@vellumai/plugin-api 0.8.10-dev.202606111255.73ec993

package/index.d.ts

@@ -0,0 +1,4738 @@
+import { z } from 'zod';
+
+declare type _AcpServerMessages = AcpSessionSpawned | AcpSessionUpdate | AcpSessionCompleted | AcpSessionError;
+
+declare interface AcpSessionCompleted {
+    type: "acp_session_completed";
+    acpSessionId: string;
+    stopReason: "end_turn" | "max_tokens" | "max_turn_requests" | "refusal" | "cancelled";
+}
+
+declare interface AcpSessionError {
+    type: "acp_session_error";
+    acpSessionId: string;
+    error: string;
+}
+
+declare interface AcpSessionSpawned {
+    type: "acp_session_spawned";
+    acpSessionId: string;
+    agent: string;
+    parentConversationId: string;
+}
+
+declare interface AcpSessionUpdate {
+    type: "acp_session_update";
+    acpSessionId: string;
+    updateType: "agent_message_chunk" | "agent_thought_chunk" | "user_message_chunk" | "tool_call" | "tool_call_update" | "plan";
+    content?: string;
+    toolCallId?: string;
+    toolTitle?: string;
+    toolKind?: string;
+    toolStatus?: string;
+}
+
+/**
+ * Why an agent turn reached a terminal state. Supplied to the `stop` hook via
+ * {@link StopContext.exitReason} and emitted on the `agent_loop_exit` event,
+ * then persisted onto the final `llm_request_logs` row of the turn (rows from
+ * intermediate turns keep a NULL reason, which is how downstream tooling and
+ * the LLM Context Inspector tell "loop kept going" from "loop is done").
+ *
+ * Values are stable wire/DB strings — they are written to SQLite and surfaced
+ * over the inspector wire format, so renaming any of them is a breaking change.
+ */
+export declare type AgentLoopExitReason = 
+/** User cancellation observed before the turn's next provider call. */
+"aborted_pre_call"
+/** Assistant message had no tool-use blocks (or no tool executor). */
+| "no_tool_calls"
+/** User cancellation observed while building the tool-results message. */
+| "aborted_post_response"
+/** User cancellation observed mid-tool-execution; completed results kept. */
+| "aborted_during_tools"
+/** A tool result requested handing back to the user. */
+| "yield_to_user"
+/** The orchestrator yielded at a checkpoint to process a queued message. */
+| "checkpoint_handoff"
+/** Context-window recovery exhausted and the turn ended with an error. */
+| "context_too_large"
+/**
+* An auto-compress rerun (post-emergency-compaction, post-tier reducer)
+* still yielded at the mid-loop budget checkpoint — the turn terminated with
+* no further recovery layer to re-enter. A pure observability signal so the
+* silent stall is attributable instead of leaving the exit reason NULL.
+*/
+| "budget_yield_unrecovered"
+/** Provider stopped because the configured output-token limit was reached. */
+| "max_tokens_reached"
+/** User cancellation landed after a non-terminal checkpoint yield. */
+| "aborted_after_checkpoint"
+/** User cancellation observed while the catch handler synthesized an error turn. */
+| "aborted_via_error"
+/** An unhandled error ended the turn. */
+| "error";
+
+declare interface AllowlistOption {
+    label: string;
+    description: string;
+    pattern: string;
+}
+
+declare interface AppDataResponse {
+    type: "app_data_response";
+    surfaceId: string;
+    callId: string;
+    success: boolean;
+    result?: unknown;
+    error?: string;
+}
+
+declare interface AppDeleteResponse {
+    type: "app_delete_response";
+    success: boolean;
+}
+
+declare interface AppDiffResponse {
+    type: "app_diff_response";
+    appId: string;
+    diff: string;
+}
+
+declare interface AppFileAtVersionResponse {
+    type: "app_file_at_version_response";
+    appId: string;
+    path: string;
+    content: string;
+}
+
+declare interface AppFilesChanged {
+    type: "app_files_changed";
+    appId: string;
+}
+
+declare interface AppHistoryResponse {
+    type: "app_history_response";
+    appId: string;
+    versions: Array<{
+        commitHash: string;
+        message: string;
+        timestamp: number;
+    }>;
+}
+
+declare interface AppPreviewResponse {
+    type: "app_preview_response";
+    appId: string;
+    preview?: string;
+}
+
+declare interface AppRestoreResponse {
+    type: "app_restore_response";
+    success: boolean;
+    error?: string;
+}
+
+declare type ApprovalRequired = z.infer<typeof ApprovalRequiredSchema>;
+
+declare const ApprovalRequiredSchema: z.ZodObject<{
+    proposal: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"http">;
+        credentialHandle: z.ZodString;
+        method: z.ZodString;
+        url: z.ZodString;
+        purpose: z.ZodString;
+        allowedUrlPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"command">;
+        credentialHandle: z.ZodString;
+        command: z.ZodString;
+        purpose: z.ZodString;
+        allowedCommandPatterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>], "type">;
+    proposalHash: z.ZodString;
+    renderedProposal: z.ZodString;
+    sessionId: z.ZodString;
+    conversationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare interface AppsListResponse {
+    type: "apps_list_response";
+    apps: Array<{
+        id: string;
+        name: string;
+        description?: string;
+        icon?: string;
+        preview?: string;
+        createdAt: number;
+        version?: string;
+        contentId?: string;
+    }>;
+}
+
+declare type _AppsServerMessages = AppDataResponse | AppsListResponse | SharedAppsListResponse | AppDeleteResponse | SharedAppDeleteResponse | ForkSharedAppResponse | BundleAppResponse | OpenBundleResponse | SignBundlePayloadRequest | GetSigningIdentityRequest | ShareAppCloudResponse | AppHistoryResponse | AppDiffResponse | AppFileAtVersionResponse | AppRestoreResponse | AppUpdatePreviewResponse | AppPreviewResponse | PublishPageResponse | UnpublishPageResponse | AppFilesChanged;
+
+declare interface AppUpdatePreviewResponse {
+    type: "app_update_preview_response";
+    success: boolean;
+    appId: string;
+}
+
+declare type AssistantActivityStateEvent = z.infer<typeof AssistantActivityStateEventSchema>;
+
+declare const AssistantActivityStateEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"assistant_activity_state">;
+    conversationId: z.ZodString;
+    activityVersion: z.ZodNumber;
+    phase: z.ZodEnum<{
+        thinking: "thinking";
+        idle: "idle";
+        streaming: "streaming";
+        tool_running: "tool_running";
+        awaiting_confirmation: "awaiting_confirmation";
+    }>;
+    anchor: z.ZodEnum<{
+        assistant_turn: "assistant_turn";
+        user_turn: "user_turn";
+        global: "global";
+    }>;
+    reason: z.ZodEnum<{
+        thinking_delta: "thinking_delta";
+        generation_cancelled: "generation_cancelled";
+        message_dequeued: "message_dequeued";
+        first_text_delta: "first_text_delta";
+        tool_use_start: "tool_use_start";
+        preview_start: "preview_start";
+        tool_result_received: "tool_result_received";
+        confirmation_requested: "confirmation_requested";
+        confirmation_resolved: "confirmation_resolved";
+        context_compacting: "context_compacting";
+        message_complete: "message_complete";
+        error_terminal: "error_terminal";
+    }>;
+    requestId: z.ZodOptional<z.ZodString>;
+    statusText: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/** Attention state metadata for a conversation's latest assistant message. */
+declare interface AssistantAttention {
+    hasUnseenLatestAssistantMessage: boolean;
+    latestAssistantMessageAt?: number;
+    lastSeenAssistantMessageAt?: number;
+    lastSeenConfidence?: string;
+    lastSeenSignalType?: string;
+}
+
+/** Daemon-side specialization of the generic event envelope. */
+export declare type AssistantEvent = AssistantEvent_2<ServerMessage>;
+
+/**
+ * Assistant Events -- shared types and SSE framing helpers.
+ *
+ * This module is intentionally free of imports from `assistant/` or any
+ * other repo-local module so it can be consumed by both the daemon and
+ * isolated skill processes without circular references.
+ *
+ * The `AssistantEvent` interface is generic over the `message` payload so
+ * the neutral package does not need to know about the daemon-side
+ * `ServerMessage` discriminated union. Consumers that want narrower
+ * typing can re-export a specialized alias, e.g.:
+ *
+ *   type AssistantEvent = BaseAssistantEvent<ServerMessage>;
+ */
+/**
+ * A single assistant event wrapping an outbound message payload.
+ *
+ * Generic over the payload type so the neutral package has zero dependency
+ * on daemon-side message schemas. The `TMessage` default of `unknown`
+ * keeps the package importable without a type argument when the caller
+ * does not care about message narrowing.
+ */
+declare interface AssistantEvent_2<TMessage = unknown> {
+    /** Globally unique event identifier (UUID). */
+    id: string;
+    /** Resolved conversation id when available. */
+    conversationId?: string;
+    /**
+     * Monotonic per-conversation sequence number. Assigned by the daemon at
+     * publish time for conversation-scoped events; absent for unscoped
+     * broadcasts. Clients track the highest observed `seq` per conversation
+     * and pass it back on reconnect to request replay of missed events.
+     */
+    seq?: number;
+    /** ISO-8601 timestamp of when the event was emitted. */
+    emittedAt: string;
+    /** Outbound message payload. */
+    message: TMessage;
+}
+
+export declare type AssistantEventCallback = (event: AssistantEvent) => void | Promise<void>;
+
+/** Filter that determines which events a subscriber receives. */
+export declare type AssistantEventFilter = {
+    /** When set, restrict delivery to events for this conversation. */
+    conversationId?: string;
+};
+
+/**
+ * Lightweight pub/sub hub for `AssistantEvent` messages.
+ *
+ * Filtering is applied at subscription level:
+ *   - `conversationId`: scoped events match subscribers with same conversationId
+ *     or no conversationId filter (broadcast to all).
+ *   - `targetCapability` (on publish): targeted events only reach subscribers
+ *     whose capabilities include the target. Untargeted events fan out to all.
+ *
+ * Client connections register as subscribers with metadata and are queryable
+ * via `listClients()`, `getMostRecentClientByCapability()`, etc.
+ */
+export declare class AssistantEventHub {
+    private readonly subscribers;
+    private readonly maxSubscribers;
+    /** Monotonic source for per-connection ids, scoped to this hub. */
+    private connectionCounter;
+    constructor(options?: {
+        maxSubscribers?: number;
+    });
+    /**
+     * Register a subscriber that will be called for each matching event.
+     *
+     * **Client deduplication:** When a client subscriber is registered with a
+     * `clientId` that already exists, all stale entries for that clientId are
+     * disposed first. This prevents subscriber stacking when clients reconnect
+     * (e.g. Chrome extension reload, SSE token refresh) before the old
+     * connection's abort signal fires.
+     *
+     * When the subscriber cap (`maxSubscribers`) has been reached, the **oldest**
+     * subscriber is evicted to make room: its `onEvict` callback is invoked (so
+     * it can close its SSE stream) and its entry is removed from the hub.
+     */
+    subscribe(subscriber: SubscriberInput): AssistantEventSubscription;
+    /**
+     * Publish an event to all matching subscribers.
+     *
+     * Matching rules:
+     * - if `excludeClientId` is set, the subscriber with that clientId is
+     *   skipped regardless of every other rule (self-echo suppression — the
+     *   client that originated the mutation does not receive its own
+     *   invalidation back through the hub).
+     * - if `targetClientId` is set, deliver only to the subscriber with that
+     *   clientId, bypassing the conversation-id filter entirely (the web-origin
+     *   event's conversationId differs from the macOS client's subscribed
+     *   conversation).
+     * - if `filter.conversationId` is set (and `targetClientId` is not), the
+     *   `event.conversationId` must equal it
+     * - if `targetCapability` is set, only subscribers whose capabilities include
+     *   it receive the event; untargeted events go to all
+     * - if `targetInterfaceId` is set, only client subscribers whose
+     *   `interfaceId` matches receive the event; process subscribers and
+     *   non-matching clients are skipped. Used to narrow legacy
+     *   broadcasts (e.g. `conversation_list_invalidated`) to a specific
+     *   client surface during a migration window.
+     *
+     * Fanout is isolated: a throwing or rejecting subscriber does not abort
+     * delivery to remaining subscribers.
+     */
+    publish(event: AssistantEvent, options?: {
+        targetCapability?: HostProxyCapability;
+        targetClientId?: string;
+        targetInterfaceId?: InterfaceId;
+        /**
+         * Skip the subscriber with this `clientId`. Used for self-echo
+         * suppression on `sync_changed`: the route handler echoes the
+         * originating tab's `X-Vellum-Client-Id` back on the event, and the
+         * hub uses it here to avoid re-delivering the invalidation to the
+         * tab that already mutated its own optimistic state.
+         */
+        excludeClientId?: string;
+    }): Promise<void>;
+    /**
+     * Return the active client subscriber with the given clientId, or
+     * `undefined` if no such subscriber exists.
+     */
+    getClientById(clientId: string): ClientEntry | undefined;
+    /**
+     * Return the verified actor principal id captured at SSE subscription time
+     * for the given client, or `undefined` if the client is unknown or
+     * connected without a principal (e.g. legacy/service tokens).
+     *
+     * Used by host proxies to bind cross-client targeted execution to the same
+     * authenticated user identity that opened the target client's SSE stream.
+     */
+    getActorPrincipalIdForClient(clientId: string): string | undefined;
+    /**
+     * Returns true when at least one active subscriber would receive the given
+     * event based on the same conversation matching rules as publish().
+     */
+    hasSubscribersForEvent(event: Pick<AssistantEvent, "conversationId">): boolean;
+    private clientEntries;
+    /**
+     * Return all active client subscribers, sorted by `lastActiveAt` descending.
+     */
+    listClients(): ClientEntry[];
+    /**
+     * Return all client subscribers that support the given capability,
+     * sorted by `lastActiveAt` descending.
+     */
+    listClientsByCapability(capability: HostProxyCapability): ClientEntry[];
+    /**
+     * Return the most recently active client that supports the given
+     * capability, or `undefined` if none exists.
+     */
+    getMostRecentClientByCapability(capability: HostProxyCapability): ClientEntry | undefined;
+    /**
+     * Return all client subscribers with the given interface type,
+     * sorted by `lastActiveAt` descending.
+     */
+    listClientsByInterface(interfaceId: InterfaceId): ClientEntry[];
+    /**
+     * Touch a client subscriber — update `lastActiveAt`. Used by heartbeat.
+     */
+    touchClient(clientId: string): void;
+    /**
+     * Force-disconnect a client by disposing all subscribers for the given
+     * `clientId`. Returns the number of disposed entries.
+     *
+     * Used by `assistant clients disconnect <clientId>` to forcibly remove
+     * stale or unwanted client connections.
+     */
+    disposeClient(clientId: string): number;
+    /** Number of currently active subscribers (useful for tests and caps). */
+    subscriberCount(): number;
+    /** Returns true if the hub can accept a subscriber without evicting anyone. */
+    hasCapacity(): boolean;
+}
+
+/**
+ * Singleton hub shared across the entire runtime process.
+ *
+ * Import and use this in daemon send paths and the SSE route.
+ */
+export declare const assistantEventHub: AssistantEventHub;
+
+/** Opaque handle returned by `subscribe`. Call `dispose()` to remove the subscription. */
+export declare interface AssistantEventSubscription {
+    dispose(): void;
+    /** True until `dispose()` has been called. */
+    readonly active: boolean;
+    /**
+     * Per-connection identifier, unique within the hub instance. Distinguishes
+     * connections that share a `clientId` (e.g. an old connection and the new
+     * one that replaced it on reconnect) so subscribe / dispose / shed log
+     * lines can be attributed to a specific connection.
+     */
+    readonly connectionId: string;
+}
+
+declare interface AssistantInboxEscalationResponse {
+    type: "assistant_inbox_escalation_response";
+    success: boolean;
+    error?: string;
+    /** List of escalations (returned on list). */
+    escalations?: Array<{
+        id: string;
+        runId: string;
+        conversationId: string;
+        channel: string;
+        requesterExternalUserId: string;
+        requesterChatId: string;
+        status: string;
+        requestSummary?: string;
+        createdAt: number;
+    }>;
+    /** Decision result (returned on decide). */
+    decision?: {
+        id: string;
+        status: string;
+        decidedAt: number;
+    };
+}
+
+declare interface AssistantStatusMessage {
+    type: "assistant_status";
+    version?: string;
+    keyFingerprint?: string;
+}
+
+declare type AssistantTextDeltaEvent = z.infer<typeof AssistantTextDeltaEventSchema>;
+
+declare const AssistantTextDeltaEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"assistant_text_delta">;
+    text: z.ZodString;
+    messageId: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare interface AssistantThinkingDelta {
+    type: "assistant_thinking_delta";
+    thinking: string;
+    conversationId?: string;
+    /** Database ID of the assistant message this thinking delta belongs to.
+     *  Same semantics as `AssistantTextDeltaEvent.messageId`. */
+    messageId?: string;
+}
+
+declare type AssistantTurnStartEvent = z.infer<typeof AssistantTurnStartEventSchema>;
+
+declare const AssistantTurnStartEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"assistant_turn_start">;
+    messageId: z.ZodString;
+    conversationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare interface AuthResult {
+    type: "auth_result";
+    success: boolean;
+    message?: string;
+}
+
+declare type AvatarUpdatedEvent = z.infer<typeof AvatarUpdatedEventSchema>;
+
+declare const AvatarUpdatedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"avatar_updated">;
+    avatarPath: z.ZodString;
+}, z.core.$strip>;
+
+declare interface BaseSubscriberEntry {
+    filter: AssistantEventFilter;
+    callback: AssistantEventCallback;
+    active: boolean;
+    onEvict: () => void;
+    connectedAt: Date;
+    lastActiveAt: Date;
+    /**
+     * Per-connection identifier, unique within the hub instance. Two entries
+     * with the same `clientId` (old vs reconnected connection) get distinct
+     * connection ids, making them traceable across subscribe / dispose / shed
+     * logs.
+     */
+    connectionId: string;
+}
+
+declare interface BookmarkCreated {
+    type: "bookmark.created";
+    bookmark: BookmarkSummary;
+}
+
+declare interface BookmarkDeleted {
+    type: "bookmark.deleted";
+    messageId: string;
+}
+
+declare type _BookmarksServerMessages = BookmarkCreated | BookmarkDeleted;
+
+/**
+ * Wire-shape representation of a bookmark, joined with the bookmarked
+ * message and its parent conversation. Mirrors
+ * `clients/shared/Network/BookmarkSummary.swift` — dates are emitted as
+ * unix-millisecond integers, and the message preview is capped to keep
+ * the list payload bounded.
+ */
+declare interface BookmarkSummary {
+    id: string;
+    messageId: string;
+    conversationId: string;
+    conversationTitle: string | null;
+    messagePreview: string;
+    /** "user" | "assistant" — kept as a free-form string so it round-trips raw. */
+    messageRole: string;
+    /** Unix milliseconds. */
+    messageCreatedAt: number;
+    /** Unix milliseconds. */
+    createdAt: number;
+}
+
+declare interface BundleAppResponse {
+    type: "bundle_app_response";
+    bundlePath: string;
+    /** Base64-encoded PNG of the generated app icon, if available. */
+    iconImageBase64?: string;
+    manifest: {
+        format_version: number;
+        name: string;
+        description?: string;
+        icon?: string;
+        created_at: string;
+        created_by: string;
+        entry: string;
+        capabilities: string[];
+        version?: string;
+        content_id?: string;
+    };
+}
+
+declare interface CardSurfaceData {
+    title: string;
+    subtitle?: string;
+    body: string;
+    metadata?: Array<{
+        label: string;
+        value: string;
+    }>;
+    /** Optional template name for specialized rendering (e.g. "weather_forecast"). */
+    template?: string;
+    /** Arbitrary data consumed by the template renderer. Shape depends on template. */
+    templateData?: Record<string, unknown>;
+}
+
+declare const CHANNEL_IDS: readonly ["telegram", "phone", "vellum", "whatsapp", "slack", "email", "platform", "a2a"];
+
+/** Channel binding metadata exposed in conversation list APIs. */
+declare interface ChannelBinding {
+    sourceChannel: ChannelId;
+    externalChatId: string;
+    externalChatName?: string | null;
+    externalThreadId?: string | null;
+    externalUserId?: string | null;
+    displayName?: string | null;
+    username?: string | null;
+    slackThread?: {
+        channelId: string;
+        threadTs: string;
+        link?: {
+            appUrl?: string;
+            webUrl?: string;
+        };
+    };
+    slackChannel?: {
+        channelId: string;
+        name?: string;
+        link?: {
+            webUrl?: string;
+        };
+    };
+}
+
+declare type ChannelId = (typeof CHANNEL_IDS)[number];
+
+declare interface ChannelVerificationSessionResponse {
+    type: "channel_verification_session_response";
+    success: boolean;
+    secret?: string;
+    instruction?: string;
+    /** Present when action is 'status'. */
+    bound?: boolean;
+    guardianExternalUserId?: string;
+    /** The channel this status pertains to (e.g. "telegram", "phone"). Present when action is 'status'. */
+    channel?: ChannelId;
+    /** The assistant ID scoped to this status. Present when action is 'status'. */
+    assistantId?: string;
+    /** The delivery chat ID for the guardian (e.g. Telegram chat ID). Present when action is 'status' and bound is true. */
+    guardianDeliveryChatId?: string;
+    /** Optional channel username/handle for the bound guardian (for UI display). */
+    guardianUsername?: string;
+    /** Optional display name for the bound guardian (for UI display). */
+    guardianDisplayName?: string;
+    /** Whether a pending verification challenge exists for this (assistantId, channel). Used by relay setup to detect active voice verification sessions. */
+    hasPendingChallenge?: boolean;
+    error?: string;
+    /** Human-readable error detail (e.g. for already_bound failures). */
+    message?: string;
+    /** Conversation ID for outbound verification flows. */
+    verificationSessionId?: string;
+    /** Epoch ms when the verification session expires. */
+    expiresAt?: number;
+    /** Epoch ms after which a resend is allowed. */
+    nextResendAt?: number;
+    /** Number of sends for this session. */
+    sendCount?: number;
+    /** Telegram deep-link URL for bootstrap (M3 placeholder). */
+    telegramBootstrapUrl?: string;
+    /** True when the outbound session is still in pending_bootstrap state (Telegram handle flow). Prevents the client from clearing the bootstrap URL during status polling. */
+    pendingBootstrap?: boolean;
+}
+
+declare interface ChoiceOption {
+    id: string;
+    title: string;
+    description?: string;
+    /** Visually highlight this option as the assistant's recommendation. */
+    recommended?: boolean;
+    /** Optional structured payload returned with this choice. */
+    data?: Record<string, unknown>;
+}
+
+declare interface ChoiceSurfaceData {
+    description?: string;
+    options: ChoiceOption[];
+    selectionMode?: "single" | "multiple";
+    /**
+     * When true, clicking an option submits it immediately. Defaults to true for
+     * single-select choice surfaces.
+     */
+    commitOnSelect?: boolean;
+    submitLabel?: string;
+}
+
+declare interface ClawhubSlimSkill extends SlimSkillBase {
+    origin: "clawhub";
+    slug: string;
+    author: string;
+    stars: number;
+    installs: number;
+    reports: number;
+    publishedAt?: string;
+    version: string;
+}
+
+declare interface ClientEntry extends BaseSubscriberEntry {
+    type: "client";
+    clientId: string;
+    interfaceId: InterfaceId;
+    capabilities: HostProxyCapability[];
+    machineName?: string;
+    /**
+     * The verified actor principal id (canonical user identity, parsed from JWT
+     * `sub`) of the user that opened this SSE connection, when available.
+     *
+     * Populated from `AuthContext.actorPrincipalId` at SSE subscription time.
+     * Used by host proxies to gate cross-client targeted execution to the same
+     * authenticated user identity. May be `undefined` for legacy or
+     * service-token connections that have no principal.
+     */
+    actorPrincipalId?: string;
+}
+
+/** Sent by the daemon to update a client-side setting (e.g. activation key). */
+declare interface ClientSettingsUpdate {
+    type: "client_settings_update";
+    /** The setting key to update (e.g. "activationKey"). */
+    key: string;
+    /** The new value for the setting. */
+    value: string;
+}
+
+declare type CompactionCircuitClosedEvent = z.infer<typeof CompactionCircuitClosedEventSchema>;
+
+declare const CompactionCircuitClosedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"compaction_circuit_closed">;
+    conversationId: z.ZodString;
+}, z.core.$strip>;
+
+declare type CompactionCircuitOpenEvent = z.infer<typeof CompactionCircuitOpenEventSchema>;
+
+declare const CompactionCircuitOpenEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"compaction_circuit_open">;
+    conversationId: z.ZodString;
+    reason: z.ZodLiteral<"3_consecutive_failures">;
+    openUntil: z.ZodNumber;
+}, z.core.$strip>;
+
+declare type _ComputerUseServerMessages = RecordingStart | RecordingStop | RecordingPause | RecordingResume;
+
+/** Sent by the daemon when workspace config.json changes on disk. */
+declare interface ConfigChanged {
+    type: "config_changed";
+}
+
+declare type ConfirmationRequestEvent = z.infer<typeof ConfirmationRequestEventSchema>;
+
+declare const ConfirmationRequestEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"confirmation_request">;
+    requestId: z.ZodString;
+    toolName: z.ZodString;
+    input: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    riskLevel: z.ZodString;
+    riskReason: z.ZodOptional<z.ZodString>;
+    isContainerized: z.ZodOptional<z.ZodBoolean>;
+    executionTarget: z.ZodOptional<z.ZodEnum<{
+        sandbox: "sandbox";
+        host: "host";
+    }>>;
+    allowlistOptions: z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        description: z.ZodString;
+        pattern: z.ZodString;
+    }, z.core.$strip>>;
+    scopeOptions: z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        scope: z.ZodString;
+    }, z.core.$strip>>;
+    directoryScopeOptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        scope: z.ZodString;
+    }, z.core.$strip>>>;
+    diff: z.ZodOptional<z.ZodObject<{
+        filePath: z.ZodString;
+        oldContent: z.ZodString;
+        newContent: z.ZodString;
+        isNewFile: z.ZodBoolean;
+    }, z.core.$strip>>;
+    conversationId: z.ZodOptional<z.ZodString>;
+    persistentDecisionsAllowed: z.ZodOptional<z.ZodBoolean>;
+    toolUseId: z.ZodOptional<z.ZodString>;
+    acpToolKind: z.ZodOptional<z.ZodString>;
+    acpOptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        optionId: z.ZodString;
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            allow_once: "allow_once";
+            allow_always: "allow_always";
+            reject_once: "reject_once";
+            reject_always: "reject_always";
+        }>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+
+/**
+ * Authoritative per-request confirmation state transition emitted by the daemon.
+ *
+ * The client must use this event (not local phrase inference) to update
+ * confirmation bubble state.
+ */
+declare interface ConfirmationStateChanged {
+    type: "confirmation_state_changed";
+    conversationId: string;
+    requestId: string;
+    state: "pending" | "approved" | "denied" | "timed_out" | "resolved_stale";
+    source: "button" | "inline_nl" | "auto_deny" | "timeout" | "system";
+    /** requestId of the user message that triggered this transition. */
+    causedByRequestId?: string;
+    /** Normalized user text for analytics/debug (e.g. "approve", "deny"). */
+    decisionText?: string;
+    /** The tool_use block ID this confirmation applies to, for disambiguating parallel tool calls. */
+    toolUseId?: string;
+}
+
+declare interface ConfirmationSurfaceData {
+    message: string;
+    detail?: string;
+    confirmLabel?: string;
+    confirmedLabel?: string;
+    cancelLabel?: string;
+    destructive?: boolean;
+}
+
+declare interface ContactChannelPayload {
+    id: string;
+    type: string;
+    address: string;
+    isPrimary: boolean;
+    externalUserId?: string;
+    status: string;
+    policy: string;
+    verifiedAt?: number;
+    verifiedVia?: string;
+    lastSeenAt?: number;
+    interactionCount?: number;
+    lastInteraction?: number;
+    revokedReason?: string;
+    blockedReason?: string;
+}
+
+declare interface ContactPayload {
+    id: string;
+    displayName: string;
+    role: "guardian" | "contact";
+    notes?: string;
+    contactType?: string;
+    lastInteraction?: number;
+    interactionCount: number;
+    channels: ContactChannelPayload[];
+}
+
+declare type ContactRequestEvent = z.infer<typeof ContactRequestEventSchema>;
+
+declare const ContactRequestEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"contact_request">;
+    requestId: z.ZodString;
+    channel: z.ZodOptional<z.ZodString>;
+    placeholder: z.ZodOptional<z.ZodString>;
+    label: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/** Server push — lightweight invalidation signal: the contacts table has been mutated, refetch your list. */
+declare interface ContactsChanged {
+    type: "contacts_changed";
+}
+
+declare interface ContactsInviteResponse {
+    type: "contacts_invite_response";
+    success: boolean;
+    error?: string;
+    /** Single invite (returned on create/revoke). Token field is only present on create. */
+    invite?: {
+        id: string;
+        sourceChannel: string;
+        token?: string;
+        tokenHash: string;
+        maxUses: number;
+        useCount: number;
+        expiresAt: number | null;
+        status: string;
+        note?: string;
+        createdAt: number;
+    };
+    /** List of invites (returned on list). */
+    invites?: Array<{
+        id: string;
+        sourceChannel: string;
+        tokenHash: string;
+        maxUses: number;
+        useCount: number;
+        expiresAt: number | null;
+        status: string;
+        note?: string;
+        createdAt: number;
+    }>;
+}
+
+declare interface ContactsResponse {
+    type: "contacts_response";
+    success: boolean;
+    error?: string;
+    contact?: ContactPayload;
+    contacts?: ContactPayload[];
+}
+
+declare type _ContactsServerMessages = ContactsResponse | ContactsChanged | ContactRequestEvent;
+
+export declare type ContentBlock = TextContent | ThinkingContent | RedactedThinkingContent | ImageContent | FileContent | ToolUseContent | ToolResultContent | ServerToolUseContent | WebSearchToolResultContent;
+
+/**
+ * Emitted after a compaction turn completes (both auto-compaction and
+ * `/compact`). Carries the fresh `estimatedInputTokens` so clients can refresh
+ * the context-window indicator without waiting for the next `usage_update`.
+ *
+ * Scoped per-conversation — see `CompactionCircuitOpenEvent` doc for why.
+ */
+declare interface ContextCompacted {
+    type: "context_compacted";
+    conversationId: string;
+    previousEstimatedInputTokens: number;
+    estimatedInputTokens: number;
+    maxInputTokens: number;
+    thresholdTokens: number;
+    compactedMessages: number;
+    summaryCalls: number;
+    summaryInputTokens: number;
+    summaryOutputTokens: number;
+    summaryModel: string;
+    /**
+     * Quality signals for the generated summary. Emitted for every
+     * compaction (including truncation-only paths where the summary text
+     * is unchanged from the prior pass). Consumers can use these to detect
+     * regressions without needing to read the summary text itself.
+     *
+     * - `summaryCharCount`: length of the produced summary text.
+     * - `summaryHeaderCount`: number of `## ` section headers in the summary.
+     * - `summaryHadMemoryEcho`: `true` if the summary contains any runtime
+     *   injection tag (e.g. `<memory`, `<turn_context>`, `<workspace>`).
+     *   Should always be `false` — `true` indicates the compaction strip
+     *   logic failed to remove an injected block from the summarizer input.
+     */
+    summaryCharCount?: number;
+    summaryHeaderCount?: number;
+    summaryHadMemoryEcho?: boolean;
+}
+
+declare type ConversationErrorEvent = z.infer<typeof ConversationErrorEventSchema>;
+
+declare const ConversationErrorEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"conversation_error">;
+    conversationId: z.ZodString;
+    code: z.ZodEnum<{
+        PROVIDER_NETWORK: "PROVIDER_NETWORK";
+        PROVIDER_RATE_LIMIT: "PROVIDER_RATE_LIMIT";
+        MANAGED_USAGE_LIMIT: "MANAGED_USAGE_LIMIT";
+        PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED";
+        PROVIDER_API: "PROVIDER_API";
+        IMAGE_TOO_LARGE: "IMAGE_TOO_LARGE";
+        PROVIDER_BILLING: "PROVIDER_BILLING";
+        PROVIDER_ORDERING: "PROVIDER_ORDERING";
+        PROVIDER_WEB_SEARCH: "PROVIDER_WEB_SEARCH";
+        PROVIDER_NOT_CONFIGURED: "PROVIDER_NOT_CONFIGURED";
+        PROVIDER_INVALID_KEY: "PROVIDER_INVALID_KEY";
+        MANAGED_KEY_INVALID: "MANAGED_KEY_INVALID";
+        CONTEXT_TOO_LARGE: "CONTEXT_TOO_LARGE";
+        BUDGET_YIELD_UNRECOVERED: "BUDGET_YIELD_UNRECOVERED";
+        MAX_TOKENS_REACHED: "MAX_TOKENS_REACHED";
+        CONVERSATION_ABORTED: "CONVERSATION_ABORTED";
+        CONVERSATION_PROCESSING_FAILED: "CONVERSATION_PROCESSING_FAILED";
+        DISK_SPACE_CRITICAL: "DISK_SPACE_CRITICAL";
+        REGENERATE_FAILED: "REGENERATE_FAILED";
+        UNKNOWN: "UNKNOWN";
+    }>;
+    userMessage: z.ZodString;
+    retryable: z.ZodBoolean;
+    debugDetails: z.ZodOptional<z.ZodString>;
+    errorCategory: z.ZodOptional<z.ZodString>;
+    connectionName: z.ZodOptional<z.ZodString>;
+    profileName: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare interface ConversationForkParent {
+    conversationId: string;
+    messageId: string;
+    title: string;
+}
+
+/**
+ * Broadcast to clients when a conversation's inference-profile override
+ * changes. `profile` is the profile name (a key in `llm.profiles`) or
+ * `null` when the override is cleared and the conversation falls back to
+ * the workspace `llm.activeProfile` resolution.
+ */
+declare interface ConversationInferenceProfileUpdated {
+    type: "conversation_inference_profile_updated";
+    conversationId: string;
+    profile: string | null;
+    sessionId?: string | null;
+    expiresAt?: number | null;
+}
+
+declare interface ConversationInfo {
+    type: "conversation_info";
+    conversationId: string;
+    title: string;
+    correlationId?: string;
+    conversationType?: ConversationType;
+    /**
+     * Per-conversation override for the LLM inference profile. `undefined`
+     * means the conversation inherits the workspace `llm.activeProfile`.
+     */
+    inferenceProfile?: string;
+}
+
+declare type ConversationListInvalidatedEvent = z.infer<typeof ConversationListInvalidatedEventSchema>;
+
+declare const ConversationListInvalidatedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"conversation_list_invalidated">;
+    reason: z.ZodEnum<{
+        deleted: "deleted";
+        created: "created";
+        renamed: "renamed";
+        reordered: "reordered";
+        seen_changed: "seen_changed";
+    }>;
+}, z.core.$strip>;
+
+declare interface ConversationListResponse {
+    type: "conversation_list_response";
+    conversations: Array<{
+        id: string;
+        title: string;
+        createdAt?: number;
+        updatedAt: number;
+        conversationType?: ConversationType;
+        source?: string;
+        scheduleJobId?: string;
+        channelBinding?: ChannelBinding;
+        conversationOriginChannel?: ChannelId;
+        conversationOriginInterface?: InterfaceId;
+        assistantAttention?: AssistantAttention;
+        displayOrder?: number;
+        isPinned?: boolean;
+        forkParent?: ConversationForkParent;
+        /**
+         * Per-conversation override for the LLM inference profile. Omitted when
+         * the conversation inherits the workspace `llm.activeProfile`.
+         */
+        inferenceProfile?: string;
+    }>;
+    /** Whether more conversations exist beyond the returned page. */
+    hasMore?: boolean;
+}
+
+declare interface ConversationsClearResponse {
+    type: "conversations_clear_response";
+    cleared: number;
+}
+
+declare interface ConversationSearchMatchingMessage {
+    messageId: string;
+    role: string;
+    /** Plain-text excerpt around the match, truncated to ~200 chars. */
+    excerpt: string;
+    createdAt: number;
+}
+
+declare interface ConversationSearchResponse {
+    type: "conversation_search_response";
+    query: string;
+    results: ConversationSearchResultItem[];
+}
+
+declare interface ConversationSearchResultItem {
+    conversationId: string;
+    conversationTitle: string | null;
+    conversationUpdatedAt: number;
+    matchingMessages: ConversationSearchMatchingMessage[];
+}
+
+declare type _ConversationsServerMessages = AuthResult | PongMessage | AssistantStatusMessage | GenerationCancelledEvent | GenerationHandoffEvent | ModelInfo | HistoryResponse | UndoComplete | UsageUpdateEvent | UsageProgress | UsageResponse | ContextCompacted | CompactionCircuitOpenEvent | CompactionCircuitClosedEvent | ConversationErrorEvent | ConversationInfo | ConversationTitleUpdatedEvent | ConversationListResponse | ConversationsClearResponse | ConversationSearchResponse | MessageContentResponse | ConversationListInvalidatedEvent | ScheduleConversationCreated | OpenConversation;
+
+declare type ConversationTitleUpdatedEvent = z.infer<typeof ConversationTitleUpdatedEventSchema>;
+
+declare const ConversationTitleUpdatedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"conversation_title_updated">;
+    conversationId: z.ZodString;
+    title: z.ZodString;
+}, z.core.$strip>;
+
+declare type ConversationType = "standard" | "background" | "scheduled";
+
+declare interface CopyBlockSurfaceData {
+    text: string;
+    label?: string;
+    language?: string;
+}
+
+declare interface CustomSlimSkill extends SlimSkillBase {
+    origin: "custom";
+}
+
+declare type _DiagnosticsServerMessages = EnvVarsResponse | DictationResponse;
+
+declare interface DictationResponse {
+    type: "dictation_response";
+    text: string;
+    mode: "dictation" | "command" | "action";
+    actionPlan?: string;
+    resolvedProfileId?: string;
+    profileSource?: "request" | "app_mapping" | "default" | "fallback";
+}
+
+declare interface DiffInfo {
+    filePath: string;
+    oldContent: string;
+    newContent: string;
+    isNewFile: boolean;
+}
+
+declare type DiskPressureStatusChangedEvent = z.infer<typeof DiskPressureStatusChangedEventSchema>;
+
+declare const DiskPressureStatusChangedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"disk_pressure_status_changed">;
+    status: z.ZodObject<{
+        enabled: z.ZodBoolean;
+        state: z.ZodEnum<{
+            ok: "ok";
+            unknown: "unknown";
+            disabled: "disabled";
+            warning: "warning";
+            critical: "critical";
+        }>;
+        locked: z.ZodBoolean;
+        acknowledged: z.ZodBoolean;
+        overrideActive: z.ZodBoolean;
+        effectivelyLocked: z.ZodBoolean;
+        lockId: z.ZodNullable<z.ZodString>;
+        usagePercent: z.ZodNullable<z.ZodNumber>;
+        thresholdPercent: z.ZodNumber;
+        path: z.ZodNullable<z.ZodString>;
+        lastCheckedAt: z.ZodNullable<z.ZodString>;
+        blockedCapabilities: z.ZodArray<z.ZodEnum<{
+            "agent-turns": "agent-turns";
+            "background-work": "background-work";
+            "remote-ingress": "remote-ingress";
+        }>>;
+        error: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+
+/** Distributive Omit that preserves union discrimination. */
+declare type DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never;
+
+declare type DocumentCommentCreatedEvent = z.infer<typeof DocumentCommentCreatedEventSchema>;
+
+declare const DocumentCommentCreatedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"document_comment_created">;
+    conversationId: z.ZodString;
+    surfaceId: z.ZodString;
+    comment: z.ZodObject<{
+        id: z.ZodString;
+        surfaceId: z.ZodString;
+        author: z.ZodString;
+        content: z.ZodString;
+        anchorStart: z.ZodOptional<z.ZodNumber>;
+        anchorEnd: z.ZodOptional<z.ZodNumber>;
+        anchorText: z.ZodOptional<z.ZodString>;
+        parentCommentId: z.ZodOptional<z.ZodString>;
+        status: z.ZodString;
+        createdAt: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+
+declare type DocumentCommentDeletedEvent = z.infer<typeof DocumentCommentDeletedEventSchema>;
+
+declare const DocumentCommentDeletedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"document_comment_deleted">;
+    conversationId: z.ZodString;
+    surfaceId: z.ZodString;
+    commentId: z.ZodString;
+}, z.core.$strip>;
+
+declare type DocumentCommentReopenedEvent = z.infer<typeof DocumentCommentReopenedEventSchema>;
+
+declare const DocumentCommentReopenedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"document_comment_reopened">;
+    conversationId: z.ZodString;
+    surfaceId: z.ZodString;
+    commentId: z.ZodString;
+}, z.core.$strip>;
+
+declare type DocumentCommentResolvedEvent = z.infer<typeof DocumentCommentResolvedEventSchema>;
+
+declare const DocumentCommentResolvedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"document_comment_resolved">;
+    conversationId: z.ZodString;
+    surfaceId: z.ZodString;
+    commentId: z.ZodString;
+    resolvedBy: z.ZodString;
+}, z.core.$strip>;
+
+declare type _DocumentCommentsServerMessages = DocumentCommentCreatedEvent | DocumentCommentResolvedEvent | DocumentCommentReopenedEvent | DocumentCommentDeletedEvent;
+
+declare interface DocumentEditorShow {
+    type: "document_editor_show";
+    conversationId: string;
+    surfaceId: string;
+    title: string;
+    initialContent: string;
+}
+
+declare type DocumentEditorUpdateEvent = z.infer<typeof DocumentEditorUpdateEventSchema>;
+
+declare const DocumentEditorUpdateEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"document_editor_update">;
+    conversationId: z.ZodString;
+    surfaceId: z.ZodString;
+    markdown: z.ZodString;
+    mode: z.ZodString;
+}, z.core.$strip>;
+
+declare interface DocumentListResponse {
+    type: "document_list_response";
+    documents: Array<{
+        surfaceId: string;
+        conversationId: string;
+        title: string;
+        wordCount: number;
+        createdAt: number;
+        updatedAt: number;
+    }>;
+}
+
+declare interface DocumentLoadResponse {
+    type: "document_load_response";
+    surfaceId: string;
+    conversationId: string;
+    title: string;
+    content: string;
+    wordCount: number;
+    createdAt: number;
+    updatedAt: number;
+    success: boolean;
+    error?: string;
+}
+
+declare interface DocumentPreviewSurfaceData {
+    title: string;
+    surfaceId: string;
+    subtitle?: string;
+}
+
+declare interface DocumentSaveResponse {
+    type: "document_save_response";
+    surfaceId: string;
+    success: boolean;
+    error?: string;
+}
+
+declare type _DocumentsServerMessages = DocumentEditorShow | DocumentEditorUpdateEvent | DocumentSaveResponse | DocumentLoadResponse | DocumentListResponse;
+
+declare interface DynamicPagePreview {
+    title: string;
+    subtitle?: string;
+    description?: string;
+    icon?: string;
+    metrics?: Array<{
+        label: string;
+        value: string;
+    }>;
+    context?: "app_create" | "general";
+    previewImage?: string;
+}
+
+declare interface DynamicPageSurfaceData {
+    html: string;
+    width?: number;
+    height?: number;
+    appId?: string;
+    /** Filesystem directory name for this app (may differ from `appId`). */
+    dirName?: string;
+    reloadGeneration?: number;
+    status?: string;
+    preview?: DynamicPagePreview;
+}
+
+declare interface EnvVarsResponse {
+    type: "env_vars_response";
+    vars: Record<string, string>;
+}
+
+declare type ErrorCategory = "permission_denied" | "auth" | "tool_failure" | "unexpected";
+
+declare type ErrorEvent_2 = z.infer<typeof ErrorEventSchema>;
+
+declare const ErrorEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"error">;
+    message: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodString>;
+    errorCategory: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/**
+ * Tool-related type declarations shared between the daemon and any
+ * skill-side package that needs to describe tools, permission risk, or tool
+ * execution results on the wire.
+ *
+ * Pure type-level declarations only (+ the `RiskLevel` enum, which is a value
+ * but is safely cross-package). No runtime helpers live here — the assistant
+ * keeps all behavior functions in `assistant/src/tools/` and re-exports the
+ * types from this file.
+ *
+ * Heavy daemon-internal references (CES client, host-proxy classes, trust
+ * classifications, interface IDs, content blocks, CES `ApprovalRequired`)
+ * are held as opaque `unknown` / broadened-`string` placeholders on this
+ * side so the contracts package never reaches into the assistant or the
+ * service-contracts runtime. The assistant redeclares `Tool`, `ToolContext`,
+ * `ToolExecutionResult`, `ToolExecutedEvent`, `ToolLifecycleEvent`,
+ * `ToolLifecycleEventHandler`, and `ProxyToolResolver` in
+ * `assistant/src/tools/types.ts` with the concrete types in place, so
+ * existing call sites keep their full type information. The two sides are
+ * structurally independent — no inheritance, no intersection — which
+ * avoids TypeScript's contravariance mismatches on lifecycle-event
+ * handlers.
+ */
+declare type ExecutionTarget = "sandbox" | "host";
+
+/**
+ * Telemetry fields stamped centrally by the executor's `emitLifecycleEvent`
+ * on terminal (executed/error) lifecycle events.
+ */
+declare interface ExecutorTelemetryStamp {
+    /**
+     * Model attribution snapshot for the conversation at invocation time.
+     * Copied from {@link ToolContext.attribution} by the executor; `null` when
+     * resolution failed or no attribution was available.
+     */
+    attribution?: UsageAttributionSnapshot | null;
+    /**
+     * Serialized byte size of the RAW tool input, stamped by the executor
+     * before sensitive-field sanitization rewrites `input`. Only the size
+     * leaves the device, never the payload.
+     */
+    inputBytes?: number | null;
+    /**
+     * Byte size of the RAW tool result content, stamped by the executor
+     * before sensitive-output extraction rewrites `result.content`. Only
+     * stamped on `executed` events: error events carry no executor-side
+     * result — the audit listener sizes the error string it builds itself,
+     * which never goes through sanitization, so it is already raw. Only the
+     * size leaves the device, never the payload.
+     */
+    resultBytes?: number | null;
+}
+
+export declare interface FileContent {
+    type: "file";
+    source: {
+        type: "base64";
+        media_type: string;
+        data: string;
+        filename: string;
+    };
+    extracted_text?: string;
+    /**
+     * Internal id linking this block to a row in the attachments table.
+     * Set when the file block originates from a persisted user-message
+     * attachment so downstream consumers (DB joins, inline-chip
+     * positioning) can correlate the block back to its attachment id.
+     * Stripped by `daemon/handlers/shared.ts` before sending to the
+     * model.
+     */
+    _attachmentId?: string;
+}
+
+declare interface FileUploadSurfaceData {
+    prompt: string;
+    acceptedTypes?: string[];
+    maxFiles?: number;
+    maxSizeBytes?: number;
+}
+
+declare interface FilingConfigResponse {
+    type: "filing_config_response";
+    enabled: boolean;
+    intervalMs: number;
+    activeHoursStart: number | null;
+    activeHoursEnd: number | null;
+    nextRunAt: number | null;
+    lastRunAt: number | null;
+    success: boolean;
+    error?: string;
+}
+
+declare interface FilingRunNowResponse {
+    type: "filing_run_now_response";
+    success: boolean;
+    ran: boolean;
+    error?: string;
+}
+
+declare interface ForkSharedAppResponse {
+    type: "fork_shared_app_response";
+    success: boolean;
+    appId?: string;
+    name?: string;
+    error?: string;
+}
+
+declare interface FormField {
+    id: string;
+    type: "text" | "textarea" | "select" | "toggle" | "number" | "password";
+    label: string;
+    placeholder?: string;
+    required?: boolean;
+    defaultValue?: string | number | boolean;
+    options?: Array<{
+        label: string;
+        value: string;
+    }>;
+}
+
+declare interface FormPage {
+    id: string;
+    title: string;
+    description?: string;
+    fields: FormField[];
+}
+
+declare interface FormSurfaceData {
+    description?: string;
+    fields: FormField[];
+    submitLabel?: string;
+    pages?: FormPage[];
+    pageLabels?: {
+        next?: string;
+        back?: string;
+        submit?: string;
+    };
+}
+
+/** Response to a generate_avatar request indicating success or failure. */
+declare interface GenerateAvatarResponse {
+    type: "generate_avatar_response";
+    /** Whether the avatar was generated successfully. */
+    success: boolean;
+    /** Error message when success is false. */
+    error?: string;
+}
+
+declare type GenerationCancelledEvent = z.infer<typeof GenerationCancelledEventSchema>;
+
+declare const GenerationCancelledEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"generation_cancelled">;
+    conversationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare type GenerationHandoffEvent = z.infer<typeof GenerationHandoffEventSchema>;
+
+declare const GenerationHandoffEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"generation_handoff">;
+    conversationId: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    queuedCount: z.ZodNumber;
+    messageId: z.ZodOptional<z.ZodString>;
+    attachments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        filename: z.ZodString;
+        mimeType: z.ZodString;
+        data: z.ZodString;
+        sourceType: z.ZodOptional<z.ZodEnum<{
+            host_file: "host_file";
+            sandbox_file: "sandbox_file";
+            tool_block: "tool_block";
+        }>>;
+        sizeBytes: z.ZodOptional<z.ZodNumber>;
+        thumbnailData: z.ZodOptional<z.ZodString>;
+        fileBacked: z.ZodOptional<z.ZodBoolean>;
+        filePath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    attachmentWarnings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+
+/**
+ * Retrieve a secret from secure storage. Convenience wrapper over
+ * `getSecureKeyResultAsync` that returns only the value.
+ */
+export declare function getSecureKeyAsync(account: string): Promise<string | undefined>;
+
+declare interface GetSigningIdentityRequest {
+    type: "get_signing_identity";
+    requestId: string;
+}
+
+declare interface GuardianActionDecisionResponse {
+    type: "guardian_action_decision_response";
+    applied: boolean;
+    reason?: string;
+    resolverFailureReason?: string;
+    requestId?: string;
+    userText?: string;
+    /** Resolver reply text for the guardian (e.g. verification code for access requests). */
+    replyText?: string;
+}
+
+declare interface GuardianActionsPendingResponse {
+    type: "guardian_actions_pending_response";
+    conversationId: string;
+    prompts: GuardianDecisionPrompt[];
+}
+
+declare type _GuardianActionsServerMessages = GuardianActionsPendingResponse | GuardianActionDecisionResponse;
+
+declare interface GuardianDecisionAction {
+    /** Canonical action identifier. */
+    action: string;
+    /** Human-readable label for the action. */
+    label: string;
+    /** Short explanation shown in rich-UI legends (Telegram, Slack). */
+    description?: string;
+}
+
+/**
+ * Shared types for the guardian decision primitive.
+ *
+ * All decision entrypoints (callback buttons, conversational engine, legacy
+ * parser, requester self-cancel) use these types to route through the
+ * unified `applyGuardianDecision` primitive.
+ */
+/** Structured model for prompts shown to guardians. */
+declare interface GuardianDecisionPrompt {
+    requestId: string;
+    /** Short human-readable code for the request. */
+    requestCode: string;
+    state: "pending" | "followup_awaiting_choice" | "expired_superseded_with_active_call";
+    questionText: string;
+    toolName: string | null;
+    actions: GuardianDecisionAction[];
+    expiresAt: number;
+    conversationId: string;
+    callSessionId: string | null;
+    /**
+     * Canonical request kind (e.g. 'tool_approval', 'pending_question').
+     * Present when the prompt originates from the canonical guardian request
+     * store. Absent for legacy-only prompts.
+     */
+    kind?: string;
+    /** Human-readable preview of the command being approved (e.g. shell command). */
+    commandPreview?: string;
+    /** Risk level label for the request (e.g. 'low', 'medium', 'high'). */
+    riskLevel?: string;
+    /** Short activity description for richer prompt display. */
+    activityText?: string;
+    /** Where the tool will execute — sandbox or host. */
+    executionTarget?: "sandbox" | "host";
+}
+
+declare interface HeartbeatAlert {
+    type: "heartbeat_alert";
+    title: string;
+    body: string;
+}
+
+declare interface HeartbeatChecklistResponse {
+    type: "heartbeat_checklist_response";
+    content: string;
+    isDefault: boolean;
+}
+
+declare interface HeartbeatChecklistWriteResponse {
+    type: "heartbeat_checklist_write_response";
+    success: boolean;
+    error?: string;
+}
+
+declare interface HeartbeatConfigResponse {
+    type: "heartbeat_config_response";
+    enabled: boolean;
+    intervalMs: number;
+    activeHoursStart: number | null;
+    activeHoursEnd: number | null;
+    nextRunAt: number | null;
+    lastRunAt: number | null;
+    success: boolean;
+    error?: string;
+}
+
+/** Server push — broadcast when a heartbeat creates a conversation. */
+declare interface HeartbeatConversationCreated {
+    type: "heartbeat_conversation_created";
+    conversationId: string;
+    title: string;
+}
+
+declare interface HeartbeatRunNowResponse {
+    type: "heartbeat_run_now_response";
+    success: boolean;
+    error?: string;
+}
+
+declare interface HeartbeatRunsListResponse {
+    type: "heartbeat_runs_list_response";
+    runs: Array<{
+        id: string;
+        scheduledFor: number;
+        startedAt: number | null;
+        finishedAt: number | null;
+        durationMs: number | null;
+        status: string;
+        skipReason: string | null;
+        error: string | null;
+        conversationId: string | null;
+        createdAt: number;
+    }>;
+}
+
+declare interface HistoryResponse {
+    type: "history_response";
+    conversationId: string;
+    messages: Array<{
+        /** Database ID used by clients for the rendered message. */
+        id?: string;
+        role: string;
+        text: string;
+        timestamp: number;
+        toolCalls?: HistoryResponseToolCall[];
+        /** True when tool_use blocks appeared before any text block in the original content. */
+        toolCallsBeforeText?: boolean;
+        attachments?: UserMessageAttachment[];
+        /** Text segments split by tool-call boundaries. Preserves interleaving order. */
+        textSegments?: string[];
+        /** Content block ordering using "text:N", "tool:N", "surface:N" encoding. */
+        contentOrder?: string[];
+        /** UI surfaces (widgets) embedded in the message. */
+        surfaces?: HistoryResponseSurface[];
+        /** Present when this message is a subagent lifecycle notification (running/completed/failed/aborted). */
+        subagentNotification?: {
+            subagentId: string;
+            label: string;
+            status: "running" | "completed" | "failed" | "aborted";
+            error?: string;
+            conversationId?: string;
+            objective?: string;
+        };
+        /** True when text or tool result content was truncated due to maxTextChars/maxToolResultChars. */
+        wasTruncated?: boolean;
+    }>;
+    /** Whether older messages exist beyond the returned page. */
+    hasMore: boolean;
+    /** Timestamp of the oldest message in the response (client uses as next pagination cursor). */
+    oldestTimestamp?: number;
+    /** ID of the oldest message in the response (tie-breaker for same-millisecond cursors). */
+    oldestMessageId?: string;
+}
+
+declare interface HistoryResponseSurface {
+    surfaceId: string;
+    surfaceType: string;
+    title?: string;
+    data: Record<string, unknown>;
+    actions?: Array<{
+        id: string;
+        label: string;
+        style?: string;
+        data?: Record<string, unknown>;
+    }>;
+    display?: string;
+    /** True when the surface was completed (e.g. form submitted, action taken). */
+    completed?: boolean;
+    /** Human-readable summary shown in the completion chip. */
+    completionSummary?: string;
+}
+
+declare interface HistoryResponseToolCall {
+    name: string;
+    input: Record<string, unknown>;
+    result?: string;
+    isError?: boolean;
+    /** Base64-encoded image data from tool contentBlocks (e.g. browser_screenshot). @deprecated Use imageDataList. */
+    imageData?: string;
+    /** Base64-encoded image data from tool contentBlocks (e.g. browser_screenshot, image generation). */
+    imageDataList?: string[];
+    /** Unix ms when the tool started executing. */
+    startedAt?: number;
+    /** Unix ms when the tool completed. */
+    completedAt?: number;
+    /** Confirmation decision for this tool call: "approved" | "denied" | "timed_out". */
+    confirmationDecision?: string;
+    /** Friendly label for the confirmation (e.g. "Edit File", "Run Command"). */
+    confirmationLabel?: string;
+    /** Risk level at the time of invocation ("low" | "medium" | "high" | "unknown"). */
+    riskLevel?: string;
+    /** Human-readable reason for the risk classification. */
+    riskReason?: string;
+    /**
+     * @deprecated Use `approvalMode` and `approvalReason` instead.
+     * Kept for backward compatibility during the migration window.
+     */
+    autoApproved?: boolean;
+    /** How the approval decision was reached: prompted, auto, blocked, or unknown (legacy). */
+    approvalMode?: string;
+    /** Why the approval decision was reached (stable enum for client display). */
+    approvalReason?: string;
+    /** Snapshot of the auto-approve threshold at execution time. */
+    riskThreshold?: string;
+}
+
+declare type HomeFeedUpdatedEvent = z.infer<typeof HomeFeedUpdatedEventSchema>;
+
+declare const HomeFeedUpdatedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"home_feed_updated">;
+    updatedAt: z.ZodString;
+    newItemCount: z.ZodNumber;
+}, z.core.$strip>;
+
+declare type _HomeServerMessages = RelationshipStateUpdatedEvent | HomeFeedUpdatedEvent;
+
+/** Union of every hook name declared in {@link HOOKS}. */
+export declare type HookName = (typeof HOOKS)[keyof typeof HOOKS];
+
+/**
+ * Public hook-name constants.
+ *
+ * Plugin authors reference hooks by name in two places: the keys on
+ * `Plugin.hooks` and the daemon's `runHook(name, ctx)` call sites.
+ * Centralizing the string literals here keeps the typo surface minimal
+ * and lets call sites import a typed constant instead of repeating a
+ * free-form string.
+ *
+ * New hooks land here as additional `HOOKS.*` entries. The runtime
+ * `runHook(name, ctx)` accepts any string (so test fixtures and
+ * forward-compat hooks can still chain through), but call sites in
+ * first-party code should always reach for a `HOOKS.*` constant.
+ */
+export declare const HOOKS: {
+    /** Plugin bootstrap. Fires once when the daemon loads the plugin. */
+    readonly INIT: "init";
+    /** Plugin teardown. Fires once when the daemon unloads the plugin. */
+    readonly SHUTDOWN: "shutdown";
+    /** Fires once per user turn, immediately before the agent loop receives `runMessages`. */
+    readonly USER_PROMPT_SUBMIT: "user-prompt-submit";
+    /** Fires immediately before each provider call. A hook may edit the outbound request (e.g. the system prompt) and opt the turn into deferred output streaming. */
+    readonly PRE_MODEL_CALL: "pre-model-call";
+    /** Fires once per tool result, after the tool returns and before the result is sent to the provider. */
+    readonly POST_TOOL_USE: "post-tool-use";
+    /** Fires once per run when the loop has committed to ending — the definitive terminal hook for teardown. Cannot continue the loop; reports how the turn ended via `exitReason`. */
+    readonly STOP: "stop";
+    /** Fires at every model-call outcome (finalized reply or provider rejection), before the message is persisted/streamed-final. A hook may transform the content and owns the continue/retry decision. */
+    readonly POST_MODEL_CALL: "post-model-call";
+    /** Fires after the loop successfully compacts a conversation mid-turn. */
+    readonly POST_COMPACT: "post-compact";
+};
+
+declare interface HostAppControlCancel {
+    type: "host_app_control_cancel";
+    requestId: string;
+    conversationId: string;
+}
+
+declare interface HostAppControlClickInput {
+    tool: "click";
+    app: string;
+    x: number;
+    y: number;
+    button?: "left" | "right" | "middle";
+    double?: boolean;
+}
+
+declare interface HostAppControlComboInput {
+    tool: "combo";
+    app: string;
+    /** Sequence of keys pressed simultaneously, e.g. ["cmd", "shift", "4"]. */
+    keys: string[];
+    /** Hold duration in milliseconds. */
+    duration_ms?: number;
+}
+
+declare interface HostAppControlDragInput {
+    tool: "drag";
+    app: string;
+    from_x: number;
+    from_y: number;
+    to_x: number;
+    to_y: number;
+    button?: "left" | "right" | "middle";
+}
+
+/** Inputs accepted by the nine app-control tool variants. */
+declare type HostAppControlInput = HostAppControlStartInput | HostAppControlObserveInput | HostAppControlPressInput | HostAppControlComboInput | HostAppControlSequenceInput | HostAppControlTypeInput | HostAppControlClickInput | HostAppControlDragInput | HostAppControlStopInput;
+
+declare interface HostAppControlObserveInput {
+    tool: "observe";
+    app: string;
+    /**
+     * Milliseconds to wait between receiving the request and capturing the
+     * window. Lets the target app process pending input and the WindowServer
+     * composite a fresh frame. When omitted, the client uses its default
+     * (~200ms, sized for emulator-class apps at 60fps). Pass `0` for static
+     * UIs to make `observe` snappier; raise it for slow-feedback apps.
+     */
+    settle_ms?: number;
+}
+
+declare interface HostAppControlPressInput {
+    tool: "press";
+    app: string;
+    /** Single key identifier, e.g. "return", "a", "f12". */
+    key: string;
+    /** Modifier list, e.g. ["cmd", "shift"]. */
+    modifiers?: string[];
+    /** Hold duration in milliseconds. */
+    duration_ms?: number;
+}
+
+declare interface HostAppControlRequest {
+    type: "host_app_control_request";
+    requestId: string;
+    conversationId: string;
+    toolName: string;
+    input: HostAppControlInput;
+}
+
+declare interface HostAppControlSequenceInput {
+    tool: "sequence";
+    app: string;
+    /** Ordered list of single-key presses to execute serially. */
+    steps: HostAppControlSequenceStep[];
+}
+
+/** A single step inside a sequence: one key press with optional modifiers, hold duration, and post-press gap. */
+declare interface HostAppControlSequenceStep {
+    /** Single key identifier, e.g. "right", "a", "return". */
+    key: string;
+    /** Modifier list, e.g. ["cmd", "shift"]. Omit for no modifiers. */
+    modifiers?: string[];
+    /** Hold duration for this key in milliseconds. */
+    duration_ms?: number;
+    /** Pause after this step before starting the next, in milliseconds. */
+    gap_ms?: number;
+}
+
+declare type _HostAppControlServerMessages = HostAppControlRequest | HostAppControlCancel;
+
+declare interface HostAppControlStartInput {
+    tool: "start";
+    /** Bundle ID (preferred) or process name. */
+    app: string;
+    /** Optional command-line arguments to launch the app with. */
+    args?: string[];
+}
+
+declare interface HostAppControlStopInput {
+    tool: "stop";
+    /** Optional — when omitted the proxy stops whichever app currently holds the session. */
+    app?: string;
+    /** Free-form reason, surfaced for logging. */
+    reason?: string;
+}
+
+declare interface HostAppControlTypeInput {
+    tool: "type";
+    app: string;
+    text: string;
+}
+
+declare interface HostBashCancelRequest {
+    type: "host_bash_cancel";
+    requestId: string;
+    conversationId: string;
+    /** When set, route this cancel only to the client that owns the request. */
+    targetClientId?: string;
+}
+
+declare interface HostBashRequest {
+    type: "host_bash_request";
+    requestId: string;
+    conversationId: string;
+    command: string;
+    working_dir?: string;
+    timeout_seconds?: number;
+    /** Extra environment variables to inject into the subprocess (e.g. VELLUM_UNTRUSTED_SHELL). */
+    env?: Record<string, string>;
+    /** When set, route this request only to the client with this ID. */
+    targetClientId?: string;
+}
+
+declare type _HostBashServerMessages = HostBashRequest | HostBashCancelRequest;
+
+declare interface HostBrowserCancelRequest {
+    type: "host_browser_cancel";
+    requestId: string;
+}
+
+declare interface HostBrowserRequest {
+    type: "host_browser_request";
+    requestId: string;
+    conversationId: string;
+    /** CDP method name, e.g. "Page.navigate", "Runtime.evaluate", "Accessibility.getFullAXTree". */
+    cdpMethod: string;
+    /** Opaque JSON params object forwarded verbatim to CDP. */
+    cdpParams?: Record<string, unknown>;
+    /** Optional CDP target/session ID; omitted = "most-recently-active tab". */
+    cdpSessionId?: string;
+    /** Client-side timeout hint; defaults to 30s in the proxy. */
+    timeout_seconds?: number;
+}
+
+declare type _HostBrowserServerMessages = HostBrowserRequest | HostBrowserCancelRequest;
+
+declare interface HostCuCancelRequest {
+    type: "host_cu_cancel";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+}
+
+declare interface HostCuRequest {
+    type: "host_cu_request";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+    toolName: string;
+    input: Record<string, unknown>;
+    stepNumber: number;
+    reasoning?: string;
+}
+
+declare type _HostCuServerMessages = HostCuRequest | HostCuCancelRequest;
+
+declare interface HostFileCancelRequest {
+    type: "host_file_cancel";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+}
+
+declare interface HostFileEditRequest {
+    type: "host_file_request";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+    operation: "edit";
+    path: string;
+    old_string: string;
+    new_string: string;
+    replace_all?: boolean;
+}
+
+declare interface HostFileReadRequest {
+    type: "host_file_request";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+    operation: "read";
+    path: string;
+    offset?: number;
+    limit?: number;
+}
+
+declare type HostFileRequest = HostFileReadRequest | HostFileWriteRequest | HostFileEditRequest;
+
+declare type _HostFileServerMessages = HostFileRequest | HostFileCancelRequest;
+
+declare interface HostFileWriteRequest {
+    type: "host_file_request";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+    operation: "write";
+    path: string;
+    content: string;
+}
+
+/**
+ * Host proxy capabilities that an interface can support. The macOS client
+ * supports all five; the chrome-extension interface only supports
+ * host_browser (via the Chrome DevTools Protocol proxy).
+ */
+declare type HostProxyCapability = "host_bash" | "host_file" | "host_cu" | "host_browser" | "host_app_control";
+
+declare interface HostTransferCancelRequest {
+    type: "host_transfer_cancel";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+}
+
+declare type HostTransferRequest = HostTransferToHostRequest | HostTransferToSandboxRequest;
+
+declare type _HostTransferServerMessages = HostTransferRequest | HostTransferCancelRequest;
+
+declare interface HostTransferToHostRequest {
+    type: "host_transfer_request";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+    direction: "to_host";
+    transferId: string;
+    destPath: string;
+    sizeBytes: number;
+    sha256: string;
+    overwrite: boolean;
+}
+
+declare interface HostTransferToSandboxRequest {
+    type: "host_transfer_request";
+    requestId: string;
+    conversationId: string;
+    targetClientId?: string;
+    direction: "to_sandbox";
+    transferId: string;
+    sourcePath: string;
+}
+
+declare type IdentityChangedEvent = z.infer<typeof IdentityChangedEventSchema>;
+
+declare const IdentityChangedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"identity_changed">;
+    name: z.ZodString;
+    role: z.ZodString;
+    personality: z.ZodString;
+    emoji: z.ZodString;
+    home: z.ZodString;
+}, z.core.$strip>;
+
+declare interface IdentityGetResponse {
+    type: "identity_get_response";
+    /** Whether an IDENTITY.md file was found. When false, all fields are empty defaults. */
+    found: boolean;
+    name: string;
+    role: string;
+    personality: string;
+    emoji: string;
+    home: string;
+    version?: string;
+    assistantId?: string;
+    createdAt?: string;
+    originSystem?: string;
+}
+
+export declare interface ImageContent {
+    type: "image";
+    source: {
+        type: "base64";
+        media_type: string;
+        data: string;
+    };
+}
+
+declare type _InboxServerMessages = ContactsInviteResponse | AssistantInboxEscalationResponse;
+
+declare interface IngressConfigResponse {
+    type: "ingress_config_response";
+    enabled: boolean;
+    publicBaseUrl: string;
+    /** Read-only gateway target computed from GATEWAY_PORT env var (default 7830) + loopback host. */
+    localGatewayTarget: string;
+    /**
+     * When true, this assistant uses platform-managed callback routing.
+     * Webhook delivery is handled by the platform — no local tunnel or
+     * ngrok setup is needed. `publicBaseUrl` reflects the platform callback URL.
+     */
+    managedCallbacks?: boolean;
+    success: boolean;
+    error?: string;
+}
+
+declare interface IntegrationConnectResult {
+    type: "integration_connect_result";
+    integrationId: string;
+    success: boolean;
+    accountInfo?: string | null;
+    error?: string | null;
+    setupRequired?: boolean;
+    setupHint?: string;
+}
+
+declare interface IntegrationListResponse {
+    type: "integration_list_response";
+    integrations: Array<{
+        id: string;
+        connected: boolean;
+        accountInfo?: string | null;
+        connectedAt?: number | null;
+        lastUsed?: number | null;
+        error?: string | null;
+    }>;
+}
+
+declare type _IntegrationsServerMessages = SlackWebhookConfigResponse | IngressConfigResponse | PlatformConfigResponse | VercelApiConfigResponse | TelegramConfigResponse | ChannelVerificationSessionResponse | IntegrationListResponse | IntegrationConnectResult | OAuthConnectResultResponse | OpenUrlEvent | NavigateSettingsEvent | ShowPlatformLogin | PlatformDisconnected;
+
+declare type InteractionResolvedEvent = z.infer<typeof InteractionResolvedEventSchema>;
+
+declare const InteractionResolvedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"interaction_resolved">;
+    requestId: z.ZodString;
+    conversationId: z.ZodString;
+    state: z.ZodEnum<{
+        approved: "approved";
+        cancelled: "cancelled";
+        rejected: "rejected";
+        answered: "answered";
+        superseded: "superseded";
+    }>;
+    kind: z.ZodString;
+}, z.core.$strip>;
+
+declare const INTERFACE_IDS: readonly ["macos", "ios", "cli", "telegram", "phone", "web", "whatsapp", "slack", "email", "chrome-extension", "a2a"];
+
+declare type InterfaceId = (typeof INTERFACE_IDS)[number];
+
+declare interface ListItem {
+    id: string;
+    title: string;
+    subtitle?: string;
+    icon?: string;
+    selected?: boolean;
+}
+
+declare interface ListSurfaceData {
+    items: ListItem[];
+    selectionMode: "single" | "multiple" | "none";
+}
+
+declare type LLMCallSite = z.infer<typeof LLMCallSiteEnum>;
+
+/**
+ * The complete set of LLM call-site identifiers the assistant emits.
+ *
+ * Each ID corresponds to a logical place in the codebase that produces an LLM
+ * request. Adding or removing a call site is a config-schema change — keep
+ * this list in sync with the resolver and registry (introduced in PR 2).
+ */
+declare const LLMCallSiteEnum: z.ZodEnum<{
+    mainAgent: "mainAgent";
+    subagentSpawn: "subagentSpawn";
+    heartbeatAgent: "heartbeatAgent";
+    filingAgent: "filingAgent";
+    compactionAgent: "compactionAgent";
+    analyzeConversation: "analyzeConversation";
+    callAgent: "callAgent";
+    memoryExtraction: "memoryExtraction";
+    memoryConsolidation: "memoryConsolidation";
+    memoryRetrieval: "memoryRetrieval";
+    memoryV2Migration: "memoryV2Migration";
+    memoryV2Sweep: "memoryV2Sweep";
+    memoryRouter: "memoryRouter";
+    memoryV3SelectL2: "memoryV3SelectL2";
+    memoryV2Consolidation: "memoryV2Consolidation";
+    memoryRetrospective: "memoryRetrospective";
+    recall: "recall";
+    narrativeRefinement: "narrativeRefinement";
+    patternScan: "patternScan";
+    conversationSummarization: "conversationSummarization";
+    conversationStarters: "conversationStarters";
+    replySuggestion: "replySuggestion";
+    conversationTitle: "conversationTitle";
+    commitMessage: "commitMessage";
+    identityIntro: "identityIntro";
+    emptyStateGreeting: "emptyStateGreeting";
+    notificationDecision: "notificationDecision";
+    preferenceExtraction: "preferenceExtraction";
+    guardianQuestionCopy: "guardianQuestionCopy";
+    approvalCopy: "approvalCopy";
+    approvalConversation: "approvalConversation";
+    interactionClassifier: "interactionClassifier";
+    styleAnalyzer: "styleAnalyzer";
+    inviteInstructionGenerator: "inviteInstructionGenerator";
+    skillCategoryInference: "skillCategoryInference";
+    meetConsentMonitor: "meetConsentMonitor";
+    meetChatOpportunity: "meetChatOpportunity";
+    inference: "inference";
+    trustRuleSuggestion: "trustRuleSuggestion";
+    homeGreeting: "homeGreeting";
+    homeSuggestedPrompts: "homeSuggestedPrompts";
+}>;
+
+/**
+ * The assistant successfully posted a chat message into the meeting via
+ * the bot's `/send_chat` endpoint. Emitted once per successful send so
+ * SSE-subscribed clients can render the outbound chat without waiting for
+ * the bot to echo it back through the transcript/chat stream.
+ */
+declare interface MeetChatSent {
+    type: "meet.chat_sent";
+    meetingId: string;
+    /** The text that was posted into the meeting's chat. */
+    text: string;
+}
+
+/** The bot hit a non-recoverable error (container crash, join failure, etc.). */
+declare interface MeetError {
+    type: "meet.error";
+    meetingId: string;
+    /** Human-readable error detail. */
+    detail: string;
+}
+
+/** The bot has successfully joined and is live in the meeting. */
+declare interface MeetJoined {
+    type: "meet.joined";
+    meetingId: string;
+}
+
+/** The bot has started attempting to join a meeting. */
+declare interface MeetJoining {
+    type: "meet.joining";
+    meetingId: string;
+    /** The Meet URL the bot was asked to join. */
+    url: string;
+}
+
+/** The bot has left the meeting. */
+declare interface MeetLeft {
+    type: "meet.left";
+    meetingId: string;
+    /** Free-form reason passed to `leave()` (e.g. "user-requested", "timeout"). */
+    reason: string;
+}
+
+/**
+ * Meet — server → client push messages for live meeting state.
+ *
+ * Emitted by the assistant daemon as the Meet-bot progresses through its
+ * lifecycle (joining → joined → left) and as in-meeting state changes
+ * (participants, active speaker, transcript chunks).
+ *
+ * Keep payloads small and client-actionable: these events power the
+ * macOS "In meeting" status panel and the conversation bridge's live
+ * transcript feed. A client that missed an event can always refetch
+ * authoritative state from the daemon's HTTP routes.
+ */
+/** A single participant in a meeting. Shape mirrors the wire-level type. */
+declare interface MeetParticipant {
+    /** Stable participant identifier (provider-specific). */
+    id: string;
+    /** Display name of the participant. */
+    name: string;
+    /** Whether the participant is the meeting host. */
+    isHost?: boolean;
+    /** Whether the participant is the bot itself. */
+    isSelf?: boolean;
+}
+
+/** Participants joined and/or left the meeting since the last snapshot. */
+declare interface MeetParticipantChanged {
+    type: "meet.participant_changed";
+    meetingId: string;
+    /** Participants who joined since the last snapshot. */
+    joined: MeetParticipant[];
+    /** Participants who left since the last snapshot. */
+    left: MeetParticipant[];
+}
+
+declare type _MeetServerMessages = MeetJoining | MeetJoined | MeetParticipantChanged | MeetSpeakerChanged | MeetTranscriptChunk | MeetLeft | MeetChatSent | MeetError | MeetSpeakingStarted | MeetSpeakingEnded;
+
+/** The active speaker in the meeting changed. */
+declare interface MeetSpeakerChanged {
+    type: "meet.speaker_changed";
+    meetingId: string;
+    /** Stable speaker identifier for the new active speaker. */
+    speakerId: string;
+    /** Display name of the new active speaker. */
+    speakerName: string;
+}
+
+/**
+ * The assistant has finished (or cancelled) a TTS playback stream. Fired
+ * after the bot-side playback request settles — whether normally, via an
+ * explicit cancel, or due to an upstream error.
+ */
+declare interface MeetSpeakingEnded {
+    type: "meet.speaking_ended";
+    meetingId: string;
+    /** Opaque stream identifier — matches `meet.speaking_started.streamId`. */
+    streamId: string;
+    /** Why the stream ended: natural completion, caller-initiated cancel, or an upstream error. */
+    reason: "completed" | "cancelled" | "error";
+}
+
+/**
+ * The assistant has begun speaking into the meeting via the TTS bridge. Fired
+ * once per {@link MeetSessionManager.speak} invocation immediately before the
+ * synthesis stream starts flowing to the bot's `/play_audio` endpoint. Useful
+ * for clients that want to render a "speaking …" indicator.
+ */
+declare interface MeetSpeakingStarted {
+    type: "meet.speaking_started";
+    meetingId: string;
+    /** Opaque stream identifier — matches `meet.speaking_ended.streamId`. */
+    streamId: string;
+}
+
+/**
+ * A finalized chunk of transcribed speech. Interim chunks are filtered
+ * out before publication so clients only render stable text.
+ */
+declare interface MeetTranscriptChunk {
+    type: "meet.transcript_chunk";
+    meetingId: string;
+    /** The transcribed text. */
+    text: string;
+    /** Human-readable speaker label, if the ASR provided one. */
+    speakerLabel?: string;
+    /** Stable speaker identifier across the meeting, if available. */
+    speakerId?: string;
+    /** ASR confidence in [0, 1], if available. */
+    confidence?: number;
+}
+
+declare interface MemoryRecalled {
+    type: "memory_recalled";
+    provider: string;
+    model: string;
+    degradation?: MemoryRecalledDegradation;
+    semanticHits: number;
+    tier1Count: number;
+    tier2Count: number;
+    hybridSearchLatencyMs: number;
+    sparseVectorUsed: boolean;
+    mergedCount: number;
+    selectedCount: number;
+    injectedTokens: number;
+    latencyMs: number;
+    topCandidates: MemoryRecalledCandidateDebug[];
+}
+
+declare interface MemoryRecalledCandidateDebug {
+    key: string;
+    type: string;
+    kind: string;
+    finalScore: number;
+    semantic: number;
+    recency: number;
+}
+
+declare interface MemoryRecalledDegradation {
+    semanticUnavailable: boolean;
+    reason: string;
+    fallbackSources: string[];
+}
+
+declare type _MemoryServerMessages = MemoryRecalled | MemoryStatus;
+
+declare interface MemoryStatus {
+    type: "memory_status";
+    enabled: boolean;
+    degraded: boolean;
+    degradation?: MemoryRecalledDegradation;
+    reason?: string;
+    provider?: string;
+    model?: string;
+}
+
+export declare interface Message {
+    role: "user" | "assistant";
+    content: ContentBlock[];
+}
+
+declare type MessageCompleteEvent = z.infer<typeof MessageCompleteEventSchema>;
+
+declare const MessageCompleteEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"message_complete">;
+    messageId: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodEnum<{
+        main: "main";
+        aux: "aux";
+    }>>;
+    attachments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodOptional<z.ZodString>;
+        filename: z.ZodString;
+        mimeType: z.ZodString;
+        data: z.ZodString;
+        sourceType: z.ZodOptional<z.ZodEnum<{
+            host_file: "host_file";
+            sandbox_file: "sandbox_file";
+            tool_block: "tool_block";
+        }>>;
+        sizeBytes: z.ZodOptional<z.ZodNumber>;
+        thumbnailData: z.ZodOptional<z.ZodString>;
+        fileBacked: z.ZodOptional<z.ZodBoolean>;
+        filePath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    attachmentWarnings: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+
+declare interface MessageContentResponse {
+    type: "message_content_response";
+    conversationId: string;
+    messageId: string;
+    text?: string;
+    toolCalls?: Array<{
+        name: string;
+        result?: string;
+        input?: Record<string, unknown>;
+    }>;
+}
+
+declare type MessageDequeuedEvent = z.infer<typeof MessageDequeuedEventSchema>;
+
+declare const MessageDequeuedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"message_dequeued">;
+    conversationId: z.ZodString;
+    requestId: z.ZodString;
+}, z.core.$strip>;
+
+declare type MessageQueuedDeletedEvent = z.infer<typeof MessageQueuedDeletedEventSchema>;
+
+declare const MessageQueuedDeletedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"message_queued_deleted">;
+    conversationId: z.ZodString;
+    requestId: z.ZodString;
+}, z.core.$strip>;
+
+declare type MessageQueuedEvent = z.infer<typeof MessageQueuedEventSchema>;
+
+declare const MessageQueuedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"message_queued">;
+    conversationId: z.ZodString;
+    requestId: z.ZodString;
+    position: z.ZodNumber;
+}, z.core.$strip>;
+
+declare type MessageRequestCompleteEvent = z.infer<typeof MessageRequestCompleteEventSchema>;
+
+declare const MessageRequestCompleteEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"message_request_complete">;
+    conversationId: z.ZodString;
+    requestId: z.ZodString;
+    runStillActive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+
+declare type _MessagesServerMessages = UserMessageEchoEvent | AssistantTurnStartEvent | AssistantTextDeltaEvent | AssistantThinkingDelta | ToolUseStartEvent | ToolUsePreviewStartEvent | ToolOutputChunkEvent | ToolInputDelta | ToolResultEvent | ConfirmationRequestEvent | SecretRequestEvent | QuestionRequestEvent | MessageCompleteEvent | ErrorEvent_2 | MessageQueuedEvent | MessageDequeuedEvent | MessageRequestCompleteEvent | MessageQueuedDeletedEvent | MessageSteered | SuggestionResponse | TraceEvent | ConfirmationStateChanged | AssistantActivityStateEvent | TurnProfileAutoRoutedEvent | ConversationInferenceProfileUpdated | InteractionResolvedEvent;
+
+declare interface MessageSteered {
+    type: "message_steered";
+    conversationId: string;
+    requestId: string;
+}
+
+declare interface ModelInfo {
+    type: "model_info";
+    conversationId?: string;
+    model: string;
+    provider: string;
+    configuredProviders?: string[];
+    availableModels?: Array<{
+        id: string;
+        displayName: string;
+    }>;
+    allProviders?: Array<{
+        id: string;
+        displayName: string;
+        models: Array<{
+            id: string;
+            displayName: string;
+        }>;
+        defaultModel: string;
+        apiKeyUrl?: string;
+        apiKeyPlaceholder?: string;
+    }>;
+}
+
+declare type NavigateSettingsEvent = z.infer<typeof NavigateSettingsEventSchema>;
+
+declare const NavigateSettingsEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"navigate_settings">;
+    tab: z.ZodString;
+}, z.core.$strip>;
+
+/** Server push — broadcast when a notification creates a new vellum conversation. */
+declare interface NotificationConversationCreated {
+    type: "notification_conversation_created";
+    conversationId: string;
+    title: string;
+    sourceEventName: string;
+    /**
+     * When set, this conversation was created for a guardian-sensitive notification
+     * and should only be surfaced by clients bound to this guardian identity.
+     */
+    targetGuardianPrincipalId?: string;
+    /**
+     * Conversation group identifier propagated from the signal producer.
+     * Clients use this to place the conversation in the correct sidebar folder
+     * (e.g. "system:scheduled" for schedule completion threads).
+     */
+    groupId?: string;
+    /**
+     * Semantic source of the conversation (e.g. "schedule", "reminder").
+     * Allows clients to override the default "notification" source so the
+     * conversation is attributed correctly.
+     */
+    source?: string;
+    /**
+     * Mirrors `NotificationIntent.silent`. When true the client must not
+     * post a fallback OS banner for this conversation — the sidebar entry
+     * still appears, but the always-on inbox is the only surfaced channel.
+     * Derived from the originating signal's `attentionHints.urgency`.
+     */
+    silent?: boolean;
+}
+
+declare type NotificationIntentEvent = z.infer<typeof NotificationIntentEventSchema>;
+
+declare const NotificationIntentEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"notification_intent">;
+    sourceEventName: z.ZodString;
+    title: z.ZodString;
+    body: z.ZodString;
+    deliveryId: z.ZodOptional<z.ZodString>;
+    deepLinkMetadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    targetGuardianPrincipalId: z.ZodOptional<z.ZodString>;
+    silent: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+
+declare type _NotificationsServerMessages = NotificationIntentEvent | NotificationConversationCreated;
+
+declare interface OAuthConnectResultResponse {
+    type: "oauth_connect_result";
+    success: boolean;
+    service?: string;
+    grantedScopes?: string[];
+    accountInfo?: string;
+    error?: string;
+}
+
+declare interface OAuthConnectSurfaceData {
+    /** OAuth provider key from the managed provider catalog, e.g. "google". */
+    providerKey: string;
+    /** Optional display label. The client falls back to the provider catalog. */
+    displayName?: string;
+    /** Optional helper text. The client falls back to the provider catalog. */
+    description?: string;
+    /** Optional provider logo URL. The client falls back to the provider catalog. */
+    logoUrl?: string | null;
+}
+
+declare interface OpenBundleResponse {
+    type: "open_bundle_response";
+    manifest: {
+        format_version: number;
+        name: string;
+        description?: string;
+        icon?: string;
+        created_at: string;
+        created_by: string;
+        entry: string;
+        capabilities: string[];
+    };
+    scanResult: {
+        passed: boolean;
+        blocked: string[];
+        warnings: string[];
+    };
+    signatureResult: {
+        trustTier: "verified" | "signed" | "unsigned" | "tampered";
+        signerKeyId?: string;
+        signerDisplayName?: string;
+        signerAccount?: string;
+    };
+    bundleSizeBytes: number;
+}
+
+/**
+ * Server push — instructs the client to open and focus a conversation. If
+ * the conversation isn't already present in the client's sidebar list (e.g.
+ * it was just created via `POST /v1/conversations`), the client should stub
+ * a sidebar entry using the provided `title` before navigating.
+ */
+declare interface OpenConversation {
+    type: "open_conversation";
+    conversationId: string;
+    /** Optional conversation title; supplied when the client may not yet have the conversation in its list. */
+    title?: string;
+    /** Optional message ID to scroll to after focus. */
+    anchorMessageId?: string;
+    /** When `false`, the client should register the conversation in its sidebar (so it's visible and navigable) but must NOT switch focus to it. Omitting the field defaults to `true` for backward compatibility with existing single-target 'jump to conversation' callers. */
+    focus?: boolean;
+}
+
+declare type OpenUrlEvent = z.infer<typeof OpenUrlEventSchema>;
+
+declare const OpenUrlEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"open_url">;
+    url: z.ZodString;
+    title: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/**
+ * Identifies which extension owns a tool (skill / plugin / MCP server).
+ * Tracked by the tool registry keyed by tool name, not stored on the `Tool`
+ * object itself — query via {@link ../tools/registry.getToolOwner}.
+ */
+declare interface OwnerInfo {
+    kind: OwnerKind;
+    /** ID of the owning extension (skill id / plugin name / MCP server id / workspace path). */
+    id: string;
+}
+
+/** The kind of extension that owns a tool. Core tools have no owner. */
+declare type OwnerKind = "skill" | "mcp" | "plugin" | "workspace";
+
+declare interface PartnerAudit {
+    risk: RiskLevel_2;
+    alerts?: number;
+    score?: number;
+    analyzedAt: string;
+}
+
+declare interface PlatformConfigResponse {
+    type: "platform_config_response";
+    baseUrl: string;
+    success: boolean;
+    error?: string;
+}
+
+declare interface PlatformDisconnected {
+    type: "platform_disconnected";
+}
+
+/**
+ * A plugin lifecycle hook. Receives a per-lifecycle context shape and may
+ * either mutate `ctx` in place (returning `void`) or return a *partial*
+ * context whose fields are merged onto the threaded context — only the keys
+ * it returns are overwritten, every other field is preserved. Returning a
+ * partial lets a hook edit just the subset of fields it cares about without
+ * having to re-specify the rest. The merged context is threaded to the next
+ * hook in the chain (e.g. `user-prompt-submit`).
+ *
+ * Because an omitted key means "keep the existing value", every field on a
+ * context shape is required (no `?`-optional or `| undefined` members): a
+ * present key always carries a concrete value, so "absent from the returned
+ * partial" is never ambiguous with "explicitly cleared". Fields that can be
+ * empty model that with `| null`, not `| undefined`.
+ *
+ * Each known hook key has a documented context shape:
+ *   - `init` — {@link PluginInitContext}
+ *   - `shutdown` — {@link PluginShutdownContext}
+ *   - `user-prompt-submit` — {@link UserPromptSubmitContext}
+ *   - `pre-model-call` — {@link PreModelCallContext}
+ *   - `post-tool-use` — {@link PostToolUseContext}
+ *   - `stop` — {@link StopContext}
+ *   - `post-model-call` — {@link PostModelCallContext}
+ */
+export declare type PluginHookFn<TCtx = unknown> = (ctx: TCtx) => Promise<Partial<TCtx> | void>;
+
+/**
+ * Context passed to `Plugin.init()` during bootstrap. Carries resolved
+ * config/credentials, a pino-compatible logger scoped to the plugin, a
+ * per-plugin writable data directory, and the assistant's version metadata.
+ */
+export declare interface PluginInitContext {
+    /** Parsed config for this plugin (may be `unknown` until the manifest validates). */
+    config: unknown;
+    /** Resolved credential values keyed by the entries of `manifest.requiresCredential`. */
+    credentials: Record<string, string>;
+    /** Pino-compatible child logger bound to `{ plugin: <name> }`. */
+    logger: PluginLogger;
+    /** Absolute path to `<workspaceDir>/plugins-data/<plugin>/` (created by bootstrap). */
+    pluginStorageDir: string;
+    /**
+     * Assistant semver. Plugins can compare against this for defensive
+     * runtime checks — but the canonical compat contract is the host
+     * version against the plugin's `peerDependencies["@vellumai/plugin-api"]`
+     * semver range, enforced at load time by the external-plugin loader.
+     */
+    assistantVersion: string;
+}
+
+/**
+ * Minimal pino-compatible logger surface handed to plugin hooks. The host
+ * supplies a pino child logger bound to `{ plugin: <name> }`; this
+ * interface intentionally captures only the two call shapes plugin code
+ * needs (structured object + optional message), so the public surface
+ * doesn't take a dependency on pino's full type machinery.
+ *
+ * Each method accepts a structured-fields object followed by an optional
+ * message string. Plugin authors that need pino's wider API (`child()`,
+ * `level`, etc.) can cast to their own narrower interface in plugin code
+ * — but the canonical contract here covers the 99% case.
+ */
+export declare interface PluginLogger {
+    info(obj: Record<string, unknown>, msg?: string): void;
+    warn(obj: Record<string, unknown>, msg?: string): void;
+    error(obj: Record<string, unknown>, msg?: string): void;
+    debug(obj: Record<string, unknown>, msg?: string): void;
+}
+
+/**
+ * Context passed to the `shutdown` hook during daemon teardown. Kept
+ * intentionally narrower than {@link PluginInitContext} — most teardown
+ * paths only need to know which assistant version they're shutting
+ * down against (e.g. for version-conditional cleanup of state files
+ * written by a previous boot).
+ *
+ * Additional fields may be added as concrete plugin needs surface; the
+ * `assistantVersion` field mirrors the init context's so plugins that
+ * stash a version stamp at init can compare against the same name on
+ * tear-down without keeping their own copy.
+ */
+export declare interface PluginShutdownContext {
+    /** Assistant semver for compatibility checks inside the plugin. */
+    assistantVersion: string;
+}
+
+declare interface PongMessage {
+    type: "pong";
+}
+
+/**
+ * Context passed to the `post-compact` hook. Fires after the agent loop
+ * compacts a conversation mid-turn — once the running history has been
+ * summarized down to fit the context window, and before the turn resumes.
+ *
+ * Compaction strips the turn's runtime injections (scratchpad, retrieved
+ * memory, workspace context, transcript snapshots) along with the raw messages
+ * it summarizes. This hook's job is to re-apply whatever injected context must
+ * survive onto the freshly compacted history before the next provider call.
+ * The default memory-retrieval plugin contributes a hook here that re-injects
+ * its memory blocks and re-tracks the memory graph; user hooks can re-apply
+ * their own injected context the same way.
+ *
+ * The hook re-injects by mutating `history` in place (or returning a new
+ * context with a replacement `history`) — see {@link PluginHookFn}'s
+ * polymorphic return shape. The agent loop reads the settled `history` back off
+ * the context and resumes the turn from it. Multiple plugins' hooks chain in
+ * registration order, each seeing the previous plugin's edits.
+ */
+export declare interface PostCompactContext {
+    /**
+     * The compacted message history to re-inject onto. Hooks mutate this in
+     * place (or return a new context with a replacement) to re-apply context
+     * that compaction stripped; the loop resumes the turn from the settled
+     * value.
+     */
+    history: Message[];
+    /**
+     * Stable ID for the request that drives this turn. Hooks that perform
+     * runtime injection forward it onto the injector turn context so the
+     * re-applied blocks are attributed to the originating request; it is fixed
+     * for the turn and cannot be recovered from the message history.
+     */
+    readonly requestId: string;
+    /** Conversation ID the turn being compacted is scoped to. */
+    readonly conversationId: string;
+    /**
+     * Whether the turn has no human present to answer clarification questions
+     * (e.g. a scheduled, background, or headless run). Mirrors the field of the
+     * same name on {@link UserPromptSubmitContext}: resolved once at turn start
+     * so re-injection reflects the turn's interactivity rather than mutable
+     * client-presence state that can flip mid-turn.
+     */
+    readonly isNonInteractive: boolean;
+    /**
+     * Active inference profile key to surface in the re-injected context, or
+     * `null` when the profile is unchanged since the one last announced to the
+     * model. Mirrors {@link UserPromptSubmitContext.modelProfileKey}: hooks that
+     * emit the `model_profile` grounding line resolve the human-readable label
+     * from this key rather than receiving the rendered string.
+     */
+    readonly modelProfileKey: string | null;
+    /**
+     * Volume of runtime injection to re-apply. `"full"` restores the complete
+     * runtime context; `"minimal"` is the reduced volume overflow recovery's
+     * injection-downgrade rung selects to keep the re-injected prompt small.
+     * Defaults to `"full"` when omitted.
+     */
+    readonly injectionMode?: "full" | "minimal";
+}
+
+/**
+ * Context passed to the `post-model-call` hook. Fires at every model-call
+ * outcome — the seam where the loop reacts to what the provider returned:
+ *
+ * - **Finalized reply.** The provider returned a message. {@link error} is
+ *   absent, {@link content} holds the reply's blocks (mutable — the loop adopts
+ *   the hook's result as the persisted and streamed message), and
+ *   {@link stopReason} carries the provider's stop reason. Fires once per model
+ *   call, including tool-bearing turns (a reply can carry both text and
+ *   `tool_use`), so a hook should transform only the blocks it owns and leave
+ *   others — notably `tool_use` — intact.
+ * - **Provider rejection.** The call threw before any reply existed.
+ *   {@link error} holds the rejection, {@link content} is empty, and
+ *   {@link stopReason} is `null`. A hook that recognizes the rejection may
+ *   repair {@link messages} and set {@link decision} to `"continue"` to retry;
+ *   hooks that only act on a real reply must guard on {@link error} and return
+ *   early.
+ *
+ * The retry decision is honored only at actionable outcomes — a no-tool reply
+ * or a `mainAgent` rejection — and is ignored on tool-bearing turns (the loop
+ * already runs the tools) and non-`mainAgent` call sites. Runs for every
+ * finalized message regardless of call site; hooks MUST self-gate on
+ * {@link callSite} / {@link conversationId}. Mutate in place or return a new
+ * context; throwing is contained by the loop (the original content is kept and
+ * the outcome is treated as `"stop"`). Multiple plugins' hooks chain in
+ * registration order — each sees the previous hook's `decision` and mutations.
+ */
+export declare interface PostModelCallContext {
+    /** Conversation ID the message belongs to. */
+    readonly conversationId: string;
+    /** The call site this message serves — `"mainAgent"` for the user-facing reply; `null` when untagged. */
+    readonly callSite: LLMCallSite | null;
+    /**
+     * The finalized message content. Mutable — transform the text blocks and leave
+     * `tool_use` (and other non-text blocks) intact. Empty on a provider rejection.
+     */
+    content: ContentBlock[];
+    /**
+     * Full conversation history: the inbound conversation followed by every
+     * message produced this run. A hook that sets {@link decision} to
+     * `"continue"` leaves this as the history the next iteration should send — a
+     * finalized-reply hook appends its follow-up turn (e.g. a nudge `user`
+     * message); a rejection-recovery hook replaces the array with a repaired one.
+     */
+    messages: Message[];
+    /** Provider-reported stop reason for the turn; `null` when not reported. */
+    readonly stopReason: string | null;
+    /**
+     * The provider rejection that ended the call, on a rejection outcome. Absent
+     * on a finalized reply. A hook that recovers from a specific rejection class
+     * inspects this and may repair {@link messages} and set {@link decision} to
+     * `"continue"`; hooks that only act on a real reply must return early when it
+     * is present.
+     */
+    readonly error?: Error;
+    /**
+     * Seeded to `"stop"`. A hook sets it to `"continue"` to force another loop
+     * iteration; later hooks in the chain may override it. Honored only at
+     * actionable outcomes (see the interface docstring).
+     */
+    decision: PostModelCallDecision;
+    /** Logger scoped to the current turn (tag structured fields with `{ plugin }`). */
+    readonly logger: PluginLogger;
+}
+
+/**
+ * Binary outcome of the `post-model-call` hook. The agent loop seeds it to
+ * `"stop"` and acts on the value the chain settles on:
+ *
+ * - `"stop"`     — accept the model-call outcome. On a finalized reply the loop
+ *                  keeps the (possibly transformed) message; on a rejection it
+ *                  surfaces the error. This is the default.
+ * - `"continue"` — re-query the model. The hook is responsible for leaving
+ *                  {@link PostModelCallContext.messages} as the history the next
+ *                  iteration should send (append a follow-up turn, or replace
+ *                  the array with a repaired one).
+ */
+export declare type PostModelCallDecision = "continue" | "stop";
+
+/**
+ * Context passed to the `post-tool-use` hook. Fires once per tool result —
+ * after the tool returns and before the result is appended to the message
+ * history sent to the provider. With several tools dispatched in a single
+ * turn, the hook fires once per result, in tool-use order.
+ *
+ * The hook may transform the result either by mutating `toolResponse` in
+ * place (e.g. reassigning `toolResponse.content`) or by returning a new
+ * context with a fresh `toolResponse` — see {@link PluginHookFn}'s
+ * polymorphic return shape. The daemon threads the final `toolResponse`
+ * into the provider-bound history.
+ *
+ * Multiple plugins' hooks chain in registration order — each plugin's hook
+ * sees the previous plugin's mutations. The default tool-result-truncate
+ * plugin contributes a hook here that tail-drops oversized output to fit the
+ * model's context window; the default tool-error plugin sets
+ * {@link additionalContext} with retry coaching for failed results. User hooks
+ * can swap in a smarter strategy (e.g. a summarizer) or observe results for
+ * side effects.
+ */
+export declare interface PostToolUseContext {
+    /** Conversation ID the tool ran on. */
+    readonly conversationId: string;
+    /**
+     * The tool result block. Plugins may mutate its `content` in place or
+     * replace the block by returning a new context.
+     */
+    toolResponse: ToolResultContent;
+    /**
+     * Conversation history up to and including the assistant turn that issued
+     * this tool call. The current result is not in it yet — it lives in
+     * {@link toolResponse}. A hook reasoning about prior tool outcomes (e.g.
+     * how many times a tool has failed in a row) derives that from the history
+     * content rather than a precomputed counter, so the signal survives mid-run
+     * compaction rewriting the array. Read-only: hooks transform the result via
+     * {@link toolResponse}, not by mutating history.
+     */
+    readonly messages: ReadonlyArray<Message>;
+    /**
+     * Extra guidance for the model that is not part of the tool's output. A hook
+     * sets this to surface provider-only context — e.g. retry coaching for a
+     * failed result — and the daemon appends it to the provider-bound history as
+     * a separate block *after* emitting the tool_result, so it reaches the model
+     * without polluting the client-facing or persisted tool output. Mirrors
+     * Claude Code's PostToolUse `hookSpecificOutput.additionalContext` and the
+     * singular of Codex's `additional_contexts`. `null` means no extra context.
+     */
+    additionalContext: string | null;
+    /**
+     * The model's context-window size in tokens. Plugins derive their own
+     * character budget from this (e.g. a share of the window) rather than
+     * receiving a precomputed limit.
+     */
+    readonly maxInputTokens: number;
+    /**
+     * Logger scoped to the current turn. The same instance is shared by
+     * every hook in the chain, so plugins should tag their structured log
+     * fields (e.g. `{ plugin: "<name>" }`) for attribution.
+     */
+    readonly logger: PluginLogger;
+}
+
+/**
+ * Context passed to the `pre-model-call` hook. Fires immediately before each
+ * provider call — once per model call within a turn, including tool-result
+ * follow-up calls. Because it runs for every provider call (background, subagent,
+ * and compaction work can share a conversation), hooks MUST self-gate on
+ * {@link callSite} / {@link conversationId} before acting.
+ *
+ * A hook may edit the outbound request by replacing {@link systemPrompt}, and may
+ * opt this turn into deferred output streaming via {@link deferAssistantOutput}.
+ * Mutate the context in place or return a new one; throwing is contained by the
+ * loop (the call proceeds with the original request).
+ */
+export declare interface PreModelCallContext {
+    /** Conversation ID the call belongs to. */
+    readonly conversationId: string;
+    /**
+     * The call site this provider call serves — `"mainAgent"` for the user-facing
+     * reply, or a background/utility site. `null` for call sites that don't tag one.
+     */
+    readonly callSite: LLMCallSite | null;
+    /**
+     * The system prompt about to be sent. A hook may replace it (e.g. strip or
+     * append a section); the loop sends the resulting value.
+     */
+    systemPrompt: string | null;
+    /**
+     * Seeded `false`. When a hook sets it `true`, the loop suppresses this turn's
+     * live assistant `text_delta` stream; a `post-model-call` hook is then
+     * expected to produce the text the client sees (emitted once, after the reply
+     * is finalized). Lets a plugin replace streamed output wholesale — e.g.
+     * redaction that needs the full message — instead of leaking the raw stream.
+     */
+    deferAssistantOutput: boolean;
+    /** Logger scoped to the current turn (tag structured fields with `{ plugin }`). */
+    readonly logger: PluginLogger;
+}
+
+declare interface ProcessEntry extends BaseSubscriberEntry {
+    type: "process";
+}
+
+/** Callback for proxy policy decisions requiring user confirmation. Returns true if approved. */
+declare type ProxyApprovalCallback = (request: ProxyApprovalRequest) => Promise<boolean>;
+
+/** Approval request from the outbound proxy when a policy decision requires user confirmation. */
+declare interface ProxyApprovalRequest {
+    decision: {
+        kind: "ask_missing_credential" | "ask_unauthenticated";
+        target: {
+            hostname: string;
+            port: number | null;
+            path: string;
+            scheme: "http" | "https";
+        };
+        /** Present when kind is "ask_missing_credential". */
+        matchingPatterns?: string[];
+    };
+    sessionId: string;
+    /** HTTP method (plain HTTP only; undefined for HTTPS CONNECT tunnels). */
+    method?: string;
+    /** Curated non-sensitive headers (plain HTTP only). */
+    requestHeaders?: Record<string, string>;
+}
+
+declare type ProxyToolResolver = (toolName: string, input: Record<string, unknown>) => Promise<ToolExecutionResult>;
+
+declare interface PublishPageResponse {
+    type: "publish_page_response";
+    success: boolean;
+    publicUrl?: string;
+    deploymentId?: string;
+    error?: string;
+    errorCode?: string;
+}
+
+declare type QuestionRequestEvent = z.infer<typeof QuestionRequestEventSchema>;
+
+declare const QuestionRequestEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"question_request">;
+    requestId: z.ZodString;
+    questions: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        question: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        options: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        freeTextPlaceholder: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    question: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    options: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    freeTextPlaceholder: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+    toolUseId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+/** Recording options shared across standalone and CU recording flows. */
+declare interface RecordingOptions {
+    captureScope?: "display" | "window";
+    displayId?: string;
+    windowId?: number;
+    includeAudio?: boolean;
+    includeMicrophone?: boolean;
+    promptForSource?: boolean;
+}
+
+/** Server → Client: pause the active recording. */
+declare interface RecordingPause {
+    type: "recording_pause";
+    recordingId: string;
+}
+
+/** Server → Client: resume a paused recording. */
+declare interface RecordingResume {
+    type: "recording_resume";
+    recordingId: string;
+}
+
+/** Server → Client: start a recording. */
+declare interface RecordingStart {
+    type: "recording_start";
+    recordingId: string;
+    attachToConversationId?: string;
+    options?: RecordingOptions;
+    /** Operation token for restart race hardening — stale completions with mismatched tokens are rejected. */
+    operationToken?: string;
+}
+
+/** Server → Client: stop a recording. */
+declare interface RecordingStop {
+    type: "recording_stop";
+    recordingId: string;
+}
+
+export declare interface RedactedThinkingContent {
+    type: "redacted_thinking";
+    data: string;
+}
+
+declare type RelationshipStateUpdatedEvent = z.infer<typeof RelationshipStateUpdatedEventSchema>;
+
+declare const RelationshipStateUpdatedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"relationship_state_updated">;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+
+export declare enum RiskLevel {
+    Low = "low",
+    Medium = "medium",
+    High = "high"
+}
+
+/**
+ * Audit types for SkillSSH partner security analysis.
+ *
+ * Extracted as a leaf module so daemon message types can reference
+ * PartnerAudit without pulling in the full skillssh-registry module
+ * (which transitively imports cli/program and the entire CLI graph).
+ */
+declare type RiskLevel_2 = "safe" | "low" | "medium" | "high" | "critical" | "unknown";
+
+/**
+ * Emitted when the compaction circuit breaker trips. After three consecutive
+ * summary-LLM failures (with local fallback covering each), auto-compaction is
+ * suspended until `openUntil` to avoid repeatedly hammering a broken provider.
+ * User-initiated compaction (`/compact`, `force: true`) bypasses the breaker.
+ *
+ * `conversationId` scopes the event so clients can ignore breaker trips from
+ * other conversations — `EventStreamClient` broadcasts every parsed server
+ * message to all subscribers, so without this field a breaker trip in one
+ * conversation would set the "auto-compaction paused" banner on every open
+ * `ChatViewModel`.
+ */
+/** Server push — broadcast when a schedule creates a conversation. */
+declare interface ScheduleConversationCreated {
+    type: "schedule_conversation_created";
+    conversationId: string;
+    scheduleJobId: string;
+    title: string;
+}
+
+declare interface SchedulesListResponse {
+    type: "schedules_list_response";
+    schedules: Array<{
+        id: string;
+        name: string;
+        enabled: boolean;
+        syntax: string;
+        expression: string | null;
+        cronExpression: string | null;
+        timezone: string | null;
+        message: string;
+        nextRunAt: number;
+        lastRunAt: number | null;
+        lastStatus: string | null;
+        description: string;
+        cadenceDescription: string;
+        mode: string;
+        status: string;
+        routingIntent: string;
+        reuseConversation: boolean;
+        wakeConversationId: string | null;
+        isOneShot: boolean;
+    }>;
+}
+
+declare type _SchedulesServerMessages = SchedulesListResponse | HeartbeatAlert | HeartbeatConversationCreated | HeartbeatConfigResponse | HeartbeatRunsListResponse | HeartbeatRunNowResponse | HeartbeatChecklistResponse | HeartbeatChecklistWriteResponse | FilingConfigResponse | FilingRunNowResponse;
+
+declare interface ScopeOption {
+    label: string;
+    scope: string;
+}
+
+declare type SecretDelivery = "store" | "transient_send";
+
+declare interface SecretPromptResult {
+    value: string | null;
+    delivery: SecretDelivery;
+    /** When set, the prompt could not be delivered and the value is null due to a delivery failure (not user cancellation). */
+    error?: "unsupported_channel";
+}
+
+declare type SecretRequestEvent = z.infer<typeof SecretRequestEventSchema>;
+
+declare const SecretRequestEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"secret_request">;
+    requestId: z.ZodString;
+    service: z.ZodString;
+    field: z.ZodString;
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    placeholder: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+    purpose: z.ZodOptional<z.ZodString>;
+    allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowedDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowOneTimeSend: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+
+declare interface SensitiveOutputBinding {
+    kind: SensitiveOutputKind;
+    placeholder: string;
+    value: string;
+}
+
+declare type SensitiveOutputKind = "invite_code";
+
+declare type ServerMessage = _ConversationsServerMessages | _MessagesServerMessages | _SurfacesServerMessages | _SkillsServerMessages | _AppsServerMessages | _IntegrationsServerMessages | _ComputerUseServerMessages | _ContactsServerMessages | _WorkItemsServerMessages | _SubagentsServerMessages | _DocumentsServerMessages | _DocumentCommentsServerMessages | _GuardianActionsServerMessages | _SyncInvalidationServerMessages | _HomeServerMessages | _HostAppControlServerMessages | _HostBashServerMessages | _HostBrowserServerMessages | _HostCuServerMessages | _HostFileServerMessages | _HostTransferServerMessages | _MeetServerMessages | _MemoryServerMessages | _WorkspaceServerMessages | _SchedulesServerMessages | _SettingsServerMessages | _DiagnosticsServerMessages | _InboxServerMessages | _NotificationsServerMessages | _UpgradesServerMessages | _AcpServerMessages | _BookmarksServerMessages | DiskPressureStatusChangedEvent | SubagentEvent;
+
+export declare interface ServerToolUseContent {
+    type: "server_tool_use";
+    id: string;
+    name: string;
+    input: Record<string, unknown>;
+}
+
+/** Broadcast to connected clients when a service group update has completed. */
+declare interface ServiceGroupUpdateComplete {
+    type: "service_group_update_complete";
+    /** The version that was installed (may differ from target if rolled back). */
+    installedVersion: string;
+    /** Whether the update succeeded or rolled back. */
+    success: boolean;
+    /** If rolled back, the version reverted to. */
+    rolledBackToVersion?: string;
+}
+
+/** Broadcast to connected clients with a progress update during an upgrade or rollback. */
+declare interface ServiceGroupUpdateProgress {
+    type: "service_group_update_progress";
+    /** A short, user-friendly status message describing what's happening right now. */
+    statusMessage: string;
+}
+
+/** Broadcast to connected clients when a service group update is about to begin. */
+declare interface ServiceGroupUpdateStarting {
+    type: "service_group_update_starting";
+    /** The version being upgraded to. */
+    targetVersion: string;
+    /** Estimated seconds of downtime. */
+    expectedDowntimeSeconds: number;
+}
+
+declare type _SettingsServerMessages = ClientSettingsUpdate | AvatarUpdatedEvent | ConfigChanged | SoundsConfigUpdated | GenerateAvatarResponse;
+
+declare interface ShareAppCloudResponse {
+    type: "share_app_cloud_response";
+    success: boolean;
+    shareToken?: string;
+    shareUrl?: string;
+    error?: string;
+}
+
+declare interface SharedAppDeleteResponse {
+    type: "shared_app_delete_response";
+    success: boolean;
+}
+
+declare interface SharedAppsListResponse {
+    type: "shared_apps_list_response";
+    apps: Array<{
+        uuid: string;
+        name: string;
+        description?: string;
+        icon?: string;
+        preview?: string;
+        entry: string;
+        trustTier: string;
+        signerDisplayName?: string;
+        bundleSizeBytes: number;
+        installedAt: string;
+        version?: string;
+        contentId?: string;
+        updateAvailable?: boolean;
+    }>;
+}
+
+declare interface ShowPlatformLogin {
+    type: "show_platform_login";
+}
+
+declare interface SignBundlePayloadRequest {
+    type: "sign_bundle_payload";
+    requestId: string;
+    payload: string;
+}
+
+declare interface SkillBodyResponse {
+    type: "skill_detail_response";
+    skillId: string;
+    body: string;
+    icon?: string;
+    error?: string;
+}
+
+declare interface SkillsDraftResponse {
+    type: "skills_draft_response";
+    success: boolean;
+    draft?: {
+        skillId: string;
+        name: string;
+        description: string;
+        emoji?: string;
+        bodyMarkdown: string;
+    };
+    warnings?: string[];
+    error?: string;
+}
+
+declare interface SkillsInspectResponse {
+    type: "skills_inspect_response";
+    slug: string;
+    data?: {
+        skill: {
+            slug: string;
+            displayName: string;
+            summary: string;
+        };
+        owner?: {
+            handle: string;
+            displayName: string;
+            image?: string;
+        } | null;
+        stats?: {
+            stars: number;
+            installs: number;
+            downloads: number;
+            versions: number;
+        } | null;
+        createdAt?: number | null;
+        updatedAt?: number | null;
+        latestVersion?: {
+            version: string;
+            changelog?: string;
+        } | null;
+        files?: Array<{
+            path: string;
+            size: number;
+            contentType?: string;
+        }> | null;
+        skillMdContent?: string | null;
+    };
+    error?: string;
+}
+
+declare interface SkillsListResponse {
+    type: "skills_list_response";
+    skills: SlimSkillResponse[];
+}
+
+declare type _SkillsServerMessages = SkillsListResponse | SkillBodyResponse | SkillStateChanged | SkillsInspectResponse | SkillsDraftResponse;
+
+declare interface SkillsshSlimSkill extends SlimSkillBase {
+    origin: "skillssh";
+    slug: string;
+    sourceRepo: string;
+    installs: number;
+    audit?: Record<string, PartnerAudit>;
+}
+
+declare interface SkillStateChanged {
+    type: "skills_state_changed";
+    name: string;
+    state: "enabled" | "disabled" | "installed" | "uninstalled";
+}
+
+declare interface SlackWebhookConfigResponse {
+    type: "slack_webhook_config_response";
+    webhookUrl?: string;
+    success: boolean;
+    error?: string;
+}
+
+/** Fields shared by all skill origins. */
+declare interface SlimSkillBase {
+    id: string;
+    name: string;
+    description: string;
+    icon?: string;
+    emoji?: string;
+    kind: "bundled" | "installed" | "catalog";
+    status: "enabled" | "disabled" | "available";
+    category: string;
+    /**
+     * Extension that ships this skill, reusing the tool registry's
+     * {@link OwnerInfo} model. Set for plugin-resident skills as
+     * `{ kind: "plugin", id: <plugin dir name> }` so clients can attribute
+     * them to the owning plugin instead of collapsing to their `kind`/`origin`.
+     */
+    owner?: OwnerInfo;
+}
+
+declare type SlimSkillResponse = VellumSlimSkill | ClawhubSlimSkill | SkillsshSlimSkill | CustomSlimSkill;
+
+/** Sent by the daemon when sounds config or sound files change on disk. */
+declare interface SoundsConfigUpdated {
+    type: "sounds_config_updated";
+}
+
+/**
+ * Context passed to the `stop` hook — the loop's definitive terminal hook.
+ *
+ * It fires exactly once per run, after the loop has committed to ending and
+ * will not run another iteration this run. Unlike `post-model-call` (which owns
+ * the model-call-outcome retry decision), `stop` cannot continue the loop: by
+ * the time it runs the turn's outcome is settled. That guarantee makes it the
+ * home for teardown — a hook can release per-turn resources or clear per-turn
+ * state knowing nothing will re-enter the loop this run.
+ *
+ * It fires on every terminal exit: a no-tool reply, a max-tokens stop, a
+ * yield-to-user, an exhausted context-overflow recovery, a user abort, or an
+ * unhandled error. It also fires on a `checkpoint_handoff`, which ends the run
+ * for teardown purposes even though the orchestrator resumes the conversation
+ * in a fresh run. {@link exitReason} reports which one and {@link error}
+ * carries the rejection when the turn ended on one, so a hook that should act
+ * only on a particular ending guards on {@link exitReason}.
+ *
+ * Multiple plugins' hooks chain in registration order over the same context.
+ */
+export declare interface StopContext {
+    /** Conversation ID the run belongs to. */
+    readonly conversationId: string;
+    /**
+     * Full conversation history at the terminal stop — the inbound conversation
+     * followed by every message produced this run. Provided for inspection;
+     * mutating it has no effect, since the loop will not run again this turn.
+     */
+    readonly messages: ReadonlyArray<Message>;
+    /**
+     * The provider rejection that ended the turn, when it ended on one (e.g. an
+     * unrecoverable error after recovery hooks declined to retry). Absent on a
+     * clean stop.
+     */
+    readonly error?: Error;
+    /**
+     * Which terminal state the turn reached. A `checkpoint_handoff` fires this
+     * hook for teardown — the run pauses so the orchestrator can drain a queued
+     * message — but is not emitted as an `agent_loop_exit`, since the
+     * conversation resumes in a fresh run. `aborted_after_checkpoint` is a
+     * control transfer that re-enters the loop and so never reaches this hook.
+     */
+    readonly exitReason: AgentLoopExitReason;
+    /**
+     * Logger scoped to the current turn. The same instance is shared by
+     * every hook in the chain, so plugins should tag their structured log
+     * fields (e.g. `{ plugin: "<name>" }`) for attribution.
+     */
+    readonly logger: PluginLogger;
+}
+
+declare interface SubagentDetailResponse {
+    type: "subagent_detail_response";
+    subagentId: string;
+    objective?: string;
+    usage?: UsageStats;
+    events: Array<{
+        type: string;
+        content: string;
+        toolName?: string;
+        isError?: boolean;
+        messageId?: string;
+    }>;
+}
+
+/** Wraps any ServerMessage emitted by a subagent conversation for routing to the client. */
+declare interface SubagentEvent {
+    type: "subagent_event";
+    subagentId: string;
+    conversationId: string;
+    event: ServerMessage;
+}
+
+declare interface SubagentSpawned {
+    type: "subagent_spawned";
+    subagentId: string;
+    parentConversationId: string;
+    label: string;
+    objective: string;
+    isFork?: boolean;
+    /**
+     * Tool-use id of the `skill_execute` call that spawned this subagent. Lets
+     * the client anchor the inline subagent card to the exact spawn tool call,
+     * independent of the (reconcile-volatile) parent message id.
+     */
+    parentToolUseId?: string;
+}
+
+declare type _SubagentsServerMessages = SubagentSpawned | SubagentStatusChanged | SubagentDetailResponse;
+
+declare type SubagentStatus = "pending" | "running" | "awaiting_input" | "completed" | "failed" | "aborted";
+
+declare interface SubagentStatusChanged {
+    type: "subagent_status_changed";
+    subagentId: string;
+    status: SubagentStatus;
+    error?: string;
+    usage?: UsageStats;
+}
+
+declare type SubscriberEntry = ClientEntry | ProcessEntry;
+
+/** Input shape for `subscribe()` — hub fills `active`, `connectedAt`, `lastActiveAt`, `connectionId` and defaults `filter`/`onEvict`. */
+declare type SubscriberInput = DistributiveOmit<SubscriberEntry, "active" | "connectedAt" | "lastActiveAt" | "filter" | "onEvict" | "connectionId"> & {
+    filter?: AssistantEventFilter;
+    onEvict?: () => void;
+};
+
+declare interface SuggestionResponse {
+    type: "suggestion_response";
+    requestId: string;
+    suggestion: string | null;
+    source: "llm" | "none";
+}
+
+declare interface SurfaceAction {
+    id: string;
+    label: string;
+    style?: "primary" | "secondary" | "destructive";
+    /** Optional data payload returned to the daemon when this action is clicked. */
+    data?: Record<string, unknown>;
+}
+
+declare type SurfaceData = CardSurfaceData | ChoiceSurfaceData | CopyBlockSurfaceData | OAuthConnectSurfaceData | FormSurfaceData | ListSurfaceData | TableSurfaceData | ConfirmationSurfaceData | DynamicPageSurfaceData | FileUploadSurfaceData | DocumentPreviewSurfaceData | WorkResultSurfaceData;
+
+declare type _SurfacesServerMessages = UiSurfaceShow | UiSurfaceUpdate | UiSurfaceDismiss | UiSurfaceComplete | UiSurfaceUndoResult;
+
+declare type SyncChangedEvent = z.infer<typeof SyncChangedEventSchema>;
+
+declare const SyncChangedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"sync_changed">;
+    tags: z.ZodArray<z.ZodString>;
+    originClientId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare type _SyncInvalidationServerMessages = SyncChangedEvent;
+
+declare interface TableCellValue {
+    text: string;
+    icon?: string;
+    iconColor?: string;
+}
+
+declare interface TableColumn {
+    id: string;
+    label: string;
+    width?: number;
+}
+
+declare interface TableRow {
+    id: string;
+    cells: Record<string, string | TableCellValue>;
+    selectable?: boolean;
+    selected?: boolean;
+}
+
+declare interface TableSurfaceData {
+    columns: TableColumn[];
+    rows: TableRow[];
+    selectionMode?: "none" | "single" | "multiple";
+    caption?: string;
+}
+
+/** Server push — broadcast when a task run creates a conversation. */
+declare interface TaskRunConversationCreated {
+    type: "task_run_conversation_created";
+    conversationId: string;
+    workItemId: string;
+    title: string;
+}
+
+/** Server push — lightweight invalidation signal: the task queue has been mutated, refetch your list. */
+declare interface TasksChanged {
+    type: "tasks_changed";
+}
+
+declare interface TelegramConfigResponse {
+    type: "telegram_config_response";
+    success: boolean;
+    hasBotToken: boolean;
+    botId?: string;
+    botUsername?: string;
+    connected: boolean;
+    hasWebhookSecret: boolean;
+    lastError?: string;
+    error?: string;
+    /** Names of bot commands that were registered (present after set_commands or setup). */
+    commandsRegistered?: string[];
+    /** Non-fatal warning (e.g. commands registration failed during setup but token was configured). */
+    warning?: string;
+}
+
+export declare interface TextContent {
+    type: "text";
+    text: string;
+}
+
+export declare interface ThinkingContent {
+    type: "thinking";
+    thinking: string;
+    signature: string;
+}
+
+/** Discriminated container so future tools can add their own metadata. */
+declare interface ToolActivityMetadata {
+    webSearch?: WebSearchMetadata;
+    webFetch?: WebFetchMetadata;
+}
+
+export declare interface ToolContext {
+    /** Identifier of the conversation this tool invocation belongs to. */
+    conversationId: string;
+    /** Working directory the daemon was launched from. */
+    workingDir: string;
+    /** Per-turn request id for cross-component log correlation. */
+    requestId?: string;
+    /** Cooperative cancellation signal for long-running tools. Tools should check `signal.aborted` periodically (or forward `signal` to fetch / child-process options). */
+    signal?: AbortSignal;
+    /** Optional incremental-output callback for streaming tools. Streaming tools should fall back to returning the full result in `content` when this is absent. */
+    onOutput?: (chunk: string) => void;
+    /** Logical assistant scope for multi-assistant routing. */
+    assistantId?: string;
+    /** When set, the tool execution is part of a task run. Used to retrieve ephemeral permission rules. */
+    taskRunId?: string;
+    /**
+     * Model attribution snapshot for the conversation at invocation time
+     * (provider/model/profile that issued this tool call). Used by tool
+     * telemetry; never sent to the tool itself.
+     */
+    attribution?: UsageAttributionSnapshot | null;
+    /** Optional callback for tool lifecycle events (start/prompt/deny/execute/error). */
+    onToolLifecycleEvent?: ToolLifecycleEventHandler;
+    /** Optional resolver for proxy tools - delegates execution to an external client. */
+    proxyToolResolver?: ProxyToolResolver;
+    /** When set, only tools in this set may execute. Tools outside the set are blocked with an error. */
+    allowedToolNames?: Set<string>;
+    /** True when this turn is restricted to storage cleanup-safe tools. */
+    diskPressureCleanupModeActive?: boolean;
+    /** Prompt the user for a secret value via native SecureField UI. */
+    requestSecret?: (params: {
+        service: string;
+        field: string;
+        label: string;
+        description?: string;
+        placeholder?: string;
+        purpose?: string;
+        allowedTools?: string[];
+        allowedDomains?: string[];
+    }) => Promise<SecretPromptResult>;
+    /** Optional callback to send a message to the connected client (e.g. open_url). */
+    sendToClient?: (msg: {
+        type: string;
+        [key: string]: unknown;
+    }) => void;
+    /** True when an interactive client is connected (not just a no-op callback). */
+    isInteractive?: boolean;
+    /** When true, tools with side effects should always prompt for confirmation. */
+    forcePromptSideEffects?: boolean;
+    /**
+     * When true, the tool requires a fresh interactive approval for every
+     * invocation - no cached grants, temporary overrides, persistent
+     * "Always Allow" rules, or non-interactive auto-approve shortcuts may
+     * bypass the prompt. This flag is independently sufficient: it
+     * promotes allow → prompt decisions on its own and suppresses
+     * temporary override options in the prompt UI. Used by
+     * `manage_secure_command_tool` to ensure a human reviews each secure
+     * bundle installation.
+     */
+    requireFreshApproval?: boolean;
+    /** Approval callback for proxy policy decisions that require user confirmation. */
+    proxyApprovalCallback?: ProxyApprovalCallback;
+    /** Optional principal identifier propagated to sub-tool confirmation flows. */
+    principal?: string;
+    /**
+     * Trust classification of the actor who initiated this tool invocation.
+     * Determines permission level: guardians self-approve, trusted contacts
+     * may escalate to guardian for approval, unknown actors are fail-closed.
+     * See {@link TrustClass} in actor-trust-resolver.ts for value semantics.
+     */
+    trustClass: TrustClass;
+    /** Channel through which the tool invocation originates (e.g. 'telegram', 'phone'). Used for scoped grant consumption. */
+    executionChannel?: string;
+    /** Voice/call session ID, if the invocation originates from a call. Used for scoped grant consumption. */
+    callSessionId?: string;
+    /** True when the tool invocation was triggered by a user clicking a surface action button (not a regular message). */
+    triggeredBySurfaceAction?: boolean;
+    /** True when the user explicitly approved this tool invocation via the interactive permission prompt (not auto-approved by trust rules or temporary overrides). */
+    approvedViaPrompt?: boolean;
+    /**
+     * True when the invocation is inside a scheduled task run whose
+     * `required_tools` array pre-authorized this tool at task-creation time.
+     * Tools that normally require a surface-action click (e.g. bulk archive,
+     * unsubscribe) may treat this as equivalent consent, since the user
+     * already reviewed the tool list when the task was saved.
+     */
+    batchAuthorizedByTask?: boolean;
+    /** External user ID of the requester (non-guardian actor). Used for scoped grant consumption. */
+    requesterExternalUserId?: string;
+    /** Chat ID of the requester (non-guardian actor). Used for tool grant request escalation notifications. */
+    requesterChatId?: string;
+    /** Human-readable identifier for the requester (e.g., @username). */
+    requesterIdentifier?: string;
+    /** Preferred display name for the requester. */
+    requesterDisplayName?: string;
+    /** Slack channel ID for channel-scoped permission enforcement. When set, tools are checked against the channel's permission profile. */
+    channelPermissionChannelId?: string;
+    /** The tool_use block ID from the LLM response, used to correlate confirmation prompts with specific tool invocations. */
+    toolUseId?: string;
+    /** True when the assistant is running as a platform-managed remote instance. Used to auto-approve sandboxed bash tools. */
+    isPlatformHosted?: boolean;
+    /**
+     * The interface ID of the connected client driving the current turn (e.g.
+     * "macos", "chrome-extension"). Browser backend policy uses this to decide
+     * transport preference — for example, macOS-originated turns prefer the
+     * user's real Chrome session via the paired extension before falling back
+     * to cdp-inspect or local Playwright.
+     */
+    transportInterface?: InterfaceId;
+    /**
+     * The per-turn inference-profile override the agent loop is currently
+     * running under, propagated through tool context so subagent-spawn tools
+     * can forward it when spawning nested subagents. Without this, sub-subagent
+     * spawns silently lose inheritance because their own conversation row never
+     * has `inferenceProfile` set — the override only flows through the
+     * in-memory `SubagentConfig.overrideProfile` chain. See
+     * `executeSubagentSpawn` in tools/subagent/spawn.ts.
+     */
+    overrideProfile?: string;
+    /**
+     * Canonical principal ID of the actor on whose behalf this tool invocation
+     * is running. Sourced from `conversation.trustContext.guardianPrincipalId`.
+     * Used by host proxies to bind cross-client targeted execution to the same
+     * authenticated user identity. May be undefined for legacy/internal flows
+     * with no resolved actor identity.
+     */
+    sourceActorPrincipalId?: string;
+}
+
+/**
+ * Author-facing tool spec — re-exported from `@vellumai/plugin-api`.
+ * Loaders fill documented defaults for omitted fields via `finalizeTool`
+ * in `tool-defaults.ts`. The type is a direct `z.infer` of
+ * {@link ToolDefinitionSchema} — both `input_schema` and `execute` are
+ * typed correctly by the schema itself, no overlay needed.
+ */
+export declare type ToolDefinition = z.infer<typeof ToolDefinitionSchema>;
+
+/**
+ * Schema describing the shape of a {@link ToolDefinition}. All fields are
+ * optional — loaders fill documented defaults for omitted fields via
+ * `finalizeTool` in `tool-defaults.ts`. The IPC layer parses incoming
+ * skill tools against this same schema and re-finalizes them locally,
+ * so author shape and wire shape are one schema.
+ *
+ * `input_schema` is `z.custom<object>(...)` rather than
+ * `z.record(z.string(), z.unknown())` so that authors can assign a typed
+ * JSON-schema literal (`{ type: "object", properties: { ... } }`)
+ * without `as Record<...>` gymnastics. The custom check still rejects
+ * `null`, primitives, and arrays at runtime.
+ *
+ * `execute` is `z.custom<(input, context) => Promise<ToolExecutionResult>>()`
+ * for the same reason — the wire path drops closures (they can't cross
+ * IPC) and `finalizeTool` synthesizes a no-op error closure on arrival.
+ * The custom shape gives `ToolDefinition.execute` a fully-typed
+ * signature via `z.infer` without an overlay type.
+ *
+ * Result: `ToolDefinition = z.infer<typeof ToolDefinitionSchema>` —
+ * one declaration, both `input_schema` and `execute` typed correctly.
+ */
+declare const ToolDefinitionSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+    input_schema: z.ZodOptional<z.ZodCustom<object, object>>;
+    defaultRiskLevel: z.ZodOptional<z.ZodEnum<typeof RiskLevel>>;
+    category: z.ZodOptional<z.ZodString>;
+    executionTarget: z.ZodOptional<z.ZodEnum<{
+        sandbox: "sandbox";
+        host: "host";
+    }>>;
+    execute: z.ZodOptional<z.ZodCustom<(input: Record<string, unknown>, context: ToolContext) => Promise<ToolExecutionResult>, (input: Record<string, unknown>, context: ToolContext) => Promise<ToolExecutionResult>>>;
+}, z.core.$strip>;
+
+/**
+ * `ToolExecutedEvent` carries a `result: ToolExecutionResult` field, so
+ * the assistant re-declares it here to reference the assistant-side
+ * `ToolExecutionResult` (which narrows `contentBlocks` to `ContentBlock[]`
+ * and `cesApprovalRequired` to `ApprovalRequired`).
+ */
+declare interface ToolExecutedEvent extends ExecutorTelemetryStamp {
+    type: "executed";
+    toolName: string;
+    input: Record<string, unknown>;
+    workingDir: string;
+    conversationId: string;
+    requestId?: string;
+    executionTarget?: ExecutionTarget;
+    riskLevel: string;
+    /** ID of the trust rule that matched this invocation (if any). */
+    matchedTrustRuleId?: string;
+    /** How the approval decision was reached. Copied from PermissionDecision for analytics consumers. */
+    approvalMode?: string;
+    /** Why the approval decision was reached (stable enum). Copied from PermissionDecision for analytics consumers. */
+    approvalReason?: string;
+    decision: string;
+    durationMs: number;
+    result: ToolExecutionResult;
+}
+
+/**
+ * Extends the contracts declaration with the assistant-side telemetry
+ * fields stamped centrally by the executor's `emitLifecycleEvent`.
+ */
+declare interface ToolExecutionErrorEvent extends ToolExecutionErrorEvent_2, ExecutorTelemetryStamp {
+}
+
+declare interface ToolExecutionErrorEvent_2 extends ToolLifecycleEventBase {
+    type: "error";
+    riskLevel: string;
+    /** ID of the trust rule that matched this invocation (if any). */
+    matchedTrustRuleId?: string;
+    decision: string;
+    durationMs: number;
+    errorMessage: string;
+    isExpected: boolean;
+    /** Classifies the error for downstream consumers (audit, alerting, monitoring). */
+    errorCategory: ErrorCategory;
+    errorName?: string;
+    errorStack?: string;
+}
+
+export declare interface ToolExecutionResult {
+    /** Textual result shown to the model in the tool-result block. Empty string is valid. */
+    content: string;
+    /** When true, the agent loop treats `content` as an error and may surface it / retry. */
+    isError: boolean;
+    /** Optional short status message for client display (e.g. `"truncated"`, `"timed out"`). */
+    status?: string;
+    /**
+     * When true, the agent loop should yield control back to the user after
+     * returning this result — tool results are pushed to history and the loop
+     * breaks without another LLM call. Two callers set this: interactive
+     * surfaces (tables with action buttons, file uploads) that force-stop the
+     * loop so the LLM cannot bypass the "wait for user action" instruction,
+     * and tools like `remember` that expose a `finish_turn` parameter letting
+     * the LLM voluntarily end its turn.
+     */
+    yieldToUser?: boolean;
+    diff?: DiffInfo;
+    /** Optional rich content blocks (e.g. images) to include alongside text in the tool result. */
+    contentBlocks?: ContentBlock[];
+    /**
+     * Runtime-internal sensitive output bindings (placeholder -> real value).
+     * Populated by the executor when tool output contains
+     * `<vellum-sensitive-output>` directives. The agent loop merges these
+     * into a per-run substitution map for deterministic post-generation
+     * replacement. MUST NOT be emitted in client-facing events or logs.
+     */
+    sensitiveBindings?: SensitiveOutputBinding[];
+    /** Risk level from the classifier (populated during permission check). */
+    riskLevel?: string;
+    /** Human-readable reason for the risk classification. */
+    riskReason?: string;
+    /** ID of the trust rule that matched this invocation (if any). */
+    matchedTrustRuleId?: string;
+    /** How the decision was reached: prompted, auto, blocked, or unknown (legacy). */
+    approvalMode?: string;
+    /** Why the decision was reached (stable enum for client display). */
+    approvalReason?: string;
+    /** Snapshot of the auto-approve threshold at the time of execution. */
+    riskThreshold?: string;
+    /** Whether the daemon is running in a containerized (Docker) environment. */
+    isContainerized?: boolean;
+    /**
+     * Display-only ladder of scope option labels for the rule editor
+     * (narrowest to broadest). The `pattern` field here is a regex-style
+     * descriptor used internally by the daemon and is NOT a valid trust
+     * rule pattern. Use `riskAllowlistOptions` for the pattern that gets
+     * saved as a trust rule.
+     */
+    riskScopeOptions?: Array<{
+        pattern: string;
+        label: string;
+    }>;
+    /**
+     * Allowlist options for the rule editor save path (narrowest to
+     * broadest). Each `pattern` is a Minimatch-glob compatible string
+     * (e.g. raw command for exact match, `action:<program>` for command
+     * wildcards) — what the gateway actually matches against. Mirrors
+     * the `allowlistOptions` field on `ConfirmationRequest` SSE events.
+     */
+    riskAllowlistOptions?: Array<{
+        label: string;
+        description: string;
+        pattern: string;
+    }>;
+    /** Directory scope ladder for the rule editor (narrowest to broadest). */
+    riskDirectoryScopeOptions?: Array<{
+        scope: string;
+        label: string;
+    }>;
+    /**
+     * When present, indicates that a CES tool returned an `approval_required`
+     * response. The executor uses the approval bridge to prompt the guardian,
+     * commit the grant decision to CES, and retry the original tool invocation
+     * with the granted grantId. CES tools populate this field rather than
+     * returning a textual error so the executor can intercept and handle the
+     * approval flow transparently.
+     */
+    cesApprovalRequired?: ApprovalRequired;
+    /** Structured activity metadata for client rendering (web search, web fetch, etc).
+     *  Populated by daemon-internal tools; plugins must not set this. */
+    activityMetadata?: ToolActivityMetadata;
+}
+
+declare interface ToolExecutionStartEvent extends ToolLifecycleEventBase {
+    type: "start";
+    startedAtMs: number;
+}
+
+declare interface ToolInputDelta {
+    type: "tool_input_delta";
+    toolName: string;
+    content: string;
+    conversationId?: string;
+    /** The tool_use block ID for client-side correlation. */
+    toolUseId?: string;
+    /** Database ID of the assistant message that owns this tool_use block.
+     *  Same semantics as `AssistantTextDeltaEvent.messageId`. */
+    messageId?: string;
+}
+
+declare interface ToolInputSchema {
+    type: "object";
+    properties?: Record<string, {
+        type?: string;
+        description?: string;
+        enum?: string[];
+        [key: string]: unknown;
+    }>;
+    required?: string[];
+}
+
+declare type ToolLifecycleEvent = ToolExecutionStartEvent | ToolPermissionPromptEvent | ToolPermissionDeniedEvent | ToolExecutedEvent | ToolExecutionErrorEvent;
+
+declare interface ToolLifecycleEventBase {
+    toolName: string;
+    input: Record<string, unknown>;
+    workingDir: string;
+    conversationId: string;
+    requestId?: string;
+    executionTarget?: ExecutionTarget;
+}
+
+declare type ToolLifecycleEventHandler = (event: ToolLifecycleEvent) => void | Promise<void>;
+
+declare interface ToolNamesListResponse {
+    type: "tool_names_list_response";
+    /** Sorted list of all registered tool names. */
+    names: string[];
+    /** Input schemas keyed by tool name. */
+    schemas?: Record<string, ToolInputSchema>;
+}
+
+declare type ToolOutputChunkEvent = z.infer<typeof ToolOutputChunkEventSchema>;
+
+declare const ToolOutputChunkEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool_output_chunk">;
+    chunk: z.ZodString;
+    conversationId: z.ZodOptional<z.ZodString>;
+    toolUseId: z.ZodOptional<z.ZodString>;
+    subType: z.ZodOptional<z.ZodEnum<{
+        status: "status";
+        tool_start: "tool_start";
+        tool_complete: "tool_complete";
+    }>>;
+    subToolName: z.ZodOptional<z.ZodString>;
+    subToolInput: z.ZodOptional<z.ZodString>;
+    subToolIsError: z.ZodOptional<z.ZodBoolean>;
+    subToolId: z.ZodOptional<z.ZodString>;
+    messageId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare interface ToolPermissionDeniedEvent extends ToolLifecycleEventBase {
+    type: "permission_denied";
+    riskLevel: string;
+    /** Classifier-provided reason explaining why the risk level was assigned (bash/host_bash only). */
+    riskReason?: string;
+    /** ID of the trust rule that matched this invocation (if any). */
+    matchedTrustRuleId?: string;
+    decision: "deny" | "always_deny";
+    reason: string;
+    durationMs: number;
+}
+
+declare interface ToolPermissionPromptEvent extends ToolLifecycleEventBase {
+    type: "permission_prompt";
+    riskLevel: string;
+    /** Classifier-provided reason explaining why the risk level was assigned (bash/host_bash only). */
+    riskReason?: string;
+    reason: string;
+    allowlistOptions: AllowlistOption[];
+    scopeOptions: ScopeOption[];
+    diff?: DiffInfo;
+    persistentDecisionsAllowed?: boolean;
+}
+
+declare interface ToolPermissionSimulateResponse {
+    type: "tool_permission_simulate_response";
+    success: boolean;
+    /** The simulated permission decision. */
+    decision?: "allow" | "deny" | "prompt";
+    /** Risk level of the simulated tool invocation. */
+    riskLevel?: string;
+    /** Human-readable reason for the decision. */
+    reason?: string;
+    /** When decision is 'prompt', the data needed to render a ToolConfirmationBubble. */
+    promptPayload?: {
+        allowlistOptions: Array<{
+            label: string;
+            description: string;
+            pattern: string;
+        }>;
+        scopeOptions: Array<{
+            label: string;
+            scope: string;
+        }>;
+        persistentDecisionsAllowed: boolean;
+    };
+    /** Resolved execution target for the tool. */
+    executionTarget?: "host" | "sandbox";
+    /** ID of the trust rule that matched (if any). */
+    matchedTrustRuleId?: string;
+    /** Error message when success is false. */
+    error?: string;
+}
+
+export declare interface ToolResultContent {
+    type: "tool_result";
+    tool_use_id: string;
+    content: string;
+    is_error?: boolean;
+    /** Rich content blocks (e.g. images) to include alongside text in the tool result. */
+    contentBlocks?: ContentBlock[];
+}
+
+declare type ToolResultEvent = z.infer<typeof ToolResultEventSchema>;
+
+declare const ToolResultEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool_result">;
+    toolName: z.ZodString;
+    result: z.ZodString;
+    isError: z.ZodOptional<z.ZodBoolean>;
+    diff: z.ZodOptional<z.ZodObject<{
+        filePath: z.ZodString;
+        oldContent: z.ZodString;
+        newContent: z.ZodString;
+        isNewFile: z.ZodBoolean;
+    }, z.core.$strip>>;
+    status: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+    imageData: z.ZodOptional<z.ZodString>;
+    imageDataList: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    toolUseId: z.ZodOptional<z.ZodString>;
+    messageId: z.ZodOptional<z.ZodString>;
+    riskLevel: z.ZodOptional<z.ZodString>;
+    riskReason: z.ZodOptional<z.ZodString>;
+    matchedTrustRuleId: z.ZodOptional<z.ZodString>;
+    isContainerized: z.ZodOptional<z.ZodBoolean>;
+    riskScopeOptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        pattern: z.ZodString;
+        label: z.ZodString;
+    }, z.core.$strip>>>;
+    riskAllowlistOptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        description: z.ZodString;
+        pattern: z.ZodString;
+    }, z.core.$strip>>>;
+    riskDirectoryScopeOptions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        scope: z.ZodString;
+    }, z.core.$strip>>>;
+    approvalMode: z.ZodOptional<z.ZodString>;
+    approvalReason: z.ZodOptional<z.ZodString>;
+    riskThreshold: z.ZodOptional<z.ZodString>;
+    activityMetadata: z.ZodOptional<z.ZodObject<{
+        webSearch: z.ZodOptional<z.ZodObject<{
+            query: z.ZodString;
+            provider: z.ZodEnum<{
+                "anthropic-native": "anthropic-native";
+                brave: "brave";
+                perplexity: "perplexity";
+                tavily: "tavily";
+            }>;
+            resultCount: z.ZodNumber;
+            durationMs: z.ZodNumber;
+            results: z.ZodArray<z.ZodObject<{
+                rank: z.ZodNumber;
+                title: z.ZodString;
+                url: z.ZodString;
+                domain: z.ZodString;
+                faviconUrl: z.ZodOptional<z.ZodString>;
+                snippet: z.ZodOptional<z.ZodString>;
+                age: z.ZodOptional<z.ZodString>;
+                score: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+            errorMessage: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        webFetch: z.ZodOptional<z.ZodObject<{
+            url: z.ZodString;
+            finalUrl: z.ZodString;
+            status: z.ZodNumber;
+            contentType: z.ZodOptional<z.ZodString>;
+            byteCount: z.ZodNumber;
+            charCount: z.ZodNumber;
+            truncated: z.ZodBoolean;
+            title: z.ZodOptional<z.ZodString>;
+            domain: z.ZodString;
+            faviconUrl: z.ZodOptional<z.ZodString>;
+            redirectCount: z.ZodNumber;
+            durationMs: z.ZodNumber;
+            errorMessage: z.ZodOptional<z.ZodString>;
+            mayRequireJavaScript: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    completedAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+
+export declare interface ToolUseContent {
+    type: "tool_use";
+    id: string;
+    name: string;
+    input: Record<string, unknown>;
+    providerMetadata?: {
+        gemini?: {
+            thoughtSignature?: string;
+        };
+    };
+}
+
+declare type ToolUsePreviewStartEvent = z.infer<typeof ToolUsePreviewStartEventSchema>;
+
+declare const ToolUsePreviewStartEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool_use_preview_start">;
+    toolUseId: z.ZodString;
+    toolName: z.ZodString;
+    conversationId: z.ZodOptional<z.ZodString>;
+    messageId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+
+declare type ToolUseStartEvent = z.infer<typeof ToolUseStartEventSchema>;
+
+declare const ToolUseStartEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tool_use_start">;
+    toolName: z.ZodString;
+    input: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    toolUseId: z.ZodOptional<z.ZodString>;
+    messageId: z.ZodOptional<z.ZodString>;
+    conversationId: z.ZodOptional<z.ZodString>;
+    startedAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+
+declare type TraceEvent = z.infer<typeof TraceEventSchema>;
+
+declare const TraceEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"trace_event">;
+    eventId: z.ZodString;
+    conversationId: z.ZodString;
+    requestId: z.ZodOptional<z.ZodString>;
+    timestampMs: z.ZodNumber;
+    sequence: z.ZodNumber;
+    kind: z.ZodEnum<{
+        generation_cancelled: "generation_cancelled";
+        generation_handoff: "generation_handoff";
+        message_complete: "message_complete";
+        request_received: "request_received";
+        request_queued: "request_queued";
+        request_dequeued: "request_dequeued";
+        llm_call_started: "llm_call_started";
+        llm_call_finished: "llm_call_finished";
+        assistant_message: "assistant_message";
+        tool_started: "tool_started";
+        tool_permission_requested: "tool_permission_requested";
+        tool_permission_decided: "tool_permission_decided";
+        tool_finished: "tool_finished";
+        tool_failed: "tool_failed";
+        request_error: "request_error";
+        tool_profiling_summary: "tool_profiling_summary";
+    }>;
+    status: z.ZodOptional<z.ZodEnum<{
+        error: "error";
+        info: "info";
+        success: "success";
+        warning: "warning";
+    }>>;
+    summary: z.ZodString;
+    attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>>>;
+}, z.core.$strip>;
+
+/**
+ * Trust classification for an inbound actor.
+ *
+ * - `'guardian'`: The sender matches the active guardian binding for this
+ *   (assistant, channel). Guardians have full control-plane access and
+ *   self-approve tool invocations.
+ * - `'trusted_contact'`: The sender is an active contact with a channel
+ *   (not the guardian). Trusted contacts can invoke tools but require
+ *   guardian approval for sensitive operations.
+ * - `'unknown'`: The sender has no contact record, no identity could be
+ *   established, or the sender is an inactive/revoked contact. Unknown
+ *   actors are fail-closed with no escalation path.
+ */
+declare type TrustClass = "guardian" | "trusted_contact" | "unknown";
+
+declare type TurnProfileAutoRoutedEvent = z.infer<typeof TurnProfileAutoRoutedEventSchema>;
+
+declare const TurnProfileAutoRoutedEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"turn_profile_auto_routed">;
+    conversationId: z.ZodString;
+    profile: z.ZodString;
+    profileLabel: z.ZodString;
+}, z.core.$strip>;
+
+declare interface UiSurfaceComplete {
+    type: "ui_surface_complete";
+    conversationId: string;
+    surfaceId: string;
+    summary: string;
+    submittedData?: Record<string, unknown>;
+}
+
+declare interface UiSurfaceDismiss {
+    type: "ui_surface_dismiss";
+    conversationId: string;
+    surfaceId: string;
+}
+
+declare type UiSurfaceShow = UiSurfaceShowCard | UiSurfaceShowChoice | UiSurfaceShowCopyBlock | UiSurfaceShowOAuthConnect | UiSurfaceShowForm | UiSurfaceShowList | UiSurfaceShowTable | UiSurfaceShowConfirmation | UiSurfaceShowDynamicPage | UiSurfaceShowFileUpload | UiSurfaceShowDocumentPreview | UiSurfaceShowWorkResult;
+
+/** Common fields shared by all UiSurfaceShow variants. */
+declare interface UiSurfaceShowBase {
+    type: "ui_surface_show";
+    conversationId: string;
+    surfaceId: string;
+    title?: string;
+    actions?: SurfaceAction[];
+    display?: "inline" | "panel";
+    /** The message ID that this surface belongs to (for history loading). */
+    messageId?: string;
+    /** When `true`, clicking an action does not dismiss the surface — the client keeps the card visible and only marks the clicked `actionId` as spent so siblings remain clickable. */
+    persistent?: boolean;
+    /** Id of the tool call that produced this surface (the `ui_show` proxy tool). Lets the client gate app previews on the tool result's arrival rather than whole-turn streaming state. */
+    toolCallId?: string;
+}
+
+declare interface UiSurfaceShowCard extends UiSurfaceShowBase {
+    surfaceType: "card";
+    data: CardSurfaceData;
+}
+
+declare interface UiSurfaceShowChoice extends UiSurfaceShowBase {
+    surfaceType: "choice";
+    data: ChoiceSurfaceData;
+}
+
+declare interface UiSurfaceShowConfirmation extends UiSurfaceShowBase {
+    surfaceType: "confirmation";
+    data: ConfirmationSurfaceData;
+}
+
+declare interface UiSurfaceShowCopyBlock extends UiSurfaceShowBase {
+    surfaceType: "copy_block";
+    data: CopyBlockSurfaceData;
+}
+
+declare interface UiSurfaceShowDocumentPreview extends UiSurfaceShowBase {
+    surfaceType: "document_preview";
+    data: DocumentPreviewSurfaceData;
+}
+
+declare interface UiSurfaceShowDynamicPage extends UiSurfaceShowBase {
+    surfaceType: "dynamic_page";
+    data: DynamicPageSurfaceData;
+}
+
+declare interface UiSurfaceShowFileUpload extends UiSurfaceShowBase {
+    surfaceType: "file_upload";
+    data: FileUploadSurfaceData;
+}
+
+declare interface UiSurfaceShowForm extends UiSurfaceShowBase {
+    surfaceType: "form";
+    data: FormSurfaceData;
+}
+
+declare interface UiSurfaceShowList extends UiSurfaceShowBase {
+    surfaceType: "list";
+    data: ListSurfaceData;
+}
+
+declare interface UiSurfaceShowOAuthConnect extends UiSurfaceShowBase {
+    surfaceType: "oauth_connect";
+    data: OAuthConnectSurfaceData;
+}
+
+declare interface UiSurfaceShowTable extends UiSurfaceShowBase {
+    surfaceType: "table";
+    data: TableSurfaceData;
+}
+
+declare interface UiSurfaceShowWorkResult extends UiSurfaceShowBase {
+    surfaceType: "work_result";
+    data: WorkResultSurfaceData;
+}
+
+declare interface UiSurfaceUndoResult {
+    type: "ui_surface_undo_result";
+    conversationId: string;
+    surfaceId: string;
+    success: boolean;
+    /** Number of remaining undo entries after this undo. */
+    remainingUndos: number;
+}
+
+declare interface UiSurfaceUpdate {
+    type: "ui_surface_update";
+    conversationId: string;
+    surfaceId: string;
+    data: Partial<SurfaceData>;
+}
+
+declare interface UndoComplete {
+    type: "undo_complete";
+    removedCount: number;
+    conversationId?: string;
+}
+
+declare interface UnpublishPageResponse {
+    type: "unpublish_page_response";
+    success: boolean;
+    error?: string;
+}
+
+declare type _UpgradesServerMessages = ServiceGroupUpdateStarting | ServiceGroupUpdateProgress | ServiceGroupUpdateComplete;
+
+declare type UsageAttributionProfileSource = "call_site" | "conversation" | "active" | "default" | "unknown";
+
+declare interface UsageAttributionSnapshot {
+    callSite: LLMCallSite | null;
+    activeProfile: string | null;
+    overrideProfile: string | null;
+    callSiteProfile: string | null;
+    appliedProfile: string | null;
+    profileSource: UsageAttributionProfileSource;
+    resolvedProvider: string;
+    resolvedModel: string;
+    /**
+     * When `appliedProfile` is a mix profile, the constituent arm chosen for
+     * this request; null otherwise. Lets A/B analysis attribute usage to the
+     * specific arm (mix name lives in `appliedProfile`).
+     */
+    resolvedMixArm: string | null;
+}
+
+/**
+ * Emitted after each LLM call with per-call token deltas and estimated cost.
+ * Clients accumulate these additively for live-updating usage metrics.
+ * This is a UI-only hint — it does not persist to DB or affect billing.
+ */
+declare interface UsageProgress {
+    type: "usage_progress";
+    conversationId: string;
+    inputTokens: number;
+    outputTokens: number;
+    estimatedCost: number;
+    model: string;
+}
+
+declare interface UsageResponse {
+    type: "usage_response";
+    totalInputTokens: number;
+    totalOutputTokens: number;
+    estimatedCost: number;
+    model: string;
+}
+
+declare interface UsageStats {
+    inputTokens: number;
+    outputTokens: number;
+    estimatedCost: number;
+}
+
+declare type UsageUpdateEvent = z.infer<typeof UsageUpdateEventSchema>;
+
+declare const UsageUpdateEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"usage_update">;
+    conversationId: z.ZodString;
+    inputTokens: z.ZodNumber;
+    outputTokens: z.ZodNumber;
+    totalInputTokens: z.ZodNumber;
+    totalOutputTokens: z.ZodNumber;
+    estimatedCost: z.ZodNumber;
+    model: z.ZodString;
+    contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+    contextWindowMaxTokens: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+
+declare interface UserMessageAttachment {
+    id?: string;
+    filename: string;
+    mimeType: string;
+    data: string;
+    /** Origin of the attachment on the daemon side, when known. */
+    sourceType?: "sandbox_file" | "host_file" | "tool_block";
+    extractedText?: string;
+    /** Original file size in bytes. Present when data was omitted from history_response to reduce payload size. */
+    sizeBytes?: number;
+    /** Base64-encoded JPEG thumbnail. Generated server-side for video attachments. */
+    thumbnailData?: string;
+    /** Absolute path to the local file on disk. Present for file-backed attachments (e.g. recordings). */
+    filePath?: string;
+    /** True when the attachment is file-backed and clients should hydrate via the /content endpoint. */
+    fileBacked?: boolean;
+}
+
+declare type UserMessageEchoEvent = z.infer<typeof UserMessageEchoEventSchema>;
+
+declare const UserMessageEchoEventSchema: z.ZodObject<{
+    type: z.ZodLiteral<"user_message_echo">;
+    text: z.ZodString;
+    conversationId: z.ZodOptional<z.ZodString>;
+    messageId: z.ZodOptional<z.ZodString>;
+    requestId: z.ZodOptional<z.ZodString>;
+    clientMessageId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+
+/**
+ * Context passed to the `user-prompt-submit` hook. Fires once per user
+ * turn, after the agent loop has prepared the message list (PKB / NOW /
+ * memory-graph injections, overflow reduction all already applied) and
+ * immediately before the messages are handed to the agent loop's tool/LLM
+ * iteration.
+ *
+ * The hook may transform `latestMessages` either by mutating it in place
+ * (`push` / `splice` / `length = 0`) or by returning a new context with
+ * a fresh `latestMessages` array — see {@link PluginHookFn}'s polymorphic
+ * return shape. The daemon threads the final `latestMessages` value into
+ * `agentLoop.run()` as the run-messages argument.
+ *
+ * `originalMessages` is the user's original message list, frozen for the
+ * hook. Plugins should treat it as a stable reference point if they need
+ * to recover from earlier transformations or compare against the pristine
+ * state.
+ *
+ * Multiple plugins' hooks chain in registration order — each plugin's
+ * hook sees the previous plugin's mutations (whether by reassignment or
+ * in-place mutation).
+ */
+export declare interface UserPromptSubmitContext {
+    /** Conversation ID the user prompt was submitted on. */
+    readonly conversationId: string;
+    /**
+     * Persisted ID of the user message that triggered this turn. Hooks that
+     * attach turn-scoped metadata to the originating message (e.g. recording an
+     * injected memory block so it survives a conversation reload) key off this
+     * row id rather than the in-memory message arrays, whose entries carry no id.
+     */
+    readonly userMessageId: string;
+    /**
+     * Stable ID for the request that drives this turn. Hooks that perform
+     * runtime injection forward it onto the injector turn context so the
+     * assembled blocks are attributed to the originating request; it is fixed
+     * for the turn and cannot be recovered from the message arrays.
+     */
+    readonly requestId: string;
+    /**
+     * Active inference profile key to surface in this turn's context, or `null`
+     * when the profile is unchanged since the one last announced to the model.
+     * Hooks that emit the `model_profile` grounding line resolve the
+     * human-readable label (and model id) from this key via the workspace LLM
+     * config rather than receiving the rendered string — the key is the minimal
+     * turn input the message arrays cannot carry.
+     */
+    readonly modelProfileKey: string | null;
+    /**
+     * Whether the turn has no human present to answer clarification questions
+     * (e.g. a scheduled, background, or headless run). Resolved once at turn
+     * start from the run's interactivity option, falling back to live client
+     * presence — a single value the hook reads rather than re-deriving from
+     * mutable conversation state that can flip mid-turn. Hooks that assemble the
+     * turn's runtime injections forward it so the assembled context reflects the
+     * turn's interactivity.
+     */
+    readonly isNonInteractive: boolean;
+    /**
+     * The text of the user prompt that triggered this turn — the resolved
+     * user message (after slash-command expansion), independent of any
+     * internal rewriting applied to the message that flows into the model.
+     * Mirrors the `prompt` field Claude Code / Codex pass to their
+     * `UserPromptSubmit` hooks, so hooks that key off the submitted text
+     * (e.g. title generation) read it directly rather than reconstructing
+     * it from the message arrays.
+     */
+    readonly prompt: string;
+    /**
+     * The user's original message list, immutable for the hook. Plugins
+     * may snapshot or compare against this but MUST NOT mutate it.
+     */
+    readonly originalMessages: ReadonlyArray<Message>;
+    /**
+     * The working message list that flows into `agentLoop.run`. Plugins
+     * may mutate this in place or replace it by returning a new context.
+     */
+    latestMessages: Message[];
+    /**
+     * Logger scoped to the current turn. The same instance is shared by
+     * every hook in the chain, so plugins should tag their structured log
+     * fields (e.g. `{ plugin: "<name>" }`) for attribution.
+     */
+    readonly logger: PluginLogger;
+}
+
+declare interface VellumSlimSkill extends SlimSkillBase {
+    origin: "vellum";
+}
+
+declare interface VercelApiConfigResponse {
+    type: "vercel_api_config_response";
+    hasToken: boolean;
+    success: boolean;
+    error?: string;
+}
+
+declare interface WebFetchMetadata {
+    url: string;
+    finalUrl: string;
+    status: number;
+    contentType?: string;
+    byteCount: number;
+    charCount: number;
+    truncated: boolean;
+    title?: string;
+    domain: string;
+    faviconUrl?: string;
+    redirectCount: number;
+    durationMs: number;
+    errorMessage?: string;
+    /** Set when extracted text is dramatically smaller than raw HTML — likely a JS-rendered SPA whose meaningful content the static fetcher missed. */
+    mayRequireJavaScript?: boolean;
+}
+
+declare interface WebSearchMetadata {
+    query: string;
+    provider: WebSearchProviderId;
+    resultCount: number;
+    durationMs: number;
+    results: WebSearchResultItem[];
+    /** Present when search itself failed; results[] will be empty. */
+    errorMessage?: string;
+}
+
+declare type WebSearchProviderId = "anthropic-native" | "brave" | "perplexity" | "tavily";
+
+declare interface WebSearchResultItem {
+    rank: number;
+    title: string;
+    url: string;
+    domain: string;
+    faviconUrl?: string;
+    snippet?: string;
+    age?: string;
+    score?: number;
+}
+
+export declare interface WebSearchToolResultContent {
+    type: "web_search_tool_result";
+    tool_use_id: string;
+    content: unknown;
+}
+
+declare interface WorkItemApprovePermissionsResponse {
+    type: "work_item_approve_permissions_response";
+    id: string;
+    success: boolean;
+    error?: string;
+}
+
+declare interface WorkItemCancelResponse {
+    type: "work_item_cancel_response";
+    id: string;
+    success: boolean;
+    error?: string;
+}
+
+declare interface WorkItemDeleteResponse {
+    type: "work_item_delete_response";
+    id: string;
+    success: boolean;
+}
+
+declare interface WorkItemGetResponse {
+    type: "work_item_get_response";
+    item: {
+        id: string;
+        taskId: string;
+        title: string;
+        notes: string | null;
+        status: string;
+        priorityTier: number;
+        sortIndex: number | null;
+        lastRunId: string | null;
+        lastRunConversationId: string | null;
+        lastRunStatus: string | null;
+        sourceType: string | null;
+        sourceId: string | null;
+        createdAt: number;
+        updatedAt: number;
+    } | null;
+}
+
+declare interface WorkItemOutputResponse {
+    type: "work_item_output_response";
+    id: string;
+    success: boolean;
+    error?: string;
+    output?: {
+        title: string;
+        status: string;
+        runId: string | null;
+        conversationId: string | null;
+        completedAt: number | null;
+        summary: string;
+        highlights: string[];
+    };
+}
+
+declare interface WorkItemPreflightResponse {
+    type: "work_item_preflight_response";
+    id: string;
+    success: boolean;
+    error?: string;
+    permissions?: {
+        tool: string;
+        description: string;
+        riskLevel: "low" | "medium" | "high";
+        currentDecision: "allow" | "deny" | "prompt";
+    }[];
+}
+
+declare type WorkItemRunTaskErrorCode = "not_found" | "already_running" | "invalid_status" | "no_task" | "permission_required";
+
+declare interface WorkItemRunTaskResponse {
+    type: "work_item_run_task_response";
+    id: string;
+    lastRunId: string;
+    success: boolean;
+    error?: string;
+    /** Structured error code so the client can deterministically re-enable buttons or show contextual UI. */
+    errorCode?: WorkItemRunTaskErrorCode;
+}
+
+declare interface WorkItemsListResponse {
+    type: "work_items_list_response";
+    items: Array<{
+        id: string;
+        taskId: string;
+        title: string;
+        notes: string | null;
+        status: string;
+        priorityTier: number;
+        sortIndex: number | null;
+        lastRunId: string | null;
+        lastRunConversationId: string | null;
+        lastRunStatus: string | null;
+        sourceType: string | null;
+        sourceId: string | null;
+        createdAt: number;
+        updatedAt: number;
+    }>;
+}
+
+declare type _WorkItemsServerMessages = WorkItemsListResponse | WorkItemGetResponse | WorkItemUpdateResponse | WorkItemDeleteResponse | WorkItemRunTaskResponse | WorkItemOutputResponse | WorkItemPreflightResponse | WorkItemApprovePermissionsResponse | WorkItemCancelResponse | WorkItemStatusChanged | TaskRunConversationCreated | TasksChanged;
+
+/** Server push — broadcast when a work item status changes (e.g. running -> awaiting_review). */
+declare interface WorkItemStatusChanged {
+    type: "work_item_status_changed";
+    item: {
+        id: string;
+        taskId: string;
+        title: string;
+        status: string;
+        lastRunId: string | null;
+        lastRunConversationId: string | null;
+        lastRunStatus: string | null;
+        updatedAt: number;
+    };
+}
+
+declare interface WorkItemUpdateResponse {
+    type: "work_item_update_response";
+    item: {
+        id: string;
+        taskId: string;
+        title: string;
+        notes: string | null;
+        status: string;
+        priorityTier: number;
+        sortIndex: number | null;
+        lastRunId: string | null;
+        lastRunConversationId: string | null;
+        lastRunStatus: string | null;
+        sourceType: string | null;
+        sourceId: string | null;
+        createdAt: number;
+        updatedAt: number;
+    } | null;
+}
+
+declare interface WorkResultDiff {
+    label?: string;
+    before?: string;
+    after?: string;
+}
+
+declare interface WorkResultItem {
+    id?: string;
+    title: string;
+    description?: string;
+    status?: string;
+    tone?: WorkResultTone;
+    metadata?: WorkResultMetadata[];
+    href?: string;
+}
+
+declare interface WorkResultMetadata {
+    label: string;
+    value: string | number;
+}
+
+declare interface WorkResultMetric {
+    label: string;
+    value: string | number;
+    detail?: string;
+    tone?: WorkResultTone;
+}
+
+declare interface WorkResultSection {
+    id?: string;
+    title: string;
+    description?: string;
+    type?: WorkResultSectionType;
+    items?: WorkResultItem[];
+    diffs?: WorkResultDiff[];
+}
+
+declare type WorkResultSectionType = "items" | "timeline" | "diff" | "artifacts" | "warnings";
+
+declare type WorkResultStatus = "completed" | "partial" | "failed" | "in_progress";
+
+declare interface WorkResultSurfaceData {
+    eyebrow?: string;
+    status?: WorkResultStatus;
+    summary?: string;
+    metrics?: WorkResultMetric[];
+    sections?: WorkResultSection[];
+}
+
+declare type WorkResultTone = "neutral" | "positive" | "warning" | "negative";
+
+declare interface WorkspaceFileReadResponse {
+    type: "workspace_file_read_response";
+    path: string;
+    content: string | null;
+    error?: string;
+}
+
+declare interface WorkspaceFilesListResponse {
+    type: "workspace_files_list_response";
+    files: Array<{
+        /** Relative path within the workspace (e.g. "IDENTITY.md", "skills/my-skill"). */
+        path: string;
+        /** Display name (e.g. "IDENTITY.md"). */
+        name: string;
+        /** Whether the file/directory exists. */
+        exists: boolean;
+    }>;
+}
+
+declare type _WorkspaceServerMessages = WorkspaceFilesListResponse | WorkspaceFileReadResponse | IdentityGetResponse | ToolPermissionSimulateResponse | ToolNamesListResponse | IdentityChangedEvent;
+
+export { }