@voicelayer/sdk 0.4.1 → 0.5.0

package/dist/index.d.ts

@@ -1,8 +1,9 @@
-import { A as AgentDTO, a as AgentStatus, b as AgentEnvironment, c as AgentContext, P as Participant, C as CallInfo, d as ProcessSchemaDTO } from './text-session-BB0dLLH2.js';
-export { e as AgentTurnEvent, f as AudioProfile, g as AudioSurface, h as ChannelKind, D as DtmfEvent, i as DtmfHandler, E as EndCallControllerHandle, j as EndCallOutcome, F as FakeSessionAdapter, k as FloorControlConfig, I as InboundOptions, L as LK_AGENT_STATE_MAP, M as MemoryHandle, l as MetricsEvent, N as NON_BUSY_STATES, m as ParticipantId, n as ParticipantKind, o as ParticipantSet, p as ProcessSnapshot, R as RespondOptions, q as Room, r as RouteEntry, s as RoutingRule, t as RoutingSnapshot, u as RunTextSessionOptions, v as RunTextTranscriptOptions, S as SayOptions, w as SendDtmfOptions, x as SessionAdapter, y as SessionCapabilities, z as SessionErrorEvent, B as SessionEvent, G as SessionEventMap, H as SessionFactory, J as SessionFactoryInput, K as SessionOutbound, O as SessionState, Q as SpeechResult, T as SpeechTarget, U as StateChangeEvent, V as TextSession, W as TextTranscriptResult, X as TtsVoiceConfig, Y as TurnEvent, Z as Unsubscribe, _ as UserInputEvent, $ as UserStateEvent, a0 as UserTurn, a1 as applySpeechTurnHandling, a2 as dtmfCodeToDigit, a3 as dtmfDigitToCode, a4 as duck, a5 as mute, a6 as normalizeState, m as participantId, a7 as passthrough, a8 as runTextSession, a9 as runTextTranscript, aa as transform } from './text-session-BB0dLLH2.js';
+import { A as AgentEnvironment, P as ProcessSchemaDTO, R as ReadinessProbe, a as AgentLifecycleEvent, b as AgentDTO, c as AgentEventEmitter, d as AgentContext, e as AgentConfig$1, f as ProcessField, M as ModelConfig, C as ConnectorInstance, g as ProviderFactory, S as STTProvider, T as TTSProvider, L as LLMProvider, h as RealtimeProvider, i as TurnDetectorProvider, V as VADProvider, j as ProcessDefinition, k as TriggerDefinition, H as HandoffConfig, l as MemoryConfig, m as ToolDefinition$1, n as SpeechConfig, o as ToolExecutor, p as HostLookup } from './text-session-Bf4Jni7H.js';
+export { q as AgentEventListener, r as AgentTurnEvent, s as AudioProfile, t as AudioSurface, u as CallInfo, v as CallOutcomeSummary, w as ChannelKind, x as CompletionStrategy, y as ComplianceTag, z as ConsultationPolicy, D as DtmfEvent, B as DtmfHandler, E as EndCallControllerHandle, F as EndCallInfo, G as EndCallOutcome, I as EndCallPolicy, J as EndCallTrigger, K as EndpointingConfig, N as FakeSessionAdapter, O as FloorControlConfig, Q as InboundOptions, U as InferProcessData, W as InterruptionConfig, X as LK_AGENT_STATE_MAP, Y as MemoryHandle, Z as MemoryScope, _ as MetricsEvent, $ as NON_BUSY_STATES, a0 as Participant, a1 as ParticipantId, a2 as ParticipantKind, a3 as ParticipantSet, a4 as ParticipantsConfig, a5 as ProcessBackendAck, a6 as ProcessFieldType, a7 as ProcessSnapshot, a8 as ReadinessReport, a9 as ReadinessResult, aa as RespondOptions, ab as Room, ac as RouteEntry, ad as RoutingRule, ae as RoutingSnapshot, af as RunTextSessionOptions, ag as RunTextTranscriptOptions, ah as SayOptions, ai as SecurityConfig, aj as SendDtmfOptions, ak as SessionAdapter, al as SessionCapabilities, am as SessionErrorEvent, an as SessionEvent, ao as SessionEventMap, ap as SessionFactory, aq as SessionFactoryInput, ar as SessionOutbound, as as SessionState, at as ShorthandPrimitive, au as SpeechResult, av as SpeechTarget, aw as StateChangeEvent, ax as TextSession, ay as TextTranscriptResult, az as ToolInputShape, aA as TriggerAction, aB as TriggerCondition, aC as TtsVoiceConfig, aD as TurnEvent, aE as Unsubscribe, aF as UserInputEvent, aG as UserStateEvent, aH as UserTurn, aI as VoiceLayerAuthError, aJ as VoiceLayerError, aK as VoiceLayerHttpError, aL as VoiceLayerNetworkError, aM as VoiceLayerValidationError, aN as applySpeechTurnHandling, aO as asyncProbe, aP as defineProcess, aQ as dtmfCodeToDigit, aR as dtmfDigitToCode, aS as duck, aT as envProbe, aU as mute, aV as normalizeState, a1 as participantId, aW as passthrough, aX as runProbes, aY as runTextSession, aZ as runTextTranscript, a_ as transform, a$ as urlProbe } from './text-session-Bf4Jni7H.js';
 import { z, ZodType } from 'zod';
-import { OnQuery, BrainTransport } from './brain/index.js';
-export { BrainCallMetadata, BrainCapabilities, BrainChunk, BrainConfigError, BrainEndpointConfig, BrainMessage, BrainPubSub, BrainRequest, BrainRequestError, ConnectorChatModel, ConnectorChatModelOptions, ConnectorLLMOptions, IncomingBrainRequest, OnQueryContext, OnQueryResult, RedisBrainPubSub, SseDelta, TunnelBrainTransportOptions, assertPublicHttpsUrl, buildRedisBrainPubSub, callbackTransport, createConnectorLLM, httpBrainTransport, parseChatCompletionSse, runBrainRequest, tunnelBrainTransport } from './brain/index.js';
+import { O as OnQuery, B as BrainTransport } from './types-KqrAfY85.js';
+export { a as BrainCallMetadata, b as BrainCapabilities, c as BrainChunk, d as BrainMessage, e as BrainRequest, f as OnQueryContext, g as OnQueryResult } from './types-KqrAfY85.js';
+export { BrainConfigError, BrainEndpointConfig, BrainPubSub, BrainRequestError, ConnectorChatModel, ConnectorChatModelOptions, ConnectorLLMOptions, IncomingBrainRequest, RedisBrainPubSub, SseDelta, TunnelBrainTransportOptions, assertPublicHttpsUrl, buildRedisBrainPubSub, callbackTransport, createConnectorLLM, httpBrainTransport, parseChatCompletionSse, runBrainRequest, tunnelBrainTransport } from './brain/index.js';
 import '@livekit/agents';
 import 'openai';
 import 'ioredis';
@@ -141,12 +142,12 @@ declare const CallPlan: z.ZodObject<{
         description: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         description?: string | undefined;
-        e164?: string | undefined;
         displayName?: string | undefined;
+        e164?: string | undefined;
     }, {
         description?: string | undefined;
-        e164?: string | undefined;
         displayName?: string | undefined;
+        e164?: string | undefined;
     }>;
     draftConfig: z.ZodDefault<z.ZodObject<{
         name: z.ZodOptional<z.ZodString>;
@@ -735,8 +736,8 @@ declare const CallPlan: z.ZodObject<{
     objective: string;
     callee: {
         description?: string | undefined;
-        e164?: string | undefined;
         displayName?: string | undefined;
+        e164?: string | undefined;
     };
     draftConfig: {
         name?: string | undefined;
@@ -869,8 +870,8 @@ declare const CallPlan: z.ZodObject<{
     objective: string;
     callee: {
         description?: string | undefined;
-        e164?: string | undefined;
         displayName?: string | undefined;
+        e164?: string | undefined;
     };
     escalation: {
         onUncertainty?: "consult_host" | "ask_callee" | "fallback_phrase" | undefined;
@@ -997,8 +998,8 @@ declare const CallPlan: z.ZodObject<{
 }>;
 type CallPlan = z.infer<typeof CallPlan>;
 
-declare const MemoryScope$1: z.ZodEnum<["call", "caller", "account", "platform"]>;
-type MemoryScope$1 = z.infer<typeof MemoryScope$1>;
+declare const MemoryScope: z.ZodEnum<["call", "caller", "account", "platform"]>;
+type MemoryScope = z.infer<typeof MemoryScope>;
 declare const RelevantContext: z.ZodObject<{
     call: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     caller: z.ZodRecord<z.ZodString, z.ZodUnknown>;
@@ -1027,39 +1028,39 @@ declare const ResolveCallerResponse: z.ZodObject<{
         updatedAt: z.ZodString;
     }, "strip", z.ZodTypeAny, {
         id: string;
+        displayName: string | null;
         projectId: string;
         createdAt: string;
         updatedAt: string;
         metadata: Record<string, unknown>;
-        displayName: string | null;
         externalKey: string;
     }, {
         id: string;
+        displayName: string | null;
         projectId: string;
         createdAt: string;
         updatedAt: string;
         metadata: Record<string, unknown>;
-        displayName: string | null;
         externalKey: string;
     }>;
 }, "strip", z.ZodTypeAny, {
     caller: {
         id: string;
+        displayName: string | null;
         projectId: string;
         createdAt: string;
         updatedAt: string;
         metadata: Record<string, unknown>;
-        displayName: string | null;
         externalKey: string;
     };
 }, {
     caller: {
         id: string;
+        displayName: string | null;
         projectId: string;
         createdAt: string;
         updatedAt: string;
         metadata: Record<string, unknown>;
-        displayName: string | null;
         externalKey: string;
     };
 }>;
@@ -1076,58 +1077,7 @@ declare const DeleteCallerResponse: z.ZodObject<{
 }>;
 type DeleteCallerResponse = z.infer<typeof DeleteCallerResponse>;
 
-/** Policy embedded in AgentConfig — caps + UX wording. */
-declare const ConsultationPolicy: z.ZodObject<{
-    enabled: z.ZodDefault<z.ZodBoolean>;
-    defaultTimeoutMs: z.ZodDefault<z.ZodNumber>;
-    maxTimeoutMs: z.ZodDefault<z.ZodNumber>;
-    maxCumulativeHoldMs: z.ZodDefault<z.ZodNumber>;
-    holdPhrase: z.ZodDefault<z.ZodString>;
-    fallbackPhrase: z.ZodDefault<z.ZodString>;
-    callEndFallback: z.ZodDefault<z.ZodString>;
-    urgencyOverrides: z.ZodOptional<z.ZodObject<{
-        low: z.ZodOptional<z.ZodNumber>;
-        normal: z.ZodOptional<z.ZodNumber>;
-        high: z.ZodOptional<z.ZodNumber>;
-    }, "strip", z.ZodTypeAny, {
-        low?: number | undefined;
-        high?: number | undefined;
-        normal?: number | undefined;
-    }, {
-        low?: number | undefined;
-        high?: number | undefined;
-        normal?: number | undefined;
-    }>>;
-}, "strip", z.ZodTypeAny, {
-    enabled: boolean;
-    defaultTimeoutMs: number;
-    maxTimeoutMs: number;
-    maxCumulativeHoldMs: number;
-    holdPhrase: string;
-    fallbackPhrase: string;
-    callEndFallback: string;
-    urgencyOverrides?: {
-        low?: number | undefined;
-        high?: number | undefined;
-        normal?: number | undefined;
-    } | undefined;
-}, {
-    enabled?: boolean | undefined;
-    defaultTimeoutMs?: number | undefined;
-    maxTimeoutMs?: number | undefined;
-    maxCumulativeHoldMs?: number | undefined;
-    holdPhrase?: string | undefined;
-    fallbackPhrase?: string | undefined;
-    callEndFallback?: string | undefined;
-    urgencyOverrides?: {
-        low?: number | undefined;
-        high?: number | undefined;
-        normal?: number | undefined;
-    } | undefined;
-}>;
-type ConsultationPolicy = z.infer<typeof ConsultationPolicy>;
-
-declare const AgentConfig$1: z.ZodObject<{
+declare const AgentConfig: z.ZodObject<{
     id: z.ZodString;
     projectId: z.ZodString;
     name: z.ZodString;
@@ -1659,673 +1609,17 @@ declare const AgentConfig$1: z.ZodObject<{
         description?: string | undefined;
     }[] | undefined;
 }>;
-type AgentConfig$1 = z.infer<typeof AgentConfig$1>;
+type AgentConfig = z.infer<typeof AgentConfig>;
 
-declare const AgentEndReason: z.ZodEnum<["flow_boot:schema_fetch_failed" | "flow_boot:no_process_schema" | "flow_boot:missing_agent_id" | "flow_boot:no_api_key", ...("flow_boot:schema_fetch_failed" | "flow_boot:no_process_schema" | "flow_boot:missing_agent_id" | "flow_boot:no_api_key")[]]>;
+declare const AgentEndReason: z.ZodEnum<["flow_boot:schema_fetch_failed" | "flow_boot:no_process_schema" | "flow_boot:missing_agent_id" | "flow_boot:no_api_key" | "flow_boot:worker_identity_refused", ...("flow_boot:schema_fetch_failed" | "flow_boot:no_process_schema" | "flow_boot:missing_agent_id" | "flow_boot:no_api_key" | "flow_boot:worker_identity_refused")[]]>;
 type AgentEndReason = z.infer<typeof AgentEndReason>;
 
-interface ReadinessResult {
-    readonly ok: boolean;
-    /** Human-readable explanation when ok=false. Surfaced in metadata. */
-    readonly detail?: string;
-}
-interface ReadinessProbe {
-    readonly name: string;
-    check(): Promise<ReadinessResult>;
-}
-/** Aggregate result the SDK records in metadata.readiness. */
-interface ReadinessReport {
-    readonly probe: string;
-    readonly ok: boolean;
-    readonly detail?: string;
-}
-/**
- * Run all probes in parallel. A probe that throws is reported as not-ok with
- * the error message as detail; one bad probe never sinks the others.
- */
-declare function runProbes(probes: readonly ReadinessProbe[]): Promise<ReadinessReport[]>;
-/** Probe that passes iff process.env[name] is non-empty after trimming. */
-declare function envProbe(name: string): ReadinessProbe;
-/**
- * Probe wrapping an arbitrary async function. Returning a value (or void)
- * means ok; throwing means not-ok. Compact escape hatch — promote to a real
- * probe class when reuse appears.
- */
-declare function asyncProbe(name: string, fn: () => Promise<unknown>): ReadinessProbe;
-/**
- * Probe that fetches a URL and considers any 2xx/3xx response ok. Useful for
- * upstream health-checks (e.g. an LLM gateway's /healthz). Default 3s timeout.
- */
-declare function urlProbe(name: string, url: string, opts?: {
-    timeoutMs?: number;
-    method?: 'GET' | 'HEAD';
-}): ReadinessProbe;
-
-declare class VoiceLayerError extends Error {
-    readonly name: string;
-}
-declare class VoiceLayerAuthError extends VoiceLayerError {
-    readonly status: number;
-    readonly name: string;
-    constructor(message: string, status: number);
-}
-declare class VoiceLayerNetworkError extends VoiceLayerError {
-    readonly name: string;
-    readonly cause?: unknown;
-    constructor(message: string, cause?: unknown);
-}
-declare class VoiceLayerValidationError extends VoiceLayerError {
-    readonly issues: unknown;
-    readonly name: string;
-    constructor(message: string, issues: unknown);
-}
-declare class VoiceLayerHttpError extends VoiceLayerError {
-    readonly status: number;
-    readonly body: unknown;
-    readonly name: string;
-    constructor(message: string, status: number, body: unknown);
-}
-
-type AgentLifecycleEvent = {
-    type: 'registered';
-    agent: AgentDTO;
-} | {
-    type: 'readiness';
-    report: readonly ReadinessReport[];
-    allOk: boolean;
-} | {
-    type: 'heartbeat';
-    agent: AgentDTO;
-} | {
-    type: 'heartbeat_error';
-    error: VoiceLayerError | Error;
-    consecutiveFailures: number;
-    willRetry: boolean;
-} | {
-    type: 'heartbeat_recovered';
-    afterFailures: number;
-} | {
-    type: 're_registered';
-    agent: AgentDTO;
-    reason: 'agent_not_found';
-} | {
-    type: 'status_changed';
-    status: AgentStatus;
-    detail?: string;
-} | {
-    type: 'metadata_updated';
-} | {
-    type: 'deregistered';
-    reason: 'manual' | 'signal';
-};
-type AgentEventListener = (event: AgentLifecycleEvent) => void;
-interface AgentEventEmitter {
-    on(listener: AgentEventListener): () => void;
-    /** @internal — used by the lifecycle to publish events. */
-    emit(event: AgentLifecycleEvent): void;
-}
-
-/** Primitive field types accepted in a process definition. */
-type ProcessFieldType = 'string' | 'string[]' | 'number' | 'boolean' | 'datetime' | 'email' | 'phone';
-interface ProcessField {
-    readonly type: ProcessFieldType;
-    readonly required?: boolean;
-    /** Regex pattern for `string` / `string[]` items. */
-    readonly pattern?: RegExp;
-    /** Inclusive lower bound on a number or array length. */
-    readonly min?: number;
-    /** Inclusive upper bound on a number or array length. */
-    readonly max?: number;
-    /** One of N — restricts the captured value to this set. */
-    readonly enum?: readonly string[];
-    /** Override the auto-generated prompt for capturing this field. */
-    readonly ask?: string;
-    /** Override the field-extraction hint shown to the LLM. */
-    readonly extract?: string;
-}
-type CompletionStrategy = 'all-required-captured' | 'all-captured' | {
-    custom: (data: Record<string, unknown>, ctx: AgentContext) => boolean | Promise<boolean>;
-};
-interface ProcessBackendAck {
-    /** URL to POST captured data to. The call cannot complete until this 2xx's. */
-    readonly url: string;
-    readonly timeoutMs?: number;
-    readonly headers?: Readonly<Record<string, string>>;
-}
-interface ProcessDefinition<T extends Record<string, ProcessField> = Record<string, ProcessField>> {
-    /** Field schema. Order is preserved when the SDK auto-asks for fields. */
-    readonly collect: T;
-    /** When the call can end. Defaults to 'all-required-captured'. */
-    readonly completeWhen?: CompletionStrategy;
-    /** Optional external system that must ACK before completion. */
-    readonly backendAck?: ProcessBackendAck;
-    /** Fires once all completion conditions are met. */
-    readonly onComplete?: (data: InferProcessData<T>, ctx: AgentContext) => Promise<void> | void;
-    /** Fires whenever a field is captured (good for live CRM updates). */
-    readonly onField?: <K extends keyof T>(field: K, value: InferFieldValue<T[K]>, ctx: AgentContext) => Promise<void> | void;
-}
-/** Inferred TS type for the data bag a process produces. */
-type InferProcessData<T extends Record<string, ProcessField>> = {
-    [K in keyof T]: T[K]['required'] extends true ? InferFieldValue<T[K]> : InferFieldValue<T[K]> | undefined;
-};
-type InferFieldValue<F extends ProcessField> = F['type'] extends 'string' ? string : F['type'] extends 'string[]' ? string[] : F['type'] extends 'number' ? number : F['type'] extends 'boolean' ? boolean : F['type'] extends 'datetime' ? Date : F['type'] extends 'email' ? string : F['type'] extends 'phone' ? string : never;
-type TriggerCondition = RegExp | `signal:${string}` | ((text: string, ctx: AgentContext) => boolean | Promise<boolean>);
-type TriggerAction = 'handoff' | 'endCall' | {
-    say: string;
-} | {
-    run: (ctx: AgentContext) => Promise<void> | void;
-}
-/** Jump the flow-graph cursor to a node id. Only meaningful under the graph
- *  interpreter (the flat goals+rails path has no cursor and ignores it). */
- | {
-    goto: string;
-};
-interface TriggerDefinition {
-    readonly on: TriggerCondition;
-    readonly then: TriggerAction;
-    /** If set, the trigger only fires while the named field is uncaptured. */
-    readonly onlyWhile?: string;
-}
-interface HandoffConfig {
-    /** Default human number when a trigger says { then: 'handoff' }. */
-    readonly fallback: string;
-    /** Map signal/trigger names to specific destinations. */
-    readonly routes?: Readonly<Record<string, string>>;
-    /** Build the briefing text passed to the human agent (or PSTN whisper). */
-    readonly briefing?: (args: {
-        readonly data: Record<string, unknown>;
-        readonly transcript: TranscriptHandle;
-        readonly call: AgentContext['call'];
-    }) => string | Promise<string>;
-    /**
-     * 'warm' (default) dials the human into the room as a conference, lets the
-     * agent brief them live, then drops the agent — caller + human stay
-     * connected. 'cold' is a blind SIP REFER: the caller is transferred away
-     * immediately. Warm falls back to cold when no outbound trunk is configured.
-     */
-    readonly mode?: 'warm' | 'cold';
-}
-interface TranscriptHandle {
-    /** Last N turns as `speaker: text` lines. */
-    tail(n: number): string;
-    full(): string;
-}
-/**
- * Memory scope. `'participant'` and `'caller'` are synonyms — `'caller'`
- * is the historical name from the 1:1 era; new code should prefer
- * `'participant'`, which makes the multi-party semantics explicit.
- */
-type MemoryScope = 'call' | 'caller' | 'participant' | 'account' | 'platform';
-interface MemoryConfig {
-    /** Which scope to persist to. Defaults to 'caller'. */
-    readonly scope?: MemoryScope;
-    readonly retentionDays?: number;
-    /** Fields auto-redacted on write. Recognized: ssn, dob, email, phone, ccn. */
-    readonly piiFields?: readonly string[];
-    /** Opt in to cross-tenant aggregate memory (anonymized). */
-    readonly platformOptIn?: boolean;
-}
-/**
- * Multi-participant configuration. Optional — when omitted, the agent runs
- * in 1:1 mode (one human + one agent) and the SDK still populates
- * `ctx.room.participants` so participant-aware code paths work.
- */
-interface ParticipantsConfig {
-    /**
-     * Fires when a human participant joins the room. In 1:1 calls this
-     * fires once at session start for the caller. In multi-party calls it
-     * fires per join.
-     */
-    readonly onJoin?: (participant: Participant, ctx: AgentContext) => Promise<void> | void;
-    /** Fires when a participant disconnects (hangup, transfer, kick). */
-    readonly onLeave?: (participant: Participant, ctx: AgentContext) => Promise<void> | void;
-    /**
-     * Synchronously enrich a participant's attribute bag before `onJoin`
-     * fires. Useful for phone-number → language lookups, etc. The returned
-     * map is merged into `participant.attributes`.
-     */
-    readonly attributes?: (participant: Participant) => Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
-    /**
-     * Reject participants beyond this count. Default: unlimited. The cap
-     * is enforced by the worker when wiring participant lifecycle.
-     */
-    readonly max?: number;
-}
-/**
- * A connector instance. Created by per-system factories like `salesforce()`,
- * `twilio()`, etc. The factory returns an opaque handle that the SDK wires
- * into `ctx.connectors` and (when `expose: true`) into the LLM tool list.
- */
-interface ConnectorInstance<TName extends string = string, TApi = unknown> {
-    readonly __connector: true;
-    readonly name: TName;
-    readonly api: TApi;
-    /** If true, every method on `api` becomes an LLM-callable tool. */
-    readonly expose?: boolean;
-}
-type ComplianceTag = 'tcpa' | 'hipaa' | 'pci' | 'gdpr' | 'soc2';
-/**
- * Duck-typed pipeline component markers. The SDK never inspects these — they
- * are passed through to LiveKit's AgentSession as-is. Three ways to satisfy:
- *
- *   1. SDK factory:    `deepgram.tts({ model: 'aura-2' })`
- *   2. Wrapped LK:     `wrap(new TTS({...}), { trace: true })`
- *   3. User-built:     class MyTTS extends BaseTTS { ... }   // BaseTTS
- *                                                            // re-exported
- *                                                            // from the SDK
- *
- * Anything implementing the duck-type — even a plain object — is accepted.
- */
-interface STTProvider {
-    readonly __vlPipeline?: 'stt';
-}
-interface LLMProvider {
-    readonly __vlPipeline?: 'llm';
-}
-interface TTSProvider {
-    readonly __vlPipeline?: 'tts';
-}
-interface VADProvider {
-    readonly __vlPipeline?: 'vad';
-}
-interface TurnDetectorProvider {
-    readonly __vlPipeline?: 'turn';
-}
-/**
- * Speech-to-speech / realtime model marker (OpenAI Realtime, Gemini Live).
- * A realtime model handles STT + LLM + TTS + turn-taking server-side, so when
- * `models.realtime` is set the SDK builds the AgentSession around it and
- * ignores the stt/llm/tts slots.
- */
-interface RealtimeProvider {
-    readonly __vlPipeline?: 'realtime';
-}
-/**
- * Lazy form so users can pick a provider per call (e.g. by caller locale).
- * The factory runs once per call, before AgentSession is constructed, so it
- * receives the call envelope (callerId, to, metadata) rather than the full
- * AgentContext (which depends on AgentSession existing).
- */
-type ProviderFactory<T> = (call: CallInfo) => T | Promise<T>;
-interface ModelConfig {
-    /**
-     * String form: 'openai/gpt-4o' (resolves via SDK defaults).
-     * Instance form: any LLMProvider (LK plugin, wrap()-ed, or user-built).
-     * Factory form: `(ctx) => provider` for per-call selection.
-     */
-    readonly llm?: string | LLMProvider | ProviderFactory<LLMProvider>;
-    readonly stt?: string | STTProvider | ProviderFactory<STTProvider>;
-    readonly tts?: string | TTSProvider | ProviderFactory<TTSProvider>;
-    /** VAD has no string form — always pass an instance or factory. */
-    readonly vad?: VADProvider | ProviderFactory<VADProvider>;
-    readonly turnDetector?: TurnDetectorProvider | ProviderFactory<TurnDetectorProvider>;
-    /**
-     * Speech-to-speech / realtime model. When set, the STT→LLM→TTS pipeline is
-     * bypassed: the realtime model drives the whole turn. No string form — pass
-     * an instance (`openai.realtime({ voice: 'alloy' })`) or a per-call factory.
-     */
-    readonly realtime?: RealtimeProvider | ProviderFactory<RealtimeProvider>;
-    /** Spoken language; defaults to 'en-US'. Used by string-form defaults. */
-    readonly language?: string;
-}
-/**
- * Answering-machine detection mode for outbound calls. Mirrors
- * `OutboundConfig.amd` in @voicelayer/agent-spec.
- *
- *   'off'              — never run AMD; treat every answer as a human.
- *   'detect'           — leave the voicemail message (or hang up) the moment
- *                        a machine greeting is recognised.
- *   'detectMessageEnd' — recognise the machine, then wait for the greeting to
- *                        finish (an explicit "after the tone"-style cue or the
- *                        greeting going quiet) before leaving the message.
- */
-type AmdMode = 'off' | 'detect' | 'detectMessageEnd';
-/**
- * Outbound-only behavior. AMD never runs on inbound calls (the runtime gates
- * on the dispatch-metadata `direction`), so these knobs are inert unless the
- * call was placed via the outbound path.
- */
-interface OutboundCallConfig {
-    /** Answering-machine detection mode. Defaults to 'off'. */
-    readonly amd?: AmdMode;
-    /**
-     * Spoken (via TTS) when a machine is detected. When unset, the agent hangs
-     * up on detection instead of leaving a message.
-     */
-    readonly voicemailScript?: string;
-}
-/**
- * Barge-in tuning. The pipeline allows interruptions by default (LK defaults:
- * any speech ≥500ms cuts the agent off). These knobs tune that behavior per
- * agent WITHOUT switching to puppet/hostControlled mode — e.g. a senior-living
- * help desk wants `minWords: 2` so backchannels ("mm-hm", "okay") don't
- * truncate the agent mid-sentence, while a fast-paced escalation desk keeps
- * the zero-word default. Set `enabled: false` to make the agent
- * non-interruptible (kiosk / broadcast announcements).
- */
-interface InterruptionConfig {
-    /** Allow the caller to barge in over agent speech. Default true. */
-    readonly enabled?: boolean;
-    /** Words the caller must say before it counts as an interruption. Default 0
-     *  (any speech interrupts). 2–3 filters out backchannels. */
-    readonly minWords?: number;
-    /** Minimum caller speech duration (ms) to count as an interruption. Default 500. */
-    readonly minDuration?: number;
-}
-/**
- * End-of-turn detection tuning: how long the pipeline waits after the caller
- * stops speaking before treating the turn as finished. Raise `minDelay` for
- * callers who pause mid-thought (e.g. elderly speakers); lower it for
- * fast-paced lines.
- */
-interface EndpointingConfig {
-    /** Minimum silence (ms) before the caller's turn is considered done. Default 500. */
-    readonly minDelay?: number;
-    /** Hard ceiling (ms) after which the turn ends regardless. Default 3000. */
-    readonly maxDelay?: number;
-}
-/**
- * Speech polish. `pronunciations` rewrites brand names / acronyms / jargon to
- * a spoken form before TTS (e.g. `{ VoiceLayer: 'Voice Layer', API: 'A P I' }`)
- * via applyPronunciations(). `backgroundAudio` plays ambient room tone under
- * the agent so silence feels less dead (a URL or a named preset).
- * `interruption` + `endpointing` tune barge-in and turn-taking per agent.
- */
-interface SpeechConfig {
-    readonly pronunciations?: Readonly<Record<string, string>>;
-    readonly backgroundAudio?: string | {
-        readonly url?: string;
-        readonly volume?: number;
-    };
-    readonly interruption?: InterruptionConfig;
-    readonly endpointing?: EndpointingConfig;
-}
-/** What caused the call to end. Surfaced to `endCall.onEnd` + logs. */
-type EndCallTrigger = 
-/** The LLM invoked the built-in `end_call` tool. */
-'tool'
-/** An external controller (MCP host) sent a `hangup` command. */
- | 'host'
-/** The dead-air backstop fired (`idleHangupMs` of silence while idle). */
- | 'idle'
-/** The hard per-call ceiling fired (`maxCallDurationMs` elapsed). */
- | 'max_duration'
-/** The last non-agent participant left the room. */
- | 'participant-left'
-/** A flow/graph run finished and asked to hang up. */
- | 'flow'
-/** The realtime engine closed / disconnected under the session. */
- | 'engine-closed'
-/** `ctx.endCall()` called directly from user code. */
- | 'user';
-/** Passed to `endCall.onEnd` describing the teardown about to happen. */
-interface EndCallInfo {
-    /** Why the call is ending (e.g. the `end_call` tool's `reason`). */
-    readonly reason?: string;
-    /** What triggered the hang-up. */
-    readonly trigger: EndCallTrigger;
-    /** The teardown strategy that will run (after the policy is resolved). */
-    readonly teardown: 'room' | 'agent';
-}
-/**
- * Controls how the agent ENDS a call. The SDK — not the agent prompt or an
- * external puppet driver — owns teardown, so a hang-up is reliable even when
- * the realtime transport has died mid-wrap.
- *
- * Defaults are "best case" and active without opt-in: the whole LiveKit room
- * is deleted (which drops the SIP/PSTN leg too, so the carrier gets a BYE),
- * a guarantee-watchdog re-attempts teardown if the first try doesn't land, and
- * a dead-air backstop hangs up after the line has been silent too long. Every
- * knob is overridable; set a field to `false` to disable that guard.
- */
-interface EndCallPolicy {
-    /**
-     * Teardown strategy. `'room'` (default) deletes the LiveKit room via the
-     * room service — this removes the SIP participant too, so the call actually
-     * disconnects on the carrier side. `'agent'` only drops the agent's own
-     * participant (leaves any SIP leg up); use it only when something else owns
-     * the room lifecycle.
-     */
-    readonly teardown?: 'room' | 'agent';
-    /**
-     * After a hang-up is requested, keep re-attempting teardown until the room
-     * is actually gone or this many ms elapse. Guards against a teardown call
-     * that silently doesn't land (transport race, transient room-service error).
-     * Default 4000. `false` disables (single best-effort attempt).
-     */
-    readonly guaranteeMs?: number | false;
-    /**
-     * Dead-air backstop: when the agent is idle (waiting on the caller) and the
-     * line stays silent — no agent turn, no caller speech — for this many ms,
-     * end the call. Catches a wedged session whose normal `end_call` never ran.
-     * Only armed while the agent is idle, so it never interrupts agent speech or
-     * a long tool call. Default 20000. `false` disables.
-     */
-    readonly idleHangupMs?: number | false;
-    /**
-     * Hard call ceiling: hang up once the call has run this many ms from when
-     * the session becomes ready, regardless of activity. Catches runaway calls
-     * that never end naturally (stuck loops, hijacked keys dialing premium
-     * numbers). Fires with trigger `'max_duration'`. Default 3600000 (60
-     * minutes). `false` disables.
-     */
-    readonly maxCallDurationMs?: number | false;
-    /**
-     * Hook fired the moment a hang-up is decided, just before teardown — for
-     * every trigger (tool, host, idle, max_duration, engine-closed, …). Return
-     * `false` to take over teardown yourself (the SDK then does nothing — the
-     * call will NOT end unless you end it). Returning anything else (or nothing)
-     * runs the default teardown. Throwing is caught + logged, then the default
-     * teardown still runs (safe by default).
-     *
-     * EXCEPT a host hangup (`trigger: 'host'` — MCP `call_hangup`): the host is
-     * the operator, so the hook is told (with the host's reason) and given 2
-     * seconds, but can't keep the call open; the room is always deleted, even
-     * after an earlier hang-up was vetoed and whatever `teardown` says (0.2.0).
-     */
-    readonly onEnd?: (ctx: AgentContext, info: EndCallInfo) => boolean | void | Promise<boolean | void>;
-}
-type ShorthandPrimitive$1 = 'string' | 'number' | 'boolean';
-type ToolInputShape$1 = Record<string, ShorthandPrimitive$1> | z.ZodTypeAny;
-interface ToolDefinition$1<I = unknown, R = unknown> {
-    readonly description: string;
-    readonly input: ToolInputShape$1;
-    readonly run: (input: I, ctx: AgentContext) => Promise<R> | R;
-    /**
-     * Capability this tool requires. Action Guard hard-blocks the call if not
-     * declared (PRD §B.5 — "no soft failures, ever"). Defaults to
-     * `tool.<name>` when omitted; passing a domain-scoped string
-     * (`crm.write`, `payment.refund`) lets multiple tools share a capability
-     * for centralised policy.
-     */
-    readonly capability?: string;
-}
-/**
- * Optional security adapters. The SDK always enforces the local-only synchronous
- * guards (PRD §B.2 input regex, §B.3 system seal + PII tokenisation, §B.4
- * markdown strip + PII partial-mask, §B.5 capability check). Setting any of
- * these augments the local floor with external services. Each is independently
- * optional — none has to be live for the floor guards to function.
- *
- * URLs can also come from env (`SECURITY_LLM_GUARD_URL`,
- * `SECURITY_PRESIDIO_ANALYZER_URL`, `SECURITY_PRESIDIO_ANONYMIZER_URL`,
- * `SECURITY_OPA_URL`, `SECURITY_OPA_DECISION_PATH`); explicit config wins.
- */
-interface SecurityConfig {
-    /** Disable the primitive entirely. Use only for tests. Production code MUST NOT set this. */
-    readonly disabled?: boolean;
-    /** External LLM-Guard adapter for richer injection detection. */
-    readonly llmGuardUrl?: string;
-    /** Presidio analyzer URL for PII detection beyond local regex. */
-    readonly presidioAnalyzerUrl?: string;
-    /** Presidio anonymizer URL — if set, output is redacted before TTS. */
-    readonly presidioAnonymizerUrl?: string;
-    /** OPA decision API base URL (e.g. `http://opa:8181`). */
-    readonly opaUrl?: string;
-    /** OPA decision path (e.g. `voicelayer/security/decision`). */
-    readonly opaDecisionPath?: string;
-    /** Per-request timeout for security adapter calls. */
-    readonly adapterTimeoutMs?: number;
-}
-/**
- * Marks an agent as a *flow-runtime* worker: instead of a fixed process it
- * resolves the deployed flow from the dispatch metadata (`agentId`) at call
- * time, fetches that agent's compiled process_schema, and boots from it. One
- * process serves many flows (the shared pool). See defineFlowRuntime().
- */
-interface FlowRuntimeConfig {
-    /** Prepended to the flow's compiled say/confirm prompt fragments. */
-    readonly basePrompt?: string;
-    /** Spoken (verbatim) before hanging up when a flow call's schema cannot be
-     *  loaded. A failed flow boot NEVER silently answers as a generic assistant. */
-    readonly bootFailureMessage?: string;
-}
-/** Output content-moderation guard config (P5). Mirrors @voicelayer/plugin-guard's
- *  GuardConfig; the pure inspector lives in runtime/guard.ts. */
-interface GuardConfig {
-    /** Flag content longer than this many characters. Default 8000. */
-    readonly maxLength?: number;
-    /** Substrings that flag content (case-insensitive). Default none. */
-    readonly bannedSubstrings?: readonly string[];
-}
-interface AgentConfig<TProcess extends Record<string, ProcessField> = Record<string, ProcessField>> {
-    /** Lowercase, kebab-case identifier. Used for LiveKit dispatch + presence. */
-    readonly name: string;
-    /** System prompt the LLM sees. */
-    readonly prompt: string;
-    /** Fixed opening line, spoken instantly via TTS at the start of the default
-     *  conversation flow — NO LLM. Eliminates the dead air of an LLM-generated
-     *  greeting (the first generateReply must process the whole system prompt).
-     *  Absent → the SDK falls back to an LLM-generated greeting. */
-    readonly greeting?: string;
-    /** Agent-level Instructions (the routing/decision layer): plain-language guidance
-     *  for WHEN the agent acts, appended below the persona under a `# Routing` header.
-     *  Interpolated with {{ }} by the process runtime. Optional. */
-    readonly routingInstructions?: string;
-    /** Capability tags surfaced in the dashboard. */
-    readonly capabilities?: readonly string[];
-    /** Semantic version. Defaults to AGENT_VERSION env or '0.0.0'. */
-    readonly version?: string;
-    /** dev / stg / prd. Defaults to AGENT_ENVIRONMENT env or 'dev'. */
-    readonly environment?: AgentEnvironment;
-    readonly process?: ProcessDefinition<TProcess>;
-    readonly triggers?: Readonly<Record<string, TriggerDefinition>>;
-    readonly handoff?: HandoffConfig;
-    readonly memory?: MemoryConfig;
-    readonly participants?: ParticipantsConfig;
-    readonly connectors?: Readonly<Record<string, ConnectorInstance>>;
-    readonly compliance?: readonly ComplianceTag[];
-    readonly models?: ModelConfig;
-    readonly outbound?: OutboundCallConfig;
-    readonly speech?: SpeechConfig;
-    readonly endCall?: EndCallPolicy;
-    readonly tools?: Readonly<Record<string, ToolDefinition$1>>;
-    /** Per-agent registry-tool scoping (stored ToolBinding names, applied at
-     *  boot). Non-empty → only these dashboard HTTP tools attach; absent/[] →
-     *  every enabled registry tool attaches (the historical default). */
-    readonly toolBindings?: readonly string[];
-    readonly security?: SecurityConfig;
-    /** Output content-moderation guard (P5). When set, each assistant turn is
-     *  inspected and a violation is recorded as an engine.guard.blocked event on
-     *  the call timeline. OBSERVE-ONLY on voice — it audits, it does not unsay a
-     *  spoken turn. Absent → no guard. */
-    readonly guard?: GuardConfig;
-    /**
-     * Per-call ConsultationPolicy used by the built-in `ask_host` tool. When
-     * omitted the SDK uses the contract defaults (30s per-consult, 120s
-     * cumulative). Plan-first calls override this at boot from
-     * `plan.draftConfig.consultation`. See
-     * packages/contracts/src/consultation.ts for the schema + semantics.
-     */
-    readonly consultation?: ConsultationPolicy;
-    /**
-     * Use your existing text agent as the LLM. When set (and `models.llm` is
-     * unset), defineAgent wires the pipeline's LLM slot to this function: the
-     * caller's STT transcript is passed to `onQuery`, and its returned text (or
-     * streamed pieces) is spoken by TTS. The "two lines, keep your stack" path.
-     *
-     * Equivalent to `models: { llm: connector.llm({ onQuery }) }`. For a remote
-     * brain instead, use `connector.llm({ url })` (direct) or a tunnel transport.
-     * See docs/specs/voice-brain-connector/.
-     */
-    readonly onQuery?: OnQuery;
-    readonly onUtterance?: (text: string, ctx: AgentContext) => Promise<void> | void;
-    readonly onFieldCaptured?: (field: string, value: unknown, ctx: AgentContext) => Promise<void> | void;
-    readonly onCallEnd?: (outcome: CallOutcomeSummary, ctx: AgentContext) => Promise<void> | void;
-    readonly onEvent?: (event: AgentLifecycleEvent) => void;
-    /** Replace the default conversation loop. The SDK does NOT auto-greet. */
-    readonly onCall?: (ctx: AgentContext) => Promise<void>;
-    readonly readiness?: readonly ReadinessProbe[];
-    /**
-     * Run as a remote-controlled (puppet) agent: no autonomous LLM loop, no
-     * process/triggers pipeline. STT utterances are still published to
-     * `call-events:{callId}` via the existing transcript-segments sync, and
-     * the SDK subscribes to `call-control:{room}` to receive `say`,
-     * `hangup`, `dtmf` commands from an external driver (typically the MCP
-     * server invoked by a coding agent).
-     *
-     * When this is on, `process`, `triggers`, `onUtterance`, `onCall` are
-     * ignored. `tools`, `connectors`, `memory` still work.
-     */
-    readonly puppetMode?: boolean;
-    /**
-     * Host-controlled autonomous agent (the "smart puppet"). UNLIKE puppetMode,
-     * the agent keeps its REAL LLM and drives the conversation itself from its
-     * prompt (the per-call `intent` is appended at boot). Since 0.2.0 EVERY
-     * agent listens on its call's control channel (the MCP host can interject
-     * with `say`, `hangup` or send `dtmf`, and answer `ask_host`), so this flag
-     * now only shapes turn handling for a host-driven call. Use this for an agent that takes a customer's
-     * intent and runs the call like a human secretary, asking the host for any
-     * info it's missing. Mutually exclusive in spirit with puppetMode (which is
-     * the older NoOp "dumb mouth").
-     */
-    readonly hostControlled?: boolean;
-    /** When set, this agent boots each call from a deployed flow's process_schema. */
-    readonly flowRuntime?: FlowRuntimeConfig;
-    /**
-     * Opt a hand-coded (non-flow) agent into the dashboard-driven pipeline: on
-     * each call the SDK fetches this agent's PUBLISHED configuration (a saved
-     * dashboard draft applies only once the owner publishes it) and applies
-     * the operator-selected voice / model / STT over the coded defaults. The
-     * pipeline *mode* (cascade vs realtime) stays pinned to what the code
-     * declares — a stale `mode=realtime` in the dashboard can't flip a
-     * cascade-only worker. Flow agents (`flowRuntime`) get this implicitly and
-     * may additionally switch mode; this flag is the SDK opt-in. The agent id is
-     * read from dispatch metadata (the inbound router injects it from
-     * phone_numbers.agentId), so it's a no-op for calls without one.
-     */
-    readonly pipelineFromConfig?: boolean;
-    /**
-     * Opt this agent into MCP-layer visibility. When true, on register the API
-     * also writes an `agent_config` row keyed by (project_id, name,
-     * environment) so MCP / dashboard / REST can list and inspect this agent
-     * (and, post-step-7, drive call_say / call_send_guidance / etc against
-     * its live calls).
-     *
-     * Defaults to true so newly-registered agents show up in dashboards and
-     * MCP-host listings without opt-in. Pass `false` for autonomous-only
-     * agents that should stay invisible to MCP. See
-     * docs/architecture/contracts-design.md §2b.
-     */
-    readonly mcpExposed?: boolean;
-}
-interface CallOutcomeSummary {
-    readonly reason: 'completed' | 'handoff' | 'caller_hung_up' | 'agent_hung_up' | 'error';
-    readonly durationMs: number;
-    readonly processCompleted: boolean;
-    readonly fieldsCaptured: number;
-    readonly handoffOccurred: boolean;
+interface ApiCredential {
+    readonly apiKey: string;
+    readonly baseUrl: string;
+    /** `worker-token`: minted for this call's project. `env-key`: the process's own VOICELAYER_API_KEY. */
+    readonly source: 'worker-token' | 'env-key';
 }
-/**
- * Identity helper that gives users a typed `defineProcess` entry point with
- * full inference on `onComplete`'s `data` argument.
- *
- *   defineProcess({
- *     collect: { name: { type: 'string', required: true } },
- *     onComplete: (data) => { data.name // string },
- *   })
- */
-declare function defineProcess<T extends Record<string, ProcessField>>(def: ProcessDefinition<T>): ProcessDefinition<T>;
 
 interface TransportOptions {
     readonly apiKey: string;
@@ -2476,7 +1770,7 @@ declare class AgentsClient {
      * published; a saved-but-unpublished dashboard draft is never returned here
      * (docs/specs/agents/draft-publish.md). Returns null on 404 (agent absent).
      */
-    getConfig(agentId: string): Promise<AgentConfig$1 | null>;
+    getConfig(agentId: string): Promise<AgentConfig | null>;
     register(input: RegisterInput, opts?: RegisterOptions): Promise<RegisteredAgent>;
     list(query?: {
         environment?: AgentEnvironment;
@@ -2506,6 +1800,7 @@ declare class AgentsClient {
                     backendAck?: {
                         url: string;
                         timeoutMs: number;
+                        allowPrivateNetwork?: boolean | undefined;
                     } | undefined;
                 };
                 fields: {
@@ -2517,6 +1812,7 @@ declare class AgentsClient {
                     min?: number | undefined;
                     max?: number | undefined;
                     enum?: string[] | undefined;
+                    fromCaller?: boolean | undefined;
                 }[];
                 handoff?: {
                     fallback?: string | undefined;
@@ -2555,9 +1851,11 @@ declare class AgentsClient {
                     input: Record<string, "string" | "number" | "boolean">;
                     method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
                     auth: "none" | "connection";
+                    allowPrivateNetwork?: boolean | undefined;
                     headers?: Record<string, string> | undefined;
                     connectionRef?: string | undefined;
                 }[] | undefined;
+                displayName?: string | undefined;
                 program?: {
                     v: 1;
                     id: string;
@@ -2594,10 +1892,10 @@ declare class AgentsClient {
 
 interface ContextInput {
     readonly callerId: string;
-    readonly scopes?: readonly MemoryScope$1[];
+    readonly scopes?: readonly MemoryScope[];
 }
 interface WriteInput {
-    readonly scope: MemoryScope$1;
+    readonly scope: MemoryScope;
     readonly callerId: string;
     readonly delta: Record<string, unknown>;
     readonly callId?: string;
@@ -3036,7 +2334,7 @@ declare class Agent {
     /** Whether this process registered `<name>::text` and takes text turns (said so at registration). */
     private textTurns;
     private processStatePublisher;
-    constructor(config: AgentConfig);
+    constructor(config: AgentConfig$1);
     /**
      * Boot the LiveKit worker and register presence. Idempotent. Returns the
      * LiveKit agent definition so the caller can `export default` it; LK's
@@ -3056,7 +2354,7 @@ declare class Agent {
     private registerPresence;
 }
 
-declare function defineAgent<TProcess extends Record<string, ProcessField> = Record<string, ProcessField>>(config: AgentConfig<TProcess>): Agent;
+declare function defineAgent<TProcess extends Record<string, ProcessField> = Record<string, ProcessField>>(config: AgentConfig$1<TProcess>): Agent;
 /**
  * defineFlowRuntime — a worker that serves many visually-built flows from one
  * process (the shared pool). It registers under a single LiveKit agent name;
@@ -3267,26 +2565,132 @@ interface CompiledAgentParts {
 /**
  * Turn a compiled ProcessSchemaDTO into the full set of `defineAgent` parts a
  * flow-runtime worker boots a visually-built conversation with: the composed
- * prompt (say/confirm fragments), the process (slots + gate), the deterministic
+ * prompt (say/confirm fragments on the flat path; the persona alone in graph
+ * mode, `graphNodeIds` given), the process (slots + gate), the deterministic
  * triggers (rails), and the handoff destination. Pure.
  */
 declare function processSchemaToAgentParts(schema: ProcessSchemaDTO, opts?: {
     readonly basePrompt?: string;
     readonly graphNodeIds?: ReadonlySet<string>;
+    /**
+     * The worker's server-side tool executor (the platform's pools): every schema tool runs through it — the API's
+     * SSRF guard, its connection resolution — instead of a fetch from this worker. Absent → the local guarded fetch.
+     */
+    readonly toolExecutor?: ToolExecutor;
 }): CompiledAgentParts;
 
 interface ExchangeWorkerTokenInput {
     readonly projectId: string;
     readonly callId?: string;
+    /**
+     * The LiveKit room the job was dispatched into — from the JOB (LiveKit's own record), never from dispatch metadata.
+     * The API mints only when the platform's record of that room names `projectId` (a caller who sets `projectId` in
+     * its metadata can't borrow another workspace's identity).
+     */
+    readonly roomName: string;
+    /** The dispatched agent: the API's audit line, and (with `route`) what a number's inbound rule is judged against. */
+    readonly agentId?: string;
+    /** The number a number's dispatch rule stamped on the job — the API refuses a leftover route. */
+    readonly phoneNumberId?: string;
+    /** 'inbound_number' when the job came from a number's inbound rule — the only jobs the API judges. */
+    readonly route?: string;
     readonly fetchImpl?: typeof fetch;
+    /** Waits between attempts on a transient failure (network / 5xx / timeout). A 4xx is final. */
+    readonly retryDelaysMs?: readonly number[];
+    /** One attempt's ceiling. Default 3 s (above the API's 2.5 s room lookup). */
+    readonly attemptTimeoutMs?: number;
+    /** The whole exchange's ceiling, retries included — a caller is on the line in silence. Default 5 s. */
+    readonly budgetMs?: number;
+}
+/**
+ * The API refused this job's identity: it was dispatched by a leftover route for a number its workspace no longer
+ * answers with this agent (moved to another workspace, released, re-assigned — burn-down G-28). The job must not act
+ * at all: no env-key fallback, no session.
+ */
+declare class StaleRouteError extends Error {
+    readonly reason: string;
+    constructor(reason: string);
 }
 /** One mint per call (cheap in-cluster HMAC mint, ~ms) so every token is
- *  attributable to a specific call in the API's audit log. Returns null when
- *  the exchange isn't configured or fails — callers fall back to the env key. */
+ *  attributable to a specific call in the API's audit log. A transient failure
+ *  (network, 5xx, 429, a hung attempt) is retried with a short backoff, all
+ *  inside the budget — the ONE timing every caller (resolveWorkerIdentity,
+ *  admitCallIdentity) inherits; null when the exchange isn't configured, the API
+ *  refuses, or the budget ran out. Throws StaleRouteError when the API refuses a
+ *  leftover route (never null: a refusal must not degrade into acting under
+ *  another key). */
 declare function exchangeWorkerToken(input: ExchangeWorkerTokenInput): Promise<string | null>;
-/** Build the per-call SDK client under the calling project's identity, with
- *  the env-key fallback chain above. `md` is the parsed dispatch metadata. */
-declare function resolveWorkerClient(md: Record<string, unknown>, fetchImpl?: typeof fetch): Promise<VoiceLayerClient | null>;
+/** The identity a call acts as: its SDK client and the credential behind it (for the call's resolvers). */
+interface WorkerIdentity {
+    readonly client: VoiceLayerClient;
+    readonly credential: ApiCredential;
+}
+type WorkerIdentityResolution = {
+    readonly kind: 'ok';
+    readonly identity: WorkerIdentity;
+}
+/** No credentials configured at all — the degraded no-API mode. */
+ | {
+    readonly kind: 'none';
+}
+/** A pool worker could not act as the calling project; it must not act as anyone else. */
+ | {
+    readonly kind: 'refused';
+    readonly reason: 'worker_token_exchange_failed' | 'no_project_in_dispatch';
+}
+/** A number's leftover inbound rule dispatched it (G-28); `detail` says why the API refused it. */
+ | {
+    readonly kind: 'refused';
+    readonly reason: 'stale_route';
+    readonly detail: string;
+};
+interface ResolveWorkerIdentityOptions {
+    /** The job's room as LiveKit reports it (never from metadata) — the mint is bound to it. */
+    readonly roomName?: string | undefined;
+    /**
+     * A worker that only ever serves a customer's project (the flow-runtime and puppet pools, a text turn): on a pool,
+     * a dispatch without a usable projectId is refused instead of falling back to the worker's own (platform) key.
+     */
+    readonly requireProject?: boolean;
+    readonly fetchImpl?: typeof fetch;
+    readonly retryDelaysMs?: readonly number[];
+    readonly attemptTimeoutMs?: number;
+    readonly budgetMs?: number;
+}
+/** Resolve the identity a call (or text turn) acts as, per the order above. `md` is the parsed dispatch metadata. */
+declare function resolveWorkerIdentity(md: Record<string, unknown>, opts?: ResolveWorkerIdentityOptions): Promise<WorkerIdentityResolution>;
+/** The per-call SDK client under the calling project's identity (resolveWorkerIdentity), or null when there is none
+ *  — including when a pool worker's token exchange failed (never the env key in its place). */
+declare function resolveWorkerClient(md: Record<string, unknown>, opts?: ResolveWorkerIdentityOptions): Promise<VoiceLayerClient | null>;
+/** The minimum of a LiveKit JobContext the admission needs (so it is testable without a worker). */
+interface AdmissibleJob {
+    shutdown(reason?: string): void;
+    /** Ends the call for the caller too (deletes the room): a refused job must not leave a SIP caller in dead air. */
+    endRoom?(): Promise<void>;
+}
+type CallAdmission = {
+    readonly admitted: true;
+    readonly resolution: WorkerIdentityResolution;
+} | {
+    readonly admitted: false;
+    readonly reason: string;
+};
+/**
+ * Per-call admission for a worker (burn-down G-28): decide whether this job may act at all, and as whom. On a POOL
+ * worker (the internal exchange is configured: it serves many workspaces) the call is ended — room deleted, job shut
+ * down, never answered under the env key — when
+ *   - a SIP call's dispatch names no workspace: no rule of ours dispatches that way (the retired provision:twilio rule
+ *     did), and the env key would answer it as whichever workspace the pool's key belongs to;
+ *   - a number's INBOUND rule dispatched it and the identity exchange does not succeed: refused as a stale route (its
+ *     workspace no longer answers the number with this agent), or failed for any other reason — a marked inbound job
+ *     only ever acts as the workspace the API confirmed.
+ * Every other job gets its identity resolution (resolveWorkerIdentity) back to act on — the agent decides what a
+ * refusal means for it (a flow apologises and ends; a coded agent runs with no workspace credential).
+ */
+declare function admitCallIdentity(job: AdmissibleJob, md: Record<string, unknown>, participant: {
+    readonly identity?: string;
+    readonly attributes?: Record<string, string> | undefined;
+}, opts?: ResolveWorkerIdentityOptions): Promise<CallAdmission>;
 
 /**
  * Extend this to author a tool with the least ceremony. `run` receives the
@@ -3329,14 +2733,30 @@ interface HttpToolSpec {
     /** Build the request body from input (non-GET). Defaults to the input bag. */
     readonly body?: (input: Record<string, unknown>) => unknown;
     readonly capability?: string;
-    /** Injectable for tests. Defaults to global fetch. */
+    /** Injectable for tests. Defaults to global fetch (always guarded, never following a redirect itself). */
     readonly fetchImpl?: typeof fetch;
+    /** Injectable for tests. Defaults to node:dns. */
+    readonly lookup?: HostLookup;
+    /** Abort the request after this long. Default 15s. */
+    readonly timeoutMs?: number;
+    /**
+     * A self-hosted worker calling its OWN private network (an intranet API, a service on localhost). Off by default:
+     * without it a private / loopback / link-local / metadata address is refused. Lifts only that refusal — the request
+     * is still http(s), still pinned to the checked address, still never follows a blind redirect. The platform never
+     * sets it, and its server-side executor has no such switch.
+     */
+    readonly allowPrivateNetwork?: boolean;
 }
 /**
  * A config-only HTTP tool — no subclass needed for the common "call an API"
  * case. Use this for public/no-auth endpoints (e.g. an n8n webhook). Secrets
  * should NOT be inlined here; vault-backed credentials resolve server-side.
+ *
+ * Safe by default (runtime/safe-fetch.ts): http(s) only, never a private /
+ * loopback / link-local / metadata address (checked again after DNS and on every
+ * redirect hop), a timeout, and a capped body. A refused request is a failed
+ * result `{ ok: false, status: 0, data: { kind: 'blocked', reason } }`, never a throw.
  */
 declare function httpTool(spec: HttpToolSpec): Record<string, ToolDefinition>;
 
-export { Agent, type AgentConfig, AgentContext, type AgentEventEmitter, type AgentEventListener, type AgentLifecycleEvent, type AppendDtmfEventInput, type AppendTranscriptInput, BaseTool, BrainTransport, type CallAttributeValue, CallInfo, type CallLegInput, type CallOutcomeSummary, type CallParticipantInput, type CallStatus, type CallSummary, CallsClient, type CompiledAgentParts, type CompletionStrategy, type ComplianceTag, type ConnectorInstance, type ConnectorLLMConfig, ConsultationPolicy, type CreateClientOptions, type CreatedFormSession, type DefaultMetadata, type DtmfDirection, EmailClient, type SendEmailInput as EmailSendInput, type EndCallInfo, type EndCallPolicy, type EndCallTrigger, type EndpointingConfig, type EnsureCallByRoomInput, type ExchangeWorkerTokenInput, type CreateFormSessionInput as FormCreateInput, type FormToolsOptions, FormsClient, type HandoffConfig, type HttpToolResult, type HttpToolSpec, type InferProcessData, type InterruptionConfig, type LLMProvider, type MemoryConfig, type MemoryScope, type ModelConfig, OnQuery, Participant, type ParticipantsConfig, type PipelineConfig, PlansClient, type ProcessBackendAck, type ProcessDefinition, type ProcessField, type ProcessFieldType, type PronunciationDict, type ProviderFactory, type PublicFormSessionView, type ReadinessProbe, type ReadinessReport, type ReadinessResult, type RealtimeProvider, type RegisterInput, type RegisterOptions, type RegisteredAgent, type ResendCredentials, type ResendEmailToolOptions, type STTProvider, type SecurityConfig, type SentEmail, type ShorthandPrimitive$1 as ShorthandPrimitive, type SpeechConfig, type SyncCallStateInput, type TTSProvider, type ToolDefinition$1 as ToolDefinition, type ToolInputShape$1 as ToolInputShape, type TriggerAction, type TriggerCondition, type TriggerDefinition, type TurnDetectorProvider, type VADProvider, VoiceLayerAuthError, type VoiceLayerClient, VoiceLayerError, VoiceLayerHttpError, VoiceLayerNetworkError, VoiceLayerValidationError, type WebhookApi, type WebhookConfig, type WrapOptions, applyPronunciations, assemblyai, asyncProbe, cartesia, collectDefaultMetadata, connector, createClient, createNoOpLLM, deepgram, defineAgent, defineFlowRuntime, defineProcess, defineTool, elevenlabs, envProbe, exchangeWorkerToken, formTools, google, httpTool, livekitTurn, mergeMetadata, openai, processSchemaToAgentParts, processSchemaToDefinition, resendEmailTool, resolveWorkerClient, runProbes, silero, urlProbe, webhook, wrap };
+export { Agent, AgentConfig$1 as AgentConfig, AgentContext, AgentEventEmitter, AgentLifecycleEvent, type ApiCredential, type AppendDtmfEventInput, type AppendTranscriptInput, BaseTool, BrainTransport, type CallAttributeValue, type CallLegInput, type CallParticipantInput, type CallStatus, type CallSummary, CallsClient, type CompiledAgentParts, ConnectorInstance, type ConnectorLLMConfig, type CreateClientOptions, type CreatedFormSession, type DefaultMetadata, type DtmfDirection, EmailClient, type SendEmailInput as EmailSendInput, type EnsureCallByRoomInput, type ExchangeWorkerTokenInput, type CreateFormSessionInput as FormCreateInput, type FormToolsOptions, FormsClient, HandoffConfig, type HttpToolResult, type HttpToolSpec, LLMProvider, MemoryConfig, ModelConfig, OnQuery, type PipelineConfig, PlansClient, ProcessDefinition, ProcessField, type PronunciationDict, ProviderFactory, type PublicFormSessionView, ReadinessProbe, RealtimeProvider, type RegisterInput, type RegisterOptions, type RegisteredAgent, type ResendCredentials, type ResendEmailToolOptions, STTProvider, type SentEmail, SpeechConfig, StaleRouteError, type SyncCallStateInput, TTSProvider, ToolDefinition$1 as ToolDefinition, TriggerDefinition, TurnDetectorProvider, VADProvider, type VoiceLayerClient, type WebhookApi, type WebhookConfig, type WorkerIdentity, type WorkerIdentityResolution, type WrapOptions, admitCallIdentity, applyPronunciations, assemblyai, cartesia, collectDefaultMetadata, connector, createClient, createNoOpLLM, deepgram, defineAgent, defineFlowRuntime, defineTool, elevenlabs, exchangeWorkerToken, formTools, google, httpTool, livekitTurn, mergeMetadata, openai, processSchemaToAgentParts, processSchemaToDefinition, resendEmailTool, resolveWorkerClient, resolveWorkerIdentity, silero, webhook, wrap };