@warble/claude-agent-sdk 0.11.0 → 0.13.0

package/dist/index.d.ts

@@ -108,6 +108,12 @@ interface LlmCall {
      * prompt text instead.
      */
     when: WhenGuard | null;
+    /** Same-profile component aliases this exact step may invoke. */
+    component_calls: ComponentCall[];
+}
+interface ComponentCall {
+    alias: string;
+    component: string;
 }
 /**
  * A closed-vocabulary guard on a conditional `llm_call`: `guard` is one of `on_failure` /
@@ -172,8 +178,36 @@ interface PreconditionResult {
     status: string;
     checks: PreconditionCheck[];
 }
+/**
+ * A named position in prompt text, with the alternative wordings that may fill it (IR 0.7).
+ *
+ * `default` always names one of `variants` — compile refuses otherwise — so a consumer that has no
+ * opinion still has something to render. `present_when` is carried but never evaluated here: the
+ * spec assigns that to the host, and this back-end only asks the host for the answer.
+ */
+interface SlotDecl {
+    name: string;
+    /** Always a key of `variants`. */
+    default: string;
+    variants: Record<string, string>;
+    /** Present only when the author declared a condition. Carried verbatim; not interpreted here. */
+    present_when?: unknown;
+}
+/**
+ * One file a component declares it needs, by identity (IR 0.7).
+ *
+ * Content is deliberately not carried — the deliberate contrast with a slot variant, whose text is.
+ * `hash` is `sha256:<hex>` over the bytes and neither field is authorable; both are computed at
+ * compile, so an author-written value cannot rot into a claim nothing keeps true.
+ */
+interface AssetDecl {
+    path: string;
+    hash: string;
+    bytes: number;
+}
 interface ComponentNode {
     id: string;
+    entrypoint: boolean;
     verb: string;
     type: ComponentType;
     realization_kind: RealizationKind;
@@ -193,6 +227,11 @@ interface ComponentNode {
     eval: EvalSpec | null;
     /** Optional free-form framing shared by every step of this component (see `docs/spec/ir-schema.md`). */
     brief?: string;
+    /** Slots belonging to THIS component's own prompt text (its steps and `brief`). Profile-level
+     *  slots live on the IR root instead and are deliberately not copied here. */
+    slots?: SlotDecl[];
+    /** Files this component declares it needs, by identity. Absent when it declares none. */
+    assets?: AssetDecl[];
 }
 interface WarbleIr {
     warble_ir_version: string;
@@ -200,6 +239,10 @@ interface WarbleIr {
     context_binding: ContextBinding;
     config: IrConfig;
     components: ComponentNode[];
+    /** Profile-level slots, belonging to the profile's `system_prompt`. Names are unique across the
+     *  whole project — compile refuses a collision with any component's — so a consumer resolves
+     *  `{{ slot.<name> }}` against one flat namespace rather than a per-layer precedence rule. */
+    slots?: SlotDecl[];
 }
 /**
  * IR versions this back-end understands. Older versions (0.1, 0.2) are no longer accepted now that
@@ -215,74 +258,108 @@ declare function parseIr(json: string): WarbleIr;
 /** Distinct tier names across a node's `llm_calls`, order-preserving. */
 declare function distinctTiers(calls: readonly LlmCall[]): string[];
 
+/** One statically-authorized caller-step edge in the materialized profile. */
+interface ComponentDependency {
+    caller: string;
+    step: string;
+    alias: string;
+    component: string;
+}
+/** The deterministic transitive closure for one selectable root. */
+interface EntryClosure {
+    root: string;
+    components: readonly string[];
+}
 /**
- * Target capability profiles — the declarative side of the capability model
- * (`docs/spec/capability-model.md`), owned by THIS back-end in TypeScript.
+ * Preparation selection before target legalization. `roots` are the only nodes an operation may
+ * start; `callees` are addressable only through an edge in `dependencies`.
+ */
+interface ComponentClosurePlan {
+    roots: readonly ComponentNode[];
+    callees: readonly ComponentNode[];
+    components: readonly ComponentNode[];
+    entries: readonly EntryClosure[];
+    dependencies: readonly ComponentDependency[];
+}
+/** Return all declared edges in profile/step/declaration order. */
+declare function componentDependencies(ir: WarbleIr): readonly ComponentDependency[];
+/**
+ * Resolve exactly the requested roots and their transitive callees. The reader rechecks the graph
+ * rather than trusting compiler provenance so a forged object IR cannot widen or cycle authority.
+ */
+declare function resolveComponentClosure(ir: WarbleIr, requestedRoots?: readonly string[]): ComponentClosurePlan;
+
+/**
+ * What a host says about each slot, keyed by slot name:
  *
- * A runtime target is `engine × mode`. This back-end declares one target, `claude-agent-sdk:local`:
- * the local `@anthropic-ai/claude-agent-sdk` `query()` loop (subscription login, compute on the
- * user's machine). The shared thing across back-ends is the IR + the capability-model
- * *semantics* (native / realize-via / degrade / fail, criticality, provided_by); the profile *data*
- * is target-specific and each back-end writes its own. So this file is the TS sibling of
- * the Rust file target's `targets.rs`, not a shared table.
+ * - a string — render this variant;
+ * - `null` — the slot's `present_when` does not hold, so remove it entirely;
+ * - absent — the host has no opinion, so render the declared `default`.
  *
- * How `local` differs from the Rust file target's `claude-code:headless` (the point of the second
- * back-end):
- *   - `llm:per_step_tier`        native (in-loop per-call model)   ← headless: realize-via(subagents)
- *   - `structured_output_capture` native (message stream)          ← headless: native(stream-json)
- *   - `render_contract`          realize-via(warble-render)         ← headless: realize-via(html-file)
- * The rest match headless, including the safety-critical loud-fails (human_approval, blast_radius).
+ * A plain table rather than a callback, so what the model was told is decided before the run rather
+ * than during it: it can be recorded, compared and fingerprinted. A callback could not be.
  */
-/** One of the four resolution outcomes a capability can take on a target. */
-type CapabilityOutcome = "native" | "realize-via" | "degrade" | "fail";
-/** Who supplies a resolved capability. */
-type ProvidedBy = "runtime" | "warble" | "none";
+type SlotSupply = Readonly<Record<string, string | null>>;
 /**
- * safety-critical capabilities must never silently degrade — unsupported means the resolution pass
- * aborts. required/best-effort may degrade with a warning recorded in the report.
+ * What to do with a conditional slot the host did not answer.
+ *
+ * `"fail"` on any path whose text reaches a model: `default` covers "no opinion on the wording", and
+ * it cannot cover "no opinion on whether this exists at all" — defaulting there ships instructions
+ * for a capability that may have been withheld, which is the failure `present_when` exists to
+ * prevent.
+ *
+ * `"default"` on a display path. The rule above protects a model, not a reader, and a structural
+ * view that refuses to render a valid profile is worse than one showing the default wording. Note
+ * this is a real difference in meaning, not a relaxation for convenience: a display says "this is
+ * what the default binding would say", never "this is what will be sent".
  */
-type Criticality = "safety-critical" | "required" | "best-effort";
-interface CapabilityEntry {
-    outcome: CapabilityOutcome;
-    via: string | null;
-    provided_by: ProvidedBy;
-    criticality: Criticality;
-    note: string | null;
-}
-type CapabilityProfile = Record<string, CapabilityEntry>;
-/** The one target this back-end declares (engine × mode). */
-type TargetId = "claude-agent-sdk:local";
-declare const DEFAULT_TARGET: TargetId;
-declare function isKnownTarget(value: string): value is TargetId;
-declare function knownTargetNames(): readonly string[];
-/** Capability profile for `claude-agent-sdk:local`. */
-declare function localProfile(): CapabilityProfile;
-/** Resolve a target id to its capability profile, or `null` if unknown. */
-declare function profileFor(targetId: string): CapabilityProfile | null;
-
-interface ResolvedCapability {
-    capability: string;
-    outcome: CapabilityOutcome;
-    provided_by: ProvidedBy;
-    criticality: Criticality;
-    note?: string;
-}
-type ResolutionReport = ResolvedCapability[];
-/** Union of declared + implied required capabilities, de-duplicated, order-preserving. */
-declare function collectRequiredCapabilities(node: ComponentNode): string[];
-declare function resolveCapabilities(node: ComponentNode, targetId: string, profile: CapabilityProfile): ResolutionReport;
+type UnansweredCondition = "fail" | "default";
 /**
- * Resolve one node's required capabilities against `targetId`, erroring on any `fail` outcome
- * (no silent degradation). Callers must not dispatch when this throws.
+ * Resolve each declared slot to the text that will replace its references, or to `null` when the
+ * host said it is not present.
+ *
+ * A slot's chosen variant may itself reference other slots — the compiler collects references from
+ * variant text and validates them, so this is authored-legal — hence the recursion, with a visiting
+ * set so a cycle is reported rather than spun on.
+ *
+ * @param decls every slot in scope for the text being resolved. That is the profile's slots PLUS
+ *   the component's, together: compile checks the two layers separately, but it also folds the
+ *   profile's `system_prompt` into each component's `brief` (`render_brief`), so by the time a
+ *   consumer sees the IR one string carries references from both. Names are unique project-wide —
+ *   compile refuses a collision — which is what makes one combined table unambiguous.
+ * @param supply the host's table.
+ * @param scope names the scope in errors ("component 'x'").
  */
-declare function resolveNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+declare function resolveSlots(decls: readonly SlotDecl[], supply: SlotSupply, scope: string, unanswered?: UnansweredCondition): ReadonlyMap<string, string | null>;
 /**
- * Read-only inspection counterpart to `resolveNodeCapabilities`. It returns
- * the same report, including a failed entry, but does not legalize execution.
- * Only display-only callers may use this; dispatch/emit/chat retain the loud
- * failure above.
+ * Apply a resolved scope to one piece of prompt text.
+ *
+ * A slot resolved to `null` leaves nothing behind — deliberately the empty string rather than any
+ * variant, since the point of a condition that does not hold is that the wording must not appear.
  */
-declare function inspectNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+declare function applySlots(raw: string, resolved: ReadonlyMap<string, string | null>, scope: string): string;
+/**
+ * Refuse prompt text that still carries a slot reference.
+ *
+ * The guard, not a formality. Every other failure in this file is loud on its own; this one catches
+ * the case where a surface was never routed through {@link applySlots} at all — a new prompt-carrying
+ * field, a path that assembles text somewhere unexpected — which is exactly how the original defect
+ * arrived: the IR grew slots and nothing downstream was taught to consume them.
+ */
+declare function assertNoSlotReferences(raw: string, owner: string): void;
+/**
+ * Parse repeated `--slot name=variant` / `--slot name=` flags into a {@link SlotSupply}.
+ *
+ * Lives here rather than in the CLI so it is reachable by a test and by any host that wants the same
+ * surface; the CLI turns the thrown error into its own usage failure. Mirrors the Rust CLI's flag of
+ * the same name — two user-facing surfaces that disagreed about what `name=` means would be worse
+ * than either one alone.
+ *
+ * An empty value is **not** an empty variant name: it is the host saying the slot's condition does
+ * not hold and the wording must not appear at all. That distinction is why the flag takes a trailing
+ * `=` rather than requiring a variant.
+ */
+declare function parseSlotFlags(flags: readonly string[]): SlotSupply;
 
 /**
  * Which provider serves a tier's model — an **open string**, opaque to warble (mirrors how the IR
@@ -356,6 +433,76 @@ declare class ModelConfig {
     validate(ir: WarbleIr): void;
 }
 
+/**
+ * Target capability profiles — the declarative side of the capability model
+ * (`docs/spec/capability-model.md`), owned by THIS back-end in TypeScript.
+ *
+ * A runtime target is `engine × mode`. This back-end declares one target, `claude-agent-sdk:local`:
+ * the local `@anthropic-ai/claude-agent-sdk` `query()` loop (subscription login, compute on the
+ * user's machine). The shared thing across back-ends is the IR + the capability-model
+ * *semantics* (native / realize-via / degrade / fail, criticality, provided_by); the profile *data*
+ * is target-specific and each back-end writes its own. So this file is the TS sibling of
+ * the Rust file target's `targets.rs`, not a shared table.
+ *
+ * How `local` differs from the Rust file target's `claude-code:headless` (the point of the second
+ * back-end):
+ *   - `llm:per_step_tier`        native (in-loop per-call model)   ← headless: realize-via(subagents)
+ *   - `structured_output_capture` native (message stream)          ← headless: native(stream-json)
+ *   - `render_contract`          realize-via(warble-render)         ← headless: realize-via(html-file)
+ * The rest match headless, including the safety-critical loud-fails (human_approval, blast_radius).
+ */
+/** One of the four resolution outcomes a capability can take on a target. */
+type CapabilityOutcome = "native" | "realize-via" | "degrade" | "fail";
+/** Who supplies a resolved capability. */
+type ProvidedBy = "runtime" | "warble" | "none";
+/**
+ * safety-critical capabilities must never silently degrade — unsupported means the resolution pass
+ * aborts. required/best-effort may degrade with a warning recorded in the report.
+ */
+type Criticality = "safety-critical" | "required" | "best-effort";
+interface CapabilityEntry {
+    outcome: CapabilityOutcome;
+    via: string | null;
+    provided_by: ProvidedBy;
+    criticality: Criticality;
+    note: string | null;
+}
+type CapabilityProfile = Record<string, CapabilityEntry>;
+/** The one target this back-end declares (engine × mode). */
+type TargetId = "claude-agent-sdk:local";
+declare const DEFAULT_TARGET: TargetId;
+declare function isKnownTarget(value: string): value is TargetId;
+declare function knownTargetNames(): readonly string[];
+/** Capability profile for `claude-agent-sdk:local`. */
+declare function localProfile(): CapabilityProfile;
+/** Resolve a target id to its capability profile, or `null` if unknown. */
+declare function profileFor(targetId: string): CapabilityProfile | null;
+
+interface ResolvedCapability {
+    capability: string;
+    outcome: CapabilityOutcome;
+    via?: string;
+    provided_by: ProvidedBy;
+    criticality: Criticality;
+    note?: string;
+}
+type ResolutionReport = ResolvedCapability[];
+/** Union of declared + implied required capabilities, de-duplicated, order-preserving. */
+declare function collectRequiredCapabilities(node: ComponentNode): string[];
+declare function resolveCapabilities(node: ComponentNode, targetId: string, profile: CapabilityProfile): ResolutionReport;
+/**
+ * Resolve one node's required capabilities against `targetId`, erroring on any `fail` outcome
+ * (no silent degradation). Callers must not dispatch when this throws.
+ */
+declare function resolveNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+/**
+ * Read-only inspection counterpart to `resolveNodeCapabilities`. It returns
+ * the same report, including a failed entry, but does not legalize execution.
+ * Only display-only callers may use this; dispatch/emit/chat retain the loud
+ * failure above.
+ */
+declare function inspectNodeCapabilities(node: ComponentNode, targetId: string): ResolutionReport;
+
 /**
  * Per-step provider routing — the hybrid-LLM core (see docs/spec/capability-model.md §7.2).
  *
@@ -427,52 +574,11 @@ interface StepMessage {
 }
 /**
  * Build the messages for one staged step: the step's own prompt as the system message, and the user
- * message = the question plus each consumed slot's value marshaled in by name (the `produces`→`consumes`
+ * message = the question plus each consumed artifact's value marshaled in by name (the `produces`→`consumes`
  * hand-off). This is the same isolated-invocation contract the IR already carries for the file target's
  * subagents (ir.ts `consumes`/`produces`), generalized here across providers.
  */
-declare function buildStepMessages(step: StagedStep, question: string, slots: Readonly<Record<string, string>>): StepMessage[];
-
-/**
- * Minimal OpenAI-compatible chat client for the hybrid-staged path (see docs/spec/capability-model.md §7.2).
- *
- * A local step (provider `openai_compat`, e.g. ollama's `http://localhost:11434/v1`) is executed by
- * calling `POST {endpoint}/chat/completions` directly — NOT through the Claude SDK, whose `agents[].model`
- * is a restricted alias union that loud-fails on a local model id (SDK-NOTES.md #1). ollama speaks the
- * OpenAI Chat Completions shape, not the Anthropic Messages shape, so this is a distinct, deliberately
- * tiny client — no streaming, no tools, no retries. It is the "third provider-aware back-end" embryo:
- * enough to prove a per-step local model can be marshaled into a cloud run, not a production LLM client.
- *
- * Live-gated: exercised only when an ollama (or other OpenAI-compat) endpoint is reachable. The request
- * SHAPING is unit-tested via {@link buildChatRequest} with no network.
- */
-
-interface ChatRequest {
-    model: string;
-    messages: StepMessage[];
-    stream: false;
-    /** Deterministic-leaning default; a local step is a bounded transform, not open-ended generation. */
-    temperature: number;
-}
-/** Build the JSON body for an OpenAI-compatible `/chat/completions` call. Pure (no network). */
-declare function buildChatRequest(model: string, messages: StepMessage[]): ChatRequest;
-/** Extract the assistant text from an OpenAI-compatible completion response. Pure. */
-declare function extractCompletionText(body: unknown): string;
-interface CallLocalOptions {
-    endpoint: string;
-    model: string;
-    messages: StepMessage[];
-    /** Optional bearer token (ollama ignores it; other OpenAI-compat servers may require it). */
-    apiKey?: string;
-    /** Injectable for tests; defaults to global fetch. */
-    fetchImpl?: typeof fetch;
-}
-/**
- * Call an OpenAI-compatible chat endpoint and return the assistant text. Live-gated (needs a reachable
- * endpoint); the request/response shaping is covered by {@link buildChatRequest} /
- * {@link extractCompletionText} tests, and a stubbed `fetchImpl` can drive this end-to-end offline.
- */
-declare function callOpenAiCompat(opts: CallLocalOptions): Promise<string>;
+declare function buildStepMessages(step: StagedStep, question: string, artifacts: Readonly<Record<string, string>>): StepMessage[];
 
 /**
  * IR enum → `query({options})` mapping — the core of this back-end, the TS analogue of the
@@ -553,6 +659,8 @@ interface DispatchMeta {
      *  beyond `wren` and Write/Edit are scoped to this root, instead of denied outright. `null` on the
      *  hybrid-staged path (out of scope — see buildHybridStagedPlan). */
     setupScope: string | null;
+    /** True when this plan requires the prepared-registry component runtime, not plain runDispatch. */
+    componentInvocation?: boolean;
 }
 interface DispatchPlan {
     /** The user question (assembled prompt for `query()`). */
@@ -573,6 +681,9 @@ interface BuildConfig {
 /**
  * Build the `query({options})` for one resolved IR node. Loud-fails on any unsupported enum value
  * before producing anything (wall-hit), mirroring `emit.rs`.
+ *
+ * The assembled prompts are checked for surviving slot references on the way out — see
+ * {@link assertPlanHasNoSlotReferences} for why that check lives here and not only at resolution.
  */
 declare function buildDispatchPlan(node: ComponentNode, report: ResolutionReport, cfg: BuildConfig): DispatchPlan;
 
@@ -635,6 +746,97 @@ type WarbleChatEvent = {
     readonly id: string | null;
 };
 
+/** Hash algorithm named in the output so a stored fingerprint stays readable if this ever changes. */
+declare const ALGORITHM = "sha256";
+/**
+ * One digest per surface, plus the total.
+ *
+ * **Per surface as well as in total, on purpose.** The total answers "did anything change"; only the
+ * per-surface digests answer "which prompt changed", and that is the question a trace disagreeing
+ * with its own hash actually raises. The cost is a few dozen bytes per run.
+ */
+interface PromptFingerprint {
+    algorithm: typeof ALGORITHM;
+    /** Digest over every surface: name-sorted, with each name hashed alongside its text. */
+    digest: string;
+    /** Per-surface digest, keyed by a stable surface name. */
+    surfaces: Record<string, string>;
+}
+/**
+ * Fingerprint an arbitrary surface map. The core; both helpers below funnel through it.
+ *
+ * The total digest hashes each surface's **name and text together**, name-sorted. Including the name
+ * is what stops two different arrangements of the same strings — a prompt moved from one subagent to
+ * another, say — from colliding; sorting is what makes the result independent of key order.
+ */
+declare function fingerprintSurfaces(surfaces: Record<string, string>): PromptFingerprint;
+/**
+ * The prompt surfaces of the `query()` options a host is about to send.
+ *
+ * **This is the primitive, not {@link promptSurfaces}.** A host may assemble its own options from a
+ * plan rather than sending the plan's verbatim — the BIRD-Interact adapter does exactly that,
+ * replacing the system prompt with the component's `prompt_fragment` — and fingerprinting the plan
+ * in that case would record something other than what was sent. A fingerprint describing a prompt
+ * nobody received is worse than no fingerprint, because it reads as evidence.
+ *
+ * So take it as late as possible: over the options that actually reach `query()`.
+ */
+declare function promptSurfacesOf(options: Options): Record<string, string>;
+/**
+ * The prompt surfaces a plan **itself** determines — what the single and split paths send verbatim.
+ *
+ * Surfaces are **named, not positional**, so a plan that gains or loses a subagent changes which
+ * keys exist rather than silently shifting every digest after the insertion point.
+ *
+ * **What this deliberately does NOT cover, and why it would be wrong to.** A staged step is not sent
+ * as its `prompt`: the executor prepends a runtime preamble built from the working directory, and
+ * the hybrid-tool path sends a driver prompt it composes from the step list, which appears nowhere in
+ * the plan's options. Recording a `step.<name>` digest of the bare `prompt` here would produce a
+ * fingerprint that does not match the bytes sent — the exact failure this module's header calls worse
+ * than no fingerprint, because it reads as evidence. Reproducing the assembly here instead would
+ * duplicate it and drift.
+ *
+ * So those paths are fingerprinted where the bytes exist: `runDispatch` reports one fingerprint per
+ * turn it sends, through `RunConfig.onPromptFingerprint`. Use that for anything staged or hybrid; use
+ * this for a plan whose options go out as built.
+ *
+ * One surface that looks missing and is not: on the single-tier (collapse) path a component's
+ * `prompt_fragment` is folded into `systemPrompt`, and `llm_calls[].prompt` is not read at all. So a
+ * one-step component's step text is covered through the driver surface rather than a step surface.
+ */
+declare function promptSurfaces(plan: DispatchPlan): Record<string, string>;
+/** Fingerprint the prompts a plan assembled. See {@link promptSurfaces} on when this is the wrong one. */
+declare function fingerprintPrompts(plan: DispatchPlan): PromptFingerprint;
+
+/**
+ * Compose an embedding host's `canUseTool` with a guardrail floor's, so a host can add its own
+ * enforcement instead of having to choose between the two. Without this an embedder's callback is
+ * silently replaced, which is the same failure whichever way round it happens.
+ *
+ * **The order is load-bearing: the embedder runs first, the floor runs last.** A `canUseTool` may
+ * rewrite a tool's input on the way through (`updatedInput`), so a floor that ran first would be
+ * inspecting an input the embedder could still change afterwards — the floor has to see what the
+ * tool will actually receive. Running it last is what makes composition one-directional: either side
+ * may deny, neither can turn the other's denial into an allow, and an allowed input has passed
+ * through both.
+ *
+ * An embedder denial returns immediately without consulting the floor, so the floor's `denials`
+ * ledger stays a record of guardrail enforcement rather than a mixed log of both parties.
+ *
+ * With no embedder callback the floor's own callback is returned unchanged, so a run without an
+ * embedder behaves exactly as it did before this seam existed.
+ */
+declare function composeCanUseTool(embedder: CanUseTool | undefined, floor: CanUseTool): CanUseTool;
+/**
+ * Merge an embedding host's `hooks` with a guardrail's `PreToolUse` matchers, appending the
+ * guardrail's so the host's run first and neither set is dropped.
+ *
+ * This is the shape the main dispatch path already used inline; it is extracted here so the staged
+ * and hybrid-tool paths can stop discarding the host's hooks, and so there is one place to read
+ * rather than three to keep in step. `PreToolUse` is a separate control path from `canUseTool` (see
+ * `makeSetupReadDenyHook` below for the empirical note), which is why both have to compose.
+ */
+declare function composeHooks(embedder: Options["hooks"], guardHooks: HookCallbackMatcher[]): Options["hooks"];
 /** A blocked tool call, recorded so the trace/report can prove enforcement actually fired. */
 interface Denial {
     tool: string;
@@ -721,6 +923,8 @@ interface Trace {
     /** Per assistant turn (per-step granularity the headless file target can't produce). */
     steps: StepUsage[];
     denials: Denial[];
+    /** Redacted parent/child attempt telemetry. Payloads and provider errors are never included. */
+    componentCalls?: ComponentCallTrace[];
 }
 /** Pure: fold the captured message stream + guardrail denials into a trace. */
 declare function aggregateTrace(messages: readonly SDKMessage[], meta: {
@@ -757,6 +961,32 @@ interface RunConfig {
      *  message stream is consumed, not batched after the fact. Only wired on the main (single/split) SDK
      *  loop below — the hybrid-staged executor passes through with no events. */
     onEvent?: (event: WarbleChatEvent) => void;
+    /**
+     * Called once per turn this run sends, with a fingerprint of the prompts THAT turn carried.
+     *
+     * Reported here rather than derived from the plan because the staged and hybrid paths do not send
+     * the plan's text as built: a step's options carry a runtime preamble ahead of its prompt, and the
+     * hybrid-tool driver composes a prompt that appears nowhere in the plan. A plan-derived digest
+     * would name bytes that were never sent, which is worse than none — it reads as evidence.
+     *
+     * Several turns therefore report several fingerprints. A consumer that wants one value per run
+     * should deduplicate by digest: one entry means the prompts held steady, more than one means they
+     * changed across the run, which is itself the finding.
+     */
+    onPromptFingerprint?: (fingerprint: PromptFingerprint) => void;
+    /**
+     * The IR file this plan came from, and the IR itself — supplied together to land the assets its
+     * components declare into the working directory before the agent runs.
+     *
+     * Optional because a caller that built a plan without an IR file on disk (a test, a programmatic
+     * IR) has nothing to land from. Omitting it on a plan whose components DO declare assets means the
+     * agent runs without them, which is the pre-existing behaviour this closes — so a host that can
+     * supply it should.
+     */
+    assets?: {
+        ir: WarbleIr;
+        irPath: string;
+    };
 }
 /**
  * A dispatch failure that still carries the SDK's session id, when the result message had one —
@@ -775,6 +1005,368 @@ declare class DispatchSessionError extends DispatchError {
  */
 declare function runDispatch(plan: DispatchPlan, cfg: RunConfig): Promise<RunResult>;
 
+interface DispatchInput {
+    /** A parsed IR or a raw JSON string. */
+    ir: WarbleIr | string;
+    /**
+     * What this host says about each declared slot: a variant name to render, `null` to remove the
+     * slot because its `present_when` does not hold, or nothing at all to take the declared default.
+     *
+     * The IR carries every variant and picks none — picking is the host's job, and so is answering a
+     * condition. Omit this entirely for an IR that declares no slots; supplying it then is harmless
+     * but pointless. An IR that DOES declare a conditional slot and gets no answer for it is a loud
+     * failure rather than a silent default (see `resolveSlots`).
+     */
+    slots?: SlotSupply;
+    /** The data question to answer (the `query()` prompt). Optional for prepare-only (dry-run/emit). */
+    question?: string;
+    target?: string;
+    flavor?: RenderFlavor;
+    models?: ModelConfig;
+    maxTurns?: number;
+    /** Explicit bound-project cwd (absolute or cwd-relative). Overrides `irPath`-based resolution. */
+    project?: string;
+    /** Resolve each node's relative `context_binding.project` against this IR file's directory. */
+    irPath?: string;
+    /**
+     * Scope preparation to this root id and its complete transitive component-call closure. An
+     * unreachable sibling is left untouched, so its model, slots, assets, capabilities, guardrails,
+     * effect and trigger never enter this dispatch's preflight. Use this for `chat`, which starts one
+     * root per process.
+     *
+     * Omit (the default) to prepare every component in the IR — the shape `manifest`, `emit`, and
+     * the whole-profile `dispatch` subcommand need, since each of those actually reads or runs
+     * every component and must know every component's resolution, not just one's.
+     *
+     * This narrows *which closure's* requirements gate a call; it does not weaken a failed
+     * capability. Reachable callees are fully planned under their own authority and stored in the
+     * prepared-callee registry, never appended to the root plan list or started automatically.
+     */
+    componentId?: string;
+}
+interface PreparedComponent {
+    id: string;
+    node: ComponentNode;
+    report: ResolutionReport;
+    plan: DispatchPlan;
+    /** Every IR step with its own runtime model/provider binding, retained for trusted step execution. */
+    steps: readonly StagedStep[];
+    role: "entry" | "callee";
+}
+interface PreparedDispatch {
+    target: string;
+    profile: string;
+    /** Backwards-compatible root plan list. Reachable callees never appear here merely by reachability. */
+    components: PreparedComponent[];
+    /** Immutable records addressable only through the authorized dependency table. */
+    preparedCallees: readonly PreparedComponent[];
+    entries: readonly EntryClosure[];
+    dependencies: readonly ComponentDependency[];
+}
+/** Stable redacted status for a component the configured target cannot run. */
+declare const UNAVAILABLE_COMPONENT_REASON = "component is unavailable on the configured runtime";
+interface UnavailableDisplayComponent {
+    id: string;
+    node: ComponentNode;
+    /** Read-only diagnostic resolution; never an executable capability grant. */
+    inspection: ResolutionReport;
+    availability: {
+        status: "unavailable";
+        reason: typeof UNAVAILABLE_COMPONENT_REASON;
+    };
+}
+/**
+ * A component in a display manifest that the target CAN run.
+ *
+ * Deliberately **not** a {@link PreparedComponent}: it carries no `plan`. A plan built for a display
+ * is resolved under the lenient unanswered-condition policy, so handing one out would let a consumer
+ * do the natural "preview it, then dispatch what was previewed" — `runDispatch(component.plan, cfg)`
+ * type-checks with no cast — and send a model wording for a condition nobody ever answered. That is
+ * exactly the failure the strict policy exists to prevent, arriving through the display door.
+ *
+ * A plan is still built during preparation, because that is what surfaces an unsupported enum as a
+ * wall-hit; it is discarded rather than returned. Nothing in the manifest builders reads it.
+ */
+interface AvailableDisplayComponent {
+    id: string;
+    node: ComponentNode;
+    report: ResolutionReport;
+}
+type DisplayComponent = AvailableDisplayComponent | UnavailableDisplayComponent;
+interface PreparedDisplayManifest {
+    target: string;
+    profile: string;
+    components: readonly DisplayComponent[];
+    entries: readonly EntryClosure[];
+    dependencies: readonly ComponentDependency[];
+}
+/**
+ * Resolve a node's bound wren project to an absolute cwd. Relative `context_binding.project` paths
+ * resolve against the IR file's directory (`irPath`) when given, else the current working directory;
+ * an explicit `project` always wins.
+ */
+declare function resolveProjectCwd(node: ComponentNode, opts: {
+    project?: string;
+    irPath?: string;
+}): string;
+/**
+ * Parse + resolve + build every requested component's `query({options})`, without calling the SDK.
+ *
+ * By default this prepares every advertised entry and the union of their closures. Pass
+ * `input.componentId` to scope preparation to one advertised root and its transitive callees;
+ * components outside that closure are never consulted. See {@link DispatchInput.componentId}.
+ */
+declare function prepareDispatch(input: DispatchInput): PreparedDispatch;
+/**
+ * Prepare a display-only whole-profile manifest. Unsupported components are
+ * represented by a closed unavailable marker; no executable plan is built
+ * for them. This must never be used by emit, dispatch, or chat.
+ */
+declare function prepareDisplayManifest(input: Omit<DispatchInput, "componentId" | "question">): PreparedDisplayManifest;
+interface DispatchRunConfig {
+    outDir: string;
+    warbleBin?: string;
+    title?: string;
+    /** Host-lowered root invocation limits. Defaults are fixed by the composition specification. */
+    componentLimits?: ComponentInvocationLimits;
+    /** Root cancellation propagated into all active child query() calls. */
+    signal?: AbortSignal;
+    /** Deterministic host/test seam; production omits this and uses fresh Agent SDK query() calls. */
+    componentStepRunner?: ComponentStepRunner;
+    /** Embedder enforcement runs before each component's own immutable guardrail floor. */
+    hostCanUseTool?: Options["canUseTool"];
+    hostHooks?: Options["hooks"];
+}
+interface ComponentOutcome {
+    id: string;
+    report: ResolutionReport;
+    plan: DispatchPlan;
+    result: RunResult;
+}
+interface DispatchOutcome {
+    target: string;
+    components: ComponentOutcome[];
+}
+/**
+ * Verify every reachable mount's travelling assets without writing them. This is intentionally a
+ * separate executable preflight from pure graph preparation: it reads the filesystem, but still
+ * completes before a model, session, output directory, or asset target is created.
+ */
+declare function preflightDispatchAssets(input: DispatchInput, prepared: PreparedDispatch): void;
+/**
+ * Prepare then RUN each component against the live Agent SDK loop. Requires `input.question`.
+ * Writes each run's artifacts under `runCfg.outDir` (see {@link runDispatch}).
+ */
+declare function dispatch(input: DispatchInput, runCfg: DispatchRunConfig): Promise<DispatchOutcome>;
+
+declare const DEFAULT_COMPONENT_INVOCATION_LIMITS: Readonly<{
+    maxDepth: 8;
+    maxAttempts: 32;
+    maxRequestBytes: 65536;
+    maxResultBytes: 1048576;
+    maxTurns: 40;
+    maxTurnsPerChild: 12;
+}>;
+interface ComponentInvocationLimits {
+    maxDepth?: number;
+    maxAttempts?: number;
+    maxRequestBytes?: number;
+    maxResultBytes?: number;
+    maxTurns?: number;
+    maxTurnsPerChild?: number;
+    /** Rejected by the Agent SDK composition preflight until provider spend is reservable. */
+    maxCostUsd?: number;
+    deadlineAt?: number;
+}
+interface ComponentInvocationRequest {
+    request: string;
+    input?: Record<string, unknown>;
+}
+interface ComponentProvenance {
+    verified?: boolean;
+    definition?: unknown;
+}
+type ComponentInvocationResult = {
+    status: "ok";
+    output: {
+        kind: "value";
+        value: unknown;
+    } | {
+        kind: "render";
+        blocks: Record<string, unknown>[];
+        summary?: string;
+    };
+    provenance?: ComponentProvenance;
+} | {
+    status: "refused";
+    code: "callee_refused";
+    message: string;
+} | {
+    status: "error";
+    code: "unsupported_callee" | "invalid_request" | "invalid_result" | "budget_exhausted" | "cancelled" | "transient_transport" | "callee_failed";
+    message: string;
+    retryable: boolean;
+};
+type ComponentCallStatus = "ok" | "refused" | "error" | "cancelled" | "late_discarded";
+interface ComponentCallTrace {
+    call_id: string;
+    parent_call_id: string | null;
+    caller_mount: string;
+    trusted_step_id: string;
+    alias: string;
+    callee_mount: string;
+    attempt: number;
+    depth: number;
+    admitted_at: number;
+    completed_at: number;
+    status: ComponentCallStatus;
+    request_bytes: number;
+    result_bytes: number;
+    model_turns: number;
+    total_cost_usd: number;
+    token_usage: {
+        input_tokens: number;
+        output_tokens: number;
+        cache_creation_input_tokens: number;
+        cache_read_input_tokens: number;
+    } | null;
+    degradation: string | null;
+}
+interface ComponentStepUsage {
+    model: string;
+    usage: unknown;
+}
+interface ComponentStepResult {
+    text: string;
+    turns: number;
+    totalCostUsd: number;
+    usage?: ComponentStepUsage[];
+    degradation?: string | null;
+}
+/** A step failed after the provider exposed billable telemetry. The runtime must charge it. */
+declare class ComponentStepExecutionError extends DispatchError {
+    readonly telemetry: ComponentStepResult;
+    readonly retryable: boolean;
+    constructor(message: string, telemetry: ComponentStepResult, retryable: boolean);
+}
+interface ComponentStepRun {
+    rootRunId: string;
+    callId: string | null;
+    parentCallId: string | null;
+    component: PreparedComponent;
+    step: StagedStep;
+    request: Required<ComponentInvocationRequest>;
+    artifacts: Readonly<Record<string, string>>;
+    aliases: readonly string[];
+    signal: AbortSignal;
+    maxTurns: number;
+    invoke(alias: string, request: unknown): Promise<ComponentInvocationResult>;
+}
+type ComponentStepRunner = (run: ComponentStepRun) => Promise<ComponentStepResult>;
+interface ComponentRuntimeOptions {
+    prepared: PreparedDispatch;
+    runStep: ComponentStepRunner;
+    limits?: ComponentInvocationLimits;
+    signal?: AbortSignal;
+    now?: () => number;
+    newId?: () => string;
+}
+interface ComponentRootResult {
+    finalText: string;
+    turns: number;
+    totalCostUsd: number;
+    usage: ComponentStepUsage[];
+    componentCalls: ComponentCallTrace[];
+}
+declare function normalizeComponentRequest(value: unknown, maxBytes?: number): {
+    value: Required<ComponentInvocationRequest>;
+    bytes: number;
+} | {
+    error: ComponentInvocationResult;
+};
+declare function normalizeComponentResult(finalText: string, renderContract: readonly RenderBlock[], maxBytes?: number): {
+    value: ComponentInvocationResult;
+    bytes: number;
+};
+declare function assertEligibleComponentCallee(component: PreparedComponent): void;
+/** A root caller may own the final render path, but its model step stays read-only and SDK-bound. */
+declare function assertEligibleComponentCaller(component: PreparedComponent): void;
+declare class ComponentInvocationRuntime {
+    private readonly options;
+    readonly rootRunId: string;
+    readonly componentCalls: ComponentCallTrace[];
+    private readonly limits;
+    private readonly abortController;
+    private readonly now;
+    private readonly newId;
+    private readonly byId;
+    private readonly edgeByStep;
+    private readonly descendantDepth;
+    private attempts;
+    private availableTurns;
+    private totalTurnsObserved;
+    private totalCostUsd;
+    private readonly allUsage;
+    private cancelledAt;
+    private deadlineTimer;
+    constructor(options: ComponentRuntimeOptions);
+    get signal(): AbortSignal;
+    cancel(): void;
+    runRoot(componentId: string, request: ComponentInvocationRequest): Promise<ComponentRootResult>;
+    private throwIfCancelled;
+    private aliasesFor;
+    private availableFor;
+    private charge;
+    private maxDescendantDepth;
+    private descendantDepthForStep;
+    /** Reserve an active root SDK query before its synchronous child handlers may be admitted. */
+    private reserveRootStep;
+    private executeComponent;
+    private enqueueInvocation;
+    private invoke;
+}
+
+/**
+ * Minimal OpenAI-compatible chat client for the hybrid-staged path (see docs/spec/capability-model.md §7.2).
+ *
+ * A local step (provider `openai_compat`, e.g. ollama's `http://localhost:11434/v1`) is executed by
+ * calling `POST {endpoint}/chat/completions` directly — NOT through the Claude SDK, whose `agents[].model`
+ * is a restricted alias union that loud-fails on a local model id (SDK-NOTES.md #1). ollama speaks the
+ * OpenAI Chat Completions shape, not the Anthropic Messages shape, so this is a distinct, deliberately
+ * tiny client — no streaming, no tools, no retries. It is the "third provider-aware back-end" embryo:
+ * enough to prove a per-step local model can be marshaled into a cloud run, not a production LLM client.
+ *
+ * Live-gated: exercised only when an ollama (or other OpenAI-compat) endpoint is reachable. The request
+ * SHAPING is unit-tested via {@link buildChatRequest} with no network.
+ */
+
+interface ChatRequest {
+    model: string;
+    messages: StepMessage[];
+    stream: false;
+    /** Deterministic-leaning default; a local step is a bounded transform, not open-ended generation. */
+    temperature: number;
+}
+/** Build the JSON body for an OpenAI-compatible `/chat/completions` call. Pure (no network). */
+declare function buildChatRequest(model: string, messages: StepMessage[]): ChatRequest;
+/** Extract the assistant text from an OpenAI-compatible completion response. Pure. */
+declare function extractCompletionText(body: unknown): string;
+interface CallLocalOptions {
+    endpoint: string;
+    model: string;
+    messages: StepMessage[];
+    /** Optional bearer token (ollama ignores it; other OpenAI-compat servers may require it). */
+    apiKey?: string;
+    /** Injectable for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Call an OpenAI-compatible chat endpoint and return the assistant text. Live-gated (needs a reachable
+ * endpoint); the request/response shaping is covered by {@link buildChatRequest} /
+ * {@link extractCompletionText} tests, and a stubbed `fetchImpl` can drive this end-to-end offline.
+ */
+declare function callOpenAiCompat(opts: CallLocalOptions): Promise<string>;
+
 /**
  * The orchestrator's system prompt — PROVIDER-AGNOSTIC. Lists the steps in order by name and the
  * produces→consumes marshaling; it never says which step is local vs cloud (that is the handler's job,
@@ -787,6 +1379,12 @@ declare function buildToolDriverPrompt(steps: readonly StagedStep[]): string;
  */
 declare function runHybridTool(plan: DispatchPlan, cfg: RunConfig): Promise<RunResult>;
 
+/** The directory an IR's assets travel in, derived from the IR's own path. Mirrors the Rust CLI's. */
+declare function assetDirForIr(irPath: string): string;
+/** Executable-preflight probe: verify every asset before model/session/output work begins. */
+declare function validateAssets(ir: WarbleIr, irPath: string, cwd: string): void;
+declare function landAssets(ir: WarbleIr, irPath: string, cwd: string): string[];
+
 interface RenderResult {
     outPath: string;
     /** stderr from `warble render` (it logs "wrote … (N block(s))"). */
@@ -802,6 +1400,22 @@ declare function renderEnvelope(finalText: string, outPath: string, opts: {
     title?: string;
 }): RenderResult;
 
+declare function createSdkComponentStepRunner(cfg?: Pick<ComposedRunConfig, "onPromptFingerprint" | "hostCanUseTool" | "hostHooks">): {
+    runStep: ComponentStepRunner;
+    denials: Denial[];
+};
+interface ComposedRunConfig extends RunConfig {
+    prepared: PreparedDispatch;
+    root: PreparedComponent;
+    limits?: ComponentInvocationLimits;
+    signal?: AbortSignal;
+    runStep?: ComponentStepRunner;
+    hostCanUseTool?: Options["canUseTool"];
+    hostHooks?: Options["hooks"];
+}
+/** Execute one prepared root and its authorized descendants. Only this root path persists output. */
+declare function runComposedDispatch(plan: DispatchPlan, cfg: ComposedRunConfig): Promise<RunResult>;
+
 /**
  * A minimal structured snapshot of what a turn resolved — filters/dimensions/measures/grain — used
  * only to thread context into the NEXT turn's prompt. Nothing here is inferred by this module: a
@@ -907,111 +1521,6 @@ declare class ChatSession {
 }
 declare function createChatSession(plan: DispatchPlan, runCfg: RunConfig, initialResumeSessionId?: string): ChatSession;
 
-interface DispatchInput {
-    /** A parsed IR or a raw JSON string. */
-    ir: WarbleIr | string;
-    /** The data question to answer (the `query()` prompt). Optional for prepare-only (dry-run/emit). */
-    question?: string;
-    target?: string;
-    flavor?: RenderFlavor;
-    models?: ModelConfig;
-    maxTurns?: number;
-    /** Explicit bound-project cwd (absolute or cwd-relative). Overrides `irPath`-based resolution. */
-    project?: string;
-    /** Resolve each node's relative `context_binding.project` against this IR file's directory. */
-    irPath?: string;
-    /**
-     * Scope preparation to exactly this component id: only its capabilities are resolved and only
-     * its plan is built — every *other* component in the IR is left untouched, so its
-     * `required_capabilities` never enter this dispatch's preflight. Use this for `chat`, which
-     * only ever runs one component per process.
-     *
-     * Omit (the default) to prepare every component in the IR — the shape `manifest`, `emit`, and
-     * the whole-profile `dispatch` subcommand need, since each of those actually reads or runs
-     * every component and must know every component's resolution, not just one's.
-     *
-     * This narrows *which* component's requirements gate a given `prepareDispatch` call — it does
-     * not change what happens when a gated capability is unmet (still a loud throw, same message,
-     * same named capability; see `resolveNodeCapabilities`). A component that can itself invoke
-     * another IR component at runtime would need that callee's requirements folded in here too, but
-     * no such reachability exists yet: `borrowed_actions` names external runtime actions (notify,
-     * ticket, …), never another component, and the one mechanism shaped for it — `orchestrating` /
-     * `effect.outcome.kind: "dispatch"` with `routable_scope` — is parsed but not consumed by any
-     * back-end (`docs/spec/authoring.md` marks `orchestrating` "scaffolded", not realized). If that
-     * ever lands, this scoping must fold in the callee's requirements too.
-     */
-    componentId?: string;
-}
-interface PreparedComponent {
-    id: string;
-    node: ComponentNode;
-    report: ResolutionReport;
-    plan: DispatchPlan;
-}
-interface PreparedDispatch {
-    target: string;
-    components: PreparedComponent[];
-}
-/** Stable redacted status for a component the configured target cannot run. */
-declare const UNAVAILABLE_COMPONENT_REASON = "component is unavailable on the configured runtime";
-interface UnavailableDisplayComponent {
-    id: string;
-    node: ComponentNode;
-    availability: {
-        status: "unavailable";
-        reason: typeof UNAVAILABLE_COMPONENT_REASON;
-    };
-}
-type DisplayComponent = PreparedComponent | UnavailableDisplayComponent;
-interface PreparedDisplayManifest {
-    target: string;
-    components: DisplayComponent[];
-}
-/**
- * Resolve a node's bound wren project to an absolute cwd. Relative `context_binding.project` paths
- * resolve against the IR file's directory (`irPath`) when given, else the current working directory;
- * an explicit `project` always wins.
- */
-declare function resolveProjectCwd(node: ComponentNode, opts: {
-    project?: string;
-    irPath?: string;
-}): string;
-/**
- * Parse + resolve + build every requested component's `query({options})`, without calling the SDK.
- *
- * By default this prepares every component in the IR. Pass `input.componentId` to scope
- * preparation — and therefore capability resolution — to exactly that one component; every other
- * component's `required_capabilities` are never consulted, so a component that isn't being
- * dispatched can't wall-hit a dispatch it has nothing to do with. See {@link DispatchInput.componentId}.
- */
-declare function prepareDispatch(input: DispatchInput): PreparedDispatch;
-/**
- * Prepare a display-only whole-profile manifest. Unsupported components are
- * represented by a closed unavailable marker; no executable plan is built
- * for them. This must never be used by emit, dispatch, or chat.
- */
-declare function prepareDisplayManifest(input: Omit<DispatchInput, "componentId" | "question">): PreparedDisplayManifest;
-interface DispatchRunConfig {
-    outDir: string;
-    warbleBin?: string;
-    title?: string;
-}
-interface ComponentOutcome {
-    id: string;
-    report: ResolutionReport;
-    plan: DispatchPlan;
-    result: RunResult;
-}
-interface DispatchOutcome {
-    target: string;
-    components: ComponentOutcome[];
-}
-/**
- * Prepare then RUN each component against the live Agent SDK loop. Requires `input.question`.
- * Writes each run's artifacts under `runCfg.outDir` (see {@link runDispatch}).
- */
-declare function dispatch(input: DispatchInput, runCfg: DispatchRunConfig): Promise<DispatchOutcome>;
-
 /**
  * Codegen (`emit`) — freeze a prepared dispatch into an importable TS agent module.
  *
@@ -1091,6 +1600,7 @@ interface GuardrailManifest {
 }
 interface AvailableAgentManifest {
     id: string;
+    entrypoint: boolean;
     verb: string;
     component_type: ComponentNode["type"];
     realization_kind: ComponentNode["realization_kind"];
@@ -1101,11 +1611,13 @@ interface AvailableAgentManifest {
     tools: ToolRef[];
     output_schema: unknown;
     capabilities: ResolutionReport;
+    dependencies: ComponentDependencyManifest[];
     brief?: string;
 }
 /** A display-only declaration of a component that remains unavailable to this target. */
 interface UnavailableAgentManifest {
     id: string;
+    entrypoint: boolean;
     verb: string;
     component_type: ComponentNode["type"];
     realization_kind: ComponentNode["realization_kind"];
@@ -1117,27 +1629,49 @@ interface UnavailableAgentManifest {
     tools: [];
     output_schema: Record<string, never>;
     capabilities: [];
+    capability_inspection: ResolutionReport;
+    dependencies: ComponentDependencyManifest[];
     availability: {
         status: "unavailable";
         reason: string;
     };
 }
 type AgentManifest = AvailableAgentManifest | UnavailableAgentManifest;
+type ComponentDependencyManifest = Omit<ComponentDependency, "caller">;
+interface EntryManifest {
+    id: string;
+    closure: string[];
+    availability: {
+        status: "available";
+    } | {
+        status: "unavailable";
+        reason: string;
+    };
+    /** Null when the entry's closure declares no component invocation. */
+    invocation_realization: ResolvedCapability | null;
+}
 interface Manifest {
     manifest_version: string;
     compat: CompatibilityPolicy;
     profile: string;
     target: string;
+    /** Selectable roots only. Internal mounts remain visible under `agents`, never here. */
+    entries: EntryManifest[];
     agents: AgentManifest[];
 }
 /** Port of `emit.rs::build_agent_bundle`, minus the tool-map parameter (this back-end's is fixed,
  * see `LOCAL_TOOL_MAP`). */
-declare function buildAgentManifest(component: PreparedComponent): AvailableAgentManifest;
+/**
+ * Takes the plan-less display shape deliberately. A {@link PreparedComponent} is still accepted —
+ * it satisfies this structurally — but nothing here reads a plan, so nothing here should require
+ * one; see `AvailableDisplayComponent` for why a display must not carry it.
+ */
+declare function buildAgentManifest(component: AvailableDisplayComponent, dependencies?: readonly ComponentDependency[]): AvailableAgentManifest;
 /** Never derives a plan, tool, or capability grant for an unavailable component. */
-declare function buildUnavailableAgentManifest(component: UnavailableDisplayComponent): UnavailableAgentManifest;
+declare function buildUnavailableAgentManifest(component: UnavailableDisplayComponent, dependencies?: readonly ComponentDependency[]): UnavailableAgentManifest;
 /** Build the full display manifest for a `prepareDispatch` result. `raw` is the same IR the
  * dispatch was prepared from — re-parsed here (a second, cheap, pure parse) just to read
  * `profile`, which `PreparedDispatch` does not itself carry. */
 declare function buildManifest(prepared: PreparedDispatch | PreparedDisplayManifest, raw: string): Manifest;
 
-export { type AgentManifest, type AskOptions, type AvailableAgentManifest, type BuildConfig, COMPONENT_TYPES, type CallLocalOptions, type CapabilityEntry, type CapabilityOutcome, type CapabilityProfile, type ChatRequest, ChatSession, type ClarifyOutcome, type CompatibilityPolicy, type ComponentNode, type ComponentOutcome, type ComponentType, type ContextBinding, type Criticality, DEFAULT_CLARIFY_THRESHOLD, DEFAULT_RENDER_FLAVOR, DEFAULT_TARGET, DESTRUCTIVE_BASH_DENY, type Denial, type DiscoverClaudeModelsOptions, DispatchError, type DispatchInput, type DispatchMeta, type DispatchOutcome, type DispatchPlan, type DispatchRunConfig, DispatchSessionError, type DisplayComponent, type Effect, type EmitOptions, type GateFailureMode, type GateKind, type GuardConfig, type Guardrail, type GuardrailManifest, type IrConfig, type LlmCall, MODEL_CATALOG_VERSION, type Manifest, type ModelCatalogModel, type ModelCatalogResult, type ModelCatalogUnavailableCode, ModelConfig, OUTCOME_KINDS, type Outcome, type OutcomeKind, type PreconditionResult, type PreparedComponent, type PreparedDispatch, type PreparedDisplayManifest, type ProvidedBy, type Provider, REALIZATION_KINDS, type RealizationKind, type RenderBlock, type RenderFlavor, type RenderGate, type RenderResult, type ResolutionReport, type ResolvedCapability, type ResolvedIntent, type RoutingMode, type RoutingPlan, type RunConfig, type RunResult, SUPPORTED_IR_VERSIONS, type SessionState, type StagedStep, type StepManifest, type StepMessage, type StepRealization, type StepUsage, TRIGGER_KINDS, type TargetId, type TierBinding, type ToolPlan, type ToolRef, type Trace, type Trigger, type TriggerKind, type Turn, type TurnResult, UNAVAILABLE_COMPONENT_REASON, type UnavailableAgentManifest, type UnavailableDisplayComponent, type WarbleIr, type WhenGuardOut, aggregateTrace, appendTurn, buildAgentManifest, buildChatRequest, buildDispatchPlan, buildManifest, buildStepMessages, buildToolDriverPrompt, buildTurnPrompt, buildUnavailableAgentManifest, callOpenAiCompat, collectRequiredCapabilities, createChatSession, createSessionState, decideClarify, discoverClaudeModels, dispatch, distillFollowup, distinctProviders, distinctTiers, emitAgentModule, extractCompletionText, inspectNodeCapabilities, isKnownTarget, knownTargetNames, lastResolvedIntent, lastSessionId, localProfile, makeReadOnlyGuard, parseIr, parseRenderFlavor, planProviderRouting, prepareDispatch, prepareDisplayManifest, profileFor, renderEnvelope, resolveCapabilities, resolveNodeCapabilities, resolveProjectCwd, resolveStagedSteps, runDispatch, runHybridTool, shouldSplitPerStepTier, usesLocalProvider };
+export { type AgentManifest, type AskOptions, type AvailableAgentManifest, type AvailableDisplayComponent, type BuildConfig, COMPONENT_TYPES, type CallLocalOptions, type CapabilityEntry, type CapabilityOutcome, type CapabilityProfile, type ChatRequest, ChatSession, type ClarifyOutcome, type CompatibilityPolicy, type ComponentCall, type ComponentCallTrace, type ComponentClosurePlan, type ComponentDependency, type ComponentDependencyManifest, type ComponentInvocationLimits, type ComponentInvocationRequest, type ComponentInvocationResult, ComponentInvocationRuntime, type ComponentNode, type ComponentOutcome, type ComponentRootResult, ComponentStepExecutionError, type ComponentStepResult, type ComponentStepRun, type ComponentStepRunner, type ComponentType, type ComposedRunConfig, type ContextBinding, type Criticality, DEFAULT_CLARIFY_THRESHOLD, DEFAULT_COMPONENT_INVOCATION_LIMITS, DEFAULT_RENDER_FLAVOR, DEFAULT_TARGET, DESTRUCTIVE_BASH_DENY, type Denial, type DiscoverClaudeModelsOptions, DispatchError, type DispatchInput, type DispatchMeta, type DispatchOutcome, type DispatchPlan, type DispatchRunConfig, DispatchSessionError, type DisplayComponent, type Effect, type EmitOptions, type EntryClosure, type EntryManifest, type GateFailureMode, type GateKind, type GuardConfig, type Guardrail, type GuardrailManifest, type IrConfig, type LlmCall, MODEL_CATALOG_VERSION, type Manifest, type ModelCatalogModel, type ModelCatalogResult, type ModelCatalogUnavailableCode, ModelConfig, OUTCOME_KINDS, type Outcome, type OutcomeKind, type PreconditionResult, type PreparedComponent, type PreparedDispatch, type PreparedDisplayManifest, type PromptFingerprint, type ProvidedBy, type Provider, REALIZATION_KINDS, type RealizationKind, type RenderBlock, type RenderFlavor, type RenderGate, type RenderResult, type ResolutionReport, type ResolvedCapability, type ResolvedIntent, type RoutingMode, type RoutingPlan, type RunConfig, type RunResult, SUPPORTED_IR_VERSIONS, type SessionState, type SlotSupply, type StagedStep, type StepManifest, type StepMessage, type StepRealization, type StepUsage, TRIGGER_KINDS, type TargetId, type TierBinding, type ToolPlan, type ToolRef, type Trace, type Trigger, type TriggerKind, type Turn, type TurnResult, UNAVAILABLE_COMPONENT_REASON, type UnansweredCondition, type UnavailableAgentManifest, type UnavailableDisplayComponent, type WarbleIr, type WhenGuardOut, aggregateTrace, appendTurn, applySlots, assertEligibleComponentCallee, assertEligibleComponentCaller, assertNoSlotReferences, assetDirForIr, buildAgentManifest, buildChatRequest, buildDispatchPlan, buildManifest, buildStepMessages, buildToolDriverPrompt, buildTurnPrompt, buildUnavailableAgentManifest, callOpenAiCompat, collectRequiredCapabilities, componentDependencies, composeCanUseTool, composeHooks, createChatSession, createSdkComponentStepRunner, createSessionState, decideClarify, discoverClaudeModels, dispatch, distillFollowup, distinctProviders, distinctTiers, emitAgentModule, extractCompletionText, fingerprintPrompts, fingerprintSurfaces, inspectNodeCapabilities, isKnownTarget, knownTargetNames, landAssets, lastResolvedIntent, lastSessionId, localProfile, makeReadOnlyGuard, normalizeComponentRequest, normalizeComponentResult, parseIr, parseRenderFlavor, parseSlotFlags, planProviderRouting, preflightDispatchAssets, prepareDispatch, prepareDisplayManifest, profileFor, promptSurfaces, promptSurfacesOf, renderEnvelope, resolveCapabilities, resolveComponentClosure, resolveNodeCapabilities, resolveProjectCwd, resolveSlots, resolveStagedSteps, runComposedDispatch, runDispatch, runHybridTool, shouldSplitPerStepTier, usesLocalProvider, validateAssets };