balladeer 0.0.4 → 1.0.0

package/LICENSE

@@ -1,7 +1,202 @@
-Copyright (c) 2026 Balladeer
 
-All rights reserved.
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
 
-This package reserves the "balladeer" package name and points at the official
-installer. It grants no rights to Balladeer's software or services. Use of the
-Balladeer service is governed by Balladeer's Terms of Service.
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Balladeer Labs
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,77 +1,163 @@
-# Balladeer
-
-Balladeer makes your AI agents work like they have been on your team for years. It is
-decision memory for engineering teams and their agents: it captures the decisions your
-team makes while building (the question, the call, the why, the rejected options) and
-returns them at the moment they matter: before an agent builds, when a choice comes up,
-and when a new plan contradicts a settled call.
-
-A real serving from Balladeer's own brain (2026-07-14, trimmed). The agent asked before
-touching a webhook receiver, and the team's settled call came back with its certainty
-and its why:
-
-```text
-⟢ balladeer · 2 decisions for "Add a rate limiter to the webhook receiver…"
-
-decision decision_1a4cdf8b-f92: The remote-MCP per-org RPM cap is enforced FLEET-WIDE
-  via a shared DB counter (mcp_rate_counters: one row per (org, minute bucket), single
-  atomic INSERT ... ON CONFLICT ... SET hits=hits+1 RETURNING), replacing the per-process
-  Map that would have enforced N x the limit across N machines. […]
-  certainty: confirmed by a human
-  question it settles: How should the remote-MCP rate limit be enforced across multiple
-  Fly machines, and which parts of the guard should stay per-process?
-```
-
-When the agent then makes a new call of its own, the decision is recorded back
-(unconfirmed until a human confirms it) and surfaces to every future session that
-touches it.
+# balladeer
 
-## What it does mechanically
+Balladeer holds the behaviors your team has agreed the software keeps, and reports whether each one
+is still being kept. Somebody on your team writes down a behavior in plain language, a named person
+reads it and agrees to it, and from then on your own CI runs your own tests against it and reports
+the outcome. What you get back is a catalog that separates the three states people usually blur
+together: promises a person has agreed to and CI is proving, promises a person has agreed to that
+nothing is proving yet, and promises whose last run says nothing usable, which read as unknown
+rather than green. This package is the command that connects one repository to that, and it never
+receives your code.
 
-- Your agent gains three habits over MCP: `get_context` before non-trivial work,
-  `consult` at a choice, `propose_decision` when a call gets made. Every decision
-  carries its certainty (human-confirmed vs machine-captured) and its receipts.
-- Your team's decisions live on a shared central server; the `balladeer` CLI and the
-  hosted MCP connector read from and write to it directly, with no local database to
-  manage.
-- Humans stay in charge: `balladeer recent` and the status line show what accumulated;
-  confirm or dismiss from the terminal. `balladeer uninstall` removes everything the
-  setup installed (your data directory is backed up, not deleted).
-- Decisions cluster into initiatives: cite a decision id in the PR body that delivers
-  it and its definition of done checks off on merge, so initiative progress is derived
-  from merged work, not status updates.
+## Getting set up
 
-## Install
+Open your coding agent in the repository you want to protect and say:
 
-```sh
-npm install -g balladeer
-balladeer
-```
+> get Balladeer set up
 
-This package is a thin installer. On your consent (one prompt; `--yes` to skip), it
-downloads the current Balladeer client from `get.balladeer.ai`, verifies the published
-sha256 checksum, and installs the verified file globally, replacing this installer with
-the real client (the everyday `balladeer` CLI).
-Equivalent, without npm:
+The agent reads the setup instructions, runs the command, and hands you the two things only you can
+do. To run it yourself instead:
 
 ```sh
-curl -fsSL https://get.balladeer.ai | sh
+npx balladeer@1.0.0 setup
 ```
 
-Then pair the machine to your team:
-
-```sh
-balladeer login
-```
-
-You need a Balladeer workspace to pair with; create one at
-[app.balladeer.ai](https://app.balladeer.ai).
-
-Flags: `--yes` installs without prompting; `--download-only` fetches and verifies the
-client tarball and prints its path without installing.
-
-The client is served from Balladeer's own infrastructure so every install gets the
-current build; the client package will publish here directly once self-serve install
-stabilizes.
-
-Copyright (c) 2026 Balladeer. All rights reserved.
+Pin the version, every time. Never use an unpinned or `@latest` form. The bare name resolves to an
+unrelated package that installs a different program.
+
+Run it inside the repository you want to protect. It prints the boundary explanation below, then one
+step at a time, and it exits within seconds rather than blocking on anything.
+
+It performs all five steps: it pairs this session, adds the repository from ids your own `gh` read,
+connects this coding agent, records the CI identity and opens the pull request whose run proves it,
+and hands you the playbook for discovering this repository's own promises. The two things it never
+does are sign you in and agree to a promise; both of those are yours, in a browser.
+
+## Requirements
+
+- Node 22 or newer. The command has no runtime dependencies at all: it uses Node builtins and
+  nothing else, so installing it pulls nothing else down.
+- `git`, and the GitHub CLI (`gh`) signed in to an account with push access to the repository. Your
+  `gh` is how the command reads the repository's ids and opens the pull request that carries the
+  workflow. Balladeer itself never holds a GitHub credential.
+
+## What Balladeer can see
+
+Balladeer never receives your code. It cannot read your repository: it holds no GitHub token,
+installs no GitHub App, and has no access to your files, tests, fixtures, logs, prompts, or
+transcripts.
+
+What it does receive is small and bounded. From you: the text of each promise a named person on your
+team approves, the numeric ids of your repository and its GitHub owner, and the name of its default
+branch. From CI: GitHub's signed statement of which repository, workflow, and run is reporting, and
+for each promise the run checked, the pass or fail outcome, the exact commit it checked, and content
+hashes of the verifier package and its output. Hashes cannot be turned back into your code or your
+test output.
+
+The verify job in your CI runs your tests with your checkout and has no Balladeer credential. A
+separate publish job, with no checkout, sends only those outcomes and hashes.
+
+This setup creates two credentials, both of which you control. Approving in the browser lets this
+session act as you to add repositories, connect your coding agent, connect CI, and propose promises;
+it cannot approve, activate, or remove anything. That session lasts a day, each use buys it another
+day, and it is gone seven days after you approved it however much you used it. The coding agent's
+own connection has no expiry: it lets the agent read the promises your team has approved, propose
+new ones, and propose replacing, retiring, excepting, or reassigning one you already have; every one
+of those waits for a named person to decide it. It can also carry out one of those acts for you, and
+only this way: you open a Balladeer page in your own browser, read what the act is, sign it off
+there, and read back the one-time code that page gives you. That code covers that one act on that
+one thing, once, and Balladeer records you as the person who took it and the connection as the
+messenger. Without a code you signed, the connection cannot approve, activate, grant, transfer,
+retire, or delete anything. You can revoke either one at any time in Balladeer, and the setup
+session also ends on its own.
+
+Adding the workflow puts a check on pull requests into your default branch. That check is advisory
+on Balladeer's side; whether it blocks a merge is your own branch protection.
+
+## What this command sends, and what it never sends
+
+The paragraphs above are the product's boundary. This is what this particular program does on your
+machine, so you can check the two against each other.
+
+It sends: your repository as `owner/name` and this machine's short hostname, both of them so you can
+recognise your own pairing on the approval page; your repository's numeric id, its GitHub owner's
+numeric id, and the name of its default branch; whether CI should report on pushes, pull requests,
+or both; and the text of any promise you ask it to propose. Nothing else leaves the machine.
+
+It never sends: a file from your repository, a test, a fixture, a log, a prompt, a transcript, a
+diff, a commit message, a GitHub token, or anything else read out of your `gh`. The workflow it
+proposes is committed to your repository, not uploaded, and the tests it triggers run in your CI
+with your checkout and no Balladeer credential.
+
+It writes, locally and visibly: your credentials to `$XDG_CONFIG_HOME/balladeer/credentials.json`,
+or `~/.config/balladeer/credentials.json`, with mode 600 inside a directory with mode 700, and it
+refuses to write them anywhere a commit could pick them up; a `balladeer` entry in the repository's
+`.mcp.json`, added beside whatever is already there and never over the top of somebody else's entry;
+and a marker-fenced block in the repository's `CLAUDE.md` or `AGENTS.md`, replaced between the
+markers on each run and never outside them. A file whose markers are damaged is left alone and
+reported rather than appended to.
+
+It changes, on your GitHub repository and through your own `gh`: the repository variables the
+workflow reads, so the workflow file itself names no host by hand.
+
+It opens, for you to review: one branch, `balladeer/connect-ci`, carrying one workflow file, and one
+pull request from it. You read that pull request and merge it, or you do not. The check it adds to
+pull requests into your default branch is advisory on Balladeer's side; whether it blocks a merge is
+your own branch protection.
+
+## Commands
+
+| Command                  | What it does                                                                   |
+| ------------------------ | ------------------------------------------------------------------------------ |
+| `balladeer setup`        | Run all five steps, then report what a person still has to do                  |
+| `balladeer repositories` | List what this machine could add, marking the one you are in and the ones in   |
+| `balladeer invite`       | Invite teammates by email, and say per address whether the email went          |
+| `balladeer status`       | Report this repository over its agent connection, and the workspace            |
+| `balladeer status <id>`  | Report one promise: whether it is holding, and if not, what the run reported   |
+| `balladeer propose`      | Propose one promise from a proposal file, over that connection                 |
+| `balladeer discover`     | File a whole catalog, up to ten promises from one file, behind one review link |
+| `balladeer touch-map`    | Record which files each promise's verifier runs, on this machine only          |
+| `balladeer affected`     | Say which promises the files you name touch, out of that record                |
+| `balladeer mcp`          | Forward one MCP session over stdio using this repository's connection          |
+| `balladeer explain`      | What Balladeer can and cannot see, where to watch it, and what leaving costs   |
+| `balladeer whoami`       | Report the stored session's workspace, role, scopes, and expiry                |
+
+`--json` emits one object per step on stdout and nothing else. `--wait` makes `setup` poll for the
+approval instead of exiting; without it the command exits and a later run finishes the pairing.
+
+`setup --repository owner/name` takes the flag more than once. One of the repositories you name has
+to be the one you are standing in, because connecting a coding agent writes files into a working
+tree and connecting CI pushes a branch to a remote. The rest are added to the workspace and nothing
+more, and the run says so for each of them; somebody runs setup in a checkout of each one to finish
+it. `balladeer repositories` is what you read first to decide which ones to name.
+
+`invite` takes one or more addresses and `--role contributor|viewer|administrator`, defaulting to
+contributor. It goes over the setup session's `workspace:invite` grant, so it works only for a
+session an administrator approved, and it says so before sending anything rather than after. Every
+address gets its own line: sending four invitations is four things that can each be refused on their
+own.
+
+`discover` takes an object with a `promises` array, each entry shaped exactly as one `propose` file.
+Every promise in it is proposed as owned by whoever paired this machine, unless `--owner` names
+another member, and the command prints one link that opens all of them. Every entry is checked here
+before anything is sent, and one bad entry means not one of them is sent.
+
+`explain` prints the boundary explanation and touches nothing, which makes it the safe first thing
+to run from a machine you have not used this on before. It also says where to watch your promises
+once they exist, and what stopping costs: your tests are yours, they keep running, and an
+administrator can download everything Balladeer holds at any time.
+
+Exit codes: 0 progress reported truthfully, 2 pairing expired or denied or already claimed, 3 this
+copy is too old for the server, 4 usage or credential store problem, 5 transport or server failure.
+
+## Revoking
+
+Both credentials are yours to end. Revoke the setup session or the coding agent's connection at any
+time in Balladeer; the setup session also ends on its own. Removing the `balladeer` entry from
+`.mcp.json` disconnects the agent locally, and deleting the credential store leaves this machine
+with nothing of yours on it.
+
+## Licence
+
+Apache License 2.0. The full text ships in this package as `LICENSE`, so you can read the rights you
+have from the copy on your own machine rather than taking a field in a manifest on trust.

package/dist/agent.d.ts

@@ -0,0 +1,126 @@
+import { type StoredAgent } from "./store.js";
+/**
+ * The repository's own agent connection, and the one way this program talks over
+ * it.
+ *
+ * Three commands reach Balladeer with this credential rather than with the setup
+ * session: `mcp` forwards a host's frames over it, `propose` sends one tool call
+ * over it, and `status` reads this repository's setup over it. They select the
+ * same credential by the same rule and send the same frames to the same
+ * endpoint, so there is one authorization body to reason about: whatever an
+ * agent connection may do, these commands may do, and nothing else.
+ */
+export type AgentSelection = Readonly<{
+    kind: "agent";
+    agent: StoredAgent;
+}> | Readonly<{
+    kind: "refused";
+    reason: string;
+    /**
+     * The repository this machine holds no credential for, named the way the
+     * caller named it. Present on that refusal and on no other, because it is
+     * the one a person can fix by running setup here: an endpoint on the wrong
+     * origin and a directory with no remote are different failures with
+     * different remedies, and a command that answered all three with "run
+     * setup" would be sending people to repeat a step that already worked.
+     */
+    missingFor?: string;
+}>;
+/**
+ * Which stored credential a command uses, or a refusal saying why none.
+ *
+ * There are exactly two ways to be right about this, and taking whichever entry
+ * comes first is neither. Either the caller named a repository, in which case
+ * only that repository's credential will do, or it did not, in which case the
+ * only defensible answer is the credential belonging to the repository this
+ * process was started in. A machine set up for two repositories otherwise binds
+ * an agent working in one of them to the other one's promises, silently, and
+ * everything that agent then reads and proposes is about the wrong repository.
+ *
+ * The bearer is never written to stdout or stderr, and an entry whose MCP URL
+ * points somewhere other than the control plane it belongs to is refused: a
+ * server response must not be able to send this credential to a new host.
+ */
+export declare function selectAgent(agents: readonly StoredAgent[], controlPlane: string, repositoryId: string | undefined, currentRepository: string): AgentSelection;
+/**
+ * What a command says when this machine holds no credential for the repository.
+ *
+ * A credential belongs to the machine it was issued on. A repository can be
+ * connected in a browser, or from a colleague's laptop, and this machine still
+ * hold nothing: the bearer is shown once, to whoever was there. Saying
+ * "Balladeer refused this workspace, run setup to pair again" in that state sent
+ * the founder to re-pair a machine whose pairing was never the problem, and a
+ * new setup session would not have helped, because these commands do not run
+ * over one.
+ *
+ * The invocation named is the checkout form, which is the one this copy was run
+ * as: nothing here has read the server's answer about publication yet.
+ */
+export declare function noAgentCredentialSentence(repository: string): string;
+export declare function withSafeEndpoint(agent: StoredAgent): AgentSelection;
+/**
+ * The headers every frame this program sends over an agent connection carries,
+ * and the one place they are written.
+ *
+ * `accept` names both media types because the Streamable HTTP transport refuses
+ * a POST that does not: a request accepting only JSON is answered 406 by the
+ * server before any tool runs. Nothing in this repository noticed, because every
+ * test that drove the endpoint wrote its own headers rather than the ones the
+ * forwarder sends. The setup probe now sends its one real call through this same
+ * constant, so a forwarder that cannot talk to the server is a failed setup step
+ * rather than a connection reported as working.
+ *
+ * `x-balladeer-client` is what lets the server refuse a copy of this program
+ * that is too old to talk to it, and answer with the line that updates it.
+ */
+export declare function forwarderHeaders(token: string): Readonly<Record<string, string>>;
+/**
+ * What one tool call over an agent connection came back as.
+ *
+ * Every outcome the server can produce is named here, so each caller writes the
+ * sentence its own person needs rather than guessing from a status code. A tool
+ * that refused (`tool_refusal`) is the connection working and this one tool
+ * being unavailable to it; `unauthorized` is the connection itself being gone.
+ * Nothing collapses those two together, because the remedies are different and
+ * only one of them is a person's.
+ */
+export type AgentToolCall = Readonly<{
+    kind: "result";
+    structured: unknown;
+}> | Readonly<{
+    kind: "tool_refusal";
+    text: string;
+    structured: unknown;
+}> | Readonly<{
+    kind: "endpoint_refused";
+    reason: string;
+}> | Readonly<{
+    kind: "unreachable";
+}> | Readonly<{
+    kind: "client_too_old";
+    update: string;
+}> | Readonly<{
+    kind: "unauthorized";
+}> | Readonly<{
+    kind: "http";
+    status: number;
+}> | Readonly<{
+    kind: "malformed";
+}>;
+/**
+ * One JSON-RPC tool call to the endpoint the forwarder would use, with the
+ * headers the forwarder sends and the same refusal of an endpoint on another
+ * origin. Nothing here reads the bearer back out or writes it anywhere.
+ */
+export declare function callAgentTool(agent: StoredAgent, name: string, argumentsValue: Readonly<Record<string, unknown>>, timeoutMs?: number): Promise<AgentToolCall>;
+export declare function safeJson(response: Response): Promise<unknown>;
+/**
+ * The server's own remedy, read from the 426 body.
+ *
+ * Never a literal written here. Only the control plane knows whether this
+ * program is published, and a remedy naming a specifier the registry cannot
+ * serve leaves the person worse off than the refusal did.
+ */
+export declare function updateLine(payload: unknown): string;
+/** One field of a tool result, when it is a string. Never a guess. */
+export declare function structuredString(structured: unknown, field: string): string | undefined;