dsh-modellix 0.1.0

package/lib/index.d.ts

@@ -0,0 +1,1399 @@
+import z from "@deepseek-ai/schemastery";
+import { SettingsPathOp } from "@deepseek-ai/dsh-settings";
+import { WebError, WebFetchProvider, WebFetchRequest, WebFetchResult, WebSearchProvider, WebSearchRequest, WebSearchResult } from "@deepseek-ai/dsh-web";
+import { Domain } from "@deepseek-ai/dsh-storage-domain";
+import { z as z$1 } from "zod";
+import { ToolDefinition } from "@deepseek-ai/dsh-tools";
+import { Context } from "@deepseek-ai/cordis";
+import { LlmRuntime } from "@deepseek-ai/dsh-llm";
+
+//#region src/core/config.d.ts
+declare const CURRENT_CONFIG_SCHEMA_VERSION: 1;
+declare const MODELLIX_CREDENTIAL_REF: "MODELLIX_API_KEY";
+type ServiceId = "design" | "llm" | "web";
+type OnboardingStatus = "active" | "completed" | "deferred";
+type RetentionPolicy = "metadata-only";
+interface ServiceToggles {
+  readonly design: boolean;
+  readonly llm: boolean;
+  readonly web: boolean;
+}
+interface DesignConfig {
+  readonly enabled: boolean;
+  readonly retentionPolicy: RetentionPolicy;
+  readonly retentionPolicyRevision: number;
+  readonly lastModel: string | null;
+  readonly recentModels: readonly string[];
+  readonly favoriteModels: readonly string[];
+}
+interface LlmConfig {
+  readonly enabled: boolean;
+  readonly recentModels: readonly string[];
+  readonly favoriteModels: readonly string[];
+}
+interface WebConfig {
+  readonly enabled: boolean;
+}
+interface ServicesConfig {
+  readonly design: DesignConfig;
+  readonly llm: LlmConfig;
+  readonly web: WebConfig;
+}
+type OnboardingSavePhase = "credential-write-pending" | "settings-write-pending";
+/**
+ * Non-secret write-ahead state for the two-store onboarding save.
+ *
+ * The Credential store and plugin Settings store cannot be committed in one
+ * transaction. Persisting this record before calling the Credential API makes
+ * an interrupted save explicit and recoverable without retaining the candidate
+ * secret in plugin data.
+ */
+interface OnboardingSaveRecovery {
+  readonly operationId: string;
+  readonly phase: OnboardingSavePhase;
+  readonly startedAt: number;
+  readonly intendedServices: ServiceToggles;
+  readonly expectedCredentialEpoch: number;
+  readonly expectedCredentialRevision: string | null;
+  readonly confirmedCredentialRevision: string | null;
+}
+interface OnboardingConfig {
+  readonly status: OnboardingStatus;
+  readonly saveRecovery: OnboardingSaveRecovery | null;
+}
+type PersistedLlmRouteOwnership = "none" | "created" | "adopted";
+interface LlmRouteOwnershipEntry {
+  readonly kind: "field" | "model";
+  readonly key: string;
+  readonly appliedFingerprint: string;
+}
+interface LlmRouteOwnershipConfig {
+  readonly ownership: PersistedLlmRouteOwnership;
+  readonly appliedRouteFingerprint: string | null;
+  readonly entries: readonly LlmRouteOwnershipEntry[];
+}
+/** Non-secret write-ahead marker for one cross-namespace LLM materialization. */
+interface LlmMaterializationRecovery {
+  readonly operationId: string;
+  readonly startedAt: number;
+  readonly expectedLlmSettingsRevision: number;
+  /** Fingerprint of the raw user route before the CAS. Null only for legacy evidence. */
+  readonly previousRouteFingerprint: string | null;
+  /** Planned ownership, persisted before the route CAS. Null only for legacy evidence. */
+  readonly targetRouteOwnership: LlmRouteOwnershipConfig | null;
+}
+interface BeginLlmMaterializationInput {
+  readonly operationId: string;
+  readonly startedAt: number;
+  readonly expectedLlmSettingsRevision: number;
+  readonly previousRouteFingerprint: string;
+  readonly targetRouteOwnership: LlmRouteOwnershipConfig;
+}
+interface LlmOwnershipConfig {
+  readonly route: LlmRouteOwnershipConfig;
+  readonly materializationRecovery: LlmMaterializationRecovery | null;
+}
+interface PluginConfig {
+  readonly schemaVersion: typeof CURRENT_CONFIG_SCHEMA_VERSION;
+  readonly credentialRef: typeof MODELLIX_CREDENTIAL_REF;
+  /** Monotonic plugin-owned generation; never derived from Credential bytes. */
+  readonly credentialEpoch: number;
+  readonly services: ServicesConfig;
+  readonly onboarding: OnboardingConfig;
+  readonly llmOwnership: LlmOwnershipConfig;
+}
+interface BeginOnboardingSaveInput {
+  readonly operationId: string;
+  readonly startedAt: number;
+  readonly intendedServices: ServiceToggles;
+  readonly expectedCredentialRevision: string | null;
+}
+type OnboardingRecoveryAction = "none" | "await-credential-write" | "commit-intended-settings" | "needs-user-reconciliation";
+interface OnboardingRecoveryDecision {
+  readonly config: PluginConfig;
+  readonly action: OnboardingRecoveryAction;
+}
+declare class UnsupportedConfigVersionError extends Error {
+  readonly version: number;
+  constructor(version: number);
+}
+declare class OnboardingSaveConflictError extends Error {
+  constructor(message: string);
+}
+declare class LlmMaterializationConflictError extends Error {
+  constructor(message: string);
+}
+declare function createDefaultConfig(): PluginConfig;
+/**
+ * Migrates absent/legacy settings by filling missing fields without turning an
+ * explicit false toggle back on. Unknown future schema versions are rejected
+ * instead of being silently downgraded.
+ */
+declare function migrateConfig(input: unknown): PluginConfig;
+declare function getServiceToggles(config: PluginConfig): ServiceToggles;
+declare function setServiceToggles(config: PluginConfig, toggles: ServiceToggles): PluginConfig;
+declare function beginLlmMaterialization(config: PluginConfig, input: BeginLlmMaterializationInput): PluginConfig;
+declare function completeLlmMaterialization(config: PluginConfig, operationId: string): PluginConfig;
+declare function abandonLlmMaterialization(config: PluginConfig, operationId: string): PluginConfig;
+declare function beginOnboardingSave(config: PluginConfig, input: BeginOnboardingSaveInput): PluginConfig;
+/** Marks a confirmed Host Credential write without storing any Credential data. */
+declare function markOnboardingCredentialSaved(config: PluginConfig, operationId: string, confirmedCredentialRevision: string): PluginConfig;
+/**
+ * Completes the idempotent Settings half of onboarding after Credential write
+ * confirmation. Calling it again with no recovery marker is intentionally a
+ * no-op so crash recovery can safely replay the Settings commit.
+ */
+declare function completeOnboardingSave(config: PluginConfig, operationId: string): PluginConfig;
+declare function deferOnboarding(config: PluginConfig, intendedServices?: ServiceToggles): PluginConfig;
+/**
+ * Determines the safe restart action from descriptor revision only. A missing
+ * revision is deliberately ambiguous and requires user reconciliation; it is
+ * never treated as proof that a Credential write failed.
+ */
+declare function reconcileOnboardingSave(config: PluginConfig, currentCredentialRevision: string | null): OnboardingRecoveryDecision;
+declare function advanceCredentialEpoch(config: PluginConfig): PluginConfig;
+//#endregion
+//#region src/core/credential-state.d.ts
+type CredentialSource = "local" | "env" | null;
+type CredentialVerification = "unknown" | "unverified" | "valid" | "invalid";
+interface CredentialDescriptor {
+  readonly configured: boolean;
+  readonly source: CredentialSource;
+  readonly writable: boolean;
+  /** Opaque Host descriptor revision. It must never be derived from the Key. */
+  readonly revision: string | null;
+  /** Plugin-owned monotonic generation used to reject stale results. */
+  readonly credentialEpoch: number;
+}
+interface InvalidCredentialEpoch {
+  readonly credentialEpoch: number;
+  readonly openedAt: number;
+}
+interface CredentialState {
+  readonly descriptor: CredentialDescriptor;
+  readonly verification: CredentialVerification;
+  readonly invalidEpoch: InvalidCredentialEpoch | null;
+}
+interface UnauthorizedTransition {
+  readonly state: CredentialState;
+  readonly stale: boolean;
+  readonly shouldOpenModal: boolean;
+}
+interface VerificationTransition {
+  readonly state: CredentialState;
+  readonly stale: boolean;
+}
+interface CredentialMutationResult<T> {
+  readonly value: T;
+  readonly previousEpoch: number;
+  readonly credentialEpoch: number;
+}
+declare class CredentialEpochConflictError extends Error {
+  readonly expectedEpoch: number;
+  readonly actualEpoch: number;
+  constructor(expectedEpoch: number, actualEpoch: number);
+}
+declare function createCredentialState(descriptor?: CredentialDescriptor): CredentialState;
+declare function missingCredentialDescriptor(credentialEpoch: number, writable?: boolean): CredentialDescriptor;
+declare function normalizeCredentialDescriptor(descriptor: CredentialDescriptor): CredentialDescriptor;
+/**
+ * Applies a Host descriptor read. A changed revision or plugin epoch invalidates
+ * earlier verification, while a same-revision refresh preserves it.
+ */
+declare function applyCredentialDescriptor(state: CredentialState, descriptor: CredentialDescriptor): CredentialState;
+declare function applyVerificationResult(state: CredentialState, capturedCredentialEpoch: number, verification: "valid" | "invalid"): VerificationTransition;
+/**
+ * A transient validation/network failure is intentionally a no-op. It must not
+ * downgrade a previously valid Credential to invalid.
+ */
+declare function preserveVerificationAfterTransientFailure(state: CredentialState, capturedCredentialEpoch: number): VerificationTransition;
+/**
+ * Applies only an explicit customer-Credential 401. Concurrent responses from
+ * the same epoch share one invalid epoch and request one Modal at most.
+ */
+declare function applyRuntimeUnauthorized(state: CredentialState, capturedCredentialEpoch: number, occurredAt: number): UnauthorizedTransition;
+/** Candidate validation never mutates the currently stored Credential state. */
+declare function preserveStoredCredentialAfterCandidateFailure(state: CredentialState): CredentialState;
+/**
+ * Serializes Host Credential set/unset calls and performs plugin epoch CAS.
+ * The operation closure may temporarily own a candidate Key, but the
+ * coordinator never receives, records, stringifies, or exposes that value.
+ */
+declare class CredentialMutationCoordinator {
+  #private;
+  constructor(initialCredentialEpoch: number);
+  get credentialEpoch(): number;
+  run<T>(expectedCredentialEpoch: number, operation: () => Promise<T>): Promise<CredentialMutationResult<T>>;
+  /** Advances an idle coordinator after persisted crash recovery. */
+  synchronizeRecoveredEpoch(credentialEpoch: number): void;
+}
+//#endregion
+//#region src/core/errors.d.ts
+type ModellixService = "design" | "llm" | "web";
+type ModellixErrorCode = "MODELLIX_CANDIDATE_KEY_INVALID" | "MODELLIX_API_KEY_INVALID" | "MODELLIX_BILLING_BLOCKED" | "MODELLIX_POLICY_BLOCKED" | "MODELLIX_RESOURCE_NOT_FOUND" | "MODELLIX_RATE_LIMITED" | "MODELLIX_CANCELED" | "MODELLIX_OFFLINE" | "MODELLIX_TIMEOUT" | "MODELLIX_SERVER_ERROR" | "MODELLIX_BAD_REQUEST" | "MODELLIX_SUBMIT_UNKNOWN" | "MODELLIX_ASSET_EXPIRED" | "MODELLIX_UNEXPECTED_RESPONSE";
+interface ModellixErrorContext {
+  readonly service: ModellixService;
+  readonly subsystem: string;
+  readonly operation: string;
+  readonly credentialEpoch?: number;
+  readonly requestId?: string | null;
+  readonly taskId?: string | null;
+}
+type ModellixFailure = {
+  readonly kind: "http";
+  readonly status: number;
+  readonly requestId?: string | null;
+  readonly retryAfterMs?: number | null;
+} | {
+  readonly kind: "network";
+} | {
+  readonly kind: "timeout";
+} | {
+  readonly kind: "abort";
+} | {
+  readonly kind: "candidate-invalid";
+} | {
+  readonly kind: "submit-unknown";
+} | {
+  readonly kind: "asset-expired";
+} | {
+  readonly kind: "unexpected-response";
+};
+interface ModellixErrorContract {
+  readonly version: 1;
+  readonly service: ModellixService;
+  readonly subsystem: string;
+  readonly operation: string;
+  readonly code: ModellixErrorCode;
+  readonly httpStatus: number | null;
+  readonly retryable: boolean;
+  readonly credentialEpoch: number | null;
+  readonly requestId: string | null;
+  readonly taskId: string | null;
+  readonly retryAfterMs: number | null;
+  readonly messageKey: string;
+}
+declare function toModellixError(context: ModellixErrorContext, failure: ModellixFailure): ModellixErrorContract;
+declare function isCredentialInvalidError(error: ModellixErrorContract): boolean;
+declare function isRetryableError(error: ModellixErrorContract): boolean;
+//#endregion
+//#region src/core/http.d.ts
+declare const MODELLIX_ORIGINS: Readonly<{
+  prediction: "https://api.modellix.ai";
+  llm: "https://llm.modellix.ai";
+  webTools: "https://tool.modellix.ai";
+  publicSchema: "https://www.modellix.ai";
+}>;
+type ModellixOriginName = keyof typeof MODELLIX_ORIGINS;
+type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE";
+interface HttpRequestPolicyInput {
+  readonly url: string | URL;
+  readonly method: HttpMethod;
+  readonly hasAuthorization: boolean;
+}
+interface ApprovedHttpRequest {
+  readonly url: URL;
+  readonly originName: ModellixOriginName;
+  readonly method: HttpMethod;
+  readonly authorizationAllowed: boolean;
+}
+interface RequestDeadline {
+  readonly signal: AbortSignal;
+  readonly timedOut: () => boolean;
+}
+/** Combines a caller cancellation signal with an operation-owned deadline. */
+declare function requestDeadline(callerSignal: AbortSignal | undefined, timeoutMs: number): RequestDeadline;
+declare class HttpPolicyError extends Error {
+  readonly code: "INVALID_URL" | "ORIGIN_NOT_ALLOWED" | "USERINFO_NOT_ALLOWED" | "FRAGMENT_NOT_ALLOWED" | "AUTHORIZATION_NOT_ALLOWED" | "METHOD_NOT_ALLOWED" | "REDIRECT_NOT_ALLOWED";
+  constructor(code: HttpPolicyError["code"], message: string);
+}
+declare class HttpResponseBoundaryError extends Error {
+  readonly code: "BODY_MISSING" | "BODY_TOO_LARGE" | "INVALID_ENCODING" | "INVALID_JSON";
+  constructor(code: HttpResponseBoundaryError["code"], message: string, options?: ErrorOptions);
+}
+/** Reads a response incrementally so a hostile Content-Length cannot allocate an unbounded body. */
+declare function readBoundedResponseText(response: Response, maximumBytes: number, signal?: AbortSignal): Promise<string>;
+declare function readBoundedResponseJson(response: Response, maximumBytes: number, signal?: AbortSignal): Promise<unknown>;
+/**
+ * Applies the shared origin boundary. Model-specific endpoint/path validation is
+ * intentionally an additional Design-layer policy and must run before submit.
+ */
+declare function approveHttpRequest(input: HttpRequestPolicyInput): ApprovedHttpRequest;
+/**
+ * Redirects are manual and same-origin only. This remains true for public
+ * no-credential GETs so an upstream response cannot widen the allowlist.
+ */
+declare function approveRedirect(from: string | URL, to: string | URL, request: Pick<HttpRequestPolicyInput, "method" | "hasAuthorization">): ApprovedHttpRequest;
+declare function isAllowedModellixOrigin(value: string | URL): boolean;
+/**
+ * Rejects literal private/reserved addresses and local-only DNS suffixes at a
+ * trust boundary. Remote fetch services must still repeat this check after DNS
+ * resolution and for every redirect to prevent DNS rebinding.
+ */
+declare function isPublicHostname(value: string): boolean;
+interface HttpRetryFailure {
+  readonly kind: "network" | "http" | "abort";
+  readonly status?: number;
+  readonly retryAfterMs?: number | null;
+}
+interface RetryOptions<E> {
+  readonly method: HttpMethod;
+  readonly maxRetries: number;
+  readonly baseDelayMs?: number;
+  readonly maxDelayMs?: number;
+  readonly jitterRatio?: number;
+  readonly shouldRetry: (error: E) => boolean;
+  readonly retryAfterMs?: (error: E) => number | null;
+  readonly sleep?: (delayMs: number) => Promise<void>;
+  readonly random?: () => number;
+}
+interface RetrySuccess<T> {
+  readonly value: T;
+  readonly attempts: number;
+}
+/**
+ * Generic bounded retry executor. Unsafe methods are structurally prevented
+ * from receiving retries; callers must perform a new explicit user action.
+ */
+declare function executeWithRetry<T, E = unknown>(operation: (attempt: number) => Promise<T>, options: RetryOptions<E>): Promise<RetrySuccess<T>>;
+declare function isRetryableReadFailure(failure: HttpRetryFailure): boolean;
+declare function retryAfterFromFailure(failure: HttpRetryFailure): number | null;
+interface RetryDelayInput {
+  readonly retryIndex: number;
+  readonly baseDelayMs: number;
+  readonly maxDelayMs: number;
+  readonly jitterRatio: number;
+  readonly retryAfterMs: number | null;
+  /** A deterministic value in [0, 1], injectable for tests. */
+  readonly random: number;
+}
+declare function computeRetryDelay(input: RetryDelayInput): number;
+/** Supports Retry-After delta-seconds and IMF-fixdate. */
+declare function parseRetryAfter(value: string | null | undefined, nowMs: number, maximumMs?: number): number | null;
+//#endregion
+//#region src/core/identity.d.ts
+declare function deriveModellixUserId(harnessAnonymousId: string): string;
+declare function deriveModellixSessionId(harnessSessionId: string): string;
+declare function isValidModellixIdentity(value: string): boolean;
+//#endregion
+//#region src/core/redaction.d.ts
+declare const REDACTED: "[REDACTED]";
+type HeaderValue = string | readonly string[] | undefined;
+type HeaderRecord = Readonly<Record<string, HeaderValue>>;
+type RedactedValue = null | boolean | number | string | readonly RedactedValue[] | {
+  readonly [key: string]: RedactedValue;
+};
+declare function redactHeaders(headers: HeaderRecord): Record<string, string | string[]>;
+/** Removes the complete query and fragment; signed media URLs are never logged. */
+declare function redactUrl(value: string | URL): string;
+/**
+ * Produces bounded log metadata. Secret-shaped fields are removed by name,
+ * URL queries are stripped, Error messages/stacks are never copied, and cycles
+ * are represented without traversing indefinitely.
+ */
+declare function redactForLog(value: unknown, options?: {
+  readonly maxDepth?: number;
+  readonly maxEntries?: number;
+}): RedactedValue;
+//#endregion
+//#region src/design/ports.d.ts
+type FetchPort = (input: string | URL, init?: RequestInit) => Promise<Response>;
+interface ClockPort {
+  now(): number;
+}
+interface SleepPort {
+  sleep(delayMs: number): Promise<void>;
+}
+interface CacheEntry<T> {
+  readonly value: T;
+  readonly expiresAt: number;
+}
+interface CachePort {
+  read<T>(key: string): Promise<CacheEntry<T> | null>;
+  write<T>(key: string, entry: CacheEntry<T>): Promise<void>;
+}
+interface StoragePort {
+  read(key: string): Promise<string | null>;
+  write(key: string, value: string): Promise<void>;
+}
+type DesignLogLevel = "info" | "warn";
+/**
+ * Design modules only emit bounded identifiers and counters. Request bodies,
+ * prompts, API keys, signed resource URLs, and thrown Error objects are never
+ * part of this contract.
+ */
+interface DesignLogEvent {
+  readonly level: DesignLogLevel;
+  readonly event: string;
+  readonly operation: string;
+  readonly status?: number;
+  readonly attempt?: number;
+  readonly taskId?: string;
+  readonly requestId?: string;
+  readonly model?: string;
+}
+interface LoggerPort {
+  write(event: DesignLogEvent): void;
+}
+declare const systemClock: ClockPort;
+declare const systemSleep: SleepPort;
+//#endregion
+//#region src/design/catalog.d.ts
+declare const AUTHENTICATED_CATALOG_URL = "https://api.modellix.ai/api/v1/models";
+declare const PUBLIC_PORTAL_CATALOG_URL = "https://www.modellix.ai/portal/v1/models";
+type DesignMediaCategory = "image" | "video" | "audio";
+interface ModelCatalogQuery {
+  readonly category: DesignMediaCategory;
+  readonly page?: number;
+  readonly pageSize?: number;
+  readonly featured?: boolean;
+}
+interface DesignModelSummary {
+  readonly provider: string;
+  readonly modelId: string;
+  readonly slug: string;
+  readonly displayName: string;
+  readonly categories: readonly DesignMediaCategory[];
+  readonly description?: string;
+  readonly thumbnailUrl?: string;
+}
+interface ModelCatalogPage {
+  readonly items: readonly DesignModelSummary[];
+  readonly page: number;
+  readonly pageSize: number;
+  readonly total: number | null;
+  readonly hasMore: boolean;
+  readonly source: "authenticated-api" | "public-portal";
+}
+interface ModelCatalogClientOptions {
+  readonly fetch: FetchPort;
+  /** Resolved for each uncached primary request so credential rotation is seen. */
+  readonly getApiKey?: () => string | null | Promise<string | null>;
+  /** Public no-credential fallback is disabled unless explicitly enabled. */
+  readonly allowPublicPortalFallback?: boolean;
+  readonly cache?: CachePort;
+  readonly cacheTtlMs?: number;
+  readonly clock?: ClockPort;
+  readonly requestTimeoutMs?: number;
+}
+declare class ModelCatalogClient {
+  #private;
+  constructor(options: ModelCatalogClientOptions);
+  list(query: ModelCatalogQuery, signal?: AbortSignal): Promise<ModelCatalogPage>;
+}
+declare function parseCatalogPage(payload: unknown, query: Required<Pick<ModelCatalogQuery, "category" | "page" | "pageSize">>, source: ModelCatalogPage["source"]): ModelCatalogPage;
+//#endregion
+//#region src/design/errors.d.ts
+type DesignErrorCode = "INVALID_ARGUMENT" | "MISSING_API_KEY" | "CATALOG_UNAVAILABLE" | "SCHEMA_UNAVAILABLE" | "SCHEMA_INVALID" | "ENDPOINT_NOT_ALLOWED" | "PARAMETER_INVALID" | "SUBMIT_REJECTED" | "SUBMIT_UNKNOWN" | "TASK_READ_FAILED" | "UNEXPECTED_RESPONSE" | "STORAGE_INVALID" | "PLANNER_UNAUTHORIZED" | "PLANNER_BILLING_BLOCKED" | "PLANNER_FORBIDDEN" | "PLANNER_RATE_LIMITED" | "PLANNER_REJECTED" | "PLANNER_UNAVAILABLE" | "PLANNER_TIMEOUT" | "PLANNER_ABORTED" | "PLANNER_RESPONSE_INVALID";
+declare class DesignError extends Error {
+  readonly code: DesignErrorCode;
+  readonly status: number | null;
+  readonly retryAfterMs: number | null;
+  constructor(code: DesignErrorCode, message: string, options?: {
+    readonly status?: number;
+    readonly retryAfterMs?: number | null;
+    readonly cause?: unknown;
+  });
+}
+//#endregion
+//#region src/design/model-schema.d.ts
+interface ModelSchemaDocument {
+  readonly provider: string;
+  readonly modelId: string;
+  readonly source: "public-api-schema" | "portal-detail";
+  readonly document: Readonly<Record<string, unknown>>;
+  /** Null for portal metadata because it is not authoritative for submission. */
+  readonly submitUrl: string | null;
+}
+interface ModelSchemaClientOptions {
+  readonly fetch: FetchPort;
+  readonly allowPortalDetailFallback?: boolean;
+  readonly requestTimeoutMs?: number;
+}
+declare class ModelSchemaClient {
+  #private;
+  constructor(options: ModelSchemaClientOptions);
+  load(provider: string, modelId: string, signal?: AbortSignal): Promise<ModelSchemaDocument>;
+}
+/**
+ * Submission is allowed only for the exact endpoint published by api_schema.
+ * The path is independently bound to the requested provider/model and aliases
+ * such as `/async`, query strings, fragments, userinfo, and redirects fail shut.
+ */
+declare function extractAllowedSubmitUrl(document: Readonly<Record<string, unknown>>, provider: string, modelId: string): string;
+//#endregion
+//#region src/design/schema-ir.d.ts
+type JsonPrimitive = null | boolean | number | string;
+type JsonValue = JsonPrimitive | readonly JsonValue[] | {
+  readonly [key: string]: JsonValue;
+};
+type UiFieldKind = "string" | "number" | "integer" | "boolean" | "object" | "array" | "media" | "unknown";
+type UiMediaKind = "image" | "video" | "audio";
+interface UiConstraints {
+  readonly minimum: number | null;
+  readonly maximum: number | null;
+  readonly exclusiveMinimum: number | null;
+  readonly exclusiveMaximum: number | null;
+  readonly minLength: number | null;
+  readonly maxLength: number | null;
+  readonly minItems: number | null;
+  readonly maxItems: number | null;
+  readonly pattern: string | null;
+}
+interface UiVariant {
+  readonly combinator: "oneOf" | "anyOf";
+  readonly title: string;
+  readonly field: UiField;
+}
+interface UiField {
+  /** RFC 6901 pointer relative to the JSON request body. */
+  readonly path: string;
+  readonly key: string;
+  readonly title: string;
+  readonly description: string | null;
+  readonly kind: UiFieldKind;
+  readonly required: boolean;
+  readonly nullable: boolean;
+  readonly hasDefault: boolean;
+  readonly defaultValue: JsonValue | undefined;
+  readonly enumValues: readonly JsonValue[];
+  readonly hasConst: boolean;
+  readonly constValue: JsonValue | undefined;
+  readonly constraints: UiConstraints;
+  readonly mediaKind: UiMediaKind | null;
+  readonly properties: readonly UiField[];
+  readonly item: UiField | null;
+  readonly variants: readonly UiVariant[];
+}
+interface SchemaDiagnostic {
+  readonly code: "BODY_NOT_FOUND" | "MULTIPLE_POST_OPERATIONS" | "REF_INVALID" | "REF_NOT_FOUND" | "REF_CYCLE" | "BUDGET_EXCEEDED" | "SCHEMA_CONFLICT" | "UNSUPPORTED_KEYWORD" | "INVALID_KEYWORD";
+  readonly path: string;
+  readonly keyword: string | null;
+  readonly blocking: boolean;
+  readonly message: string;
+}
+interface DesignSchemaIR {
+  readonly version: 1;
+  readonly method: "POST";
+  readonly operationPath: string | null;
+  readonly fields: readonly UiField[];
+  readonly primaryPromptPath: string | null;
+  readonly schemaHash: string;
+  readonly diagnostics: readonly SchemaDiagnostic[];
+  readonly supported: boolean;
+}
+interface SchemaParserLimits {
+  readonly maxBytes?: number;
+  readonly maxDepth?: number;
+  readonly maxNodes?: number;
+  readonly maxRefDepth?: number;
+}
+declare function parseDesignSchema(input: unknown, limits?: SchemaParserLimits): DesignSchemaIR;
+//#endregion
+//#region src/design/parameter-planner.d.ts
+interface ExactParameterPatch {
+  readonly set?: Readonly<Record<string, unknown>>;
+  readonly unset?: readonly string[];
+}
+interface NaturalLanguagePlan {
+  readonly parameters: Readonly<Record<string, JsonValue>>;
+  readonly appliedPaths: readonly string[];
+  readonly ignoredAssignments: readonly string[];
+}
+/** Materializes only schema-declared defaults/const values and required objects. */
+declare function materializeDefaults(schema: DesignSchemaIR): Record<string, JsonValue>;
+/**
+ * Applies exact RFC 6901 field paths. Unknown paths and invalid values fail
+ * closed; no field names are synthesized from the patch.
+ */
+declare function applyExactPatch(schema: DesignSchemaIR, current: Readonly<Record<string, JsonValue>>, patch: ExactParameterPatch): Record<string, JsonValue>;
+/**
+ * Natural language is deliberately conservative: plain text updates only the
+ * primary prompt, while other fields require an exact `field=value` or
+ * `field: value` assignment separated by a newline or semicolon.
+ */
+declare function applyNaturalLanguage(schema: DesignSchemaIR, current: Readonly<Record<string, JsonValue>>, instruction: string): NaturalLanguagePlan;
+/**
+ * Builds the paid-call JSON body from schema defaults plus caller values and
+ * verifies every required/nested field immediately before submission.
+ */
+declare function buildInvocationBody(schema: DesignSchemaIR, values?: Readonly<Record<string, unknown>>): Record<string, JsonValue>;
+//#endregion
+//#region src/design/planner-client.d.ts
+declare const DESIGN_PLANNER_ENDPOINT = "https://llm.modellix.ai/v1/chat/completions";
+declare const DESIGN_PLANNER_MODEL = "openai/gpt-5.6-luna";
+interface DesignPlannerRequest {
+  readonly apiKey: string;
+  readonly schema: DesignSchemaIR;
+  readonly current: Readonly<Record<string, JsonValue>>;
+  readonly instruction: string;
+  readonly signal?: AbortSignal;
+}
+interface DesignPlannerResult {
+  readonly patch: ExactParameterPatch;
+  readonly parameters: Readonly<Record<string, JsonValue>>;
+  readonly needsClarification: string | null;
+}
+interface DesignPlannerClientOptions {
+  readonly fetch?: FetchPort;
+}
+/**
+ * Executes one explicitly requested, non-streaming Host-only LLM plan. The
+ * response is untrusted until every path and value passes applyExactPatch.
+ */
+declare class DesignPlannerClient {
+  #private;
+  constructor(options?: DesignPlannerClientOptions);
+  plan(request: DesignPlannerRequest): Promise<DesignPlannerResult>;
+}
+//#endregion
+//#region src/design/prediction-client.d.ts
+type PredictionTaskStatus = "queued" | "running" | "succeeded" | "failed" | "canceled" | "unknown";
+interface PredictionResource {
+  readonly kind: "image" | "video" | "audio";
+  readonly url: string;
+  readonly mimeType: string | null;
+  readonly expiresAt: number | null;
+}
+interface PredictionTask {
+  readonly taskId: string;
+  readonly status: PredictionTaskStatus;
+  readonly resources: readonly PredictionResource[];
+  readonly createdAt: number | null;
+  readonly completedAt: number | null;
+  readonly expiresAt: number | null;
+}
+interface PredictionClientOptions {
+  readonly fetch: FetchPort;
+  readonly clock?: ClockPort;
+  readonly sleep?: SleepPort;
+  readonly logger?: LoggerPort;
+  readonly requestTimeoutMs?: number;
+}
+interface SubmitPredictionInput {
+  /** Authoritative servers[0].url returned by the public api_schema. */
+  readonly endpoint: string;
+  /** Used only to bind endpoint path; it is never used to construct the URL. */
+  readonly modelSlug: string;
+  readonly apiKey: string;
+  readonly body: Readonly<Record<string, JsonValue>>;
+  readonly requestId?: string;
+  readonly signal?: AbortSignal;
+}
+interface ReadPredictionInput {
+  readonly taskId: string;
+  readonly apiKey: string;
+  readonly maxAttempts?: number;
+  readonly signal?: AbortSignal;
+}
+declare class PredictionClient {
+  #private;
+  constructor(options: PredictionClientOptions);
+  /** A paid POST is attempted exactly once and never follows redirects. */
+  submit(input: SubmitPredictionInput): Promise<PredictionTask>;
+  /** GET retries only transient read failures and is capped at five attempts. */
+  readTask(input: ReadPredictionInput): Promise<PredictionTask>;
+}
+declare function validateSubmitEndpoint(endpoint: string, modelSlug: string): URL;
+declare function parsePredictionTask(payload: unknown, expectedTaskId?: string): PredictionTask | null;
+declare function parseResources(value: unknown, inheritedExpiresAt?: number | null): PredictionResource[];
+//#endregion
+//#region src/design/task-wal.d.ts
+declare const DEFAULT_RESULT_TTL_MS: number;
+declare const DEFAULT_DESIGN_WAL_KEY = "modellix.design.task-wal.v1";
+type DesignTaskState = "submitting" | "submit-unknown" | PredictionTaskStatus;
+interface DesignTaskRecord {
+  readonly requestId: string;
+  readonly modelSlug: string;
+  /** Credential generation that created the remote task; null only for legacy v1 records. */
+  readonly credentialEpoch: number | null;
+  readonly taskId: string | null;
+  readonly state: DesignTaskState;
+  readonly createdAt: number;
+  readonly updatedAt: number;
+  readonly completedAt: number | null;
+  readonly expiresAt: number | null;
+  readonly resources: readonly PredictionResource[];
+  readonly pollAttempt: number;
+  readonly nextPollAt: number;
+  readonly pollBlocked: boolean;
+  readonly pollDiagnostic: DesignPollDiagnosticCode | null;
+}
+type DesignPollDiagnosticCode = "credential-rejected" | "task-inaccessible" | "rate-limited" | "poll-unavailable" | "response-invalid";
+interface AvailableDesignResult {
+  readonly requestId: string;
+  readonly taskId: string;
+  readonly modelSlug: string;
+  readonly kind: PredictionResource["kind"];
+  readonly url: string;
+  readonly mimeType: string | null;
+  readonly createdAt: number;
+  readonly expiresAt: number;
+}
+type DesignWalEvent = {
+  readonly type: "submit-intent";
+  readonly sequence: number;
+  readonly timestamp: number;
+  readonly requestId: string;
+  readonly modelSlug: string; /** Optional only so pre-0.1.0 WAL documents fail safe instead of becoming unreadable. */
+  readonly credentialEpoch?: number;
+} | {
+  readonly type: "submit-unknown";
+  readonly sequence: number;
+  readonly timestamp: number;
+  readonly requestId: string;
+} | {
+  readonly type: "submit-rejected";
+  readonly sequence: number;
+  readonly timestamp: number;
+  readonly requestId: string;
+} | {
+  readonly type: "submit-accepted";
+  readonly sequence: number;
+  readonly timestamp: number;
+  readonly requestId: string;
+  readonly task: PredictionTask;
+} | {
+  readonly type: "task-observed";
+  readonly sequence: number;
+  readonly timestamp: number;
+  readonly task: PredictionTask;
+} | {
+  readonly type: "task-poll-failed";
+  readonly sequence: number;
+  readonly timestamp: number;
+  readonly taskId: string;
+  readonly attempt: number;
+  readonly nextPollAt: number;
+  readonly blocked: boolean;
+  readonly code: DesignPollDiagnosticCode;
+};
+interface DesignTaskRepositoryOptions {
+  readonly storage: StoragePort;
+  readonly clock?: ClockPort;
+  readonly key?: string;
+  readonly maxEvents?: number;
+  readonly maxBytes?: number;
+}
+/**
+ * Append-only logical WAL. Its closed event types intentionally have no place
+ * for API keys or prompts; only replay identifiers, task state, and result URLs
+ * can be persisted.
+ */
+declare class DesignTaskRepository {
+  #private;
+  constructor(options: DesignTaskRepositoryOptions);
+  recordSubmitIntent(requestId: string, modelSlug: string, credentialEpoch: number): Promise<void>;
+  markSubmitUnknown(requestId: string): Promise<void>;
+  markSubmitRejected(requestId: string): Promise<void>;
+  recordSubmitAccepted(requestId: string, task: PredictionTask): Promise<void>;
+  recordTaskObserved(task: PredictionTask): Promise<void>;
+  recordPollFailure(taskId: string, failure: {
+    readonly attempt: number;
+    readonly nextPollAt: number;
+    readonly blocked: boolean;
+    readonly code: DesignPollDiagnosticCode;
+  }): Promise<void>;
+  listTasks(): Promise<readonly DesignTaskRecord[]>;
+  listAvailableResults(): Promise<readonly AvailableDesignResult[]>;
+}
+declare function replayDesignWal(events: readonly DesignWalEvent[]): readonly DesignTaskRecord[];
+declare function selectAvailableResults(records: readonly DesignTaskRecord[], nowMs: number): readonly AvailableDesignResult[];
+//#endregion
+//#region src/host/credential-broker.d.ts
+interface HarnessCredentialInfo {
+  readonly configured: boolean;
+  readonly source?: string;
+  readonly writable: boolean;
+}
+interface HarnessCredentialPort {
+  resolve(ref: string): Promise<{
+    readonly value: string;
+    readonly source: string;
+  } | undefined>;
+  describe(ref: string): Promise<HarnessCredentialInfo>;
+  set(ref: string, value: string): Promise<void>;
+  unset(ref: string): Promise<void>;
+}
+declare class CredentialValidationError extends Error {
+  readonly contract: ModellixErrorContract;
+  constructor(contract: ModellixErrorContract);
+}
+interface CredentialBrokerOptions {
+  readonly credentials: HarnessCredentialPort;
+  readonly initialCredentialEpoch: number;
+  readonly fetch?: typeof fetch;
+  readonly now?: () => number;
+  readonly requestTimeoutMs?: number;
+}
+/** Host-only owner of candidate validation and serialized Credential writes. */
+declare class CredentialBroker {
+  #private;
+  constructor(options: CredentialBrokerOptions);
+  get credentialEpoch(): number;
+  describe(): Promise<CredentialDescriptor>;
+  resolve(): Promise<{
+    readonly value: string;
+    readonly credentialEpoch: number;
+  } | undefined>;
+  validateCandidate(candidate: string, signal?: AbortSignal): Promise<void>;
+  set(candidate: string, expectedCredentialEpoch: number): Promise<CredentialMutationResult<void>>;
+  unset(expectedCredentialEpoch: number): Promise<CredentialMutationResult<void>>;
+  synchronizeRecoveredEpoch(credentialEpoch: number): void;
+}
+//#endregion
+//#region src/shared/design-presentation-codes.d.ts
+declare const DESIGN_NOTICE_CODES: readonly ["schema-unavailable", "schema-invalid", "catalog-stale", "catalog-unavailable", "credential-reloaded"];
+type DesignNoticeCode = (typeof DESIGN_NOTICE_CODES)[number];
+declare const DESIGN_MODEL_UNAVAILABLE_CODES: readonly ["removed-from-catalog"];
+type DesignModelUnavailableCode = (typeof DESIGN_MODEL_UNAVAILABLE_CODES)[number];
+declare const DESIGN_FIELD_DISABLED_CODES: readonly ["unsupported-schema-field"];
+type DesignFieldDisabledCode = (typeof DESIGN_FIELD_DISABLED_CODES)[number];
+declare const DESIGN_DIAGNOSTIC_CODES: readonly ["credential-changed", "submit-unknown", "generation-failed", "result-unavailable", "credential-rejected", "task-inaccessible", "rate-limited", "response-invalid", "poll-unavailable"];
+type DesignDiagnosticCode = (typeof DESIGN_DIAGNOSTIC_CODES)[number];
+//#endregion
+//#region src/host/design-controller.d.ts
+interface CredentialSnapshot {
+  readonly value: string;
+  readonly credentialEpoch: number;
+}
+interface DesignHostControllerOptions {
+  readonly storage: StoragePort;
+  readonly resolveCredential: () => Promise<CredentialSnapshot | undefined>;
+  readonly isCredentialEpochCurrent: (credentialEpoch: number) => boolean;
+  readonly onUnauthorized: (credentialEpoch: number) => void | Promise<void>;
+  readonly isEnabled: () => boolean;
+  readonly getLastModel: () => string | null;
+  readonly rememberModel: (modelId: string) => Promise<void>;
+  readonly fetch?: typeof fetch;
+  readonly now?: () => number;
+}
+interface DesignModelWire {
+  readonly id: string;
+  readonly label: string;
+  readonly kind: "image" | "video" | "audio" | "unknown";
+  readonly featured: boolean;
+  readonly available: boolean;
+  readonly unavailableReason: DesignModelUnavailableCode | null;
+}
+interface DesignFieldWire {
+  readonly path: string;
+  readonly label: string;
+  readonly description: string | null;
+  readonly kind: "string" | "number" | "integer" | "boolean" | "enum" | "array" | "object" | "media";
+  readonly widget: "input" | "textarea" | "select" | "switch" | "json" | "media";
+  readonly required: boolean;
+  readonly options: readonly {
+    readonly label: string;
+    readonly value: string | number | boolean;
+  }[];
+  readonly minimum: number | null;
+  readonly maximum: number | null;
+  readonly step: number | null;
+  readonly maxLength: number | null;
+  readonly disabledReason: DesignFieldDisabledCode | null;
+}
+interface DesignProposalChangeWire {
+  readonly path: string;
+  readonly label: string;
+  readonly before?: JsonValue;
+  readonly after?: JsonValue;
+}
+interface DesignProposalWire {
+  readonly proposalId: string;
+  readonly baseDraftRevision: number;
+  readonly summary: string;
+  readonly changes: readonly DesignProposalChangeWire[];
+  readonly conflicts: readonly string[];
+}
+interface DesignSnapshotWire {
+  readonly version: 1;
+  readonly enabled: boolean;
+  readonly credentialReady: boolean;
+  readonly models: readonly DesignModelWire[];
+  readonly selectedModelId: string | null;
+  readonly draft: {
+    readonly modelId: string;
+    readonly draftRevision: number;
+    readonly irContractHash: string;
+    readonly primaryInputPath: string;
+    readonly fields: readonly DesignFieldWire[];
+    readonly parameters: Readonly<Record<string, JsonValue>>;
+  } | null;
+  readonly proposal: DesignProposalWire | null;
+  readonly jobs: readonly {
+    readonly jobId: string;
+    readonly modelId: string;
+    readonly status: "running" | "succeeded" | "failed" | "canceled" | "submit-unknown" | "expired";
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly resources: readonly {
+      readonly id: string;
+      readonly kind: "image" | "video" | "audio";
+      readonly url: string;
+      readonly downloadUrl: string;
+      readonly expiresAt: string | null;
+    }[];
+    readonly diagnostic: {
+      readonly code: DesignDiagnosticCode;
+      readonly retryable: boolean;
+    } | null;
+  }[];
+  readonly notice: DesignNoticeCode | null;
+}
+/** Stateful Host facade over pure Design contracts; no Secret crosses its wire. */
+declare class DesignHostController {
+  #private;
+  constructor(options: DesignHostControllerOptions);
+  handle(endpoint: string, payload: unknown, signal?: AbortSignal): Promise<DesignSnapshotWire>;
+  pollRunning(signal?: AbortSignal): Promise<boolean>;
+  private read;
+  private refresh;
+  private selectModel;
+  private propose;
+  private proposeOnce;
+  private applyProposal;
+  private rejectProposal;
+  private submit;
+}
+//#endregion
+//#region src/host/design-storage.d.ts
+/** One atomic singleton keeps the Design WAL independent of Settings. */
+declare const modellixDesignDomainSpec: {
+  name: string;
+  version: number;
+  global: {
+    schema: z$1.ZodObject<{
+      version: z$1.ZodLiteral<1>;
+      values: z$1.ZodRecord<z$1.ZodString, z$1.ZodString>;
+    }, z$1.core.$strip>;
+    initial: {
+      version: 1;
+      values: Record<string, string>;
+    };
+  };
+  tables: {};
+};
+type ModellixDesignDomain = Domain<typeof modellixDesignDomainSpec>;
+declare function openDesignStorage(ctx: Context): Promise<{
+  readonly domain: ModellixDesignDomain;
+  readonly storage: StoragePort;
+}>;
+//#endregion
+//#region src/host/design-tool.d.ts
+declare const MODELLIX_DESIGN_MODELS_TOOL = "modellix_design_models";
+declare const MODELLIX_DESIGN_PREPARE_TOOL = "modellix_design_prepare";
+declare const MODELLIX_DESIGN_GENERATE_TOOL = "modellix_design_generate";
+declare const MODELLIX_DESIGN_TASK_TOOL = "modellix_design_task";
+/** The deliberately narrow Host seam used by model-facing Design tools. */
+interface DesignToolController {
+  handle(endpoint: string, payload: unknown, signal?: AbortSignal): Promise<DesignSnapshotWire>;
+}
+/**
+ * Build the four stable, namespaced Modellix Design tools. The caller owns
+ * visibility and must only register these definitions while Design is enabled.
+ */
+declare function createModellixDesignToolDefinitions(controller: DesignToolController): readonly ToolDefinition[];
+/**
+ * Register Design tools plus explicit LLM-proposal and paid-generate approval gates. The returned
+ * disposer removes both definitions and the gate, allowing the runtime to
+ * mirror the live Design toggle without leaving model-visible stale tools.
+ */
+declare function registerModellixDesignTools(ctx: Context, controller: DesignToolController): () => void;
+//#endregion
+//#region src/host/runtime.d.ts
+interface ModellixRuntimeState {
+  readonly version: 1;
+  readonly settingsRevision: number;
+  readonly services: ServiceToggles;
+  readonly credential: CredentialDescriptor & {
+    readonly verification: CredentialState["verification"];
+    readonly invalidEpoch: number | null;
+  };
+  readonly onboarding: {
+    readonly status: PluginConfig["onboarding"]["status"];
+    readonly recoveryPending: boolean; /** Non-secret, process-local token for the latest explicit capability recovery request. */
+    readonly recoveryRequestId: string | null;
+  };
+  readonly llm: {
+    readonly health: "unknown" | "ready" | "missing" | "disabled" | "error" | "policy-blocked";
+    readonly modelCount: number;
+    readonly refreshedAt: number | null;
+  };
+}
+/** Host composition root; every Secret-bearing operation terminates here. */
+declare class ModellixRuntime {
+  #private;
+  static create(ctx: Context): Promise<ModellixRuntime>;
+  private constructor();
+  private initialize;
+  private handleRpc;
+  private state;
+  private saveCredential;
+  private removeCredential;
+  private defer;
+  private updateToggles;
+  private refreshLlmRpc;
+  private reconcileLiveSettings;
+  private refreshLlm;
+  private rollbackLlmMaterialization;
+  private compensateLlmMaterialization;
+  private observeLlmOwnershipCommit;
+  private abandonPendingLlmMaterialization;
+  private reconcileInterruptedLlmMaterialization;
+  private recordLlmRecoveryDiagnostic;
+  private clearLlmProvenanceBestEffort;
+  /**
+   * Finish an interrupted remove or an out-of-process Credential deletion.
+   * An in-process caller supplies the exact confirmed Broker mutation epoch;
+   * otherwise completed onboarding is the non-secret evidence that one
+   * Credential generation disappeared while this process was offline.
+   */
+  private reconcileMissingCredentialState;
+  private enqueueWrite;
+  private credentialIsUsable;
+  private requestCredentialRecovery;
+  private clearCredentialRecoveryRequest;
+  /** Coalesces concurrent 401s while explicit later capability calls get a fresh token. */
+  private markCredentialRejected;
+  private resolveUsableCredential;
+  private enqueueDesignWrite;
+  private rememberDesignModel;
+  private syncDesignTools;
+  private scheduleDesignPoll;
+}
+//#endregion
+//#region src/host/settings.d.ts
+declare const MODELLIX_SETTINGS_NAMESPACE: "modellix";
+/** Serializable non-secret section. Host reads still pass through migrateConfig. */
+declare const PluginSettingsSchema: z<PluginConfig>;
+interface SettingsScopeLike {
+  get(): PluginConfig;
+  watch(callback: (next: PluginConfig, previous: PluginConfig) => void | Promise<void>): () => void;
+}
+interface SettingsServiceLike {
+  register<T>(namespace: string, schema: z<T>, options: {
+    readonly base: Partial<T>;
+    readonly applies: "live";
+  }): SettingsScopeLike;
+  describe(options?: {
+    readonly redactSecrets?: boolean;
+  }): readonly {
+    readonly ns: string;
+    readonly revision: number;
+    readonly user?: unknown;
+  }[];
+  mutate(namespace: string, operations: readonly SettingsPathOp[], expectedRevision?: number): Promise<void>;
+}
+interface PluginSettingsSnapshot {
+  readonly config: PluginConfig;
+  readonly revision: number;
+}
+/** Small CAS facade that always returns migrated, detached plugin settings. */
+declare class PluginSettingsController {
+  #private;
+  constructor(settings: SettingsServiceLike);
+  read(): PluginSettingsSnapshot;
+  replace(config: PluginConfig, expectedRevision?: number): Promise<void>;
+  watch(callback: (next: PluginConfig, previous: PluginConfig) => void | Promise<void>): () => void;
+}
+//#endregion
+//#region src/llm/catalog.d.ts
+declare const MODELLIX_LLM_BASE_URL: "https://llm.modellix.ai/v1";
+declare const MODELLIX_LLM_MODELS_URL: "https://llm.modellix.ai/v1/models";
+interface LlmCredentialSnapshot {
+  readonly value: string;
+  readonly credentialEpoch: number;
+}
+interface ModellixLlmModel {
+  readonly id: string;
+  readonly name?: string;
+}
+interface ModellixLlmCatalog {
+  readonly models: readonly ModellixLlmModel[];
+  readonly credentialEpoch: number;
+  readonly fetchedAt: number;
+}
+interface LlmCatalogClientOptions {
+  readonly resolveCredential: () => Promise<LlmCredentialSnapshot | undefined>;
+  readonly fetch?: typeof fetch;
+  readonly now?: () => number;
+  readonly maxResponseBytes?: number;
+  readonly requestTimeoutMs?: number;
+}
+declare class LlmCatalogRequestError extends Error {
+  readonly contract: ModellixErrorContract;
+  constructor(contract: ModellixErrorContract);
+}
+declare class StaleLlmCatalogError extends Error {
+  readonly expectedCredentialEpoch: number;
+  readonly actualCredentialEpoch: number;
+  constructor(expectedCredentialEpoch: number, actualCredentialEpoch: number);
+}
+/**
+ * Authenticated, read-only Modellix LLM catalog client. The resolved key lives
+ * only in the request closure and is never retained on the instance or result.
+ */
+declare class LlmCatalogClient {
+  #private;
+  constructor(options: LlmCatalogClientOptions);
+  fetchModels(signal?: AbortSignal): Promise<ModellixLlmCatalog>;
+}
+interface LlmCatalogCacheOptions {
+  readonly ttlMs?: number;
+  readonly now?: () => number;
+}
+/** Five-minute epoch-keyed cache with one in-flight read per credential epoch. */
+declare class LlmCatalogCache {
+  #private;
+  constructor(client: LlmCatalogClient, options?: LlmCatalogCacheOptions);
+  peek(credentialEpoch: number): ModellixLlmCatalog | undefined;
+  get(credentialEpoch: number, options?: {
+    readonly force?: boolean;
+    readonly signal?: AbortSignal;
+  }): Promise<ModellixLlmCatalog>;
+  invalidate(): void;
+}
+//#endregion
+//#region src/llm/materializer.d.ts
+declare const MODELLIX_LLM_PROVIDER_ID: "modellix";
+declare const MODELLIX_LLM_PROVENANCE_FIELD: "__dshModellixMaterialization";
+interface PiAiModelEntry {
+  readonly id: string;
+  readonly name?: string;
+  readonly [key: string]: unknown;
+}
+interface ModellixPiAiRoute {
+  readonly apiKeyEnv: typeof MODELLIX_CREDENTIAL_REF;
+  readonly displayName: "Modellix";
+  readonly api: "openai-completions";
+  readonly baseURL: "https://llm.modellix.ai/v1";
+  readonly defaultInput: readonly ["text"];
+  readonly retryPolicy: {
+    readonly mode: "normal";
+    readonly maxRetries: 0;
+  };
+  readonly models: readonly PiAiModelEntry[];
+  readonly [key: string]: unknown;
+}
+type LlmRouteOwnership = "none" | "created" | "adopted";
+interface LlmOwnedEntry {
+  readonly kind: "field" | "model";
+  readonly key: string;
+  readonly appliedFingerprint: string;
+}
+interface LlmRouteLedger {
+  readonly ownership: LlmRouteOwnership;
+  readonly appliedRouteFingerprint: string | null;
+  readonly entries: readonly LlmOwnedEntry[];
+}
+interface RouteMaterializationPlan {
+  readonly route: ModellixPiAiRoute & Record<string, unknown>;
+  readonly ledger: LlmRouteLedger;
+  readonly changed: boolean;
+}
+declare class LlmRouteConflictError extends Error {
+  readonly field: string;
+  constructor(field: string);
+}
+declare const EMPTY_LLM_ROUTE_LEDGER: LlmRouteLedger;
+/**
+ * Merge a live catalog into one llm-pi-ai route without replacing unknown
+ * fields or hand-authored model metadata. Previously plugin-owned models may
+ * be removed only while their exact applied fingerprint still matches.
+ */
+declare function planLlmRouteMaterialization(current: unknown, catalog: readonly ModellixLlmModel[], previous?: LlmRouteLedger): RouteMaterializationPlan;
+interface RouteRemovalPlan {
+  readonly action: "none" | "unset-route" | "set-route" | "conflict";
+  readonly route?: Record<string, unknown>;
+  readonly ledger: LlmRouteLedger;
+}
+/** Remove only values still byte-for-byte owned by the plugin. */
+declare function planLlmRouteRemoval(current: unknown, ledger: LlmRouteLedger): RouteRemovalPlan;
+/**
+ * Preserve only ownership already proven before an interrupted cross-namespace
+ * commit. Newly materialized values are deliberately left unowned because the
+ * public Settings API cannot prove which process wrote the observed revision.
+ */
+declare function reconcileLlmRouteLedgerAfterInterruption(current: unknown, ledger: LlmRouteLedger): LlmRouteLedger;
+interface SettingsNamespaceDescriptor {
+  readonly revision: number;
+  readonly value: unknown;
+  readonly base?: unknown;
+  readonly user?: unknown;
+}
+interface LlmSettingsPort {
+  describe(): Promise<SettingsNamespaceDescriptor | undefined>;
+  mutate(operations: readonly ({
+    readonly op: "set";
+    readonly path: readonly string[];
+    readonly value: unknown;
+  } | {
+    readonly op: "unset";
+    readonly path: readonly string[];
+  })[], expectedRevision: number): Promise<void>;
+}
+interface LlmMaterializationReceipt {
+  readonly ledger: LlmRouteLedger;
+  /** Restore the raw Modellix route captured immediately before this write. */
+  rollback(): Promise<void>;
+}
+interface LlmPreparedMaterialization extends LlmMaterializationReceipt {
+  readonly changed: boolean;
+  readonly expectedSettingsRevision: number;
+  readonly previousRouteFingerprint: string;
+  readonly targetRouteFingerprint: string;
+  apply(): Promise<void>;
+}
+interface LlmInterruptedMaterializationEvidence {
+  readonly previousLedger: LlmRouteLedger;
+  readonly targetLedger: LlmRouteLedger;
+  readonly previousRouteFingerprint: string;
+  readonly provenanceToken: string;
+}
+interface LlmInterruptedMaterializationResult {
+  readonly status: "not-applied" | "applied";
+  readonly ledger: LlmRouteLedger;
+}
+declare class LlmMaterializationRollbackError extends Error {
+  constructor(reason: "namespace-unavailable" | "route-changed");
+}
+/** CAS materializer over the public Settings namespace contract. */
+declare class LlmSettingsMaterializer {
+  #private;
+  constructor(settings: LlmSettingsPort);
+  materialize(catalog: readonly ModellixLlmModel[], ledger: LlmRouteLedger): Promise<LlmRouteLedger>;
+  materializeWithRollback(catalog: readonly ModellixLlmModel[], ledger: LlmRouteLedger): Promise<LlmMaterializationReceipt>;
+  prepareMaterialization(catalog: readonly ModellixLlmModel[], ledger: LlmRouteLedger, provenanceToken?: string): Promise<LlmPreparedMaterialization>;
+  recoverInterruptedMaterialization(evidence: LlmInterruptedMaterializationEvidence): Promise<LlmInterruptedMaterializationResult>;
+  clearProvenance(provenanceToken: string): Promise<void>;
+  remove(ledger: LlmRouteLedger): Promise<LlmRouteLedger>;
+}
+//#endregion
+//#region src/llm/registry-verifier.d.ts
+/** Public, non-generating LLM registry surface used for materialization backreads. */
+type LlmRegistryReader = Pick<LlmRuntime, "listProviders" | "resolveModelInfo">;
+interface LlmRegistryVerificationOptions {
+  readonly attempts?: number;
+  readonly retryDelayMs?: number;
+  readonly signal?: AbortSignal;
+}
+/** The materialized route never became observable through the public LLM registry. */
+declare class LlmRegistryBackreadError extends Error {
+  readonly attempts: number;
+  constructor(attempts: number, cause: unknown);
+}
+/**
+ * Wait until llm-pi-ai has consumed its Settings update, then prove that the
+ * route and every exact catalog model resolve through the public registry.
+ * This reads adapter metadata only; it never resolves a Credential or starts a
+ * generated/streaming request.
+ */
+declare function verifyLlmRegistryBackread(registry: LlmRegistryReader, models: readonly ModellixLlmModel[], options?: LlmRegistryVerificationOptions): Promise<void>;
+//#endregion
+//#region src/web/contracts.d.ts
+declare const MODELLIX_WEB_SEARCH_ENDPOINT: "https://tool.modellix.ai/v1/web-search";
+declare const MODELLIX_WEB_FETCH_ENDPOINT: "https://tool.modellix.ai/v1/web-fetch";
+declare const DEFAULT_WEB_SEARCH_MAX_RESULTS = 5;
+declare const MAX_WEB_SEARCH_RESULTS = 20;
+declare const MAX_WEB_QUERY_CHARS = 32000;
+declare const MAX_WEB_URL_CHARS = 8192;
+declare const DEFAULT_WEB_RESPONSE_BYTES: number;
+declare class ModellixWebContractError extends Error {
+  constructor(message: string);
+}
+interface ParsedSearchResponse {
+  readonly result: WebSearchResult;
+  readonly requestId: string;
+}
+interface ParsedFetchSuccess {
+  readonly kind: "success";
+  readonly result: WebFetchResult;
+  readonly requestId: string;
+}
+interface ParsedFetchFailure {
+  readonly kind: "failure";
+  readonly requestId: string;
+}
+type ParsedFetchResponse = ParsedFetchSuccess | ParsedFetchFailure;
+declare function buildSearchRequest(query: string, maxResults: number | undefined): {
+  readonly query: string;
+  readonly depth: "standard";
+  readonly max_results: number;
+};
+declare function buildFetchRequest(url: string): {
+  readonly urls: readonly [string];
+};
+declare function parseSearchResponse(input: string, maxResults: number): ParsedSearchResponse;
+declare function parseFetchResponse(input: string): ParsedFetchResponse;
+declare function validatePublicHttpUrl(value: string, label: string): string;
+//#endregion
+//#region src/web/provider.d.ts
+declare const MODELLIX_WEB_PROVIDER_ID: "modellix";
+interface ModellixWebCredentialSnapshot {
+  /** Host-only secret. It must be resolved for each operation and never cached. */
+  readonly apiKey: string;
+  readonly credentialEpoch: number;
+}
+interface ModellixWebProviderOptions {
+  /** Cheap local switch state. */
+  readonly isEnabled: () => boolean;
+  /** Cheap local descriptor check. This callback must never resolve the Key. */
+  readonly hasCredential: () => boolean;
+  /** Resolves a fresh Host Credential snapshot for every paid request. */
+  readonly resolveCredential: () => Promise<ModellixWebCredentialSnapshot | null>;
+  /** Returns a stable, locally derived Modellix user identifier. */
+  readonly getUserId: () => string;
+  /** Rejects a stale 401 from an earlier Credential generation. */
+  readonly isCredentialEpochCurrent: (credentialEpoch: number) => boolean;
+  readonly onCredentialRejected?: (credentialEpoch: number, error: ModellixErrorContract) => void | Promise<void>;
+  readonly fetchImpl?: typeof globalThis.fetch;
+  readonly maxResponseBytes?: number;
+  readonly requestTimeoutMs?: number;
+  readonly now?: () => number;
+}
+interface ModellixWebProviders {
+  readonly search: ModellixWebSearchProvider;
+  readonly fetch: ModellixWebFetchProvider;
+}
+interface ModellixWebRegistry {
+  registerSearchProvider(provider: WebSearchProvider): () => void;
+  registerFetchProvider(provider: WebFetchProvider): () => void;
+}
+declare class ModellixWebProviderError extends WebError {
+  readonly contract: ModellixErrorContract;
+  readonly diagnostic: RedactedValue;
+  constructor(contract: ModellixErrorContract, diagnostic?: unknown);
+}
+declare class ModellixWebFetchFailedError extends WebError {
+  readonly requestId: string;
+  readonly diagnostic: RedactedValue;
+  constructor(requestId: string, url: string);
+}
+declare class ModellixWebSearchProvider implements WebSearchProvider {
+  #private;
+  readonly id: "modellix";
+  constructor(options: ModellixWebProviderOptions);
+  available(): boolean;
+  search(request: WebSearchRequest, signal?: AbortSignal): Promise<WebSearchResult>;
+}
+declare class ModellixWebFetchProvider implements WebFetchProvider {
+  #private;
+  readonly id: "modellix";
+  constructor(options: ModellixWebProviderOptions);
+  available(): boolean;
+  fetch(request: WebFetchRequest, signal?: AbortSignal): Promise<WebFetchResult>;
+}
+declare function createModellixWebProviders(options: ModellixWebProviderOptions): ModellixWebProviders;
+/** Registers only providers; the Harness-owned web_search/web_fetch Tools remain untouched. */
+declare function registerModellixWebProviders(registry: ModellixWebRegistry, options: ModellixWebProviderOptions): () => void;
+//#endregion
+//#region src/index.d.ts
+declare const name = "modellix";
+declare const inject: string[];
+interface Config {}
+declare const Config: z<Config>;
+declare function apply(ctx: Context): Promise<void>;
+//#endregion
+export { AUTHENTICATED_CATALOG_URL, ApprovedHttpRequest, AvailableDesignResult, BeginLlmMaterializationInput, BeginOnboardingSaveInput, CURRENT_CONFIG_SCHEMA_VERSION, CacheEntry, CachePort, ClockPort, Config, CredentialBroker, CredentialBrokerOptions, CredentialDescriptor, CredentialEpochConflictError, CredentialMutationCoordinator, CredentialMutationResult, CredentialSource, CredentialState, CredentialValidationError, CredentialVerification, DEFAULT_DESIGN_WAL_KEY, DEFAULT_RESULT_TTL_MS, DEFAULT_WEB_RESPONSE_BYTES, DEFAULT_WEB_SEARCH_MAX_RESULTS, DESIGN_PLANNER_ENDPOINT, DESIGN_PLANNER_MODEL, DesignConfig, DesignError, DesignErrorCode, DesignHostController, DesignHostControllerOptions, DesignLogEvent, DesignLogLevel, DesignMediaCategory, DesignModelSummary, DesignPlannerClient, DesignPlannerClientOptions, DesignPlannerRequest, DesignPlannerResult, DesignPollDiagnosticCode, DesignSchemaIR, DesignSnapshotWire, DesignTaskRecord, DesignTaskRepository, DesignTaskRepositoryOptions, DesignTaskState, DesignToolController, DesignWalEvent, EMPTY_LLM_ROUTE_LEDGER, ExactParameterPatch, FetchPort, HarnessCredentialInfo, HarnessCredentialPort, HeaderRecord, HeaderValue, HttpMethod, HttpPolicyError, HttpRequestPolicyInput, HttpResponseBoundaryError, HttpRetryFailure, InvalidCredentialEpoch, JsonPrimitive, JsonValue, LlmCatalogCache, LlmCatalogCacheOptions, LlmCatalogClient, LlmCatalogClientOptions, LlmCatalogRequestError, LlmConfig, LlmCredentialSnapshot, LlmInterruptedMaterializationEvidence, LlmInterruptedMaterializationResult, LlmMaterializationConflictError, LlmMaterializationReceipt, LlmMaterializationRecovery, LlmMaterializationRollbackError, LlmOwnedEntry, LlmOwnershipConfig, LlmPreparedMaterialization, LlmRegistryBackreadError, LlmRegistryReader, LlmRegistryVerificationOptions, LlmRouteConflictError, LlmRouteLedger, LlmRouteOwnership, LlmRouteOwnershipConfig, LlmRouteOwnershipEntry, LlmSettingsMaterializer, LlmSettingsPort, LoggerPort, MAX_WEB_QUERY_CHARS, MAX_WEB_SEARCH_RESULTS, MAX_WEB_URL_CHARS, MODELLIX_CREDENTIAL_REF, MODELLIX_DESIGN_GENERATE_TOOL, MODELLIX_DESIGN_MODELS_TOOL, MODELLIX_DESIGN_PREPARE_TOOL, MODELLIX_DESIGN_TASK_TOOL, MODELLIX_LLM_BASE_URL, MODELLIX_LLM_MODELS_URL, MODELLIX_LLM_PROVENANCE_FIELD, MODELLIX_LLM_PROVIDER_ID, MODELLIX_ORIGINS, MODELLIX_SETTINGS_NAMESPACE, MODELLIX_WEB_FETCH_ENDPOINT, MODELLIX_WEB_PROVIDER_ID, MODELLIX_WEB_SEARCH_ENDPOINT, ModelCatalogClient, ModelCatalogClientOptions, ModelCatalogPage, ModelCatalogQuery, ModelSchemaClient, ModelSchemaClientOptions, ModelSchemaDocument, ModellixDesignDomain, ModellixErrorCode, ModellixErrorContext, ModellixErrorContract, ModellixFailure, ModellixLlmCatalog, ModellixLlmModel, ModellixOriginName, ModellixPiAiRoute, ModellixRuntime, ModellixRuntimeState, ModellixService, ModellixWebContractError, ModellixWebCredentialSnapshot, ModellixWebFetchFailedError, ModellixWebFetchProvider, ModellixWebProviderError, ModellixWebProviderOptions, ModellixWebProviders, ModellixWebRegistry, ModellixWebSearchProvider, NaturalLanguagePlan, OnboardingConfig, OnboardingRecoveryAction, OnboardingRecoveryDecision, OnboardingSaveConflictError, OnboardingSavePhase, OnboardingSaveRecovery, OnboardingStatus, PUBLIC_PORTAL_CATALOG_URL, ParsedFetchFailure, ParsedFetchResponse, ParsedFetchSuccess, ParsedSearchResponse, PersistedLlmRouteOwnership, PiAiModelEntry, PluginConfig, PluginSettingsController, PluginSettingsSchema, PluginSettingsSnapshot, PredictionClient, PredictionClientOptions, PredictionResource, PredictionTask, PredictionTaskStatus, REDACTED, ReadPredictionInput, RedactedValue, RequestDeadline, RetentionPolicy, RetryDelayInput, RetryOptions, RetrySuccess, RouteMaterializationPlan, RouteRemovalPlan, SchemaDiagnostic, SchemaParserLimits, ServiceId, ServiceToggles, ServicesConfig, SettingsNamespaceDescriptor, SettingsScopeLike, SettingsServiceLike, SleepPort, StaleLlmCatalogError, StoragePort, SubmitPredictionInput, UiConstraints, UiField, UiFieldKind, UiMediaKind, UiVariant, UnauthorizedTransition, UnsupportedConfigVersionError, VerificationTransition, WebConfig, abandonLlmMaterialization, advanceCredentialEpoch, apply, applyCredentialDescriptor, applyExactPatch, applyNaturalLanguage, applyRuntimeUnauthorized, applyVerificationResult, approveHttpRequest, approveRedirect, beginLlmMaterialization, beginOnboardingSave, buildFetchRequest, buildInvocationBody, buildSearchRequest, completeLlmMaterialization, completeOnboardingSave, computeRetryDelay, createCredentialState, createDefaultConfig, createModellixDesignToolDefinitions, createModellixWebProviders, deferOnboarding, deriveModellixSessionId, deriveModellixUserId, executeWithRetry, extractAllowedSubmitUrl, getServiceToggles, inject, isAllowedModellixOrigin, isCredentialInvalidError, isPublicHostname, isRetryableError, isRetryableReadFailure, isValidModellixIdentity, markOnboardingCredentialSaved, materializeDefaults, migrateConfig, missingCredentialDescriptor, modellixDesignDomainSpec, name, normalizeCredentialDescriptor, openDesignStorage, parseCatalogPage, parseDesignSchema, parseFetchResponse, parsePredictionTask, parseResources, parseRetryAfter, parseSearchResponse, planLlmRouteMaterialization, planLlmRouteRemoval, preserveStoredCredentialAfterCandidateFailure, preserveVerificationAfterTransientFailure, readBoundedResponseJson, readBoundedResponseText, reconcileLlmRouteLedgerAfterInterruption, reconcileOnboardingSave, redactForLog, redactHeaders, redactUrl, registerModellixDesignTools, registerModellixWebProviders, replayDesignWal, requestDeadline, retryAfterFromFailure, selectAvailableResults, setServiceToggles, systemClock, systemSleep, toModellixError, validatePublicHttpUrl, validateSubmitEndpoint, verifyLlmRegistryBackread };
+//# sourceMappingURL=index.d.ts.map