open-multi-agent-kit 0.79.3 → 0.80.0

package/dist/runtime/headroom-policy.d.ts

@@ -6,7 +6,8 @@
  * a configurable threshold (default 90%).
  *
  * Prefers the external `headroom` CLI compressor when available;
- * falls back to the built-in `optimizeContextBudget` when not.
+ * falls back to caller-provided structured text and finally to legacy
+ * side-effect optimizers when not.
  *
  * Deterministic except for the injectable `runHeadroom` runner.
  */
@@ -18,9 +19,20 @@ export interface HeadroomDecision {
     readonly contextWindow: number;
     readonly reason: string;
 }
+export type HeadroomBackend = "headroom" | "structured-fallback" | "side-effect-fallback" | "none";
 export interface HeadroomCompactResult {
+    /** Backward-compatible summary: a backend produced compacted text or completed a legacy fallback. */
     readonly compacted: boolean;
+    /** Backward-compatible backend family. */
     readonly via: "headroom" | "fallback" | "none";
+    readonly compactedText?: string;
+    readonly reason?: string;
+    /** Whether a compaction attempt was made because the policy threshold was crossed. */
+    readonly attempted: boolean;
+    /** Specific backend that produced this result. */
+    readonly backend: HeadroomBackend;
+    /** Whether a textual backend produced non-empty compacted text. */
+    readonly compactedTextProduced: boolean;
 }
 export declare function resolveHeadroomThreshold(env?: NodeJS.ProcessEnv | Record<string, string | undefined>): number;
 export declare function isHeadroomEnabled(env?: NodeJS.ProcessEnv | Record<string, string | undefined>): boolean;
@@ -34,4 +46,5 @@ export declare function maybeCompactWithHeadroom(args: {
     text?: string;
     runHeadroom?: (text: string) => Promise<string | null>;
     fallback?: () => Promise<void>;
+    fallbackText?: () => string | null | Promise<string | null>;
 }): Promise<HeadroomCompactResult>;

package/dist/runtime/headroom-policy.js

@@ -6,7 +6,8 @@
  * a configurable threshold (default 90%).
  *
  * Prefers the external `headroom` CLI compressor when available;
- * falls back to the built-in `optimizeContextBudget` when not.
+ * falls back to caller-provided structured text and finally to legacy
+ * side-effect optimizers when not.
  *
  * Deterministic except for the injectable `runHeadroom` runner.
  */
@@ -50,14 +51,14 @@ export function evaluateHeadroom(input) {
             reason: "headroom disabled via OMK_HEADROOM",
         };
     }
-    if (contextWindow <= 0) {
+    if (!Number.isFinite(contextWindow) || contextWindow <= 0) {
         return {
             shouldCompact: false,
             utilization: 0,
             threshold,
             usedTokens,
             contextWindow,
-            reason: "context window size unknown (0)",
+            reason: `context window size unknown (${String(contextWindow)})`,
         };
     }
     const utilization = usedTokens / contextWindow;
@@ -93,30 +94,91 @@ async function defaultRunHeadroom(text) {
 }
 export async function maybeCompactWithHeadroom(args) {
     if (!args.decision.shouldCompact) {
-        return { compacted: false, via: "none" };
+        return {
+            compacted: false,
+            via: "none",
+            attempted: false,
+            backend: "none",
+            compactedTextProduced: false,
+            reason: args.decision.reason,
+        };
     }
-    // Try headroom first
+    // Try headroom first.
     if (args.text) {
         try {
             const runner = args.runHeadroom ?? defaultRunHeadroom;
             const result = await runner(args.text);
-            if (result !== null) {
-                return { compacted: true, via: "headroom" };
+            if (typeof result === "string" && result.trim().length > 0) {
+                return {
+                    compacted: true,
+                    via: "headroom",
+                    backend: "headroom",
+                    compactedText: result,
+                    attempted: true,
+                    compactedTextProduced: true,
+                    reason: "headroom CLI compaction produced text",
+                };
             }
         }
         catch {
-            // Headroom threw — fall through to fallback
+            // Headroom threw — fall through to fallback.
         }
     }
-    // Fall back to built-in optimizer
+    // Fall back to a caller-provided textual compaction. This keeps autocompact
+    // effective even when the installed headroom CLI exposes proxy/MCP commands
+    // but no direct `compact --stdin` subcommand.
+    if (args.fallbackText) {
+        try {
+            const text = await args.fallbackText();
+            if (typeof text === "string" && text.trim().length > 0) {
+                return {
+                    compacted: true,
+                    via: "fallback",
+                    backend: "structured-fallback",
+                    compactedText: text,
+                    attempted: true,
+                    compactedTextProduced: true,
+                    reason: "headroom CLI compaction unavailable; used structured fallback text",
+                };
+            }
+            if (typeof text === "string") {
+                return {
+                    compacted: false,
+                    via: "none",
+                    backend: "none",
+                    attempted: true,
+                    compactedTextProduced: false,
+                    reason: "empty fallback text",
+                };
+            }
+        }
+        catch {
+            // Text fallback failed — try side-effect fallback below.
+        }
+    }
+    // Fall back to built-in optimizer side effects when supplied by older callers.
     if (args.fallback) {
         try {
             await args.fallback();
-            return { compacted: true, via: "fallback" };
+            return {
+                compacted: true,
+                via: "fallback",
+                backend: "side-effect-fallback",
+                attempted: true,
+                compactedTextProduced: false,
+                reason: "side-effect fallback completed",
+            };
         }
         catch {
-            // Fallback also failed — graceful degradation
+            // Fallback also failed — graceful degradation.
         }
     }
-    return { compacted: false, via: "none" };
+    return {
+        compacted: false,
+        via: "none",
+        backend: "none",
+        attempted: true,
+        compactedTextProduced: false,
+        reason: "no compaction backend succeeded",
+    };
 }

package/dist/runtime/kimi-api-runtime.d.ts

@@ -5,6 +5,7 @@
  * Calls https://api.moonshot.cn/v1/chat/completions directly.
  */
 import type { AgentRuntime, AgentRunResult, AgentResult, AgentTask, RuntimeCapabilities, RuntimeHealth } from "./agent-runtime.js";
+import type { RuntimeHealthProbeRequest } from "./contracts/shared.js";
 import type { ContextCapsule } from "./context-capsule.js";
 export interface KimiApiRuntimeOptions {
     id?: string;
@@ -37,6 +38,7 @@ export declare function createKimiApiRuntime(options?: KimiApiRuntimeOptions): A
 export declare const createKimiWireRuntime: typeof createKimiApiRuntime;
 export declare class KimiApiRuntime implements AgentRuntime {
     readonly id: string;
+    readonly advisory = true;
     readonly providerId: string;
     readonly legacy = false;
     readonly runtimeMode = "api";
@@ -50,8 +52,9 @@ export declare class KimiApiRuntime implements AgentRuntime {
     private readonly baseUrl;
     constructor(options?: KimiApiRuntimeOptions);
     supports(capsule: ContextCapsule): boolean;
-    health(): Promise<RuntimeHealth>;
+    health(input?: RuntimeHealthProbeRequest): Promise<RuntimeHealth>;
     runNode(capsule: ContextCapsule, signal: AbortSignal): Promise<AgentRunResult>;
     execute(task: AgentTask): Promise<AgentResult>;
+    private consumeCompactionContext;
     private parseStreamResponse;
 }

package/dist/runtime/kimi-api-runtime.js

@@ -9,6 +9,7 @@ import { resolve } from "node:path";
 import { capsuleToTask } from "./context-broker-converter.js";
 import { buildProviderToolPayload } from "./provider-tool-contracts.js";
 import { repairToolCalls } from "./tool-call-repair.js";
+import { probeOpenAiCompatibleModels } from "./runtime-health-probes.js";
 /**
  * Detect "Image file: <path>" patterns in the prompt text (inserted by /paste
  * or Ctrl+V clipboard image) and load the referenced images as base64 data URIs
@@ -86,6 +87,7 @@ export function createKimiApiRuntime(options = {}) {
 export const createKimiWireRuntime = createKimiApiRuntime;
 export class KimiApiRuntime {
     id;
+    advisory = true;
     providerId;
     legacy = false;
     runtimeMode = "api";
@@ -133,14 +135,16 @@ export class KimiApiRuntime {
             return false;
         return true;
     }
-    async health() {
-        const available = Boolean(this.apiKey);
-        return {
+    async health(input = { probeKind: "static", highRisk: false }) {
+        return probeOpenAiCompatibleModels({
             runtimeId: this.id,
-            available,
-            reason: available ? undefined : `${this.apiKeyEnvName} is not set`,
-            checkedAt: new Date().toISOString(),
-        };
+            baseUrl: this.baseUrl,
+            apiKey: this.apiKey,
+            apiKeyName: this.apiKeyEnvName,
+            model: this.model,
+            providerName: this.providerName,
+            probeKind: input.probeKind,
+        });
     }
     async runNode(capsule, signal) {
         try {
@@ -172,12 +176,13 @@ export class KimiApiRuntime {
         }
     }
     async execute(task) {
+        const compactionMeta = this.consumeCompactionContext(task);
         if (!this.apiKey) {
             return {
                 output: "",
                 exitCode: 1,
                 thinking: "",
-                metadata: { error: `${this.apiKeyEnvName} is not set` },
+                metadata: { error: `${this.apiKeyEnvName} is not set`, ...compactionMeta },
             };
         }
         if (task.capabilities.write ||
@@ -192,6 +197,7 @@ export class KimiApiRuntime {
                 metadata: {
                     error: `${this.id} is advisory/read-only and does not receive write, shell, MCP, merge, or patch authority`,
                     authorityMode: "advisory",
+                    ...compactionMeta,
                 },
             };
         }
@@ -252,13 +258,14 @@ export class KimiApiRuntime {
                     output: "",
                     exitCode: 1,
                     thinking: "",
-                    metadata: { error: `${this.providerName} API error ${response.status}: ${errorText}` },
+                    metadata: { error: `${this.providerName} API error ${response.status}: ${errorText}`, ...compactionMeta },
                 };
             }
             if (useStreaming) {
                 return this.parseStreamResponse(response, {
                     toolPlaneHash: providerTools.toolPlaneHash,
                     toolContracts: providerTools.contracts,
+                    compactionMeta,
                 });
             }
             const contentType = response.headers.get("content-type") ?? "";
@@ -266,6 +273,7 @@ export class KimiApiRuntime {
                 return this.parseStreamResponse(response, {
                     toolPlaneHash: providerTools.toolPlaneHash,
                     toolContracts: providerTools.contracts,
+                    compactionMeta,
                 });
             }
             const payload = (await response.json());
@@ -297,6 +305,7 @@ export class KimiApiRuntime {
                     toolPlaneHash: providerTools.toolPlaneHash,
                     toolContracts: providerTools.contracts,
                     toolCallRepair: mappedToolCalls.repair,
+                    ...compactionMeta,
                 },
             };
         }
@@ -306,17 +315,31 @@ export class KimiApiRuntime {
                     output: "",
                     exitCode: 130,
                     thinking: "",
-                    metadata: { error: "Request aborted" },
+                    metadata: { error: "Request aborted", ...compactionMeta },
                 };
             }
             return {
                 output: "",
                 exitCode: 1,
                 thinking: "",
-                metadata: { error: String(err) },
+                metadata: { error: String(err), ...compactionMeta },
             };
         }
     }
+    consumeCompactionContext(task) {
+        const compaction = task.context.compaction;
+        if (!compaction || compaction.schemaVersion !== "omk.task-compaction.v1") {
+            return { compactionConsumed: false };
+        }
+        return {
+            compactionConsumed: true,
+            compactionContract: typeof compaction.contract.schemaVersion === "string"
+                ? compaction.contract.schemaVersion
+                : "unknown",
+            compactionArtifactRef: compaction.artifactRef,
+            compactionQualityScore: compaction.diagnostics?.qualityScore,
+        };
+    }
     async parseStreamResponse(response, metadata) {
         const reader = response.body?.getReader();
         if (!reader) {
@@ -424,6 +447,7 @@ export class KimiApiRuntime {
                 model,
                 finishReason,
                 ...metadata,
+                ...(metadata.compactionMeta ?? {}),
                 toolCallRepair: mappedToolCalls.repair,
             },
         };

package/dist/runtime/kimi-print-runtime.js

@@ -30,6 +30,25 @@ export function createKimiPrintRuntime(options = {}) {
                     metadata: { runtime: "kimi-print", error: errorMsg },
                 };
             }
+            const routing = capsule.node?.routing;
+            const approvalPolicy = routing?.approvalPolicy ?? routing?.executionPrompt;
+            const sandboxMode = routing?.sandboxMode;
+            const capabilities = routing?.assignedProviderCapabilities ?? [];
+            const isAdvisory = sandboxMode === "read-only" ||
+                capabilities.length === 0 ||
+                capabilities.every((c) => ["read", "review"].includes(c));
+            const requiresWriteShellMerge = capabilities.some((c) => ["write", "patch", "shell", "merge"].includes(c));
+            if (requiresWriteShellMerge && isAdvisory) {
+                const errorMsg = `[omk] kimi-print runtime is advisory/read-only and does not receive write, patch, shell, or merge authority`;
+                process.stderr.write(`${errorMsg}\n`);
+                return {
+                    success: false,
+                    exitCode: 1,
+                    stdout: `[ERROR] ${errorMsg}`,
+                    stderr: errorMsg,
+                    metadata: { runtime: "kimi-print", error: errorMsg, authorityMode: "advisory" },
+                };
+            }
             const runner = createKimiTaskRunner(options);
             const resources = await getOmkResourceSettings();
             const env = {
@@ -41,6 +60,8 @@ export function createKimiPrintRuntime(options = {}) {
                 OMK_HOOKS_ENABLED: resources.hooksScope === "none" ? "false" : "true",
                 OMK_CONTEXT_BUDGET: capsule.budget.compression,
                 OMK_TOTAL_TOKENS: String(capsule.budget.maxInputTokens),
+                OMK_APPROVAL_POLICY: approvalPolicy ?? "",
+                OMK_SANDBOX_MODE: sandboxMode ?? (isAdvisory ? "read-only" : "workspace-write"),
                 ...(capsule.node ? dagNodeRoutingEnv(capsule.node) : {}),
             };
             const node = {

package/dist/runtime/kimi-wire-protocol-runtime.js

@@ -66,11 +66,27 @@ export class KimiWireProtocolRuntime {
         const kimiBin = resolveKimiBin();
         const available = await checkCommand(kimiBin);
         this.kimiAvailable = available;
+        const now = new Date();
         return {
             runtimeId: this.id,
             available,
             reason: available ? undefined : "`kimi` command not found in PATH",
-            checkedAt: new Date().toISOString(),
+            checkedAt: now.toISOString(),
+            vector: {
+                runtimeOk: available,
+                authOk: available,
+                modelOk: true,
+                quotaOk: true,
+                rateLimitOk: true,
+                runtime: available ? "pass" : "fail",
+                auth: available ? "unknown" : "fail",
+                model: "unknown",
+                quota: "unknown",
+                rateLimit: "unknown",
+                lastProbeKind: "static",
+                checkedAt: now.toISOString(),
+                expiresAt: new Date(now.getTime() + 60_000).toISOString(),
+            },
         };
     }
     async runNode(capsule, signal) {

package/dist/runtime/local-llm-runtime.d.ts

@@ -6,6 +6,7 @@
  * Supports SSE streaming and reasoning_content.
  */
 import type { AgentRuntime, AgentRunResult, AgentResult, AgentTask, RuntimeCapabilities, RuntimeHealth } from "./agent-runtime.js";
+import type { RuntimeHealthProbeRequest } from "./contracts/shared.js";
 import type { ContextCapsule } from "./context-capsule.js";
 export interface LocalLlmRuntimeOptions {
     apiKey?: string;
@@ -14,6 +15,9 @@ export interface LocalLlmRuntimeOptions {
 }
 export declare class LocalLlmRuntime implements AgentRuntime {
     readonly id = "local-llm";
+    readonly providerId = "local-llm";
+    readonly advisory = true;
+    readonly runtimeMode = "api";
     readonly kind = "api";
     readonly priority = 35;
     readonly capabilities: RuntimeCapabilities;
@@ -22,7 +26,7 @@ export declare class LocalLlmRuntime implements AgentRuntime {
     private readonly baseUrl;
     constructor(options?: LocalLlmRuntimeOptions);
     supports(capsule: ContextCapsule): boolean;
-    health(): Promise<RuntimeHealth>;
+    health(input?: RuntimeHealthProbeRequest): Promise<RuntimeHealth>;
     runNode(capsule: ContextCapsule, signal: AbortSignal): Promise<AgentRunResult>;
     execute(task: AgentTask): Promise<AgentResult>;
     private parseStreamResponse;

package/dist/runtime/local-llm-runtime.js

@@ -7,8 +7,12 @@
  */
 import { capsuleToTask } from "./context-broker-converter.js";
 import { sanitizeUserVisibleOutput } from "../util/user-visible-output.js";
+import { probeOpenAiCompatibleModels } from "./runtime-health-probes.js";
 export class LocalLlmRuntime {
     id = "local-llm";
+    providerId = "local-llm";
+    advisory = true;
+    runtimeMode = "api";
     kind = "api";
     priority = 35;
     capabilities = {
@@ -40,29 +44,16 @@ export class LocalLlmRuntime {
             return false;
         return true;
     }
-    async health() {
-        try {
-            const controller = new AbortController();
-            const timeout = setTimeout(() => controller.abort(), 5000);
-            const resp = await fetch(`${this.baseUrl}/models`, {
-                signal: controller.signal,
-            });
-            clearTimeout(timeout);
-            return {
-                runtimeId: this.id,
-                available: resp.ok,
-                reason: resp.ok ? undefined : `Local LLM returned ${resp.status}`,
-                checkedAt: new Date().toISOString(),
-            };
-        }
-        catch (err) {
-            return {
-                runtimeId: this.id,
-                available: false,
-                reason: `Local LLM not reachable: ${err instanceof Error ? err.message : String(err)}`,
-                checkedAt: new Date().toISOString(),
-            };
-        }
+    async health(input = { probeKind: "static", highRisk: false }) {
+        return probeOpenAiCompatibleModels({
+            runtimeId: this.id,
+            baseUrl: this.baseUrl,
+            apiKey: this.apiKey,
+            apiKeyName: "LOCAL_LLM_API_KEY",
+            model: this.model,
+            providerName: "Local LLM",
+            probeKind: input.probeKind === "static" ? "static" : input.probeKind,
+        });
     }
     async runNode(capsule, signal) {
         try {

package/dist/runtime/private-stderr.d.ts

@@ -0,0 +1,13 @@
+export interface PrivateStderrRetentionOptions {
+    readonly runId?: string;
+    readonly nodeId?: string;
+    readonly runtimeId?: string;
+    readonly root?: string;
+    readonly env?: Record<string, string | undefined>;
+}
+export interface StderrSanitizableResult {
+    readonly stderr: string;
+    readonly metadata?: Record<string, unknown>;
+}
+export declare function privateStderrRetentionEnabled(env?: Record<string, string | undefined>): boolean;
+export declare function sanitizeRuntimeStderrResult<T extends StderrSanitizableResult>(result: T, options?: PrivateStderrRetentionOptions): T;

package/dist/runtime/private-stderr.js

@@ -0,0 +1,69 @@
+import { createHash } from "node:crypto";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { getRunArtifactPath } from "../util/run-store.js";
+import { maskSensitiveText } from "../util/secret-mask.js";
+export function privateStderrRetentionEnabled(env) {
+    const value = env?.OMK_PRIVATE_STDERR_ARTIFACTS ?? env?.OMK_DEBUG;
+    return /^(1|true|yes|on)$/i.test(value ?? "");
+}
+export function sanitizeRuntimeStderrResult(result, options = {}) {
+    const originalStderr = result.stderr ?? "";
+    const sanitizedStderr = maskSensitiveText(originalStderr);
+    const redacted = sanitizedStderr !== originalStderr;
+    const privateArtifact = writePrivateStderrArtifact(sanitizedStderr, originalStderr, options);
+    if (!redacted && !privateArtifact && sanitizedStderr === result.stderr)
+        return result;
+    return {
+        ...result,
+        stderr: sanitizedStderr,
+        metadata: {
+            ...(result.metadata ?? {}),
+            stderrRedacted: true,
+            secretLikeContentRedacted: redacted,
+            stderrPreview: sanitizedStderr.slice(0, 500),
+            ...(privateArtifact && {
+                stderrPrivateArtifact: privateArtifact.path,
+                stderrPrivateArtifactSha256: privateArtifact.sha256,
+                stderrRetainedPrivately: true,
+            }),
+        },
+    };
+}
+function writePrivateStderrArtifact(sanitizedStderr, originalStderr, options) {
+    if (!privateStderrRetentionEnabled(options.env))
+        return undefined;
+    if (sanitizedStderr.trim().length === 0)
+        return undefined;
+    const runId = options.runId;
+    if (!runId || runId.startsWith("local-"))
+        return undefined;
+    try {
+        const node = safeArtifactSegment(options.nodeId, "node");
+        const runtime = safeArtifactSegment(options.runtimeId, "runtime");
+        const sha256 = createHash("sha256").update(sanitizedStderr).digest("hex");
+        const rel = `private/stderr/${node}-${runtime}-${sha256.slice(0, 12)}.json`;
+        const full = getRunArtifactPath(runId, rel, options.root);
+        mkdirSync(dirname(full), { recursive: true });
+        writeFileSync(full, JSON.stringify({
+            schemaVersion: "omk.private-stderr.v1",
+            runId,
+            nodeId: options.nodeId,
+            runtimeId: options.runtimeId,
+            redaction: "secret-like-content-masked-before-retention",
+            publicPreviewLength: 500,
+            sha256,
+            rawSha256: createHash("sha256").update(originalStderr).digest("hex"),
+            stderr: sanitizedStderr,
+            timestamp: new Date().toISOString(),
+        }, null, 2), "utf-8");
+        return { path: rel, sha256 };
+    }
+    catch {
+        return undefined;
+    }
+}
+function safeArtifactSegment(value, fallback) {
+    const sanitized = (value ?? fallback).replace(/[^A-Za-z0-9._-]/g, "-").slice(0, 48);
+    return sanitized.length > 0 ? sanitized : fallback;
+}

package/dist/runtime/prompt-envelope.d.ts

@@ -9,7 +9,7 @@ export interface PromptEnvelopeInput {
     readonly nodeId?: string;
     readonly runId?: string;
     readonly executionPrompt?: string;
-    readonly turnRisk?: "read" | "write" | "shell" | "merge";
+    readonly turnRisk?: "read" | "write" | "shell" | "merge" | "ask";
     readonly sandboxMode?: "read-only" | "workspace-write";
 }
 export interface PromptEnvelopeSection {

package/dist/runtime/provider-sovereignty.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Provider sovereignty scoring for Freedomd.
+ *
+ * Translates provider jurisdiction, retention, cutoff/portability, and locality
+ * properties into a normalized score that feeds runtime routing. The score is
+ * intentionally conservative: unknowns are treated as risk.
+ */
+import type { AgentRuntime, AgentTask } from "./agent-runtime.js";
+import type { RuntimeHealth } from "./contracts/shared.js";
+export type ExportPolicy = "open" | "restricted" | "controlled" | "unknown";
+export interface ProviderSovereigntyProfile {
+    readonly providerId: string;
+    readonly runtimeMode: string;
+    readonly providerCountry: string;
+    readonly exportPolicy: ExportPolicy;
+    readonly retentionDays: number;
+    readonly zeroDataRetention: boolean;
+    readonly trainingUse: boolean;
+    readonly supportsSelfHosted: boolean;
+    readonly openApiCompatible: boolean;
+    readonly policyInstabilityScore: number;
+    readonly exportControlExposure: number;
+    readonly accountDependency: number;
+    readonly metadataEvidenceSupport: boolean;
+}
+export interface ProviderIncidentState {
+    readonly providerId: string;
+    readonly runtimeMode?: string;
+    readonly kind: "availability" | "policy" | "export-control" | "retention" | "jurisdiction";
+    readonly severity: "info" | "warn" | "block";
+    readonly reason: string;
+    readonly updatedAt: string;
+}
+export interface SovereigntyDiagnostics {
+    readonly jurisdictionRisk: number;
+    readonly retentionRisk: number;
+    readonly cutoffRisk: number;
+    readonly localityScore: number;
+    readonly portabilityScore: number;
+    readonly incidentSeverity?: string;
+    readonly reason: string;
+}
+export interface SovereigntyScore {
+    readonly score: number;
+    readonly diagnostics: SovereigntyDiagnostics;
+}
+export interface ComputeSovereigntyOptions {
+    readonly profile: ProviderSovereigntyProfile;
+    readonly userCountry?: string;
+    readonly taskRisk?: string;
+    readonly incidents?: readonly ProviderIncidentState[];
+    readonly localAvailable?: boolean;
+}
+export declare function assessJurisdictionRisk(options: {
+    readonly providerCountry: string;
+    readonly userCountry?: string;
+    readonly taskRisk?: string;
+    readonly exportPolicy: ExportPolicy;
+    readonly incidents?: readonly ProviderIncidentState[];
+}): number;
+export declare function assessRetentionRisk(options: {
+    readonly retentionDays: number;
+    readonly zeroDataRetention: boolean;
+    readonly trainingUse: boolean;
+    readonly maxRetentionDays?: number;
+}): number;
+export declare function assessCutoffRisk(options: {
+    readonly health?: RuntimeHealth;
+    readonly policyInstabilityScore: number;
+    readonly exportControlExposure: number;
+    readonly accountDependency: number;
+    readonly incidents?: readonly ProviderIncidentState[];
+}): number;
+export declare function assessPortability(options: {
+    readonly supportsOpenApiCompat: boolean;
+    readonly supportsToolContract: boolean;
+    readonly supportsEvidenceReturn: boolean;
+}): number;
+export declare function computeProviderSovereigntyScore(runtime: AgentRuntime, task: AgentTask, options: ComputeSovereigntyOptions): SovereigntyScore;
+export declare function buildProviderSovereigntyProfiles(): Readonly<Record<string, ProviderSovereigntyProfile>>;
+export declare function lookupSovereigntyProfile(runtime: AgentRuntime, profiles?: Readonly<Record<string, ProviderSovereigntyProfile>>): ProviderSovereigntyProfile | undefined;