spawnfile 0.1.25 → 0.1.27

package/dist/compiler/training/rewind/contract.d.ts

@@ -1,18 +1,18 @@
 import { z } from "zod";
 export declare const inputIdentitySchema: z.ZodObject<{
     section: z.ZodEnum<{
+        networks: "networks";
         memory: "memory";
         resources: "resources";
-        networks: "networks";
     }>;
     id: z.ZodString;
     declaredBy: z.ZodString;
 }, z.core.$strict>;
 export declare const materializedInputSchema: z.ZodObject<{
     section: z.ZodEnum<{
+        networks: "networks";
         memory: "memory";
         resources: "resources";
-        networks: "networks";
     }>;
     id: z.ZodString;
     declaredBy: z.ZodString;
@@ -57,8 +57,8 @@ export type MaterializedInput = z.infer<typeof materializedInputSchema>;
 export declare const materializedMomentSchema: z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.materialized-moment.v1">;
     status: z.ZodEnum<{
-        materialized: "materialized";
         refused: "refused";
+        materialized: "materialized";
     }>;
     agent: z.ZodString;
     example: z.ZodObject<{
@@ -74,9 +74,9 @@ export declare const materializedMomentSchema: z.ZodObject<{
     effectiveAt: z.ZodISODateTime;
     inputs: z.ZodArray<z.ZodObject<{
         section: z.ZodEnum<{
+            networks: "networks";
             memory: "memory";
             resources: "resources";
-            networks: "networks";
         }>;
         id: z.ZodString;
         declaredBy: z.ZodString;
@@ -133,9 +133,9 @@ export type MaterializedMoment = z.infer<typeof materializedMomentSchema>;
 export declare const leakFindingSchema: z.ZodObject<{
     input: z.ZodNullable<z.ZodObject<{
         section: z.ZodEnum<{
+            networks: "networks";
             memory: "memory";
             resources: "resources";
-            networks: "networks";
         }>;
         id: z.ZodString;
         declaredBy: z.ZodString;
@@ -171,9 +171,9 @@ export declare const leakCheckSchema: z.ZodObject<{
     findings: z.ZodArray<z.ZodObject<{
         input: z.ZodNullable<z.ZodObject<{
             section: z.ZodEnum<{
+                networks: "networks";
                 memory: "memory";
                 resources: "resources";
-                networks: "networks";
             }>;
             id: z.ZodString;
             declaredBy: z.ZodString;
@@ -204,8 +204,8 @@ export declare const taskClockSchema: z.ZodObject<{
 export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.ZodObject<{
     version: z.ZodLiteral<"spawnfile.materialized-moment.v1">;
     status: z.ZodEnum<{
-        materialized: "materialized";
         refused: "refused";
+        materialized: "materialized";
     }>;
     agent: z.ZodString;
     example: z.ZodObject<{
@@ -221,9 +221,9 @@ export declare const materializedMomentJsonSchema: z.core.ZodStandardJSONSchemaP
     effectiveAt: z.ZodISODateTime;
     inputs: z.ZodArray<z.ZodObject<{
         section: z.ZodEnum<{
+            networks: "networks";
             memory: "memory";
             resources: "resources";
-            networks: "networks";
         }>;
         id: z.ZodString;
         declaredBy: z.ZodString;
@@ -291,9 +291,9 @@ export declare const leakCheckJsonSchema: z.core.ZodStandardJSONSchemaPayload<z.
     findings: z.ZodArray<z.ZodObject<{
         input: z.ZodNullable<z.ZodObject<{
             section: z.ZodEnum<{
+                networks: "networks";
                 memory: "memory";
                 resources: "resources";
-                networks: "networks";
             }>;
             id: z.ZodString;
             declaredBy: z.ZodString;

package/dist/compiler/training/subjectDeclaration.d.ts

@@ -1,3 +1,4 @@
+import { DAIMON_BROKER_ENGINE_ID, DAIMON_PORTABLE_ENGINE_ID } from "../../runtime/daimon/index.js";
 /** The slice of a leased broker section the declaration must agree with. */
 export interface TrainingSubjectDeclaredBroker {
     limits: {
@@ -22,4 +23,4 @@ export interface TrainingSubjectDeclaredBroker {
  *
  * Any other runtime or engine is refused. Returns the engine it checked.
  */
-export declare const assertTrainingSubjectDeclaration: (projectRoot: string, agentId: string, broker?: TrainingSubjectDeclaredBroker) => Promise<"codex" | "grok">;
+export declare const assertTrainingSubjectDeclaration: (projectRoot: string, agentId: string, broker?: TrainingSubjectDeclaredBroker) => Promise<typeof DAIMON_PORTABLE_ENGINE_ID | typeof DAIMON_BROKER_ENGINE_ID>;

package/dist/compiler/training/subjectDeclaration.js

@@ -1,3 +1,4 @@
+import { DAIMON_BROKER_ENGINE_ID, DAIMON_PORTABLE_ENGINE_ID, getDaimonEngineDescriptor } from "../../runtime/daimon/index.js";
 import { SpawnfileError } from "../../shared/index.js";
 import { resolveDaimonEngine } from "../../runtime/daimon/config.js";
 import { resolveDaimonGrokTurnLimits } from "../../runtime/daimon/grokTurnLimits.js";
@@ -28,7 +29,8 @@ export const assertTrainingSubjectDeclaration = async (projectRoot, agentId, bro
         return refuse(`Training subject ${agentId} must declare runtime daimon, not ${node.runtime.name}`);
     const engine = resolveDaimonEngine(node);
     const declared = resolveDaimonGrokTurnLimits(node.runtime.options.turn_limits);
-    if (engine === "codex") {
+    const subject = getDaimonEngineDescriptor(engine)?.training.subject;
+    if (subject?.supported && subject.isolation === "native-sandbox" && engine === DAIMON_PORTABLE_ENGINE_ID) {
         if (node.runtime.options.codex_policy !== "workspace-no-network") {
             refuse(`Codex training subject ${agentId} requires explicit codex_policy: workspace-no-network on its Daimon declaration`);
         }
@@ -36,7 +38,7 @@ export const assertTrainingSubjectDeclaration = async (projectRoot, agentId, bro
             refuse(`Codex training subject ${agentId} takes no broker slot and no turn_limits`);
         return engine;
     }
-    if (engine !== "grok")
+    if (!subject?.supported || subject.isolation !== "broker-worker" || engine !== DAIMON_BROKER_ENGINE_ID)
         return refuse(`Training subject ${agentId} uses Daimon engine ${engine}; only codex and grok subjects train`);
     if (!broker)
         return refuse(`Grok training subject ${agentId} requires its leased broker slot`);

package/dist/compiler/training/subjectLease.d.ts

@@ -1,17 +1,18 @@
+import { DAIMON_BROKER_ENGINE_ID, DAIMON_PORTABLE_ENGINE_ID } from "../../runtime/daimon/index.js";
 import type { Socket } from "node:net";
 import { DAIMON_GROK_ENGINE_BROKER, type DaimonGrokBrokerModel, type DaimonGrokBrokerReasoningEffort } from "../../runtime/daimon/contractManifest.js";
-/** Paideia's slot freshness floor for this trial: the receipt must echo the nonce at no lower generation. */
+/** The training core's slot freshness floor for this trial: the receipt must echo the nonce at no lower generation. */
 export interface TrainingSubjectFreshness {
     expectedNonce: string;
     minGeneration: number;
 }
-/** The evaluator-created per-trial directories (Paideia `TrialPaths`); only Codex subjects live in them. */
+/** The evaluator-created per-trial directories (`TrialPaths`); only Codex subjects live in them. */
 export interface TrainingSubjectTrialRoots {
     workspace: string;
     runtimeHome: string;
 }
 export type TrainingSubjectEvaluatorRole = "run-root" | "context" | "sealed-inputs" | "judge-home" | "slot-ledger";
-/** `paideia.daimon-native.launch.v2` `broker`, structurally `grokBrokerLaunchSchema` of Paideia 0.1.1. */
+/** `spawnfile.training.daimon-native.launch.v2` `broker`, structurally `grokBrokerLaunchSchema` in the bundled native adapter. */
 export interface TrainingSubjectBrokerSection {
     projectionVersion: typeof DAIMON_GROK_ENGINE_BROKER.projectionVersion;
     workerConfigVariant: "unclocked" | "clocked";
@@ -39,11 +40,11 @@ export interface TrainingSubjectBrokerSection {
 }
 export type TrainingSubjectAgent = {
     id: string;
-    engine: "codex";
+    engine: typeof DAIMON_PORTABLE_ENGINE_ID;
     model: string;
 } | {
     id: string;
-    engine: "grok";
+    engine: typeof DAIMON_BROKER_ENGINE_ID;
     model: DaimonGrokBrokerModel;
     reasoningEffort: DaimonGrokBrokerReasoningEffort;
 };
@@ -91,7 +92,7 @@ export interface LeaseTrainingSubjectOptions {
     /** Required for Codex; a Grok subject lives at the container's fixed slot roots. */
     trialRoots?: TrainingSubjectTrialRoots;
     signal: AbortSignal;
-    /** Resolves Daimon's public `@noopolis/daimon/runtime` export. */
+    /** Resolves Daimon's public `Daimon/runtime` export. */
     loadDaimon?: () => Promise<unknown>;
     /** Test seams: the supervisor connection and the declaration file. */
     connect?: () => Socket;
@@ -99,10 +100,10 @@ export interface LeaseTrainingSubjectOptions {
     slotsFile?: string;
 }
 /** The fixed read-only container leaf the training launch binds the Codex login to. */
-export declare const TRAINING_CODEX_CREDENTIAL_INGRESS = "/run/paideia-auth/codex";
+export declare const TRAINING_CODEX_CREDENTIAL_INGRESS = "/run/spawnfile-training-auth/codex";
 /**
  * Lease one training slot for an engine-neutral subject and return everything
- * `paideia.daimon-native.launch.v2` must carry about it.
+ * `spawnfile.training.daimon-native.launch.v2` must carry about it.
  *
  * Spawnfile owns the container, its slots, the broker declaration and
  * registration, the projection inputs, the recycle verb and the credential

package/dist/compiler/training/subjectLease.js

@@ -1,13 +1,15 @@
+import { DAIMON_BROKER_ENGINE_ID, DAIMON_PORTABLE_ENGINE_ID, getDaimonEngineDescriptor } from "../../runtime/daimon/index.js";
+import { DAIMON_PACKAGE_NAME } from '../../runtime/daimon/packageName.js';
 import { readFile } from "node:fs/promises";
 import path from "node:path";
 import { SpawnfileError } from "../../shared/index.js";
-import { DAIMON_ENGINE_CREDENTIALS, DAIMON_GROK_ENGINE_BROKER } from "../../runtime/daimon/contractManifest.js";
+import { DAIMON_GROK_ENGINE_BROKER } from "../../runtime/daimon/contractManifest.js";
 import { parseTrainingBrokerDeclaration } from "./broker/declaration.js";
-import { TRAINING_BROKER_DECLARATION_FILE, TRAINING_PAIDEIA_ROOT, TRAINING_SLOTS_FILE, trainingSlotDescriptors } from "./broker/paths.js";
+import { TRAINING_BROKER_DECLARATION_FILE, TRAINING_ROOT, TRAINING_SLOTS_FILE, trainingSlotDescriptors } from "./broker/paths.js";
 import { loadDaimonProjectionModule, resolveTrainingSlotProjection } from "./broker/projection.js";
 import { recycleTrainingSlot } from "./broker/recycleClient.js";
 /** The fixed read-only container leaf the training launch binds the Codex login to. */
-export const TRAINING_CODEX_CREDENTIAL_INGRESS = "/run/paideia-auth/codex";
+export const TRAINING_CODEX_CREDENTIAL_INGRESS = "/run/spawnfile-training-auth/codex";
 const NONCE = /^[a-f0-9]{64}$/u;
 const invalid = (message) => { throw new SpawnfileError("validation_error", message); };
 const refused = (message) => { throw new SpawnfileError("runtime_error", message); };
@@ -19,7 +21,7 @@ const canonical = (label, value) => {
 };
 /**
  * Lease one training slot for an engine-neutral subject and return everything
- * `paideia.daimon-native.launch.v2` must carry about it.
+ * `spawnfile.training.daimon-native.launch.v2` must carry about it.
  *
  * Spawnfile owns the container, its slots, the broker declaration and
  * registration, the projection inputs, the recycle verb and the credential
@@ -32,9 +34,11 @@ export const leaseTrainingSubject = async (options) => {
     options.signal.throwIfAborted();
     if (!Number.isInteger(options.slot) || options.slot < 0)
         invalid("Training subject lease requires a slot index");
-    if (options.engine === "grok")
+    const subject = getDaimonEngineDescriptor(options.engine)?.training.subject;
+    // These versioned lease variants implement only the two released identities.
+    if (subject?.supported && subject.isolation === "broker-worker" && options.engine === DAIMON_BROKER_ENGINE_ID)
         return leaseGrokSubject(options);
-    if (options.engine === "codex")
+    if (subject?.supported && subject.isolation === "native-sandbox" && options.engine === DAIMON_PORTABLE_ENGINE_ID)
         return leaseCodexSubject(options);
     return invalid(`Training subject engine ${String(options.engine)} is not supported; lease a codex or grok subject`);
 };
@@ -64,10 +68,10 @@ const leaseGrokSubject = async (options) => {
     options.signal.throwIfAborted();
     const roots = {
         workspace: descriptor.workspace, home: descriptor.runtimeHome, control: descriptor.state, workerHome: descriptor.workerHome,
-        usageLedger: descriptor.usageLedger, preflightReceipt: descriptor.preflightReceipt, context: TRAINING_PAIDEIA_ROOT
+        usageLedger: descriptor.usageLedger, preflightReceipt: descriptor.preflightReceipt, context: TRAINING_ROOT
     };
     return {
-        agent: { id: declaration.agentId, engine: "grok", model: declaration.model, reasoningEffort: declaration.reasoningEffort },
+        agent: { id: declaration.agentId, engine: DAIMON_BROKER_ENGINE_ID, model: declaration.model, reasoningEffort: declaration.reasoningEffort },
         workspace: { source: descriptor.workspace, target: descriptor.workspace },
         // The projection digest binds exactly the slot workspace and runtime home; nothing else may be writable.
         projections: [{ role: "home", source: descriptor.runtimeHome, target: descriptor.runtimeHome }],
@@ -99,7 +103,7 @@ const leaseGrokSubject = async (options) => {
 };
 /** Indirect specifier: Daimon is an in-image runtime peer, never a Spawnfile source dependency. */
 const loadDaimonRuntime = async () => {
-    const packageName = "@noopolis/daimon/runtime";
+    const packageName = `${DAIMON_PACKAGE_NAME}/runtime`;
     return import(packageName);
 };
 /** The Codex credential leaf Daimon reads, from its public export, refused unless it equals the vendored manifest. */
@@ -109,10 +113,10 @@ const codexCredentialRelativePath = async (load = loadDaimonRuntime) => {
         daimon = await load();
     }
     catch {
-        return refused("The training image must install @noopolis/daimon with its public /runtime export");
+        return refused(`The training image must install ${DAIMON_PACKAGE_NAME} with its public /runtime export`);
     }
-    const relative = daimon?.ENGINE_CREDENTIAL_MATERIAL?.codex?.sourceRelativePath;
-    if (relative !== DAIMON_ENGINE_CREDENTIALS.codex.sourceRelativePath) {
+    const relative = daimon?.ENGINE_CREDENTIAL_MATERIAL?.[DAIMON_PORTABLE_ENGINE_ID]?.sourceRelativePath;
+    if (typeof relative !== "string" || relative !== getDaimonEngineDescriptor(DAIMON_PORTABLE_ENGINE_ID).credentialMaterial.sourceRelativePath) {
         return refused("The installed Daimon Codex credential material differs from this compiler's vendored manifest");
     }
     return relative;
@@ -161,7 +165,7 @@ const leaseCodexSubject = async (options) => {
         invalid("Codex trial roots must not overlap the subject workspace");
     }
     return {
-        agent: { id: options.agentId, engine: "codex", model: options.model },
+        agent: { id: options.agentId, engine: DAIMON_PORTABLE_ENGINE_ID, model: options.model },
         workspace: { source: workspace, target: workspace },
         projections: [{ role: "home", source: home, target: home }, { role: "memory", source: memory, target: memory },
             { role: "transport", source: transport, target: transport }],

package/dist/distribution/imageRuntimeAuth.js

@@ -1,9 +1,9 @@
+import { getDaimonEngineDescriptor } from "../runtime/daimon/index.js";
 import path from "node:path";
 import { loadImportedClaudeCodeCredential, loadImportedCodexCredential } from "../auth/index.js";
 import { fileExists } from "../filesystem/index.js";
 import { getRuntimeAdapter } from "../runtime/index.js";
-import { DAIMON_AGY_SUBSCRIPTION_REALM, DAIMON_ENGINE_CREDENTIALS, DAIMON_GROK_SUBSCRIPTION_REALM } from "../runtime/daimon/contractManifest.js";
-import { assertDaimonCredentialContainerOwner, assertSafeDaimonSourceFile, DAIMON_AGY_UNLOCK_SOURCE_ENV, DAIMON_CREDENTIAL_CONTAINER_UID, daimonSourcePathForEngine } from "../runtime/daimon/runAuth.js";
+import { assertDaimonCredentialContainerOwner, assertSafeDaimonSourceFile, DAIMON_CREDENTIAL_CONTAINER_UID, daimonSourceEnvironmentName, daimonSourcePathForEngine } from "../runtime/daimon/runAuth.js";
 import { SpawnfileError } from "../shared/index.js";
 const importMountTargetName = (kind) => kind === "claude-code" ? ".claude" : ".codex";
 const daimonNodeSlug = (nodeId) => nodeId.replace(/^agent:/u, "").toLowerCase()
@@ -25,7 +25,7 @@ export const prepareDaimonImageAuthMounts = async (instance, environment, authPr
     if (JSON.stringify(engineNodeIds) !== JSON.stringify([...instance.node_ids].sort())) {
         throw new SpawnfileError("validation_error", "Daimon image engine map does not match its declared agents");
     }
-    if (engines.some(([, engine]) => engine !== "agy" && engine !== "codex" && engine !== "grok")) {
+    if (engines.some(([, engine]) => !getDaimonEngineDescriptor(engine))) {
         throw new SpawnfileError("validation_error", "Daimon image report declares an unsupported engine");
     }
     const root = daimonInstanceRoot(instance);
@@ -37,33 +37,42 @@ export const prepareDaimonImageAuthMounts = async (instance, environment, authPr
             throw new SpawnfileError("validation_error", "Daimon image report has an unsafe agent id");
         slugs.set(slug, nodeId);
     }
-    const codexSource = engines.some(([, engine]) => engine === "codex")
-        ? daimonSourcePathForEngine("codex", environment, authProfile) : null;
-    if (codexSource) {
-        const ownerUid = await assertSafeDaimonSourceFile(codexSource, "codex", 64 * 1024, "codex");
-        assertDaimonCredentialContainerOwner(ownerUid, "codex", containerCredentialUid);
-    }
-    for (const [nodeId, engine] of engines) {
-        if (engine !== "codex")
+    const descriptors = [...new Set(engines.map(([, engine]) => engine))]
+        .map((engine) => getDaimonEngineDescriptor(engine));
+    // Keep portable leaves, broker bootstrap, then realm unlock mounts in the
+    // existing order while resolving every engine's staging contract from data.
+    for (const descriptor of descriptors) {
+        if (descriptor.auth.staging !== "portable-file")
             continue;
-        const slug = daimonNodeSlug(nodeId);
-        const target = path.posix.join(root, "runtime-homes", slug, DAIMON_ENGINE_CREDENTIALS.codex.sourceRelativePath);
-        mounts.push("-v", `${codexSource}:${target}:ro`);
+        const source = daimonSourcePathForEngine(descriptor.id, environment, authProfile);
+        const ownerUid = await assertSafeDaimonSourceFile(source, descriptor.id, descriptor.auth.maxCredentialBytes, descriptor.id);
+        assertDaimonCredentialContainerOwner(ownerUid, descriptor.id, containerCredentialUid);
+        for (const [nodeId, engine] of engines) {
+            if (engine !== descriptor.id)
+                continue;
+            const target = path.posix.join(root, "runtime-homes", daimonNodeSlug(nodeId), descriptor.credentialMaterial.sourceRelativePath);
+            mounts.push("-v", `${source}:${target}:ro`);
+        }
     }
-    // The Grok bootstrap leaf is deliberately exempt from the container-owner
-    // assertion; see the matching note in runAuth.ts.
-    if (engines.some(([, engine]) => engine === "grok")) {
-        const source = daimonSourcePathForEngine("grok", environment);
-        await assertSafeDaimonSourceFile(source, "grok", DAIMON_GROK_SUBSCRIPTION_REALM.maxCredentialBytes, "grok");
-        mounts.push("-v", `${source}:${DAIMON_GROK_SUBSCRIPTION_REALM.bootstrapMountPath}:ro`);
+    for (const descriptor of descriptors) {
+        if (descriptor.auth.staging !== "broker-realm")
+            continue;
+        // Broker bootstrap leaves are read and staged by root, so they deliberately
+        // do not require ownership by the eventual organization uid.
+        const source = daimonSourcePathForEngine(descriptor.id, environment);
+        await assertSafeDaimonSourceFile(source, descriptor.id, descriptor.auth.maxCredentialBytes, descriptor.id);
+        mounts.push("-v", `${source}:${descriptor.auth.realm.bootstrapMountPath}:ro`);
     }
-    if (engines.some(([, engine]) => engine === "agy")) {
-        const source = environment[DAIMON_AGY_UNLOCK_SOURCE_ENV]?.trim();
+    for (const descriptor of descriptors) {
+        if (descriptor.auth.staging !== "secret-service")
+            continue;
+        const realm = descriptor.auth.realm;
+        const source = environment[daimonSourceEnvironmentName(realm.unlockSourceSlot)]?.trim();
         if (!source)
             throw new SpawnfileError("validation_error", "Daimon runtime auth is missing the operator-authorized AGY realm unlock artifact");
-        const ownerUid = await assertSafeDaimonSourceFile(source, "AGY realm unlock", DAIMON_AGY_SUBSCRIPTION_REALM.maxUnlockBytes);
+        const ownerUid = await assertSafeDaimonSourceFile(source, "AGY realm unlock", realm.maxUnlockBytes);
         assertDaimonCredentialContainerOwner(ownerUid, "AGY realm unlock", containerCredentialUid);
-        mounts.push("-v", `${source}:${DAIMON_AGY_SUBSCRIPTION_REALM.unlockMountPath}:ro`);
+        mounts.push("-v", `${source}:${realm.unlockMountPath}:ro`);
     }
     return mounts;
 };

package/dist/manifest/executionSchemas.d.ts

@@ -46,10 +46,10 @@ export declare const modelTargetSchema: z.ZodObject<{
     provider: z.ZodString;
     reasoning_effort: z.ZodOptional<z.ZodEnum<{
         none: "none";
-        high: "high";
-        medium: "medium";
-        low: "low";
         minimal: "minimal";
+        low: "low";
+        medium: "medium";
+        high: "high";
         xhigh: "xhigh";
         max: "max";
         ultra: "ultra";
@@ -96,10 +96,10 @@ export declare const executionSchema: z.ZodObject<{
             provider: z.ZodString;
             reasoning_effort: z.ZodOptional<z.ZodEnum<{
                 none: "none";
-                high: "high";
-                medium: "medium";
-                low: "low";
                 minimal: "minimal";
+                low: "low";
+                medium: "medium";
+                high: "high";
                 xhigh: "xhigh";
                 max: "max";
                 ultra: "ultra";
@@ -128,10 +128,10 @@ export declare const executionSchema: z.ZodObject<{
             provider: z.ZodString;
             reasoning_effort: z.ZodOptional<z.ZodEnum<{
                 none: "none";
-                high: "high";
-                medium: "medium";
-                low: "low";
                 minimal: "minimal";
+                low: "low";
+                medium: "medium";
+                high: "high";
                 xhigh: "xhigh";
                 max: "max";
                 ultra: "ultra";

package/dist/manifest/mcpSchemas.d.ts

@@ -9,8 +9,8 @@ export declare const mcpServerSchema: z.ZodObject<{
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     name: z.ZodString;
     transport: z.ZodEnum<{
-        sse: "sse";
         stdio: "stdio";
+        sse: "sse";
         streamable_http: "streamable_http";
     }>;
     tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -33,8 +33,8 @@ export declare const sharedMcpServerSchema: z.ZodObject<{
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     name: z.ZodString;
     transport: z.ZodEnum<{
-        sse: "sse";
         stdio: "stdio";
+        sse: "sse";
         streamable_http: "streamable_http";
     }>;
     tools: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -61,7 +61,7 @@ export type McpServerEntry = McpServerDeclaration | McpServerOverride;
 /** Agent-scope MCP entry: a complete server (has `transport`) or an override of an inherited one. */
 export declare const mcpServerEntrySchema: z.ZodPipe<z.ZodUnknown, z.ZodTransform<{
     name: string;
-    transport: "sse" | "stdio" | "streamable_http";
+    transport: "stdio" | "sse" | "streamable_http";
     args?: string[] | undefined;
     auth?: {
         secret: string;