/**
 * The agent-session GUEST. This module is bundled by `bundle.ts` with the
 * lane's own esbuild options and executed inside the isolate, so it must stay
 * portable: no `node:` import, no host module, nothing the guest prelude does
 * not provide.
 *
 * It runs Pi's original AgentSession with an in-memory SessionManager. The
 * provider call is pi-ai's fetch-native Anthropic or OpenAI path, which
 * reaches the network through the prelude's streaming `fetch` and therefore
 * through the host's one egress module. A tool call is
 * the same kind of request to the same host: the gateway's MCP route, over the
 * same `fetch`, under the same allowlist. A workspace tool never leaves the
 * isolate at all: `bash` is just-bash over an in-memory filesystem that lives
 * for this turn.
 *
 * The turn holds ONE credential and never a real one. `provider.apiKey` is the
 * host's vault placeholder over the gateway's per-turn worker token; the host
 * swaps it into the outbound header, the secret proxy accepts it as the
 * provider credential and the MCP route accepts it as the bearer.
 */
import type { AgentTurnEvent, AgentTurnInput, AgentTurnOutput, AgentTurnSteer, RuntimeExecRequest, RuntimeExecResult } from './types.js';
/**
 * Run one turn and resolve with its native Pi session checkpoint.
 *
 * `emit` is the host bridge: every call crosses into the worker while the
 * stream is still open, so deltas arrive while the turn is running.
 */
export declare function runAgentTurn(input: AgentTurnInput, emit: (event: AgentTurnEvent) => void, takeSteering?: () => AgentTurnSteer[], runtimeExec?: (request: RuntimeExecRequest) => Promise<RuntimeExecResult>): Promise<AgentTurnOutput>;
//# sourceMappingURL=guest-entry.d.ts.map