# SDK export reference

> Find the public builders, runtime interfaces, resource contracts, protocol helpers, and validation families exported by @constal/sdk.

Import from `@constal/sdk`; deep module paths are not public API. The following recipes show the exported families in their intended context.

## Executable definitions {#definitions}

```ts
import {
  agent, subtask,
  validateTool, validateView, validatePartitionFn, validateFoldFn,
  channel, authProvider, policy, credentialProvider,
} from "@constal/sdk";
```

`agent` and `subtask` define runtime work. Validators register Tools, views, and Stage functions. `channel` and `authProvider` own ingress translation and evidence. `policy` defines deterministic authorization. `credentialProvider` defines private Credential lifecycle packages.

## Runtime and Resources {#runtime-resources}

```ts
import {
  type Ctx,
  resourceName, parseResourceName,
  authProviderName, credentialProviderName, credentialName,
  policyName, customerTenantName, bindingName, scopedBindingKey,
} from "@constal/sdk";

const model = resourceName({
  environment: "production", tenant: "acme", namespace: "default",
  kind: "model", path: "support",
});
const parts = parseResourceName(model);
const binding = scopedBindingKey("github");
```

Use a narrow validator whenever a field expects a specific CRN kind. `Ctx` exposes the seven Agent primitives plus Resource invocation, replay-safe local steps, capability requests, analytics, accepted bindings, and immutable Run identity.

## Capability helpers {#capability-helpers}

```ts
import {
  opTool, opTools, webFetch,
  MEMORY_OPERATION_DECLARATIONS,
  analyticsEvent, hashValue,
  sandboxInvoke, sandboxWebFetch,
} from "@constal/sdk";

const githubTools = opTools("github", ["issue.get", "issue.create"]);
const search = opTool("memory", "search", { name: "search_memory" });
const event = analyticsEvent({ id: "support.resolved", version: "1", dimensions: ["queue"], metrics: [] } as const);
const identity = await hashValue({ event: event.id, version: event.version });
```

Model protocol and network-policy helpers are exported from the same root. Use them only for the Resource contract they validate.

## Errors and compatibility {#errors}

```ts
import { OutcomeUnknown, PolicyDecisionFailed } from "@constal/sdk";

try {
  return await ctx.invoke(ctx.resources.payments!, "charge", request);
} catch (error) {
  if (error instanceof OutcomeUnknown) throw error; // reconcile; never retry blindly
  if (error instanceof PolicyDecisionFailed) return { refused: true };
  throw error;
}
```

Stable error classes preserve recovery meaning. Deployment manifests, Platform API payloads, and Console operations are separate contracts; do not invent them from SDK types.