@buoy-gg/agent-core 7.0.35 → 7.0.38

package/lib/module/providers/xhrStream.js

@@ -0,0 +1,207 @@
+"use strict";
+
+/**
+ * Streaming over `XMLHttpRequest`, for the runtimes where `fetch` cannot.
+ *
+ * React Native core still has no `response.body`: its `fetch` is the whatwg
+ * polyfill over XHR and resolves inside `xhr.onload`, i.e. after the ENTIRE
+ * body. Under Expo the global is `expo/fetch`, which does stream — but
+ * `EXPO_PUBLIC_USE_RN_FETCH=1` reverts that, and the bare-RN CLI, TV CLI and
+ * NativeScript lanes never had it at all. On those, every Ask Buoy answer
+ * appeared in one lump, however long the model took.
+ *
+ * XHR itself has streamed the whole time. `responseText` grows as bytes arrive
+ * and `onprogress` fires as it does, so slicing from the last offset gives the
+ * same incremental text a reader would. Two conditions, both easy to miss:
+ * the progress handler must be installed BEFORE `send()`, and `responseType`
+ * must stay text — anything else stops RN emitting progress at all.
+ *
+ * WHAT THIS IS NOT. It is not a second SSE parser: framing, the truncation
+ * rule and the terminal-marker contract all live in `sse.ts` and are shared
+ * verbatim. This file only produces text chunks.
+ */
+import { framesFrom } from "./sse";
+
+/** Beyond this the answer is not an answer any more; stop reading. */
+const MAX_RESPONSE_CHARS = 8_000_000;
+export function xhrAvailable() {
+  return typeof XMLHttpRequest === "function";
+}
+
+/**
+ * Send the request and resolve once the HEADERS are in, so the caller can
+ * check the status and content type before deciding to read a stream — the
+ * same shape `fetch` offers, and the reason this can slot in beside it.
+ */
+export function xhrStream(req) {
+  return new Promise((resolveHeaders, rejectHeaders) => {
+    const xhr = new XMLHttpRequest();
+
+    /** Text seen but not yet handed to a consumer. */
+    const queue = [];
+    /** Resolvers for a consumer parked on an empty queue. */
+    const waiters = [];
+    let offset = 0;
+    let done = false;
+    let failure;
+    let headersSeen = false;
+    let capped = false;
+    const wake = () => {
+      while (waiters.length) waiters.shift()();
+    };
+    const pull = () => {
+      // `responseText` is the WHOLE body so far, so the delta is everything
+      // past what was already taken. RN keeps the full string either way;
+      // the offset bounds the work, not the memory.
+      let text;
+      try {
+        text = xhr.responseText ?? "";
+      } catch {
+        return; // Not readable yet on some runtimes; the next event will do.
+      }
+      if (text.length <= offset) return;
+      if (text.length > MAX_RESPONSE_CHARS) {
+        capped = true;
+        failure = new Error("The endpoint sent more than this tool will read.");
+        done = true;
+        try {
+          xhr.abort();
+        } catch {
+          /* already gone */
+        }
+        wake();
+        return;
+      }
+      queue.push(text.slice(offset));
+      offset = text.length;
+      wake();
+    };
+    const settleHeaders = () => {
+      if (headersSeen) return;
+      headersSeen = true;
+      let contentType = "";
+      let retryAfter = null;
+      try {
+        contentType = xhr.getResponseHeader("content-type") ?? "";
+        retryAfter = xhr.getResponseHeader("retry-after");
+      } catch {
+        contentType = "";
+      }
+      resolveHeaders({
+        status: xhr.status,
+        ok: xhr.status >= 200 && xhr.status < 300,
+        contentType,
+        retryAfter,
+        async text() {
+          // Whatever has arrived. For a non-2xx that is the error body; the
+          // request is over by the time anyone asks.
+          await new Promise(r => {
+            if (done) return r();
+            waiters.push(() => r());
+          });
+          try {
+            return xhr.responseText ?? "";
+          } catch {
+            return "";
+          }
+        },
+        frames(options) {
+          return framesFrom(chunks(), options);
+        }
+      });
+    };
+    async function* chunks() {
+      try {
+        for (;;) {
+          while (queue.length) yield queue.shift();
+          if (done) break;
+          await new Promise(r => waiters.push(r));
+        }
+        while (queue.length) yield queue.shift();
+        if (failure) throw failure;
+      } finally {
+        if (!done) {
+          // The consumer left early — a completed turn, a Stop, a timeout.
+          // Nothing else will read this socket.
+          try {
+            xhr.abort();
+          } catch {
+            /* already gone */
+          }
+        }
+      }
+    }
+    const onAbort = () => {
+      try {
+        xhr.abort();
+      } catch {
+        /* already gone */
+      }
+    };
+    xhr.onreadystatechange = () => {
+      // HEADERS_RECEIVED. Status and content type are known here, long before
+      // the body finishes — which is the whole point of using XHR directly.
+      if (xhr.readyState === 2) settleHeaders();
+    };
+    xhr.onprogress = () => {
+      settleHeaders();
+      pull();
+    };
+    xhr.onload = () => {
+      settleHeaders();
+      if (!capped) pull();
+      done = true;
+      wake();
+    };
+    xhr.onerror = () => {
+      failure = new Error("The request failed before it finished.");
+      done = true;
+      if (!headersSeen) {
+        headersSeen = true;
+        rejectHeaders(failure);
+      }
+      wake();
+    };
+    xhr.onabort = () => {
+      const err = new Error("Aborted");
+      err.name = "AbortError";
+      failure = err;
+      done = true;
+      if (!headersSeen) {
+        headersSeen = true;
+        rejectHeaders(err);
+      }
+      wake();
+    };
+    xhr.ontimeout = () => {
+      failure = new Error("The request timed out.");
+      done = true;
+      if (!headersSeen) {
+        headersSeen = true;
+        rejectHeaders(failure);
+      }
+      wake();
+    };
+    try {
+      xhr.open("POST", req.url, true);
+      // Text, and nothing else: RN emits no progress events for any other
+      // response type, which turns this back into a buffered read in silence.
+      xhr.responseType = "text";
+      for (const [k, v] of Object.entries(req.headers)) {
+        try {
+          xhr.setRequestHeader(k, v);
+        } catch {
+          /* a header the runtime forbids is not worth failing the turn over */
+        }
+      }
+      if (req.signal) {
+        if (req.signal.aborted) onAbort();else req.signal.addEventListener?.("abort", onAbort);
+      }
+      xhr.send(req.body);
+    } catch (err) {
+      headersSeen = true;
+      rejectHeaders(err instanceof Error ? err : new Error(String(err)));
+    }
+  });
+}
+//# sourceMappingURL=xhrStream.js.map

package/lib/module/providers/xhrStream.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["framesFrom","MAX_RESPONSE_CHARS","xhrAvailable","XMLHttpRequest","xhrStream","req","Promise","resolveHeaders","rejectHeaders","xhr","queue","waiters","offset","done","failure","headersSeen","capped","wake","length","shift","pull","text","responseText","Error","abort","push","slice","settleHeaders","contentType","retryAfter","getResponseHeader","status","ok","r","frames","options","chunks","onAbort","onreadystatechange","readyState","onprogress","onload","onerror","onabort","err","name","ontimeout","open","url","responseType","k","v","Object","entries","headers","setRequestHeader","signal","aborted","addEventListener","send","body","String"],"sourceRoot":"../../../src","sources":["providers/xhrStream.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,UAAU,QAA4C,OAAO;;AAEtE;AACA,MAAMC,kBAAkB,GAAG,SAAS;AAoBpC,OAAO,SAASC,YAAYA,CAAA,EAAY;EACtC,OAAO,OAAOC,cAAc,KAAK,UAAU;AAC7C;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,SAASA,CAACC,GAAqB,EAA8B;EAC3E,OAAO,IAAIC,OAAO,CAAoB,CAACC,cAAc,EAAEC,aAAa,KAAK;IACvE,MAAMC,GAAG,GAAG,IAAIN,cAAc,CAAC,CAAC;;IAEhC;IACA,MAAMO,KAAe,GAAG,EAAE;IAC1B;IACA,MAAMC,OAA0B,GAAG,EAAE;IACrC,IAAIC,MAAM,GAAG,CAAC;IACd,IAAIC,IAAI,GAAG,KAAK;IAChB,IAAIC,OAA0B;IAC9B,IAAIC,WAAW,GAAG,KAAK;IACvB,IAAIC,MAAM,GAAG,KAAK;IAElB,MAAMC,IAAI,GAAGA,CAAA,KAAM;MACjB,OAAON,OAAO,CAACO,MAAM,EAAEP,OAAO,CAACQ,KAAK,CAAC,CAAC,CAAE,CAAC;IAC3C,CAAC;IAED,MAAMC,IAAI,GAAGA,CAAA,KAAM;MACjB;MACA;MACA;MACA,IAAIC,IAAY;MAChB,IAAI;QACFA,IAAI,GAAGZ,GAAG,CAACa,YAAY,IAAI,EAAE;MAC/B,CAAC,CAAC,MAAM;QACN,OAAO,CAAC;MACV;MACA,IAAID,IAAI,CAACH,MAAM,IAAIN,MAAM,EAAE;MAC3B,IAAIS,IAAI,CAACH,MAAM,GAAGjB,kBAAkB,EAAE;QACpCe,MAAM,GAAG,IAAI;QACbF,OAAO,GAAG,IAAIS,KAAK,CAAC,kDAAkD,CAAC;QACvEV,IAAI,GAAG,IAAI;QACX,IAAI;UACFJ,GAAG,CAACe,KAAK,CAAC,CAAC;QACb,CAAC,CAAC,MAAM;UACN;QAAA;QAEFP,IAAI,CAAC,CAAC;QACN;MACF;MACAP,KAAK,CAACe,IAAI,CAACJ,IAAI,CAACK,KAAK,CAACd,MAAM,CAAC,CAAC;MAC9BA,MAAM,GAAGS,IAAI,CAACH,MAAM;MACpBD,IAAI,CAAC,CAAC;IACR,CAAC;IAED,MAAMU,aAAa,GAAGA,CAAA,KAAM;MAC1B,IAAIZ,WAAW,EAAE;MACjBA,WAAW,GAAG,IAAI;MAClB,IAAIa,WAAW,GAAG,EAAE;MACpB,IAAIC,UAAyB,GAAG,IAAI;MACpC,IAAI;QACFD,WAAW,GAAGnB,GAAG,CAACqB,iBAAiB,CAAC,cAAc,CAAC,IAAI,EAAE;QACzDD,UAAU,GAAGpB,GAAG,CAACqB,iBAAiB,CAAC,aAAa,CAAC;MACnD,CAAC,CAAC,MAAM;QACNF,WAAW,GAAG,EAAE;MAClB;MACArB,cAAc,CAAC;QACbwB,MAAM,EAAEtB,GAAG,CAACsB,MAAM;QAClBC,EAAE,EAAEvB,GAAG,CAACsB,MAAM,IAAI,GAAG,IAAItB,GAAG,CAACsB,MAAM,GAAG,GAAG;QACzCH,WAAW;QACXC,UAAU;QACV,MAAMR,IAAIA,CAAA,EAAG;UACX;UACA;UACA,MAAM,IAAIf,OAAO,CAAQ2B,CAAC,IAAK;YAC7B,IAAIpB,IAAI,EAAE,OAAOoB,CAAC,CAAC,CAAC;YACpBtB,OAAO,CAACc,IAAI,CAAC,MAAMQ,CAAC,CAAC,CAAC,CAAC;UACzB,CAAC,CAAC;UACF,IAAI;YACF,OAAOxB,GAAG,CAACa,YAAY,IAAI,EAAE;UAC/B,CAAC,CAAC,MAAM;YACN,OAAO,EAAE;UACX;QACF,CAAC;QACDY,MAAMA,CAACC,OAAwB,EAAE;UAC/B,OAAOnC,UAAU,CAACoC,MAAM,CAAC,CAAC,EAAED,OAAO,CAAC;QACtC;MACF,CAAC,CAAC;IACJ,CAAC;IAED,gBAAgBC,MAAMA,CAAA,EAAuC;MAC3D,IAAI;QACF,SAAS;UACP,OAAO1B,KAAK,CAACQ,MAAM,EAAE,MAAMR,KAAK,CAACS,KAAK,CAAC,CAAE;UACzC,IAAIN,IAAI,EAAE;UACV,MAAM,IAAIP,OAAO,CAAQ2B,CAAC,IAAKtB,OAAO,CAACc,IAAI,CAACQ,CAAC,CAAC,CAAC;QACjD;QACA,OAAOvB,KAAK,CAACQ,MAAM,EAAE,MAAMR,KAAK,CAACS,KAAK,CAAC,CAAE;QACzC,IAAIL,OAAO,EAAE,MAAMA,OAAO;MAC5B,CAAC,SAAS;QACR,IAAI,CAACD,IAAI,EAAE;UACT;UACA;UACA,IAAI;YACFJ,GAAG,CAACe,KAAK,CAAC,CAAC;UACb,CAAC,CAAC,MAAM;YACN;UAAA;QAEJ;MACF;IACF;IAEA,MAAMa,OAAO,GAAGA,CAAA,KAAM;MACpB,IAAI;QACF5B,GAAG,CAACe,KAAK,CAAC,CAAC;MACb,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ,CAAC;IAEDf,GAAG,CAAC6B,kBAAkB,GAAG,MAAM;MAC7B;MACA;MACA,IAAI7B,GAAG,CAAC8B,UAAU,KAAK,CAAC,EAAEZ,aAAa,CAAC,CAAC;IAC3C,CAAC;IACDlB,GAAG,CAAC+B,UAAU,GAAG,MAAM;MACrBb,aAAa,CAAC,CAAC;MACfP,IAAI,CAAC,CAAC;IACR,CAAC;IACDX,GAAG,CAACgC,MAAM,GAAG,MAAM;MACjBd,aAAa,CAAC,CAAC;MACf,IAAI,CAACX,MAAM,EAAEI,IAAI,CAAC,CAAC;MACnBP,IAAI,GAAG,IAAI;MACXI,IAAI,CAAC,CAAC;IACR,CAAC;IACDR,GAAG,CAACiC,OAAO,GAAG,MAAM;MAClB5B,OAAO,GAAG,IAAIS,KAAK,CAAC,wCAAwC,CAAC;MAC7DV,IAAI,GAAG,IAAI;MACX,IAAI,CAACE,WAAW,EAAE;QAChBA,WAAW,GAAG,IAAI;QAClBP,aAAa,CAACM,OAAO,CAAC;MACxB;MACAG,IAAI,CAAC,CAAC;IACR,CAAC;IACDR,GAAG,CAACkC,OAAO,GAAG,MAAM;MAClB,MAAMC,GAAG,GAAG,IAAIrB,KAAK,CAAC,SAAS,CAAC;MAChCqB,GAAG,CAACC,IAAI,GAAG,YAAY;MACvB/B,OAAO,GAAG8B,GAAG;MACb/B,IAAI,GAAG,IAAI;MACX,IAAI,CAACE,WAAW,EAAE;QAChBA,WAAW,GAAG,IAAI;QAClBP,aAAa,CAACoC,GAAG,CAAC;MACpB;MACA3B,IAAI,CAAC,CAAC;IACR,CAAC;IACDR,GAAG,CAACqC,SAAS,GAAG,MAAM;MACpBhC,OAAO,GAAG,IAAIS,KAAK,CAAC,wBAAwB,CAAC;MAC7CV,IAAI,GAAG,IAAI;MACX,IAAI,CAACE,WAAW,EAAE;QAChBA,WAAW,GAAG,IAAI;QAClBP,aAAa,CAACM,OAAO,CAAC;MACxB;MACAG,IAAI,CAAC,CAAC;IACR,CAAC;IAED,IAAI;MACFR,GAAG,CAACsC,IAAI,CAAC,MAAM,EAAE1C,GAAG,CAAC2C,GAAG,EAAE,IAAI,CAAC;MAC/B;MACA;MACAvC,GAAG,CAACwC,YAAY,GAAG,MAAM;MACzB,KAAK,MAAM,CAACC,CAAC,EAAEC,CAAC,CAAC,IAAIC,MAAM,CAACC,OAAO,CAAChD,GAAG,CAACiD,OAAO,CAAC,EAAE;QAChD,IAAI;UACF7C,GAAG,CAAC8C,gBAAgB,CAACL,CAAC,EAAEC,CAAC,CAAC;QAC5B,CAAC,CAAC,MAAM;UACN;QAAA;MAEJ;MACA,IAAI9C,GAAG,CAACmD,MAAM,EAAE;QACd,IAAInD,GAAG,CAACmD,MAAM,CAACC,OAAO,EAAEpB,OAAO,CAAC,CAAC,CAAC,KAC7BhC,GAAG,CAACmD,MAAM,CAACE,gBAAgB,GAAG,OAAO,EAAErB,OAAO,CAAC;MACtD;MACA5B,GAAG,CAACkD,IAAI,CAACtD,GAAG,CAACuD,IAAI,CAAC;IACpB,CAAC,CAAC,OAAOhB,GAAG,EAAE;MACZ7B,WAAW,GAAG,IAAI;MAClBP,aAAa,CAACoC,GAAG,YAAYrB,KAAK,GAAGqB,GAAG,GAAG,IAAIrB,KAAK,CAACsC,MAAM,CAACjB,GAAG,CAAC,CAAC,CAAC;IACpE;EACF,CAAC,CAAC;AACJ","ignoreList":[]}

package/lib/module/session.js

@@ -6,51 +6,22 @@
  * This is the one-call surface the UI packages use. It owns the pieces that
  * have to agree with each other across a whole session — the provider, the
  * catalog filtered to what this device can actually do, the system prompt
- * (built once, after grounding), the effect ledger, and the message history —
+ * (the stable part built once after grounding, the RIGHT NOW part re-read every
+ * turn), the effect ledger, and the message history —
  * so a chat UI is a message list plus a text box rather than an orchestrator.
  */
 import { CATALOG } from "./catalog/catalog.g";
-import { buildContextDigest } from "./context/buildContextPack";
+import { buildContextDigest, buildLiveContext } from "./context/buildContextPack";
 import { runAgentTurn } from "./engine/runAgentTurn";
-import { buildSystemPrompt } from "./engine/systemPrompt";
+import { buildLiveBlock, buildSystemPrompt, listableProcedures } from "./engine/systemPrompt";
 import { EffectLedger } from "./effects/ledger";
+import { EvidenceStore } from "./engine/evidence";
+import { TokenCalibration } from "./engine/tokenCalibration";
+import { compressConsumed, trimHistory, trimHistoryReport } from "./engine/historyBudget";
 import { createAnthropicProvider } from "./providers/anthropic";
 import { createOpenAIProvider } from "./providers/openai";
 import { resolveRequireApproval } from "./policy/policy";
 import { registerSelfEndpoint } from "./policy/redact";
-/**
- * A long QA session must not die on the provider's context limit with an
- * opaque error — the transcript grows without bound (tool results are the
- * heavy part), so the OLDEST rounds are dropped once the history passes a
- * budget. Rounds are dropped whole — a round starts at a user message — so
- * the assistant/tool-result pairing every provider requires stays intact and
- * the history still begins with a user message.
- */
-const MAX_HISTORY_CHARS = 150_000;
-const MIN_KEEP_MESSAGES = 4;
-function messageSize(m) {
-  try {
-    return JSON.stringify(m).length;
-  } catch {
-    return 0;
-  }
-}
-function trimHistory(messages) {
-  let total = 0;
-  for (const m of messages) total += messageSize(m);
-  if (total <= MAX_HISTORY_CHARS) return messages;
-  const out = [...messages];
-  while (out.length > MIN_KEEP_MESSAGES && total > MAX_HISTORY_CHARS) {
-    total -= messageSize(out[0]);
-    out.shift();
-    while (out.length > MIN_KEEP_MESSAGES && out[0].role !== "user") {
-      total -= messageSize(out[0]);
-      out.shift();
-    }
-  }
-  return out;
-}
-
 /**
  * A stored history, made safe to send as the start of a new request.
  *
@@ -67,6 +38,9 @@ function trimHistory(messages) {
  * always resumes with a fresh user message instead, so their signatures are
  * dead weight at best and a stale-signature 400 at worst.
  */
+// Re-exported: these were defined here before the engine needed them too, and
+// the tests and the package surface still reach them through this module.
+export { compressConsumed, trimHistory, trimHistoryReport };
 export function resumableHistory(history) {
   let end = history.length;
   while (end > 0) {
@@ -84,8 +58,60 @@ export function createAskBuoySession(config) {
   const ledger = new EffectLedger();
   const policy = config.policy ?? {};
   let messages = [];
+  /**
+   * Image-URL provenance for the whole conversation, not one turn of it.
+   *
+   * "Show me the shop as pictures" and "no, actually render them" are two
+   * turns; the second has no tool calls of its own, so a per-turn set held
+   * nothing and every image was stripped out from under the model. It kept
+   * describing artwork that was not on screen. The rule is unchanged — a URL
+   * still has to have been READ — the window is just the conversation. Reset
+   * with the conversation.
+   */
+  const seenUrls = new Set();
+  /**
+   * Every result's full text, for `ask-buoy.retrieve` — see engine/evidence.ts.
+   * Conversation-scoped like `seenUrls`: "what were the stats in that response"
+   * is a normal second message. Cleared with the conversation; never persisted.
+   */
+  const evidence = new EvidenceStore();
+  /** Chars-per-token as measured on THIS session's provider — see engine/tokenCalibration.ts. */
+  const calibration = new TokenCalibration();
   let system;
   let primed = false;
+  /** See `setApprovalBypass`. Consulted per turn, never captured. */
+  let bypassApproval = false;
+  /** Actions the user waived the card for in this conversation — see RunTurnInput.trusted. */
+  const trusted = new Set();
+  /** See `setReadOnly`. */
+  let deviceReadOnly = false;
+  /**
+   * Rounds dropped by `restore` — reported on the first send, because there is
+   * no open turn to carry the event when the restore happens.
+   */
+  let trimmedOnRestore = 0;
+  /**
+   * Which conversation is live. Bumped by `reset`.
+   *
+   * A turn's history is committed when its generator drains, and a turn does
+   * not stop the moment Stop is pressed — an in-flight dispatch has to settle
+   * first, and nothing can pull a store write back out of an adapter. So the
+   * sequence Stop -> "New conversation" -> the write finishes used to end with
+   * the OLD turn assigning its whole history over the empty one: a chat the
+   * user had just cleared came back, carrying a change they never saw made.
+   * The turn still finishes and its effect still lands in the app; it simply
+   * no longer owns a conversation that has moved on.
+   */
+  let generation = 0;
+  /**
+   * The grounding probe's result, held past `prime`.
+   *
+   * The system prompt is a pure function of this plus the policy, and the
+   * approval paragraph changes when the device toggle does — holding the
+   * digest lets the prompt be rebuilt without re-probing the app for state it
+   * already read.
+   */
+  let digest = {};
   /**
    * `storage key -> the live store that owns it`, derived from the grounding.
    *
@@ -99,16 +125,63 @@ export function createAskBuoySession(config) {
   // So the agent's own requests to the model endpoint never come back to it
   // out of the network tool — that would feed it its own auth headers.
   registerSelfEndpoint(config.endpoint);
-  const provider = config.protocol === "openai" ? createOpenAIProvider(config) : createAnthropicProvider(config);
+  const provider = config.provider ?? (config.protocol === "openai" ? createOpenAIProvider(config) : createAnthropicProvider(config));
 
   // Mutable: the device's tool list fills in over the first frames and can
   // change while the sheet is open. See setAvailableActions.
   let availableActions = config.availableActions;
   let availableToolIds = Object.keys(availableActions);
+
+  /**
+   * THE policy object the engine reads, mutated in place.
+   *
+   * One object for the life of the session, not a fresh one per turn: the
+   * engine reads `policy.readOnly` and the approval lists at each call, so a
+   * toggle flipped mid-turn lands on the very next call of that turn. A new
+   * object per turn would leave a running turn on the old rules until it
+   * finished — "Read only" switched on while the agent was writing would let
+   * the rest of the batch through.
+   */
+  const live = {
+    ...policy
+  };
+  function refreshLive() {
+    for (const k of Object.keys(live)) delete live[k];
+    Object.assign(live, policy);
+    if (bypassApproval) {
+      live.requireApproval = [];
+      live.requireApprovalFor = [];
+    }
+    // OR, never override: the device can narrow, the app's own read-only stands.
+    if (deviceReadOnly) live.readOnly = true;
+  }
+  function activePolicy() {
+    return live;
+  }
+  function composeSystem() {
+    system = buildSystemPrompt({
+      catalog,
+      context: {
+        ...config.context,
+        digest: {
+          ...digest,
+          ...config.context?.digest
+        }
+      },
+      isRelease: config.isRelease,
+      readOnly: live.readOnly ?? false,
+      readOnlySource: policy.readOnly ? "app" : deviceReadOnly ? "device" : undefined,
+      requireApproval: resolveRequireApproval(live),
+      approvalsBypassed: bypassApproval,
+      appName: config.appName,
+      platform: config.platform,
+      availableToolIds
+    });
+  }
   async function prime() {
     if (primed) return;
     primed = true;
-    let digest = {};
+    digest = {};
     try {
       digest = await buildContextDigest({
         dispatch: config.dispatch,
@@ -125,24 +198,16 @@ export function createAskBuoySession(config) {
       const store = raw;
       if (store?.persistsTo && store.name) storeKeyOwners[store.persistsTo] = store.name;
     }
-    system = buildSystemPrompt({
-      catalog,
-      context: {
-        ...config.context,
-        digest: {
-          ...digest,
-          ...config.context?.digest
-        }
-      },
-      isRelease: config.isRelease,
-      readOnly: policy.readOnly ?? false,
-      requireApproval: resolveRequireApproval(policy),
-      appName: config.appName,
-      platform: config.platform
-    });
+    composeSystem();
   }
   return {
     ledger,
+    evidence,
+    calibration,
+    trustedActions: () => [...trusted],
+    untrust: key => {
+      trusted.delete(key);
+    },
     get messages() {
       return messages;
     },
@@ -151,35 +216,128 @@ export function createAskBuoySession(config) {
       availableActions = actions;
       availableToolIds = Object.keys(actions);
     },
+    setApprovalBypass(enabled) {
+      if (bypassApproval === enabled) return;
+      bypassApproval = enabled;
+      refreshLive();
+      // The prompt tells the model whether a card will appear before its
+      // change lands; leaving that paragraph stale would have it announce an
+      // approval step that no longer exists. Rebuilt from the held digest, so
+      // toggling mid-conversation costs nothing and re-reads nothing.
+      if (system) composeSystem();
+    },
+    setReadOnly(enabled) {
+      if (deviceReadOnly === enabled) return;
+      deviceReadOnly = enabled;
+      refreshLive();
+      if (system) composeSystem();
+    },
     restore(history) {
       // Only into a session that has not been talked to. Restoring over a live
       // conversation would drop whatever was said since the app started.
       if (messages.length > 0) return;
-      messages = trimHistory(resumableHistory(history));
+      const report = trimHistoryReport(resumableHistory(history), calibration.charsPerToken, ledger.liveCallIds());
+      messages = report.messages;
+      trimmedOnRestore = report.droppedRounds;
     },
     async *send(text, signal) {
+      /**
+       * Captured FIRST, before any await.
+       *
+       * Priming and the live-context probes are awaits like any other, and a
+       * reset can land inside them. Reading the generation after them would
+       * pick up the NEW conversation's value and let this turn commit into it —
+       * the precise bug this guards against, reintroduced one line lower.
+       */
+      const myGeneration = generation;
       await prime();
-      messages.push({
+      // The RIGHT NOW block: re-read on EVERY turn, not once at open. The
+      // stable digest above was once the whole picture, and it was built
+      // before the user had navigated anywhere — so the query that owned the
+      // screen they were looking at was simply not in the prompt. This is the
+      // uncached tail of the system prompt (see ProviderRequest.systemVolatile).
+      let live;
+      try {
+        live = await buildLiveContext({
+          dispatch: config.dispatch,
+          readSnapshot: config.readSnapshot,
+          availableToolIds,
+          availableActions
+        });
+      } catch {
+        live = undefined;
+      }
+      /**
+       * The conversation was cleared while this turn was still getting ready.
+       *
+       * Priming and the live probes take real time, so "New conversation"
+       * lands here often enough to matter. Abandoning now costs nothing: the
+       * model has not been asked anything yet.
+       */
+      if (myGeneration !== generation) {
+        yield {
+          type: "done",
+          stopReason: "superseded"
+        };
+        return;
+      }
+
+      /**
+       * The turn works on its OWN array, and `messages` is assigned in exactly
+       * one place — the commit at the bottom.
+       *
+       * `runAgentTurn` pushes each round into the array it is handed. Handing
+       * it the session's own array made every push a live edit of session
+       * state, so a turn racing a reset wrote its whole history into the new
+       * conversation one push at a time and the commit guard had nothing left
+       * to protect. Copying makes ownership checkable in one place instead of
+       * spread across the loop.
+       */
+      const trimmed = trimHistoryReport([...messages, {
         role: "user",
         text
-      });
-      messages = trimHistory(messages);
+      }], calibration.charsPerToken, ledger.liveCallIds());
+      const working = trimmed.messages;
+      // Said once, before the answer it affects. The screen still shows the
+      // rounds the model just lost; this is the only thing that tells the two
+      // apart. See the `history-trimmed` event.
+      const droppedRounds = trimmed.droppedRounds + trimmedOnRestore;
+      trimmedOnRestore = 0;
+      if (droppedRounds > 0) yield {
+        type: "history-trimmed",
+        droppedRounds,
+        droppedPinned: trimmed.droppedPinned
+      };
       const gen = runAgentTurn({
         provider,
         catalog,
-        messages,
+        messages: working,
         system: system,
+        systemVolatile: buildLiveBlock(live,
+        // What this conversation has already done to the app. See
+        // buildLiveBlock — without it the model answers "what have you
+        // changed?" from memory of its own sentences, and reports a value it
+        // overwrote itself as the app's own.
+        ledger.list().map(e => ({
+          label: `${e.toolId}.${e.action}${e.effect.label ? ` — ${e.effect.label}` : ""}`,
+          undone: e.undoneAt !== undefined
+        }))),
         model: config.model,
         maxTokens: config.maxTokens ?? 4096,
         dispatch: config.dispatch,
         readSnapshot: config.readSnapshot,
         storeKeyOwners,
         ledger,
-        policy,
+        policy: activePolicy(),
         isRelease: config.isRelease,
         availableToolIds,
         availableActions,
         requestApproval: config.requestApproval,
+        seenUrls,
+        evidence,
+        calibration,
+        trusted,
+        procedures: listableProcedures(config.context?.procedures, availableToolIds),
         signal
       });
       let next = await gen.next();
@@ -188,11 +346,19 @@ export function createAskBuoySession(config) {
         next = await gen.next();
       }
       // The generator's return value is the full history including tool turns.
-      messages = next.value;
+      // Committed only if this turn still owns the conversation — see
+      // `generation`.
+      if (myGeneration === generation) messages = next.value;
     },
     reset() {
+      // Before anything else: a turn still draining must not commit over this.
+      generation += 1;
       messages = [];
+      trimmedOnRestore = 0;
       ledger.clear();
+      seenUrls.clear();
+      evidence.clear();
+      trusted.clear();
       // The grounding digest is a snapshot of the app AT OPEN — stores and
       // routes registered since are invisible to it. A new conversation is
       // the natural moment to re-read the world.

package/lib/module/session.js.map

@@ -1 +1 @@
-{"version":3,"names":["CATALOG","buildContextDigest","runAgentTurn","buildSystemPrompt","EffectLedger","createAnthropicProvider","createOpenAIProvider","resolveRequireApproval","registerSelfEndpoint","MAX_HISTORY_CHARS","MIN_KEEP_MESSAGES","messageSize","m","JSON","stringify","length","trimHistory","messages","total","out","shift","role","resumableHistory","history","end","toolCalls","slice","map","thinking","undefined","createAskBuoySession","config","catalog","ledger","policy","system","primed","storeKeyOwners","endpoint","provider","protocol","availableActions","availableToolIds","Object","keys","prime","digest","dispatch","readSnapshot","raw","zustandStores","store","persistsTo","name","context","isRelease","readOnly","requireApproval","appName","platform","setAvailableActions","actions","restore","send","text","signal","push","gen","model","maxTokens","requestApproval","next","done","value","reset","clear"],"sourceRoot":"../../src","sources":["session.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,OAAO,QAAQ,qBAAqB;AAC7C,SAASC,kBAAkB,QAAQ,4BAA4B;AAC/D,SAASC,YAAY,QAAwB,uBAAuB;AACpE,SAASC,iBAAiB,QAA0B,uBAAuB;AAC3E,SAASC,YAAY,QAAQ,kBAAkB;AAC/C,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,oBAAoB,QAAQ,oBAAoB;AAEzD,SAASC,sBAAsB,QAA4B,iBAAiB;AAC5E,SAASC,oBAAoB,QAAQ,iBAAiB;AA6DtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,iBAAiB,GAAG,OAAO;AACjC,MAAMC,iBAAiB,GAAG,CAAC;AAE3B,SAASC,WAAWA,CAACC,CAAe,EAAU;EAC5C,IAAI;IACF,OAAOC,IAAI,CAACC,SAAS,CAACF,CAAC,CAAC,CAACG,MAAM;EACjC,CAAC,CAAC,MAAM;IACN,OAAO,CAAC;EACV;AACF;AAEA,SAASC,WAAWA,CAACC,QAAwB,EAAkB;EAC7D,IAAIC,KAAK,GAAG,CAAC;EACb,KAAK,MAAMN,CAAC,IAAIK,QAAQ,EAAEC,KAAK,IAAIP,WAAW,CAACC,CAAC,CAAC;EACjD,IAAIM,KAAK,IAAIT,iBAAiB,EAAE,OAAOQ,QAAQ;EAE/C,MAAME,GAAG,GAAG,CAAC,GAAGF,QAAQ,CAAC;EACzB,OAAOE,GAAG,CAACJ,MAAM,GAAGL,iBAAiB,IAAIQ,KAAK,GAAGT,iBAAiB,EAAE;IAClES,KAAK,IAAIP,WAAW,CAACQ,GAAG,CAAC,CAAC,CAAE,CAAC;IAC7BA,GAAG,CAACC,KAAK,CAAC,CAAC;IACX,OAAOD,GAAG,CAACJ,MAAM,GAAGL,iBAAiB,IAAIS,GAAG,CAAC,CAAC,CAAC,CAAEE,IAAI,KAAK,MAAM,EAAE;MAChEH,KAAK,IAAIP,WAAW,CAACQ,GAAG,CAAC,CAAC,CAAE,CAAC;MAC7BA,GAAG,CAACC,KAAK,CAAC,CAAC;IACb;EACF;EACA,OAAOD,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASG,gBAAgBA,CAACC,OAAuB,EAAkB;EACxE,IAAIC,GAAG,GAAGD,OAAO,CAACR,MAAM;EACxB,OAAOS,GAAG,GAAG,CAAC,EAAE;IACd,MAAMZ,CAAC,GAAGW,OAAO,CAACC,GAAG,GAAG,CAAC,CAAE;IAC3B,IAAIZ,CAAC,CAACS,IAAI,KAAK,WAAW,IAAI,CAACT,CAAC,CAACa,SAAS,EAAEV,MAAM,EAAE;IACpDS,GAAG,IAAI,CAAC;EACV;EACA,OAAOD,OAAO,CAACG,KAAK,CAAC,CAAC,EAAEF,GAAG,CAAC,CAACG,GAAG,CAAEf,CAAC,IACjCA,CAAC,CAACS,IAAI,KAAK,WAAW,IAAIT,CAAC,CAACgB,QAAQ,GAAG;IAAE,GAAGhB,CAAC;IAAEgB,QAAQ,EAAEC;EAAU,CAAC,GAAGjB,CACzE,CAAC;AACH;AAEA,OAAO,SAASkB,oBAAoBA,CAACC,MAA4B,EAAkB;EACjF,MAAMC,OAAO,GAAGD,MAAM,CAACC,OAAO,IAAIhC,OAAO;EACzC,MAAMiC,MAAM,GAAG,IAAI7B,YAAY,CAAC,CAAC;EACjC,MAAM8B,MAAM,GAAGH,MAAM,CAACG,MAAM,IAAI,CAAC,CAAC;EAClC,IAAIjB,QAAwB,GAAG,EAAE;EACjC,IAAIkB,MAA0B;EAC9B,IAAIC,MAAM,GAAG,KAAK;EAClB;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE,IAAIC,cAAsC,GAAG,CAAC,CAAC;;EAE/C;EACA;EACA7B,oBAAoB,CAACuB,MAAM,CAACO,QAAQ,CAAC;EAErC,MAAMC,QAAkB,GACtBR,MAAM,CAACS,QAAQ,KAAK,QAAQ,GACxBlC,oBAAoB,CAACyB,MAAM,CAAC,GAC5B1B,uBAAuB,CAAC0B,MAAM,CAAC;;EAErC;EACA;EACA,IAAIU,gBAAgB,GAAGV,MAAM,CAACU,gBAAgB;EAC9C,IAAIC,gBAAgB,GAAGC,MAAM,CAACC,IAAI,CAACH,gBAAgB,CAAC;EAEpD,eAAeI,KAAKA,CAAA,EAAkB;IACpC,IAAIT,MAAM,EAAE;IACZA,MAAM,GAAG,IAAI;IACb,IAAIU,MAA+B,GAAG,CAAC,CAAC;IACxC,IAAI;MACFA,MAAM,GAAG,MAAM7C,kBAAkB,CAAC;QAChC8C,QAAQ,EAAEhB,MAAM,CAACgB,QAAQ;QACzBC,YAAY,EAAEjB,MAAM,CAACiB,YAAY;QACjCN,gBAAgB;QAChBD;MACF,CAAC,CAAC;IACJ,CAAC,CAAC,MAAM;MACN;MACA;IAAA;IAEFJ,cAAc,GAAG,CAAC,CAAC;IACnB,KAAK,MAAMY,GAAG,IAAKH,MAAM,CAACI,aAAa,IAA8B,EAAE,EAAE;MACvE,MAAMC,KAAK,GAAGF,GAA6C;MAC3D,IAAIE,KAAK,EAAEC,UAAU,IAAID,KAAK,CAACE,IAAI,EAAEhB,cAAc,CAACc,KAAK,CAACC,UAAU,CAAC,GAAGD,KAAK,CAACE,IAAI;IACpF;IAEAlB,MAAM,GAAGhC,iBAAiB,CAAC;MACzB6B,OAAO;MACPsB,OAAO,EAAE;QAAE,GAAGvB,MAAM,CAACuB,OAAO;QAAER,MAAM,EAAE;UAAE,GAAGA,MAAM;UAAE,GAAGf,MAAM,CAACuB,OAAO,EAAER;QAAO;MAAE,CAAC;MAChFS,SAAS,EAAExB,MAAM,CAACwB,SAAS;MAC3BC,QAAQ,EAAEtB,MAAM,CAACsB,QAAQ,IAAI,KAAK;MAClCC,eAAe,EAAElD,sBAAsB,CAAC2B,MAAM,CAAC;MAC/CwB,OAAO,EAAE3B,MAAM,CAAC2B,OAAO;MACvBC,QAAQ,EAAE5B,MAAM,CAAC4B;IACnB,CAAC,CAAC;EACJ;EAEA,OAAO;IACL1B,MAAM;IACN,IAAIhB,QAAQA,CAAA,EAAG;MACb,OAAOA,QAAQ;IACjB,CAAC;IACD4B,KAAK;IAELe,mBAAmBA,CAACC,OAAiC,EAAE;MACrDpB,gBAAgB,GAAGoB,OAAO;MAC1BnB,gBAAgB,GAAGC,MAAM,CAACC,IAAI,CAACiB,OAAO,CAAC;IACzC,CAAC;IAEDC,OAAOA,CAACvC,OAAuB,EAAE;MAC/B;MACA;MACA,IAAIN,QAAQ,CAACF,MAAM,GAAG,CAAC,EAAE;MACzBE,QAAQ,GAAGD,WAAW,CAACM,gBAAgB,CAACC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,OAAOwC,IAAIA,CAACC,IAAY,EAAEC,MAAoB,EAAE;MAC9C,MAAMpB,KAAK,CAAC,CAAC;MACb5B,QAAQ,CAACiD,IAAI,CAAC;QAAE7C,IAAI,EAAE,MAAM;QAAE2C;MAAK,CAAC,CAAC;MACrC/C,QAAQ,GAAGD,WAAW,CAACC,QAAQ,CAAC;MAEhC,MAAMkD,GAAG,GAAGjE,YAAY,CAAC;QACvBqC,QAAQ;QACRP,OAAO;QACPf,QAAQ;QACRkB,MAAM,EAAEA,MAAO;QACfiC,KAAK,EAAErC,MAAM,CAACqC,KAAK;QACnBC,SAAS,EAAEtC,MAAM,CAACsC,SAAS,IAAI,IAAI;QACnCtB,QAAQ,EAAEhB,MAAM,CAACgB,QAAQ;QACzBC,YAAY,EAAEjB,MAAM,CAACiB,YAAY;QACjCX,cAAc;QACdJ,MAAM;QACNC,MAAM;QACNqB,SAAS,EAAExB,MAAM,CAACwB,SAAS;QAC3Bb,gBAAgB;QAChBD,gBAAgB;QAChB6B,eAAe,EAAEvC,MAAM,CAACuC,eAAe;QACvCL;MACF,CAAC,CAAC;MAEF,IAAIM,IAAI,GAAG,MAAMJ,GAAG,CAACI,IAAI,CAAC,CAAC;MAC3B,OAAO,CAACA,IAAI,CAACC,IAAI,EAAE;QACjB,MAAMD,IAAI,CAACE,KAAK;QAChBF,IAAI,GAAG,MAAMJ,GAAG,CAACI,IAAI,CAAC,CAAC;MACzB;MACA;MACAtD,QAAQ,GAAGsD,IAAI,CAACE,KAAK;IACvB,CAAC;IAEDC,KAAKA,CAAA,EAAG;MACNzD,QAAQ,GAAG,EAAE;MACbgB,MAAM,CAAC0C,KAAK,CAAC,CAAC;MACd;MACA;MACA;MACAvC,MAAM,GAAG,KAAK;IAChB;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"names":["CATALOG","buildContextDigest","buildLiveContext","runAgentTurn","buildLiveBlock","buildSystemPrompt","listableProcedures","EffectLedger","EvidenceStore","TokenCalibration","compressConsumed","trimHistory","trimHistoryReport","createAnthropicProvider","createOpenAIProvider","resolveRequireApproval","registerSelfEndpoint","resumableHistory","history","end","length","m","role","toolCalls","slice","map","thinking","undefined","createAskBuoySession","config","catalog","ledger","policy","messages","seenUrls","Set","evidence","calibration","system","primed","bypassApproval","trusted","deviceReadOnly","trimmedOnRestore","generation","digest","storeKeyOwners","endpoint","provider","protocol","availableActions","availableToolIds","Object","keys","live","refreshLive","k","assign","requireApproval","requireApprovalFor","readOnly","activePolicy","composeSystem","context","isRelease","readOnlySource","approvalsBypassed","appName","platform","prime","dispatch","readSnapshot","raw","zustandStores","store","persistsTo","name","trustedActions","untrust","key","delete","setAvailableActions","actions","setApprovalBypass","enabled","setReadOnly","restore","report","charsPerToken","liveCallIds","droppedRounds","send","text","signal","myGeneration","type","stopReason","trimmed","working","droppedPinned","gen","systemVolatile","list","e","label","toolId","action","effect","undone","undoneAt","model","maxTokens","requestApproval","procedures","next","done","value","reset","clear"],"sourceRoot":"../../src","sources":["session.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASA,OAAO,QAAQ,qBAAqB;AAC7C,SAASC,kBAAkB,EAAEC,gBAAgB,QAAQ,4BAA4B;AACjF,SAASC,YAAY,QAA6C,uBAAuB;AACzF,SAASC,cAAc,EAAEC,iBAAiB,EAAEC,kBAAkB,QAA0B,uBAAuB;AAC/G,SAASC,YAAY,QAAQ,kBAAkB;AAC/C,SAASC,aAAa,QAAQ,mBAAmB;AACjD,SAASC,gBAAgB,QAAQ,2BAA2B;AAC5D,SACEC,gBAAgB,EAEhBC,WAAW,EACXC,iBAAiB,QACZ,wBAAwB;AAC/B,SAASC,uBAAuB,QAAQ,uBAAuB;AAC/D,SAASC,oBAAoB,QAAQ,oBAAoB;AAEzD,SAASC,sBAAsB,QAA4B,iBAAiB;AAC5E,SAASC,oBAAoB,QAAQ,iBAAiB;AA+GtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASN,gBAAgB,EAAEC,WAAW,EAAEC,iBAAiB;AAEzD,OAAO,SAASK,gBAAgBA,CAACC,OAAuB,EAAkB;EACxE,IAAIC,GAAG,GAAGD,OAAO,CAACE,MAAM;EACxB,OAAOD,GAAG,GAAG,CAAC,EAAE;IACd,MAAME,CAAC,GAAGH,OAAO,CAACC,GAAG,GAAG,CAAC,CAAE;IAC3B,IAAIE,CAAC,CAACC,IAAI,KAAK,WAAW,IAAI,CAACD,CAAC,CAACE,SAAS,EAAEH,MAAM,EAAE;IACpDD,GAAG,IAAI,CAAC;EACV;EACA,OAAOD,OAAO,CAACM,KAAK,CAAC,CAAC,EAAEL,GAAG,CAAC,CAACM,GAAG,CAAEJ,CAAC,IACjCA,CAAC,CAACC,IAAI,KAAK,WAAW,IAAID,CAAC,CAACK,QAAQ,GAAG;IAAE,GAAGL,CAAC;IAAEK,QAAQ,EAAEC;EAAU,CAAC,GAAGN,CACzE,CAAC;AACH;AAEA,OAAO,SAASO,oBAAoBA,CAACC,MAA4B,EAAkB;EACjF,MAAMC,OAAO,GAAGD,MAAM,CAACC,OAAO,IAAI9B,OAAO;EACzC,MAAM+B,MAAM,GAAG,IAAIxB,YAAY,CAAC,CAAC;EACjC,MAAMyB,MAAM,GAAGH,MAAM,CAACG,MAAM,IAAI,CAAC,CAAC;EAClC,IAAIC,QAAwB,GAAG,EAAE;EACjC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMC,QAAQ,GAAG,IAAIC,GAAG,CAAS,CAAC;EAClC;AACF;AACA;AACA;AACA;EACE,MAAMC,QAAQ,GAAG,IAAI5B,aAAa,CAAC,CAAC;EACpC;EACA,MAAM6B,WAAW,GAAG,IAAI5B,gBAAgB,CAAC,CAAC;EAC1C,IAAI6B,MAA0B;EAC9B,IAAIC,MAAM,GAAG,KAAK;EAClB;EACA,IAAIC,cAAc,GAAG,KAAK;EAC1B;EACA,MAAMC,OAAO,GAAG,IAAIN,GAAG,CAAS,CAAC;EACjC;EACA,IAAIO,cAAc,GAAG,KAAK;EAC1B;AACF;AACA;AACA;EACE,IAAIC,gBAAgB,GAAG,CAAC;EACxB;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,IAAIC,UAAU,GAAG,CAAC;EAClB;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE,IAAIC,MAA+B,GAAG,CAAC,CAAC;EACxC;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE,IAAIC,cAAsC,GAAG,CAAC,CAAC;;EAE/C;EACA;EACA9B,oBAAoB,CAACa,MAAM,CAACkB,QAAQ,CAAC;EAErC,MAAMC,QAAkB,GACtBnB,MAAM,CAACmB,QAAQ,KACdnB,MAAM,CAACoB,QAAQ,KAAK,QAAQ,GACzBnC,oBAAoB,CAACe,MAAM,CAAC,GAC5BhB,uBAAuB,CAACgB,MAAM,CAAC,CAAC;;EAEtC;EACA;EACA,IAAIqB,gBAAgB,GAAGrB,MAAM,CAACqB,gBAAgB;EAC9C,IAAIC,gBAAgB,GAAGC,MAAM,CAACC,IAAI,CAACH,gBAAgB,CAAC;;EAEpD;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACE,MAAMI,IAAmB,GAAG;IAAE,GAAGtB;EAAO,CAAC;EACzC,SAASuB,WAAWA,CAAA,EAAS;IAC3B,KAAK,MAAMC,CAAC,IAAIJ,MAAM,CAACC,IAAI,CAACC,IAAI,CAAC,EAA6B,OAAOA,IAAI,CAACE,CAAC,CAAC;IAC5EJ,MAAM,CAACK,MAAM,CAACH,IAAI,EAAEtB,MAAM,CAAC;IAC3B,IAAIQ,cAAc,EAAE;MAClBc,IAAI,CAACI,eAAe,GAAG,EAAE;MACzBJ,IAAI,CAACK,kBAAkB,GAAG,EAAE;IAC9B;IACA;IACA,IAAIjB,cAAc,EAAEY,IAAI,CAACM,QAAQ,GAAG,IAAI;EAC1C;EACA,SAASC,YAAYA,CAAA,EAAkB;IACrC,OAAOP,IAAI;EACb;EAEA,SAASQ,aAAaA,CAAA,EAAS;IAC7BxB,MAAM,GAAGjC,iBAAiB,CAAC;MACzByB,OAAO;MACPiC,OAAO,EAAE;QAAE,GAAGlC,MAAM,CAACkC,OAAO;QAAElB,MAAM,EAAE;UAAE,GAAGA,MAAM;UAAE,GAAGhB,MAAM,CAACkC,OAAO,EAAElB;QAAO;MAAE,CAAC;MAChFmB,SAAS,EAAEnC,MAAM,CAACmC,SAAS;MAC3BJ,QAAQ,EAAEN,IAAI,CAACM,QAAQ,IAAI,KAAK;MAChCK,cAAc,EAAEjC,MAAM,CAAC4B,QAAQ,GAAG,KAAK,GAAGlB,cAAc,GAAG,QAAQ,GAAGf,SAAS;MAC/E+B,eAAe,EAAE3C,sBAAsB,CAACuC,IAAI,CAAC;MAC7CY,iBAAiB,EAAE1B,cAAc;MACjC2B,OAAO,EAAEtC,MAAM,CAACsC,OAAO;MACvBC,QAAQ,EAAEvC,MAAM,CAACuC,QAAQ;MACzBjB;IACF,CAAC,CAAC;EACJ;EAEA,eAAekB,KAAKA,CAAA,EAAkB;IACpC,IAAI9B,MAAM,EAAE;IACZA,MAAM,GAAG,IAAI;IACbM,MAAM,GAAG,CAAC,CAAC;IACX,IAAI;MACFA,MAAM,GAAG,MAAM5C,kBAAkB,CAAC;QAChCqE,QAAQ,EAAEzC,MAAM,CAACyC,QAAQ;QACzBC,YAAY,EAAE1C,MAAM,CAAC0C,YAAY;QACjCpB,gBAAgB;QAChBD;MACF,CAAC,CAAC;IACJ,CAAC,CAAC,MAAM;MACN;MACA;IAAA;IAEFJ,cAAc,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM0B,GAAG,IAAK3B,MAAM,CAAC4B,aAAa,IAA8B,EAAE,EAAE;MACvE,MAAMC,KAAK,GAAGF,GAA6C;MAC3D,IAAIE,KAAK,EAAEC,UAAU,IAAID,KAAK,CAACE,IAAI,EAAE9B,cAAc,CAAC4B,KAAK,CAACC,UAAU,CAAC,GAAGD,KAAK,CAACE,IAAI;IACpF;IAEAd,aAAa,CAAC,CAAC;EACjB;EAEA,OAAO;IACL/B,MAAM;IACNK,QAAQ;IACRC,WAAW;IACXwC,cAAc,EAAEA,CAAA,KAAM,CAAC,GAAGpC,OAAO,CAAC;IAClCqC,OAAO,EAAGC,GAAW,IAAK;MACxBtC,OAAO,CAACuC,MAAM,CAACD,GAAG,CAAC;IACrB,CAAC;IACD,IAAI9C,QAAQA,CAAA,EAAG;MACb,OAAOA,QAAQ;IACjB,CAAC;IACDoC,KAAK;IAELY,mBAAmBA,CAACC,OAAiC,EAAE;MACrDhC,gBAAgB,GAAGgC,OAAO;MAC1B/B,gBAAgB,GAAGC,MAAM,CAACC,IAAI,CAAC6B,OAAO,CAAC;IACzC,CAAC;IAEDC,iBAAiBA,CAACC,OAAgB,EAAE;MAClC,IAAI5C,cAAc,KAAK4C,OAAO,EAAE;MAChC5C,cAAc,GAAG4C,OAAO;MACxB7B,WAAW,CAAC,CAAC;MACb;MACA;MACA;MACA;MACA,IAAIjB,MAAM,EAAEwB,aAAa,CAAC,CAAC;IAC7B,CAAC;IAEDuB,WAAWA,CAACD,OAAgB,EAAE;MAC5B,IAAI1C,cAAc,KAAK0C,OAAO,EAAE;MAChC1C,cAAc,GAAG0C,OAAO;MACxB7B,WAAW,CAAC,CAAC;MACb,IAAIjB,MAAM,EAAEwB,aAAa,CAAC,CAAC;IAC7B,CAAC;IAEDwB,OAAOA,CAACpE,OAAuB,EAAE;MAC/B;MACA;MACA,IAAIe,QAAQ,CAACb,MAAM,GAAG,CAAC,EAAE;MACzB,MAAMmE,MAAM,GAAG3E,iBAAiB,CAACK,gBAAgB,CAACC,OAAO,CAAC,EAAEmB,WAAW,CAACmD,aAAa,EAAEzD,MAAM,CAAC0D,WAAW,CAAC,CAAC,CAAC;MAC5GxD,QAAQ,GAAGsD,MAAM,CAACtD,QAAQ;MAC1BU,gBAAgB,GAAG4C,MAAM,CAACG,aAAa;IACzC,CAAC;IAED,OAAOC,IAAIA,CAACC,IAAY,EAAEC,MAAoB,EAAE;MAC9C;AACN;AACA;AACA;AACA;AACA;AACA;AACA;MACM,MAAMC,YAAY,GAAGlD,UAAU;MAC/B,MAAMyB,KAAK,CAAC,CAAC;MACb;MACA;MACA;MACA;MACA;MACA,IAAIf,IAAyC;MAC7C,IAAI;QACFA,IAAI,GAAG,MAAMpD,gBAAgB,CAAC;UAC5BoE,QAAQ,EAAEzC,MAAM,CAACyC,QAAQ;UACzBC,YAAY,EAAE1C,MAAM,CAAC0C,YAAY;UACjCpB,gBAAgB;UAChBD;QACF,CAAC,CAAC;MACJ,CAAC,CAAC,MAAM;QACNI,IAAI,GAAG3B,SAAS;MAClB;MACA;AACN;AACA;AACA;AACA;AACA;AACA;MACM,IAAImE,YAAY,KAAKlD,UAAU,EAAE;QAC/B,MAAM;UAAEmD,IAAI,EAAE,MAAM;UAAEC,UAAU,EAAE;QAAa,CAAC;QAChD;MACF;;MAEA;AACN;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;MACM,MAAMC,OAAO,GAAGrF,iBAAiB,CAAC,CAAC,GAAGqB,QAAQ,EAAE;QAAEX,IAAI,EAAE,MAAe;QAAEsE;MAAK,CAAC,CAAC,EAAEvD,WAAW,CAACmD,aAAa,EAAEzD,MAAM,CAAC0D,WAAW,CAAC,CAAC,CAAC;MAClI,MAAMS,OAAO,GAAGD,OAAO,CAAChE,QAAQ;MAChC;MACA;MACA;MACA,MAAMyD,aAAa,GAAGO,OAAO,CAACP,aAAa,GAAG/C,gBAAgB;MAC9DA,gBAAgB,GAAG,CAAC;MACpB,IAAI+C,aAAa,GAAG,CAAC,EAAE,MAAM;QAAEK,IAAI,EAAE,iBAAiB;QAAEL,aAAa;QAAES,aAAa,EAAEF,OAAO,CAACE;MAAc,CAAC;MAE7G,MAAMC,GAAG,GAAGjG,YAAY,CAAC;QACvB6C,QAAQ;QACRlB,OAAO;QACPG,QAAQ,EAAEiE,OAAO;QACjB5D,MAAM,EAAEA,MAAO;QACf+D,cAAc,EAAEjG,cAAc,CAC5BkD,IAAI;QACJ;QACA;QACA;QACA;QACAvB,MAAM,CAACuE,IAAI,CAAC,CAAC,CAAC7E,GAAG,CAAE8E,CAAC,KAAM;UACxBC,KAAK,EAAE,GAAGD,CAAC,CAACE,MAAM,IAAIF,CAAC,CAACG,MAAM,GAAGH,CAAC,CAACI,MAAM,CAACH,KAAK,GAAG,MAAMD,CAAC,CAACI,MAAM,CAACH,KAAK,EAAE,GAAG,EAAE,EAAE;UAC/EI,MAAM,EAAEL,CAAC,CAACM,QAAQ,KAAKlF;QACzB,CAAC,CAAC,CACJ,CAAC;QACDmF,KAAK,EAAEjF,MAAM,CAACiF,KAAK;QACnBC,SAAS,EAAElF,MAAM,CAACkF,SAAS,IAAI,IAAI;QACnCzC,QAAQ,EAAEzC,MAAM,CAACyC,QAAQ;QACzBC,YAAY,EAAE1C,MAAM,CAAC0C,YAAY;QACjCzB,cAAc;QACdf,MAAM;QACNC,MAAM,EAAE6B,YAAY,CAAC,CAAC;QACtBG,SAAS,EAAEnC,MAAM,CAACmC,SAAS;QAC3Bb,gBAAgB;QAChBD,gBAAgB;QAChB8D,eAAe,EAAEnF,MAAM,CAACmF,eAAe;QACvC9E,QAAQ;QACRE,QAAQ;QACRC,WAAW;QACXI,OAAO;QACPwE,UAAU,EAAE3G,kBAAkB,CAACuB,MAAM,CAACkC,OAAO,EAAEkD,UAAU,EAAE9D,gBAAgB,CAAC;QAC5E0C;MACF,CAAC,CAAC;MAEF,IAAIqB,IAAI,GAAG,MAAMd,GAAG,CAACc,IAAI,CAAC,CAAC;MAC3B,OAAO,CAACA,IAAI,CAACC,IAAI,EAAE;QACjB,MAAMD,IAAI,CAACE,KAAK;QAChBF,IAAI,GAAG,MAAMd,GAAG,CAACc,IAAI,CAAC,CAAC;MACzB;MACA;MACA;MACA;MACA,IAAIpB,YAAY,KAAKlD,UAAU,EAAEX,QAAQ,GAAGiF,IAAI,CAACE,KAAK;IACxD,CAAC;IAEDC,KAAKA,CAAA,EAAG;MACN;MACAzE,UAAU,IAAI,CAAC;MACfX,QAAQ,GAAG,EAAE;MACbU,gBAAgB,GAAG,CAAC;MACpBZ,MAAM,CAACuF,KAAK,CAAC,CAAC;MACdpF,QAAQ,CAACoF,KAAK,CAAC,CAAC;MAChBlF,QAAQ,CAACkF,KAAK,CAAC,CAAC;MAChB7E,OAAO,CAAC6E,KAAK,CAAC,CAAC;MACf;MACA;MACA;MACA/E,MAAM,GAAG,KAAK;IAChB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/typescript/blocks/receipts.d.ts

@@ -12,6 +12,11 @@ export interface ReceiptInput {
     result: unknown;
     /** From captureBefore, when the engine read the prior value. */
     before?: unknown;
+    /**
+     * The same read taken AFTER the call landed, for the projectors that show a
+     * diff. Present only where the engine captures both sides (zustand's store).
+     */
+    after?: unknown;
     effect: "read" | "write" | "destructive";
 }
 /**