@canonmsg/agent-sdk 10.3.0 → 11.0.0

package/README.md

@@ -34,7 +34,13 @@ await agent.start();
 npm install @canonmsg/agent-sdk
 ```
 
-The only runtime dependency is `@canonmsg/core`, which npm installs for you. Everything else is native `fetch` and `ReadableStream` (Node.js 18+).
+The SDK uses `@canonmsg/core` and the shared `@canonmsg/endpoint` engine. Node.js 22.22.3 or later is required.
+
+The endpoint owns stable installation and operation IDs, SQLite outbox/inbox state, live transport, receipt recovery, conversation synchronization, and upload dependencies. `CanonAgent` adds handler and native-session behavior. Set `CANON_ENDPOINT_STATE_DIR` to a persistent private directory; the default is `~/.canon/endpoint`. Keep this directory when upgrading or restarting a runtime.
+
+Replicated or ephemeral cloud deployments must inject an operator-owned endpoint store through `endpoint: { endpoint: sharedEndpoint }`. File delivery also needs a durable `mediaBytes` adapter or persistent `mediaDirectory`; a temporary container filesystem is not a delivery journal. All replicas for one installation share the same store namespace. A process must not replay an uncertain provider call automatically.
+
+Existing conversations require the rollout tool's reconciled history baseline before agent execution. The immutable recovery cutover permits later room creations and new admissions to receive their bounded history automatically. Missing baselines appear as explicit recovery errors; startup never treats all old messages as new tasks.
 
 Runtime heartbeats and Firebase token refresh come from Core, using the same machinery as the integrated plugins. The SDK adds handler dispatch and lifecycle wiring. Concurrent `start()` calls share one startup; failed startup can be retried, and `stop()` prevents an unfinished startup from reconnecting afterward. Heartbeat failures are reported and later heartbeats retry. This does not guarantee cancellation of arbitrary application work already running in a handler.
 

package/dist/attached-session.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { buildChunkedMessagePartMetadata, CanonClient, CanonStream, createAttachedNativeSession, createRuntimeHeartbeat, createRuntimeStatePublisher, initRTDBAuth, resolveCanonRuntimeConnection, splitTextByUtf8Bytes, verifyCanonRuntimeConnection, } from '@canonmsg/core';
+import { buildChunkedMessagePartMetadata, buildCanonGroupContext, buildCompactGroupContextLines, CanonClient, CanonStream, createAttachedNativeSession, createRuntimeHeartbeat, createRuntimeStatePublisher, initRTDBAuth, resolveCanonRuntimeConnection, splitTextByUtf8Bytes, verifyCanonRuntimeConnection, } from '@canonmsg/core';
 /**
  * Connect one existing native session to one existing Canon conversation.
  * This is account-level participation, not a second group member. The caller
@@ -26,7 +26,7 @@ export function createCanonAttachedSession(options) {
         rtdbUrl: connection.rtdbUrl,
         firebaseWebApiKey: connection.firebaseApiKey,
     });
-    const client = options.transport?.client ?? new CanonClient(connection.apiKey, runtimeConnection.apiBaseUrl);
+    const client = options.transport?.client ?? new CanonClient(connection.apiKey, runtimeConnection.apiBaseUrl, { environmentId: runtimeConnection.environmentId, streamUrl: runtimeConnection.streamUrl });
     let stopped = false;
     let running = false;
     let connected = false;
@@ -36,6 +36,8 @@ export function createCanonAttachedSession(options) {
     let coreStopPromise;
     let timer;
     let stream;
+    let endpoint;
+    let inbound;
     let unsubscribeStream;
     let publisher;
     let heartbeat;
@@ -47,6 +49,8 @@ export function createCanonAttachedSession(options) {
     const reportedHistory = new Set();
     let publicationFailed = false;
     let historyIncomplete = false;
+    let currentConversation = null;
+    let currentOwnerId;
     let inputError = null;
     let observedTurnId;
     let turnUpdatedAt = null;
@@ -80,6 +84,7 @@ export function createCanonAttachedSession(options) {
     const transcriptPublisher = createCanonAttachedSessionPublisher(client, binding);
     const core = createAttachedNativeSession({
         binding, store: options.store, adapter: options.native,
+        beforeNativeSubmit: (input) => endpoint.claimInbound(`message:${binding.conversationId}:${input.messageId}`),
         isPublicationReady: () => options.transport?.isRouteActive?.(binding.conversationId) !== false,
         publisher: {
             prepare(input) {
@@ -179,10 +184,10 @@ export function createCanonAttachedSession(options) {
         void stop().catch((error) => report(error, 'detach'));
     }
     async function verifyMembership() {
-        const conversations = await client.getConversations();
+        const conversation = await client.getConversation(binding.conversationId);
         if (stopped)
             return false;
-        const conversation = conversations.find((entry) => entry.id === binding.conversationId);
+        currentConversation = conversation ?? null;
         if (!conversation?.memberIds.includes(binding.agentId)) {
             detach('conversation-membership-lost');
             return false;
@@ -226,11 +231,22 @@ export function createCanonAttachedSession(options) {
                 await notice(payload, inputError);
                 return;
             }
+            const roster = buildCanonGroupContext({ conversation: currentConversation, messages: [message], agentId: binding.agentId, ownerId: currentOwnerId });
+            const rosterLines = roster ? buildCompactGroupContextLines(roster, 'initial') : [];
             const result = await core.submit({
                 messageId: message.id,
-                text: `Canon message from ${message.senderName ?? message.senderId} (${message.senderType}):\n\n${message.text}`,
+                text: [...rosterLines, `Canon message from ${message.senderName ?? message.senderId} (${message.senderType}):\n\n${message.text}`].join('\n\n'),
                 ...(payload.replyAuthority ? { replyAuthority: payload.replyAuthority } : {}),
             });
+            // A conclusive provider acknowledgement settles command delivery. Native
+            // turn progress and transcript correlation remain in the provider journal.
+            const inputId = `message:${binding.conversationId}:${message.id}`;
+            if (result.status === 'uncertain' && result.messageId === message.id) {
+                await endpoint.setInboundState(inputId, 'uncertain', 'native-reconciliation-required');
+            }
+            else if (!(result.status === 'not_submitted' && result.reason === 'This input already has another execution owner.')) {
+                await endpoint.setInboundState(inputId, 'settled', `native-${result.status}`);
+            }
             if (stopped)
                 return;
             reportedHistory.delete(message.id);
@@ -370,11 +386,12 @@ export function createCanonAttachedSession(options) {
             }
             if (stopped)
                 return;
-            const conversations = await client.getConversations();
-            const conversation = conversations.find((entry) => entry.id === binding.conversationId);
+            endpoint = await client.getEndpoint();
+            const conversation = await client.getConversation(binding.conversationId);
             if (!conversation || !conversation.memberIds.includes(binding.agentId)) {
                 throw new Error('The agent is not a member of the specified Canon conversation');
             }
+            currentConversation = conversation;
             const initial = await client.getMessagesPage(binding.conversationId, 100);
             if (stopped)
                 return;
@@ -411,9 +428,33 @@ export function createCanonAttachedSession(options) {
                 });
             }
             running = true;
+            inbound = endpoint.acceptInbound({ kind: 'message.created', conversationId: binding.conversationId,
+                offer: async (event) => {
+                    if (!running || stopped || options.transport?.isRouteActive?.(binding.conversationId) === false) {
+                        await endpoint.setInboundState(event.id, 'deferred', 'attachment-not-ready');
+                        return;
+                    }
+                    const payload = event.data;
+                    if (core.getState().pendingSourceMessageId === payload.message.id && core.getState().status === 'uncertain') {
+                        await endpoint.setInboundState(event.id, 'uncertain', 'native-reconciliation-required');
+                        return;
+                    }
+                    await receive(payload);
+                    const record = await endpoint.getInbound(event.id);
+                    if (record && record.state !== 'uncertain' && record.state !== 'settled') {
+                        await endpoint.setInboundState(event.id, 'settled', 'native-input-reviewed');
+                    }
+                }, onError: (error) => report(error, 'inbound-recovery') });
+            inbound.start();
             const handler = {
-                onMessage: (payload) => track(receive(payload), 'receive'),
+                onMessage: (payload) => {
+                    if (payload.conversationId !== binding.conversationId)
+                        return;
+                    track(inbound.receive({ id: `message:${payload.conversationId}:${payload.message.id}`, kind: 'message.created',
+                        conversationId: payload.conversationId, durable: true, data: payload }), 'receive');
+                },
                 onAgentContext: (context) => {
+                    currentOwnerId = context.ownerId;
                     if (context.agentId !== binding.agentId) {
                         report(new Error('Canon stream context belongs to a different agent'), 'stream-identity');
                         detach('stream-identity-mismatch');
@@ -422,6 +463,10 @@ export function createCanonAttachedSession(options) {
                 onConversationUpdated: (payload) => {
                     if (stopped || payload.conversationId !== binding.conversationId)
                         return;
+                    if (currentConversation) {
+                        currentConversation = { ...currentConversation, ...payload.changes };
+                        track(client.rememberConversation(currentConversation), 'conversation-state');
+                    }
                     const members = payload.changes.memberIds;
                     if ((Array.isArray(members) && !members.includes(binding.agentId))
                         || payload.membershipChange?.removedMemberIds.includes(binding.agentId)
@@ -455,7 +500,7 @@ export function createCanonAttachedSession(options) {
                 unsubscribeStream = options.transport.subscribe(handler);
             else
                 stream = new CanonStream({
-                    apiKey: connection.apiKey, agentId: binding.agentId, streamUrl: runtimeConnection.streamUrl, handler,
+                    endpoint: await client.getEndpoint(), agentId: binding.agentId, handler,
                 });
             publishState(core.getState());
             // CanonStream.start runs for the lifetime of a fetch stream. Do not
@@ -489,6 +534,7 @@ export function createCanonAttachedSession(options) {
         stopCore();
         stopPromise = (async () => {
             await startPromise?.catch(() => { });
+            await inbound?.close();
             await cleanup();
             emit({ status: 'stopped' });
         })();

package/dist/canon-agent.d.ts

@@ -90,6 +90,7 @@ export declare class CanonAgent {
     private readonly activeAbortControllers;
     private readonly activeTurns;
     private readonly conversationMemberIds;
+    private readonly conversationMembershipRevisions;
     private readonly pendingMembershipChanges;
     private readonly typingSignals;
     private sseConnectedLogged;

package/dist/canon-agent.js

@@ -1,4 +1,4 @@
-import { ApprovalManager, RuntimeRequestManager, runtimeInputDescriptor, runtimeCardDescriptor, CanonClient, ControlChannelPoller, buildCanonTurnContextV2, buildCanonGroupContext, buildParticipationHistorySnapshot, createTurnOutputController, createRuntimeStatePublisher, createRuntimeHeartbeat, createTypingStatusPublisher, diffCanonMemberIds, FINAL_MESSAGE_HANDOFF_MS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, buildRuntimeInputOutcome, initRTDBAuth, isChunkedSendMessageError, normalizeRuntimeCommandDescriptors, normalizeTurnMetadata, normalizeTurnVerbosityConversationType, reportNoReplyOutcome, resolveCanonReplyContext, resolveMessageActiveSelfContextId, resolveRuntimeProvenance, resolveTurnVerbosity, selectActiveSelfContexts, renderCanonHostInboundContent, resolveCanonRuntimeConnection, sendMessageWithRetryChunked, shouldPublishTurnTrail, splitTextByUtf8Bytes, verifyCanonRuntimeConnection, } from '@canonmsg/core';
+import { ApprovalManager, RuntimeRequestManager, runtimeInputDescriptor, runtimeCardDescriptor, CanonClient, ControlChannelPoller, buildCanonTurnContextV2, buildCanonGroupContext, buildParticipationHistorySnapshot, createTurnOutputController, createRuntimeStatePublisher, createRuntimeHeartbeat, createTypingStatusPublisher, diffCanonMemberIds, FINAL_MESSAGE_HANDOFF_MS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, buildRuntimeInputOutcome, initRTDBAuth, isChunkedSendMessageError, isPendingCanonOperation, normalizeRuntimeCommandDescriptors, normalizeTurnMetadata, normalizeTurnVerbosityConversationType, reportNoReplyOutcome, resolveCanonReplyContext, resolveMessageActiveSelfContextId, resolveRuntimeProvenance, resolveTurnVerbosity, resolveConversationPolicyScope, selectActiveSelfContexts, renderCanonHostInboundContent, resolveCanonRuntimeConnection, sendMessageWithRetryChunked, shouldPublishTurnTrail, splitTextByUtf8Bytes, verifyCanonRuntimeConnection, } from '@canonmsg/core';
 import { createHash, randomUUID } from 'node:crypto';
 import { Debouncer } from './debouncer.js';
 import { DEFAULT_RUNTIME_INPUT_TIMEOUT_MS, RUNTIME_INPUT_ID_PATTERN, buildRuntimeCardCreateArgs, normalizeResponseUserId, resolveRuntimeCardRouting, } from './runtime-card.js';
@@ -143,6 +143,9 @@ const STANDARD_PRIMITIVE_COMMANDS = {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function knownMembershipRevision(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
 function sleepWithAbort(ms, signal) {
     if (signal.aborted)
         return Promise.reject(createTurnAbortError());
@@ -325,6 +328,7 @@ export class CanonAgent {
     activeAbortControllers = new Map();
     activeTurns = new Map();
     conversationMemberIds = new Map();
+    conversationMembershipRevisions = new Map();
     pendingMembershipChanges = new Map();
     typingSignals;
     sseConnectedLogged = false;
@@ -342,6 +346,7 @@ export class CanonAgent {
             historyLimit: 50,
             autoMarkRead: true,
             runtimeControlSurface: 'agent',
+            endpoint: {},
             ...options,
             environmentId: this.runtimeConnection.environmentId,
             baseUrl: this.runtimeConnection.apiBaseUrl,
@@ -349,7 +354,9 @@ export class CanonAgent {
             rtdbUrl: this.runtimeConnection.rtdbUrl,
             firebaseApiKey: this.runtimeConnection.firebaseWebApiKey,
         };
-        this.apiClient = new CanonClient(this.options.apiKey, this.options.baseUrl);
+        this.apiClient = new CanonClient(this.options.apiKey, this.options.baseUrl, {
+            environmentId: this.runtimeConnection.environmentId, streamUrl: this.runtimeConnection.streamUrl, ...options.endpoint,
+        });
         this.typingSignals = createTypingStatusPublisher({
             setTyping: (conversationId, typing, status) => status
                 ? this.apiClient.setTyping(conversationId, typing, status)
@@ -678,7 +685,7 @@ export class CanonAgent {
         if (generation !== this.lifecycleGeneration)
             return;
         this.voiceEventsEnabled = Boolean(this.callStartedHandler || this.callEndedHandler);
-        const rtm = new RealtimeManager(this.options.apiKey, this.debouncer, agentId, this.options.streamUrl, { enableVoiceEvents: this.voiceEventsEnabled });
+        const rtm = new RealtimeManager(this.options.apiKey, this.debouncer, agentId, this.options.streamUrl, { enableVoiceEvents: this.voiceEventsEnabled, endpoint: await this.apiClient.getEndpoint() });
         if (this.voiceEventsEnabled) {
             rtm.setCallHandlers({
                 onCallStarted: (payload) => {
@@ -964,24 +971,43 @@ export class CanonAgent {
     }
     rememberConversationMembers(conversations) {
         for (const conversation of conversations) {
+            const revision = knownMembershipRevision(conversation.membershipRevision);
+            const currentRevision = this.conversationMembershipRevisions.get(conversation.id);
+            if (revision !== undefined && currentRevision !== undefined && revision < currentRevision)
+                continue;
             this.conversationMemberIds.set(conversation.id, [...(conversation.memberIds ?? [])]);
+            if (revision !== undefined)
+                this.conversationMembershipRevisions.set(conversation.id, revision);
+            else
+                this.conversationMembershipRevisions.delete(conversation.id);
         }
     }
     handleConversationUpdated(payload) {
         const rawMemberIds = payload.changes.memberIds;
         if (!Array.isArray(rawMemberIds))
             return;
+        const revision = knownMembershipRevision(payload.changes.membershipRevision);
+        const currentRevision = this.conversationMembershipRevisions.get(payload.conversationId);
+        if (revision !== undefined && currentRevision !== undefined && revision < currentRevision)
+            return;
         const memberIds = rawMemberIds.filter((id) => typeof id === 'string');
         const hadPreviousMemberIds = this.conversationMemberIds.has(payload.conversationId);
         const previousMemberIds = this.conversationMemberIds.get(payload.conversationId) ?? [];
         const membershipChange = payload.membershipChange
             ?? (hadPreviousMemberIds ? diffCanonMemberIds(previousMemberIds, memberIds) : null);
         this.conversationMemberIds.set(payload.conversationId, memberIds);
+        if (revision !== undefined)
+            this.conversationMembershipRevisions.set(payload.conversationId, revision);
+        else
+            this.conversationMembershipRevisions.delete(payload.conversationId);
         if (membershipChange) {
             this.pendingMembershipChanges.set(payload.conversationId, membershipChange);
         }
         if (this.agentId && !memberIds.includes(this.agentId)) {
             this.cachedConversationIds = this.cachedConversationIds.filter((id) => id !== payload.conversationId);
+            this.abortActiveTurns(payload.conversationId);
+            this.sessionManager?.dropQueued(payload.conversationId);
+            this.pendingMembershipChanges.delete(payload.conversationId);
         }
         else {
             this.rememberConversationId(payload.conversationId);
@@ -1230,12 +1256,26 @@ export class CanonAgent {
     }
     async handleMessages(conversationId, messages, provenanceByMessageId) {
         const actionableMessages = this.filterApprovalReplyMessages(conversationId, messages);
-        if (actionableMessages.length === 0) {
-            return;
+        const consumed = messages.filter((message) => !actionableMessages.includes(message));
+        if (consumed.length) {
+            const endpoint = await this.apiClient.getEndpoint();
+            for (const message of consumed) {
+                const id = `message:${conversationId}:${message.id}`;
+                if (await endpoint.getInbound(id))
+                    await endpoint.setInboundState(id, 'settled', 'interaction-consumed');
+            }
         }
+        if (actionableMessages.length === 0)
+            return;
         messages = actionableMessages;
         if (!this.handler) {
-            console.warn(`[canon-sdk] No message handler registered — messages for ${conversationId} dropped. Call agent.on('message', handler) before starting.`);
+            const endpoint = await this.apiClient.getEndpoint();
+            for (const message of messages) {
+                const id = `message:${conversationId}:${message.id}`;
+                if (await endpoint.getInbound(id))
+                    await endpoint.setInboundState(id, 'deferred', 'no-handler');
+            }
+            console.warn(`[canon-sdk] No message handler registered — input for ${conversationId} is deferred. Call agent.on('message', handler) before starting.`);
             return;
         }
         const deliveryIntent = this.resolveBatchDeliveryIntent(messages);
@@ -1254,7 +1294,43 @@ export class CanonAgent {
     async executeHandler(conversationId, messages, session, provenanceByMessageId) {
         if (!this.handler)
             return;
+        // Message rediscovery can precede the SSE roster snapshot after admission.
+        // Refresh before trusting cached exclusion, accepting queued input, or
+        // freezing output policy. Reuse this same snapshot for handler context.
+        const endpoint = await this.apiClient.getEndpoint();
+        const setInputState = async (state, reason) => {
+            for (const message of messages) {
+                const id = `message:${conversationId}:${message.id}`;
+                if (await endpoint.getInbound(id))
+                    await endpoint.setInboundState(id, state, reason);
+            }
+        };
+        let conversation;
+        try {
+            conversation = await this.apiClient.getConversation(conversationId);
+        }
+        catch (error) {
+            await setInputState('deferred', 'membership-unavailable');
+            console.error(`[canon-sdk] Input deferred until conversation refresh recovers for ${conversationId}:`, error);
+            return;
+        }
+        if (!conversation) {
+            await setInputState('settled', 'conversation-unavailable');
+            return;
+        }
+        this.rememberConversationMembers([conversation]);
+        const currentMembers = this.conversationMemberIds.get(conversationId);
+        if (currentMembers && this.agentId && !currentMembers.includes(this.agentId)) {
+            await setInputState('settled', 'membership-lost');
+            return;
+        }
+        this.rememberConversationId(conversationId);
         await this.markQueuedMessagesAccepted(conversationId, messages);
+        const acceptedMembers = this.conversationMemberIds.get(conversationId);
+        if (acceptedMembers && this.agentId && !acceptedMembers.includes(this.agentId)) {
+            await setInputState('settled', 'membership-lost');
+            return;
+        }
         const turnId = randomUUID();
         const turnOpenedAt = Date.now();
         let turnState = 'thinking';
@@ -1316,19 +1392,14 @@ export class CanonAgent {
                     : {}),
             })).catch(() => { });
         };
-        // Quiet mode is resolved HERE, once, and carried for the whole turn.
-        //
-        // It has to be here because everything downstream is already too late: the
-        // controller's mode is fixed at construction two lines below, the
-        // `'Thinking...'` seed lands before that, and the conversation fetch that
-        // would otherwise name the conversation type is ~30 lines further down,
-        // inside the try. Provenance already carries the type — the stream service
-        // stamps it on every `message.created` frame — so the answer is available
-        // before the first publish of any kind.
-        //
-        // Re-deriving it mid-turn is what must never happen: a turn that started
-        // quiet and finished verbose would emit a trail nothing narrated.
-        const inboundConversationType = normalizeTurnVerbosityConversationType(provenanceByMessageId?.get(triggeringMessageId ?? '')?.conversation?.type);
+        // Resolve once from the refreshed roster before constructing the output
+        // controller or publishing the first thinking seed. Keep it fixed for the
+        // turn so the final trail agrees with what was actually narrated.
+        const inboundProvenance = provenanceByMessageId?.get(triggeringMessageId ?? '')?.conversation;
+        const inboundRoster = this.conversationMemberIds.get(conversationId) ?? inboundProvenance?.memberCount;
+        const inboundConversationType = inboundRoster != null
+            ? resolveConversationPolicyScope(inboundRoster)
+            : normalizeTurnVerbosityConversationType(inboundProvenance?.type);
         const turnVerbosity = resolveTurnVerbosity({
             configured: selectConfiguredTurnVerbosity(this.options.turnVerbosity, inboundConversationType),
             conversationType: inboundConversationType,
@@ -1412,14 +1483,8 @@ export class CanonAgent {
             if (this.sessionManager && session) {
                 this.sessionManager.seedHistory(conversationId, history);
             }
-            // Get conversation info
-            const conversations = await this.apiClient.getConversations();
-            this.rememberConversationMembers(conversations);
-            const conversation = conversations.find((c) => c.id === conversationId);
-            if (!conversation)
-                return;
             // Build reply functions
-            const replyFinal = async (text, options) => {
+            const replyFinal = async (text, options, delivery) => {
                 throwIfAborted();
                 try {
                     await this.typingSignals.start(conversationId, 'typing');
@@ -1443,11 +1508,11 @@ export class CanonAgent {
                 };
                 let result;
                 try {
-                    result = await sendDurableMessage(text, finalOptions, ['sdk', 'final', conversationId, turnId]);
+                    result = await sendDurableMessage(text, finalOptions, ['sdk', 'final', conversationId, turnId], delivery);
                 }
                 catch (error) {
                     const chunked = isChunkedSendMessageError(error) ? error : null;
-                    if (!chunked || chunked.deliveredMessageIds.length === 0 || isAbortLikeError(error)) {
+                    if (!chunked || chunked.deliveredMessageIds.length === 0 || sendOptions.messageId || isAbortLikeError(error) || isPendingCanonOperation(error)) {
                         throw error;
                     }
                     const requestedReplyBehavior = sendOptions.metadata?.replyBehavior;
@@ -1565,9 +1630,11 @@ export class CanonAgent {
             // override below only covers a retry backoff.
             const abortAwareClient = Object.create(this.apiClient, {
                 sendMessage: {
-                    value: (targetConversationId, targetText, targetOptions) => {
+                    value: (targetConversationId, targetText, targetOptions, delivery) => {
                         throwIfAborted();
-                        return this.apiClient.sendMessage(targetConversationId, targetText, targetOptions);
+                        return delivery?.operationId
+                            ? this.apiClient.sendMessage(targetConversationId, targetText, targetOptions, delivery)
+                            : this.apiClient.sendMessage(targetConversationId, targetText, targetOptions);
                     },
                 },
             });
@@ -1579,7 +1646,7 @@ export class CanonAgent {
             // that FITS still goes out as a single message under the plain id with
             // untouched metadata, so the common case (and the interim→final handoff
             // that keys on that id) is unchanged.
-            const sendDurableMessage = async (text, options, fallbackMessageIdParts) => {
+            const sendDurableMessage = async (text, options, fallbackMessageIdParts, delivery) => {
                 // Counts every durable send the turn attempts, not just the ones that
                 // needed a generated id: teardown reads `durableMessageSequence` to
                 // decide whether the turn genuinely ended silent, and a reply sent
@@ -1591,7 +1658,9 @@ export class CanonAgent {
                     ...(options ?? {}),
                     messageId,
                 }, {
-                    sleep: (ms) => sleepWithAbort(ms, abortController.signal),
+                    signal: abortController.signal,
+                    ...(delivery?.operationId ? { operationId: delivery.operationId } : {}),
+                    ...(delivery?.replacesOperationId ? { replacesOperationId: delivery.replacesOperationId } : {}),
                 }, {
                     resumable: true,
                 });
@@ -1601,21 +1670,14 @@ export class CanonAgent {
                 // the end of the answer, not its head. `messageIds` has the full set.
                 return { messageId: messageIds[messageIds.length - 1], messageIds };
             };
-            // Build agent context (fallback to minimal if not yet received)
-            const agent = this.agentContext ?? {
-                agentId: this.agentId,
-                ownerId: '',
-                ownerName: '',
-                discoverable: false,
-                inboundPolicy: 'approval-required',
-                outboundPolicy: 'approval-required',
-                groupJoinPolicy: 'approval-required',
-            };
+            // Runtime context must come from authenticated agent metadata. A synthetic
+            // generation cannot authorize an endpoint or a new owner's native work.
+            const agent = this.agentContext ?? await this.apiClient.getAgentMe();
             const provenance = latestMessage
                 ? resolveRuntimeProvenance({
                     provenance: provenanceByMessageId?.get(latestMessage.id) ?? null,
                     conversationId,
-                    conversationType: conversation.type,
+                    conversationType: resolveConversationPolicyScope(conversation.memberIds),
                     memberCount: conversation.memberIds.length,
                     senderId: latestMessage.senderId,
                     senderName: latestMessage.senderName ?? latestMessage.senderId,
@@ -1628,7 +1690,7 @@ export class CanonAgent {
                 })
                 : resolveRuntimeProvenance({
                     conversationId,
-                    conversationType: conversation.type,
+                    conversationType: resolveConversationPolicyScope(conversation.memberIds),
                     memberCount: conversation.memberIds.length,
                     senderId: '',
                     senderType: 'human',
@@ -1663,7 +1725,7 @@ export class CanonAgent {
                 content: latestMessage ? renderCanonHostInboundContent(latestMessage) : '[Empty message]',
                 conversationId,
                 participantContext: {
-                    conversationType: conversation.type,
+                    conversationType: resolveConversationPolicyScope(conversation.memberIds),
                     memberCount: conversation.memberIds.length,
                     senderType: latestMessage?.senderType ?? provenance.sender.type,
                     senderName: latestMessage?.senderName
@@ -2129,8 +2191,15 @@ export class CanonAgent {
                     catch { }
                 }
             };
-            // Invoke handler
+            // Fence uncertain native/business effects before handing execution out.
+            // A crash after this write requires provider/operator reconciliation.
             throwIfAborted();
+            // Every SDK message handler invocation originates in Canon admission. A
+            // restored native queue without its journal must await migration instead
+            // of treating a missing record as permission to execute.
+            const journaled = messages.map((message) => `message:${conversationId}:${message.id}`);
+            if (!journaled.length || !await endpoint.claimInbound(journaled))
+                return;
             await this.handler({
                 messages: hydratedMessages,
                 history,
@@ -2139,6 +2208,19 @@ export class CanonAgent {
                 conversation,
                 ...(groupContext ? { groupContext } : {}),
                 replyFinal,
+                getReplyOperation: (messageId, delivery) => this.apiClient.getMessageOperation(conversationId, messageId, delivery),
+                waitForReply: async (operationId) => {
+                    throwIfAborted();
+                    durableMessageSequence += 1;
+                    const result = await this.apiClient.waitForOperation(operationId, { signal: abortController.signal });
+                    if (typeof result?.messageId !== 'string' || !result.messageId)
+                        throw new Error('Canon returned a malformed message receipt');
+                    try {
+                        await this.typingSignals.clear(conversationId);
+                    }
+                    catch { }
+                    return { messageId: result.messageId, messageIds: result.messageIds ?? [result.messageId] };
+                },
                 replyProgress,
                 deleteMessage,
                 markAsRead,
@@ -2291,6 +2373,7 @@ export class CanonAgent {
                     },
                 },
             });
+            await setInputState('settled', 'handler-completed');
             // Auto-mark conversation as read after successful processing
             if (this.options.autoMarkRead) {
                 try {

package/dist/media.d.ts

@@ -15,6 +15,8 @@ export interface MaterializeMediaOptions {
     onError?: (error: unknown, attachment: MediaAttachment, index: number) => void;
 }
 export interface UploadMediaFileOptions {
+    /** Stable native/product job key for upload recovery across restarts. */
+    attachmentId?: string;
     fileName?: string;
     mimeType?: string;
     durationMs?: number;
@@ -22,6 +24,12 @@ export interface UploadMediaFileOptions {
     signal?: AbortSignal;
 }
 export interface ReplyWithFileOptions extends Omit<SendMessageOptions, 'attachments' | 'contentType'>, UploadMediaFileOptions {
+    /**
+     * Optional local policy check after upload/finalization, immediately before
+     * publishing the attachment. Returning false withholds the message. Automatic
+     * artifact routing uses this to recheck its current audience.
+     */
+    canPublish?: () => boolean;
 }
 export interface MaterializedCanonAttachment extends MediaAttachment {
     index: number;

package/dist/media.js

@@ -1,4 +1,4 @@
-import { createReadStream, createWriteStream } from 'node:fs';
+import { createWriteStream } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import { mkdir, open, rename, stat, unlink } from 'node:fs/promises';
 import { basename, dirname, extname, join } from 'node:path';
@@ -321,95 +321,47 @@ export async function uploadMediaFile(client, conversationId, filePath, options)
     }
     const mimeType = inferUploadMimeType(filePath, options?.mimeType);
     const fileName = options?.fileName ?? basename(filePath);
-    const session = await client.createResumableMediaUpload(conversationId, fileStat.size, mimeType, fileName);
-    options?.signal?.throwIfAborted();
-    if (typeof session.uploadId !== 'string' || session.uploadId.length === 0) {
-        throw new Error('Canon returned an invalid resumable upload ID');
-    }
-    if (session.sizeBytes !== fileStat.size) {
-        throw new Error('Canon resumable upload size does not match the local file');
-    }
-    if (typeof session.mimeType !== 'string' || session.mimeType.length === 0) {
-        throw new Error('Canon returned an invalid resumable upload MIME type');
-    }
-    let uploadUrl;
-    try {
-        uploadUrl = new URL(session.uploadUrl);
-    }
-    catch {
-        throw new Error('Canon returned an invalid resumable upload URL');
-    }
-    if (uploadUrl.protocol !== 'https:') {
-        throw new Error('Canon returned a non-HTTPS resumable upload URL');
-    }
-    if (uploadUrl.hostname !== 'storage.googleapis.com'
-        || uploadUrl.username.length > 0
-        || uploadUrl.password.length > 0) {
-        throw new Error('Canon returned an untrusted resumable upload URL');
-    }
-    const fetchImpl = ensureFetch(options?.fetchImpl);
-    const uploadResponse = await fetchImpl(uploadUrl, {
-        method: 'PUT',
-        headers: {
-            'Content-Type': session.mimeType,
-            'Content-Length': String(fileStat.size),
-            'Content-Range': `bytes 0-${fileStat.size - 1}/${fileStat.size}`,
-        },
-        body: createReadStream(filePath),
-        signal: options?.signal,
-        // Node requires this for streaming request bodies. It is intentionally
-        // outside the DOM RequestInit type but supported by the built-in fetch.
-        duplex: 'half',
-    });
-    if (!uploadResponse.ok) {
-        throw new Error(`Failed to upload Canon media (${uploadResponse.status} ${uploadResponse.statusText})`);
-    }
-    options?.signal?.throwIfAborted();
-    const finalized = await client.finalizeResumableMediaUpload(session.uploadId);
-    options?.signal?.throwIfAborted();
-    if (finalized.uploadId !== session.uploadId) {
-        throw new Error('Canon resumable upload result does not match its session');
-    }
-    if (finalized.attachment.uploadId !== undefined
-        && finalized.attachment.uploadId !== session.uploadId) {
-        throw new Error('Canon resumable upload attachment does not match its session');
-    }
-    const uploaded = {
-        ...finalized,
-        attachment: {
-            ...finalized.attachment,
-            uploadId: session.uploadId,
-        },
-    };
-    if (uploaded.attachment.kind === 'audio'
-        && typeof options?.durationMs === 'number'
-        && Number.isFinite(options.durationMs)
-        && options.durationMs > 0) {
-        return {
-            ...uploaded,
-            attachment: {
-                ...uploaded.attachment,
-                durationMs: Math.round(options.durationMs),
-            },
-        };
-    }
-    return uploaded;
+    const media = await client.getFileMediaPipeline(options?.fetchImpl);
+    const [attachment] = await media.prepare({ conversationId, attachmentId: options?.attachmentId ?? randomUUID(),
+        files: [{ source: filePath, descriptor: { mimeType, sizeBytes: fileStat.size, fileName,
+                    ...(options?.durationMs !== undefined ? { durationMs: options.durationMs } : {}) } }],
+    }, { signal: options?.signal });
+    if (typeof attachment?.uploadId !== 'string' || typeof attachment.url !== 'string') {
+        throw new Error('Canon returned an invalid prepared attachment');
+    }
+    return { uploadId: attachment.uploadId, url: attachment.url, attachment: attachment };
 }
 export async function sendMediaFileMessage(client, conversationId, filePath, text = '', options) {
-    const { fileName, mimeType, durationMs, fetchImpl, signal, ...sendOptions } = options ?? {};
-    const uploaded = await uploadMediaFile(client, conversationId, filePath, {
-        ...(fileName ? { fileName } : {}),
-        ...(mimeType ? { mimeType } : {}),
-        ...(durationMs != null ? { durationMs } : {}),
-        ...(fetchImpl ? { fetchImpl } : {}),
-        ...(signal ? { signal } : {}),
-    });
+    const { fileName, mimeType, durationMs, fetchImpl, signal, canPublish, attachmentId: _attachmentId, ...sendOptions } = options ?? {};
     signal?.throwIfAborted();
-    return client.sendMessage(conversationId, text, {
-        ...sendOptions,
-        contentType: uploaded.attachment.kind,
-        attachments: [uploaded.attachment],
-    });
+    const info = await stat(filePath);
+    if (!info.isFile() || info.size <= 0 || info.size > MAX_CANON_MEDIA_BYTES) {
+        throw new Error('Canon media must be a regular file from 1 byte to 100 MiB');
+    }
+    const effectiveMimeType = inferUploadMimeType(filePath, mimeType);
+    const contentType = effectiveMimeType.startsWith('image/') ? 'image'
+        : effectiveMimeType.startsWith('video/') ? 'video'
+            : effectiveMimeType.startsWith('audio/') ? 'audio' : 'file';
+    // Automatic artifacts keep their audience across upload and every later
+    // receipt retry. A membership change may reduce, but never expand, that audience.
+    const initialRoom = canPublish ? await client.getConversation(conversationId) : null;
+    const originalMembers = new Set(initialRoom?.memberIds ?? []);
+    const beforePublish = canPublish ? async () => {
+        const current = await client.getConversation(conversationId);
+        return !!current && originalMembers.size > 0
+            && current.memberIds.every((id) => originalMembers.has(id)) && canPublish();
+    } : undefined;
+    const messageId = sendOptions.messageId ?? randomUUID();
+    const pipeline = await client.getFileMediaPipeline(fetchImpl);
+    const delivered = await pipeline.send({
+        conversationId, messageId,
+        message: { ...sendOptions, text, contentType },
+        files: [{ source: filePath, descriptor: {
+                    mimeType: effectiveMimeType, sizeBytes: info.size, fileName: fileName ?? basename(filePath),
+                    ...(durationMs != null ? { durationMs } : {}),
+                } }],
+    }, { ...(signal ? { signal } : {}), ...(beforePublish ? { beforePublish } : {}) });
+    return { messageId: delivered };
 }
 /**
  * Resolve the effective MIME type of a materialized attachment, falling back

package/dist/realtime.d.ts

@@ -1,4 +1,4 @@
-import { type AgentContext, type ContactAddedPayload, type ContactRemovedPayload, type ConversationUpdatedPayload, type MessageUpdatedPayload, type ParticipationSuppressedPayload, type VoiceSessionEventPayload } from '@canonmsg/core';
+import { type CanonEndpoint, type AgentContext, type ContactAddedPayload, type ContactRemovedPayload, type ConversationUpdatedPayload, type MessageUpdatedPayload, type ParticipationSuppressedPayload, type VoiceSessionEventPayload } from '@canonmsg/core';
 import { Debouncer } from './debouncer.js';
 /**
  * Wraps @canonmsg/core's CanonStream with SDK-specific features:
@@ -9,8 +9,8 @@ import { Debouncer } from './debouncer.js';
 export declare class RealtimeManager {
     private debouncer;
     private stream;
-    /** Recent inbound message IDs (`conversationId:messageId`) for cross-flush dedupe. */
-    private readonly recentInboundMessageIds;
+    private readonly endpoint;
+    private readonly inbound;
     private lastSseErrorKey;
     private lastSseErrorAt;
     private suppressedSseErrorCount;
@@ -25,12 +25,12 @@ export declare class RealtimeManager {
     private onDisconnected;
     private onCallStarted;
     private onCallEnded;
-    constructor(apiKey: string, debouncer: Debouncer, agentId: string, streamUrl?: string, options?: {
+    constructor(apiKey: string, debouncer: Debouncer, agentId: string, streamUrl: string | undefined, options: {
         enableVoiceEvents?: boolean;
+        endpoint: CanonEndpoint;
     });
-    private hasSeenInboundMessage;
-    private recordSeenInboundMessage;
-    private pruneRecentInboundMessageIds;
+    private receive;
+    private offer;
     private logSseError;
     setOnAgentContext(cb: (ctx: AgentContext) => void): void;
     setContactGraphHandlers(handlers: {

package/dist/realtime.js

@@ -1,6 +1,4 @@
 import { CanonStream, } from '@canonmsg/core';
-const RECENT_INBOUND_TTL_MS = 30 * 60 * 1000;
-const MAX_RECENT_INBOUND_MESSAGE_IDS = 5000;
 /**
  * Wraps @canonmsg/core's CanonStream with SDK-specific features:
  * - Debouncer integration (message batching)
@@ -10,8 +8,8 @@ const MAX_RECENT_INBOUND_MESSAGE_IDS = 5000;
 export class RealtimeManager {
     debouncer;
     stream;
-    /** Recent inbound message IDs (`conversationId:messageId`) for cross-flush dedupe. */
-    recentInboundMessageIds = new Map();
+    endpoint;
+    inbound;
     lastSseErrorKey = null;
     lastSseErrorAt = 0;
     suppressedSseErrorCount = 0;
@@ -28,10 +26,13 @@ export class RealtimeManager {
     onCallEnded = null;
     constructor(apiKey, debouncer, agentId, streamUrl, options) {
         this.debouncer = debouncer;
+        this.endpoint = options.endpoint;
+        this.inbound = this.endpoint.acceptInbound({ kind: 'message.created',
+            offer: (event) => this.offer(event.data),
+            onError: (error) => this.logSseError(error instanceof Error ? error : new Error(String(error))), });
         this.stream = new CanonStream({
-            apiKey,
+            endpoint: this.endpoint,
             agentId,
-            streamUrl,
             handler: {
                 // The voice family is requested from handler PRESENCE at stream
                 // construction, so these delegating closures exist only when the
@@ -49,44 +50,7 @@ export class RealtimeManager {
                     }
                     : {}),
                 onMessage: (payload) => {
-                    // Cross-flush id dedupe: SSE replay overlap must never double-fire
-                    // a turn for the same message.
-                    if (this.hasSeenInboundMessage(payload.conversationId, payload.message.id)) {
-                        return;
-                    }
-                    this.recordSeenInboundMessage(payload.conversationId, payload.message.id);
-                    if (payload.turnDispatch && payload.turnDispatch.kind !== 'run_turn') {
-                        console.error(`[canon-sdk] Ignoring server-dispatched observe-only message in ${payload.conversationId}: ${payload.turnDispatch.reason}`);
-                        return;
-                    }
-                    const m = payload.message;
-                    const message = {
-                        id: m.id,
-                        senderId: m.senderId,
-                        ...(m.senderName ? { senderName: m.senderName } : {}),
-                        senderType: m.senderType ?? 'human',
-                        isOwner: m.isOwner ?? false,
-                        contentType: m.contentType ?? 'text',
-                        text: m.text ?? null,
-                        attachments: m.attachments ?? [],
-                        mentions: m.mentions ?? [],
-                        ...(m.reactions ? { reactions: m.reactions } : {}),
-                        replyTo: m.replyTo ?? null,
-                        replyToPosition: m.replyToPosition ?? null,
-                        ...(m.forwarded === true || m.forwardedFrom
-                            ? { forwarded: true }
-                            : {}),
-                        ...(m.forwardedFrom
-                            ? { forwardedFrom: m.forwardedFrom }
-                            : {}),
-                        status: 'sent',
-                        deleted: false,
-                        createdAt: m.createdAt ?? new Date().toISOString(),
-                        ...(m.contactCard ? { contactCard: m.contactCard } : {}),
-                        ...(m.metadata ? { metadata: m.metadata } : {}),
-                        ...(payload.replyAuthority ? { replyAuthority: payload.replyAuthority } : {}),
-                    };
-                    this.debouncer.add(payload.conversationId, message, payload.provenance ?? null);
+                    void this.receive(payload).catch((error) => this.logSseError(error instanceof Error ? error : new Error(String(error))));
                 },
                 onMessageDeleted: (payload) => {
                     this.debouncer.removeMessage(payload.conversationId, payload.messageId);
@@ -105,7 +69,9 @@ export class RealtimeManager {
                     this.onContactRemoved?.(payload);
                 },
                 onConversationUpdated: (payload) => {
-                    this.onConversationUpdated?.(payload);
+                    void this.endpoint.applyConversationSnapshot({ id: payload.conversationId, ...payload.changes })
+                        .then(({ id: _id, ...changes }) => this.onConversationUpdated?.({ ...payload, changes }))
+                        .catch((error) => this.logSseError(error instanceof Error ? error : new Error(String(error))));
                 },
                 onParticipationSuppressed: (payload) => {
                     this.onParticipationSuppressed?.(payload);
@@ -117,7 +83,7 @@ export class RealtimeManager {
                     this.onDisconnected?.();
                 },
                 onReplayExpired: (payload) => {
-                    console.error(`[canon-sdk] SSE replay window expired${payload.lastAvailableId ? ` (oldest available event: ${payload.lastAvailableId})` : ''}; missed history is available via explicit REST fetch`);
+                    console.error(`[canon-sdk] SSE replay window expired${payload.lastAvailableId ? ` (oldest available event: ${payload.lastAvailableId})` : ''}; the endpoint is recovering the durable gap`);
                 },
                 onError: (err) => {
                     this.logSseError(err);
@@ -125,27 +91,45 @@ export class RealtimeManager {
             },
         });
     }
-    hasSeenInboundMessage(conversationId, messageId) {
-        return this.recentInboundMessageIds.has(`${conversationId}:${messageId}`);
-    }
-    recordSeenInboundMessage(conversationId, messageId) {
-        const now = Date.now();
-        this.recentInboundMessageIds.set(`${conversationId}:${messageId}`, now);
-        this.pruneRecentInboundMessageIds(now);
+    async receive(payload) {
+        await this.inbound.receive({ id: `message:${payload.conversationId}:${payload.message.id}`,
+            kind: 'message.created', conversationId: payload.conversationId, durable: true,
+            data: payload });
     }
-    pruneRecentInboundMessageIds(now = Date.now()) {
-        const cutoff = now - RECENT_INBOUND_TTL_MS;
-        for (const [key, seenAt] of this.recentInboundMessageIds) {
-            if (seenAt < cutoff) {
-                this.recentInboundMessageIds.delete(key);
-            }
-        }
-        while (this.recentInboundMessageIds.size > MAX_RECENT_INBOUND_MESSAGE_IDS) {
-            const oldestKey = this.recentInboundMessageIds.keys().next().value;
-            if (!oldestKey)
-                break;
-            this.recentInboundMessageIds.delete(oldestKey);
+    async offer(payload) {
+        const id = `message:${payload.conversationId}:${payload.message.id}`;
+        if (payload.turnDispatch && payload.turnDispatch.kind !== 'run_turn') {
+            await this.endpoint.setInboundState(id, 'settled', 'observe-only');
+            return;
         }
+        const m = payload.message;
+        const message = {
+            id: m.id,
+            senderId: m.senderId,
+            ...(m.senderName ? { senderName: m.senderName } : {}),
+            senderType: m.senderType ?? 'human',
+            isOwner: m.isOwner ?? false,
+            contentType: m.contentType ?? 'text',
+            text: m.text ?? null,
+            attachments: m.attachments ?? [],
+            mentions: m.mentions ?? [],
+            ...(m.reactions ? { reactions: m.reactions } : {}),
+            replyTo: m.replyTo ?? null,
+            replyToPosition: m.replyToPosition ?? null,
+            ...(m.forwarded === true || m.forwardedFrom
+                ? { forwarded: true }
+                : {}),
+            ...(m.forwardedFrom
+                ? { forwardedFrom: m.forwardedFrom }
+                : {}),
+            status: 'sent',
+            deleted: false,
+            createdAt: m.createdAt ?? new Date().toISOString(),
+            ...(m.contactCard ? { contactCard: m.contactCard } : {}),
+            ...(m.metadata ? { metadata: m.metadata } : {}),
+            ...(payload.replyAuthority ? { replyAuthority: payload.replyAuthority } : {}),
+        };
+        this.debouncer.add(payload.conversationId, message, payload.provenance ?? null);
     }
     logSseError(err) {
         const code = err.code;
@@ -196,9 +180,11 @@ export class RealtimeManager {
         this.onCallEnded = handlers.onCallEnded ?? null;
     }
     async start() {
+        this.inbound.start();
         await this.stream.start();
     }
     stop() {
+        void this.inbound.close();
         this.stream.stop();
     }
 }

package/dist/types.d.ts

@@ -166,7 +166,16 @@ export interface MessageHandlerContext {
     conversation: CanonConversation;
     /** Lightweight group awareness, present for group conversations. */
     groupContext?: CanonGroupContext;
-    replyFinal: (text: string, options?: SendMessageOptions) => Promise<FinalMessageResult>;
+    replyFinal: (text: string, options?: SendMessageOptions, delivery?: {
+        operationId?: string;
+        replacesOperationId?: string;
+    }) => Promise<FinalMessageResult>;
+    /** Inspect a prior reply before renewing media or recording product completion. */
+    getReplyOperation: (messageId: string, delivery?: {
+        operationId?: string;
+    }) => Promise<import('@canonmsg/core').CanonMessageOperation | undefined>;
+    /** Reconcile every part of a journaled reply without rebuilding its content. */
+    waitForReply: (operationId: string) => Promise<FinalMessageResult>;
     replyProgress: (text: string, options?: ProgressMessageOptions) => Promise<ProgressMessageResult>;
     /** Soft-delete a message (agent must be the sender) */
     deleteMessage: (messageId: string) => Promise<void>;
@@ -307,6 +316,8 @@ export interface CanonAgentConnectionOptions {
     firebaseApiKey?: string;
 }
 export interface CanonAgentOptions extends CanonAgentConnectionOptions {
+    /** Shared durable engine or persistent installation profile for this runtime. */
+    endpoint?: import('@canonmsg/core').CanonClientEndpointOptions;
     apiKey: string;
     /** `auto` resolves to SSE. */
     deliveryMode?: DeliveryMode;

package/dist/work-session-host.js

@@ -9,7 +9,7 @@ export function createCanonWorkSessionHost(options) {
     const runtime = resolveCanonRuntimeConnection({ environmentId: connection.environmentId,
         apiBaseUrl: connection.baseUrl, streamUrl: connection.streamUrl,
         rtdbUrl: connection.rtdbUrl, firebaseWebApiKey: connection.firebaseApiKey });
-    const client = new CanonClient(connection.apiKey, runtime.apiBaseUrl);
+    const client = new CanonClient(connection.apiKey, runtime.apiBaseUrl, { environmentId: runtime.environmentId, streamUrl: runtime.streamUrl });
     const journal = createWorkSessionJournal(options.store, {
         environmentId: connection.environmentId, agentId: connection.agentId, hostId: options.hostId,
     });
@@ -30,6 +30,7 @@ export function createCanonWorkSessionHost(options) {
     let transport;
     let stream;
     let connected = false;
+    let agentContext;
     let stopped = false;
     let startPromise;
     let stopPromise;
@@ -134,7 +135,7 @@ export function createCanonWorkSessionHost(options) {
             throw new Error('This conversation already has a work session.');
         if ([...rooms.values()].some((room) => room.binding.nativeSessionId === binding.nativeSessionId))
             throw new Error('This native session already has a different Canon audience.');
-        const conversation = (await client.getConversations()).find((entry) => entry.id === binding.conversationId);
+        const conversation = await client.getConversation(binding.conversationId);
         if (!conversation?.memberIds.includes(connection.agentId) || !conversation.memberIds.includes(broker.ownerId))
             throw new Error('The owner and agent must both be members of this conversation.');
         fence();
@@ -446,11 +447,19 @@ export function createCanonWorkSessionHost(options) {
             transport = { agentId: connection.agentId, environmentId: connection.environmentId, client, publisher,
                 hasPendingInteraction: (id) => pending.has(id),
                 isRouteActive: (id) => !stopped && rooms.get(id)?.acknowledged === true,
-                subscribe: (handler) => { handlers.add(handler); if (connected && !stopped)
-                    handler.onConnected?.(); return () => { handlers.delete(handler); }; } };
+                subscribe: (handler) => {
+                    handlers.add(handler);
+                    // Context is account state, not a one-shot notification. An attachment
+                    // created after stream startup needs the same trusted owner identity.
+                    if (!stopped && agentContext)
+                        handler.onAgentContext?.(agentContext);
+                    if (connected && !stopped)
+                        handler.onConnected?.();
+                    return () => { handlers.delete(handler); };
+                } };
             const connectionReady = new Promise((resolve, reject) => { resolveConnection = resolve; rejectConnection = reject; });
             const connectionTimer = setTimeout(() => rejectConnection?.(new Error('Canon stream did not connect; work-session setup was not started.')), connectTimeoutMs);
-            stream = new CanonStream({ apiKey: connection.apiKey, agentId: connection.agentId, streamUrl: runtime.streamUrl, handler: {
+            stream = new CanonStream({ endpoint: await client.getEndpoint(), agentId: connection.agentId, handler: {
                     onMessage: (payload) => {
                         if (stopped || !connected)
                             return;
@@ -462,6 +471,7 @@ export function createCanonWorkSessionHost(options) {
                             fail(new Error('Canon stream identity changed.'), 'stream-identity');
                             return;
                         }
+                        agentContext = context;
                         fanout('onAgentContext', context);
                     },
                     onConversationUpdated: (payload) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/agent-sdk",
-  "version": "10.3.0",
+  "version": "11.0.0",
   "description": "Canon Agent SDK — build AI agents that participate in Canon conversations",
   "type": "module",
   "main": "dist/index.js",
@@ -25,10 +25,10 @@
     "prepack": "npm run build"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.22.3"
   },
   "dependencies": {
-    "@canonmsg/core": "^12.4.0"
+    "@canonmsg/core": "^13.0.0"
   },
   "publishConfig": {
     "access": "public"