@canonmsg/agent-sdk 11.2.0 → 12.0.0

package/dist/chunks/mls-crypto-NZDNSPAO.js

@@ -0,0 +1,10 @@
+import {
+  MLS_DEV_DEVICE_HTTP_CONFIGURATION,
+  createMlsDevCredentialVerifier,
+  parseMlsDevClientConfiguration
+} from "./chunk-FPQFTTND.js";
+export {
+  MLS_DEV_DEVICE_HTTP_CONFIGURATION,
+  createMlsDevCredentialVerifier,
+  parseMlsDevClientConfiguration
+};

package/dist/cli.js

@@ -0,0 +1,198 @@
+#!/usr/bin/env node
+import {
+  assertPrivateHome,
+  checkCodex,
+  claudeDriver,
+  codeDriver,
+  codexDriver,
+  createRunner,
+  loadClaudeQuery
+} from "./chunks/chunk-6VK4UZHJ.js";
+import {
+  loadProfiles,
+  runCli
+} from "./chunks/chunk-OLJ7H4E2.js";
+import {
+  __name
+} from "./chunks/chunk-FPQFTTND.js";
+
+// src/cli.ts
+import { realpathSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseArgs } from "node:util";
+var HELP = `canon-agent: run a Canon agent on the unified runner
+
+Usage:
+  canon-agent run --driver code --module <path> [--profile <name>] [--environment <id>]
+  canon-agent run --driver claude [--cwd <dir>] [--model <id>] [--permission-mode <mode>]
+                  [--claude-path <path>] [--profile <name>] [--environment <id>]
+  canon-agent run --driver codex [--cwd <dir>] [--model <id>] [--sandbox <mode>]
+                  [--approval-policy <policy>] [--codex-path <path>] [--profile <name>]
+                  [--environment <id>]
+
+Flags:
+  --driver <name>        The runtime driver: "code", "claude" or "codex".
+  --module <path>        code: an ES module whose default export answers a turn.
+                         Its directory is one the agent may send files from.
+  --cwd <dir>            claude, codex: the directory the runtime works in (default:
+                         the current one). The agent may send files from it.
+  --model <id>           claude, codex: the model (default: the runtime's).
+  --permission-mode <m>  claude: "default" puts each tool call Claude Code would ask
+                         about to Canon as an approval; "acceptEdits" and
+                         "bypassPermissions" allow more without asking, and then
+                         only the owner's messages may lead to tool use.
+  --claude-path <path>   claude: a Claude Code executable to use instead of the
+                         SDK's bundled one.
+  --sandbox <mode>       codex: "workspace-write" (default), "read-only" or
+                         "danger-full-access", for the owner's turns.
+  --approval-policy <p>  codex: "on-request" (default), "untrusted" or "never": when
+                         Codex asks the owner (as a Canon approval) before acting.
+                         Turns holding anyone else's message are always read-only,
+                         approve nothing and get only Canon's tools.
+  --codex-path <path>    codex: the Codex CLI (default: codex on the PATH).
+  --profile <name>       A profile in $CANON_HOME/agents.json (key and endpoints).
+  --environment <id>     canon-prod-v1 or canon-dev-v1 (default: CANON_ENVIRONMENT_ID).
+  --help, -h             Show this help.
+  --version, -V          Show the package version.
+
+Environment:
+  CANON_API_KEY          The agent's key (or use --profile).
+  CANON_ENVIRONMENT_ID   Required; a profile from another environment is refused.
+  CANON_HOME             Agent state, default ~/.canon. It must be private (0700).
+  ANTHROPIC_API_KEY      claude: use this API key instead of a Claude subscription
+                         login. The claude driver needs @anthropic-ai/claude-agent-sdk.
+  OPENAI_API_KEY         codex: use this API key instead of Codex's own login, unless
+                         Codex is configured for another model provider.
+
+SIGTERM or Ctrl-C stops taking messages, lets running turns finish for 10 seconds,
+then stops them.`;
+var DRIVERS = ["code", "claude", "codex", "hermes"];
+var AVAILABLE = ["code", "claude", "codex"];
+var PERMISSION_MODES = ["default", "acceptEdits", "bypassPermissions"];
+var SANDBOXES = ["workspace-write", "read-only", "danger-full-access"];
+var APPROVAL_POLICIES = ["on-request", "untrusted", "never"];
+var UsageError = class extends Error {
+  static {
+    __name(this, "UsageError");
+  }
+};
+async function main() {
+  let parsed;
+  try {
+    parsed = parse();
+  } catch (error) {
+    throw new UsageError(error instanceof Error ? error.message : String(error));
+  }
+  const { values, positionals } = parsed;
+  if (positionals[0] !== "run" || positionals.length > 1) throw new UsageError('Expected the "run" command.');
+  if (!values.driver) throw new UsageError("--driver is required.");
+  if (!AVAILABLE.includes(values.driver)) {
+    throw new Error(DRIVERS.includes(values.driver) ? `The "${values.driver}" driver is not yet available; ${AVAILABLE.join(", ")} run today.` : `Unknown driver "${values.driver}". Available: ${AVAILABLE.join(", ")}.`);
+  }
+  if (values.driver === "code" && !values.module) throw new UsageError("--driver code needs --module <path>.");
+  const permissionMode = values["permission-mode"];
+  if (permissionMode !== void 0 && !PERMISSION_MODES.includes(permissionMode)) {
+    throw new UsageError(`--permission-mode must be one of ${PERMISSION_MODES.join(", ")}.`);
+  }
+  const { sandbox, "approval-policy": approvalPolicy } = values;
+  if (sandbox !== void 0 && !SANDBOXES.includes(sandbox)) {
+    throw new UsageError(`--sandbox must be one of ${SANDBOXES.join(", ")}.`);
+  }
+  if (approvalPolicy !== void 0 && !APPROVAL_POLICIES.includes(approvalPolicy)) {
+    throw new UsageError(`--approval-policy must be one of ${APPROVAL_POLICIES.join(", ")}.`);
+  }
+  const environmentId = values.environment || process.env.CANON_ENVIRONMENT_ID;
+  if (!environmentId) throw new Error("CANON_ENVIRONMENT_ID (or --environment) is required.");
+  if (!values.profile && !process.env.CANON_API_KEY) throw new Error("CANON_API_KEY (or --profile <name>) is required.");
+  const home = resolve(process.env.CANON_HOME || join(homedir(), ".canon"));
+  await assertPrivateHome(home);
+  const profile = values.profile ? loadProfiles(home)[values.profile] : void 0;
+  if (values.profile && !profile) throw new Error(`No profile "${values.profile}" in ${join(home, "agents.json")}.`);
+  if (profile && profile.environmentId !== environmentId) {
+    throw new Error(`Profile "${values.profile}" belongs to ${profile.environmentId}, not ${environmentId}.`);
+  }
+  const apiKey = process.env.CANON_API_KEY || profile.apiKey;
+  let driver;
+  if (values.driver === "claude") {
+    driver = claudeDriver({
+      cwd: resolve(values.cwd ?? "."),
+      query: await loadClaudeQuery(),
+      ...values.model ? { model: values.model } : {},
+      ...permissionMode ? { permissionMode } : {},
+      ...values["claude-path"] ? { claudePath: resolve(values["claude-path"]) } : {}
+    });
+  } else if (values.driver === "codex") {
+    const codexPath = values["codex-path"] ? resolve(values["codex-path"]) : "codex";
+    checkCodex(codexPath);
+    driver = codexDriver({
+      cwd: resolve(values.cwd ?? "."),
+      codexPath,
+      ...values.model ? { model: values.model } : {},
+      ...sandbox ? { sandbox } : {},
+      ...approvalPolicy ? { approvalPolicy } : {}
+    });
+  } else {
+    const modulePath = realpathSync(resolve(values.module));
+    const handler = (await import(pathToFileURL(modulePath).href)).default;
+    if (typeof handler !== "function") throw new Error(`${values.module} must export a turn handler as its default export.`);
+    driver = codeDriver(handler, { outboundFiles: { roots: [dirname(modulePath), realpathSync(tmpdir())] } });
+  }
+  const runner = await createRunner({
+    apiKey,
+    environmentId,
+    home,
+    driver,
+    baseUrl: process.env.CANON_BASE_URL || profile?.baseUrl,
+    streamUrl: process.env.CANON_STREAM_URL || profile?.streamUrl
+  });
+  stopOnSignals(runner);
+  try {
+    await runner.start();
+  } catch (error) {
+    await runner.stop().catch(() => void 0);
+    throw error;
+  }
+  console.error(`canon-agent: running the ${values.driver} driver in ${environmentId}. Ctrl-C stops it.`);
+}
+__name(main, "main");
+function parse() {
+  return parseArgs({
+    allowPositionals: true,
+    options: {
+      driver: { type: "string" },
+      module: { type: "string" },
+      profile: { type: "string" },
+      environment: { type: "string" },
+      cwd: { type: "string" },
+      model: { type: "string" },
+      "permission-mode": { type: "string" },
+      "claude-path": { type: "string" },
+      sandbox: { type: "string" },
+      "approval-policy": { type: "string" },
+      "codex-path": { type: "string" }
+    }
+  });
+}
+__name(parse, "parse");
+function stopOnSignals(runner) {
+  let stopping = false;
+  const onSignal = /* @__PURE__ */ __name((signal) => {
+    if (stopping) process.exit(1);
+    stopping = true;
+    console.error(`canon-agent: ${signal}, stopping.`);
+    runner.stop().then(() => process.exit(0), (error) => {
+      console.error(`canon-agent: ${error instanceof Error ? error.message : String(error)}`);
+      process.exit(1);
+    });
+  }, "onSignal");
+  process.on("SIGTERM", onSignal);
+  process.on("SIGINT", onSignal);
+}
+__name(stopOnSignals, "stopOnSignals");
+runCli(import.meta.url, main, (error) => {
+  console.error(`canon-agent: ${error instanceof Error ? error.message : String(error)}`);
+  if (error instanceof UsageError) console.error(HELP.split("\n\nFlags:")[0]);
+  process.exit(1);
+}, { name: "canon-agent", help: HELP });

package/dist/drivers/claude.d.ts

@@ -0,0 +1,36 @@
+import { type RuntimeDriver } from '../runner/types.js';
+/** The Claude Agent SDK's `query()` as the driver uses it: one prompt, one native turn. */
+export type ClaudeQuery = (params: {
+    prompt: string;
+    options: Record<string, unknown>;
+}) => AsyncIterable<unknown> & {
+    interrupt(): Promise<void>;
+    close(): void;
+};
+export interface ClaudeDriverOptions {
+    /** The directory Claude Code works in. The agent may also send files from it. */
+    cwd: string;
+    /** A model id; Claude Code's default otherwise. */
+    model?: string;
+    /**
+     * `default` (the default) puts every tool call Claude Code would ask about to the owner as a Canon approval.
+     * `acceptEdits` and `bypassPermissions` approve more on their own. In every mode, a turn holding anyone else's message
+     * may use only Canon's tools, AskUserQuestion and ToolSearch.
+     */
+    permissionMode?: 'default' | 'acceptEdits' | 'bypassPermissions';
+    /** A Claude Code executable to run instead of the one bundled with the SDK. */
+    claudePath?: string;
+    /** How long an interrupted Claude Code may take to stop before its process is closed (default 5 s). */
+    interruptGraceMs?: number;
+    /** The SDK's `query()` (see `loadClaudeQuery`), loaded on the first turn when unset; tests pass a stand-in. */
+    query?: ClaudeQuery;
+}
+/** Loads the SDK's `query()`; it is an optional peer dependency, installed by whoever runs the `claude` driver. */
+export declare function loadClaudeQuery(): Promise<ClaudeQuery>;
+/**
+ * Runs each turn as one Claude Agent SDK `query()` that resumes the room's native session, whose id the runner keeps in
+ * the driver state. Canon's tools reach Claude only through the runner's per-turn MCP server; Stop interrupts the native
+ * turn and closes its process if it does not stop. One process per session at a time: a room's next turn starts only
+ * after the previous one has exited.
+ */
+export declare function claudeDriver(options: ClaudeDriverOptions): RuntimeDriver;

package/dist/drivers/code.d.ts

@@ -0,0 +1,18 @@
+import type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, RuntimeDriver, TurnInput, TurnTools } from '../runner/types.js';
+/** The `DriverTurn` an in-process handler sees, with friendlier names. */
+export interface CodeTurn {
+    readonly input: TurnInput;
+    readonly prompt: string;
+    readonly files: readonly string[];
+    readonly signal: AbortSignal;
+    /** The full visible answer so far; a preview, never the final. */
+    stream(text: string): void;
+    activity(event: ActivityEvent): void;
+    ask(request: AskRequest): Promise<AskAnswer>;
+    readonly state: DriverState;
+    readonly tools: TurnTools;
+}
+/** Return the turn's one final: text, `null` for deliberate silence, or text with files. */
+export type CodeHandler = (turn: CodeTurn) => Promise<string | null | DriverResult> | string | null | DriverResult;
+/** Runs a turn as an in-process function. The runner owns every Canon behaviour around it. */
+export declare function codeDriver(handler: CodeHandler, capabilities?: Partial<DriverCapabilities>): RuntimeDriver;

package/dist/drivers/codex.d.ts

@@ -0,0 +1,37 @@
+import { type DriverTurn, type RuntimeDriver } from '../runner/types.js';
+export interface CodexDriverOptions {
+    /** The directory Codex works in. The agent may also send files from it. */
+    cwd: string;
+    /** A model id; Codex's configured default otherwise. */
+    model?: string;
+    /** Codex's sandbox for the owner's turns: `workspace-write` (the default), `read-only` or `danger-full-access`. */
+    sandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
+    /**
+     * When Codex asks before acting in the owner's turns: `on-request` (the default), `untrusted` or `never`. Each request
+     * becomes a Canon approval. A turn holding anyone else's message is always read-only and approves nothing.
+     */
+    approvalPolicy?: 'untrusted' | 'on-request' | 'never';
+    /** The Codex CLI (default: `codex` on the PATH). */
+    codexPath?: string;
+    /** How long an interrupted Codex may take to stop before its process is closed (default 5 s). */
+    interruptGraceMs?: number;
+}
+type Json = Record<string, unknown>;
+/** Checks the Codex CLI runs at all; the CLI calls it at startup so a missing install fails at once. */
+export declare function checkCodex(codexPath?: string): string;
+/**
+ * Codex's requests to its client, from the turn's thread or a subagent's. Approvals are scoped to exactly what they
+ * allow: a session approval covers the same command with the same directory, network destination and permissions, the
+ * same set of files or the same MCP tool, never "commands". A request whose scope is not fully known is approved once.
+ * `rpcId` is the request's own JSON-RPC id, the identity of a request that names no item.
+ */
+export declare function answerCodexRequest(turn: DriverTurn, method: string, params: Json, items: Map<string, Json>, rpcId: unknown): Promise<unknown>;
+/**
+ * Runs each turn as one `codex app-server` process that resumes the room's Codex thread, whose id the runner keeps in
+ * the driver state, and exits after the turn. Settings that differ per turn (Canon's tool URL and token, the guard for
+ * turns holding anyone else's message) are thread settings, so a fresh process per turn applies them exactly. Canon's
+ * tools reach Codex only as the turn's `canon` MCP server; Stop interrupts the native turn and closes a process that
+ * does not stop. A room's next turn starts only after the previous process has exited.
+ */
+export declare function codexDriver(options: CodexDriverOptions): RuntimeDriver;
+export {};

package/dist/index.d.ts

@@ -1,27 +1,14 @@
-export { CanonAgent } from './canon-agent.js';
-export { createCanonManagedSessionHost } from './managed-session-host.js';
-export type { CanonManagedSessionHostOptions } from './managed-session-host.js';
-export { MANAGED_EXECUTION_MODE_LABELS, buildManagedSessionCatalog, configureManagedSession, findManagedSessionState, hasSavedNativeSession, inspectGitEnvironment, managedSessionFields, observedSessionFields, savedSessionFields, savedSessionMatchesOwner, } from './managed-session-setup.js';
-export type { ManagedSessionConfiguredFacts, ManagedSessionProject, ManagedSessionRuntime, } from './managed-session-setup.js';
-export { clearPendingRegistration, ensureAgentProfile, resumeRegistration } from '@canonmsg/core';
-export type { EnsureAgentProfileOptions, RegistrationCredentials, RegistrationProgress, RegistrationSession, RegistrationStatus, RegistrationStore, ResumeRegistrationOptions } from '@canonmsg/core';
-export type { AgentContactsAPI, AgentConversationsAPI, AgentDirectoryAPI, AgentUsersAPI, } from './canon-agent.js';
-export { ApprovalManager, buildApprovalOutcome, buildApprovalReply, buildApprovalRequest, CanonApiError, DEFAULT_APPROVAL_CONFIG, generateApprovalId, HOST_ADMISSION_ACTION_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, parseApprovalReplyMetadata, parseApprovalRequestMetadata, parseSessionRule, redactSecrets, } from '@canonmsg/core';
-export type { ApprovalConfig, ApprovalNativeRequestMetadata, ApprovalOutcomeMetadata, ApprovalReplyMetadata, ApprovalRequestCategory, ApprovalRequestDetail, ApprovalRequestMetadata, ApprovalResult, ApprovalRisk, CanonContact, CanonRuntimeActivityItem, CanonRuntimeActivityKind, CanonRuntimeActivityStatus, CanonRuntimeTurnModeActivation, CanonRuntimeTurnModeDescriptor, CanonRuntimeTurnModeScope, CanonRuntimeFact, CanonRuntimeFactGroup, CanonResolveAdmissionResult, CanonAgentDirectoryEntry, ContactAddedPayload, ContactCardPayload, ContactRemovedPayload, ContactSource, DiscoverAgentsInput, DiscoverAgentsResult, HostAdmissionActionCapabilities, ParticipationSuppressedPayload, ResolveAdmissionTargetInput, ResolvedAdmissionState, ResolvedAdmissionTargetSummary, ResolvedTargetAdmissionPayload, ResumableMediaUploadResult, MediaAttachment, VideoProcessingStatus, VideoProcessingErrorCode, RuntimeInputAnswers, RuntimeInputChoice, RuntimeInputKind, RuntimeInputNativeMetadata, RuntimeInputQuestion, RuntimePlanRequestPayload, RuntimePlanRequestResult, SessionRule, } from '@canonmsg/core';
-export { SessionManager } from './session-manager.js';
+export { createRunner, runtimeDescriptor } from './runner/runner.js';
+export type { Runner, RunnerOptions } from './runner/runner.js';
+export { DriverSessionError } from './runner/types.js';
+export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
+export { codeDriver } from './drivers/code.js';
+export type { CodeHandler, CodeTurn } from './drivers/code.js';
+export { claudeDriver, loadClaudeQuery } from './drivers/claude.js';
+export type { ClaudeDriverOptions, ClaudeQuery } from './drivers/claude.js';
+export { checkCodex, codexDriver } from './drivers/codex.js';
+export type { CodexDriverOptions } from './drivers/codex.js';
+export { CanonApiError, clearPendingRegistration, ensureAgentProfile, resumeRegistration } from './internal/core/index.js';
+export type { CommunicateInput, CommunicateResult, EnsureAgentProfileOptions, MediaAttachment, RegistrationCredentials, RegistrationProgress, RegistrationSession, RegistrationStatus, RegistrationStore, ResumableMediaUploadResult, ResumeRegistrationOptions, VideoProcessingErrorCode, VideoProcessingStatus, } from './internal/core/index.js';
 export { DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES, DEFAULT_MEDIA_CACHE_DIR, DEFAULT_MEDIA_MATERIALIZATION_BYTES, MAX_ANTHROPIC_IMAGE_RAW_BYTES, MAX_ANTHROPIC_REQUEST_BYTES, MAX_CANON_MEDIA_BYTES, getCodexImagePath, getMessageAttachments, inferUploadMimeType, isAnthropicImageAttachment, conversationMediaCacheDir, materializeAttachment, materializeMessageMedia, materializeReplyContextMedia, resolveAttachmentMimeType, sendMediaFileMessage, toAnthropicImageBlock, toAnthropicImageBlocksWithinBudget, uploadMediaFile, } from './media.js';
 export type { AnthropicImageBlock, AnthropicImageBudgetOptions, AnthropicImageMimeType, MaterializeMediaOptions, MaterializedCanonAttachment, MaterializedCanonReplyContext, ReplyWithFileOptions, UploadMediaFileOptions, } from './media.js';
-export type { SessionConfig, Session } from './session-manager.js';
-export type { CanonAgentTurnVerbosityOption } from './turn-verbosity-option.js';
-export type { AgentContext, CanonGroupContext, CanonKnownRecentParticipant, CanonMembershipChange, CanonMessage, CanonConversation, CommunicateInput, CommunicateResult, DirectConversationSelection, CanonConversationsPage, CanonConversationsPageOptions, CanonReplyContext, CanonSelfContext, CanonTurnContextV2, CanonRuntimeDescriptor, MessageUpdatedPayload, SendMessageOptions, CreateGroupOptions, CreateGroupResult, TurnVerbosity, TurnVerbosityConfig, } from '@canonmsg/core';
-export type { CanonAgentConnectionOptions, CanonAgentOptions, ContactAddedHandler, ContactRemovedHandler, FinalMessageResult, MessageHandler, MessageHandlerContext, MessageUpdatedHandler, ParticipationSuppressedHandler, ProgressMessageOptions, ProgressMessageResult, RuntimeApprovalRequest, RuntimeInputRequest, RuntimeInputResult, RuntimePlanReviewRequest, RuntimePlanReviewResult, RuntimeControlSurface, RuntimePrimitiveContext, RuntimePrimitiveHandler, RuntimePrimitiveHandlers, SessionInfo, SessionOptions, DeliveryMode, } from './types.js';
-export { createCanonAttachedSession, createCanonAttachedSessionPublisher } from './attached-session.js';
-export { createCanonWorkSessionHost } from './work-session-host.js';
-export type { CanonWorkSessionHost, CanonWorkSessionHostOptions } from './work-session-host.js';
-export { createFileWorkSessionHostStore } from './work-session-state.js';
-export type { WorkSessionHostStore, WorkSessionHostJournal } from './work-session-state.js';
-export { createFileAttachedSessionStore } from '@canonmsg/core';
-export type { CanonAttachedSession, CanonAttachedSessionConnection, CanonAttachedSessionOptions, CanonAttachedSessionStatus, } from './attached-session.js';
-export type { AttachedNativeSessionAdapter, AttachedSessionBinding, AttachedSessionJournal, AttachedSessionState, AttachedSessionStore, NativeSessionEvent, NativeSessionItem, NativeSessionSnapshot, NativeSubmissionResult, } from '@canonmsg/core';
-export { ARTIFACT_CONTEXT_PROTOCOL, ARTIFACT_LIMITS, CanonArtifactError, isCanonArtifactEnvironmentEnabled, parseArtifactContext, readArtifactContext, } from '@canonmsg/core';
-export type { CanonConversationArtifacts, CanonArtifactErrorCode, ArtifactConflictView, ArtifactDomainOutcome, ArtifactCreateInput, ArtifactUpdateAction, ArtifactUpdateResult, ArtifactWriteView, ArtifactInputValue, ArtifactList, ArtifactListItem, ArtifactGenerateImageInput, ArtifactGenerateImageResult, ArtifactAddImageInput, ArtifactAddImageResult, ArtifactImageRegion, ArtifactAsset, ArtifactView, ArtifactPrincipalView, ArtifactChessView, ArtifactChessMoveView, ArtifactFormView, ArtifactFormFieldView, ArtifactFormChangeView, ArtifactImageView, ArtifactImageVariantView, ArtifactKind, ArtifactFormField, ArtifactFormFieldType, ArtifactFormValue, ArtifactFormTable, ArtifactFormColumn, ArtifactContext, ArtifactReference, ArtifactReferenceOrigin, ArtifactSelection, } from '@canonmsg/core';

package/dist/index.js

@@ -1,13 +1,69 @@
-export { CanonAgent } from './canon-agent.js';
-export { createCanonManagedSessionHost } from './managed-session-host.js';
-export { MANAGED_EXECUTION_MODE_LABELS, buildManagedSessionCatalog, configureManagedSession, findManagedSessionState, hasSavedNativeSession, inspectGitEnvironment, managedSessionFields, observedSessionFields, savedSessionFields, savedSessionMatchesOwner, } from './managed-session-setup.js';
-export { clearPendingRegistration, ensureAgentProfile, resumeRegistration } from '@canonmsg/core';
-export { ApprovalManager, buildApprovalOutcome, buildApprovalReply, buildApprovalRequest, CanonApiError, DEFAULT_APPROVAL_CONFIG, generateApprovalId, HOST_ADMISSION_ACTION_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, parseApprovalReplyMetadata, parseApprovalRequestMetadata, parseSessionRule, redactSecrets, } from '@canonmsg/core';
-export { SessionManager } from './session-manager.js';
-export { DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES, DEFAULT_MEDIA_CACHE_DIR, DEFAULT_MEDIA_MATERIALIZATION_BYTES, MAX_ANTHROPIC_IMAGE_RAW_BYTES, MAX_ANTHROPIC_REQUEST_BYTES, MAX_CANON_MEDIA_BYTES, getCodexImagePath, getMessageAttachments, inferUploadMimeType, isAnthropicImageAttachment, conversationMediaCacheDir, materializeAttachment, materializeMessageMedia, materializeReplyContextMedia, resolveAttachmentMimeType, sendMediaFileMessage, toAnthropicImageBlock, toAnthropicImageBlocksWithinBudget, uploadMediaFile, } from './media.js';
-export { createCanonAttachedSession, createCanonAttachedSessionPublisher } from './attached-session.js';
-export { createCanonWorkSessionHost } from './work-session-host.js';
-export { createFileWorkSessionHostStore } from './work-session-state.js';
-export { createFileAttachedSessionStore } from '@canonmsg/core';
-// Shared work (Dev-only preview): `ctx.artifacts` is `CanonClient.artifacts(conversationId)`.
-export { ARTIFACT_CONTEXT_PROTOCOL, ARTIFACT_LIMITS, CanonArtifactError, isCanonArtifactEnvironmentEnabled, parseArtifactContext, readArtifactContext, } from '@canonmsg/core';
+import {
+  DriverSessionError,
+  checkCodex,
+  claudeDriver,
+  codeDriver,
+  codexDriver,
+  createRunner,
+  loadClaudeQuery,
+  runtimeDescriptor
+} from "./chunks/chunk-6VK4UZHJ.js";
+import {
+  CanonApiError,
+  DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
+  DEFAULT_MEDIA_CACHE_DIR,
+  DEFAULT_MEDIA_MATERIALIZATION_BYTES,
+  MAX_ANTHROPIC_IMAGE_RAW_BYTES,
+  MAX_ANTHROPIC_REQUEST_BYTES,
+  MAX_CANON_MEDIA_BYTES,
+  clearPendingRegistration,
+  conversationMediaCacheDir,
+  ensureAgentProfile,
+  getCodexImagePath,
+  getMessageAttachments,
+  inferUploadMimeType,
+  isAnthropicImageAttachment,
+  materializeAttachment,
+  materializeMessageMedia,
+  materializeReplyContextMedia,
+  resolveAttachmentMimeType,
+  resumeRegistration,
+  sendMediaFileMessage,
+  toAnthropicImageBlock,
+  toAnthropicImageBlocksWithinBudget,
+  uploadMediaFile
+} from "./chunks/chunk-OLJ7H4E2.js";
+import "./chunks/chunk-FPQFTTND.js";
+export {
+  CanonApiError,
+  DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
+  DEFAULT_MEDIA_CACHE_DIR,
+  DEFAULT_MEDIA_MATERIALIZATION_BYTES,
+  DriverSessionError,
+  MAX_ANTHROPIC_IMAGE_RAW_BYTES,
+  MAX_ANTHROPIC_REQUEST_BYTES,
+  MAX_CANON_MEDIA_BYTES,
+  checkCodex,
+  claudeDriver,
+  clearPendingRegistration,
+  codeDriver,
+  codexDriver,
+  conversationMediaCacheDir,
+  createRunner,
+  ensureAgentProfile,
+  getCodexImagePath,
+  getMessageAttachments,
+  inferUploadMimeType,
+  isAnthropicImageAttachment,
+  loadClaudeQuery,
+  materializeAttachment,
+  materializeMessageMedia,
+  materializeReplyContextMedia,
+  resolveAttachmentMimeType,
+  resumeRegistration,
+  runtimeDescriptor,
+  sendMediaFileMessage,
+  toAnthropicImageBlock,
+  toAnthropicImageBlocksWithinBudget,
+  uploadMediaFile
+};

package/dist/internal/backend-contracts/agentBehaviorPolicy.d.ts

@@ -0,0 +1,122 @@
+/** Conversation scope a policy is resolved for. Absent means "agent scope". */
+export type PolicyConversationType = 'direct' | 'group' | 'unknown';
+export type ParticipationStyle = 'natural' | 'collaborative' | 'mention-first' | 'approval-gated' | 'handoff-only' | 'observer';
+/**
+ * The stored/parsed shape. This is the RETURN type of
+ * {@link parseAgentBehaviorSettings} and {@link normalizeStoredAgentBehaviorPolicy},
+ * so its optional fields deliberately stay `T | undefined` — widening them to
+ * `T | null` would be a breaking change for every reader of those results.
+ * Parameter positions take {@link AgentBehaviorSettingsInput} instead.
+ */
+export interface AgentBehaviorSettingsRecord {
+    participationStyle?: ParticipationStyle;
+    allowAgentToAgent?: boolean;
+    allowLongRunningCollaboration?: boolean;
+    requireMentionForGroupReplies?: boolean;
+    maxConsecutiveAgentTurns?: number | null;
+    instructions?: string | null;
+}
+/**
+ * The input shape accepted by {@link resolveAgentBehaviorPolicy}. Every field
+ * additionally accepts an explicit `null` (an editor clearing a value), which
+ * coalesces exactly like `undefined` — the field falls through to the next
+ * layer. {@link AgentBehaviorSettingsRecord} is assignable to this type.
+ */
+export interface AgentBehaviorSettingsInput {
+    participationStyle?: ParticipationStyle | null;
+    allowAgentToAgent?: boolean | null;
+    allowLongRunningCollaboration?: boolean | null;
+    requireMentionForGroupReplies?: boolean | null;
+    maxConsecutiveAgentTurns?: number | null;
+    instructions?: string | null;
+}
+export interface ParticipationPolicy {
+    style: ParticipationStyle;
+    allowAgentToAgent: boolean;
+    allowHumanToAgent: boolean;
+    allowLongRunningCollaboration: boolean;
+    requireMentionForGroupReplies: boolean;
+    maxConsecutiveAgentTurns?: number | null;
+}
+export interface ResolvedAgentBehaviorPolicyRecord {
+    participation: ParticipationPolicy;
+    instructions: string[];
+    source: {
+        hasAgentDefault: boolean;
+        hasConversationOverride: boolean;
+    };
+}
+export interface ParticipationDecisionInput {
+    conversationType: PolicyConversationType;
+    senderType: 'human' | 'ai_agent';
+    isOwner: boolean;
+    mentionedAgent: boolean;
+    recentHumanCount?: number;
+    /**
+     * Consecutive agent turns already in the streak, NOT counting the message
+     * being evaluated. The message itself adds one more when its sender is an
+     * agent, and a delivery would add a further one — see the turn-cap check in
+     * {@link evaluateParticipationPolicy}.
+     */
+    consecutiveAgentTurns?: number;
+    currentAgentStreakStartedByHuman?: boolean;
+}
+export interface ParticipationDecision {
+    allow: boolean;
+    reasonCode: string;
+    reason: string;
+}
+export interface ParticipationHistoryMessage {
+    id?: string;
+    senderId: string;
+    senderType: 'human' | 'ai_agent';
+    metadata?: unknown;
+}
+export interface ParticipationHistorySnapshot {
+    recentSenderTypes: Array<'human' | 'ai_agent'>;
+    recentHumanCount: number;
+    recentAgentCount: number;
+    consecutiveAgentTurns: number;
+    currentAgentStreakStartedByHuman: boolean;
+}
+export declare const PARTICIPATION_HISTORY_FETCH_LIMIT = 50;
+/**
+ * Safety backstop for conversations with no explicit turn cap: at most this
+ * many consecutive agent turns before a human speaks or a new conversation
+ * starts.
+ *
+ * This is a backstop, not the steering wheel — agents are expected to stop on
+ * their own. Every triggerable agent message counts in both direct and group
+ * conversations. An explicit `null` remains the deployer opt-out for trusted,
+ * intentionally long-running collaboration.
+ */
+export declare const DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS = 4;
+export declare const DEFAULT_DIRECT_MAX_CONSECUTIVE_AGENT_TURNS = 4;
+export declare function parseAgentBehaviorSettings(raw: unknown): AgentBehaviorSettingsRecord;
+export declare function normalizeStoredAgentBehaviorPolicy(raw: Record<string, unknown> | undefined): AgentBehaviorSettingsRecord | null;
+export declare function normalizeAgentBehaviorInstructions(value: string | null | undefined): string | null;
+/**
+ * The scope-independent participation defaults. `maxConsecutiveAgentTurns` is
+ * `null` here because the turn cap is scope-dependent — a conversation with no
+ * stored setting resolves to its direct or group safety default. Use
+ * {@link resolveAgentBehaviorPolicy} with a `conversationType` to learn what a
+ * given conversation actually enforces.
+ */
+export declare function getDefaultParticipationPolicy(): ParticipationPolicy;
+/**
+ * Coalesce agent defaults and a conversation override into the resolved record
+ * every runtime reads. `conversationType` selects the Canon-wide fallbacks that
+ * differ per scope — today only the turn cap, which defaults to 4 in direct and
+ * group conversations and to unlimited elsewhere. Omit it when resolving for
+ * the agent scope (no conversation);
+ * an absent or unknown type always resolves to the unlimited default, so a call
+ * site that forgets to thread it can never invent a cap.
+ */
+export declare function resolveAgentBehaviorPolicy(params?: {
+    agentDefault?: AgentBehaviorSettingsInput | null;
+    conversationOverride?: AgentBehaviorSettingsInput | null;
+    conversationType?: PolicyConversationType;
+}): ResolvedAgentBehaviorPolicyRecord;
+export declare function buildParticipationHistorySnapshot(messages: ParticipationHistoryMessage[], agentId?: string): ParticipationHistorySnapshot;
+export declare function appendParticipationHistoryMessage(snapshot: ParticipationHistorySnapshot, message: ParticipationHistoryMessage, limit?: number): ParticipationHistorySnapshot;
+export declare function evaluateParticipationPolicy(policy: ResolvedAgentBehaviorPolicyRecord | null | undefined, input: ParticipationDecisionInput): ParticipationDecision;

package/dist/internal/backend-contracts/agentDirectory.d.ts

@@ -0,0 +1,32 @@
+import type { CommunicationRule } from './communication.js';
+import type { AgentOrigin } from './agentOrigin.js';
+/** Shared paging bounds for Canon's discoverable-agent directory. */
+export declare const DEFAULT_DISCOVER_AGENTS_LIMIT = 20;
+export declare const MAX_DISCOVER_AGENTS_LIMIT = 25;
+export declare const MAX_DISCOVER_AGENTS_QUERY_LENGTH = 64;
+export interface DiscoverAgentsInput {
+    query?: string;
+    limit?: number;
+    cursor?: string | null;
+}
+/** Public, addressable identity returned to an authenticated agent caller. */
+export interface CanonAgentDirectoryEntry {
+    principalId: string;
+    canonContactId?: string;
+    displayName?: string;
+    description?: string;
+    /** Self-reported source attribution; never an identity or verification claim. */
+    origin?: AgentOrigin;
+    /** Human principal accountable for this agent. */
+    owner: {
+        principalId: string;
+        displayName?: string;
+    };
+    inboundPolicy?: CommunicationRule;
+    groupJoinPolicy?: CommunicationRule;
+    shareable: boolean;
+}
+export interface DiscoverAgentsResult {
+    agents: CanonAgentDirectoryEntry[];
+    nextCursor: string | null;
+}

package/dist/internal/backend-contracts/agentOrigin.d.ts

@@ -0,0 +1,23 @@
+/** Public attribution supplied by an agent's developer or connecting client.
+ * It describes where an agent came from, never its Canon identity, permissions,
+ * uniqueness, or a verified relationship with the named service. */
+export interface AgentOriginDeclaration {
+    name: string;
+    /** Optional public reference link. Canon does not use it to connect or authenticate. */
+    url?: string;
+}
+/** Canon records how it received the declaration. The name and URL remain
+ * self-reported, including when an OAuth client supplied them. */
+export interface AgentOrigin extends AgentOriginDeclaration {
+    reportedBy: 'registration' | 'connector';
+}
+export declare const MAX_AGENT_ORIGIN_NAME_LENGTH = 120;
+export declare const MAX_AGENT_ORIGIN_URL_LENGTH = 2048;
+/** Strict write-boundary parser. A supplied invalid declaration must be rejected
+ * by its caller; absent origin remains optional for existing and custom agents.
+ * Unknown fields are rejected, so callers cannot supply Canon's provenance or
+ * assert verification. The result is a fresh, normalized value. */
+export declare function parseAgentOriginDeclaration(value: unknown): AgentOriginDeclaration | null;
+/** Closed projection for a stored/public origin. Missing or malformed legacy
+ * data returns null; it must not be guessed from an agent's name or client type. */
+export declare function parseAgentOrigin(value: unknown): AgentOrigin | null;

package/dist/internal/backend-contracts/agentSearch.d.ts

@@ -0,0 +1,17 @@
+/** The indexable fields a stored agent contributes to `searchPrefixes`. */
+export interface AgentSearchIndexFields {
+    displayName?: string | null;
+    description?: string | null;
+}
+/** The agent shape a directory filter reads. */
+export interface AgentSearchProfile {
+    displayName?: string | null;
+    agentConfig?: {
+        description?: string | null;
+    } | null;
+}
+/** Tolerant: non-string input normalises to ''. */
+export declare function normalizeAgentDirectoryQuery(value: unknown): string;
+export declare function getAgentDirectoryQueryTokens(query: string): string[];
+export declare function buildAgentSearchPrefixes(input: AgentSearchIndexFields): string[];
+export declare function matchesAgentSearchQuery(profile: AgentSearchProfile, query: string): boolean;

package/dist/internal/backend-contracts/api-origins.generated.d.ts

@@ -0,0 +1,4 @@
+export declare const CANON_API_ORIGINS: {
+    readonly "canon-dev-v1": "https://dev.api.canonmail.com";
+    readonly "canon-prod-v1": "https://api.canonmail.com";
+};

package/dist/internal/backend-contracts/apiErrors.d.ts

@@ -0,0 +1 @@
+export declare const MESSAGE_ADMISSION_REQUIRED_CODE: "MESSAGE_ADMISSION_REQUIRED";