@canonmsg/agent-sdk 12.0.0 → 12.2.0

package/dist/index.d.ts

@@ -1,13 +1,21 @@
 export { createRunner, runtimeDescriptor } from './runner/runner.js';
 export type { Runner, RunnerOptions } from './runner/runner.js';
-export { DriverSessionError } from './runner/types.js';
-export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
+export { ConnectorRelayError, DriverSessionError } from './runner/types.js';
+export { loadMlsDevConfiguration, MLS_SETUP_ACTIONS, mlsDevRoomPackageId, runMlsDevSetup } from './runner/mls.js';
+export type { MlsSetupAction, RunnerMlsOptions } from './runner/mls.js';
+export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
+export { errandJournal, errandsDirectory, queueErrand } from './runner/errands.js';
+export type { ErrandCommand, ErrandInput, ErrandKind, ErrandRecord, ErrandStatus } from './runner/errands.js';
 export { codeDriver } from './drivers/code.js';
 export type { CodeHandler, CodeTurn } from './drivers/code.js';
 export { claudeDriver, loadClaudeQuery } from './drivers/claude.js';
 export type { ClaudeDriverOptions, ClaudeQuery } from './drivers/claude.js';
 export { checkCodex, codexDriver } from './drivers/codex.js';
 export type { CodexDriverOptions } from './drivers/codex.js';
+export { connectorDriver } from './drivers/connector.js';
+export type { ConnectorDriver, ConnectorInbox } from './drivers/connector.js';
+export { loadRelayConfiguration, startRelayChannel } from './runner/relay.js';
+export type { RelayChannel, RelayChannelOptions, RelayConfiguration, RelayCredentialDelivery, RelayTarget } from './runner/relay.js';
 export { CanonApiError, clearPendingRegistration, ensureAgentProfile, resumeRegistration } from './internal/core/index.js';
 export type { CommunicateInput, CommunicateResult, EnsureAgentProfileOptions, MediaAttachment, RegistrationCredentials, RegistrationProgress, RegistrationSession, RegistrationStatus, RegistrationStore, ResumableMediaUploadResult, ResumeRegistrationOptions, VideoProcessingErrorCode, VideoProcessingStatus, } from './internal/core/index.js';
 export { DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES, DEFAULT_MEDIA_CACHE_DIR, DEFAULT_MEDIA_MATERIALIZATION_BYTES, MAX_ANTHROPIC_IMAGE_RAW_BYTES, MAX_ANTHROPIC_REQUEST_BYTES, MAX_CANON_MEDIA_BYTES, getCodexImagePath, getMessageAttachments, inferUploadMimeType, isAnthropicImageAttachment, conversationMediaCacheDir, materializeAttachment, materializeMessageMedia, materializeReplyContextMedia, resolveAttachmentMimeType, sendMediaFileMessage, toAnthropicImageBlock, toAnthropicImageBlocksWithinBudget, uploadMediaFile, } from './media.js';

package/dist/index.js

@@ -1,13 +1,24 @@
 import {
+  ConnectorRelayError,
   DriverSessionError,
+  MLS_SETUP_ACTIONS,
   checkCodex,
   claudeDriver,
   codeDriver,
   codexDriver,
+  connectorDriver,
   createRunner,
+  errandJournal,
+  errandsDirectory,
   loadClaudeQuery,
-  runtimeDescriptor
-} from "./chunks/chunk-6VK4UZHJ.js";
+  loadMlsDevConfiguration,
+  loadRelayConfiguration,
+  mlsDevRoomPackageId,
+  queueErrand,
+  runMlsDevSetup,
+  runtimeDescriptor,
+  startRelayChannel
+} from "./chunks/chunk-HITMISWV.js";
 import {
   CanonApiError,
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
@@ -32,10 +43,11 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-OLJ7H4E2.js";
-import "./chunks/chunk-FPQFTTND.js";
+} from "./chunks/chunk-O5C3ZGI4.js";
+import "./chunks/chunk-J63YVAKA.js";
 export {
   CanonApiError,
+  ConnectorRelayError,
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
   DEFAULT_MEDIA_CACHE_DIR,
   DEFAULT_MEDIA_MATERIALIZATION_BYTES,
@@ -43,26 +55,36 @@ export {
   MAX_ANTHROPIC_IMAGE_RAW_BYTES,
   MAX_ANTHROPIC_REQUEST_BYTES,
   MAX_CANON_MEDIA_BYTES,
+  MLS_SETUP_ACTIONS,
   checkCodex,
   claudeDriver,
   clearPendingRegistration,
   codeDriver,
   codexDriver,
+  connectorDriver,
   conversationMediaCacheDir,
   createRunner,
   ensureAgentProfile,
+  errandJournal,
+  errandsDirectory,
   getCodexImagePath,
   getMessageAttachments,
   inferUploadMimeType,
   isAnthropicImageAttachment,
   loadClaudeQuery,
+  loadMlsDevConfiguration,
+  loadRelayConfiguration,
   materializeAttachment,
   materializeMessageMedia,
   materializeReplyContextMedia,
+  mlsDevRoomPackageId,
+  queueErrand,
   resolveAttachmentMimeType,
   resumeRegistration,
+  runMlsDevSetup,
   runtimeDescriptor,
   sendMediaFileMessage,
+  startRelayChannel,
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile

package/dist/internal/backend-contracts/artifactActions.d.ts

@@ -1,84 +1,3 @@
-import { type ArtifactCommandType, type ArtifactFormField, type ArtifactFormTable, type ArtifactFormValue } from './artifacts.js';
-/**
- * The agent-facing vocabulary of shared work: what a model, an SDK handler or
- * a person asks for. An endpoint turns an action into a protocol command
- * against what its author last saw; agents never write commands, revision IDs
- * or command IDs. The parsers check everything that does not need the work
- * itself; the shared rules (the endpoint reducer) decide the rest.
- */
-/** A form value as an author gives it. Core turns numeric text for number inputs (and "true"/"false" for checkboxes) into typed values. */
-export type ArtifactActionValue = ArtifactFormValue;
-export interface ArtifactCellAction {
-    row: string;
-    column: string;
-    value: ArtifactActionValue;
-}
-/** Without `id`, a stable row ID is generated and returned as `addedRowIds`. */
-export interface ArtifactRowAction {
-    id?: string;
-    cells: Record<string, ArtifactActionValue>;
-}
-export declare const ARTIFACT_UPDATE_ACTION_TYPES: readonly ["chess.move", "chess.resign", "form.set", "form.fields", "image.select", "archive"];
-export type ArtifactUpdateActionType = typeof ARTIFACT_UPDATE_ACTION_TYPES[number];
-export type ArtifactUpdateAction = 
-/** SAN ("Nf3") or UCI ("g1f3"); trimmed, at most 16 characters. */
-{
-    type: 'chess.move';
-    move: string;
-} | {
-    type: 'chess.resign';
-} | {
-    type: 'form.set';
-    values?: Record<string, ArtifactActionValue>;
-    cells?: ArtifactCellAction[];
-    addRows?: ArtifactRowAction[];
-    removeRows?: string[];
-}
-/** `remove` names fields; the endpoint sends each one's last-seen value, so a newer value conflicts instead of being discarded. */
- | {
-    type: 'form.fields';
-    add?: ArtifactFormField[];
-    remove?: string[];
-} | {
-    type: 'image.select';
-    variantId: string;
-} | {
-    type: 'archive';
-    archived: boolean;
-};
-/** `opponent` (a participant ID) is host-owned: tools fill it with the person whose message started the turn. */
-export type ArtifactCreateAction = {
-    kind: 'chess';
-    title: string;
-    playAs?: 'white' | 'black';
-    opponent?: string;
-    fen?: string;
-} | {
-    kind: 'form';
-    title: string;
-    fields: ArtifactFormField[];
-    values?: Record<string, ArtifactActionValue>;
-    table?: ArtifactFormTable;
-    rows?: ArtifactRowAction[];
-} | {
-    kind: 'image';
-    title: string;
-};
-/** The model-facing create input (`artifact_create`): kind-specific options nest under `chess` or `form`. */
-export interface ArtifactCreateToolInput {
-    kind: 'chess' | 'form' | 'image';
-    title: string;
-    chess?: {
-        playAs?: 'white' | 'black';
-        fen?: string;
-    };
-    form?: {
-        fields: ArtifactFormField[];
-        values?: Record<string, ArtifactActionValue>;
-        table?: ArtifactFormTable;
-        rows?: ArtifactRowAction[];
-    };
-}
 /** Fractions of the image, origin top-left. */
 export interface ArtifactImageRegion {
     x: number;
@@ -86,74 +5,4 @@ export interface ArtifactImageRegion {
     width: number;
     height: number;
 }
-/** 'current' edits the current version (or starts fresh when there is none); 'new' uses the prompt alone. */
-export type ArtifactImageSource = 'current' | 'new' | {
-    variantId: string;
-};
-/** Models may also give a bare version ID as `from`; the parser turns it into `{ variantId }`. */
-export interface ArtifactGenerateImageAction {
-    prompt: string;
-    label: string;
-    from: ArtifactImageSource;
-    region?: ArtifactImageRegion;
-}
-/**
- * At most one source: a local file (`path`, only where the host allows local
- * files) or a message attachment (`messageId`, `attachmentIndex`). With
- * neither, hosts use the image on the message that started the turn.
- */
-export interface ArtifactAddImageAction {
-    label: string;
-    prompt?: string;
-    sourceVariantId?: string;
-    path?: string;
-    messageId?: string;
-    attachmentIndex?: number;
-}
-export type ArtifactJsonSchema = Record<string, unknown>;
-export interface ArtifactActionSchemas {
-    create: ArtifactJsonSchema;
-    update: ArtifactJsonSchema;
-    generateImage: ArtifactJsonSchema;
-    addImage: ArtifactJsonSchema;
-}
-/** The model-facing input of each action (without the work's artifactId). */
-export declare function artifactActionSchemas(): ArtifactActionSchemas;
-export declare const ARTIFACT_TOOL_NAMES: readonly ["artifact_list", "artifact_read", "artifact_create", "artifact_update", "artifact_generate_image", "artifact_add_image"];
-export type ArtifactToolName = typeof ARTIFACT_TOOL_NAMES[number];
-/** The complete model-facing input of each shared-work tool. */
-export declare function artifactToolInputSchemas(): Record<ArtifactToolName, ArtifactJsonSchema>;
-/** The model-facing create input (`artifact_create`). `opponent` is never taken from it. */
-export declare function parseArtifactCreateToolInput(input: unknown): ArtifactCreateAction;
-/** The flat create action (SDK callers), including the host-owned `opponent`. */
-export declare function parseArtifactCreateAction(input: unknown): ArtifactCreateAction;
-/** An `artifact_update` action, or an SDK `update` action. */
-export declare function parseArtifactUpdateAction(input: unknown): ArtifactUpdateAction;
 export declare function parseArtifactImageRegion(input: unknown): ArtifactImageRegion;
-export declare function parseArtifactImageSource(input: unknown): ArtifactImageSource;
-/** An `artifact_generate_image` input (without the work's artifactId), or an SDK `generateImage` input. */
-export declare function parseArtifactGenerateImageAction(input: unknown): ArtifactGenerateImageAction;
-/** An `artifact_add_image` input (without the work's artifactId). Hosts check that `path` is absolute and allowed. */
-export declare function parseArtifactAddImageAction(input: unknown): ArtifactAddImageAction;
-export type ArtifactActionName = 'create' | ArtifactUpdateActionType | 'image.generate' | 'image.add';
-export interface ArtifactActionSemantics {
-    /** Who sees the result: every current member of the conversation (no narrower audience exists). */
-    audience: 'conversation-members';
-    /** What the change is judged against: the revision the author saw, the values the author saw, or nothing. */
-    base: 'current-revision' | 'before-values' | 'none';
-    conflict: string;
-    /** How a retried request maps to the same change. */
-    idempotency: string;
-    persistence: string;
-    /** What a receipt means and what decides the outcome. */
-    completion: string;
-    /** Member-authored input (action paths) that future encryption must cover: never in IDs, receipts, logs or other server-visible metadata. */
-    privateFields: readonly string[];
-    /** Server-visible routing the action needs. IDs are opaque (random or keyed per installation). */
-    routing: readonly string[];
-    /** Content a processor outside the audience receives by design. */
-    processorDisclosure?: readonly string[];
-    /** Protocol commands the action becomes. */
-    commands: readonly ArtifactCommandType[];
-}
-export declare const ARTIFACT_ACTION_SEMANTICS: Readonly<Record<ArtifactActionName, ArtifactActionSemantics>>;

package/dist/internal/backend-contracts/clientFloor.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Which client is calling, and the oldest version Canon still serves (mls-cutover-operator.md §2 15b). Every client names
+ * itself on its endpoint requests with `X-Canon-Client: <kind>/<version>`. While a floor exists, Canon refuses a kind
+ * below its minimum, and any request without a valid header, with `426 CLIENT_UPDATE_REQUIRED`.
+ */
+export declare const CANON_CLIENT_HEADER = "X-Canon-Client";
+export declare const CLIENT_UPDATE_REQUIRED = "CLIENT_UPDATE_REQUIRED";
+/**
+ * - `app-ios`, `app-android`: the native build's version (an OTA update cannot add native code, so the bundle's does not count);
+ * - `web`, `runner` (`@canonmsg/agent-sdk`), `hermes` (the plugin), and `core` for other first-party tools (the CLIs);
+ * - `connector`: Canon's hosted MCP connector, which deploys with Functions. Like `web`, it ships one build at a time and
+ *   names itself `0.0.0`; neither gets a minimum.
+ */
+export declare const CANON_CLIENT_KINDS: readonly ["app-ios", "app-android", "web", "runner", "hermes", "core", "connector"];
+export type CanonClientKind = typeof CANON_CLIENT_KINDS[number];
+export interface CanonClientIdentity {
+    readonly kind: CanonClientKind;
+    readonly version: string;
+}
+/** `major.minor.patch`, each at most six digits: no prerelease or build suffix, so versions compare exactly. */
+export declare function isCanonClientVersion(value: unknown): value is string;
+export declare function formatCanonClientHeader(client: CanonClientIdentity): string;
+/** A malformed header is treated as absent. */
+export declare function parseCanonClientHeader(value: unknown): CanonClientIdentity | null;
+export declare function compareCanonClientVersions(left: string, right: string): number;
+/** The server-only floor record (mls-cutover-operator.md §2 15b), written by `scripts/mls-rollout.mjs floor-set`. */
+export declare const CANON_CLIENT_FLOOR_PATH = "mlsRollout/clientFloor";
+/** The record's per-kind minimums. A kind it does not name has none. */
+export interface CanonClientFloor {
+    readonly minimum: Readonly<Partial<Record<CanonClientKind, string>>>;
+}
+/** The server-only record, in its exact shape; anything else is a broken floor, which the caller refuses rather than ignore. */
+export declare function parseCanonClientFloor(data: unknown): CanonClientFloor;
+/** A server's cached floor: one `get` per `ttlMs`, null when none is set. A malformed record rejects (through `invalid`),
+ * so the caller fails closed rather than serve every client; a failed read is not remembered. */
+export declare function createCanonClientFloorReader(get: () => Promise<{
+    readonly exists: boolean;
+    data(): unknown;
+}>, ttlMs: number, invalid?: () => never): {
+    read(now?: number): Promise<CanonClientFloor | null>;
+    reset(): void;
+};
+/** The refusal's message, naming the minimum, so a runner or plugin log says what to install. */
+export declare function canonClientUpdateMessage(refusal: {
+    kind: CanonClientKind | null;
+    minimum: string | null;
+}): string;
+/** The refusal a request gets under a floor, or null when it passes: no valid header, or a version below its kind's minimum. */
+export declare function canonClientBelowFloor(floor: CanonClientFloor, header: unknown): {
+    kind: CanonClientKind | null;
+    minimum: string | null;
+} | null;

package/dist/internal/backend-contracts/communication.d.ts

@@ -109,9 +109,15 @@ export type CommunicateResult = ({
 /** Principal-neutral app/SDK command. Humans may open a composer before sending. */
 export interface StartDirectInput {
     targetUserId: string;
+    /** `withheld`: the client holds a line it sends only encrypted. Canon reserves `messageId` and answers
+     * `openingText: 'deferred'` for an encrypted room, and `opening-text-required` (writing nothing) for a plaintext one,
+     * which the client then starts again with its text (mls-rooms-by-default.md §2a.9). */
     opener?: {
         text: string;
         messageId?: string;
+    } | {
+        withheld: true;
+        messageId: string;
     } | null;
     selection?: DirectConversationSelection;
 }
@@ -121,9 +127,18 @@ export type StartDirectResult = {
     messageId?: string;
     created?: boolean;
     reused?: boolean;
+    /** The room is encrypted, so Canon stored no opening text: the requester's client sends it encrypted, under
+     * `messageId` (mls-rooms-by-default.md §2a.9). */
+    openingText?: 'deferred';
 } | {
     status: 'requested' | 'pending';
     requestId: string;
+    /** The room the request made, which the requester may open and write in (§2a.2). An encrypted room stores no
+     * opener: the requester's client sends it into `conversationId` under `messageId` once the request's other
+     * approvers have approved and the target's device is in (§2a.4, §2a.9). */
+    conversationId?: string;
+    messageId?: string;
+    openingText?: 'deferred';
 } | {
     status: 'blocked' | 'unavailable';
     reason: string;

package/dist/internal/backend-contracts/connectorRelay.d.ts

@@ -0,0 +1,179 @@
+/**
+ * The class-C relay (docs/design/agent-runner.md §11): a Canon-operated process that relays a connector agent's
+ * encrypted rooms, holding an MLS device for the agent and decrypting and re-encrypting messages for the assistant (which
+ * its provider runs, not Canon), so those rooms are not end-to-end encrypted to that agent. Its installation id carries a
+ * reserved prefix, which the device's registration shows, and with it every MLS credential the issuer signs and every
+ * room roster: that is the machine-readable marker that a member is relayed. Only the agent's owner-approved relay
+ * installation may be enrolled under the prefix, and only with that relay's own credential.
+ */
+export declare const CONNECTOR_RELAY_INSTALLATION_PREFIX = "canon-relay:";
+export declare const CONNECTOR_RELAY_INSTALLATION_PATTERN: RegExp;
+export declare function isConnectorRelayInstallation(installationId: unknown): boolean;
+/**
+ * Canon's per-relay credential (§11.4): minted when the owner approves (or re-approves) the relay and delivered once, over
+ * the channel, to that agent's relay alone; Canon keeps only its SHA-256, on the agent's relay binding. It authenticates
+ * the relay as its agent for the relay's own work only: its installation's endpoint operations and MLS device, and the
+ * encrypted rooms' live hints. It is never accepted for plaintext rooms or any other route, and it stops working when the
+ * relay is disabled or re-approved, its connection is revoked, replaced or expires, or the agent's ownership changes.
+ */
+export declare const CONNECTOR_RELAY_CREDENTIAL_PREFIX = "canon_relay_";
+export declare const CONNECTOR_RELAY_CREDENTIAL_PATTERN: RegExp;
+export declare function isConnectorRelayCredential(value: unknown): value is string;
+/** What the channel's `credential` operation carries; the connection is the request's `grantId`. */
+export interface ConnectorRelayCredentialDelivery {
+    installationId: string;
+    generation: number;
+    credential: string;
+}
+/**
+ * A relay binding is current for `installationId` (and, given one, the credential with that hash): the agent is active,
+ * not mid-transfer, and still at the binding's ownership generation; its connection's grant is active, unexpired, for the
+ * same agent, owner and generation; neither agent nor owner is ejected. Functions and the stream service read the same
+ * documents (`users/{agentId}`, the binding's `connectorGrants/{grantId}`) and decide with this one rule.
+ */
+export declare function isConnectorRelayBindingCurrent(input: {
+    agentId: string;
+    installationId: string;
+    ownershipVersion?: number;
+    credentialDigest?: string;
+    agent: Record<string, any> | undefined;
+    grant: Record<string, any> | undefined;
+    agentEjected: boolean;
+    ownerEjected: boolean;
+    now: number;
+}): boolean;
+/** A relayed turn as the connector's pickup tools name it: never reused, and it names nothing about the turn. */
+export declare const CONNECTOR_RELAY_INPUT_ID_PATTERN: RegExp;
+export declare const CONNECTOR_RELAY_MAX_BODY_BYTES: number;
+/** An encrypted room's text is one message of at most 32 KiB. */
+export declare const CONNECTOR_RELAY_MAX_TEXT_BYTES: number;
+/**
+ * The one budget for a relay answer, serialized: Functions refuses a longer response body, and the relay fits every answer
+ * under it before it changes any state (a claim's input is fitted before the claim is taken, a history page is cut short).
+ */
+export declare const CONNECTOR_RELAY_MAX_RESPONSE_BYTES: number;
+/** Functions' deadline for one exchange with the relay, request to last response byte. */
+export declare const CONNECTOR_RELAY_CHANNEL_TIMEOUT_MS = 10000;
+/**
+ * The relay answers every exchange within this, measured from the request's arrival, leaving the rest of Functions'
+ * deadline for the network. Work that may outlast it answers before it changes state (a busy refusal) or after it is
+ * durable (a send answers `pending` only once it is journaled).
+ */
+export declare const CONNECTOR_RELAY_ANSWER_WITHIN_MS = 7000;
+/** A value's size as the channel serializes it (UTF-8 JSON). */
+export declare function connectorRelayResponseBytes(value: unknown): number;
+export type ConnectorRelaySettleOutcome = 'completed' | 'no_reply' | 'failed';
+/** One request from Functions to the relay; Functions initiates every exchange (§11.6). */
+export type ConnectorRelayRequest = {
+    version: 1;
+    agentId: string;
+    grantId: string;
+} & ({
+    op: 'pending';
+    args: {
+        conversationId: string;
+        limit?: number;
+    };
+} | {
+    op: 'claim';
+    args: {
+        inputId: string;
+        requestId: string;
+    };
+} | {
+    op: 'reply';
+    args: {
+        inputId: string;
+        requestId: string;
+        text: string;
+    };
+} | {
+    op: 'settle';
+    args: {
+        inputId: string;
+        requestId: string;
+        outcome: ConnectorRelaySettleOutcome;
+    };
+} | {
+    op: 'read';
+    args: {
+        conversationId: string;
+        limit?: number;
+        before?: string;
+    };
+} | {
+    op: 'send';
+    args: {
+        conversationId: string;
+        messageId: string;
+        text: string;
+    };
+} | {
+    op: 'credential';
+    args: ConnectorRelayCredentialDelivery;
+});
+export type ConnectorRelayOp = ConnectorRelayRequest['op'];
+export interface ConnectorRelayInputRef {
+    inputId: string;
+    conversationId: string;
+    messageId: string;
+    createdAt: string;
+}
+export interface ConnectorRelayMessage {
+    id: string;
+    senderId: string;
+    senderName?: string;
+    senderType: 'human' | 'ai_agent';
+    isOwner?: boolean;
+    text: string;
+    createdAt: string;
+}
+/**
+ * What the assistant gets with its first claim: the turn's messages and, for context, the history window before them,
+ * each once (structured, as the plaintext connector's claim is; no rendered prompt repeats them). History is trimmed,
+ * oldest first, to fit the response budget; the turn's own messages always fit.
+ */
+export interface ConnectorRelayInput {
+    conversationId: string;
+    room: 'direct' | 'group';
+    sender: {
+        id: string;
+        name?: string;
+        type: 'human' | 'ai_agent';
+        isOwner: boolean;
+    };
+    messages: ConnectorRelayMessage[];
+    history: ConnectorRelayMessage[];
+}
+export interface ConnectorRelayClaim {
+    inputId: string;
+    requestId: string;
+    runAllowed: boolean;
+    state: 'claimed' | 'answered' | 'withdrawn';
+    input?: ConnectorRelayInput;
+}
+export interface ConnectorRelayAck {
+    inputId: string;
+    state: 'accepted';
+    outcome: 'reply' | ConnectorRelaySettleOutcome;
+}
+/** Messages Canon accepted into the room's feed, newest first; the relay's own unaccepted sends are not history. */
+export interface ConnectorRelayPage {
+    messages: ConnectorRelayMessage[];
+    nextBefore: string | null;
+}
+/**
+ * `messageId` is the send's identity: sending again with it (or with the id the caller first gave) is the same message,
+ * never a second one. `historyMessageId` is the id the message has in the conversation's history.
+ */
+export interface ConnectorRelaySent {
+    conversationId: string;
+    messageId: string;
+    historyMessageId: string;
+    status: 'sent' | 'pending';
+}
+export declare class ConnectorRelayRequestError extends Error {
+    name: string;
+}
+/** The closed request schema both sides check: Functions before it signs, the relay after it verifies the signature. */
+export declare function parseConnectorRelayRequest(value: unknown): ConnectorRelayRequest;

package/dist/internal/backend-contracts/endpoint.d.ts

@@ -1,4 +1,5 @@
 import { type PreparedContent } from './preparedContent.js';
+import type { MlsPrincipalOpening } from './mlsPrincipalAlias.js';
 /** Plaintext endpoint protocol. Identity and authority come from authenticated transport. */
 export declare const CANON_ENDPOINT_PROTOCOL: "canon.endpoint.v1";
 export interface EndpointPreconditions {
@@ -96,6 +97,22 @@ export interface EndpointCapabilities {
     actions: string[];
     queries: string[];
     maintenance: boolean;
+    /** Only for a principal eligible for MLS here: how new rooms are born (functions `rollout.ts`, `CANON_MLS_DEV_ROOMS`). */
+    mls?: {
+        eligible: true;
+        roomMode: 'default';
+        /** The principal's MLS identity, its alias (mls-dev-groups.md, erasure privacy), and the opening that proves the alias
+         * is its own; null until it has an alias, when the account is its own principal. Absent from older servers. */
+        principal?: {
+            type: 'human' | 'ai_agent';
+            id: string;
+        };
+        opening?: MlsPrincipalOpening | null;
+    };
+    /** While a client floor exists (`clientFloor.ts`): the minimum for the caller's kind, or null when it has none. */
+    clientFloor?: {
+        minimum: string | null;
+    };
 }
 export declare const ENDPOINT_ID_PATTERN: RegExp;
 export declare const ENDPOINT_ACTION_PATTERN: RegExp;

package/dist/internal/backend-contracts/endpointContentPolicy.d.ts

@@ -7,10 +7,10 @@ export type EndpointContentLane = 'operation.request' | 'operation.receipt' | 'q
 /** ID-only operations can still mutate encrypted semantics. These require an
  * authenticated encrypted protocol before they can operate on a protected room.
  * Their routing fields remain public metadata; classification is not authority. */
-export declare const MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS: readonly ["delete_message", "forward_message"];
-export declare const ENDPOINT_CONTENT_ACTIONS: readonly ["mls_application", "mls_group_control", "initialize_endpoint", "append_artifact_command", "retain_artifact_asset", "sync_phone_contacts", "request_work_session", "resolve_work_session_request", "update_agent_behavior_policy", "update_conversation_agent_behavior_policy", "send_message", "delete_message", "forward_message", "react", "verb_execute", "send_contextual_message", "create_interaction", "consume_interaction", "start_conversation", "create_conversation", "add_member", "remove_member", "leave_conversation", "update_member_role", "update_conversation", "rename_conversation", "update_topic", "update_group_avatar", "mark_read", "cancel_queued_message", "set_conversation_preferences", "set_block", "save_contact", "remove_contact", "respond_interaction", "session_control", "approve_contact_request", "reject_contact_request", "cancel_direct_request", "update_message_disposition", "create_upload", "finalize_upload", "delete_upload", "retry_video_processing", "stage_media_message", "cancel_media_message", "renew_media_message_upload", "finalize_memo_stream", "abort_memo_stream", "create_voice_session", "join_voice_session", "decline_voice_session", "end_voice_session", "consume_runtime_signal", "consume_runtime_primitive", "generate_image"];
-export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_work_session_catalog", "get_work_session_details", "get_work_session_request", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status"];
-export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_work_session_catalog", "get_work_session_details", "get_work_session_request", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "admit_messages"];
+export declare const MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS: readonly ["forward_message"];
+export declare const ENDPOINT_CONTENT_ACTIONS: readonly ["mls_application", "mls_group_control", "initialize_endpoint", "append_artifact_command", "retain_artifact_asset", "sync_phone_contacts", "update_agent_behavior_policy", "update_conversation_agent_behavior_policy", "send_message", "delete_message", "forward_message", "react", "verb_execute", "send_contextual_message", "create_interaction", "consume_interaction", "start_conversation", "create_conversation", "add_member", "remove_member", "leave_conversation", "update_member_role", "update_conversation", "rename_conversation", "update_topic", "update_group_avatar", "mark_read", "cancel_queued_message", "set_conversation_preferences", "set_block", "save_contact", "remove_contact", "respond_interaction", "session_control", "approve_contact_request", "reject_contact_request", "cancel_direct_request", "update_message_disposition", "create_upload", "finalize_upload", "delete_upload", "retry_video_processing", "stage_media_message", "cancel_media_message", "renew_media_message_upload", "finalize_memo_stream", "abort_memo_stream", "create_voice_session", "join_voice_session", "decline_voice_session", "end_voice_session", "consume_runtime_signal", "consume_runtime_primitive", "generate_image"];
+export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents"];
+export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents", "admit_messages"];
 export declare const ENDPOINT_CONTENT_EPHEMERALS: readonly ["create_memo_stream", "publish_presence", "publish_typing", "publish_streaming", "publish_turn", "publish_runtime_status", "publish_session_state", "publish_runtime_info", "publish_runtime_activity", "append_memo_chunk"];
 export declare const ENDPOINT_CONTENT_EPHEMERAL_FAMILIES: readonly ["typing", "streaming", "turn-state", "agent-session", "runtime-card-state", "memo-streams", "runtime-info", "runtime-activity", "runtime-suppression", "runtime-silence", "runtime-attention", "call-attention", "agent-runtime", "presence"];
 export declare const ENDPOINT_CONTENT_EVENTS: readonly ["connected", "heartbeat", "agent.context", "replay.expired", "error", "participation.suppressed", "artifact.changed", "message.created", "message.snapshot", "message.updated", "message.deleted", "message.media_terminal", "conversation.updated", "conversation.changed", "conversation.removed", "conversations.changed", "contacts.changed", "contact.added", "contact.updated", "contact.removed", "presence", "typing", "runtime.updated", "runtime.control", "turn.updated", "voice.session.started", "voice.session.ended", ...string[]];
@@ -18,6 +18,14 @@ export declare class EndpointContentPolicyError extends Error {
     readonly code = "ENDPOINT_CONTENT_UNCLASSIFIED";
     constructor(lane: string, name: string);
 }
+/**
+ * An encrypted room's content-free turn state (owner ruling 2026-10-16; agent-runner.md §6): Canon learns when an agent
+ * is busy there, never what it does. On `publish_turn` a closed state (`thinking` while the agent works, `waiting_input`
+ * while a card waits on a person, `interrupted`, `idle`), the runner's random turn id and two times are public metadata,
+ * each only with such a value; queue depth, speaker, active messages, capabilities, `streaming`/`tool` and anything else
+ * stay private, so an encrypted room refuses them.
+ */
+export declare const ENDPOINT_TURN_PRESENCE_STATES: readonly ["thinking", "waiting_input", "interrupted", "idle"];
 export interface EndpointContentBoundary {
     readonly lane: EndpointContentLane;
     readonly name: string;
@@ -35,3 +43,6 @@ export declare function endpointOperationRequestRetention(action: string, body:
 /** Validate the lane before accepting/transmitting its payload. No body values
  * are logged, copied into metadata, or claimed to be encrypted by this API. */
 export declare function endpointContentBoundary(lane: EndpointContentLane, name: string, payload?: unknown): EndpointContentBoundary;
+/** Whether every leaf of an ephemeral body is public metadata: all an encrypted (MLS) room may receive on that lane. The
+ * endpoint applies this before publishing (its MLS preflight); Functions applies it again on receipt. */
+export declare function endpointEphemeralIsMetadataOnly(name: string, body: unknown): boolean;

package/dist/internal/backend-contracts/index.d.ts

@@ -1,9 +1,11 @@
 export * from './diffRedaction.js';
 export * from './environment.js';
+export * from './clientFloor.js';
 export * from './api-origins.generated.js';
 export * from './media.js';
 export * from './mediaDelivery.js';
 export * from './media-url.js';
+export * from './upload-mime-types.js';
 export * from './message.js';
 export * from './messageText.js';
 export * from './runtimeCardFields.js';
@@ -23,11 +25,11 @@ export * from './moderation.js';
 export * from './selfContext.js';
 export * from './replyAuthority.js';
 export * from './runtimeDescriptor.js';
-export * from './workSessions.js';
 export type { WebPhoneAccountRequest, WebPhoneTokenResponse } from './webAuth.js';
 export * from './conversationMembership.js';
 export * from './endpoint.js';
 export * from './externalInbound.js';
+export * from './connectorRelay.js';
 export * from './endpointContentPolicy.js';
 export * from './plaintextProcessors.js';
 export { computeEndpointUnreadProjection } from './endpoint-unread.js';
@@ -37,6 +39,7 @@ export * from './mediaTransferProtocol.js';
 export * from './preparedContent.js';
 export * from './artifacts.js';
 export * from './artifactActions.js';
+export * from './mlsEnvironment.js';
 export * from './mlsDevEnrollment.js';
 export * from './mlsDevCredential.js';
 export * from './mlsDevCredentialReconciliation.js';
@@ -46,3 +49,6 @@ export * from './mlsDevKeyPackages.js';
 export * from './mlsDevGroup.js';
 export * from './mlsDevApplication.js';
 export * from './mlsDevGroupFeed.js';
+export * from './mlsDevFeedReceipt.js';
+export * from './mlsDevInteraction.js';
+export * from './mlsPrincipalAlias.js';