@canonmsg/agent-sdk 12.5.1 → 13.0.2

package/dist/chunks/{mls-crypto-Y44BOSEM.js → mls-crypto-NZVMSUFU.js}

@@ -2,7 +2,8 @@ import {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,
   parseMlsDevClientConfiguration
-} from "./chunk-C2WJT3VX.js";
+} from "./chunk-YHDDOADK.js";
+import "./chunk-5WPAB5MB.js";
 export {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,

package/dist/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import {
   MLS_SETUP_ACTIONS,
-  assertPrivateHome,
+  acpDriver,
   awaitErrand,
+  checkAcp,
   checkCodex,
   claudeDriver,
   codeDriver,
@@ -20,10 +21,13 @@ import {
   readRelayCredential,
   relayRunnerHome,
   runMlsDevSetup,
-  runnerLockName,
   startRelayChannel,
   writeRelayCredential
-} from "./chunks/chunk-3KFVBOVI.js";
+} from "./chunks/chunk-DNHJGAEL.js";
+import {
+  assertPrivateHome,
+  runnerLockName
+} from "./chunks/chunk-DTAWEQCM.js";
 import {
   CanonApiError,
   CanonClient,
@@ -34,11 +38,13 @@ import {
   resolveCanonRuntimeConnection,
   runCli,
   verifyCanonRuntimeConnection
-} from "./chunks/chunk-TFSURFF6.js";
+} from "./chunks/chunk-TYZT346O.js";
+import "./chunks/chunk-YJUPKU47.js";
+import "./chunks/chunk-YHDDOADK.js";
 import {
   __name,
   isCanonClientVersion
-} from "./chunks/chunk-C2WJT3VX.js";
+} from "./chunks/chunk-5WPAB5MB.js";
 
 // src/cli.ts
 import { realpathSync } from "node:fs";
@@ -67,6 +73,8 @@ Usage:
   canon-agent run --driver codex [--cwd <dir>] [--model <id>] [--sandbox <mode>]
                   [--approval-policy <policy>] [--codex-path <path>] [--profile <name>]
                   [--environment <id>]
+  canon-agent run --driver acp [--cwd <dir>] [--guest-mode <id> | --unguarded-guests]
+                  [--profile <name>] [--environment <id>] -- <agent command> [args]
   canon-agent run --driver connector --relay-config <path> [--mls-dev-config <path>]
                   [--profile <name>] [--environment <id>]
   canon-agent mls --action <action> [--mls-dev-config <path>] [--room <id>]
@@ -81,34 +89,36 @@ Usage:
   canon-agent errands [--follow] [--cancel <errand id>] (--agent <id> | --profile <name>)
                   [--environment <id>]
 
-Encrypted rooms need the agent's MLS device. On macOS (Apple silicon) and Linux
-(x64, arm64) the runner keeps it in $CANON_HOME with the custody helper this package
-ships, and sets it up on the agent's first start: nothing to configure. Every run
-command also takes --mls-dev-config <path>, an operator's own custody instead. With
-neither, the agent refuses encrypted rooms, and where Canon encrypts every new
-conversation it does not start.
+Every room is encrypted, so the agent needs its MLS device. The runner keeps it in
+$CANON_HOME and sets it up on the agent's first start: nothing to configure. On macOS
+(Apple silicon) and glibc Linux (x64, arm64) it uses the custody helper this package
+ships; on Windows, Intel Macs and musl Linux, this package's WASM core. Every run
+command also takes --mls-dev-config <path>, an operator's own custody instead. With none
+of these, the agent refuses every room, and where Canon encrypts every new conversation
+it does not start.
 
-Team rooms (an owner's agents working together): claude and codex also take
+Team rooms (an owner's agents working together): claude, codex and acp also take
 [--instructions <file>] [--trust-agent <agentId>]...; every run command takes
-[--agent-turn-cap <n>] [--mention-alias <name>]..., which apply in encrypted rooms.
-code, claude and codex take [--allow-session-for-destructive] for encrypted cards.
+[--agent-turn-cap <n>] [--mention-alias <name>]....
+code, claude, codex and acp take [--allow-session-for-destructive] for encrypted cards.
 
 Errands: tell, post and errand direct a running agent from the machine it runs on:
 whoever can write $CANON_HOME commands it, and the CLI itself uses no network. tell
 leaves a private note for the agent's next turn in a room: never posted, it starts no
-turn. post sends the text as the agent's own message, with no turn (encrypted in an
-encrypted room). errand runs one owner-authorised turn that carries the instruction to
-the recipient (a room the agent is in, or a new conversation with a person or agent),
-reports to --origin, and tells later turns there why the agent came. What concerns an
-encrypted room is reported only to an encrypted origin; otherwise the report stays
-local (canon-agent errands). Canon's policies, blocks and rate limits apply as to any
-message from the agent.
+turn. post sends the text, encrypted, as the agent's own message, with no turn. errand
+runs one owner-authorised turn that carries the instruction to the recipient (a room
+the agent is in, or a new conversation with a person or agent), reports to --origin,
+and tells later turns there why the agent came. Without --origin the report stays local
+(canon-agent errands). Canon's policies, blocks and rate limits apply as to any message
+from the agent.
 
 Flags:
-  --driver <name>        The runtime driver: "code", "claude", "codex" or "connector".
+  --driver <name>        The runtime driver: "code", "claude", "codex", "acp" or
+                         "connector". acp runs any agent that speaks the Agent Client
+                         Protocol over stdio, named after --: -- goose acp.
   --module <path>        code: an ES module whose default export answers a turn.
                          Its directory is one the agent may send files from.
-  --cwd <dir>            claude, codex: the directory the runtime works in (default:
+  --cwd <dir>            claude, codex, acp: the directory the runtime works in (default:
                          the current one). The agent may send files from it.
   --model <id>           claude, codex: the model (default: the runtime's).
   --permission-mode <m>  claude: "default" puts each tool call Claude Code would ask
@@ -124,28 +134,34 @@ Flags:
                          Turns holding anyone else's message are always read-only,
                          approve nothing and get only Canon's tools.
   --codex-path <path>    codex: the Codex CLI (default: codex on the PATH).
-  --instructions <file>  claude, codex: standing instructions from the owner (a role,
-                         say), appended to the runtime's system or developer
-                         instructions. A UTF-8 file of at most 32 KiB, owned by you
+  --guest-mode <id>      acp: the agent's own read-only session mode, for turns holding
+                         anyone else's message, such as chat on Goose. Without this
+                         the agent is not started for such a turn, and the person
+                         is told it takes only its owner's messages.
+  --unguarded-guests     acp: run such turns under the agent's own policy instead. The
+                         driver only refuses permission requests and stops a turn
+                         if the agent reports a machine tool, so an agent that runs
+                         tools unasked runs them on this machine for anyone.
+  --instructions <file>  claude, codex, acp: standing instructions from the owner (a role,
+                         say), added to the runtime's system or developer
+                         instructions, or to a session's first prompt. A UTF-8 file of at most 32 KiB, owned by you
                          and not writable by others, read once at start; never sent
                          to Canon.
-  --trust-agent <id>     claude, codex: an agent of the same owner whose messages count
+  --trust-agent <id>     claude, codex, acp: an agent of the same owner whose messages count
                          as the owner's for tool use (repeat for several), only in a
                          room whose other members are all listed agents that Canon
                          confirms at each turn as active agents of this agent's
-                         owner (and, in plaintext, only for a final that agent's own
-                         runner marked as answering its owner). Otherwise they are
-                         guarded like any other agent's. Approvals still go to the
-                         owner.
-  --agent-turn-cap <n>   Encrypted rooms: another agent's message wakes this agent only
-                         when it @mentions it (by display name, id or an alias), at
-                         most n times in a row per room until a person writes there
-                         (default 6; 0: agents never wake it). Plaintext rooms
-                         follow Canon's group rules.
-  --mention-alias <name> Encrypted rooms: another name that @mentions this agent, such
-                         as its role (repeat for several).
+                         owner. Otherwise they are guarded like any other agent's.
+                         Approvals still go to the owner.
+  --agent-turn-cap <n>   Another agent's message wakes this agent only when it
+                         @mentions it (by display name, id or an alias), at most n
+                         times in a row per room until a person writes there
+                         (default 6; 0: agents never wake it). The room's own
+                         rules can stop them sooner.
+  --mention-alias <name> Another name that @mentions this agent, such as its role
+                         (repeat for several).
   --allow-session-for-destructive
-                         Encrypted rooms: let the owner allow an action the runtime
+                         Let the owner allow an action the runtime
                          marks destructive (Claude Code's default-to-no prompts,
                          Codex's risky commands and deletions) for the rest of the
                          session. Off by default: each such action asks.
@@ -173,10 +189,9 @@ Flags:
   --text <text>          tell: the note. post: the message. errand: the instruction.
                          At most 32 KiB.
   --to <id>              errand: a conversation the agent is in, or else a person or
-                         agent to start a new (plaintext) conversation with.
+                         agent to start a new conversation with.
   --why <why>            errand: why the owner sends the agent (at most 4 KiB).
-  --origin <id>          errand: the conversation the report goes to. A report about an
-                         encrypted recipient goes only to an encrypted origin.
+  --origin <id>          errand: the conversation the report goes to.
   --follow               errands: go on printing each change.
   --cancel <id>          errands: cancel that errand (Stop in its origin also stops it).
   --agent <id>           tell, post, errand, errands: the agent (or --profile).
@@ -192,15 +207,17 @@ Flags:
 Environment:
   CANON_API_KEY          The agent's key (or use --profile).
   CANON_ENVIRONMENT_ID   Required; a profile from another environment is refused.
-  CANON_HOME             Agent state, default ~/.canon. It must be private (0700).
+  CANON_HOME             Agent state, default ~/.canon. It must be private (0700; on
+                         Windows, only you, SYSTEM and Administrators in its access list).
   ANTHROPIC_API_KEY      claude: use this API key instead of a Claude subscription
                          login. The claude driver needs @anthropic-ai/claude-agent-sdk.
   OPENAI_API_KEY         codex: use this API key instead of Codex's own login, unless
                          Codex is configured for another model provider.
 
 SIGTERM or Ctrl-C stops taking messages, lets running turns finish for 10 seconds,
-then stops them.`;
-var AVAILABLE = ["code", "claude", "codex", "connector"];
+then stops them. Windows has no SIGTERM: use Ctrl-C or Ctrl-Break, which is what a
+service wrapper such as NSSM sends. Closing the console gives far less time.`;
+var AVAILABLE = ["code", "claude", "codex", "acp", "connector"];
 var PERMISSION_MODES = ["default", "acceptEdits", "bypassPermissions"];
 var SANDBOXES = ["workspace-write", "read-only", "danger-full-access"];
 var APPROVAL_POLICIES = ["on-request", "untrusted", "never"];
@@ -225,7 +242,7 @@ async function main() {
     throw new UsageError(error instanceof Error ? error.message : String(error));
   }
   const { values, positionals } = parsed;
-  if (!["run", "mls", "tell", "post", "errand", "errands"].includes(positionals[0] ?? "") || positionals.length > 1) {
+  if (!["run", "mls", "tell", "post", "errand", "errands"].includes(positionals[0] ?? "") || positionals.length > 1 && positionals[0] !== "run") {
     throw new UsageError('Expected the "run", "mls", "tell", "post", "errand" or "errands" command.');
   }
   if (positionals[0] === "mls") return mlsSetup(values);
@@ -237,9 +254,13 @@ async function main() {
   }
   if (values.driver === "code" && !values.module) throw new UsageError("--driver code needs --module <path>.");
   if (values.driver === "connector" !== !!values["relay-config"]) throw new UsageError("--relay-config goes with --driver connector, which needs it.");
-  if (!["claude", "codex"].includes(values.driver) && (values.instructions !== void 0 || values["trust-agent"]?.length)) {
-    throw new UsageError("--instructions and --trust-agent go with --driver claude or codex.");
+  if (!["claude", "codex", "acp"].includes(values.driver) && (values.instructions !== void 0 || values["trust-agent"]?.length)) {
+    throw new UsageError("--instructions and --trust-agent go with --driver claude, codex or acp.");
   }
+  const [agentCommand, ...agentArgs] = positionals.slice(1);
+  if (values.driver === "acp" !== !!agentCommand) throw new UsageError("--driver acp needs its agent's command after --, and only it takes one: canon-agent run --driver acp -- goose acp.");
+  if (values.driver !== "acp" && (values["guest-mode"] !== void 0 || values["unguarded-guests"])) throw new UsageError("--guest-mode and --unguarded-guests go with --driver acp.");
+  if (values["guest-mode"] !== void 0 && values["unguarded-guests"]) throw new UsageError("--guest-mode and --unguarded-guests are alternatives.");
   const team = teamOptions(values);
   if (values.driver === "connector" && values["allow-session-for-destructive"]) throw new UsageError("--allow-session-for-destructive goes with a driver that asks.");
   if (values.driver === "connector") return runRelay(values, team);
@@ -282,6 +303,20 @@ async function main() {
       ...approvalPolicy ? { approvalPolicy } : {},
       ...instructions ? { instructions } : {}
     });
+  } else if (values.driver === "acp") {
+    const cwd = resolve(values.cwd ?? ".");
+    const agent = await checkAcp({ command: agentCommand, args: agentArgs, cwd });
+    console.error(`canon-agent: ${agent.name}${agent.version ? ` ${agent.version}` : ""} speaks the Agent Client Protocol; ${agent.sessionMemory === "native" ? "it keeps each room's session" : "it keeps no session, so prompts carry recent history"}.`);
+    driver = acpDriver({
+      command: agentCommand,
+      args: agentArgs,
+      cwd,
+      sessionMemory: agent.sessionMemory,
+      ...values["guest-mode"] ? { guestMode: values["guest-mode"] } : {},
+      ...values["unguarded-guests"] ? { unguardedGuests: true } : {},
+      ...instructions ? { instructions } : {}
+    });
+    if (!values["guest-mode"] && !values["unguarded-guests"]) console.error("canon-agent: it takes only its owner's messages. To let others reach it, give --guest-mode with a read-only mode of the agent's own.");
   } else {
     const modulePath = realpathSync(resolve(values.module));
     const handler = (await import(pathToFileURL(modulePath).href)).default;
@@ -425,6 +460,8 @@ function parse() {
       sandbox: { type: "string" },
       "approval-policy": { type: "string" },
       "codex-path": { type: "string" },
+      "guest-mode": { type: "string" },
+      "unguarded-guests": { type: "boolean" },
       "mls-dev-config": { type: "string" },
       action: { type: "string" },
       room: { type: "string" },
@@ -573,6 +610,7 @@ function stopOnSignals(stop) {
   }, "onSignal");
   process.on("SIGTERM", onSignal);
   process.on("SIGINT", onSignal);
+  if (process.platform === "win32") for (const signal of ["SIGBREAK", "SIGHUP"]) process.on(signal, onSignal);
 }
 __name(stopOnSignals, "stopOnSignals");
 runCli(import.meta.url, main, (error) => {

package/dist/drivers/acp.d.ts

@@ -0,0 +1,56 @@
+import { type DriverCapabilities, type RuntimeDriver } from '../runner/types.js';
+export interface AcpDriverOptions {
+    /** The agent's executable, e.g. `goose`, found on the PATH. */
+    command: string;
+    /** Its arguments, e.g. `['acp']`. */
+    args?: string[];
+    /** The directory the agent works in. The agent may also send files from it. */
+    cwd: string;
+    /**
+     * `native` when the agent keeps a session across its processes; `none` (the default) makes every prompt carry the recent
+     * history. `checkAcp` reports which one an agent is.
+     */
+    sessionMemory?: DriverCapabilities['sessionMemory'];
+    /**
+     * What a turn holding a message from anyone but the owner or a confirmed trusted agent of the owner does. By default the
+     * agent is not started and the person is told it takes only its owner's messages, because nothing here can limit what
+     * an arbitrary agent runs. `guestMode` runs it in that session mode instead: a read-only mode of the agent's own, such
+     * as `chat` on Goose. Such a turn fails if the agent refuses the mode.
+     */
+    guestMode?: string;
+    /**
+     * Run such a turn under the agent's own policy, with no mode. The driver then only refuses permission requests and stops
+     * the turn when the agent reports a machine tool running: an agent that does neither runs what the message asks, on
+     * this machine. Only for an agent whose developer has limited it some other way.
+     */
+    unguardedGuests?: boolean;
+    /**
+     * The owner's standing instructions for this agent (its role, say), added to the first prompt of a session after Canon's
+     * own framing, since the protocol has no system prompt. At most 32 KiB; the CLI reads them from `--instructions <file>`.
+     */
+    instructions?: string;
+    /** How long a cancelled agent may take to stop, and an agent with its input closed to exit (default 5 s). */
+    interruptGraceMs?: number;
+}
+/** What `initialize` told the driver about an agent. */
+export interface AcpAgent {
+    name: string;
+    version: string;
+    sessionMemory: DriverCapabilities['sessionMemory'];
+}
+/** Checks the agent starts and speaks the protocol; the CLI calls it at startup so a wrong command fails at once. */
+export declare function checkAcp({ command, args, cwd, timeoutMs }: Pick<AcpDriverOptions, 'command' | 'args' | 'cwd'> & {
+    timeoutMs?: number;
+}): Promise<AcpAgent>;
+/**
+ * Runs an agent that speaks the Agent Client Protocol (v1, JSON-RPC over stdio), which most coding agents do. Each turn is
+ * one process that restores the room's session, whose id the runner keeps in the driver state, and exits after the turn:
+ * Canon's tool URL and token change per turn, and a session takes its MCP servers only when opened. Stop cancels the
+ * native turn and closes a process that does not stop. A room's next turn starts only after the previous process has exited.
+ *
+ * Unlike the claude and codex drivers, this one cannot configure a sandbox: what runs on the machine is the agent's own
+ * policy, which its developer sets. So a turn holding anyone else's message runs only if the owner chose how (`guestMode`
+ * or `unguardedGuests`), approves nothing, and stops when the agent reports a machine tool running or leaves that mode.
+ * Only the mode is a real limit, since the agent enforces it; the rest depends on what the agent reports.
+ */
+export declare function acpDriver(options: AcpDriverOptions): RuntimeDriver;

package/dist/drivers/codex.d.ts

@@ -1,4 +1,5 @@
 import { type DriverTurn, type RuntimeDriver } from '../runner/types.js';
+import { type Json } from './subprocess.js';
 export interface CodexDriverOptions {
     /** The directory Codex works in. The agent may also send files from it. */
     cwd: string;
@@ -22,7 +23,6 @@ export interface CodexDriverOptions {
     /** How long an interrupted Codex may take to stop before its process is closed (default 5 s). */
     interruptGraceMs?: number;
 }
-type Json = Record<string, unknown>;
 /** Checks the Codex CLI runs at all; the CLI calls it at startup so a missing install fails at once. */
 export declare function checkCodex(codexPath?: string): string;
 /**
@@ -43,4 +43,3 @@ export declare function answerCodexRequest(turn: DriverTurn, method: string, par
  * does not stop. A room's next turn starts only after the previous process has exited.
  */
 export declare function codexDriver(options: CodexDriverOptions): RuntimeDriver;
-export {};

package/dist/drivers/subprocess.d.ts

@@ -0,0 +1,38 @@
+import type { spawn } from 'node:child_process';
+import type { AskRequest, DriverTurn } from '../runner/types.js';
+/** What the drivers of runtimes that run as a child process share. */
+export type Json = Record<string, unknown>;
+export declare const isRecord: (value: unknown) => value is Json;
+export declare const text: (value: unknown) => string;
+export declare const oneLine: (value: string, max: number) => string;
+export declare const RISKY: RegExp;
+/**
+ * A turn holding a message from anyone but the owner, or an agent the runner confirmed as the owner's trusted teammate,
+ * is someone else's: coalesced follow-ups count too.
+ */
+export declare const guestTurn: (turn: DriverTurn) => boolean;
+/**
+ * RUN-25: one native approval request becomes one `approve` ask. The runner answers a repeated ask id once, so the id also
+ * carries what is asked: two requests on one item never share an answer.
+ */
+export declare function approve(turn: DriverTurn, request: Omit<Extract<AskRequest, {
+    kind: 'approve';
+}>, 'kind'>): Promise<"stopped" | "once" | "session" | "denied">;
+export interface StdioRpcOptions {
+    /** The runtime's name, for a refusal that carries no message. */
+    name: string;
+    /** Sent on every message: `{ jsonrpc: '2.0' }` where the runtime's protocol requires it. */
+    envelope?: Json;
+}
+/**
+ * JSON-RPC over a child's stdio: one line per message. A refusal rejects with the runtime's numeric `code`. A child that
+ * exits always reaches `close`, which otherwise waits for its pipes, so a driver can settle its process there.
+ */
+export declare function stdioRpc(child: ReturnType<typeof spawn>, handlers: {
+    notify(method: string, params: Json): void;
+    request(method: string, params: Json, id: unknown): Promise<unknown>;
+}, { name, envelope }: StdioRpcOptions): {
+    call: (method: string, params: Json) => Promise<Json>;
+    notify: (method: string, params?: Json) => void;
+    fail(error: Error): void;
+};

package/dist/index.d.ts

@@ -3,9 +3,9 @@ export type { Runner, RunnerOptions } from './runner/runner.js';
 export { ConnectorRelayError, DriverSessionError } from './runner/types.js';
 export { loadMlsDevConfiguration, MLS_SETUP_ACTIONS, mlsDevRoomPackageId, runMlsDevSetup } from './runner/mls.js';
 export type { MlsSetupAction, RunnerMlsOptions } from './runner/mls.js';
-export { bundledMlsCustodyHelper, MLS_ENVIRONMENT_PINS } from './runner/mls-bundled.js';
+export { bundledMlsCustodyHelper, bundledMlsWasmCore, MLS_ENVIRONMENT_PINS, type BundledMlsWasmCore } from './runner/mls-bundled.js';
 export { managedMlsDevice, type ManagedMlsDevice, type ManagedMlsDeviceOptions } from './runner/mls-managed.js';
-export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
+export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RoomFacts, RoomRules, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
 export { errandJournal, errandsDirectory, queueErrand } from './runner/errands.js';
 export type { ErrandCommand, ErrandInput, ErrandKind, ErrandRecord, ErrandStatus } from './runner/errands.js';
 export { codeDriver } from './drivers/code.js';
@@ -14,6 +14,8 @@ export { claudeDriver, loadClaudeQuery } from './drivers/claude.js';
 export type { ClaudeDriverOptions, ClaudeQuery } from './drivers/claude.js';
 export { checkCodex, codexDriver } from './drivers/codex.js';
 export type { CodexDriverOptions } from './drivers/codex.js';
+export { acpDriver, checkAcp } from './drivers/acp.js';
+export type { AcpAgent, AcpDriverOptions } from './drivers/acp.js';
 export { connectorDriver } from './drivers/connector.js';
 export type { ConnectorDriver, ConnectorInbox } from './drivers/connector.js';
 export { loadRelayConfiguration, startRelayChannel } from './runner/relay.js';

package/dist/index.js

@@ -3,7 +3,10 @@ import {
   DriverSessionError,
   MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  acpDriver,
   bundledMlsCustodyHelper,
+  bundledMlsWasmCore,
+  checkAcp,
   checkCodex,
   claudeDriver,
   codeDriver,
@@ -21,7 +24,8 @@ import {
   runMlsDevSetup,
   runtimeDescriptor,
   startRelayChannel
-} from "./chunks/chunk-3KFVBOVI.js";
+} from "./chunks/chunk-DNHJGAEL.js";
+import "./chunks/chunk-DTAWEQCM.js";
 import {
   CanonApiError,
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
@@ -46,8 +50,10 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-TFSURFF6.js";
-import "./chunks/chunk-C2WJT3VX.js";
+} from "./chunks/chunk-TYZT346O.js";
+import "./chunks/chunk-YJUPKU47.js";
+import "./chunks/chunk-YHDDOADK.js";
+import "./chunks/chunk-5WPAB5MB.js";
 export {
   CanonApiError,
   ConnectorRelayError,
@@ -60,7 +66,10 @@ export {
   MAX_CANON_MEDIA_BYTES,
   MLS_ENVIRONMENT_PINS,
   MLS_SETUP_ACTIONS,
+  acpDriver,
   bundledMlsCustodyHelper,
+  bundledMlsWasmCore,
+  checkAcp,
   checkCodex,
   claudeDriver,
   clearPendingRegistration,

package/dist/internal/backend-contracts/endpointContentPolicy.d.ts

@@ -14,8 +14,8 @@ export declare const MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS: readonly ["forward_mes
  * them through, and any other field still keeps the operation out. */
 export declare const MLS_DEV_DISCLOSED_PROCESSING_FIELDS: Readonly<Record<string, readonly string[]>>;
 export declare const ENDPOINT_CONTENT_ACTIONS: readonly ["mls_application", "mls_group_control", "initialize_endpoint", "append_artifact_command", "retain_artifact_asset", "sync_phone_contacts", "update_agent_behavior_policy", "update_conversation_agent_behavior_policy", "send_message", "delete_message", "forward_message", "react", "verb_execute", "send_contextual_message", "create_interaction", "consume_interaction", "start_conversation", "create_conversation", "add_member", "remove_member", "leave_conversation", "update_member_role", "update_conversation", "rename_conversation", "update_topic", "update_group_avatar", "mark_read", "cancel_queued_message", "set_conversation_preferences", "set_block", "save_contact", "remove_contact", "respond_interaction", "session_control", "approve_contact_request", "reject_contact_request", "cancel_direct_request", "update_message_disposition", "create_upload", "finalize_upload", "delete_upload", "retry_video_processing", "stage_media_message", "cancel_media_message", "renew_media_message_upload", "finalize_memo_stream", "abort_memo_stream", "create_voice_session", "join_voice_session", "decline_voice_session", "end_voice_session", "consume_runtime_signal", "consume_runtime_primitive", "generate_image"];
-export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents"];
-export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents", "admit_messages"];
+export declare const ENDPOINT_CONTENT_FUNCTION_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "mls_devices", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents"];
+export declare const ENDPOINT_CONTENT_QUERIES: readonly ["mls_group_feed", "mls_group_controls", "mls_group_admissions", "mls_interactions", "mls_devices", "list_artifacts", "get_artifact_log", "get_artifact_asset", "discover_agents", "get_unread_summary", "peek_runtime_signal", "list_runtime_primitives", "get_agent_behavior_policy", "get_conversation_agent_behavior_policy", "get_ephemeral", "list_voice_sessions", "list_contact_requests", "list_conversations", "list_messages", "get_messages", "admission_fences", "list_contacts", "get_contact", "get_members", "resolve_admission", "resolve_group_admission", "get_runtime_card_state", "conversation", "conversation_changes", "get_upload", "get_media_message", "get_voice_session", "get_image_generation", "get_image_generation_status", "same_owner_agents", "admit_messages"];
 export declare const ENDPOINT_CONTENT_EPHEMERALS: readonly ["prewarm_agents", "create_memo_stream", "publish_presence", "publish_typing", "publish_streaming", "publish_turn", "publish_runtime_status", "publish_session_state", "publish_runtime_info", "publish_runtime_activity", "append_memo_chunk"];
 export declare const ENDPOINT_CONTENT_EPHEMERAL_FAMILIES: readonly ["typing", "streaming", "turn-state", "agent-session", "runtime-card-state", "memo-streams", "runtime-info", "runtime-activity", "runtime-suppression", "runtime-silence", "runtime-attention", "call-attention", "agent-runtime", "presence"];
 export declare const ENDPOINT_CONTENT_EVENTS: readonly ["connected", "heartbeat", "agent.context", "replay.expired", "error", "participation.suppressed", "artifact.changed", "message.created", "message.snapshot", "message.updated", "message.deleted", "message.media_terminal", "conversation.updated", "conversation.changed", "conversation.removed", "conversations.changed", "contacts.changed", "contact.added", "contact.updated", "contact.removed", "presence", "typing", "runtime.updated", "runtime.control", "turn.updated", "voice.session.started", "voice.session.ended", ...string[]];

package/dist/internal/backend-contracts/index.d.ts

@@ -41,6 +41,7 @@ export * from './artifacts.js';
 export * from './artifactActions.js';
 export * from './mlsEnvironment.js';
 export * from './mlsDevEnrollment.js';
+export * from './loggedOutSessions.js';
 export * from './mlsDevCredential.js';
 export * from './mlsDevCredentialReconciliation.js';
 export * from './mlsDevDeviceCustody.js';

package/dist/internal/backend-contracts/loggedOutSessions.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Firebase sessions a device log-out ended (web-mls-device.md, decision 10). Firebase can only revoke every session of an
+ * account, so Canon names each ended one by its sign-in time, which a token refresh keeps, and refuses it.
+ */
+export declare const LOGGED_OUT_SESSIONS_DOCUMENT = "sessions";
+export declare const SESSION_LOGGED_OUT = "SESSION_LOGGED_OUT";
+export declare function isLoggedOutSession(record: unknown, authTime: number): boolean;

package/dist/internal/backend-contracts/mlsDevCredential.d.ts

@@ -1,6 +1,9 @@
 import { type MlsDevEnrollmentDevice } from './mlsDevEnrollment.js';
 import { type MlsEnvironmentId, type MlsIssuerId } from './mlsEnvironment.js';
+/** The lifetime the issuer gives every device. */
 export declare const MLS_DEV_CREDENTIAL_TTL_MS = 86400000;
+/** The other lifetime verifiers accept, for a person's device only. Nothing issues it yet (mls-production-cutover.md §6). */
+export declare const MLS_DEV_CREDENTIAL_LONG_TTL_MS: number;
 export declare const MLS_DEV_CREDENTIAL_CHALLENGE_TTL_MS = 300000;
 export declare const MLS_DEV_CREDENTIAL_MAX_BYTES = 8192;
 export interface MlsDevCredentialClaims {

package/dist/internal/backend-contracts/mlsDevGroup.d.ts

@@ -288,6 +288,23 @@ export declare function parseMlsDevGroupCreateConversation(value: unknown): MlsD
 export declare function parseMlsDevGroupHead(value: unknown): MlsDevGroupHead;
 export declare function parseMlsDevGroupMarker(value: unknown): MlsDevGroupMarker;
 export declare function parseMlsDevGroupRoster(value: unknown): readonly MlsDevGroupRosterEntry[];
+/** How long a room waits for a member who just joined it, or was there at its birth (D2, mls-rooms-by-default.md §2.7). */
+export declare const MLS_MEMBER_JOIN_WAIT_MS = 60000;
+/**
+ * Whom a send waits for in a room Canon made; empty means it may go (D2, narrowed 2026-10-31, mls-rooms-by-default.md
+ * §2.7). `unacceptedIds` are a direct request's target and founders still invited. `joinedAtMs` is the room's
+ * `mlsMemberJoinedAtMs`, NaN when it has none.
+ */
+export declare function mlsAdmissionWait(input: {
+    senderId: string;
+    memberIds: readonly string[];
+    unacceptedIds: readonly string[];
+    admitted: {
+        has(id: string): boolean;
+    };
+    joinedAtMs: number;
+    nowMs: number;
+}): string[];
 /** Hold, then close (owner ruling 2026-10-16; mls-dev-groups.md): how long an erased member's devices wait for a commit. */
 export declare const MLS_DEV_ROOM_REMOVAL_DEADLINE_MS: number;
 export interface MlsDevRoomRemovalEntry {

package/dist/internal/core/completed-output-journal.d.ts

@@ -32,8 +32,3 @@ export declare function createCompletedOutputJournal<T extends CompletedOutputRe
     /** Runtime-specific shape check beyond the base fields; false is an invalid record. */
     validate?: (record: T) => boolean;
 }): CompletedOutputJournal<T>;
-/** A new delivery after restart must not silently adopt a changed audience. */
-export declare function assertCompletedOutputAudience(record: Pick<CompletedOutputRecordBase, 'audience'>, current: {
-    memberIds: string[];
-    membershipRevision?: number;
-} | null, label: string): void;

package/dist/internal/core/index.d.ts

@@ -26,9 +26,6 @@ export type { RegistrationSession, RegistrationCredentials, RegistrationStore, R
 export { ensureAgentProfile } from './registration-profile.js';
 export type { EnsureAgentProfileOptions } from './registration-profile.js';
 export { submitRegistrationRequest, } from './registration.js';
-export { RuntimeRequestManager, RuntimeRequestCancelledError, runtimeInputDescriptor, runtimeCardDescriptor, runtimePlanDescriptor, } from './runtime-request-manager.js';
-export type { RuntimeRequestKind, RuntimeRequestContext, RuntimeRequestOptions, RuntimeConsumeOutcome, RuntimeOutcomeMessage, RuntimeRequestCallInput, RuntimeRequestPreflightInput, RuntimeRequestPushInput, RuntimeRequestPushMatch, KindDescriptor, RuntimeInputRequestPayload, RuntimeInputRequestResult, RuntimeCardRequestPayload, RuntimeCardRequestResult, RuntimePlanRequestPayload, RuntimePlanRequestResult, } from './runtime-request-manager.js';
-export { ApprovalManager } from './approval-manager.js';
 export { generateApprovalId, buildApprovalRequest, buildApprovalOutcome, redactSecrets, } from './approval-format.js';
 export { DEFAULT_APPROVAL_CONFIG, parseApprovalReplyMetadata, parseSessionRule, } from './approval-types.js';
 export type { ApprovalRequestCategory, ApprovalRequestDetail, ApprovalRequestMetadata, ApprovalNativeRequestMetadata, ApprovalRisk, ApprovalReplyMetadata, ApprovalOutcomeMetadata, SessionRule, ApprovalResult, ApprovalConfig, } from './approval-types.js';
@@ -37,10 +34,7 @@ export type { TruncateUnifiedDiffOptions } from './unified-diff.js';
 export { decodeStoredRuntimeCard } from '../backend-contracts/index.js';
 export { RUNTIME_CARD_SCHEMA_V1, RUNTIME_CARD_LIMITS, RUNTIME_CARD_FIELD_TYPES, RUNTIME_CARD_LINE_ITEM_COLUMN_TYPES, buildRuntimeCardOutcome, buildRuntimeCardPreview, buildRuntimeInputOutcome, parseRuntimeCardV1, validateRuntimeCardFieldValues, } from './runtime-cards.js';
 export type { PlanApprovalDecision, PlanApprovalMetadata, PlanApprovalReplyMetadata, RuntimeCardAction, RuntimeCardActionsBlock, RuntimeCardBlock, RuntimeCardBlockKind, RuntimeCardCalloutBlock, RuntimeCardChartBlock, RuntimeCardChartPoint, RuntimeCardChartSeries, RuntimeCardDetailsBlock, RuntimeCardDetailsRow, RuntimeCardField, RuntimeCardFieldChoice, RuntimeCardFieldType, RuntimeCardKnownBlockKind, RuntimeCardLineItemColumn, RuntimeCardLineItemColumnType, RuntimeCardListBlock, RuntimeCardListItem, RuntimeCardMediaKind, RuntimeCardMediaPreviewBlock, RuntimeCardMediaPreviewMedia, RuntimeCardMetric, RuntimeCardMetricGridBlock, RuntimeCardNativeMetadata, RuntimeCardOutcomeMetadata, RuntimeCardPreview, RuntimeCardReplyMetadata, RuntimeCardReplyStatus, RuntimeCardRequestMetadata, RuntimeCardResolutionStatus, RuntimeCardSchemaV1, RuntimeCardSummaryBlock, RuntimeCardTableBlock, RuntimeCardTone, RuntimeCardUnknownBlock, RuntimeCardV1, RuntimeInputAnswers, RuntimeInputChoice, RuntimeInputKind, RuntimeInputNativeMetadata, RuntimeInputOutcomeMetadata, RuntimeInputQuestion, RuntimeInputReplyMetadata, RuntimeInputReplyStatus, RuntimeInputRequestMetadata, RuntimeInputResolutionStatus, } from './runtime-cards.js';
-export { NO_REPLY_ACK_NOTE, NO_REPLY_REASON_SENTINEL, reportNoReplyOutcome, } from './silent-turn.js';
-export type { NoReplyReportClient } from './silent-turn.js';
-export { DEFAULT_TURN_VERBOSITY_BY_CONVERSATION_TYPE, normalizeTurnVerbosityConversationType, parseTurnVerbosityConfig, resolveTurnVerbosity, } from './turn-verbosity.js';
-export type { TurnVerbosity, TurnVerbosityConfig, TurnVerbosityConversationType, } from './turn-verbosity.js';
+export { NO_REPLY_ACK_NOTE, NO_REPLY_REASON_SENTINEL, } from './silent-turn.js';
 export { clearPendingRegistration, loadPendingRegistrations, loadProfiles, savePendingRegistrations, saveProfiles, upsertAgentProfile, isProfileLocked, acquireLock, releaseLock, isProcessAlive, CANON_DIR, AGENTS_PATH, LOCKS_DIR, } from './agent-profiles.js';
 export type { AgentProfile, AgentProfileInput, PendingRegistration, ProfileLockHandle, } from './agent-profiles.js';
 export { initRTDBAuth, } from './rtdb-rest.js';
@@ -49,8 +43,8 @@ export { renderCanonHostInboundContent, } from './host-runtime.js';
 export type { CanonReplyContext, } from './host-runtime.js';
 export { createRuntimeStatePublisher, } from './runtime-state-publisher.js';
 export type { RuntimeStatePublisher, RuntimeStatePublisherOptions, RuntimeStreamingPayload, ClearRuntimeActivityOptions, } from './runtime-state-publisher.js';
-export { buildChunkedMessagePartMetadata, CANON_MESSAGE_TEXT_MAX_BYTES, ChunkedSendMessageError, DEFAULT_CHUNKED_MESSAGE_TEXT_MAX_BYTES, sendMessageWithRetryChunked, isPendingCanonOperation, isChunkedSendMessageError, isRetryableCanonDeliveryError, sendMessageWithRetry, splitTextByUtf8Bytes, utf8ByteLength, } from './retry.js';
-export type { ChunkedMessagePartMetadataInput, ChunkedSendMessageResult, SendMessageChunkingOptions, SendMessageRetryOptions, } from './retry.js';
+export { buildChunkedMessagePartMetadata, CANON_MESSAGE_TEXT_MAX_BYTES, DEFAULT_CHUNKED_MESSAGE_TEXT_MAX_BYTES, isPendingCanonOperation, isRetryableCanonDeliveryError, splitTextByUtf8Bytes, splitTextWithinBytes, utf8ByteLength, } from './retry.js';
+export type { ChunkedMessagePartMetadataInput, } from './retry.js';
 export { DEFAULT_BASE_URL } from './constants.js';
 export { CANON_RUNTIME_ENDPOINT_DEFAULTS, DEFAULT_CANON_ENVIRONMENT_ID, DEFAULT_CANON_RUNTIME_ENDPOINTS, getCanonRuntimeEndpointDefaults, requireCanonRuntimeEndpointDefaults, resolveCanonRuntimeConnection, verifyCanonRuntimeConnection, } from './runtime-endpoints.js';
 export type { CanonRuntimeConnection, CanonRuntimeConnectionOptions, CanonRuntimeEndpointDefaults, } from './runtime-endpoints.js';