@canonmsg/agent-sdk 12.6.1 → 13.0.2

package/dist/chunks/{chunk-QK37HAHC.js → chunk-YHDDOADK.js}

@@ -9,7 +9,7 @@ import {
   parseMlsDevEnrollmentPrincipal,
   parseMlsDevIssuerKeyVersion,
   parseMlsDevReceiptKeyVersion
-} from "./chunk-S7BV74DN.js";
+} from "./chunk-5WPAB5MB.js";
 
 // ../endpoint/src/mls-crypto.ts
 import { ed25519 } from "@noble/curves/ed25519.js";

package/dist/chunks/{chunk-FVYKLH6I.js → chunk-YJUPKU47.js}

@@ -43,7 +43,7 @@ import {
   parseMlsDevKeyPackagePreparation,
   parseMlsDevKeyPackagePublicationReceipt,
   parseMlsDevKeyPackagePublish
-} from "./chunk-S7BV74DN.js";
+} from "./chunk-5WPAB5MB.js";
 
 // ../endpoint/src/events.ts
 function createEndpointEventHub(input) {
@@ -611,13 +611,21 @@ __name(validateEndpointContentBoundary, "validateEndpointContentBoundary");
 function createHttpEndpointTransport(options) {
   const fetcher = options.fetch ?? globalThis.fetch;
   const clientHeaders = options.client ? { [CANON_CLIENT_HEADER]: formatCanonClientHeader(options.client) } : {};
+  let clientUpdateRequired;
   const updateRequired = /* @__PURE__ */ __name((error) => {
-    if (error.code === CLIENT_UPDATE_REQUIRED) try {
-      options.onClientUpdateRequired?.(error);
-    } catch {
+    if (error.code === CLIENT_UPDATE_REQUIRED) {
+      if (clientUpdateRequired) return clientUpdateRequired;
+      clientUpdateRequired = error;
+      try {
+        options.onClientUpdateRequired?.(error);
+      } catch {
+      }
     }
     return error;
   }, "updateRequired");
+  const assertClientSupported = /* @__PURE__ */ __name(() => {
+    if (clientUpdateRequired) throw clientUpdateRequired;
+  }, "assertClientSupported");
   const baseUrl = options.baseUrl.replace(/\/$/, "");
   let resolvedStreamId;
   function streamIdentity() {
@@ -639,7 +647,9 @@ function createHttpEndpointTransport(options) {
   __name(ownershipHeaders, "ownershipHeaders");
   async function call(path, method, body, signal, origin = baseUrl, groupResponse = false) {
     for (let authAttempt = 0; authAttempt < 2; authAttempt++) {
+      if (path !== "/endpoint/capabilities") assertClientSupported();
       const token = await options.credentials.getToken(authAttempt > 0);
+      if (path !== "/endpoint/capabilities") assertClientSupported();
       if (!token) throw new EndpointError("Authentication is required", { status: 401, code: "UNAUTHENTICATED", retryable: false });
       const controller = new AbortController();
       const abort = /* @__PURE__ */ __name(() => controller.abort(signal?.reason), "abort");
@@ -694,9 +704,12 @@ function createHttpEndpointTransport(options) {
     },
     ...options.streamUrl ? {
       async *events(streamOptions) {
+        assertClientSupported();
         const streamId = await streamIdentity();
         for (let attempt = 0; attempt < 2; attempt++) {
+          assertClientSupported();
           const token = await options.credentials.getToken(attempt > 0);
+          assertClientSupported();
           if (!token) throw new EndpointError("Authentication is required", { status: 401, code: "UNAUTHENTICATED", retryable: false });
           const connection = new AbortController();
           const abort = /* @__PURE__ */ __name(() => connection.abort(streamOptions.signal.reason), "abort");
@@ -717,7 +730,7 @@ function createHttpEndpointTransport(options) {
               await response.body?.cancel();
               continue;
             }
-            if (!response.ok) throw updateRequired(await readHttpError(response, connection.signal));
+            if (!response.ok) throw await readHttpError(response, connection.signal);
             if (!response.headers.get("Content-Type")?.toLowerCase().startsWith("text/event-stream")) {
               await response.body?.cancel();
               throw new EndpointError("Canon returned an invalid event stream", { status: 502, code: "INVALID_EVENT_STREAM" });
@@ -732,6 +745,8 @@ function createHttpEndpointTransport(options) {
               yield event;
             }
             return;
+          } catch (error) {
+            throw error instanceof EndpointError ? updateRequired(error) : error;
           } finally {
             clearTimeout(handshake);
             streamOptions.signal.removeEventListener("abort", abort);

package/dist/chunks/{mls-crypto-4DZT2UFH.js → mls-crypto-NZVMSUFU.js}

@@ -2,8 +2,8 @@ import {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,
   parseMlsDevClientConfiguration
-} from "./chunk-QK37HAHC.js";
-import "./chunk-S7BV74DN.js";
+} from "./chunk-YHDDOADK.js";
+import "./chunk-5WPAB5MB.js";
 export {
   createMlsDevCredentialVerifier,
   mlsDevDeviceHttpConfiguration,

package/dist/cli.js

@@ -23,11 +23,11 @@ import {
   runMlsDevSetup,
   startRelayChannel,
   writeRelayCredential
-} from "./chunks/chunk-DAJ7L7TN.js";
+} from "./chunks/chunk-DNHJGAEL.js";
 import {
   assertPrivateHome,
   runnerLockName
-} from "./chunks/chunk-HH7KR22P.js";
+} from "./chunks/chunk-DTAWEQCM.js";
 import {
   CanonApiError,
   CanonClient,
@@ -38,13 +38,13 @@ import {
   resolveCanonRuntimeConnection,
   runCli,
   verifyCanonRuntimeConnection
-} from "./chunks/chunk-5J4YPLNW.js";
-import "./chunks/chunk-FVYKLH6I.js";
-import "./chunks/chunk-QK37HAHC.js";
+} from "./chunks/chunk-TYZT346O.js";
+import "./chunks/chunk-YJUPKU47.js";
+import "./chunks/chunk-YHDDOADK.js";
 import {
   __name,
   isCanonClientVersion
-} from "./chunks/chunk-S7BV74DN.js";
+} from "./chunks/chunk-5WPAB5MB.js";
 
 // src/cli.ts
 import { realpathSync } from "node:fs";
@@ -89,29 +89,28 @@ Usage:
   canon-agent errands [--follow] [--cancel <errand id>] (--agent <id> | --profile <name>)
                   [--environment <id>]
 
-Encrypted rooms need the agent's MLS device. The runner keeps it in $CANON_HOME and sets
-it up on the agent's first start: nothing to configure. On macOS (Apple silicon) and
-glibc Linux (x64, arm64) it uses the custody helper this package ships; on Windows,
-Intel Macs and musl Linux, this package's WASM core. Every run command also takes
---mls-dev-config <path>, an operator's own custody instead. With none of these, the
-agent refuses encrypted rooms, and where Canon encrypts every new conversation it does
-not start.
+Every room is encrypted, so the agent needs its MLS device. The runner keeps it in
+$CANON_HOME and sets it up on the agent's first start: nothing to configure. On macOS
+(Apple silicon) and glibc Linux (x64, arm64) it uses the custody helper this package
+ships; on Windows, Intel Macs and musl Linux, this package's WASM core. Every run
+command also takes --mls-dev-config <path>, an operator's own custody instead. With none
+of these, the agent refuses every room, and where Canon encrypts every new conversation
+it does not start.
 
 Team rooms (an owner's agents working together): claude, codex and acp also take
 [--instructions <file>] [--trust-agent <agentId>]...; every run command takes
-[--agent-turn-cap <n>] [--mention-alias <name>]..., which apply in encrypted rooms.
+[--agent-turn-cap <n>] [--mention-alias <name>]....
 code, claude, codex and acp take [--allow-session-for-destructive] for encrypted cards.
 
 Errands: tell, post and errand direct a running agent from the machine it runs on:
 whoever can write $CANON_HOME commands it, and the CLI itself uses no network. tell
 leaves a private note for the agent's next turn in a room: never posted, it starts no
-turn. post sends the text as the agent's own message, with no turn (encrypted in an
-encrypted room). errand runs one owner-authorised turn that carries the instruction to
-the recipient (a room the agent is in, or a new conversation with a person or agent),
-reports to --origin, and tells later turns there why the agent came. What concerns an
-encrypted room is reported only to an encrypted origin; otherwise the report stays
-local (canon-agent errands). Canon's policies, blocks and rate limits apply as to any
-message from the agent.
+turn. post sends the text, encrypted, as the agent's own message, with no turn. errand
+runs one owner-authorised turn that carries the instruction to the recipient (a room
+the agent is in, or a new conversation with a person or agent), reports to --origin,
+and tells later turns there why the agent came. Without --origin the report stays local
+(canon-agent errands). Canon's policies, blocks and rate limits apply as to any message
+from the agent.
 
 Flags:
   --driver <name>        The runtime driver: "code", "claude", "codex", "acp" or
@@ -152,19 +151,17 @@ Flags:
                          as the owner's for tool use (repeat for several), only in a
                          room whose other members are all listed agents that Canon
                          confirms at each turn as active agents of this agent's
-                         owner (and, in plaintext, only for a final that agent's own
-                         runner marked as answering its owner). Otherwise they are
-                         guarded like any other agent's. Approvals still go to the
-                         owner.
-  --agent-turn-cap <n>   Encrypted rooms: another agent's message wakes this agent only
-                         when it @mentions it (by display name, id or an alias), at
-                         most n times in a row per room until a person writes there
-                         (default 6; 0: agents never wake it). Plaintext rooms
-                         follow Canon's group rules.
-  --mention-alias <name> Encrypted rooms: another name that @mentions this agent, such
-                         as its role (repeat for several).
+                         owner. Otherwise they are guarded like any other agent's.
+                         Approvals still go to the owner.
+  --agent-turn-cap <n>   Another agent's message wakes this agent only when it
+                         @mentions it (by display name, id or an alias), at most n
+                         times in a row per room until a person writes there
+                         (default 6; 0: agents never wake it). The room's own
+                         rules can stop them sooner.
+  --mention-alias <name> Another name that @mentions this agent, such as its role
+                         (repeat for several).
   --allow-session-for-destructive
-                         Encrypted rooms: let the owner allow an action the runtime
+                         Let the owner allow an action the runtime
                          marks destructive (Claude Code's default-to-no prompts,
                          Codex's risky commands and deletions) for the rest of the
                          session. Off by default: each such action asks.
@@ -192,10 +189,9 @@ Flags:
   --text <text>          tell: the note. post: the message. errand: the instruction.
                          At most 32 KiB.
   --to <id>              errand: a conversation the agent is in, or else a person or
-                         agent to start a new (plaintext) conversation with.
+                         agent to start a new conversation with.
   --why <why>            errand: why the owner sends the agent (at most 4 KiB).
-  --origin <id>          errand: the conversation the report goes to. A report about an
-                         encrypted recipient goes only to an encrypted origin.
+  --origin <id>          errand: the conversation the report goes to.
   --follow               errands: go on printing each change.
   --cancel <id>          errands: cancel that errand (Stop in its origin also stops it).
   --agent <id>           tell, post, errand, errands: the agent (or --profile).

package/dist/drivers/subprocess.d.ts

@@ -24,7 +24,10 @@ export interface StdioRpcOptions {
     /** Sent on every message: `{ jsonrpc: '2.0' }` where the runtime's protocol requires it. */
     envelope?: Json;
 }
-/** JSON-RPC over a child's stdio: one line per message. A refusal rejects with the runtime's numeric `code`. */
+/**
+ * JSON-RPC over a child's stdio: one line per message. A refusal rejects with the runtime's numeric `code`. A child that
+ * exits always reaches `close`, which otherwise waits for its pipes, so a driver can settle its process there.
+ */
 export declare function stdioRpc(child: ReturnType<typeof spawn>, handlers: {
     notify(method: string, params: Json): void;
     request(method: string, params: Json, id: unknown): Promise<unknown>;

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { loadMlsDevConfiguration, MLS_SETUP_ACTIONS, mlsDevRoomPackageId, runMls
 export type { MlsSetupAction, RunnerMlsOptions } from './runner/mls.js';
 export { bundledMlsCustodyHelper, bundledMlsWasmCore, MLS_ENVIRONMENT_PINS, type BundledMlsWasmCore } from './runner/mls-bundled.js';
 export { managedMlsDevice, type ManagedMlsDevice, type ManagedMlsDeviceOptions } from './runner/mls-managed.js';
-export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
+export type { ActivityEvent, AskAnswer, AskRequest, DriverCapabilities, DriverResult, DriverState, DriverTurn, ErrandFacts, RoomFacts, RoomRules, RuntimeDriver, ToolDefinition, ToolResult, TurnInput, TurnInputMessage, TurnTools, } from './runner/types.js';
 export { errandJournal, errandsDirectory, queueErrand } from './runner/errands.js';
 export type { ErrandCommand, ErrandInput, ErrandKind, ErrandRecord, ErrandStatus } from './runner/errands.js';
 export { codeDriver } from './drivers/code.js';

package/dist/index.js

@@ -24,8 +24,8 @@ import {
   runMlsDevSetup,
   runtimeDescriptor,
   startRelayChannel
-} from "./chunks/chunk-DAJ7L7TN.js";
-import "./chunks/chunk-HH7KR22P.js";
+} from "./chunks/chunk-DNHJGAEL.js";
+import "./chunks/chunk-DTAWEQCM.js";
 import {
   CanonApiError,
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
@@ -50,10 +50,10 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-5J4YPLNW.js";
-import "./chunks/chunk-FVYKLH6I.js";
-import "./chunks/chunk-QK37HAHC.js";
-import "./chunks/chunk-S7BV74DN.js";
+} from "./chunks/chunk-TYZT346O.js";
+import "./chunks/chunk-YJUPKU47.js";
+import "./chunks/chunk-YHDDOADK.js";
+import "./chunks/chunk-5WPAB5MB.js";
 export {
   CanonApiError,
   ConnectorRelayError,

package/dist/internal/backend-contracts/mlsDevGroup.d.ts

@@ -288,6 +288,23 @@ export declare function parseMlsDevGroupCreateConversation(value: unknown): MlsD
 export declare function parseMlsDevGroupHead(value: unknown): MlsDevGroupHead;
 export declare function parseMlsDevGroupMarker(value: unknown): MlsDevGroupMarker;
 export declare function parseMlsDevGroupRoster(value: unknown): readonly MlsDevGroupRosterEntry[];
+/** How long a room waits for a member who just joined it, or was there at its birth (D2, mls-rooms-by-default.md §2.7). */
+export declare const MLS_MEMBER_JOIN_WAIT_MS = 60000;
+/**
+ * Whom a send waits for in a room Canon made; empty means it may go (D2, narrowed 2026-10-31, mls-rooms-by-default.md
+ * §2.7). `unacceptedIds` are a direct request's target and founders still invited. `joinedAtMs` is the room's
+ * `mlsMemberJoinedAtMs`, NaN when it has none.
+ */
+export declare function mlsAdmissionWait(input: {
+    senderId: string;
+    memberIds: readonly string[];
+    unacceptedIds: readonly string[];
+    admitted: {
+        has(id: string): boolean;
+    };
+    joinedAtMs: number;
+    nowMs: number;
+}): string[];
 /** Hold, then close (owner ruling 2026-10-16; mls-dev-groups.md): how long an erased member's devices wait for a commit. */
 export declare const MLS_DEV_ROOM_REMOVAL_DEADLINE_MS: number;
 export interface MlsDevRoomRemovalEntry {

package/dist/internal/core/completed-output-journal.d.ts

@@ -32,8 +32,3 @@ export declare function createCompletedOutputJournal<T extends CompletedOutputRe
     /** Runtime-specific shape check beyond the base fields; false is an invalid record. */
     validate?: (record: T) => boolean;
 }): CompletedOutputJournal<T>;
-/** A new delivery after restart must not silently adopt a changed audience. */
-export declare function assertCompletedOutputAudience(record: Pick<CompletedOutputRecordBase, 'audience'>, current: {
-    memberIds: string[];
-    membershipRevision?: number;
-} | null, label: string): void;

package/dist/internal/core/index.d.ts

@@ -26,9 +26,6 @@ export type { RegistrationSession, RegistrationCredentials, RegistrationStore, R
 export { ensureAgentProfile } from './registration-profile.js';
 export type { EnsureAgentProfileOptions } from './registration-profile.js';
 export { submitRegistrationRequest, } from './registration.js';
-export { RuntimeRequestManager, RuntimeRequestCancelledError, runtimeInputDescriptor, runtimeCardDescriptor, runtimePlanDescriptor, } from './runtime-request-manager.js';
-export type { RuntimeRequestKind, RuntimeRequestContext, RuntimeRequestOptions, RuntimeConsumeOutcome, RuntimeOutcomeMessage, RuntimeRequestCallInput, RuntimeRequestPreflightInput, RuntimeRequestPushInput, RuntimeRequestPushMatch, KindDescriptor, RuntimeInputRequestPayload, RuntimeInputRequestResult, RuntimeCardRequestPayload, RuntimeCardRequestResult, RuntimePlanRequestPayload, RuntimePlanRequestResult, } from './runtime-request-manager.js';
-export { ApprovalManager } from './approval-manager.js';
 export { generateApprovalId, buildApprovalRequest, buildApprovalOutcome, redactSecrets, } from './approval-format.js';
 export { DEFAULT_APPROVAL_CONFIG, parseApprovalReplyMetadata, parseSessionRule, } from './approval-types.js';
 export type { ApprovalRequestCategory, ApprovalRequestDetail, ApprovalRequestMetadata, ApprovalNativeRequestMetadata, ApprovalRisk, ApprovalReplyMetadata, ApprovalOutcomeMetadata, SessionRule, ApprovalResult, ApprovalConfig, } from './approval-types.js';
@@ -37,10 +34,7 @@ export type { TruncateUnifiedDiffOptions } from './unified-diff.js';
 export { decodeStoredRuntimeCard } from '../backend-contracts/index.js';
 export { RUNTIME_CARD_SCHEMA_V1, RUNTIME_CARD_LIMITS, RUNTIME_CARD_FIELD_TYPES, RUNTIME_CARD_LINE_ITEM_COLUMN_TYPES, buildRuntimeCardOutcome, buildRuntimeCardPreview, buildRuntimeInputOutcome, parseRuntimeCardV1, validateRuntimeCardFieldValues, } from './runtime-cards.js';
 export type { PlanApprovalDecision, PlanApprovalMetadata, PlanApprovalReplyMetadata, RuntimeCardAction, RuntimeCardActionsBlock, RuntimeCardBlock, RuntimeCardBlockKind, RuntimeCardCalloutBlock, RuntimeCardChartBlock, RuntimeCardChartPoint, RuntimeCardChartSeries, RuntimeCardDetailsBlock, RuntimeCardDetailsRow, RuntimeCardField, RuntimeCardFieldChoice, RuntimeCardFieldType, RuntimeCardKnownBlockKind, RuntimeCardLineItemColumn, RuntimeCardLineItemColumnType, RuntimeCardListBlock, RuntimeCardListItem, RuntimeCardMediaKind, RuntimeCardMediaPreviewBlock, RuntimeCardMediaPreviewMedia, RuntimeCardMetric, RuntimeCardMetricGridBlock, RuntimeCardNativeMetadata, RuntimeCardOutcomeMetadata, RuntimeCardPreview, RuntimeCardReplyMetadata, RuntimeCardReplyStatus, RuntimeCardRequestMetadata, RuntimeCardResolutionStatus, RuntimeCardSchemaV1, RuntimeCardSummaryBlock, RuntimeCardTableBlock, RuntimeCardTone, RuntimeCardUnknownBlock, RuntimeCardV1, RuntimeInputAnswers, RuntimeInputChoice, RuntimeInputKind, RuntimeInputNativeMetadata, RuntimeInputOutcomeMetadata, RuntimeInputQuestion, RuntimeInputReplyMetadata, RuntimeInputReplyStatus, RuntimeInputRequestMetadata, RuntimeInputResolutionStatus, } from './runtime-cards.js';
-export { NO_REPLY_ACK_NOTE, NO_REPLY_REASON_SENTINEL, reportNoReplyOutcome, } from './silent-turn.js';
-export type { NoReplyReportClient } from './silent-turn.js';
-export { DEFAULT_TURN_VERBOSITY_BY_CONVERSATION_TYPE, normalizeTurnVerbosityConversationType, parseTurnVerbosityConfig, resolveTurnVerbosity, } from './turn-verbosity.js';
-export type { TurnVerbosity, TurnVerbosityConfig, TurnVerbosityConversationType, } from './turn-verbosity.js';
+export { NO_REPLY_ACK_NOTE, NO_REPLY_REASON_SENTINEL, } from './silent-turn.js';
 export { clearPendingRegistration, loadPendingRegistrations, loadProfiles, savePendingRegistrations, saveProfiles, upsertAgentProfile, isProfileLocked, acquireLock, releaseLock, isProcessAlive, CANON_DIR, AGENTS_PATH, LOCKS_DIR, } from './agent-profiles.js';
 export type { AgentProfile, AgentProfileInput, PendingRegistration, ProfileLockHandle, } from './agent-profiles.js';
 export { initRTDBAuth, } from './rtdb-rest.js';
@@ -49,8 +43,8 @@ export { renderCanonHostInboundContent, } from './host-runtime.js';
 export type { CanonReplyContext, } from './host-runtime.js';
 export { createRuntimeStatePublisher, } from './runtime-state-publisher.js';
 export type { RuntimeStatePublisher, RuntimeStatePublisherOptions, RuntimeStreamingPayload, ClearRuntimeActivityOptions, } from './runtime-state-publisher.js';
-export { buildChunkedMessagePartMetadata, CANON_MESSAGE_TEXT_MAX_BYTES, ChunkedSendMessageError, DEFAULT_CHUNKED_MESSAGE_TEXT_MAX_BYTES, sendMessageWithRetryChunked, isPendingCanonOperation, isChunkedSendMessageError, isRetryableCanonDeliveryError, sendMessageWithRetry, splitTextByUtf8Bytes, utf8ByteLength, } from './retry.js';
-export type { ChunkedMessagePartMetadataInput, ChunkedSendMessageResult, SendMessageChunkingOptions, SendMessageRetryOptions, } from './retry.js';
+export { buildChunkedMessagePartMetadata, CANON_MESSAGE_TEXT_MAX_BYTES, DEFAULT_CHUNKED_MESSAGE_TEXT_MAX_BYTES, isPendingCanonOperation, isRetryableCanonDeliveryError, splitTextByUtf8Bytes, splitTextWithinBytes, utf8ByteLength, } from './retry.js';
+export type { ChunkedMessagePartMetadataInput, } from './retry.js';
 export { DEFAULT_BASE_URL } from './constants.js';
 export { CANON_RUNTIME_ENDPOINT_DEFAULTS, DEFAULT_CANON_ENVIRONMENT_ID, DEFAULT_CANON_RUNTIME_ENDPOINTS, getCanonRuntimeEndpointDefaults, requireCanonRuntimeEndpointDefaults, resolveCanonRuntimeConnection, verifyCanonRuntimeConnection, } from './runtime-endpoints.js';
 export type { CanonRuntimeConnection, CanonRuntimeConnectionOptions, CanonRuntimeEndpointDefaults, } from './runtime-endpoints.js';

package/dist/internal/core/retry.d.ts

@@ -1,82 +1,12 @@
-import type { SendMessageOptions } from './types.js';
-import { type CanonClient } from './client.js';
-export interface SendMessageRetryOptions {
-    /** Stable replacement recorded by the product after a conclusive rejection. */
-    operationId?: string;
-    replacesOperationId?: string;
-    signal?: AbortSignal;
-    timeoutMs?: number;
-    maxAttempts?: number;
-    baseDelayMs?: number;
-    maxDelayMs?: number;
-    sleep?: (ms: number) => Promise<void>;
-}
 export declare const CANON_MESSAGE_TEXT_MAX_BYTES: number;
 export declare const DEFAULT_CHUNKED_MESSAGE_TEXT_MAX_BYTES = 3800;
-export interface SendMessageChunkingOptions {
-    maxTextBytes?: number;
-    /**
-     * Opt in to resumable chunked delivery.
-     *
-     * With it on, a mid-sequence failure throws a `ChunkedSendMessageError`
-     * carrying the ids of the parts that ARE durable, so a later attempt can pick
-     * up the tail. Off by default so callers that do not resume keep today's
-     * behaviour: the raw send error, unwrapped.
-     *
-     * Implied by a non-empty `deliveredMessageIds` — passing progress back IS
-     * opting in.
-     */
-    resumable?: boolean;
-    /**
-     * Ids of the parts an earlier attempt already made durable, in part order.
-     * Those parts are skipped and their ids are carried into the result, so a
-     * resumed send still reports the whole answer.
-     */
-    deliveredMessageIds?: readonly string[];
-}
-export interface ChunkedSendMessageResult {
-    messageIds: string[];
-}
 /** Pending delivery is visible, but cannot truthfully produce a failure notice. */
 export declare function isPendingCanonOperation(error: unknown): boolean;
-/**
- * A chunked send that stopped part-way, with the progress needed to resume it.
- *
- * Parts 1..`deliveredMessageIds.length` are durable in Canon; only the tail is
- * missing. Handing `deliveredMessageIds` back to `sendMessageWithRetryChunked`
- * restarts at the next part instead of re-sending the answer's head — which the
- * server would reject or duplicate, and which the reader has already seen.
- */
-export declare class ChunkedSendMessageError extends Error {
-    /** Ids of the parts that are durable in Canon, in part order. */
-    readonly deliveredMessageIds: string[];
-    /** The part the send stopped on (1-based). */
-    readonly failedPart: number;
-    /** How many parts the text splits into in total. */
-    readonly totalParts: number;
-    /** The underlying send failure — what callers should classify. */
-    readonly cause: unknown;
-    constructor(input: {
-        cause: unknown;
-        deliveredMessageIds: readonly string[];
-        failedPart: number;
-        totalParts: number;
-    });
-    /** How many parts are durable — a resume starts at the next one. */
-    get deliveredParts(): number;
-}
-/**
- * Structural check as well as `instanceof`, so progress survives a caller that
- * ended up with a second copy of this module (a workspace package resolved to
- * both `dist` and source, say) instead of silently degrading to "no progress".
- */
-export declare function isChunkedSendMessageError(error: unknown): error is ChunkedSendMessageError;
 export declare function isRetryableCanonDeliveryError(error: unknown): boolean;
-export declare function sendMessageWithRetry(client: CanonClient, conversationId: string, text: string, options?: SendMessageOptions, retryOptions?: SendMessageRetryOptions): Promise<{
-    messageId: string;
-}>;
 export declare function utf8ByteLength(value: string): number;
 export declare function splitTextByUtf8Bytes(text: string, maxBytes?: number): string[];
+/** The same split for a limit of the caller's own: an encrypted room's text takes up to 32 KiB. */
+export declare function splitTextWithinBytes(text: string, byteLimit: number): string[];
 export declare function chunkMessageId(baseMessageId: string | undefined, index: number): string | undefined;
 export interface ChunkedMessagePartMetadataInput {
     /** Stable group id shared by every part, normally the unsuffixed message id. */
@@ -94,20 +24,3 @@ export interface ChunkedMessagePartMetadataInput {
  * preceding message parts.
  */
 export declare function buildChunkedMessagePartMetadata(input: ChunkedMessagePartMetadataInput): Record<string, unknown>;
-/**
- * Send `text` as one message, or as an ordered sequence of `-part-N` messages
- * when it exceeds the byte budget.
- *
- * Sequential by construction, so a failure leaves parts 1..k durable and the
- * tail unsent. Callers that opt into `resumable` get that progress back (see
- * `ChunkedSendMessageError`) and can hand it to a later attempt, which then
- * picks up at part k+1. The split is a pure function of the text and the byte
- * budget, so part N of a resumed attempt is byte-identical to part N of the
- * attempt that delivered it — which is what makes the `-part-N` ids a safe
- * resume cursor.
- *
- * A byte-identical replay succeeds at the server. Any idempotency conflict
- * therefore means the stored part differs and is always reported; treating it
- * as delivered would stitch two different answers together.
- */
-export declare function sendMessageWithRetryChunked(client: CanonClient, conversationId: string, text: string, options?: SendMessageOptions, retryOptions?: SendMessageRetryOptions, chunkingOptions?: SendMessageChunkingOptions): Promise<ChunkedSendMessageResult>;

package/dist/internal/core/silent-turn.d.ts

@@ -11,39 +11,10 @@
  * the server and the hosts depend on.
  */
 export { NO_REPLY_ACK_NOTE } from '../backend-contracts/index.js';
-import { type CanonVerbWireRequest } from '../backend-contracts/index.js';
-/** The one client capability the outcome report needs. */
-export interface NoReplyReportClient {
-    executeVerbWire(wire: CanonVerbWireRequest): Promise<unknown>;
-}
 /**
- * What `reportNoReplyOutcome` puts on the wire in place of any caller-supplied
- * reason text. The server stores only `hasReason` and discards the text, so
- * transmitting the model- or handler-authored sentence would be pure exposure:
- * the sentinel preserves the server's `hasReason` signal without moving the
- * text. The reason a binding was handed never leaves its process.
+ * What a `no_reply` verb carries in place of any caller-supplied reason text.
+ * The server stores only `hasReason` and discards the text, so transmitting
+ * the model- or handler-authored sentence would be pure exposure: the sentinel
+ * preserves the server's `hasReason` signal without moving the text.
  */
 export declare const NO_REPLY_REASON_SENTINEL = "given";
-/**
- * Report a locally-answered `no_reply` to the server, fire-and-forget.
- *
- * Four of the five runtimes answer the silence tool inside their own process
- * and never reach `POST /agent/verbs/no_reply`, so Canon's durable record of
- * deliberate silence (`/runtime-silence/{convoId}/{agentId}`) would otherwise
- * cover Claude turns only. This is telemetry, not behavior: the silence flag
- * is already set locally before this is called, so a failed or unreachable
- * report degrades to exactly the pre-report behavior — never to a posted
- * message and never to a failed turn.
- *
- * `params.reason` is read only for its presence: the wire carries
- * `NO_REPLY_REASON_SENTINEL` in its place, never the caller's text.
- *
- * The Claude host must NOT call this helper: its binding already POSTs the
- * verb via agent-tools, so calling both would double-record the silence.
- */
-export declare function reportNoReplyOutcome(client: NoReplyReportClient, params: {
-    conversationId: string;
-    messageId?: string;
-    reason?: string;
-    now?: number;
-}): void;

package/dist/internal/endpoint/engine.d.ts

@@ -34,6 +34,9 @@ export interface EndpointExecuteOptions {
     operationId?: string;
     sensitive?: boolean;
     guardId?: string;
+    /** A person's text in an encrypted room that is held (D2): kept on this device and sent once the room may send, the
+     * call waiting with it, instead of refused with `MLS_DEV_GROUP_ADMISSION_PENDING`. */
+    waitWhileHeld?: boolean;
 }
 export interface EndpointWaitOptions {
     signal?: AbortSignal;

package/dist/internal/endpoint/mls-dev-groups.d.ts

@@ -46,6 +46,8 @@ export interface MlsDevVerifiedMessageBinding {
 export interface MlsDevAdmissionHold {
     readonly held: boolean;
     readonly waitingPrincipalIds: readonly string[];
+    /** This device joined after the room's first message, so its history starts later (mls-rooms-by-default.md §2.7). */
+    readonly missedEarlier?: true;
 }
 export interface MlsDevCurrentAudience {
     readonly version: 1;
@@ -173,6 +175,16 @@ export declare function createMlsDevGroups(options: MlsDevDeviceClientOptions, c
      * encrypted room (mls-payload-v3.md §4). Items and cards are not forwarded yet. */
     forwardText(value: unknown, operationId: string, guardId?: string): Promise<EndpointOperation>;
     sendText(value: unknown, operationId: string, guardId?: string): Promise<EndpointOperation>;
+    /** `sendText` for a person's composer: in a held room the text is kept, not refused (undefined), until `sendHeldTexts`. */
+    holdText(value: unknown, operationId: string): Promise<EndpointOperation | undefined>;
+    sendHeldTexts(conversationId: string): Promise<{
+        sent: EndpointOperation[];
+        failed: {
+            operationId: string;
+            error: EndpointError;
+        }[];
+        waiting: boolean;
+    }>;
     /** A room this device holds caught up is read as it holds it: what fetches the room's new entries says so
      * (bridge.historyChanged). Otherwise a read fetches the feed first, which the polling fallback and the connected
      * stream's minute-long safety poll rely on. */

package/dist/internal/endpoint/mls-dev-text.d.ts

@@ -23,6 +23,35 @@ export declare const mlsDevOwnAnswerKey: (conversationId: string, agentId: strin
 /** Whether this device's answer to a card is committed and still on its way: queued, or its outcome uncertain, and not
  * yet applied from the feed (where the reduction takes over) nor refused. The card waits for it rather than answer twice. */
 export declare function isMlsDevOwnAnswerSending(tx: EndpointStoreTransaction, conversationId: string, agentId: string, requestId: string): Promise<boolean>;
+/**
+ * A text its sender sent while the room was held (D2, mls-rooms-by-default.md §2.7): kept here, unencrypted and never in a
+ * request, until the hold lifts. Then it is encrypted and queued as any send, in the order sent, and this record goes.
+ */
+export interface MlsDevHeldText {
+    version: 1;
+    /** The send's body as authored, its message ID fixed: what is encrypted once the room may send. */
+    body: {
+        conversationId: string;
+        messageId: string;
+        text: string;
+        replyTo?: string;
+        mentions?: string[];
+    };
+    operationId: string;
+    senderId: string;
+    senderType: 'human' | 'ai_agent';
+    createdAtMs: number;
+    /** The order sent, within the room's kept texts. */
+    sequence: number;
+    /** Refused for good when its turn came; kept so its sender sees it failed and can send it again. */
+    failed?: string;
+}
+export declare const mlsDevHeldTextPrefix: (conversationId?: string) => string;
+export declare const mlsDevHeldTextKey: (conversationId: string, messageId: string) => string;
+/** A room's held texts, oldest first. */
+export declare function readMlsDevHeldTexts(tx: EndpointStoreTransaction, conversationId: string): Promise<MlsDevHeldText[]>;
+/** Held texts per room. A send past it is refused, as a held send was before rooms kept them. */
+export declare const MLS_DEV_HELD_TEXT_MAX = 100;
 /** A deletion for everyone that reached this device, before or after the message itself (mls-payload-v3.md §4). */
 export declare const mlsDevTextDeletedKey: (conversationId: string, messageId: string) => string;
 /** The reactions Canon holds for a message's public stub, which the history shows beside its decrypted text. */

package/dist/internal/endpoint/transport.d.ts

@@ -58,6 +58,6 @@ export declare function createHttpEndpointTransport(options: {
     /** Names this client on every request and stream (`X-Canon-Client`), so Canon can apply its client floor. */
     client?: CanonClientIdentity;
     /** Canon refused this client as below its floor (`426 CLIENT_UPDATE_REQUIRED`), on any request or stream. Called
-     * before the error is thrown, so a host can stop wherever the refusal surfaces. */
+     * once before the error is thrown; further operations, queries, publishes and streams are blocked, not capabilities. */
     onClientUpdateRequired?(error: EndpointError): void;
 }): EndpointTransport;

package/dist/media.js

@@ -18,10 +18,10 @@ import {
   toAnthropicImageBlock,
   toAnthropicImageBlocksWithinBudget,
   uploadMediaFile
-} from "./chunks/chunk-5J4YPLNW.js";
-import "./chunks/chunk-FVYKLH6I.js";
-import "./chunks/chunk-QK37HAHC.js";
-import "./chunks/chunk-S7BV74DN.js";
+} from "./chunks/chunk-TYZT346O.js";
+import "./chunks/chunk-YJUPKU47.js";
+import "./chunks/chunk-YHDDOADK.js";
+import "./chunks/chunk-5WPAB5MB.js";
 export {
   DEFAULT_ANTHROPIC_REQUEST_HEADROOM_BYTES,
   DEFAULT_MEDIA_CACHE_DIR,

package/dist/mls-wasm-host.js

@@ -2,20 +2,20 @@ import {
   WASM_HOST_CONFIGURE,
   WASM_HOST_PROVISION,
   keyFile
-} from "./chunks/chunk-HH7KR22P.js";
+} from "./chunks/chunk-DTAWEQCM.js";
 import {
   MAX_INPUT,
   NodeMlsDevCustodyError,
   parseFrame,
   rejected,
   requireValue
-} from "./chunks/chunk-FVYKLH6I.js";
+} from "./chunks/chunk-YJUPKU47.js";
 import {
   __name,
   canonicalEndpointJson,
   isMlsDevReceiptClockSkew,
   parseMlsDevDeviceContext
-} from "./chunks/chunk-S7BV74DN.js";
+} from "./chunks/chunk-5WPAB5MB.js";
 
 // src/mls-wasm-host.ts
 import { createHash } from "node:crypto";