@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/core/egress/device-proxy.js

@@ -0,0 +1,214 @@
+import { createAssistantMessageEventStream, } from "@earendil-works/pi-ai";
+import { followCall } from "./device-proxy-call.js";
+import { lostCallPacer } from "./device-proxy-lost-calls.js";
+import { ABORT_TEXT, admittedRequestJson, failureMessage, parseStoredRequest, planDispatch, } from "./device-proxy-request.js";
+import { createAbortion, nextKeyBackoffMs, stepWaits } from "./device-proxy-waits.js";
+/** The `done` reason of a finished, successful stop; `undefined` (never replayed) for error, aborted or pending. */
+const doneReason = (stopReason) => stopReason === "error" || stopReason === "aborted" || stopReason === "pending" ? undefined : stopReason;
+export function createDeviceProxyEgress(deps) {
+    const { ledger, route, host } = deps;
+    const abortion = createAbortion();
+    const waitsOf = (run) => stepWaits(run.out, host, run.step, run.signal, abortion);
+    const callContext = (run, deviceId) => ({
+        out: run.out,
+        model: run.model,
+        ledger,
+        channel: deps.hands.channel(deviceId),
+        offlineFor: deps.hands.offlineFor,
+        waits: waitsOf(run),
+        conditions: deps.conditions,
+        clock: deps.clock,
+        bounds: deps.bounds,
+        signal: run.signal,
+        abortion,
+        claim: deps.claims.current,
+        live: run.live,
+    });
+    const servedDecision = async (run) => {
+        for (;;) {
+            const decision = route.decide(run.model.provider, await ledger.variants(run.model.provider));
+            const { deviceId } = decision;
+            if (decision.servedNow && decision.route === "device" && deviceId !== undefined)
+                return { ...decision, deviceId };
+            if (decision.servedNow)
+                throw new Error(`the device route cannot serve a ${decision.route} decision`);
+            const waitFor = decision.waitFor ?? [];
+            const wait = { reason: decision.reason, steer: decision.steer ?? "", waitFor };
+            await waitsOf(run).hold(wait, deps.conditions.until(waitFor, run.signal));
+        }
+    };
+    /** 4.6: renew an expired or superseded claim, back off on an unknown registry key, and restart the same call. */
+    const startWithClaim = async (run, dispatched, decision, plan) => {
+        let row = dispatched;
+        const deviceId = row.deviceId ?? "";
+        const expectedSourceDigest = decision.serveOwnDefinition ? undefined : route.headDigest(row.providerId);
+        const maxOutputTokens = run.options?.maxTokens;
+        let backoff;
+        for (;;) {
+            const start = {
+                t: "provider.call.start",
+                callId: row.callId,
+                sessionId: deps.sessionId,
+                call: row.call,
+                claim: await deps.claims.current(),
+                providerId: row.providerId,
+                modelId: row.modelId,
+                ...(expectedSourceDigest === undefined ? {} : { expectedSourceDigest }),
+                hooks: plan.hooks,
+                ...(deps.cwd === undefined ? {} : { cwd: deps.cwd }),
+                request: parseStoredRequest(plan.requestJson),
+                budget: {
+                    deadlineMs: deps.bounds.deadlineMs,
+                    ...(maxOutputTokens === undefined ? {} : { maxOutputTokens }),
+                },
+            };
+            const outcome = await followCall(callContext(run, deviceId), row, { start });
+            if (outcome.kind !== "refused")
+                return outcome;
+            await deps.hands.channel(deviceId).ack({ t: "provider.call.ack", callId: row.callId });
+            const waitFor = [{ kind: "claim-renewed" }];
+            const code = outcome.code;
+            if (code === "registry_key_unknown") {
+                backoff = nextKeyBackoffMs(backoff);
+                const pause = deps.clock.sleep(backoff, run.signal);
+                await waitsOf(run).hold({ reason: "claim-expired", steer: outcome.message, waitFor }, pause);
+            }
+            else {
+                const steer = "renewing this session's placement claim";
+                await waitsOf(run).hold({ reason: "claim-expired", steer, waitFor }, deps.claims.renew(code));
+            }
+            row = await ledger.replaceRefused(outcome.row, crypto.randomUUID());
+        }
+    };
+    /** A lost (`unknown`) or mismatched call is superseded; a mismatch records the device variant in the same write. */
+    const retire = async (run, outcome) => {
+        const { row } = outcome;
+        const deviceId = row.deviceId ?? "";
+        if (outcome.kind === "unknown")
+            await deps.hands
+                .channel(deviceId)
+                .cancel({ t: "provider.call.cancel", callId: row.callId, reason: "superseded" });
+        const headDigest = route.headDigest(row.providerId);
+        const variant = outcome.kind === "mismatch" && headDigest !== undefined
+            ? {
+                providerId: row.providerId,
+                deviceId,
+                stepId: run.step.stepId,
+                headDigest,
+                liveAtMismatch: route.liveDigest(deviceId, row.providerId),
+            }
+            : undefined;
+        const superseded = await ledger.supersede(row, variant);
+        run.live.row = superseded;
+        deps.notify({ t: "step.reset", sessionId: deps.sessionId, stepId: run.step.stepId, cause: "superseded" });
+        return superseded;
+    };
+    const serve = async (run, pacer, firstRequest, firstPrevious) => {
+        let stored = firstRequest;
+        let previous = firstPrevious;
+        let attempt = previous && previous.call.kind === "step" ? previous.call.attempt + 1 : run.step.attempt;
+        const providerId = run.model.provider;
+        for (;;) {
+            if (previous !== undefined && route.capability(providerId) === "callback-stream") {
+                const waitFor = [{ kind: "user-choice", choiceId: `${run.step.stepId}:${attempt}` }];
+                const steer = "re-run this step (tools may run again) or select another device";
+                await waitsOf(run).hold({ reason: "capability:callback-stream", steer, waitFor }, deps.conditions.until(waitFor, run.signal));
+            }
+            const decision = await servedDecision(run);
+            const plan = await planDispatch(decision, stored, deps.requestHooks);
+            const next = {
+                callId: crypto.randomUUID(),
+                sessionId: deps.sessionId,
+                call: { kind: "step", stepId: run.step.stepId, attempt },
+                route: "device",
+                deviceId: decision.deviceId,
+                providerId,
+                modelId: run.model.id,
+                epoch: run.step.fence.epoch,
+                capability: route.capability(providerId),
+                hooksApplied: plan.hooksApplied,
+            };
+            const row = await ledger.dispatch(next, plan.requestJson, previous);
+            const outcome = await startWithClaim(run, row, decision, plan);
+            if (outcome.kind === "ended")
+                return;
+            previous = await retire(run, outcome);
+            stored = { requestJson: await ledger.readRequest(previous), hooksApplied: previous.hooksApplied };
+            attempt += 1;
+            if (outcome.kind === "unknown")
+                await pacer.beforeReissue(decision.deviceId, attempt);
+        }
+    };
+    /** The 4.5 replay rules for a step that already has a row, applied before any route decision or request hook. */
+    const runStep = async (run, context) => {
+        const { stepId } = run.step;
+        if (await host.historyHasStep(stepId))
+            throw new Error(`step ${stepId} is already committed; resume from history`);
+        if (await ledger.isCancelled(stepId)) {
+            run.out.push({ type: "error", reason: "aborted", error: failureMessage(run.model, "aborted", ABORT_TEXT) });
+            return;
+        }
+        const latest = (await ledger.rowsForStep(stepId)).at(-1);
+        const reason = latest?.result?.kind === "message" ? doneReason(latest.result.stopReason) : undefined;
+        if (latest?.state === "ended" && reason !== undefined) {
+            const message = await ledger.readMessage(latest);
+            run.out.push({ type: "start", partial: { ...message } });
+            run.out.push({ type: "done", reason, message });
+            return;
+        }
+        const askUser = route.capability(run.model.provider) !== "callback-stream";
+        const pacer = lostCallPacer({ ...deps, stepId, waits: waitsOf(run), signal: run.signal, askUser });
+        const resumable = latest?.state === "dispatched" || latest?.state === "ended" || latest?.state === "superseded";
+        if (!latest || !resumable) {
+            const admitted = { requestJson: admittedRequestJson(context, run.options), hooksApplied: false };
+            return serve(run, pacer, admitted, undefined);
+        }
+        let previous = latest;
+        // The resumed row is live until the next W4 retires it: an abort in the waits before that must delete its chunks.
+        run.live.row = latest;
+        if (latest.state === "dispatched") {
+            const deviceId = latest.deviceId ?? "";
+            if (deps.hands.offlineFor(deviceId) >= deps.bounds.resumeWindowMs) {
+                const waitFor = [{ kind: "device-online", deviceId }];
+                const pinned = deps.conditions.until(waitFor, run.signal);
+                await waitsOf(run).hold({ reason: "device-offline", steer: `open omo on ${deviceId}`, waitFor }, pinned);
+            }
+            const outcome = await followCall(callContext(run, deviceId), latest, { resume: true });
+            if (outcome.kind === "ended")
+                return;
+            if (outcome.kind === "refused")
+                throw new Error(`device ${deviceId} refused the placement claim: ${outcome.message}`);
+            previous = await retire(run, outcome);
+            if (outcome.kind === "unknown" && latest.call.kind === "step")
+                await pacer.beforeReissue(deviceId, latest.call.attempt + 1);
+        }
+        const stored = { requestJson: await ledger.readRequest(previous), hooksApplied: previous.hooksApplied };
+        return serve(run, pacer, stored, previous);
+    };
+    const abortFailure = async (run) => {
+        const row = run.live.row;
+        let cause;
+        await ledger.cancelStep(run.step.stepId, row).catch((error) => {
+            cause = error;
+        });
+        if (row?.deviceId !== undefined && row.state === "dispatched")
+            await deps.hands
+                .channel(row.deviceId)
+                .cancel({ t: "provider.call.cancel", callId: row.callId, reason: "user" });
+        return new Error(ABORT_TEXT, cause === undefined ? undefined : { cause });
+    };
+    return {
+        stream: (model, context, options) => {
+            const out = createAssistantMessageEventStream();
+            const signal = options?.signal ?? new AbortController().signal;
+            const run = { out, model, options, step: host.currentStep(), signal, live: { row: undefined } };
+            out.trackLocalWork(runStep(run, context)).catch(async (error) => {
+                if (!signal.aborted)
+                    return out.fail(error);
+                out.fail(await abortFailure(run).catch((cause) => new Error(ABORT_TEXT, { cause })));
+            });
+            return out;
+        },
+    };
+}
+//# sourceMappingURL=device-proxy.js.map

package/dist/core/egress/endpoint.js

@@ -36,7 +36,8 @@ function isTemplatedUrlPart(raw) {
     return isCommandConfigValue(raw) || getConfigValueEnvVarNames(raw).length > 0;
 }
 function isKeyishQueryName(name) {
-    return KEYISH_QUERY_NAMES.includes(name.toLowerCase());
+    const lower = name.toLowerCase();
+    return KEYISH_QUERY_NAMES.some((keyish) => keyish === lower);
 }
 export function splitEndpoint(baseUrl, secretUrlParts = []) {
     const match = URL_SHAPE.exec(baseUrl);

package/dist/core/egress/entry-verify.d.ts

@@ -0,0 +1,13 @@
+export declare const ENTRY_SIG_DOMAIN = "omo-custody/provider-entry/v1";
+/** r11.1 C.P5: entrySig signs ASCII(domain) || 0x00 || ASCII(entryDigest), entryDigest in lowercase hex. */
+export declare function entrySigPayload(entryDigest: string): Uint8Array;
+export interface EntrySigInput {
+    readonly entryDigest: string;
+    /** Canonical base64url without padding. */
+    readonly entrySig: string;
+    /** The owner's enrolled Ed25519 public key (32 raw bytes). */
+    readonly ownerPublicKey: Uint8Array;
+}
+/** The brain-side check before dialing (custody design 3.2); a false result is a wait, never a dial. */
+export declare function verifyEntrySig(input: EntrySigInput): Promise<boolean>;
+//# sourceMappingURL=entry-verify.d.ts.map

package/dist/core/egress/entry-verify.js

@@ -0,0 +1,33 @@
+import { strictEd25519Verify } from "../../modes/rpc/ed25519-strict.js";
+export const ENTRY_SIG_DOMAIN = "omo-custody/provider-entry/v1";
+const LOWER_HEX = /^[0-9a-f]+$/u;
+const BASE64URL_NO_PAD = /^[A-Za-z0-9_-]+$/u;
+const ED25519_PUBLIC_KEY_BYTES = 32;
+const ED25519_SIGNATURE_BYTES = 64;
+/** r11.1 C.P5: entrySig signs ASCII(domain) || 0x00 || ASCII(entryDigest), entryDigest in lowercase hex. */
+export function entrySigPayload(entryDigest) {
+    if (!LOWER_HEX.test(entryDigest))
+        throw new TypeError("entryDigest must be lowercase hexadecimal");
+    const domain = Buffer.from(ENTRY_SIG_DOMAIN, "ascii");
+    return new Uint8Array(Buffer.concat([domain, Buffer.from([0]), Buffer.from(entryDigest, "ascii")]));
+}
+function decodeSignature(entrySig) {
+    if (!BASE64URL_NO_PAD.test(entrySig))
+        return undefined;
+    const bytes = Buffer.from(entrySig, "base64url");
+    if (bytes.length !== ED25519_SIGNATURE_BYTES || bytes.toString("base64url") !== entrySig)
+        return undefined;
+    return new Uint8Array(bytes);
+}
+/** The brain-side check before dialing (custody design 3.2); a false result is a wait, never a dial. */
+export async function verifyEntrySig(input) {
+    if (input.ownerPublicKey.length !== ED25519_PUBLIC_KEY_BYTES)
+        return false;
+    if (!LOWER_HEX.test(input.entryDigest))
+        return false;
+    const signature = decodeSignature(input.entrySig);
+    if (signature === undefined)
+        return false;
+    return strictEd25519Verify(input.ownerPublicKey, entrySigPayload(input.entryDigest), signature);
+}
+//# sourceMappingURL=entry-verify.js.map

package/dist/core/egress/hpke.d.ts

@@ -0,0 +1,63 @@
+/**
+ * HPKE base mode (RFC 9180): DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, AES-256-GCM, on Web Crypto only so the same code
+ * runs on Bun, Node, compiled binaries, the desktop renderer and Workers. Every wrap is single-shot (sequence 0).
+ *
+ * The recipient side takes a Diffie-Hellman function instead of a private key, so a recipient whose key never leaves
+ * hardware (a KMS key that only performs ECDH) opens wraps through the same code as a device key.
+ *
+ * Base mode authenticates nothing about the sender: anyone holding a recipient public key can produce a wrap that opens.
+ * A successful open proves only that the wrap was made for this key, so origin is established above this layer
+ * (signed wraps documents, per-dekId owners), never by an open.
+ */
+export type SealedFormatErrorCode = "open_failed" | "unsupported_version" | "invalid_public_key" | "invalid_private_key" | "invalid_key" | "invalid_aad" | "empty_secret";
+/** Errors carry a code only: no key material, ciphertext or plaintext is ever echoed. */
+export declare class SealedFormatError extends Error {
+    readonly code: SealedFormatErrorCode;
+    constructor(code: SealedFormatErrorCode);
+}
+/** A P-256 HPKE recipient. `dh` returns the 32-byte x-coordinate of the ECDH shared point with `peer`. */
+export interface HpkeRecipient {
+    /** Uncompressed SEC1 encoding (65 bytes, leading 0x04). */
+    readonly publicKey: Uint8Array;
+    dh(peer: Uint8Array): Promise<Uint8Array>;
+}
+export interface HpkeSealInput {
+    readonly info: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly pt: Uint8Array;
+}
+export interface HpkeOpenInput {
+    readonly enc: Uint8Array;
+    readonly ct: Uint8Array;
+    readonly info: Uint8Array;
+    readonly aad: Uint8Array;
+}
+export interface HpkeSealed {
+    readonly enc: Uint8Array;
+    readonly ct: Uint8Array;
+}
+type Bytes = Uint8Array<ArrayBuffer>;
+/** A recipient whose private scalar is held in this process (device keys, tests). */
+export declare function p256Recipient(privateKey: Uint8Array, publicKey: Uint8Array): Promise<HpkeRecipient>;
+/** RFC 9180 Decap: the shared secret for `enc` addressed to `recipient`. */
+export declare function hpkeDecap(recipient: HpkeRecipient, enc: Uint8Array): Promise<Bytes>;
+/**
+ * RFC 9180 Encap with a caller-supplied ephemeral key pair. KNOWN-ANSWER TESTS ONLY: reusing an ephemeral key
+ * across wraps breaks HPKE's guarantees. Production sealing goes through {@link hpkeSealBase}, which mints one.
+ * @internal
+ */
+export declare function hpkeEncapDeterministic(recipientPublicKey: Uint8Array, ephemeralPrivateKey: Uint8Array, ephemeralPublicKey: Uint8Array): Promise<{
+    readonly enc: Uint8Array;
+    readonly sharedSecret: Uint8Array;
+}>;
+/** RFC 9180 KeySchedule for mode_base (no PSK). The exporter secret is not derived: the format never exports. */
+export declare function hpkeKeySchedule(sharedSecret: Uint8Array, info: Uint8Array): Promise<{
+    readonly key: Bytes;
+    readonly baseNonce: Bytes;
+}>;
+/** Single-shot HPKE seal (sequence 0) to `recipientPublicKey` under a freshly generated ephemeral key. */
+export declare function hpkeSealBase(recipientPublicKey: Uint8Array, input: HpkeSealInput): Promise<HpkeSealed>;
+/** Single-shot HPKE open (sequence 0). Any failure is the one code `open_failed`. */
+export declare function hpkeOpenBase(recipient: HpkeRecipient, input: HpkeOpenInput): Promise<Bytes>;
+export {};
+//# sourceMappingURL=hpke.d.ts.map

package/dist/core/egress/hpke.js

@@ -0,0 +1,192 @@
+/**
+ * HPKE base mode (RFC 9180): DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, AES-256-GCM, on Web Crypto only so the same code
+ * runs on Bun, Node, compiled binaries, the desktop renderer and Workers. Every wrap is single-shot (sequence 0).
+ *
+ * The recipient side takes a Diffie-Hellman function instead of a private key, so a recipient whose key never leaves
+ * hardware (a KMS key that only performs ECDH) opens wraps through the same code as a device key.
+ *
+ * Base mode authenticates nothing about the sender: anyone holding a recipient public key can produce a wrap that opens.
+ * A successful open proves only that the wrap was made for this key, so origin is established above this layer
+ * (signed wraps documents, per-dekId owners), never by an open.
+ */
+const HPKE_V1 = "HPKE-v1";
+const KEM_ID = 0x0010; // DHKEM(P-256, HKDF-SHA256)
+const KDF_ID = 0x0001; // HKDF-SHA256
+const AEAD_ID = 0x0002; // AES-256-GCM
+const MODE_BASE = 0x00;
+const N_SECRET = 32;
+const N_DH = 32;
+const N_K = 32;
+const N_N = 12;
+const N_T = 16;
+const N_PK = 65;
+const HASH_LEN = 32;
+/** Errors carry a code only: no key material, ciphertext or plaintext is ever echoed. */
+export class SealedFormatError extends Error {
+    constructor(code) {
+        super(`sealed format: ${code}`);
+        this.name = "SealedFormatError";
+        this.code = code;
+    }
+}
+const encoder = new TextEncoder();
+const own = (view) => Uint8Array.from(view);
+function i2osp(value, length) {
+    const out = new Uint8Array(length);
+    for (let index = length - 1, rest = value; index >= 0; index--, rest = Math.floor(rest / 256))
+        out[index] = rest & 0xff;
+    return out;
+}
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+function kemSuiteId() {
+    return concat(encoder.encode("KEM"), i2osp(KEM_ID, 2));
+}
+function hpkeSuiteId() {
+    return concat(encoder.encode("HPKE"), i2osp(KEM_ID, 2), i2osp(KDF_ID, 2), i2osp(AEAD_ID, 2));
+}
+async function hmacSha256(key, data) {
+    const hmacKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return new Uint8Array(await crypto.subtle.sign("HMAC", hmacKey, data));
+}
+// RFC 5869: an absent salt is HashLen zero bytes.
+async function hkdfExtract(salt, ikm) {
+    return hmacSha256(salt.length === 0 ? new Uint8Array(HASH_LEN) : own(salt), ikm);
+}
+async function hkdfExpand(prk, info, length) {
+    const out = new Uint8Array(length);
+    let previous = new Uint8Array();
+    for (let block = 1, offset = 0; offset < length; block++) {
+        previous = await hmacSha256(prk, concat(previous, info, Uint8Array.of(block)));
+        out.set(previous.subarray(0, Math.min(previous.length, length - offset)), offset);
+        offset += previous.length;
+    }
+    return out;
+}
+function labeledExtract(suiteId, salt, label, ikm) {
+    return hkdfExtract(salt, concat(encoder.encode(HPKE_V1), suiteId, encoder.encode(label), ikm));
+}
+function labeledExpand(suiteId, prk, label, info, length) {
+    return hkdfExpand(prk, concat(i2osp(length, 2), encoder.encode(HPKE_V1), suiteId, encoder.encode(label), info), length);
+}
+async function extractAndExpand(dh, kemContext) {
+    const eaePrk = await labeledExtract(kemSuiteId(), new Uint8Array(), "eae_prk", dh);
+    return labeledExpand(kemSuiteId(), eaePrk, "shared_secret", kemContext, N_SECRET);
+}
+async function importPublicKey(raw) {
+    if (raw.length !== N_PK || raw[0] !== 0x04)
+        throw new SealedFormatError("invalid_public_key");
+    try {
+        return await crypto.subtle.importKey("raw", own(raw), { name: "ECDH", namedCurve: "P-256" }, true, []);
+    }
+    catch {
+        throw new SealedFormatError("invalid_public_key");
+    }
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+async function importPrivateKey(privateKey, publicKey) {
+    if (privateKey.length !== 32 || publicKey.length !== N_PK || publicKey[0] !== 0x04) {
+        throw new SealedFormatError("invalid_private_key");
+    }
+    try {
+        return await crypto.subtle.importKey("jwk", {
+            kty: "EC",
+            crv: "P-256",
+            d: base64Url(privateKey),
+            x: base64Url(publicKey.subarray(1, 33)),
+            y: base64Url(publicKey.subarray(33, 65)),
+        }, { name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
+    }
+    catch {
+        throw new SealedFormatError("invalid_private_key");
+    }
+}
+async function ecdh(privateKey, peer) {
+    const peerKey = await importPublicKey(peer);
+    return new Uint8Array(await crypto.subtle.deriveBits({ name: "ECDH", public: peerKey }, privateKey, N_DH * 8));
+}
+/** A recipient whose private scalar is held in this process (device keys, tests). */
+export async function p256Recipient(privateKey, publicKey) {
+    const key = await importPrivateKey(privateKey, publicKey);
+    return { publicKey: Uint8Array.from(publicKey), dh: (peer) => ecdh(key, peer) };
+}
+/** RFC 9180 Decap: the shared secret for `enc` addressed to `recipient`. */
+export async function hpkeDecap(recipient, enc) {
+    await importPublicKey(enc);
+    const dh = await recipient.dh(enc);
+    return extractAndExpand(dh, concat(enc, recipient.publicKey));
+}
+/**
+ * RFC 9180 Encap with a caller-supplied ephemeral key pair. KNOWN-ANSWER TESTS ONLY: reusing an ephemeral key
+ * across wraps breaks HPKE's guarantees. Production sealing goes through {@link hpkeSealBase}, which mints one.
+ * @internal
+ */
+export async function hpkeEncapDeterministic(recipientPublicKey, ephemeralPrivateKey, ephemeralPublicKey) {
+    const ephemeral = await importPrivateKey(ephemeralPrivateKey, ephemeralPublicKey);
+    return encapWith(recipientPublicKey, ephemeral, Uint8Array.from(ephemeralPublicKey));
+}
+async function encapWith(recipientPublicKey, ephemeral, enc) {
+    const dh = await ecdh(ephemeral, recipientPublicKey);
+    return { enc, sharedSecret: await extractAndExpand(dh, concat(enc, recipientPublicKey)) };
+}
+/** RFC 9180 KeySchedule for mode_base (no PSK). The exporter secret is not derived: the format never exports. */
+export async function hpkeKeySchedule(sharedSecret, info) {
+    const empty = new Uint8Array();
+    const pskIdHash = await labeledExtract(hpkeSuiteId(), empty, "psk_id_hash", empty);
+    const infoHash = await labeledExtract(hpkeSuiteId(), empty, "info_hash", info);
+    const context = concat(Uint8Array.of(MODE_BASE), pskIdHash, infoHash);
+    const secret = await labeledExtract(hpkeSuiteId(), sharedSecret, "secret", empty);
+    return {
+        key: await labeledExpand(hpkeSuiteId(), secret, "key", context, N_K),
+        baseNonce: await labeledExpand(hpkeSuiteId(), secret, "base_nonce", context, N_N),
+    };
+}
+async function aesGcmKey(key, usage) {
+    return crypto.subtle.importKey("raw", key, { name: "AES-GCM", length: N_K * 8 }, false, [usage]);
+}
+/** Single-shot HPKE seal (sequence 0) to `recipientPublicKey` under a freshly generated ephemeral key. */
+export async function hpkeSealBase(recipientPublicKey, input) {
+    await importPublicKey(recipientPublicKey);
+    const ephemeral = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
+    const enc = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+    const { sharedSecret } = await encapWith(recipientPublicKey, ephemeral.privateKey, enc);
+    const { key, baseNonce } = await hpkeKeySchedule(sharedSecret, input.info);
+    const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv: baseNonce, additionalData: own(input.aad), tagLength: N_T * 8 }, await aesGcmKey(key, "encrypt"), own(input.pt));
+    sharedSecret.fill(0);
+    key.fill(0);
+    return { enc, ct: new Uint8Array(ct) };
+}
+/** Single-shot HPKE open (sequence 0). Any failure is the one code `open_failed`. */
+export async function hpkeOpenBase(recipient, input) {
+    if (input.ct.length < N_T)
+        throw new SealedFormatError("open_failed");
+    let sharedSecret;
+    let key;
+    try {
+        sharedSecret = await hpkeDecap(recipient, input.enc);
+        const schedule = await hpkeKeySchedule(sharedSecret, input.info);
+        key = schedule.key;
+        const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: schedule.baseNonce, additionalData: own(input.aad), tagLength: N_T * 8 }, await aesGcmKey(key, "decrypt"), own(input.ct));
+        return new Uint8Array(pt);
+    }
+    catch {
+        throw new SealedFormatError("open_failed");
+    }
+    finally {
+        sharedSecret?.fill(0);
+        key?.fill(0);
+    }
+}
+//# sourceMappingURL=hpke.js.map

package/dist/core/egress/key-policy-template.d.ts

@@ -13,5 +13,11 @@ export interface KeyPolicyTemplate {
         readonly roles: CustodyRoleArns;
     }): string;
 }
-export declare const KEY_POLICY_TEMPLATE_V1: KeyPolicyTemplate;
+export declare const KEY_POLICY_TEMPLATE_V1: {
+    readonly render: ({ keyKind, roles }: {
+        readonly accountId: string;
+        readonly keyKind: KeyPolicyKind;
+        readonly roles: CustodyRoleArns;
+    }) => string;
+};
 //# sourceMappingURL=key-policy-template.d.ts.map

package/dist/core/egress/ledger-schema.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Schema of the brain's `egress_call` ledger (row CK9; custody design 4.5, 2.3, 4.2, 15.7). One row per dialed model
+ * call with its admitted request and, once `ended`, its assembled message stored beside it in 96 KiB chunks (never the
+ * event log: every streamed event carries the whole message so far), the step-cancelled marker (W14), and the
+ * per-session device variants (`session/variants`, read by the route). Every value here is written by `ledger.ts`
+ * through the host's admitted mutations; this module only names keys and converts rows to and from store values.
+ */
+import type { DeviceId, ProviderId } from "@earendil-works/pi-agent-core";
+import type { StoreValue } from "@earendil-works/pi-agent-core/conformance";
+import type { AssistantMessage, StopReason, Usage } from "@earendil-works/pi-ai";
+import { type ProviderCallErrorCode, type ProviderCallKind } from "./wire.ts";
+/** `dispatched` -> `ended` -> `closed` (by the step commit, W9); `superseded` and `cancelled` are final. */
+export type EgressCallState = "dispatched" | "ended" | "superseded" | "cancelled" | "closed";
+/** `callback-stream` providers run tools inside the stream, so every reissue of their step needs a user choice. */
+export type EgressCallCapability = "callback-stream" | "stream";
+/** `message`: the assembled message lives in `chunks` result chunks; the row keeps only its stop reason and usage. */
+export type EgressCallResult = {
+    readonly kind: "message";
+    readonly stopReason: StopReason;
+    readonly usage: Usage;
+    readonly chunks: number;
+} | {
+    readonly kind: "error";
+    readonly code: ProviderCallErrorCode;
+    readonly message: string;
+    readonly retryable: boolean;
+    readonly usage?: Usage;
+};
+/** What `ended` records: the assembled message of a finished call, or the hand's refusal or failure. */
+export type EgressCallEnd = {
+    readonly kind: "message";
+    readonly message: AssistantMessage;
+} | Extract<EgressCallResult, {
+    readonly kind: "error";
+}>;
+export interface EgressCallRow {
+    readonly callId: string;
+    readonly sessionId: string;
+    readonly call: ProviderCallKind;
+    readonly route: "sealed" | "device";
+    readonly deviceId?: DeviceId;
+    readonly providerId: ProviderId;
+    readonly modelId: string;
+    readonly epoch: number;
+    readonly capability: EgressCallCapability;
+    /** The stored request already carries this session's request hooks (4.5). */
+    readonly hooksApplied: boolean;
+    readonly state: EgressCallState;
+    readonly requestChunks: number;
+    readonly result?: EgressCallResult;
+}
+/** Durable `session/variants[P][deviceId]` (4.2); `mismatches` counts per (device, step) and restarts on a new head. */
+export interface VariantRecord {
+    readonly headDigest: string;
+    readonly liveAtMismatch: string | undefined;
+    readonly mismatches: number;
+}
+export declare const REQUEST_CHUNK_BYTES: number;
+export declare const callKey: (callId: string) => string;
+export declare const requestPrefix: (callId: string) => string;
+export declare const requestChunkKey: (callId: string, index: number) => string;
+export declare const resultPrefix: (callId: string) => string;
+export declare const resultChunkKey: (callId: string, index: number) => string;
+export declare const stepIndexPrefix: (stepId: string) => string;
+export declare const stepIndexKey: (stepId: string, attempt: number) => string;
+export declare const cancelledKey: (stepId: string) => string;
+export declare const variantPrefix: (providerId: ProviderId) => string;
+export declare const variantKey: (providerId: ProviderId, deviceId: DeviceId) => string;
+/** Splits UTF-8 text into chunks of at most `REQUEST_CHUNK_BYTES` bytes, never inside a code point. */
+export declare function splitUtf8(text: string): string[];
+/** The stored message text is the ledger's own JSON; the shape check guards against a truncated or foreign chunk set. */
+export declare function isStoredMessage(value: unknown): value is AssistantMessage;
+export declare function encodeCallRow(row: EgressCallRow): StoreValue;
+export declare function decodeCallRow(value: StoreValue | undefined): EgressCallRow | undefined;
+export interface StoredVariant extends VariantRecord {
+    readonly stepId: string;
+}
+export declare function decodeVariant(value: StoreValue | undefined): StoredVariant | undefined;
+export declare const encodeVariant: (variant: StoredVariant) => StoreValue;
+//# sourceMappingURL=ledger-schema.d.ts.map