@corca-org/ceal-host-win32-x64 1.0.10 → 1.0.11

package/libexec/ceal-host/claude-hook.mjs

@@ -2,18 +2,6 @@
 import { createRequire as __cealCreateRequire } from "node:module";
 const require = __cealCreateRequire(import.meta.url);
 
-// host/direct-invocation.ts
-import { realpathSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-function isDirectInvocation(importMetaUrl, argv1 = process.argv[1]) {
-  if (!argv1) return false;
-  try {
-    return realpathSync(fileURLToPath(importMetaUrl)) === realpathSync(argv1);
-  } catch {
-    return false;
-  }
-}
-
 // host/claude/src/claude-types.ts
 var CLAUDE_HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "Stop", "StopFailure"];
 var CLAUDE_HOST_ERROR_CODES = ["invalid_input", "storage", "configuration"];
@@ -97,6 +85,46 @@ var client_wire_contract_default = {
     schema_version: "ceal.command_request.v1",
     absolute_transport_max_bytes: 65536
   },
+  command_resolution: {
+    schema_version: "ceal.gateway_command_resolution.v1",
+    authority: {
+      anonymous: {
+        state: "anonymous",
+        fields: [
+          "state"
+        ]
+      },
+      authenticated: {
+        state: "authenticated",
+        fields: [
+          "state",
+          "principal_kind",
+          "organization_ref",
+          "instance_ref",
+          "access_group_ref",
+          "principal_ref",
+          "authority_revision_ref"
+        ]
+      }
+    },
+    semantic_options: {
+      inspection: {
+        values: [
+          "default",
+          "full"
+        ]
+      },
+      cache_mode: {
+        values: [
+          "default",
+          "bypass"
+        ]
+      },
+      compact: {
+        type: "boolean"
+      }
+    }
+  },
   command_response: {
     schema_version: "ceal.command_response.v1",
     descriptor_field: "verified_artifact",
@@ -110,12 +138,15 @@ var client_wire_contract_default = {
     ],
     bare_document_fields: [
       "invocation",
-      "required_action_sequence",
       "entrypoints",
       "common_concepts",
       "operations",
       "catalog_revision"
     ],
+    bare_document_optional_fields: [
+      "required_action_sequence",
+      "withheld"
+    ],
     prompt_field: "prompt",
     prompt_schema_version: "ceal.prompt.v1",
     focused_prompt_document_fields: [
@@ -128,7 +159,7 @@ var client_wire_contract_default = {
       "prompt"
     ],
     discovery_command: "discovery",
-    discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
+    discovery_manifest_schema_version: "ceal.discovery_manifest.v2",
     discovery_manifest_document_fields: [
       "discovery_manifest"
     ],
@@ -136,11 +167,29 @@ var client_wire_contract_default = {
     bare_document_max_bytes: 65536,
     complete_max_bytes: 66019,
     absolute_transport_max_bytes: 4194304
+  },
+  resource_stream: {
+    path: "/api/ceal/v2/resources",
+    request_schema_version: "ceal.resource_stream_request.v1",
+    ref_pattern: "^resource:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+    media_type_pattern: "^[a-z0-9][a-z0-9!#$&^_.+-]{0,63}/[a-z0-9][a-z0-9!#$&^_.+-]{0,63}$",
+    filename_max_bytes: 512,
+    max_bytes: 9007199254740991,
+    deadline_ms: 6e5,
+    fetch_argv: [
+      "resource",
+      "fetch"
+    ],
+    ref_flag: "--ref"
   }
 };
 
 // packages/ceal-client-protocol/src/client-wire-contract.ts
 var CEAL_CLIENT_WIRE_CONTRACT = Object.freeze(client_wire_contract_default);
+var commandResolution = CEAL_CLIENT_WIRE_CONTRACT.command_resolution;
+var commandResolutionAuthority = commandResolution.authority;
+var commandResolutionSemanticOptions = commandResolution.semantic_options;
+var CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION = commandResolution.schema_version;
 var artifact = CEAL_CLIENT_WIRE_CONTRACT.artifact_descriptor;
 var request = CEAL_CLIENT_WIRE_CONTRACT.command_request;
 var response = CEAL_CLIENT_WIRE_CONTRACT.command_response;
@@ -161,6 +210,7 @@ var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
 var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
 var CEAL_COMMAND_RESPONSE_PROMPT_FIELD = response.prompt_field;
 var CEAL_COMMAND_RESPONSE_PROMPT_SCHEMA_VERSION = response.prompt_schema_version;
+var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_OPTIONAL_FIELDS = Object.freeze([...response.bare_document_optional_fields]);
 var CEAL_COMMAND_RESPONSE_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.bare_document_fields, response.prompt_field]);
 var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_document_fields]);
 var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_continuation_document_fields]);
@@ -174,9 +224,50 @@ function vocabulary(words) {
   return Object.freeze(words);
 }
 
+// packages/ceal-client-protocol/src/gateway-response-types.ts
+var CEAL_OPERATION_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
+var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
+var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
+var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
+var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
+var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
+var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
+var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
+var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
+var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "agent_lease_admission", "provider_authenticated_event"]);
+var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
+var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
+var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
+var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
+var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_STATES = vocabulary(["outcome_unknown", "verified", "not_dispatched"]);
+var CEAL_WRITE_RECEIPT_PROVIDER_READBACKS = vocabulary(["outcome_unknown", "verified", "not_applied"]);
+var CEAL_PROTOCOL_VERSION = "1.4.0";
+var CEAL_GATEWAY_ANNOUNCEMENT_SCOPE_STATEMENTS = Object.freeze({
+  github_app_installation_repositories: "Repositories in the installed GitHub App installation.",
+  slack_public_app_member_channels_only: "Public channels where the installed Slack app is a member, plus direct and multi-person direct messages the requester is a member of, as Slack reports that membership; private channels the administrator has not approved are not declared by this connector.",
+  notion_connected_logical_area: "Connected Notion logical area under provider-enforced sharing; descendant inventory is not declared.",
+  google_workspace_calendar_read_only: "Approved Calendar availability and event reads only; Calendar mutation is not declared.",
+  google_workspace_admitted_drive_target_metadata: "Metadata search for files in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; file-content read and mutation are not declared.",
+  google_workspace_admitted_drive_target_sheet_ranges: "Bounded values reads from Google Sheets in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; file mutation is not declared.",
+  google_workspace_admitted_drive_target_sheet_tabs: "Bounded tab metadata and grid extents from Google Sheets in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; cell contents and file mutation are not declared.",
+  google_workspace_admitted_drive_target_editable_sheet_ranges: "Bounded values updates and clears in editable Google Sheets in the shared drives and directly shared files the Connector reaches and the Organization admits as Targets; Docs, Slides, and other Drive file mutation are not declared."
+});
+var CEAL_OPERATION_ACCESS_SCHEMA_VERSION = "ceal.operation_access.v1";
+var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
+var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
+var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
+var CEAL_GATEWAY_ORGANIZATION_ROUTE_FACT_CALL_KEYS = Object.freeze([
+  "connector_ref",
+  "connector_revision",
+  "policy_decision_revision"
+]);
+
 // packages/ceal-client-protocol/src/operation-contract-types.ts
 var CEAL_JSON_SCHEMA_2020_12 = "https://json-schema.org/draft/2020-12/schema";
 var CEAL_OPERATION_ERROR_SCHEMA_VERSION = "ceal.operation_error.v1";
+var CEAL_OPERATION_WITHHELD_CAUSES = vocabulary(["provider_permission", "access_level", "personal_authorization_required"]);
+var CEAL_RETRY_AFTER_MAX_MS = 60 * 60 * 1e3;
 var CEAL_JSON_SCHEMA_TYPES = vocabulary(["object", "array", "string", "integer", "number", "boolean", "null"]);
 var OBSERVATION_POSTURES = vocabulary(["direct_readback", "approved_no_readback", "operator_mediated", "excluded"]);
 var EFFECT_DOMAINS = vocabulary(["none", "gateway_state", "provider", "external_world"]);
@@ -212,27 +303,6 @@ var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
   "interactive_unavailable"
 ]);
 
-// packages/ceal-client-protocol/src/gateway-response-types.ts
-var CEAL_CAPABILITY_READINESS_VALUES = vocabulary(["ready", "degraded", "unavailable", "unknown"]);
-var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
-var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
-var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
-var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
-var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
-var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
-var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
-var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
-var CEAL_WRITE_SOURCE_KINDS = vocabulary(["authenticated_registered_client", "agent_lease_admission", "provider_authenticated_event"]);
-var CEAL_REFRESH_DELIVERIES = vocabulary(["initial", "recovery", "replay", "terminal_failure", "recovery_unavailable"]);
-var CEAL_CLIENT_OPERATIONS = vocabulary(["handshake", "discover", "call", "readback"]);
-var CEAL_WRITE_IDEMPOTENCY_POSTURES = vocabulary(["required", "optional", "not_required"]);
-var CEAL_WRITE_PROVIDER_READBACK_POSTURES = vocabulary(["required", "best_effort", "not_available"]);
-var CEAL_WRITE_ATTRIBUTIONS = vocabulary(["subject", "requester_event", "connector_integration"]);
-var CEAL_PROTOCOL_VERSION = "1.4.0";
-var CEAL_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "phase", "schema_version"]);
-var CEAL_CLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["cause", ...CEAL_CONNECTOR_ROUTE_FAILURE_KEYS]);
-var CEAL_UNCLASSIFIED_CONNECTOR_ROUTE_FAILURE_KEYS = vocabulary(["connector_kind", "error_class", "phase", "schema_version"]);
-
 // packages/ceal-client-protocol/src/gateway-validation-primitives.ts
 var CealProtocolValidationError = class extends Error {
   name = "CealProtocolValidationError";
@@ -249,6 +319,7 @@ var SAFE_CONNECTOR_KIND = new RegExp(`^[a-z][a-z0-9-]{0,${MAX_SAFE_TOKEN_LENGTH
 var FORBIDDEN_SECRET_KEY = /^(?:[a-z0-9_]*(?:token|secret|password|credential(?:s)?|private_?key)|api_?key|authorization|bearer|raw_?provider_?payload|provider_?payload)$/iu;
 var FORBIDDEN_AUTHORITY_KEY = /^(?:actor_?ref|owner_?ref|registration_?ref|runner_?ref|auth_?decision|policy_?decision|host_?decision)$/iu;
 var TEXT_ENCODER = new TextEncoder();
+var CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS = 128;
 var CEAL_WIRE_SAFE_TEXT_MAX_BYTES = 8 * 1024;
 function assertSafeJsonValue(value, options, depth = 0, count = { value: 0 }) {
   count.value += 1;
@@ -268,12 +339,12 @@ function assertSafeJsonString(value, options) {
   if (byteLength(value) > CEAL_WIRE_SAFE_TEXT_MAX_BYTES || firstDisallowedControl(value, "multi_line") !== null) invalidByContext(options);
 }
 function assertSafeJsonArray(value, options, depth, count) {
-  if (value.length > 128) invalidByContext(options);
+  if (value.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
   for (const item of value) assertSafeJsonValue(item, options, depth + 1, count);
 }
 function assertSafeJsonRecord(record7, options, depth, count) {
   const entries = Object.entries(record7);
-  if (entries.length > 128) invalidByContext(options);
+  if (entries.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
   const sourceUrlColumn = options.allowHttpsUrl ? compactSourceUrlColumn(record7.fields) : null;
   for (const [key, child] of entries) {
     if (key === "credential_material_included" && child !== false) invalidByContext(options);
@@ -299,9 +370,9 @@ function compactSourceUrlColumn(fields) {
   return index < 0 ? null : index;
 }
 function assertSafeJsonCompactRows(value, sourceUrlColumn, options, depth, count) {
-  if (!Array.isArray(value) || value.length > 128) invalidByContext(options);
+  if (!Array.isArray(value) || value.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
   for (const row of value) {
-    if (!Array.isArray(row) || row.length > 128) invalidByContext(options);
+    if (!Array.isArray(row) || row.length > CEAL_WIRE_SAFE_ARRAY_MAX_ITEMS) invalidByContext(options);
     for (const [index, cell] of row.entries()) {
       if (index === sourceUrlColumn && (cell === null || isSafeExternalHttpsUrl(cell))) continue;
       assertSafeJsonValue(cell, options, depth + 2, count);
@@ -334,6 +405,7 @@ function isSafeResultContent(value, key) {
   const maximum = key === "text" ? 8192 : 1024;
   return typeof value === "string" && byteLength(value) <= maximum && firstDisallowedControl(value, "multi_line") === null;
 }
+var CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES = 512;
 function normalizeCealSingleLineText(value) {
   return value.split("").map((character) => hasControlCharacter(character) ? " " : character).join("").trim();
 }
@@ -442,6 +514,28 @@ function cut(text) {
   return text.length <= REFUSAL_VALUE_MAX_CHARS ? text : `${text.slice(0, REFUSAL_VALUE_MAX_CHARS)}...(+${text.length - REFUSAL_VALUE_MAX_CHARS} chars)`;
 }
 
+// packages/ceal-client-protocol/src/operation-access-class.ts
+var CEAL_OPERATION_ACCESS_CLASSES = vocabulary(["read", "write"]);
+
+// packages/ceal-client-protocol/src/domain-vocabulary.ts
+var CEAL_INTEGRATION_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
+var CEAL_CONNECTOR_STATUSES = vocabulary(["active", "disabled", "disconnected"]);
+var CEAL_CONNECTOR_CUSTODIES = vocabulary(["organization", "personal"]);
+var CEAL_PROVIDER_BOUNDARY_KINDS = vocabulary([
+  "github_account",
+  "github_organization",
+  "google_workspace_domain",
+  "notion_workspace",
+  "slack_workspace"
+]);
+var CEAL_PROVIDER_BOUNDARY_EVIDENCE = vocabulary(["provider_readback", "operator_stated"]);
+var CEAL_ACCESS_LEVELS = vocabulary(["none", "read", "read_write"]);
+var CEAL_PERSONAL_ACCESS_CEILINGS = vocabulary(["disabled", "read", "read_write"]);
+var CEAL_TARGET_VISIBILITIES = vocabulary(["public", "private"]);
+var CEAL_PRINCIPAL_KINDS = vocabulary(["human", "service", "runtime"]);
+var CEAL_ORGANIZATION_ROLES = vocabulary(["member", "admin"]);
+var LABEL_EXPECTATION = `public-safe display text of at most ${CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES} bytes`;
+
 // packages/ceal-client-protocol/src/safe-json-budget.ts
 var SAFE_JSON_MIN_BYTES_PER_NODE = 4;
 function safeJsonNodeBudgetForBytes(maxBytes) {
@@ -471,7 +565,9 @@ var CEAL_OPERATION_JSON_SCHEMA_BUDGET = Object.freeze({
 });
 
 // packages/ceal-client-protocol/src/operation-validation-primitives.ts
-var ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/u;
+var ISO_TIMESTAMP = /^(\d{4})-(\d{2})-(\d{2})[Tt](\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?([Zz]|([+-])(\d{2}):(\d{2}))$/u;
+var CEAL_CALENDAR_DATE_PATTERN_SOURCE = "^\\d{4}-\\d{2}-\\d{2}$";
+var CEAL_CALENDAR_DATE = new RegExp(CEAL_CALENDAR_DATE_PATTERN_SOURCE, "u");
 function isOperationRecord(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
   const prototype = Object.getPrototypeOf(value);
@@ -483,8 +579,56 @@ function requireOperationRecord(value, message) {
 function requireClosedValue(value, members, message) {
   if (typeof value !== "string" || !members.includes(value)) throw new TypeError(message);
 }
+function isCealIsoTimestamp(value) {
+  return typeof value === "string" && parseCealIsoTimestamp(value) !== null;
+}
+function parseCealIsoTimestamp(value) {
+  const fields = parseCealIsoTimestampFields(value);
+  if (fields === null || !validCalendarDate(fields) || !validClockTime(fields) || !validUtcOffset(fields)) return null;
+  const epochMilliseconds = cealFieldsEpochMilliseconds(fields);
+  if (!Number.isFinite(epochMilliseconds)) return null;
+  return {
+    epochNanoseconds: BigInt(epochMilliseconds) * 1000000n + BigInt(fields.fraction.padEnd(9, "0") || "0")
+  };
+}
+function parseCealIsoTimestampFields(value) {
+  const match = ISO_TIMESTAMP.exec(value);
+  if (match === null) return null;
+  return {
+    year: Number(match[1]),
+    month: Number(match[2]),
+    day: Number(match[3]),
+    hour: Number(match[4]),
+    minute: Number(match[5]),
+    second: Number(match[6]),
+    fraction: match[7] ?? "",
+    offsetSign: match[9] === void 0 ? 0 : match[9] === "+" ? 1 : -1,
+    offsetHour: Number(match[10] ?? 0),
+    offsetMinute: Number(match[11] ?? 0)
+  };
+}
+function validCalendarDate({ year, month, day }) {
+  return month >= 1 && month <= 12 && day >= 1 && day <= daysInMonth(year, month);
+}
+function validClockTime({ hour, minute, second }) {
+  return hour <= 23 && minute <= 59 && second <= 59;
+}
+function validUtcOffset({ offsetHour, offsetMinute }) {
+  return offsetHour <= 23 && offsetMinute <= 59;
+}
+function cealFieldsEpochMilliseconds(fields) {
+  const shiftedYear = fields.year < 100 ? fields.year + 400 : fields.year;
+  const cycleMilliseconds = fields.year < 100 ? (400 * 365 + 97) * 24 * 60 * 60 * 1e3 : 0;
+  const localMilliseconds = Date.UTC(shiftedYear, fields.month - 1, fields.day, fields.hour, fields.minute, fields.second, 0) - cycleMilliseconds;
+  const offsetMilliseconds = fields.offsetSign * (fields.offsetHour * 60 + fields.offsetMinute) * 6e4;
+  return localMilliseconds - offsetMilliseconds;
+}
+function daysInMonth(year, month) {
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  return [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1] ?? 0;
+}
 function requireIsoTimestamp(value, message) {
-  if (typeof value !== "string" || !ISO_TIMESTAMP.test(value) || !Number.isFinite(Date.parse(value))) throw new TypeError(message);
+  if (!isCealIsoTimestamp(value)) throw new TypeError(message);
 }
 
 // packages/ceal-client-protocol/src/operation-json-schema.ts
@@ -506,7 +650,7 @@ var CLIENT_AUDIENCE_SET = new Set(CLIENT_AUDIENCES);
 // packages/ceal-client-protocol/src/schema-literals.ts
 var CEAL_SCHEMA_LITERALS = [
   "ceal.activation_transport.v1",
-  "ceal.capability_access.v1",
+  CEAL_OPERATION_ACCESS_SCHEMA_VERSION,
   CEAL_OPERATION_CATALOG_SCHEMA_VERSION,
   "ceal.client_refresh_request.v2",
   "ceal.client_refresh_result.v2",
@@ -529,7 +673,6 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.enrollment_exchange.v1",
   "ceal.enrollment_result.v1",
   "ceal.first_activation_causal_join.v1",
-  "ceal.gateway_aggregate_authorization_snapshot.v2",
   "ceal.gateway_announcement_policy.v1",
   "ceal.gateway_audit_call_detail.v1",
   "ceal.gateway_audit_event.v1",
@@ -537,7 +680,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.gateway_authorization_snapshot.v1",
   "ceal.gateway_cache_origin.v1",
   "ceal.gateway_call_result.v1",
-  "ceal.gateway_command_resolution.v1",
+  CEAL_GATEWAY_COMMAND_RESOLUTION_SCHEMA_VERSION,
   "ceal.gateway_connector_route_failure.v1",
   "ceal.gateway_discovery.v3",
   "ceal.gateway_handshake.v1",
@@ -572,7 +715,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.operation_receipt.v1",
   "ceal.operation_result.v1",
   "ceal.operation_result.compact.v1",
-  "ceal.local_result_materialization.v1",
+  "ceal.local_result_materialization.v2",
   "ceal.local_result_root.v1",
   "ceal.owner_bootstrap_exchange_request.v1",
   "ceal.owner_bootstrap_exchange_result.v1",
@@ -582,7 +725,8 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.request_cancellation.v1",
   "ceal.request_graph_revision.v1",
   "ceal.request_occurrence_correlation.v1",
-  "ceal.request_projection.v1"
+  "ceal.request_projection.v1",
+  "ceal.write_safety_finding.v1"
 ];
 var CEAL_SCHEMA_LITERAL_SET = new Set(CEAL_SCHEMA_LITERALS);
 
@@ -597,21 +741,14 @@ var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
   thread_run_events: (root) => join(root, "run-events.jsonl"),
   bounded_store_sidecar: (root) => `${root}.jsonl`,
   gateway_audit_archive: (root) => `${root}.jsonl`,
-  gateway_capability_audit: (root) => join(root, "capability-audit.jsonl"),
-  gateway_retrieval_waste_partition: (root) => `${root}.jsonl`,
-  gateway_access_policy_publication: (root) => join(root, "access-policy-publications.jsonl"),
   gateway_access_group_connector_control_audit: (root) => `${root}.audit.jsonl`,
   gateway_access_group_connector_scope_audit: (root) => join(root, "profile-connector-scope-audit.jsonl"),
   gateway_access_group_connector_activity_scope_audit: (root) => join(root, "profile-connector-activity-scope-audit.jsonl"),
+  gateway_access_group_connector_calendar_scope_audit: (root) => join(root, "profile-connector-calendar-scope-audit.jsonl"),
   gateway_access_group_connector_readiness_audit: (root) => join(root, "profile-connector-readiness.audit.jsonl"),
   gateway_organization_audit_ledger: (root) => join(root, "organization-ledger.jsonl"),
   gateway_personal_client_audit: (root) => join(root, "audit.jsonl"),
-  gateway_personal_client_access_audit: (root) => join(root, "access-audit.jsonl"),
-  gateway_admin_enrollment: (root) => join(root, "enrollments.jsonl"),
-  gateway_admin_login: (root) => join(root, "logins.jsonl"),
-  gateway_admin_family: (root) => join(root, "families.jsonl"),
-  gateway_admin_refresh_token: (root) => join(root, "refresh-tokens.jsonl"),
-  gateway_admin_access_token: (root) => join(root, "access-tokens.jsonl")
+  gateway_personal_client_access_audit: (root) => join(root, "access-audit.jsonl")
 });
 
 // packages/ceal-client-protocol/src/gateway-installation-activation.ts
@@ -619,8 +756,20 @@ var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_DATA_CHARACTERS = 32;
 var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_CHECK_CHARACTERS = 8;
 var CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_COMPACT_CHARACTERS = CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_DATA_CHARACTERS + CEAL_GATEWAY_INSTALLATION_ACTIVATION_CODE_CHECK_CHARACTERS;
 
+// packages/ceal-client-protocol/src/gateway-entrypoint-commands.ts
+var GATEWAY_ENTRYPOINT_COMMANDS = Object.freeze([
+  Object.freeze({ id: "controlPlane", path: Object.freeze(["control-plane"]) }),
+  Object.freeze({ id: "originShow", path: Object.freeze(["origin", "show"]) }),
+  Object.freeze({ id: "credentialsImport", path: Object.freeze(["credentials", "import"]) }),
+  Object.freeze({ id: "initialize", path: Object.freeze(["init"]) })
+]);
+
 // packages/ceal-client-protocol/src/host-registration.ts
 var CEAL_HOST_REGISTRATION_RESULT_KEYS = Object.freeze(["credential_generation", "host_access_token", "host_installation_ref", "host_source_ref", "ok", "registration_attempt_ref", "schema_version", "status"]);
+var CEAL_LOWERCASE_UUID_PATTERN = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+var CEAL_HOST_REGISTRATION_ATTEMPT_REF_PATTERN = new RegExp(`^host-registration-attempt:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
+var CEAL_HOST_INSTALLATION_REF_PATTERN = new RegExp(`^host-installation:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
+var CEAL_HOST_SOURCE_REF_PATTERN = new RegExp(`^host-source:${CEAL_LOWERCASE_UUID_PATTERN}$`, "u");
 
 // packages/ceal-client-protocol/src/agent-session-handoff.ts
 var CEAL_AGENT_ADMISSION_PHASES = vocabulary([
@@ -652,12 +801,19 @@ var CEAL_AGENT_SERVICE_SESSION_RECORD_KEYS = vocabulary([
 var CEAL_AGENT_SESSION_COMMIT_KEYS = vocabulary(["attempt_ref", "expected_session_revision", "session_revision"]);
 
 // packages/ceal-client-protocol/src/operation-next-actions.ts
+var CEAL_REPEAT_REQUEST_NEXT_ACTION = "repeat_request";
+var CEAL_INSPECT_RECEIPT_NEXT_ACTION = "inspect_receipt";
 var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "select_did_you_mean",
   "choose_new_output_path",
   "choose_new_idempotency_key",
   "restart_search",
   "repeat_original_arguments",
+  // The occurrence this call addressed is settled and cannot move again -- a
+  // denied effect approval, an expired continuation -- so the caller runs the
+  // same call again as a new request. The refusal names the re-request; this
+  // word is the re-request.
+  CEAL_REPEAT_REQUEST_NEXT_ACTION,
   "choose_new_request_identity",
   // A refusal that names the argument (invalid_argument with `property`) tells the caller exactly what to change.
   "correct_argument",
@@ -676,10 +832,35 @@ var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "use_original_input",
   // The same mismatch on the Request binding rather than the input: the
   // occurrence was admitted under one binding and the replay presents another.
-  "use_original_request_binding"
+  "use_original_request_binding",
+  // The client's own filesystem write was refused -- EACCES, EPERM, or a
+  // read-only mount -- which is how an agent sandbox fences writes outside its
+  // workspace. The caller reruns the same command with unsandboxed or escalated
+  // execution; re-adopting the session cannot help, because the sandbox refuses
+  // that write too.
+  "rerun_outside_agent_sandbox",
+  // The refusal names the one Operation to read next in `describe_command`:
+  // an absent Operation id with a sole catalog-ranked candidate, or a known
+  // Operation invoked without its input. Describing only reads the verified
+  // contract and dispatches nothing, and the caller then retries with the
+  // named Operation or input, so it is guidance the scorer counts.
+  "describe_operation",
+  // The refusal names the caller's own personal connect Operation in
+  // `required_action_sequence`: the Operation asked for, or the credential
+  // the call ran on, needs a personal connection the caller does not hold
+  // (never connected, revoked, or expired). The caller runs that exact
+  // Operation, completes the consent it hands back, and retries the same call.
+  "connect_personal_account",
+  // The provider or Gateway named a bounded wait; the caller waits that long
+  // and submits the same read again.
+  "retry_after"
 ];
 var CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS = Object.freeze(CALLER_RECOVERABLE_NEXT_ACTION_VALUES);
 var NON_REMEDY_NEXT_ACTION_VALUES = [
+  // Only an administrator can take the named step -- approving a place for an
+  // Operation, granting a withheld capability -- so a non-administrator asks
+  // one. The refusal names the administrator step; this word is the ask.
+  "ask_admin",
   "await_pending_approval",
   "check_gateway",
   "inspect_context_store",
@@ -694,9 +875,13 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "inspect_local_command",
   "inspect_local_output",
   "inspect_local_route",
-  "inspect_receipt",
+  CEAL_INSPECT_RECEIPT_NEXT_ACTION,
   "inspect_request",
   "none",
+  // The provider refused because of its own configuration -- an API not
+  // enabled, an app scope missing -- which an operator changes in that
+  // provider's console. No caller edit and no retry fixes it.
+  "operator_action",
   "recover",
   "reconcile",
   // Reconciliation of one named occurrence, not of the deployment: a legacy
@@ -704,6 +889,10 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   // no edit to the call changes that. `reconcile` is the deployment-wide word.
   "reconcile_occurrence",
   "reduce_request_size",
+  // The Host's invocation context for this turn is stale or expired at the
+  // Gateway. The Host's next turn rebinds it and the same call then succeeds;
+  // nothing in the call changes, so it is not a remedy the scorer may count.
+  "refresh_host_invocation_context",
   "repair_or_adopt_session",
   "retry",
   // The owner -- a correlation hook, an approval hook -- is not serving right
@@ -717,10 +906,23 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
 var CEAL_NON_REMEDY_NEXT_ACTIONS = Object.freeze(NON_REMEDY_NEXT_ACTION_VALUES);
 var DECLARED = /* @__PURE__ */ new Set([...CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS, ...CEAL_NON_REMEDY_NEXT_ACTIONS]);
 var RECOVERABLE = new Set(CEAL_CALLER_RECOVERABLE_NEXT_ACTIONS);
+var CEAL_OPERATION_WITHHELD_NEXT_ACTIONS = Object.freeze({
+  provider_permission: "ask_admin",
+  access_level: "ask_admin",
+  personal_authorization_required: "connect_personal_account"
+});
 
 // packages/ceal-client-protocol/src/operation-contract-artifact.ts
 var CATALOG_REVISION = new RegExp(CEAL_VERIFIED_ARTIFACT_CATALOG_REVISION_PATTERN, "u");
 var SHA256 = new RegExp(CEAL_VERIFIED_ARTIFACT_DIGEST_PATTERN, "u");
+var CEAL_OPERATION_INVOKE_COMMAND = "invoke";
+var CEAL_OPERATION_INPUT_FLAG = "--input";
+var CEAL_OPERATION_ID_PLACEHOLDER = "<operation-id>";
+var CEAL_OPERATION_INPUT_PLACEHOLDER = "<json-object>";
+var CEAL_MODEL_INVOCATION_ARGUMENTS = [CEAL_OPERATION_INVOKE_COMMAND, CEAL_OPERATION_ID_PLACEHOLDER, CEAL_OPERATION_INPUT_FLAG, shellSingleQuoted(CEAL_OPERATION_INPUT_PLACEHOLDER)].join(" ");
+function shellSingleQuoted(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
 var CEAL_OPERATION_CONTRACT_REQUIRED_FIELDS = Object.freeze(["input_schema", "result_schema"]);
 var CEAL_OPERATION_CONTRACT_OPTIONAL_FIELDS = Object.freeze(["summary", "input_resolution"]);
 var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
@@ -749,9 +951,178 @@ var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_JSON_SCHEMA = Object.freeze({
   }
 });
 
+// packages/ceal-client-protocol/src/bare-document.ts
+var REQUIRED_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_fields;
+var OPTIONAL_FIELDS = CEAL_CLIENT_WIRE_CONTRACT.command_response.bare_document_optional_fields;
+
+// packages/ceal-client-protocol/src/leased-consumer-vocabulary.ts
+var CEAL_TERMINAL_DISPOSITIONS = vocabulary(["completed", "failed", "cancelled"]);
+var CEAL_LEASE_DISPOSITIONS = vocabulary([...CEAL_TERMINAL_DISPOSITIONS, "deferred"]);
+var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["initial"]);
+var CEAL_LEASED_MESSAGE_DELIVERY_OPERATION_IDS = vocabulary(["message.send", "message.update", "message.delete"]);
+var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
+var CEAL_RESULT_DELIVERY_OFFERS = vocabulary(["pending", "offered", "transport_lost"]);
+var CEAL_RESULT_DELIVERY_STATES = vocabulary(["unavailable", ...CEAL_RESULT_DELIVERY_OFFERS]);
+var CEAL_PROVIDER_OUTCOMES = vocabulary(["not_attempted", "outcome_unknown", "verified"]);
+var CEAL_ACTIVITY_GAP_CODES = vocabulary([
+  "provider_page_budget",
+  "call_deadline",
+  "related_item_budget",
+  "provider_cursor_unavailable",
+  "malformed_provider_page",
+  "visibility_incomplete",
+  "unsupported_event_kind"
+]);
+var CEAL_ACTIVITY_CONNECTOR_KINDS = vocabulary(["slack", "github", "google-calendar", "google-drive", "notion"]);
+var CEAL_ACTIVITY_COVERAGE_STATUSES = vocabulary(["complete_for_target", "continuation_required", "blocked"]);
+var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
+  "slack.message",
+  "slack.reply",
+  "slack.direct_message",
+  "github.commit.authored",
+  "github.issue.opened",
+  "github.pull_request.opened",
+  "github.review.submitted",
+  "github.issue_comment.created",
+  "github.review_comment.created",
+  "calendar.organized",
+  "calendar.accepted_invite",
+  "calendar.recorded",
+  "drive.file.created",
+  "drive.file.modified",
+  "drive.file.viewed",
+  "notion.page.created",
+  "notion.page.edited"
+]);
+var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
+  "message_created",
+  "commit_authored",
+  "resource_created",
+  "review_submitted",
+  "comment_created",
+  "event_start",
+  "all_day_start",
+  "file_created",
+  "file_modified",
+  "file_modified_by_me",
+  "file_viewed_by_me",
+  "page_created",
+  "page_last_edited",
+  "resource_modified"
+]);
+var CEAL_ACTIVITY_V3_KINDS = vocabulary(["authored", "edited", "messaged", "responded"]);
+var CEAL_RESOURCE_TIME_BASES = vocabulary(["created", "modified", "viewed"]);
+var CEAL_RESOURCE_SEARCH_ORDERS = vocabulary(["relevance", "modified", "viewed", "created"]);
+var CEAL_RESOURCE_SEARCH_DIRECTIONS = vocabulary(["ascending", "descending"]);
+var CEAL_RESOURCE_SEARCH_FILTERS = vocabulary(["query", "modified_since", "kinds", "container_ref", "addressed_to_me", "unread"]);
+var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
+var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
+var CEAL_LEASED_MESSAGE_SEARCH_COMPLETENESS = vocabulary(["complete", "continuation_available", "truncated"]);
+var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "object"]);
+var CEAL_WRITE_OBJECT_KINDS = vocabulary(["document", "comment", "cell_range"]);
+var CEAL_CONVERSATION_KINDS = vocabulary(["channel", "dm", "group"]);
+var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
+var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
+var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
+  "paragraph",
+  "heading_1",
+  "heading_2",
+  "heading_3",
+  "bulleted_list_item",
+  "numbered_list_item",
+  "to_do",
+  "code"
+]);
+var CEAL_NOTION_NEUTRAL_TYPES = vocabulary([
+  "text",
+  "number",
+  "boolean",
+  "date",
+  "select",
+  "multi_select",
+  "people",
+  "url",
+  "email",
+  "phone",
+  "unsupported"
+]);
+var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
+  "identity_unavailable",
+  "identity_stale",
+  "identity_ambiguous",
+  "identity_revoked",
+  "identity_unlinked"
+]);
+var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
+var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
+var CEAL_PLAN_ITEM_STATUSES = vocabulary(["pending", "active", "completed"]);
+var CEAL_FINAL_PRESENTATION_INTENTS = vocabulary(["final", "stop", "transient_notice"]);
+var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATION_INTENTS]);
+
+// packages/ceal-client-protocol/src/resource-row.ts
+var RESOURCE_ROW_KEY_RULES = Object.freeze({
+  schema_version: { required: true, timestamp: false },
+  ref: { required: true, timestamp: false },
+  next: { required: true, timestamp: false },
+  kind: { required: true, timestamp: false },
+  title: { required: true, timestamp: false },
+  container_label: { required: true, timestamp: false },
+  container_ref: { required: false, timestamp: false },
+  source: { required: true, timestamp: false },
+  owner: { required: false, timestamp: false },
+  counterparts: { required: false, timestamp: false },
+  created_at: { required: false, timestamp: true },
+  created_at_local: { required: false, timestamp: true },
+  modified_at: { required: false, timestamp: true },
+  modified_at_local: { required: false, timestamp: true },
+  viewed_by_me_at: { required: false, timestamp: true },
+  visibility: { required: false, timestamp: false },
+  start: { required: false, timestamp: false },
+  end: { required: false, timestamp: false },
+  status: { required: false, timestamp: false },
+  snippet: { required: false, timestamp: false },
+  state: { required: true, timestamp: false },
+  timestamp_basis: { required: true, timestamp: false }
+});
+var RESOURCE_ROW_REQUIRED_KEYS = Object.entries(RESOURCE_ROW_KEY_RULES).flatMap(([key, rule]) => rule.required ? [key] : []);
+var RESOURCE_ROW_KEYS = new Set(Object.keys(RESOURCE_ROW_KEY_RULES));
+var RESOURCE_ROW_TIMESTAMP_KEYS = Object.entries(RESOURCE_ROW_KEY_RULES).flatMap(([key, rule]) => rule.timestamp ? [key] : []);
+
+// packages/ceal-client-protocol/src/resource-read-result.ts
+var CEAL_RESOURCE_GET_COVERAGE_NEXT_ACTIONS = vocabulary(["reduce_request_size", "read_resource_again"]);
+
+// packages/ceal-client-protocol/src/excluded-target-coverage-contract.ts
+var CEAL_EXCLUDED_TARGET_REASONS = vocabulary(["audience_narrower_than_place", "visibility_unknown"]);
+
+// packages/ceal-client-protocol/src/excluded-target-coverage.ts
+var CEAL_EXCLUDED_TARGET_COVERAGE_MAX_ENTRIES = 64;
+function cealExcludedTargetCoverageJsonSchema() {
+  const target = {
+    target_ref: { type: "string", minLength: 8, maxLength: 134, pattern: "^target:[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" },
+    connector_kind: { type: "string", minLength: 1, maxLength: 64, pattern: "^[a-z][a-z0-9-]{0,63}$" },
+    label: { type: "string", minLength: 1, maxLength: CEAL_PUBLIC_DISPLAY_NAME_MAX_BYTES },
+    reason: { type: "string", enum: [...CEAL_EXCLUDED_TARGET_REASONS] }
+  };
+  return {
+    type: "array",
+    minItems: 1,
+    maxItems: CEAL_EXCLUDED_TARGET_COVERAGE_MAX_ENTRIES,
+    items: { type: "object", additionalProperties: false, maxProperties: 4, properties: target, required: ["target_ref", "reason"] }
+  };
+}
+
+// packages/ceal-client-protocol/src/write-safety-finding.ts
+var CEAL_WRITE_SAFETY_FINDING_STATUSES = vocabulary(["warning", "unchecked"]);
+var CEAL_WRITE_SAFETY_AUDIENCES = vocabulary(["workspace", "person", "members", "unknown"]);
+var CEAL_WRITE_SAFETY_REFERENCE_REASONS = vocabulary(["not_published_to_audience", "audience_access_unknown"]);
+var CEAL_WRITE_SAFETY_UNCHECKED_REASONS = vocabulary(["authority_unavailable"]);
+
 // packages/ceal-client-protocol/src/operation-occurrence.ts
 var MAX_RECEIPT_REVISION = Number.MAX_SAFE_INTEGER - 1;
 
+// packages/ceal-client-protocol/src/leased-artifact-contract.ts
+var CEAL_LEASED_CONSUMER_ARTIFACT_CHUNK_MAX_BYTES = 12 * 1024;
+
 // packages/ceal-client-protocol/src/leased-resource-stream.ts
 var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_MAGIC = new Uint8Array([67, 69, 65, 76, 82, 83, 50, 0]);
 var CEAL_LEASED_CONSUMER_ATTACHMENT_STREAM_RECORD_PREFIX_BYTES = 8;
@@ -763,6 +1134,7 @@ var CEAL_ATTACHMENT_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_
 // packages/ceal-client-protocol/src/request-validation-primitives.ts
 import { createHash } from "node:crypto";
 var DIGEST = /^[a-f0-9]{64}$/u;
+var CEAL_SHA256_DIGEST_PATTERN = DIGEST.source;
 function isCealDigest(value) {
   return typeof value === "string" && DIGEST.test(value);
 }
@@ -789,7 +1161,7 @@ var CANCELLATION_STATES = vocabulary(["requested", "cancelled"]);
 var CEAL_REQUEST_KEYS = Object.freeze(["schema_version", "ceal_request_ref", "created_at", "authority", "prompt_ref", "host_session_ref", "host_turn_ref", "host_source_ref"]);
 var CEAL_REQUEST_JSON_SCHEMA = {
   type: "object",
-  maxProperties: 9,
+  maxProperties: 10,
   additionalProperties: false,
   properties: {
     schema_version: { type: "string", const: CEAL_REQUEST_SCHEMA_VERSION, maxLength: 32 },
@@ -812,7 +1184,8 @@ var CEAL_REQUEST_JSON_SCHEMA = {
     host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
     host_turn_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
     host_input_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-    host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
+    host_source_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+    requester_timezone: { type: "string", minLength: 1, maxLength: 128, description: "IANA timezone observed for the requester on this Request." }
   },
   required: CEAL_REQUEST_KEYS
 };
@@ -862,21 +1235,26 @@ var REQUEST_NODE_STANDING_OCCURRENCE_SCHEMA = {
   },
   required: ["schema_version", "node_ref", "operation_id", "correlation_ref", "occurrence_ref", "graph_revision", "graph_revision_digest", "admitted_input_sha256", "reason"]
 };
+var REQUEST_EXECUTION_PREPARE_REFUSAL_PROPERTIES = {
+  schema_version: { type: "string", const: CEAL_OPERATION_ERROR_SCHEMA_VERSION, maxLength: 64 },
+  code: REQUEST_ACTION_SAFE_REF_SCHEMA,
+  message: { type: "string", minLength: 1, maxLength: 2048 },
+  property: { type: "string", minLength: 1, maxLength: 256 },
+  next_action: REQUEST_ACTION_SAFE_REF_SCHEMA,
+  retryable: { type: "boolean" },
+  source: { type: "string", enum: ["provider", "gateway"] },
+  retry_after_ms: { type: "integer", minimum: 0, maximum: CEAL_RETRY_AFTER_MAX_MS },
+  excluded_targets: cealExcludedTargetCoverageJsonSchema(),
+  repaired_input: {},
+  unrepaired_pointers: { type: "array", maxItems: 128, items: { type: "string", minLength: 1, maxLength: 256 } },
+  provider_handoff: { type: "string", const: "not_offered", maxLength: 32 },
+  cause: { type: "string", enum: [...CEAL_OPERATION_WITHHELD_CAUSES] }
+};
 var REQUEST_EXECUTION_PREPARE_REFUSAL_SCHEMA = {
   type: "object",
   additionalProperties: false,
-  maxProperties: 9,
-  properties: {
-    schema_version: { type: "string", const: CEAL_OPERATION_ERROR_SCHEMA_VERSION, maxLength: 64 },
-    code: REQUEST_ACTION_SAFE_REF_SCHEMA,
-    message: { type: "string", minLength: 1, maxLength: 2048 },
-    property: { type: "string", minLength: 1, maxLength: 256 },
-    next_action: REQUEST_ACTION_SAFE_REF_SCHEMA,
-    retryable: { type: "boolean" },
-    repaired_input: {},
-    unrepaired_pointers: { type: "array", maxItems: 128, items: { type: "string", minLength: 1, maxLength: 256 } },
-    provider_handoff: { type: "string", const: "not_offered", maxLength: 32 }
-  },
+  maxProperties: Object.keys(REQUEST_EXECUTION_PREPARE_REFUSAL_PROPERTIES).length,
+  properties: REQUEST_EXECUTION_PREPARE_REFUSAL_PROPERTIES,
   required: ["schema_version", "code", "message", "next_action", "retryable"]
 };
 var CEAL_REQUEST_EXECUTION_ORDERS = vocabulary(["graph_dependency", "caller"]);
@@ -1063,16 +1441,14 @@ var CEAL_REQUEST_GRAPH_NODE_PREPARE_READINESS_JSON_SCHEMA = {
 };
 
 // packages/ceal-client-protocol/src/client-result-materialization.ts
-var REQUIRED_FIELDS = Object.freeze(["schema_version", "operation_id", "local_path", "content_json_pointer", "size_bytes", "sha256", "read_argv"]);
-var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS, "local_result_root", "model_disclosure"]);
+var CEAL_MODEL_VISIBLE_COMMAND_OUTPUT_MAX_BYTES = 32 * 1024;
+var REQUIRED_FIELDS2 = Object.freeze(["schema_version", "operation_id", "read_argv"]);
+var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS2, "local_result_root"]);
 
 // packages/ceal-client-protocol/src/session-start-affordance.ts
 var CEAL_SESSION_ENTRY_INVOCATION = "ceal";
 var CEAL_LINK_RESOURCE_PRECEDENCE = `When the user asks to use Ceal or provides a link to information that may be available through installed organizational capabilities, run bare \`${CEAL_SESSION_ENTRY_INVOCATION}\`. The Host supplies the current user prompt without exposing it to the client command, and the Gateway returns the applicable entry in that one response. Treat a supplied link as a candidate Ceal resource rather than a public web-search target. Reach for a generic web fetch or web search only when the Gateway offered nothing.`;
 
-// packages/ceal-client-protocol/src/discovery-manifest.ts
-var CEAL_DISCOVERY_MANIFEST_CONNECTOR_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
-
 // packages/ceal-client-protocol/src/conversation-contracts.ts
 var CEAL_APPROVAL_POLICY_KINDS = vocabulary(["requester_only", "named_users", "role_based"]);
 var CEAL_APPROVAL_TARGET_KINDS = vocabulary([
@@ -1115,38 +1491,18 @@ var CEAL_GATEWAY_ANNOUNCEMENT_POLICY_NON_CLAIMS = vocabulary([
 
 // packages/ceal-client-protocol/src/gateway-discovery-response-validation.ts
 var ANNOUNCEMENT_POLICY_CAPABILITY_BINDINGS = Object.freeze({
-  "github.repository.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
-  "collection.search": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
-  "github.issue.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
-  "github.pull_request.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
+  "repository.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
+  "resource.search": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
   "github.workflow_run.get": [{ effect: "read", scopeStatementKind: "github_app_installation_repositories", providerAuthorityKind: "github_app" }],
   "message.search": [{ effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" }],
-  "message.get": [{ effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" }],
-  "resource.resolve": [
-    { effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" },
-    { effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }
-  ],
-  "conversation.thread.get": [{ effect: "read", scopeStatementKind: "slack_public_app_member_channels_only", providerAuthorityKind: "slack_app" }],
   "notion.search": [{ effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }],
-  "notion.page.get": [{ effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }],
-  "calendar.availability": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
-  "calendar.event.search": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
-  "calendar.event.get": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
-  "file.search": [{ effect: "read", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_metadata", providerAuthorityKind: "google_service_account" }],
-  "sheets.values.read": [{ effect: "read", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_sheet_ranges", providerAuthorityKind: "google_service_account" }],
-  "sheets.tabs.list": [{ effect: "read", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_sheet_tabs", providerAuthorityKind: "google_service_account" }],
-  "sheets.values.update": [{ effect: "write", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_editable_sheet_ranges", providerAuthorityKind: "google_service_account" }],
-  "sheets.values.clear": [{ effect: "write", scopeStatementKind: "google_workspace_ceal_drive_or_direct_share_editable_sheet_clear_ranges", providerAuthorityKind: "google_service_account" }]
-});
-var ANNOUNCEMENT_SCOPE_STATEMENTS = Object.freeze({
-  github_app_installation_repositories: "Repositories in the installed GitHub App installation.",
-  slack_public_app_member_channels_only: "Public channels where the installed Slack app is a member; private channels, direct messages, multi-person direct messages, and requester membership are not declared by this connector.",
-  notion_connected_logical_area: "Connected Notion logical area under provider-enforced sharing; descendant inventory is not declared.",
-  google_workspace_calendar_read_only: "Approved Calendar availability and event reads only; Calendar mutation is not declared.",
-  google_workspace_ceal_drive_or_direct_share_metadata: "Metadata search for files in the organization shared drive named Ceal Drive and files directly shared with the provider application; file-content read and mutation are not declared.",
-  google_workspace_ceal_drive_or_direct_share_sheet_ranges: "Bounded values reads from governed Google Sheets in the organization shared drive named Ceal Drive and directly shared files; file mutation is not declared.",
-  google_workspace_ceal_drive_or_direct_share_editable_sheet_ranges: "Bounded values updates in governed editable Google Sheets in the organization shared drive named Ceal Drive and directly shared files; Docs, Slides, and other Drive file mutation are not declared.",
-  google_workspace_ceal_drive_or_direct_share_editable_sheet_clear_ranges: "Bounded values clears in governed editable Google Sheets in the organization shared drive named Ceal Drive and directly shared files; Docs, Slides, and other Drive file mutation are not declared."
+  "resource.get": [{ effect: "read", scopeStatementKind: "notion_connected_logical_area", providerAuthorityKind: "notion_integration" }],
+  "availability.get": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
+  "event.search": [{ effect: "read", scopeStatementKind: "google_workspace_calendar_read_only", providerAuthorityKind: "google_service_account" }],
+  "file.search": [{ effect: "read", scopeStatementKind: "google_workspace_admitted_drive_target_metadata", providerAuthorityKind: "google_service_account" }],
+  "cell_range.get": [{ effect: "read", scopeStatementKind: "google_workspace_admitted_drive_target_sheet_ranges", providerAuthorityKind: "google_service_account" }],
+  "sheet.list": [{ effect: "read", scopeStatementKind: "google_workspace_admitted_drive_target_sheet_tabs", providerAuthorityKind: "google_service_account" }],
+  "cell_range.update": [{ effect: "write", scopeStatementKind: "google_workspace_admitted_drive_target_editable_sheet_ranges", providerAuthorityKind: "google_service_account" }]
 });
 
 // packages/ceal-client-protocol/src/gateway-write-identity.ts
@@ -1203,90 +1559,6 @@ var ADMIN_LINEAGE_NODE_KINDS = vocabulary(["source_read", "synthesis_preview", "
 // packages/ceal-client-protocol/src/actor-kind.ts
 var CEAL_ACTOR_KINDS = vocabulary(["human", "bot", "app", "unknown"]);
 
-// packages/ceal-client-protocol/src/leased-consumer-vocabulary.ts
-var CEAL_TERMINAL_DISPOSITIONS = vocabulary(["completed", "failed", "cancelled"]);
-var CEAL_LEASE_DISPOSITIONS = vocabulary([...CEAL_TERMINAL_DISPOSITIONS, "deferred"]);
-var CEAL_AUTOMATIC_FEEDBACK_INTENTS = vocabulary(["initial"]);
-var CEAL_LEASED_MESSAGE_DELIVERY_CAPABILITY_IDS = vocabulary(["message.create", "message.update", "message.delete"]);
-var CEAL_REPOSITORY_VISIBILITIES = vocabulary(["public", "private", "internal"]);
-var CEAL_RESULT_DELIVERY_OFFERS = vocabulary(["pending", "offered", "transport_lost"]);
-var CEAL_RESULT_DELIVERY_STATES = vocabulary(["unavailable", ...CEAL_RESULT_DELIVERY_OFFERS]);
-var CEAL_PROVIDER_OUTCOMES = vocabulary(["not_attempted", "outcome_unknown", "verified"]);
-var CEAL_ACTIVITY_GAP_CODES = vocabulary([
-  "provider_page_budget",
-  "related_item_budget",
-  "provider_cursor_unavailable",
-  "malformed_provider_page",
-  "visibility_incomplete",
-  "unsupported_event_kind"
-]);
-var CEAL_ACTIVITY_COVERAGE_STATUSES = vocabulary(["complete_for_target", "continuation_required", "blocked"]);
-var CEAL_ACTIVITY_EVENT_KINDS = vocabulary([
-  "slack.message",
-  "slack.reply",
-  "github.commit.authored",
-  "github.issue.opened",
-  "github.pull_request.opened",
-  "github.review.submitted",
-  "github.issue_comment.created",
-  "github.review_comment.created",
-  "calendar.organized",
-  "calendar.accepted_invite",
-  "calendar.recorded"
-]);
-var CEAL_ACTIVITY_TIMESTAMP_BASES = vocabulary([
-  "message_created",
-  "commit_authored",
-  "resource_created",
-  "review_submitted",
-  "comment_created",
-  "event_start",
-  "all_day_start"
-]);
-var CEAL_ARTIFACT_STAGE_TERMINALS = vocabulary(["chunk_accepted", "artifact_ready", "idempotency_replayed"]);
-var CEAL_READ_ITEM_KINDS = vocabulary(["conversation", "identity", "usergroup", "message", "file", "document"]);
-var CEAL_RESOURCE_RESOLVE_KINDS = vocabulary(["conversation", "identity", "usergroup", "permalink"]);
-var CEAL_OPAQUE_HANDLE_KINDS = vocabulary(["target", "message", "thread", "artifact", "document", "object"]);
-var CEAL_WRITE_OBJECT_KINDS = vocabulary(["document", "comment", "cell_range"]);
-var CEAL_CONVERSATION_KINDS = vocabulary(["channel", "dm", "group"]);
-var CEAL_FILE_TYPE_FAMILIES = vocabulary(["all", "image", "pdf"]);
-var CEAL_GITHUB_ISSUE_STATES = vocabulary(["open", "closed", "all"]);
-var CEAL_NOTION_UPDATABLE_BLOCK_TYPES = vocabulary([
-  "paragraph",
-  "heading_1",
-  "heading_2",
-  "heading_3",
-  "bulleted_list_item",
-  "numbered_list_item",
-  "to_do",
-  "code"
-]);
-var CEAL_NOTION_NEUTRAL_TYPES = vocabulary([
-  "text",
-  "number",
-  "boolean",
-  "date",
-  "select",
-  "multi_select",
-  "people",
-  "url",
-  "email",
-  "phone",
-  "unsupported"
-]);
-var CEAL_NOTION_IDENTITY_GAP_REASONS = vocabulary([
-  "identity_unavailable",
-  "identity_stale",
-  "identity_ambiguous",
-  "identity_revoked",
-  "identity_unlinked"
-]);
-var CEAL_NOTION_STRING_VALUE_TYPES = vocabulary(["text", "select", "url", "email", "phone"]);
-var CEAL_UNREAD_REASONS = vocabulary(["blocked", "unavailable", "too_large", "unsupported", "download_failed", "permission_denied"]);
-var CEAL_PLAN_ITEM_STATUSES = vocabulary(["pending", "active", "completed"]);
-var CEAL_FINAL_PRESENTATION_INTENTS = vocabulary(["final", "stop", "transient_notice"]);
-var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATION_INTENTS]);
-
 // packages/ceal-client-protocol/src/personal-client-vocabulary.ts
 var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
   "access_group_ref",
@@ -1309,7 +1581,7 @@ var CEAL_REFRESH_FAILURE_CODES = vocabulary([
 ]);
 
 // packages/ceal-client-protocol/src/device-enrollment.ts
-var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired"]);
+var CEAL_DEVICE_ENROLLMENT_POLL_FAILURE_CODES = Object.freeze(["unsupported_feature", "recovery_required", "expired", "denied"]);
 var POLL_RESULT_KEYS = Object.freeze(["retry_after_ms", "schema_version", "status"]);
 
 // packages/ceal-client-protocol/src/personal-client-session.ts
@@ -1321,7 +1593,6 @@ var MAX_ARGUMENT_BYTES = 16 * 1024;
 var HANDSHAKE_IDENTITY_KEYS = Object.freeze(["membership_ref", "registration_ref", "client_ref", "subject_ref", "instance_ref"]);
 var AUDIT_IDENTITY_KEYS = Object.freeze(["event_ref", "membership_ref", "registration_ref", "client_ref", "subject_ref", "instance_ref"]);
 var FAILURE_RESPONSE_KEYS = Object.freeze(["error", "ok", "proof_ref_or_unavailable", "protocol_version", "request_id"]);
-var MAX_RECOVERY_RETRY_AFTER_MS = 60 * 60 * 1e3;
 
 // host/claude/src/claude-decoder.ts
 var MAX_HOOK_BYTES = 256 * 1024;
@@ -1653,6 +1924,9 @@ function errorCode(error) {
   return typeof error === "object" && error !== null && "code" in error ? String(error.code) : null;
 }
 
+// host/relay/src/relay-request-binding-store.ts
+var MAX_STATE_BYTES = 8 * 1024 * 1024;
+
 // host/relay/src/relay-quarantine-store.ts
 var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
 
@@ -1661,9 +1935,6 @@ var DEFAULT_LIMITS = { global_count: 8192, global_bytes: 64 * 1024 * 1024, produ
 var RETRY_SECONDS = [1, 2, 4, 8, 16, 32, 60];
 var MAX_RETRYABLE_ATTEMPTS = RETRY_SECONDS.length + 10;
 
-// host/relay/src/relay-request-binding-store.ts
-var MAX_STATE_BYTES = 8 * 1024 * 1024;
-
 // host/relay/src/relay-ipc.ts
 import { createConnection, createServer } from "node:net";
 
@@ -1691,13 +1962,53 @@ var HOST_RELAY_CURRENT_PROMPT_REGISTER_SCHEMA = "ceal.host_relay_current_prompt_
 var HOST_RELAY_CURRENT_PROMPT_RESULT_SCHEMA = "ceal.host_relay_current_prompt_result.v1";
 var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
 var HOST_RELAY_ADMISSION_RESPONSE_MAX_BYTES = 4096;
+var HOST_RELAY_INVOCATION_MINT_REFUSAL_REASONS = vocabulary([
+  "context_stale",
+  "context_expired",
+  "host_source_refused",
+  "host_credential_refused",
+  "gateway_unavailable",
+  "gateway_refused",
+  "gateway_response_invalid",
+  "deadline",
+  "cancelled",
+  "mint_failed",
+  "relay_failed"
+]);
+var HOST_RELAY_INVOCATION_MINT_OUTCOMES = vocabulary(["completed", "caller_cancelled", "deadline", "failed", "no_binding"]);
+var HOST_RELAY_EXCHANGE_FAILURES = vocabulary([
+  "permission_denied",
+  "socket_missing",
+  "connection_refused",
+  "closed_early",
+  "response_invalid",
+  "timed_out",
+  "cancelled",
+  "unavailable"
+]);
 var HostRelayIpcError = class extends Error {
   code;
-  constructor(code3, message = code3) {
+  /** Set only when the client-side socket exchange itself failed. */
+  failure;
+  constructor(code3, message = code3, failure) {
     super(message);
     this.code = code3;
+    this.failure = failure;
   }
 };
+function socketErrorFailure(error) {
+  switch (errorCode2(error)) {
+    case "EACCES":
+    case "EPERM":
+      return "permission_denied";
+    case "ENOENT":
+      return "socket_missing";
+    case "ECONNREFUSED":
+      return "connection_refused";
+    default:
+      return "unavailable";
+  }
+}
 var HostRelayIpcAdmissionPort = class {
   endpoint;
   timeout_ms;
@@ -1732,7 +2043,7 @@ function exchange(endpoint, encoded, timeoutMs, decode, signal) {
     const socket = createConnection(endpoint);
     let buffer = Buffer.alloc(0);
     let settled = false;
-    const aborted = () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC was cancelled."));
+    const aborted = () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC was cancelled.", "cancelled"));
     const finish = (error, response2) => {
       if (settled) return;
       settled = true;
@@ -1741,13 +2052,16 @@ function exchange(endpoint, encoded, timeoutMs, decode, signal) {
       if (error !== null) reject(error);
       else if (response2 !== void 0) resolve(response2);
     };
-    if (timeoutMs !== void 0) socket.setTimeout(timeoutMs, () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC timed out.")));
+    if (timeoutMs !== void 0) socket.setTimeout(timeoutMs, () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC timed out.", "timed_out")));
     if (signal?.aborted === true) {
       aborted();
       return;
     }
     signal?.addEventListener("abort", aborted, { once: true });
-    socket.once("error", () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC is unavailable.")));
+    socket.once("error", (error) => {
+      const failure = socketErrorFailure(error);
+      finish(new HostRelayIpcError("relay_unavailable", `Host Relay IPC is unavailable: ${failure}.`, failure));
+    });
     socket.once("connect", () => socket.write(encoded));
     socket.on("data", (chunk) => {
       try {
@@ -1755,11 +2069,11 @@ function exchange(endpoint, encoded, timeoutMs, decode, signal) {
         const decoded = decode(buffer);
         if (decoded !== null) finish(null, decoded);
       } catch (error) {
-        finish(error instanceof Error ? error : new HostRelayIpcError("relay_unavailable"));
+        finish(new HostRelayIpcError("relay_unavailable", error instanceof Error ? error.message : "Host Relay IPC response is invalid.", "response_invalid"));
       }
     });
     socket.once("end", () => {
-      if (!settled) finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC closed without a response."));
+      if (!settled) finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC closed without a response.", "closed_early"));
     });
   });
 }
@@ -1827,6 +2141,9 @@ function encodeLengthPrefixed(value) {
 function exactKeys2(value, keys) {
   return Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
 }
+function errorCode2(error) {
+  return record3(error) && typeof error.code === "string" ? error.code : null;
+}
 
 // host/invocation-context.ts
 var HOST_INVOCATION_IDENTITY_KEYS = ["host_session_ref", "host_turn_ref", "host_source_ref"];
@@ -2274,8 +2591,11 @@ import { homedir } from "node:os";
 import { join as join4 } from "node:path";
 
 // host/producer-service.ts
-import { constants } from "node:fs";
-import { lstat as lstat2, open as open3 } from "node:fs/promises";
+import { posix as posix3, win32 as win323 } from "node:path";
+
+// host/runtime-source-paths.ts
+import { createHash as createHash4 } from "node:crypto";
+import { posix as posix2, win32 as win322 } from "node:path";
 
 // host/absolute-path.ts
 import { posix, win32 } from "node:path";
@@ -2284,7 +2604,35 @@ function isAbsoluteNormalizedNonRootPath(value, flavor = process.platform, allow
   return typeof value === "string" && value.length <= 4096 && !value.includes("\0") && pathApi.isAbsolute(value) && pathApi.normalize(value) === value && (allowRoot || pathApi.parse(value).root !== value);
 }
 
+// host/runtime-source-paths.ts
+var HOST_SOURCE_ID = /^host-source:([0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12})$/u;
+function hostSourceUuid(sourceRef) {
+  return HOST_SOURCE_ID.exec(sourceRef)?.[1] ?? null;
+}
+function hostRuntimeSourcePaths(stateRoot, sourceRef, platform = process.platform) {
+  const sourceId = hostSourceUuid(sourceRef);
+  if (!isAbsoluteNormalizedNonRootPath(stateRoot, platform) || sourceId === null) throw new TypeError("Host runtime source identity is invalid.");
+  const path = platform === "win32" ? win322 : posix2;
+  const sourcesRoot = path.join(stateRoot, "sources");
+  const sourceRoot = path.join(sourcesRoot, sourceId);
+  const runtimeRoot = path.join(stateRoot, "run");
+  const endpoint = platform === "win32" ? `\\\\.\\pipe\\ceal-host-${createHash4("sha256").update(`${stateRoot}\0${sourceRef}`).digest("hex").slice(0, 24)}` : path.join(runtimeRoot, `${sourceId}.sock`);
+  assertHostRuntimeIpcLength(endpoint, platform);
+  return { sourceId, sourcesRoot, sourceRoot, relayRoot: path.join(sourceRoot, "relay"), codexOutbox: path.join(sourceRoot, "producers", "codex", "outbox"), claudeOutbox: path.join(sourceRoot, "producers", "claude", "outbox"), endpoint, runtimeRoot };
+}
+function assertHostRuntimeIpcLength(endpoint, platform) {
+  if (platform === "win32") return;
+  const maximum = platform === "linux" ? 107 : 103;
+  if (Buffer.byteLength(endpoint, "utf8") > maximum) throw Object.assign(new TypeError(`ipc_endpoint_too_long: Host IPC path exceeds ${maximum} bytes; use a shorter Host state root.`), { code: "ipc_endpoint_too_long" });
+}
+function assertHostProducerSourcePaths(stateRoot, config, producer, platform = process.platform) {
+  const paths = hostRuntimeSourcePaths(stateRoot, config.host_source_ref, platform);
+  if (config.outbox_dir !== (producer === "codex" ? paths.codexOutbox : paths.claudeOutbox) || config.relay_endpoint !== paths.endpoint) throw new TypeError("Host producer outbox and IPC must belong to its configured source.");
+}
+
 // host/producer-service.ts
+import { constants } from "node:fs";
+import { lstat as lstat2, open as open3 } from "node:fs/promises";
 var MAX_CONFIG_BYTES = 32 * 1024;
 var SAFE_REF5 = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
 var HOST_PRODUCER_CONFIG_FLAG = "--ceal-host-config";
@@ -2301,7 +2649,15 @@ function parseHostProducerConfigFlag(args, platform = process.platform) {
   return parseProducerHostConfigFlag(args, HOST_PRODUCER_CONFIG_FLAG, platform, hostProducerError);
 }
 async function readHostProducerConfig(descriptor, configPath, platform = process.platform) {
-  return decodeHostProducerConfigText(descriptor, await readProducerConfigText(configPath, platform, hostProducerError), platform);
+  const config = decodeHostProducerConfigText(descriptor, await readProducerConfigText(configPath, platform, hostProducerError), platform);
+  const path = platform === "win32" ? win323 : posix3;
+  const root = path.resolve(config.outbox_dir, "../../../../..");
+  try {
+    assertHostProducerSourcePaths(root, config, descriptor.producer_id, platform);
+  } catch (error) {
+    throw hostProducerError("invalid_config", error instanceof Error ? error.message : "Host producer source tuple is invalid.");
+  }
+  return config;
 }
 function decodeHostProducerConfigText(descriptor, text, platform = process.platform) {
   const extraPaths = descriptor.extra_paths ?? [];
@@ -2440,6 +2796,7 @@ function boundedMilliseconds(value) {
 var CLAUDE_PRODUCER_CONFIG_SCHEMA = "ceal.claude_producer_config.v1";
 var CLAUDE_PRODUCER_DESCRIPTOR = {
   schema: CLAUDE_PRODUCER_CONFIG_SCHEMA,
+  producer_id: "claude",
   config: (shared) => shared,
   runtime_options: (config) => Object.freeze({
     outbox_dir: config.outbox_dir,
@@ -2525,12 +2882,13 @@ var execFileAsync = promisify(execFile);
 
 // host/claude/src/claude-installer.ts
 var CLAUDE_LOCAL_CAPABILITY_ACTIVATION = Object.freeze({ environment: "CLAUDE_CODE_ENTRYPOINT", value: "cli" });
+var CLAUDE_CLIENT_ALLOW_RULE = `Bash(${CEAL_SESSION_ENTRY_INVOCATION}:*)`;
 
 // host/claude/bin/ceal-claude-hook.ts
 async function main() {
   return runClaudeHookCli();
 }
-if (isDirectInvocation(import.meta.url)) process.exitCode = await main();
+if (import.meta.main) process.exitCode = await main();
 export {
   main
 };