@corca-org/ceal-host-win32-x64 1.0.8 → 1.0.10

package/libexec/ceal-host/claude-invocation-authentication.mjs

@@ -74,11 +74,28 @@ var client_wire_contract_default = {
     ],
     bare_document_fields: [
       "invocation",
-      "next",
+      "required_action_sequence",
+      "entrypoints",
       "common_concepts",
       "operations",
       "catalog_revision"
     ],
+    prompt_field: "prompt",
+    prompt_schema_version: "ceal.prompt.v1",
+    focused_prompt_document_fields: [
+      "catalog_revision",
+      "prompt"
+    ],
+    focused_prompt_continuation_document_fields: [
+      "catalog_revision",
+      "remaining_work",
+      "prompt"
+    ],
+    discovery_command: "discovery",
+    discovery_manifest_schema_version: "ceal.discovery_manifest.v1",
+    discovery_manifest_document_fields: [
+      "discovery_manifest"
+    ],
     exit_code_max: 125,
     bare_document_max_bytes: 65536,
     complete_max_bytes: 66019,
@@ -105,8 +122,15 @@ var CEAL_VERIFIED_ARTIFACT_MAX_BYTES = artifact.max_bytes;
 var CEAL_VERIFIED_ARTIFACT_DESCRIPTOR_MAX_BYTES = artifact.envelope_max_bytes;
 var CEAL_COMMAND_REQUEST_SCHEMA_VERSION = request.schema_version;
 var CEAL_COMMAND_REQUEST_MAX_BYTES = request.absolute_transport_max_bytes;
-var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_FIELDS = response.bare_document_fields;
 var CEAL_COMMAND_RESPONSE_BARE_DOCUMENT_MAX_BYTES = response.bare_document_max_bytes;
+var CEAL_COMMAND_RESPONSE_PROMPT_FIELD = response.prompt_field;
+var CEAL_COMMAND_RESPONSE_PROMPT_SCHEMA_VERSION = response.prompt_schema_version;
+var CEAL_COMMAND_RESPONSE_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.bare_document_fields, response.prompt_field]);
+var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_document_fields]);
+var CEAL_COMMAND_RESPONSE_FOCUSED_PROMPT_CONTINUATION_DOCUMENT_FIELDS = Object.freeze([...response.focused_prompt_continuation_document_fields]);
+var CEAL_COMMAND_RESPONSE_DISCOVERY_COMMAND = response.discovery_command;
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_SCHEMA_VERSION = response.discovery_manifest_schema_version;
+var CEAL_COMMAND_RESPONSE_DISCOVERY_MANIFEST_DOCUMENT_FIELDS = Object.freeze([...response.discovery_manifest_document_fields]);
 var CEAL_COMMAND_RESPONSE_MAX_BYTES = response.absolute_transport_max_bytes;
 
 // packages/ceal-client-protocol/src/vocabulary.ts
@@ -142,7 +166,7 @@ var CEAL_OPERATION_RECOVERY_KINDS = vocabulary(["none", "reconcile", "compensate
 var CEAL_OPERATION_RECOVERY_STATUSES = vocabulary(["not_started", "active", "completed"]);
 var CEAL_OPERATION_PROVIDER_READBACK_AVAILABILITY = vocabulary(["not_started", "not_applicable", "not_available", "pending", "available"]);
 var CEAL_OPERATION_OFFERED_HANDOFF_STATES = vocabulary(["accepted", "rejected", "unknown"]);
-var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "profile_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
+var CEAL_OPERATION_RECEIPT_AUTHORITY_KEYS = Object.freeze(["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]);
 var CEAL_OPERATION_APPROVAL_DISPOSITIONS = vocabulary([
   "approval_not_required_by_policy",
   "interactive_pending",
@@ -157,6 +181,8 @@ var CEAL_CAPABILITY_READINESS_VALUES = vocabulary(["ready", "degraded", "unavail
 var CEAL_TARGET_REQUIREMENTS = vocabulary(["required", "optional", "none"]);
 var CEAL_AUDIT_OUTCOMES = vocabulary(["succeeded", "denied", "failed"]);
 var CEAL_GATEWAY_PROVIDER_STEP_OUTCOMES = vocabulary(["completed", "rejected", "throttled", "failed"]);
+var CEAL_GATEWAY_READ_REUSE_DISPOSITIONS = vocabulary(["response_cache_hit", "corpus_hit", "corpus_hit_after_revalidation", "corpus_partial_provider_supplement", "provider_direct", "provider_continuation", "reuse_unavailable"]);
+var CEAL_GATEWAY_READ_REUSE_UNAVAILABLE_REASONS = vocabulary(["not_reported", "storage_unavailable", "coverage_incomplete", "freshness_refresh_required", "not_reusable", "bypassed"]);
 var CEAL_POLICY_DECISIONS = vocabulary(["allowed", "denied", "not_evaluated"]);
 var CEAL_CONNECTOR_ROUTE_PHASES = vocabulary(["scope_observation", "target_selection", "route_resolution"]);
 var CEAL_CONNECTOR_ROUTE_CAUSES = vocabulary(["provider_throttled", "provider_unavailable", "binding_invalid", "scope_limit_exceeded"]);
@@ -429,8 +455,10 @@ function requireIsoTimestamp(value, message) {
 var JSON_DESCRIPTION_CONTROL_CHARACTER = new RegExp("\\p{Cc}", "u");
 
 // packages/ceal-client-protocol/src/operation-contract-validation.ts
-var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["profile", "instance_binding", "target", "admission_recheck"]);
+var CEAL_OPERATION_AUTHORITY_POLICY_KEYS = Object.freeze(["access_group", "instance_binding", "target", "admission_recheck"]);
 var MAX_OPERATION_INPUT_RESOLVER_BINDINGS = 96;
+var CEAL_OPERATION_DESCRIPTOR_REQUIRED_ENVELOPE_KEYS = Object.freeze(["schema_version", "id", "input_contract", "result_contract", "policy"]);
+var CEAL_OPERATION_DESCRIPTOR_OPTIONAL_ENVELOPE_KEYS = Object.freeze(["input_resolution", "summary"]);
 var CEAL_OPERATION_RESULT_KEYS = vocabulary(["ok", "operation_id", "operation_receipt", "schema_version", "value"]);
 var CEAL_OPERATION_COMPACT_RESULT_KEYS = vocabulary(["ok", "operation_evidence", "operation_id", "schema_version", "value"]);
 
@@ -504,6 +532,7 @@ var CEAL_SCHEMA_LITERALS = [
   "ceal.operation_descriptor.v1",
   "ceal.operation_error.v1",
   "ceal.operation_failure.v1",
+  "ceal.operation_failure.compact.v1",
   "ceal.operation_receipt.v1",
   "ceal.operation_result.v1",
   "ceal.operation_result.compact.v1",
@@ -529,17 +558,16 @@ var CEAL_BOUNDED_SERIES_CATALOG = Object.freeze({
   engagement_signal: (root) => join(root, "runtime-state", "slack-feedback.jsonl"),
   runtime_error: (root) => join(root, "runtime-state", "runtime-errors.jsonl"),
   turn_bridge_request: (root) => join(root, ".ceal", "turn-bridge", "requests.jsonl"),
-  channel_log: (root) => join(root, "log.jsonl"),
   thread_run_events: (root) => join(root, "run-events.jsonl"),
   bounded_store_sidecar: (root) => `${root}.jsonl`,
   gateway_audit_archive: (root) => `${root}.jsonl`,
   gateway_capability_audit: (root) => join(root, "capability-audit.jsonl"),
   gateway_retrieval_waste_partition: (root) => `${root}.jsonl`,
   gateway_access_policy_publication: (root) => join(root, "access-policy-publications.jsonl"),
-  gateway_profile_connector_control_audit: (root) => `${root}.audit.jsonl`,
-  gateway_profile_connector_scope_audit: (root) => join(root, "profile-connector-scope-audit.jsonl"),
-  gateway_profile_connector_activity_scope_audit: (root) => join(root, "profile-connector-activity-scope-audit.jsonl"),
-  gateway_profile_connector_readiness_audit: (root) => join(root, "profile-connector-readiness.audit.jsonl"),
+  gateway_access_group_connector_control_audit: (root) => `${root}.audit.jsonl`,
+  gateway_access_group_connector_scope_audit: (root) => join(root, "profile-connector-scope-audit.jsonl"),
+  gateway_access_group_connector_activity_scope_audit: (root) => join(root, "profile-connector-activity-scope-audit.jsonl"),
+  gateway_access_group_connector_readiness_audit: (root) => join(root, "profile-connector-readiness.audit.jsonl"),
   gateway_organization_audit_ledger: (root) => join(root, "organization-ledger.jsonl"),
   gateway_personal_client_audit: (root) => join(root, "audit.jsonl"),
   gateway_personal_client_access_audit: (root) => join(root, "access-audit.jsonl"),
@@ -590,12 +618,6 @@ var CEAL_AGENT_SESSION_COMMIT_KEYS = vocabulary(["attempt_ref", "expected_sessio
 // packages/ceal-client-protocol/src/operation-next-actions.ts
 var CALLER_RECOVERABLE_NEXT_ACTION_VALUES = [
   "select_did_you_mean",
-  // The graph, not the argument list, is what the caller must change: the
-  // resolver that owns this input has no producing node upstream, and no edit
-  // to the invocation can conjure one. `resolver_dependency_absent` carried no
-  // remedy at all rather than borrow a word that means something else, so the
-  // scorer read a fully-diagnosed, caller-fixable refusal as a failed run.
-  "request.graph.append",
   "choose_new_output_path",
   "choose_new_idempotency_key",
   "restart_search",
@@ -647,8 +669,6 @@ var NON_REMEDY_NEXT_ACTION_VALUES = [
   "reconcile_occurrence",
   "reduce_request_size",
   "repair_or_adopt_session",
-  "request.effect_approval.read",
-  "request.run",
   "retry",
   // The owner -- a correlation hook, an approval hook -- is not serving right
   // now. The caller changes nothing and the same call succeeds once the owner
@@ -745,12 +765,12 @@ var CEAL_REQUEST_JSON_SCHEMA = {
       additionalProperties: false,
       properties: {
         instance_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
-        profile_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
+        access_group_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
         principal_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
         execution_subject_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
         authority_revision_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source }
       },
-      required: ["instance_ref", "profile_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
+      required: ["instance_ref", "access_group_ref", "principal_ref", "execution_subject_ref", "authority_revision_ref"]
     },
     prompt_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
     host_session_ref: { type: "string", minLength: 1, maxLength: 128, pattern: SAFE_REF.source },
@@ -876,7 +896,7 @@ var CEAL_HOST_OBSERVATION_KINDS = vocabulary(["prompt", "session", "turn", "mode
 function isCealHostPromptObservationValue(value) {
   return isOperationRecord(value) && Object.keys(value).length === 1 && isCealDigest(value.body_sha256);
 }
-var HOST_RESERVED_KEY = /^(?:admission|approval|audit|authorization|cancellation|capability|effect|grant|occurrence|operation|policy|profile|provider_readback|receipt|reconciliation|replay|target|write_request)(?:_|$)/iu;
+var HOST_RESERVED_KEY = /^(?:access_group|admission|approval|audit|authorization|cancellation|capability|effect|grant|occurrence|operation|policy|profile|provider_readback|receipt|reconciliation|replay|target|write_request)(?:_|$)/iu;
 function assertHostObservationValue(value, kind) {
   if (value === void 0) invalid("Ceal Host observation value is invalid.");
   if (kind === "prompt" && !isCealHostPromptObservationValue(value)) invalid("Ceal Host prompt observation must contain only its body digest.");
@@ -896,6 +916,10 @@ function inspectHostKeys(value) {
   }
 }
 
+// packages/ceal-client-protocol/src/host-prompt-ref.ts
+var CEAL_HOST_PROMPT_DIGEST_PATTERN = "^[a-f0-9]{64}$";
+var PROMPT_DIGEST = new RegExp(CEAL_HOST_PROMPT_DIGEST_PATTERN, "u");
+
 // packages/ceal-client-protocol/src/request-effect-approval.ts
 var CEAL_EFFECT_APPROVAL_DECISION_CHECK_PHRASES = Object.freeze([
   "observed after this approval was raised and before it expires",
@@ -911,6 +935,12 @@ var OWNER_WRITE_STATES = Object.freeze(["attempt_started", "provider_acknowledge
 var OWNER_EFFECT_STATES = Object.freeze(["none", "applied", "failed", "unknown", "reconciled"]);
 var OWNER_RECEIPT_STATES = Object.freeze(["pending", "available", "failed", "unknown", "reconciled"]);
 
+// packages/ceal-client-protocol/src/thread-excerpt.ts
+var CEAL_THREAD_RECENT_WINDOW = 6;
+var CEAL_THREAD_LAST_APP_MESSAGES_WINDOW = 3;
+var CEAL_THREAD_OLDER_SUMMARY_WINDOW = 4;
+var CEAL_FED_THREAD_MESSAGE_LIMIT = CEAL_THREAD_RECENT_WINDOW + CEAL_THREAD_OLDER_SUMMARY_WINDOW + CEAL_THREAD_LAST_APP_MESSAGES_WINDOW;
+
 // packages/ceal-client-protocol/src/request-graph-readiness.ts
 var REQUEST_GRAPH_PRODUCER_TO_APPEND_SCHEMA = {
   type: "object",
@@ -1016,21 +1046,12 @@ function exactKeys(value, expected) {
 var REQUIRED_FIELDS = Object.freeze(["schema_version", "operation_id", "local_path", "content_json_pointer", "size_bytes", "sha256", "read_argv"]);
 var FIELDS = /* @__PURE__ */ new Set([...REQUIRED_FIELDS, "local_result_root", "model_disclosure"]);
 
-// packages/ceal-client-protocol/src/profile-readback.ts
-function cealAuthenticatedProfileReadback(value) {
-  if (!isProfileReadResult(value)) return null;
-  const receipt = value.operation_receipt;
-  if (!isUnaffectingAvailableReceipt(receipt)) return null;
-  const authority = receipt.authority;
-  if (!isCealJsonRecord(authority) || typeof authority.instance_ref !== "string" || typeof authority.profile_ref !== "string") return null;
-  return Object.freeze({ instance_ref: authority.instance_ref, profile_ref: authority.profile_ref });
-}
-function isProfileReadResult(value) {
-  return isCealJsonRecord(value) && value.schema_version === "ceal.operation_result.v1" && value.ok === true && value.operation_id === "profile.read";
-}
-function isUnaffectingAvailableReceipt(value) {
-  return isCealJsonRecord(value) && value.effect === "none" && value.provider_handoff === "not_offered" && isCealJsonRecord(value.terminal) && value.terminal.availability === "available";
-}
+// packages/ceal-client-protocol/src/session-start-affordance.ts
+var CEAL_SESSION_ENTRY_INVOCATION = "ceal";
+var CEAL_LINK_RESOURCE_PRECEDENCE = `When the user asks to use Ceal or provides a link to information that may be available through installed organizational capabilities, run bare \`${CEAL_SESSION_ENTRY_INVOCATION}\`. The Host supplies the current user prompt without exposing it to the client command, and the Gateway returns the applicable entry in that one response. Treat a supplied link as a candidate Ceal resource rather than a public web-search target. Reach for a generic web fetch or web search only when the Gateway offered nothing.`;
+
+// packages/ceal-client-protocol/src/discovery-manifest.ts
+var CEAL_DISCOVERY_MANIFEST_CONNECTOR_KINDS = vocabulary(["github", "google-workspace", "notion", "slack"]);
 
 // packages/ceal-client-protocol/src/conversation-contracts.ts
 var CEAL_APPROVAL_POLICY_KINDS = vocabulary(["requester_only", "named_users", "role_based"]);
@@ -1248,7 +1269,7 @@ var CEAL_PRESENTATION_INTENTS = vocabulary(["progress", ...CEAL_FINAL_PRESENTATI
 
 // packages/ceal-client-protocol/src/personal-client-vocabulary.ts
 var CEAL_PERSONAL_CLIENT_BINDING_KEYS = vocabulary([
-  "profile_ref",
+  "access_group_ref",
   "membership_ref",
   "registration_ref",
   "client_ref",
@@ -1263,7 +1284,8 @@ var CEAL_REFRESH_FAILURE_CODES = vocabulary([
   "refresh_replayed",
   "refresh_revoked",
   "authority_replaced",
-  "refresh_recovery_unavailable"
+  "refresh_recovery_unavailable",
+  "refresh_recovery_expired"
 ]);
 
 // packages/ceal-client-protocol/src/device-enrollment.ts
@@ -1290,8 +1312,8 @@ function hostTerminalFailure(error, component) {
   if (code3 === "ENOENT") return { code: "host_dependency_unavailable", message: `A command or file the ${component} Host needs is unavailable: ${detail}`, next_action: "Install the missing dependency or restore the missing file, then rerun this command." };
   if (code3 === "EACCES" || code3 === "EPERM") return { code: "host_permission_denied", message: `The ${component} Host was refused access to a local path: ${detail}`, next_action: "Repair the ownership or mode of the named path, then rerun this command." };
   if (code3 === "ENOSPC") return { code: "host_storage_unavailable", message: `The ${component} Host could not write local state: ${detail}`, next_action: "Free local disk space, then rerun this command." };
-  if (code3 !== null && HOST_OWNED_CODE.test(code3)) return { code: code3, message: `The ${component} Host command failed: ${detail}`, next_action: `Resolve the named failure above; run \`ceal-host doctor --json\` only if it reports installed ${component} Host drift.` };
-  return { code: "host_failure_unclassified", message: `The ${component} Host command failed for a cause it cannot classify: ${detail}`, next_action: `Run \`ceal-host doctor --json\`; if it reports no drift then the ${component} Host configuration is not the cause, and the message above is the only evidence of what is.` };
+  if (code3 !== null && HOST_OWNED_CODE.test(code3)) return { code: code3, message: `The ${component} Host command failed: ${detail}`, next_action: `Resolve the named failure above; run \`ceal-host doctor\` only if it reports installed ${component} Host drift.` };
+  return { code: "host_failure_unclassified", message: `The ${component} Host command failed for a cause it cannot classify: ${detail}`, next_action: `Run \`ceal-host doctor\`; if it reports no drift then the ${component} Host configuration is not the cause, and the message above is the only evidence of what is.` };
 }
 var DOCTOR_FLAGS = Object.freeze({
   "--expected-sha256": "expected_sha256",
@@ -1588,12 +1610,19 @@ var RELAY_QUARANTINE_MAX_BYTES = 16 * 1024 * 1024;
 
 // host/relay/src/relay-admission-store.ts
 var DEFAULT_LIMITS = { global_count: 8192, global_bytes: 64 * 1024 * 1024, producer_count: 4096, producer_bytes: 32 * 1024 * 1024 };
+var RETRY_SECONDS = [1, 2, 4, 8, 16, 32, 60];
+var MAX_RETRYABLE_ATTEMPTS = RETRY_SECONDS.length + 10;
 
 // host/relay/src/relay-request-binding-store.ts
 var MAX_STATE_BYTES = 8 * 1024 * 1024;
 
 // host/relay/src/relay-ipc.ts
 import { createConnection, createServer } from "node:net";
+
+// host/relay/src/current-prompt-custody.ts
+var HOST_CURRENT_PROMPT_MAX_BYTES = 256 * 1024;
+
+// host/relay/src/relay-ipc.ts
 var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
   "schema_version",
   "producer_id",
@@ -1610,8 +1639,6 @@ var HOST_RELAY_REQUEST_BINDING_KEYS = Object.freeze([
   "host_input_ref"
 ]);
 var HOST_RELAY_IPC_RESPONSE_SCHEMA = "ceal.host_relay_admission.v1";
-var HOST_RELAY_BINDING_QUERY_SCHEMA = "ceal.host_relay_binding_query.v1";
-var HOST_RELAY_BINDING_RESULT_SCHEMA = "ceal.host_relay_binding_result.v1";
 var HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA = "ceal.host_relay_invocation_context_query.v1";
 var HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA = "ceal.host_relay_invocation_context_result.v1";
 var HOST_RELAY_IPC_LENGTH_BYTES = Uint32Array.BYTES_PER_ELEMENT;
@@ -1624,18 +1651,13 @@ var HostRelayIpcError = class extends Error {
     this.code = code3;
   }
 };
-var HostRelayRequestBindingPort = class {
+var HostRelayInvocationContextPort = class {
   endpoint;
-  timeout_ms;
-  constructor(endpoint, timeoutMs = 5e3) {
+  constructor(endpoint) {
     this.endpoint = endpoint;
-    this.timeout_ms = timeoutMs;
   }
-  query(input) {
-    return queryHostRelayRequestBinding(this.endpoint, input, this.timeout_ms);
-  }
-  mintInvocationContext(input) {
-    return queryHostRelayInvocationContext(this.endpoint, input, this.timeout_ms);
+  mintInvocationContext(input, signal) {
+    return queryHostRelayInvocationContext(this.endpoint, input, signal);
   }
 };
 var HostRelayIpcAdmissionPort = class {
@@ -1654,32 +1676,29 @@ var HostRelayIpcAdmissionPort = class {
 function submitHostProducerFrame(endpoint, frame, timeoutMs = 5e3) {
   return exchange(endpoint, encodeHostProducerFrame(frame), timeoutMs, decodeResponseBuffer);
 }
-async function queryHostRelayRequestBinding(endpoint, query, timeoutMs = 5e3) {
-  const request2 = encodeBindingQuery(query);
-  const response2 = await exchange(endpoint, request2, timeoutMs, decodeBindingResponseBuffer);
-  if (response2.status === "no_binding") return { status: "no_binding" };
-  return { status: "ready", binding: response2.binding };
-}
-function decodeHostRelayBindingQueryResult(value) {
-  if (!validBindingResponse(value)) throw new HostRelayIpcError("relay_unavailable", "Host Relay binding response is invalid.");
-  return value.status === "no_binding" ? { status: "no_binding" } : { status: "ready", binding: value.binding };
+function queryHostRelayInvocationContext(endpoint, query, signal) {
+  return exchange(endpoint, encodeInvocationContextQuery(query), void 0, decodeInvocationContextResponseBuffer, signal);
 }
-function queryHostRelayInvocationContext(endpoint, query, timeoutMs = 5e3) {
-  return exchange(endpoint, encodeInvocationContextQuery(query), timeoutMs, decodeInvocationContextResponseBuffer);
-}
-function exchange(endpoint, encoded, timeoutMs, decode) {
+function exchange(endpoint, encoded, timeoutMs, decode, signal) {
   return new Promise((resolve, reject) => {
     const socket = createConnection(endpoint);
     let buffer = Buffer.alloc(0);
     let settled = false;
+    const aborted = () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC was cancelled."));
     const finish = (error, response2) => {
       if (settled) return;
       settled = true;
+      signal?.removeEventListener("abort", aborted);
       socket.destroy();
       if (error !== null) reject(error);
       else if (response2 !== void 0) resolve(response2);
     };
-    socket.setTimeout(timeoutMs, () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC timed out.")));
+    if (timeoutMs !== void 0) socket.setTimeout(timeoutMs, () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC timed out.")));
+    if (signal?.aborted === true) {
+      aborted();
+      return;
+    }
+    signal?.addEventListener("abort", aborted, { once: true });
     socket.once("error", () => finish(new HostRelayIpcError("relay_unavailable", "Host Relay IPC is unavailable.")));
     socket.once("connect", () => socket.write(encoded));
     socket.on("data", (chunk) => {
@@ -1732,42 +1751,23 @@ function decodeResponseBuffer(buffer) {
   if (buffer.length !== length + HOST_RELAY_IPC_LENGTH_BYTES) throw new HostRelayIpcError("relay_unavailable", `Host Relay IPC returned trailing bytes: ${refusalFacts([{ name: "declared_bytes", value: length, expected: `the received message length minus ${HOST_RELAY_IPC_LENGTH_BYTES}` }, { name: "received_bytes", value: buffer.byteLength, expected: `exactly ${length + HOST_RELAY_IPC_LENGTH_BYTES}` }])}.`);
   return decodeHostRelayIpcResponse(buffer);
 }
-function decodeBindingResponseBuffer(buffer) {
-  const value = decodeLengthPrefixedJson(buffer, HOST_RELAY_QUERY_RESPONSE_MAX_BYTES);
-  if (value === null) return null;
-  const decoded = decodeHostRelayBindingQueryResult(value);
-  return decoded.status === "no_binding" ? { schema_version: HOST_RELAY_BINDING_RESULT_SCHEMA, status: "no_binding" } : { schema_version: HOST_RELAY_BINDING_RESULT_SCHEMA, status: "ready", binding: decoded.binding };
-}
 function decodeInvocationContextResponseBuffer(buffer) {
   const value = decodeLengthPrefixedJson(buffer, HOST_RELAY_QUERY_RESPONSE_MAX_BYTES);
   if (value === null) return null;
   if (!validInvocationContextResponse(value)) throw new HostRelayIpcError("relay_unavailable", "Host Relay invocation context response is invalid.");
   return value;
 }
-function encodeBindingQuery(query) {
-  const value = { schema_version: HOST_RELAY_BINDING_QUERY_SCHEMA, ...query };
-  if (!validBindingQueryRequest(value)) throw new HostRelayIpcError("invalid_frame_shape", "Host Relay binding query is invalid.");
-  return encodeLengthPrefixed(value);
-}
 function encodeInvocationContextQuery(query) {
   const value = { schema_version: HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA, ...query };
   if (!validInvocationContextQueryRequest(value)) throw new HostRelayIpcError("invalid_frame_shape");
   return encodeLengthPrefixed(value);
 }
-function validBindingQueryRequest(value) {
-  return validQueryIdentity(value, HOST_RELAY_BINDING_QUERY_SCHEMA) && exactKeys3(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref"]);
-}
 function validInvocationContextQueryRequest(value) {
   return validQueryIdentity(value, HOST_RELAY_INVOCATION_CONTEXT_QUERY_SCHEMA) && exactKeys3(value, ["schema_version", "producer_id", "producer_installation_ref", "local_session_ref", "local_turn_ref", "client_nonce"]) && typeof value.client_nonce === "string" && CEAL_HOST_CLIENT_NONCE_PATTERN.test(value.client_nonce);
 }
 function validQueryIdentity(value, schema) {
   return record2(value) && value.schema_version === schema && (value.producer_id === "codex" || value.producer_id === "claude") && safeRef2(value.producer_installation_ref) && safeRef2(value.local_session_ref) && safeRef2(value.local_turn_ref);
 }
-function validBindingResponse(value) {
-  if (!record2(value) || value.schema_version !== HOST_RELAY_BINDING_RESULT_SCHEMA) return false;
-  if (value.status === "no_binding") return Object.keys(value).length === 2;
-  return value.status === "ready" && Object.keys(value).length === 3 && validWireBinding(value.binding);
-}
 function validInvocationContextResponse(value) {
   if (!record2(value) || value.schema_version !== HOST_RELAY_INVOCATION_CONTEXT_RESULT_SCHEMA) return false;
   if (value.status === "no_binding") return Object.keys(value).length === 2;
@@ -1779,19 +1779,6 @@ function validInvocationContextResponse(value) {
     return false;
   }
 }
-function validWireBinding(value) {
-  if (!record2(value) || value.schema_version !== "ceal.host_relay_request_binding.v1" || value.producer_id !== "codex" && value.producer_id !== "claude") return false;
-  const required = HOST_RELAY_REQUEST_BINDING_KEYS;
-  const keys = Object.keys(value);
-  return required.every((key) => Object.hasOwn(value, key)) && keys.every((key) => required.includes(key) || key === "context_expires_at") && validWireBindingRefs(value) && validWireBindingTimes(value);
-}
-function validWireBindingRefs(value) {
-  const tuple = [value.host_source_ref, value.host_session_ref, value.host_turn_ref, value.host_input_ref];
-  return [value.producer_installation_ref, value.local_session_ref, value.local_turn_ref, value.prompt_ref, value.request_ref].every(safeRef2) && Array.isArray(value.local_turn_aliases) && value.local_turn_aliases.length <= 16 && value.local_turn_aliases.every(safeRef2) && tuple.every(safeRef2);
-}
-function validWireBindingTimes(value) {
-  return validTimestamp(value.bound_at) && (value.context_expires_at === void 0 || validTimestamp(value.context_expires_at));
-}
 function decodeLengthPrefixedJson(input, maximum) {
   if (input.length < HOST_RELAY_IPC_LENGTH_BYTES) return null;
   const length = input.readUInt32BE(0);
@@ -1817,14 +1804,12 @@ function exactKeys3(value, keys) {
 function safeRef2(value) {
   return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
 }
-function validTimestamp(value) {
-  return typeof value === "string" && Number.isFinite(Date.parse(value));
-}
 
 // host/invocation-authentication-command.ts
 var HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX = ["authenticate", "--client-nonce"];
+var REFUSAL_REASON_PATTERN = /^[a-z][a-z0-9_ ]{0,63}$/u;
 function installedHostInvocationAuthenticationCommandOptions(config) {
-  const port = new HostRelayRequestBindingPort(config.relay_endpoint, config.ipc_timeout_ms);
+  const port = new HostRelayInvocationContextPort(config.relay_endpoint);
   return {
     host_source_ref: config.host_source_ref,
     outbox_dir: config.outbox_dir,
@@ -1839,15 +1824,19 @@ async function runHostInvocationAuthenticationCommand(descriptor, args, options)
     sink = resolved.options.output_sink;
     writeResult(await authenticateHostInvocation(descriptor, resolved.input, resolved.options), sink);
     return 0;
-  } catch {
-    writeResult({ ok: false, code: "invocation_authentication_unavailable" }, sink);
+  } catch (error) {
+    writeResult({ ok: false, code: "invocation_authentication_unavailable", reason: authenticationRefusalReason(error) }, sink);
     return 2;
   }
 }
+function authenticationRefusalReason(error) {
+  const message = error instanceof Error ? error.message : "";
+  return REFUSAL_REASON_PATTERN.test(message) ? message : "unclassified";
+}
 async function authenticateHostInvocation(descriptor, input, options) {
   if (input.length !== HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX.length + 1 || input[0] !== HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX[0] || input[1] !== HOST_INVOCATION_AUTHENTICATION_COMMAND_PREFIX[1]) throw new TypeError("invalid arguments");
   const request2 = decodeCealHostInvocationAuthenticationRequest({ schema_version: CEAL_HOST_INVOCATION_AUTHENTICATION_REQUEST_SCHEMA, client_nonce: input[2] });
-  const config = validateOptions(options, descriptor.command_name);
+  const config = validateOptions(options);
   const now = (config.now ?? (() => /* @__PURE__ */ new Date()))();
   const { store, current } = await currentInvocation(descriptor, config, now);
   if (config.mint_invocation_context === void 0) throw new TypeError("mint unavailable");
@@ -1885,9 +1874,9 @@ async function resolveOptions(descriptor, args, options) {
     options: installedHostInvocationAuthenticationCommandOptions(await descriptor.read_producer_config(configPath))
   };
 }
-function validateOptions(options, commandName) {
+function validateOptions(options) {
   if (typeof options.outbox_dir !== "string" || options.outbox_dir.length === 0 || typeof options.host_source_ref !== "string" || !SAFE_REF.test(options.host_source_ref) || typeof options.producer_installation_ref !== "string" || !SAFE_REF.test(options.producer_installation_ref) || !validOptionalSession(options.session_id)) {
-    throw new TypeError(`${commandName} invocation authentication command options are invalid.`);
+    throw new TypeError("options invalid");
   }
   return options;
 }
@@ -2072,6 +2061,7 @@ function boundedMilliseconds(value) {
 import { createHash as createHash2 } from "node:crypto";
 
 // host/claude/src/claude-types.ts
+var CLAUDE_SESSION_ID_ENVIRONMENT = "CLAUDE_CODE_SESSION_ID";
 var CLAUDE_HOST_ERROR_CODES = ["invalid_input", "storage", "configuration"];
 function isClaudeHostErrorCode(value) {
   return typeof value === "string" && CLAUDE_HOST_ERROR_CODES.some((code3) => code3 === value);
@@ -2462,10 +2452,9 @@ var CLAUDE_PRODUCER_DESCRIPTOR = {
 
 // host/claude/src/claude-invocation-authentication-command.ts
 var CLAUDE_INVOCATION_AUTHENTICATION_DESCRIPTOR = {
-  command_name: "ceal-claude-invocation-authentication",
   producer_id: "claude",
   create_store: (directory) => new ClaudeOutboxStore(directory),
-  session_id_env: "CLAUDE_SESSION_ID",
+  session_id_env: CLAUDE_SESSION_ID_ENVIRONMENT,
   session_ref: (_hostSourceRef, sessionId) => claudeLocalSessionRef(sessionId),
   config_flag: HOST_PRODUCER_CONFIG_FLAG,
   parse_config_flag: parseHostProducerConfigFlag,
@@ -2498,8 +2487,6 @@ async function doctorClient(options = {}, component) {
   const contextInspection = await inspectCanonicalContext(options, executable, environment, run, component);
   if (!contextInspection.ok) return contextInspection.failure;
   const selected = contextInspection.value;
-  const readbackFailure = await inspectAuthenticatedReadback(executable, selected, environment, run, component);
-  if (readbackFailure !== null) return readbackFailure;
   return {
     ok: true,
     status: "ready",
@@ -2510,9 +2497,7 @@ async function doctorClient(options = {}, component) {
     source_tree: version.source_tree,
     context_source: "canonical_user_config",
     context_name: selected.name,
-    instance_ref: selected.instance_ref,
-    profile_ref: selected.profile_ref,
-    authenticated_readback: "profile.read"
+    instance_ref: selected.instance_ref
   };
 }
 async function inspectExecutable(options, environment, component) {
@@ -2543,16 +2528,11 @@ function probeCode(code3) {
   return "ceal_output_unreadable";
 }
 async function inspectCanonicalContext(options, executable, environment, run, component) {
-  const probe = hostClientProbe(await safeRun(run, executable.path, ["profile", "list"], environment), (result) => selectedContext(commandDocument(result)));
-  if (probe.kind === "unreachable") return probeFailure(probe, "profile list", component, options);
+  const probe = hostClientProbe(await safeRun(run, executable.path, ["access-group", "list"], environment), (result) => selectedContext(commandDocument(result)));
+  if (probe.kind === "unreachable") return probeFailure(probe, "access-group list", component, options);
   if (probe.kind !== "value" || options.expected_instance_ref !== void 0 && probe.value.instance_ref !== options.expected_instance_ref) return inspectedFailure("canonical_context_unavailable", `The ${component} Host cannot select the intended authenticated context from Ceal's canonical user configuration (${refusalFacts([{ name: "probe_kind", value: probe.kind, expected: "value" }, { name: "instance_ref", value: probe.kind === "value" ? probe.value.instance_ref : "unavailable", expected: options.expected_instance_ref ?? "a selected context" }])}).`, `Run \`ceal session adopt --email <email>\` without CEAL context overrides, then restart ${component}.`);
   return { ok: true, value: probe.value };
 }
-async function inspectAuthenticatedReadback(executable, selected, environment, run, component) {
-  const result = await safeRun(run, executable.path, ["profile", "show"], environment);
-  if (result !== null && result.exit_code === 0 && readbackProvesSelectedContext(commandDocument(result), selected)) return null;
-  return failure("gateway_context_unavailable", "The canonical Ceal context could not complete an authenticated Gateway readback.", `Inspect the structured \`ceal profile show\` failure, repair or re-adopt the context, then restart ${component} if its environment changed.`);
-}
 function inspectedFailure(code3, message, nextAction) {
   return { ok: false, failure: failure(code3, message, nextAction) };
 }
@@ -2624,25 +2604,21 @@ function commandDocument(result) {
   }
 }
 function selectedContext(value) {
-  if (value?.schema_version !== "ceal.profile.v1" || value.ok !== true || !Array.isArray(value.contexts)) return null;
+  if (value?.schema_version !== "ceal.access-group.v1" || value.ok !== true || !Array.isArray(value.contexts)) return null;
   const selected = value.contexts.filter((item) => isRecord2(item) && item.selected === true);
   if (selected.length !== 1) return null;
   return selectedContextRecord(selected[0]);
 }
 function selectedContextRecord(item) {
-  if (!isRecord2(item) || typeof item.name !== "string" || typeof item.instance_ref !== "string" || typeof item.profile_ref !== "string") return null;
-  if (!SAFE_REF6.test(item.instance_ref) || !SAFE_REF6.test(item.profile_ref)) return null;
-  return { name: item.name, instance_ref: item.instance_ref, profile_ref: item.profile_ref };
+  if (!isRecord2(item) || typeof item.name !== "string" || typeof item.instance_ref !== "string") return null;
+  if (!SAFE_REF6.test(item.instance_ref)) return null;
+  return { name: item.name, instance_ref: item.instance_ref };
 }
 function versionIdentity(value) {
   if (value?.schema_version !== "ceal.version.v1" || value.ok !== true || typeof value.version !== "string" || typeof value.source_commit !== "string" || typeof value.source_tree !== "string") return null;
   if (value.version.length === 0 || !GIT_OID.test(value.source_commit) || !GIT_OID.test(value.source_tree)) return null;
   return { version: value.version, source_commit: value.source_commit, source_tree: value.source_tree };
 }
-function readbackProvesSelectedContext(value, selected) {
-  const authority = cealAuthenticatedProfileReadback(value);
-  return authority?.instance_ref === selected.instance_ref && authority.profile_ref === selected.profile_ref;
-}
 function validExpectations(options) {
   return (options.expected_sha256 === void 0 || SHA2562.test(options.expected_sha256)) && (options.expected_source_commit === void 0 || GIT_OID.test(options.expected_source_commit)) && (options.expected_instance_ref === void 0 || SAFE_REF6.test(options.expected_instance_ref));
 }