@deepstrike/wasm 0.2.51 → 0.2.60

package/dist/providers/request-plan.d.ts

@@ -0,0 +1,87 @@
+import type { RenderedContext, ToolSchema } from "../types.js";
+export interface ProviderRequestEndpoint {
+    id: string;
+    protocol: string;
+    baseURL: string;
+}
+export interface ProviderRequestPlan {
+    providerId: string;
+    modelId: string;
+    endpoint: ProviderRequestEndpoint;
+    context: RenderedContext;
+    tools: ToolSchema[];
+    options: Record<string, unknown>;
+    fingerprint: string;
+}
+/** Stable, provider-independent fallback used when no native token meter is available. */
+export declare function estimateProviderPromptTokens(context: RenderedContext, tools: ToolSchema[]): number;
+export interface RecordedPromptMeasurement {
+    requestFingerprint: string;
+    inputTokens: number;
+    source: {
+        kind: "native";
+        provider: string;
+    } | {
+        kind: "local_exact";
+        tokenizer: string;
+    } | {
+        kind: "heuristic";
+    };
+    confidence: "exact" | "high_confidence" | "low_confidence";
+}
+export interface ProviderUsage {
+    inputTokens: number;
+    outputTokens: number;
+    cacheReadInputTokens?: number;
+    cacheCreationInputTokens?: number;
+    reasoningTokens?: number;
+}
+export interface NormalizedProviderUsage extends ProviderUsage {
+    uncachedInputTokens: number;
+}
+export interface PricingSnapshot {
+    version: string;
+    currency: string;
+    region: string;
+    effectiveFrom: string;
+    expiresAt?: string;
+    ratesPerMillion: {
+        input: number;
+        output: number;
+        cacheRead?: number;
+        cacheCreation?: number;
+        reasoning?: number;
+    };
+}
+export type CostObservation = {
+    source: "snapshot";
+    currency: string;
+    amount: number;
+    pricingVersion: string;
+} | {
+    source: "unpriced";
+    reason: "pricing_snapshot_not_effective" | "pricing_snapshot_expired" | "invalid_pricing_snapshot";
+};
+export declare function createProviderRequestPlan(input: Omit<ProviderRequestPlan, "fingerprint" | "options"> & {
+    options?: Record<string, unknown>;
+}): ProviderRequestPlan;
+export declare function createProviderRequestPlanForProvider(provider: {
+    descriptor?(): {
+        provider: string;
+        protocol: string;
+        model: string;
+    };
+    requestPlanIdentity?(): {
+        providerId?: string;
+        modelId?: string;
+        endpoint?: {
+            id?: string;
+            protocol?: string;
+            baseURL?: string;
+        };
+    };
+}, context: RenderedContext, tools: ToolSchema[], options?: Record<string, unknown>): ProviderRequestPlan;
+export declare function recordPromptMeasurement(plan: Pick<ProviderRequestPlan, "fingerprint">, measurement: Omit<RecordedPromptMeasurement, "requestFingerprint">): RecordedPromptMeasurement;
+export declare function measurementForPlan(plan: Pick<ProviderRequestPlan, "fingerprint">, record: RecordedPromptMeasurement | undefined): RecordedPromptMeasurement | undefined;
+export declare function normalizeProviderUsage(usage: ProviderUsage): NormalizedProviderUsage;
+export declare function priceProviderUsage(usage: NormalizedProviderUsage, snapshot: PricingSnapshot, observedAt?: string | Date): CostObservation;

package/dist/providers/request-plan.js

@@ -0,0 +1,153 @@
+import { sha256Hex } from "../runtime/sha256.js";
+/** Stable, provider-independent fallback used when no native token meter is available. */
+export function estimateProviderPromptTokens(context, tools) {
+    const bytes = new TextEncoder().encode(stableJson({ context, tools })).byteLength;
+    return Math.max(1, Math.ceil(bytes / 4));
+}
+const EXCLUDED = new Set(["apiKey", "api_key", "bearerToken", "bearer_token", "authorization", "credential", "credentials", "retry", "maxRetries", "baseDelay", "timeout", "signal"]);
+export function createProviderRequestPlan(input) {
+    const value = {
+        providerId: input.providerId, modelId: input.modelId, endpoint: sanitizeEndpoint(input.endpoint),
+        context: clone(input.context), tools: clone(input.tools), options: materialOptions(input.options ?? {}),
+    };
+    return { ...value, fingerprint: sha256Hex(stableJson(value)) };
+}
+export function createProviderRequestPlanForProvider(provider, context, tools, options) {
+    const descriptor = provider.descriptor?.() ?? { provider: "unknown", protocol: "unknown", model: "unknown" };
+    const identity = provider.requestPlanIdentity?.();
+    return createProviderRequestPlan({
+        providerId: identity?.providerId ?? descriptor.provider,
+        modelId: identity?.modelId ?? descriptor.model,
+        endpoint: {
+            id: identity?.endpoint?.id ?? `${descriptor.provider}.${descriptor.protocol}`,
+            protocol: identity?.endpoint?.protocol ?? descriptor.protocol,
+            baseURL: identity?.endpoint?.baseURL ?? "",
+        },
+        context, tools, options,
+    });
+}
+export function recordPromptMeasurement(plan, measurement) {
+    if (!Number.isSafeInteger(measurement.inputTokens) || measurement.inputTokens < 0)
+        throw new RangeError("inputTokens must be a non-negative safe integer");
+    return { requestFingerprint: plan.fingerprint, inputTokens: measurement.inputTokens, source: clone(measurement.source), confidence: measurement.confidence };
+}
+export function measurementForPlan(plan, record) {
+    if (!record || record.requestFingerprint !== plan.fingerprint)
+        return undefined;
+    if (!Number.isSafeInteger(record.inputTokens) || record.inputTokens < 0)
+        return undefined;
+    if (record.confidence !== "exact" && record.confidence !== "high_confidence" && record.confidence !== "low_confidence")
+        return undefined;
+    if (!record.source || typeof record.source !== "object")
+        return undefined;
+    if (record.source.kind === "native" && typeof record.source.provider === "string" && record.source.provider.length > 0)
+        return clone(record);
+    if (record.source.kind === "local_exact" && typeof record.source.tokenizer === "string" && record.source.tokenizer.length > 0)
+        return clone(record);
+    if (record.source.kind === "heuristic")
+        return clone(record);
+    return undefined;
+}
+export function normalizeProviderUsage(usage) {
+    const inputTokens = nonNegativeInteger(usage.inputTokens, "inputTokens");
+    const outputTokens = nonNegativeInteger(usage.outputTokens, "outputTokens");
+    const cacheReadInputTokens = optionalNonNegativeInteger(usage.cacheReadInputTokens, "cacheReadInputTokens");
+    const cacheCreationInputTokens = optionalNonNegativeInteger(usage.cacheCreationInputTokens, "cacheCreationInputTokens");
+    const reasoningTokens = optionalNonNegativeInteger(usage.reasoningTokens, "reasoningTokens");
+    const cached = (cacheReadInputTokens ?? 0) + (cacheCreationInputTokens ?? 0);
+    if (cached > inputTokens)
+        throw new RangeError("cache token subsets cannot exceed inputTokens");
+    if (reasoningTokens !== undefined && reasoningTokens > outputTokens)
+        throw new RangeError("reasoningTokens must be a subset of outputTokens");
+    return {
+        inputTokens,
+        uncachedInputTokens: inputTokens - cached,
+        outputTokens,
+        ...(cacheReadInputTokens !== undefined ? { cacheReadInputTokens } : {}),
+        ...(cacheCreationInputTokens !== undefined ? { cacheCreationInputTokens } : {}),
+        ...(reasoningTokens !== undefined ? { reasoningTokens } : {}),
+    };
+}
+export function priceProviderUsage(usage, snapshot, observedAt = new Date()) {
+    const at = typeof observedAt === "string" ? new Date(observedAt) : observedAt;
+    const from = new Date(snapshot.effectiveFrom);
+    const expires = snapshot.expiresAt ? new Date(snapshot.expiresAt) : undefined;
+    const rates = snapshot.ratesPerMillion;
+    const requiredRates = [rates.input, rates.output];
+    if (!snapshot.version || !snapshot.currency || Number.isNaN(at.valueOf()) || Number.isNaN(from.valueOf())
+        || requiredRates.some(rate => typeof rate !== "number" || !Number.isFinite(rate) || rate < 0)
+        || Object.values(rates).some(rate => typeof rate !== "number" || !Number.isFinite(rate) || rate < 0)) {
+        return { source: "unpriced", reason: "invalid_pricing_snapshot" };
+    }
+    if (at < from)
+        return { source: "unpriced", reason: "pricing_snapshot_not_effective" };
+    if (expires && (Number.isNaN(expires.valueOf()) || at >= expires))
+        return { source: "unpriced", reason: "pricing_snapshot_expired" };
+    const amount = (usage.uncachedInputTokens * rates.input
+        + usage.outputTokens * rates.output
+        + (usage.cacheReadInputTokens ?? 0) * (rates.cacheRead ?? rates.input)
+        + (usage.cacheCreationInputTokens ?? 0) * (rates.cacheCreation ?? rates.input)
+        + (usage.reasoningTokens ?? 0) * (rates.reasoning ?? 0)) / 1_000_000;
+    return { source: "snapshot", currency: snapshot.currency, amount, pricingVersion: snapshot.version };
+}
+function materialOptions(options) {
+    return sanitizeMaterialValue(options);
+}
+function sanitizeEndpoint(endpoint) {
+    try {
+        const url = new URL(endpoint.baseURL);
+        url.username = "";
+        url.password = "";
+        url.search = "";
+        url.hash = "";
+        return { ...clone(endpoint), baseURL: url.toString().replace(/\/$/, "") };
+    }
+    catch {
+        return { ...clone(endpoint), baseURL: "" };
+    }
+}
+function sanitizeMaterialValue(value) {
+    if (value === undefined || typeof value === "function")
+        return undefined;
+    if (Array.isArray(value))
+        return value.map(sanitizeMaterialValue).filter(item => item !== undefined);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.keys(value).sort().flatMap(key => {
+            if (EXCLUDED.has(key) || isTransportOnlyKey(key))
+                return [];
+            const sanitized = sanitizeMaterialValue(value[key]);
+            return sanitized === undefined ? [] : [[key, sanitized]];
+        }));
+    }
+    return value;
+}
+function isTransportOnlyKey(key) {
+    const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+    return normalized.includes("authorization") || normalized.includes("credential")
+        || normalized.includes("accesstoken") || normalized.includes("refreshtoken")
+        || normalized.includes("apikey") || normalized === "bearer" || normalized === "token"
+        || normalized === "secret" || normalized === "xapikey";
+}
+function stableJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(",")}]`;
+    const object = value;
+    return `{${Object.keys(object).sort().map(key => `${JSON.stringify(key)}:${stableJson(object[key])}`).join(",")}}`;
+}
+function clone(value) {
+    if (value === undefined || value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map(clone);
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, clone(item)]));
+}
+function nonNegativeInteger(value, name) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new RangeError(`${name} must be a non-negative safe integer`);
+    return value;
+}
+function optionalNonNegativeInteger(value, name) {
+    return value === undefined ? undefined : nonNegativeInteger(value, name);
+}

package/dist/providers/stop-reason.d.ts

@@ -0,0 +1,5 @@
+export type CanonicalStopReason = "end_turn" | "tool_use" | "max_tokens" | "stop_sequence" | "content_filter" | "other";
+/** Validates the closed, provider-normalized stop-reason contract. */
+export declare function decodeCanonicalStopReason(value: unknown): CanonicalStopReason;
+/** Normalize an open-ended provider value into the closed runtime contract. */
+export declare function normalizeProviderStopReason(value: unknown): CanonicalStopReason;

package/dist/providers/stop-reason.js

@@ -0,0 +1,24 @@
+const KNOWN = new Set([
+    "end_turn",
+    "tool_use",
+    "max_tokens",
+    "stop_sequence",
+    "content_filter",
+    "other",
+]);
+/** Validates the closed, provider-normalized stop-reason contract. */
+export function decodeCanonicalStopReason(value) {
+    if (typeof value !== "string" || !KNOWN.has(value)) {
+        throw new RangeError(`unknown canonical stop reason: ${String(value)}`);
+    }
+    return value;
+}
+/** Normalize an open-ended provider value into the closed runtime contract. */
+export function normalizeProviderStopReason(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new RangeError(`invalid provider stop reason: ${String(value)}`);
+    }
+    return KNOWN.has(value)
+        ? value
+        : "other";
+}

package/dist/runtime/canonical-kernel-step.d.ts

@@ -30,6 +30,10 @@ export interface CanonicalTransition {
     recordDigest: string;
     plannedStep: CanonicalPlannedStep;
     checkpointAdvice?: Record<string, unknown>;
+    /** Set when the advised §12.3 checkpoint failed AFTER this step was durably committed.
+     *  The step itself is published and authoritative; the checkpoint is deferred
+     *  housekeeping retried at the next advice or forced by the checkpoint_required gate. */
+    checkpointFailure?: string;
     replayed: boolean;
 }
 export declare function canonicalUnsupportedEffectResolution(effectId: string, effectKind: string): CanonicalKernelInput;
@@ -44,8 +48,13 @@ export declare class CanonicalKernelRejectedError extends Error {
  * is therefore a rebuild boundary, never an abort boundary.
  */
 export declare class CanonicalKernelRebuildRequiredError extends Error {
+    /** True when the runtime was already rebuilt from the journal with the durable record
+     *  applied — the caller can resync and continue. False when the rebuild itself failed
+     *  and the operation cannot proceed without journal repair. */
+    readonly rebuilt: boolean;
     constructor(message: string, options?: {
         cause?: unknown;
+        rebuilt?: boolean;
     });
 }
 /**
@@ -85,13 +94,9 @@ export interface CanonicalRunnerRuntimeOptions {
     }>;
 }
 export declare function sha256(value: string): string;
-/** Small synchronous SHA-256 for Worker/browser hosts (no node:crypto). */
-declare function syncSha256(value: string): string;
-export { syncSha256 as sha256Hex };
 /**
  * Canonical operation runtime used by the WASM host.
- * Every durable transition below is one of the canonical ABI's five input classes; no legacy
- * envelope or synthesized host transaction reaches core or storage.
+ * Every durable transition below is one of the canonical contract's five input classes.
  */
 export declare class CanonicalRunnerRuntime {
     private readonly options;
@@ -144,3 +149,4 @@ export declare function canonicalKernelAction(runtime: CanonicalRunnerRuntime, p
 export declare function canonicalStartAgent(runtime: CanonicalRunnerRuntime, pending: KernelObservationLike[], task: Record<string, unknown>, runSpec?: Record<string, unknown>): Promise<KernelRunnerAction>;
 export declare function canonicalStartWorkflow(runtime: CanonicalRunnerRuntime, pending: KernelObservationLike[], spec: Record<string, unknown>): Promise<KernelRunnerAction | null>;
 type KernelObservationLike = KernelObservation;
+export {};

package/dist/runtime/canonical-kernel-step.js

@@ -1,4 +1,5 @@
-import { kernelAbiVersion } from "@deepstrike/wasm-kernel";
+import { normalizeProviderStopReason } from "../providers/stop-reason.js";
+import { sha256Hex } from "./sha256.js";
 import { JournalCasConflictError, MAX_CHAIN_POSITION as JOURNAL_MAX_CHAIN_POSITION, } from "./kernel-journal.js";
 import { encodeCanonicalContentParts, kernelMessageToSdk, renderedContextToSdk, } from "./kernel-step.js";
 export const MAX_CHAIN_POSITION = JOURNAL_MAX_CHAIN_POSITION;
@@ -281,9 +282,14 @@ export class CanonicalKernelRejectedError extends Error {
  * is therefore a rebuild boundary, never an abort boundary.
  */
 export class CanonicalKernelRebuildRequiredError extends Error {
+    /** True when the runtime was already rebuilt from the journal with the durable record
+     *  applied — the caller can resync and continue. False when the rebuild itself failed
+     *  and the operation cannot proceed without journal repair. */
+    rebuilt;
     constructor(message, options) {
-        super(message, options);
+        super(message, options?.cause !== undefined ? { cause: options.cause } : undefined);
         this.name = "CanonicalKernelRebuildRequiredError";
+        this.rebuilt = options?.rebuilt ?? false;
     }
 }
 function chainPosition(value, label) {
@@ -338,7 +344,6 @@ export class CanonicalKernelHost {
     }
     async transition(input, options = {}) {
         const inputJson = JSON.stringify({
-            abi_version: kernelAbiVersion(),
             operation_id: this.operationId,
             input_id: options.inputId ?? `wasm-input-${crypto.randomUUID()}`,
             observed_at_ms: options.observedAtMs ?? String(Date.now()),
@@ -434,6 +439,7 @@ export class CanonicalKernelHost {
         }
         const stepSeq = chainPosition(preparation.stepSeq, "prepared stepSeq");
         let appended = false;
+        let transition;
         try {
             const receipt = await this.journal.compareAndAppend(this.operationId, preparation.expectedHead, {
                 step_seq: stepSeq,
@@ -447,7 +453,7 @@ export class CanonicalKernelHost {
                 throw new Error("canonical commit receipt disagrees with the durably appended record");
             }
             const checkpointAdvice = parseAdvice(committed.checkpointAdviceJson);
-            const transition = {
+            transition = {
                 inputJson,
                 stepSeq,
                 recordDigest: committed.recordDigest,
@@ -455,9 +461,6 @@ export class CanonicalKernelHost {
                 ...(checkpointAdvice ? { checkpointAdvice } : {}),
                 replayed: false,
             };
-            if (checkpointAdvice)
-                await this.checkpoint();
-            return transition;
         }
         catch (error) {
             if (appended) {
@@ -467,7 +470,7 @@ export class CanonicalKernelHost {
                 catch (restoreError) {
                     throw new CanonicalKernelRebuildRequiredError("canonical record is durable, commit failed, and journal rebuild also failed", { cause: new AggregateError([error, restoreError]) });
                 }
-                throw new CanonicalKernelRebuildRequiredError("canonical record is durable but commit could not be published; runtime rebuilt from journal", { cause: error });
+                throw new CanonicalKernelRebuildRequiredError("canonical record is durable but commit could not be published; runtime rebuilt from journal", { cause: error, rebuilt: true });
             }
             try {
                 this.kernel.abort(preparation.prepareToken);
@@ -481,6 +484,19 @@ export class CanonicalKernelHost {
             }
             throw error;
         }
+        // Past this point the step is durable AND committed. A failing advised checkpoint
+        // must not be misdiagnosed as a lost commit: it is deferred housekeeping — the next
+        // advice retries it, and the checkpoint_required prepare gate is the hard backstop.
+        if (transition.checkpointAdvice) {
+            try {
+                await this.checkpoint();
+            }
+            catch (checkpointError) {
+                transition.checkpointFailure =
+                    checkpointError instanceof Error ? checkpointError.message : String(checkpointError);
+            }
+        }
+        return transition;
     }
 }
 function canonicalProviderMessage(raw) {
@@ -575,7 +591,7 @@ function logicalRunSpec(raw, goal) {
         ...(raw.metadata && typeof raw.metadata === "object" ? { metadata: raw.metadata } : {}),
     };
 }
-function canonicalWorkflowSpec(raw) {
+function canonicalWorkflowSpec(raw, allowHostSchedulingFactors = false) {
     const nodes = Array.isArray(raw.nodes) ? raw.nodes.map(asObject) : [];
     const nodeIds = nodes.map((_node, index) => `wf-node${index}`);
     return {
@@ -598,6 +614,9 @@ function canonicalWorkflowSpec(raw) {
                 unsupported.push("max_turns");
             if (node.max_wall_ms !== undefined || node.maxWallMs !== undefined)
                 unsupported.push("max_wall_ms");
+            const schedulingFactors = node.scheduling_factors ?? node.schedulingFactors;
+            if (schedulingFactors !== undefined && !allowHostSchedulingFactors)
+                unsupported.push("scheduling_factors");
             const inheritance = node.context_inheritance ?? node.contextInheritance;
             if (unsupported.length > 0) {
                 throw new CanonicalKernelRejectedError(JSON.stringify({
@@ -618,16 +637,20 @@ function canonicalWorkflowSpec(raw) {
                 : [];
             const modelHint = node.model_hint ?? node.modelHint;
             const outputSchema = node.output_schema ?? node.outputSchema;
+            const canonicalSchedulingFactors = schedulingFactors === undefined
+                ? undefined
+                : canonicalSchedulingFactorsForHost(schedulingFactors);
             const runSpec = logicalRunSpec({
                 goal,
                 ...(node.role ? { role: node.role } : {}),
                 ...(node.isolation ? { isolation: node.isolation } : {}),
                 ...(inheritance ? { context_inheritance: inheritance } : {}),
-                ...((modelHint !== undefined || outputSchema !== undefined)
+                ...((modelHint !== undefined || outputSchema !== undefined || canonicalSchedulingFactors !== undefined)
                     ? {
                         metadata: {
                             ...(modelHint !== undefined ? { model_hint: modelHint } : {}),
                             ...(outputSchema !== undefined ? { output_schema: outputSchema } : {}),
+                            ...(canonicalSchedulingFactors !== undefined ? { scheduling_factors: canonicalSchedulingFactors } : {}),
                         },
                     }
                     : {}),
@@ -645,62 +668,35 @@ function canonicalWorkflowSpec(raw) {
         }),
     };
 }
-export function sha256(value) {
-    return syncSha256(value);
-}
-/** Small synchronous SHA-256 for Worker/browser hosts (no node:crypto). */
-function syncSha256(value) {
-    const encoder = new TextEncoder();
-    const input = encoder.encode(value);
-    const bitLength = input.length * 8;
-    const length = ((input.length + 9 + 63) >> 6) << 6;
-    const data = new Uint8Array(length);
-    data.set(input);
-    data[input.length] = 0x80;
-    new DataView(data.buffer).setUint32(length - 4, bitLength >>> 0, false);
-    const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
-    const k = [0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3, 0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2];
-    const ror = (x, n) => (x >>> n) | (x << (32 - n));
-    for (let offset = 0; offset < data.length; offset += 64) {
-        const w = new Uint32Array(64);
-        const view = new DataView(data.buffer, offset, 64);
-        for (let i = 0; i < 16; i++)
-            w[i] = view.getUint32(i * 4, false);
-        for (let i = 16; i < 64; i++) {
-            w[i] = (w[i - 16] + (ror(w[i - 15], 7) ^ ror(w[i - 15], 18) ^ (w[i - 15] >>> 3)) + w[i - 7] + (ror(w[i - 2], 17) ^ ror(w[i - 2], 19) ^ (w[i - 2] >>> 10))) >>> 0;
+function canonicalSchedulingFactorsForHost(value) {
+    const raw = asObject(value);
+    const allowed = new Set(["deadline_urgency", "process_priority", "resource_pressure", "budget_pressure"]);
+    const unknown = Object.keys(raw).filter(key => !allowed.has(key));
+    if (unknown.length > 0)
+        throw new TypeError(`unknown scheduling factor(s): ${unknown.join(", ")}`);
+    const factors = {};
+    for (const key of allowed) {
+        const factor = raw[key];
+        if (factor === undefined)
+            continue;
+        if (!Number.isSafeInteger(factor) || factor < 0) {
+            throw new RangeError(`scheduling_factors.${key} must be a non-negative safe integer`);
         }
-        let [a, b, c, d, e, f, g, hh] = h;
-        for (let i = 0; i < 64; i++) {
-            const t1 = (hh + (ror(e, 6) ^ ror(e, 11) ^ ror(e, 25)) + ((e & f) ^ ((~e) & g)) + k[i] + w[i]) >>> 0;
-            const t2 = ((ror(a, 2) ^ ror(a, 13) ^ ror(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
-            hh = g;
-            g = f;
-            f = e;
-            e = (d + t1) >>> 0;
-            d = c;
-            c = b;
-            b = a;
-            a = (t1 + t2) >>> 0;
-        }
-        for (let i = 0; i < 8; i++)
-            h[i] = (h[i] + [a, b, c, d, e, f, g, hh][i]) >>> 0;
+        factors[key] = factor;
     }
-    return `sha256:${Array.from(h, word => word.toString(16).padStart(8, "0")).join("")}`;
+    return factors;
+}
+export function sha256(value) {
+    return sha256Hex(value);
 }
-export { syncSha256 as sha256Hex };
 function providerStopReason(value) {
-    if (typeof value !== "string" || value.length === 0)
+    if (value === undefined || value === null || value === "")
         return undefined;
-    const normalized = value.toLowerCase();
-    if (["end_turn", "tool_use", "max_tokens", "stop_sequence", "content_filter"].includes(normalized)) {
-        return normalized;
-    }
-    return "other";
+    return normalizeProviderStopReason(value);
 }
 /**
  * Canonical operation runtime used by the WASM host.
- * Every durable transition below is one of the canonical ABI's five input classes; no legacy
- * envelope or synthesized host transaction reaches core or storage.
+ * Every durable transition below is one of the canonical contract's five input classes.
  */
 export class CanonicalRunnerRuntime {
     options;
@@ -826,7 +822,7 @@ export class CanonicalRunnerRuntime {
             kind: "start_operation",
             entry: {
                 kind: "workflow",
-                spec: canonicalWorkflowSpec(specValue),
+                spec: canonicalWorkflowSpec(specValue, true),
             },
             initial_context: this.initialContext,
         });
@@ -880,7 +876,8 @@ export class CanonicalRunnerRuntime {
             }
             case "provider_error": {
                 const message = String(event.message ?? "");
-                const contextOverflow = /context|token.*limit|too long/i.test(message);
+                const errorKind = typeof event.error_kind === "string" ? event.error_kind : "unknown";
+                const contextOverflow = errorKind === "context_overflow";
                 input = contextOverflow
                     ? {
                         kind: "resolve_effect",
@@ -890,7 +887,11 @@ export class CanonicalRunnerRuntime {
                             result: { kind: "provider", outcome: { kind: "context_overflow" } },
                         },
                     }
-                    : this.failedEffect(event, "transport_exhausted", message, true);
+                    : this.failedEffect(event, ["transport", "rate_limit", "model_unavailable"].includes(errorKind)
+                        ? "transport_exhausted"
+                        : ["auth", "invalid_request", "modality", "protocol"].includes(errorKind)
+                            ? "protocol_error"
+                            : "unknown", message, typeof event.retryable === "boolean" ? event.retryable : false);
                 break;
             }
             case "tool_results": {
@@ -1140,22 +1141,45 @@ export class CanonicalRunnerRuntime {
     async commit(input) {
         let nextInput = input;
         for (;;) {
-            const transition = await this.host.transition(nextInput);
-            if (!transition.replayed) {
-                for (const raw of transition.plannedStep.observations ?? []) {
-                    const kind = String(raw.kind ?? "");
-                    if (!kind)
-                        throw new Error("canonical observation is missing kind");
-                    this.hostObservations.push({ ...raw, kind });
-                }
-                if (transition.checkpointAdvice) {
-                    this.hostObservations.push({
-                        kind: "checkpoint_advised",
-                        ...transition.checkpointAdvice,
-                    });
+            let transition;
+            try {
+                transition = await this.host.transition(nextInput);
+            }
+            catch (error) {
+                if (!(error instanceof CanonicalKernelRebuildRequiredError) || !error.rebuilt)
+                    throw error;
+                // The input's record is durable and the kernel was rebuilt from the journal with it
+                // applied; only that step's observations are lost (the crash-window cost). Resync and
+                // publish the rebuilt kernel's pending work instead of failing a healthy run.
+                const lifecycle = this.host.kernel.lifecycle();
+                this.configured = lifecycle !== "created";
+                this.started = !["created", "configured"].includes(lifecycle);
+                this.hostObservations.push({ kind: "kernel_rebuilt", reason: error.message });
+                this.lastAction = this.currentAction();
+            }
+            if (transition) {
+                if (!transition.replayed) {
+                    for (const raw of transition.plannedStep.observations ?? []) {
+                        const kind = String(raw.kind ?? "");
+                        if (!kind)
+                            throw new Error("canonical observation is missing kind");
+                        this.hostObservations.push({ ...raw, kind });
+                    }
+                    if (transition.checkpointAdvice) {
+                        this.hostObservations.push({
+                            kind: "checkpoint_advised",
+                            ...transition.checkpointAdvice,
+                        });
+                    }
+                    if (transition.checkpointFailure) {
+                        this.hostObservations.push({
+                            kind: "checkpoint_deferred",
+                            reason: transition.checkpointFailure,
+                        });
+                    }
                 }
+                this.lastAction = canonicalActionFromPlannedStep(transition.plannedStep);
             }
-            this.lastAction = canonicalActionFromPlannedStep(transition.plannedStep);
             if (this.lastAction?.kind !== "unsupported_effect")
                 return this.lastAction;
             nextInput = canonicalUnsupportedEffectResolution(this.lastAction.effectId, this.lastAction.effectKind);
@@ -1426,9 +1450,6 @@ export class CanonicalRunnerRuntime {
             delete asObject(execution.entropy_watch).threshold;
             delete asObject(execution.entropy_watch).hysteresis;
         }
-        if (config.tool_dispatch_gate !== undefined) {
-            this.featurePolicy().tool_dispatch_gate = config.tool_dispatch_gate;
-        }
         if (config.knowledge_budget_ratio !== undefined) {
             const context = asObject(this.config.context_policy);
             context.knowledge_budget_ppm = Math.round(Number(config.knowledge_budget_ratio) * 1_000_000);