@lensagent/core 0.1.1 → 0.1.2

package/dist/contracts/capability.d.ts

@@ -8,25 +8,34 @@ export interface CapabilityDefinition {
     readonly effect: EffectScope;
     readonly adapterId: string;
     readonly loadMode: 'eager' | 'deferred';
+    /** Adapter metadata, not a universal byte cap; concrete adapters enforce their own limits. */
     readonly outputLimitBytes: number;
     readonly defaultAssignment?: 'all_new_agents' | 'configured' | 'none';
-    readonly kind?: 'tool' | 'command' | 'skill';
+    readonly kind?: 'tool' | 'slash_command' | 'skill';
     readonly promptText?: string;
 }
 export interface CapabilityInvocation {
     readonly callId: string;
+    readonly taskId?: string;
     readonly projectId: string;
     readonly agentId: string | null;
     readonly capabilityId: string;
     readonly arguments: Json;
+    readonly continuation?: {
+        readonly prompt?: Json;
+        readonly answer?: Json;
+    };
     readonly workspacePaths: readonly string[];
     readonly workspaceId: string;
     readonly fullAccess?: boolean;
     readonly signal: AbortSignal;
 }
+export type CaptureStatus = 'complete' | 'partial' | 'unknown';
 export interface CapabilityOutput {
+    readonly capture?: CaptureStatus;
     readonly content: Json;
     readonly artifacts?: readonly ArtifactOutput[];
+    readonly artifactReferences?: readonly string[];
     readonly outcome?: 'success' | 'failed';
     readonly errorCode?: string;
 }
@@ -35,6 +44,23 @@ export interface ArtifactOutput {
     readonly mediaType: string;
     readonly bytes: Uint8Array;
 }
+/** Non-PTC Result view shared by automatic Yield and manual Include. */
+export type ResultEnvelope = {
+    readonly result_id: string;
+    readonly call_id: string;
+    readonly outcome: string;
+    readonly outcome_unknown: boolean;
+    readonly error_code: string | null;
+    readonly error_message: string | null;
+    readonly content: Json;
+    readonly artifacts: readonly string[];
+    readonly truncated: boolean;
+    readonly payload: {
+        readonly capture: CaptureStatus;
+        readonly stored: 'full' | 'unknown';
+        readonly view: 'full' | 'preview';
+    };
+};
 export interface CapabilityAdapter {
     readonly id: string;
     execute(invocation: CapabilityInvocation): Promise<CapabilityOutput>;

package/dist/contracts/domain.d.ts

@@ -10,6 +10,7 @@ export type WaitReason = 'user_input' | 'policy_review';
 export type Policy = 'read_only' | 'workspace_write' | 'external' | 'ask' | 'auto_approve' | 'full_access';
 export type EffectScope = 'read_only' | 'workspace_write' | 'external' | 'full';
 export interface TrustedIngress {
+    readonly strongTrust: boolean;
     readonly source: 'user';
     readonly clientId: string;
     readonly transport: 'http' | 'https';

package/dist/contracts/model.d.ts

@@ -1,7 +1,17 @@
 import type { Json } from './domain.js';
+import type { AssistantModelMessage } from 'ai';
+/** Completed, ordered SDK content; signatures and encrypted state remain opaque. */
+export interface ModelResponse {
+    readonly route: string;
+    readonly content: Exclude<AssistantModelMessage['content'], string>;
+}
 export interface ModelMessage {
     readonly role: 'system' | 'user' | 'assistant' | 'tool';
     readonly content: string;
+    readonly response?: ModelResponse;
+    readonly images?: readonly ModelImage[];
+    readonly contextItemId?: string;
+    readonly metadata?: Readonly<Record<string, Json>>;
     readonly toolCallId?: string;
     readonly toolName?: string;
     readonly toolCalls?: readonly {
@@ -10,6 +20,10 @@ export interface ModelMessage {
         readonly arguments: Json;
     }[];
 }
+export interface ModelImage {
+    readonly projectId: string;
+    readonly artifactId: string;
+}
 export interface ModelTool {
     readonly id: string;
     readonly description: string;
@@ -23,21 +37,31 @@ export interface ModelToolBridgeInput {
     readonly ordinal: number;
     readonly parentProviderCallId?: string;
 }
-export interface ProgrammaticToolCalling {
-    readonly capabilityIds: readonly string[];
-    readonly maxToolCalls: number;
-    execute(input: ModelToolBridgeInput, signal: AbortSignal | undefined): Promise<Json>;
-}
 export interface ModelRequest {
+    readonly auditContext?: {
+        readonly projectId: string;
+        readonly taskId?: string;
+        readonly agentId?: string;
+        readonly callId?: string;
+        readonly attemptId?: string;
+        readonly purpose: 'agent' | 'compaction' | 'auto-review';
+    };
     readonly model: string;
+    readonly cacheIdentity?: string;
+    readonly toolChoice?: 'none';
     readonly messages: readonly ModelMessage[];
     readonly tools: readonly ModelTool[];
     readonly reasoningEffort: string | null;
     readonly maxOutputTokens?: number;
-    readonly programmaticToolCalling?: ProgrammaticToolCalling;
     readonly signal: AbortSignal;
 }
 export type ModelStreamEvent = {
+    readonly type: 'response';
+    readonly response: ModelResponse;
+} | {
+    readonly type: 'providerWarnings';
+    readonly warnings: Json;
+} | {
     readonly type: 'text';
     readonly text: string;
 } | {
@@ -68,6 +92,9 @@ export type ModelStreamEvent = {
     readonly type: 'usage';
     readonly inputTokens: number;
     readonly outputTokens: number;
+    readonly cacheReadTokens?: number;
+    readonly cacheWriteTokens?: number;
+    readonly uncachedInputTokens?: number;
 } | {
     readonly type: 'end';
     readonly reason: string;

package/dist/contracts/review.d.ts

@@ -0,0 +1,17 @@
+import type { Json } from '../core/domain.js';
+export interface ReviewContext {
+    readonly authorization: readonly Json[];
+    readonly workspacePaths: readonly string[];
+    readonly evidence: readonly Json[];
+}
+export type AutoReviewResult = {
+    readonly status: 'reviewed';
+    readonly risk_level: 'low' | 'medium' | 'high' | 'critical';
+    readonly user_authorization: 'unknown' | 'low' | 'medium' | 'high';
+    readonly outcome: 'allow' | 'deny';
+    readonly rationale: string;
+} | {
+    readonly status: 'failed';
+    readonly error_code: string;
+    readonly rationale: string;
+};

package/dist/contracts/review.js

@@ -0,0 +1 @@
+export {};

package/dist/core/access-policy.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Who may be approved without a person deciding.
+ *
+ * Separate from the store that applies it so the rule can be read and tested on its own. It governs access to
+ * Sessions, Providers and every file Capability Core exposes, which is not a decision to leave implicit in the
+ * middle of a request handler.
+ */
+/**
+ * Whether a socket address is on this machine.
+ *
+ * Must be given the raw socket address. A forwarded header is supplied by the caller, so deriving locality from
+ * one would let anyone claim it.
+ */
+export declare function loopbackAddress(address: string | undefined): boolean;
+/**
+ * Whether the request reached Core through something else.
+ *
+ * This is what stops a relay from lending its own locality to whoever is behind it. Facet's host proxies browser
+ * traffic to Core from loopback, so without this every caller that can reach Facet -- from any machine -- would
+ * look local to Core and be approved automatically.
+ *
+ * Presence is the whole test, and it does not matter whether the header can be trusted. A relay that sets it
+ * honestly is excluded, and a caller that forges one only manages to exclude itself.
+ */
+export declare function isRelayed(headers: Readonly<Record<string, unknown>>): boolean;
+/**
+ * Whether an unknown caller may be approved on first contact.
+ *
+ * Three conditions, each earning its place.
+ *
+ * The connection comes from this machine, judged by the socket rather than by anything the caller can set.
+ *
+ * It identifies itself as a native component. Loopback alone is not enough, because a web page can reach
+ * 127.0.0.1 and a browser fingerprint is whatever the other end says it is. A local process running as this user
+ * could already read the same files directly, so granting it access adds no exposure; a browser is not in that
+ * position, and still needs a person.
+ *
+ * Nothing relayed the request. Otherwise Facet's proxy would extend its own locality to every caller behind it.
+ */
+export declare function qualifiesForAutoApproval(kind: 'native' | 'browser', peerAddress: string | undefined, headers: Readonly<Record<string, unknown>>): boolean;

package/dist/core/access-policy.js

@@ -0,0 +1,68 @@
+/**
+ * Who may be approved without a person deciding.
+ *
+ * Separate from the store that applies it so the rule can be read and tested on its own. It governs access to
+ * Sessions, Providers and every file Capability Core exposes, which is not a decision to leave implicit in the
+ * middle of a request handler.
+ */
+/**
+ * Whether a socket address is on this machine.
+ *
+ * Must be given the raw socket address. A forwarded header is supplied by the caller, so deriving locality from
+ * one would let anyone claim it.
+ */
+export function loopbackAddress(address) {
+    // Absent for a non-IP socket. Refusing is the safe answer: the caller cannot be shown to be local.
+    if (address === undefined)
+        return false;
+    // A dual-stack listener reports an IPv4 peer as `::ffff:127.0.0.1`.
+    const normalized = (address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address).toLowerCase();
+    if (normalized === '::1')
+        return true;
+    // Every octet checked rather than just the `127.` prefix, so nothing that merely begins with it can pass. Node
+    // reports addresses and not names, so `127.0.0.1.example.com` cannot arrive here -- but this decides who
+    // reaches the API, and a rule that would accept such a string if it ever could is not one to keep.
+    const octets = normalized.split('.');
+    if (octets.length !== 4)
+        return false;
+    if (!octets.every((octet) => /^\d{1,3}$/u.test(octet) && Number(octet) <= 255))
+        return false;
+    return octets[0] === '127';
+}
+/** Headers that mean something forwarded this request rather than originating it. */
+const RELAY_HEADERS = ['x-forwarded-for', 'x-forwarded-host', 'x-forwarded-proto', 'x-forwarded-port', 'forwarded', 'via'];
+/**
+ * Whether the request reached Core through something else.
+ *
+ * This is what stops a relay from lending its own locality to whoever is behind it. Facet's host proxies browser
+ * traffic to Core from loopback, so without this every caller that can reach Facet -- from any machine -- would
+ * look local to Core and be approved automatically.
+ *
+ * Presence is the whole test, and it does not matter whether the header can be trusted. A relay that sets it
+ * honestly is excluded, and a caller that forges one only manages to exclude itself.
+ */
+export function isRelayed(headers) {
+    return RELAY_HEADERS.some((name) => {
+        const value = headers[name];
+        if (typeof value === 'string')
+            return value.trim() !== '';
+        return Array.isArray(value) && value.length > 0;
+    });
+}
+/**
+ * Whether an unknown caller may be approved on first contact.
+ *
+ * Three conditions, each earning its place.
+ *
+ * The connection comes from this machine, judged by the socket rather than by anything the caller can set.
+ *
+ * It identifies itself as a native component. Loopback alone is not enough, because a web page can reach
+ * 127.0.0.1 and a browser fingerprint is whatever the other end says it is. A local process running as this user
+ * could already read the same files directly, so granting it access adds no exposure; a browser is not in that
+ * position, and still needs a person.
+ *
+ * Nothing relayed the request. Otherwise Facet's proxy would extend its own locality to every caller behind it.
+ */
+export function qualifiesForAutoApproval(kind, peerAddress, headers) {
+    return kind === 'native' && loopbackAddress(peerAddress) && !isRelayed(headers);
+}

package/dist/core/access.d.ts

@@ -15,10 +15,38 @@ export declare class PairStore {
     get metadataRevision(): number;
     get pairDigest(): string;
     load(): Promise<void>;
-    start(onError?: (error: Error) => void): void;
+    start(onError?: (error: Error) => void, onReload?: () => void): void;
     close(): void;
     identify(headers: Headers): Identity;
-    authorize(headers: Headers, transport: 'http' | 'https', correlationId: string): Promise<TrustedIngress>;
+    /**
+     * Decides whether a caller may proceed.
+     *
+     * A component running on this machine is admitted without anyone pairing it by hand. Judged on three things,
+     * each doing work: the connection arrives on loopback, the caller identifies itself as native, and nothing
+     * relayed the request. What the pair file can defend is the reasoning -- a local process running as this user
+     * could read the same files and run the same tools directly, so refusing it protects nothing, while a caller
+     * from another machine and a browser still require a person.
+     *
+     * A browser is excluded however local it is, because a page can reach 127.0.0.1 and a fingerprint is whatever
+     * the other end claims. Relayed requests are excluded because Facet proxies browser traffic from loopback, so
+     * without that condition Facet would lend its locality to every caller behind it.
+     *
+     * `strongTrust` is deliberately not granted this way. Raw configuration holds Provider credentials, and
+     * reaching it still requires a credential somebody issued on purpose, so the exemption buys ordinary API
+     * access and nothing more.
+     *
+     * `peerAddress` must be the raw socket address. A forwarded header is supplied by the caller, so locality
+     * derived from one would be locality anyone could claim.
+     */
+    authorize(headers: Headers, transport: 'http' | 'https', correlationId: string, registerUnknown?: boolean, peerAddress?: string): Promise<TrustedIngress>;
+    requireStrong(headers: Headers): Promise<void>;
+    document(): Promise<{
+        content: string;
+        file_digest: string;
+    }>;
+    replace(source: string, expectedDigest: string, headers: Headers): Promise<void>;
+    /** Local administration only: the credential is returned once, never stored in plaintext. */
+    issueCredential(clientId: string, strongTrust: boolean): Promise<string>;
     reload(): Promise<void>;
 }
 export {};

package/dist/core/access.js

@@ -1,9 +1,10 @@
-import { createHash, randomUUID } from 'node:crypto';
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { watch } from 'node:fs';
-import { mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { basename, dirname, resolve } from 'node:path';
 import { digest, now } from './codec.js';
 import { fail } from './domain.js';
+import { qualifiesForAutoApproval } from './access-policy.js';
 export class PairStore {
     onRevoked;
     path;
@@ -32,11 +33,11 @@ export class PairStore {
         }
         await this.reload();
     }
-    start(onError) {
+    start(onError, onReload) {
         this.#watcher = watch(dirname(this.path), (_event, filename) => {
             if (filename !== null && filename !== basename(this.path))
                 return;
-            this.#writeTail = this.#writeTail.then(() => this.reload()).catch((error) => {
+            this.#writeTail = this.#writeTail.then(async () => { await this.reload(); onReload?.(); }).catch((error) => {
                 this.#metadataRevision += 1;
                 onError?.(error instanceof Error ? error : new Error(String(error)));
             });
@@ -58,28 +59,139 @@ export class PairStore {
         }
         fail('CLIENT_ID_INVALID', 400, 'X-Lens-Client-Kind must be native or browser.');
     }
-    async authorize(headers, transport, correlationId) {
+    /**
+     * Decides whether a caller may proceed.
+     *
+     * A component running on this machine is admitted without anyone pairing it by hand. Judged on three things,
+     * each doing work: the connection arrives on loopback, the caller identifies itself as native, and nothing
+     * relayed the request. What the pair file can defend is the reasoning -- a local process running as this user
+     * could read the same files and run the same tools directly, so refusing it protects nothing, while a caller
+     * from another machine and a browser still require a person.
+     *
+     * A browser is excluded however local it is, because a page can reach 127.0.0.1 and a fingerprint is whatever
+     * the other end claims. Relayed requests are excluded because Facet proxies browser traffic from loopback, so
+     * without that condition Facet would lend its locality to every caller behind it.
+     *
+     * `strongTrust` is deliberately not granted this way. Raw configuration holds Provider credentials, and
+     * reaching it still requires a credential somebody issued on purpose, so the exemption buys ordinary API
+     * access and nothing more.
+     *
+     * `peerAddress` must be the raw socket address. A forwarded header is supplied by the caller, so locality
+     * derived from one would be locality anyone could claim.
+     */
+    async authorize(headers, transport, correlationId, registerUnknown = true, peerAddress) {
+        await this.reload();
         const client = this.identify(headers);
-        const record = this.#records.get(client.clientId);
+        // Evaluated per request, never stored. A record admitted locally must not let the same client in later from
+        // a browser, or through a proxy, without a credential.
+        const local = qualifiesForAutoApproval(client.kind, peerAddress, headers);
+        let record = this.#records.get(client.clientId);
+        if (record === undefined && local && registerUnknown) {
+            await this.#appendUnknown(client, true);
+            record = this.#records.get(client.clientId);
+        }
         if (record?.isVerified !== true) {
-            if (record === undefined)
-                await this.#appendUnknown(client);
+            if (record === undefined && registerUnknown)
+                await this.#appendUnknown(client, false);
             fail('CLIENT_UNVERIFIED', 403, 'The client has not been verified.', { client_id: client.clientId });
         }
-        return { source: 'user', clientId: client.clientId, transport, correlationId };
+        const authorization = headers.authorization;
+        const token = typeof authorization === 'string' && authorization.startsWith('Bearer ') ? authorization.slice(7) : '';
+        const credentialValid = record.credentialHash !== null
+            && /^[A-Za-z0-9_-]{43}$/.test(token)
+            && timingSafeEqual(Buffer.from(record.credentialHash, 'hex'), Buffer.from(tokenHash(token), 'hex'));
+        if (!credentialValid && !local) {
+            fail('CLIENT_CREDENTIAL_INVALID', 401, 'A valid Pair credential is required.');
+        }
+        return {
+            source: 'user',
+            clientId: client.clientId,
+            transport,
+            correlationId,
+            // Strong trust follows the credential, not the network. A client granted it keeps it only while presenting
+            // the credential it was granted with.
+            strongTrust: record.strongTrust && credentialValid
+        };
+    }
+    async requireStrong(headers) {
+        // Called inside the write queue too; never enqueue registration behind that same write.
+        const ingress = await this.authorize(headers, 'http', 'configuration', false);
+        if (!ingress.strongTrust)
+            fail('STRONG_TRUST_REQUIRED', 403, 'This operation requires a strongly trusted client.');
+    }
+    async document() {
+        const content = await readFile(this.path, 'utf8');
+        return { content, file_digest: tokenHash(content) };
+    }
+    replace(source, expectedDigest, headers) {
+        const operation = this.#writeTail.then(async () => {
+            const check = async () => {
+                await this.requireStrong(headers);
+                const current = await this.document();
+                if (current.file_digest !== expectedDigest)
+                    fail('CONFIG_CONFLICT', 409, 'The pair file changed.');
+            };
+            await check();
+            parsePair(source);
+            await this.#save(source, check);
+        });
+        this.#writeTail = operation.catch(() => undefined);
+        return operation;
+    }
+    /** Local administration only: the credential is returned once, never stored in plaintext. */
+    issueCredential(clientId, strongTrust) {
+        const operation = this.#writeTail.then(async () => {
+            const records = await readPairFile(this.path);
+            const index = records.findIndex(record => record.client_id === clientId);
+            const current = records[index];
+            if (current === undefined)
+                fail('CLIENT_NOT_FOUND', 404, 'Connect the client first to register its identity.');
+            const token = randomBytes(32).toString('base64url');
+            records[index] = { ...current, isVerified: true, strongTrust, credentialHash: tokenHash(token) };
+            await this.#save(`${JSON.stringify({ clients: records }, null, 2)}\n`);
+            return token;
+        });
+        this.#writeTail = operation.then(() => undefined, () => undefined);
+        return operation;
+    }
+    async #save(source, beforeCommit) {
+        const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporary, source, { encoding: 'utf8', mode: 0o600 });
+            await beforeCommit?.();
+            await rename(temporary, this.path);
+            await this.reload();
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
     }
     async reload() {
-        const next = await readPairFile(this.path);
+        let next;
+        try {
+            next = await readPairFile(this.path);
+        }
+        catch (error) {
+            for (const clientId of this.#records.keys())
+                this.onRevoked(clientId);
+            this.#records.clear();
+            this.#digest = '';
+            throw error;
+        }
+        const nextDigest = tokenHash(JSON.stringify(next));
+        if (nextDigest === this.#digest)
+            return;
         const previous = this.#records;
         this.#records = new Map(next.map((entry) => [entry.client_id, entry]));
-        this.#digest = digest(next.filter((entry) => entry.isVerified).map((entry) => entry.client_id).sort());
+        this.#digest = nextDigest;
         this.#metadataRevision += 1;
         for (const [clientId, record] of previous) {
-            if (record.isVerified && this.#records.get(clientId)?.isVerified !== true)
+            const current = this.#records.get(clientId);
+            if (record.isVerified && (current?.isVerified !== true || current.credentialHash !== record.credentialHash || current.strongTrust !== record.strongTrust))
                 this.onRevoked(clientId);
         }
     }
-    #appendUnknown(identityValue) {
+    #appendUnknown(identityValue, verified) {
         const write = this.#writeTail.then(async () => {
             const records = await readPairFile(this.path);
             if (records.some((entry) => entry.client_id === identityValue.clientId)) {
@@ -95,8 +207,12 @@ export class PairStore {
                 mac: identityValue.mac,
                 hardware_id: identityValue.hardwareId,
                 browser_fingerprint: identityValue.browserFingerprint,
-                isVerified: false,
-                label: null,
+                isVerified: verified,
+                // Never strongly trusted and never given a credential by this path: an automatic approval grants
+                // ordinary API access, and anything more stays a deliberate act.
+                strongTrust: false,
+                credentialHash: null,
+                label: verified ? 'Approved automatically: local native client' : null,
                 first_seen_at: timestamp,
                 last_seen_at: timestamp
             });
@@ -104,7 +220,7 @@ export class PairStore {
             if (Buffer.byteLength(source) > 1_048_576)
                 fail('PAIR_FILE_CAPACITY', 503, 'The pair file reached its size limit.');
             const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
-            await writeFile(temporary, source, 'utf8');
+            await writeFile(temporary, source, { encoding: 'utf8', mode: 0o600 });
             await rename(temporary, this.path);
             await this.reload();
         });
@@ -113,29 +229,44 @@ export class PairStore {
     }
 }
 async function readPairFile(path) {
+    let source;
+    try {
+        source = await readFile(path, 'utf8');
+    }
+    catch {
+        fail('PAIR_FILE_INVALID', 503, 'The pair file could not be loaded.');
+    }
+    return parsePair(source);
+}
+function parsePair(source) {
+    if (Buffer.byteLength(source) > 1_048_576)
+        fail('PAIR_FILE_CAPACITY', 503, 'The pair file reached its size limit.');
     let document;
     try {
-        const source = await readFile(path, 'utf8');
-        if (Buffer.byteLength(source) > 1_048_576)
-            fail('PAIR_FILE_CAPACITY', 503, 'The pair file reached its size limit.');
         document = JSON.parse(source);
     }
-    catch (error) {
-        if (error instanceof Error && error.name === 'LensError')
-            throw error;
-        fail('PAIR_FILE_INVALID', 503, 'The pair file could not be loaded.');
+    catch {
+        fail('PAIR_FILE_INVALID', 400, 'The pair file is not valid JSON.');
     }
     if (typeof document !== 'object' || document === null || Array.isArray(document))
-        fail('PAIR_FILE_INVALID', 503, 'The pair file is invalid.');
+        fail('PAIR_FILE_INVALID', 400, 'The pair file is invalid.');
     const clients = document.clients;
     if (!Array.isArray(clients) || clients.length > 4096)
-        fail('PAIR_FILE_INVALID', 503, 'The pair file is invalid.');
-    return clients.map(pairRecord);
+        fail('PAIR_FILE_INVALID', 400, 'The pair file is invalid.');
+    const records = clients.map(pairRecord);
+    if (new Set(records.map(record => record.client_id)).size !== records.length)
+        fail('PAIR_FILE_INVALID', 400, 'Duplicate client identities.');
+    return records;
 }
+function tokenHash(value) { return createHash('sha256').update(value).digest('hex'); }
 function pairRecord(value) {
     if (typeof value !== 'object' || value === null || Array.isArray(value))
         fail('PAIR_FILE_INVALID', 503, 'A pair record is invalid.');
     const row = value;
+    if (row.strongTrust !== undefined && typeof row.strongTrust !== 'boolean')
+        fail('PAIR_FILE_INVALID', 400, 'strongTrust must be a boolean.');
+    if (row.credentialHash !== undefined && row.credentialHash !== null && (typeof row.credentialHash !== 'string' || !/^[a-f0-9]{64}$/.test(row.credentialHash)))
+        fail('PAIR_FILE_INVALID', 400, 'Invalid credential digest.');
     const kind = row.client_kind;
     if (kind !== 'native' && kind !== 'browser')
         fail('PAIR_FILE_INVALID', 503, 'A pair client kind is invalid.');
@@ -147,6 +278,8 @@ function pairRecord(value) {
         hardware_id: nullableString(row.hardware_id),
         browser_fingerprint: nullableString(row.browser_fingerprint),
         isVerified: row.isVerified === true,
+        strongTrust: row.strongTrust === true,
+        credentialHash: typeof row.credentialHash === 'string' ? row.credentialHash : null,
         label,
         first_seen_at: string(row.first_seen_at, 'first_seen_at'),
         last_seen_at: string(row.last_seen_at, 'last_seen_at')

package/dist/core/context-boundaries.d.ts

@@ -0,0 +1,25 @@
+import { type ModelMessage } from './domain.js';
+import type { Document } from '../store/store.js';
+export interface ContextBoundaries {
+    readonly legalCuts: readonly number[];
+    readonly protectedRanges: readonly {
+        start: number;
+        end: number;
+        complete: boolean;
+    }[];
+    readonly violations: readonly {
+        index: number;
+        reason: string;
+    }[];
+}
+/** Cuts are positions between messages. IDs are scoped to a batch, not the session. */
+export declare function contextBoundaries(messages: readonly ModelMessage[], unsettledItemIds?: readonly string[]): ContextBoundaries;
+export declare function assertContextBoundaries(messages: readonly ModelMessage[], options?: {
+    allowOpenTail?: boolean;
+    unsettledItemIds?: readonly string[];
+}): ContextBoundaries;
+/** Preserve source membership, even if two different batches reuse the same wire IDs. */
+export declare function assertContextTransition(before: readonly ModelMessage[], after: readonly ModelMessage[], unsettledItemIds: readonly string[]): void;
+export declare function contextToolCalls(content: string): NonNullable<ModelMessage['toolCalls']>;
+/** Included results without native tool identity are evidence, not protocol responses. */
+export declare function boundaryMessages(items: readonly Document[]): readonly ModelMessage[];