@leuduan/lagent 0.1.2 → 44.0.0

package/dist/services/confinement/service.d.ts

@@ -0,0 +1,219 @@
+import { Service, type Context } from '@leuduan/cordis';
+import { z } from 'zod';
+import { type SpawnedCommand, type SpawnedGroup, type SpawnedPipes, type SpawnEnvironment } from '../../sys/spawn.js';
+import { type FileScope } from './files.js';
+/**
+ * How a model-driven process becomes a local launch: the one place `run_command`, the search tools,
+ * and later other model-driven processes such as MCP stdio servers, start a process, so a host's
+ * confinement sees every one. Not `sys/spawn`: lagent's own spawns (git, the shell probe, stop-check
+ * hooks) call `spawnCommand` directly and are never intercepted.
+ */
+/** Which launch a process got, recorded with it: never secrets, ids or ports. */
+export declare const LaunchProvenanceSchema: z.ZodObject<{
+    launcher: z.ZodString;
+    version: z.ZodString;
+    policy: z.ZodString;
+}, z.core.$strict>;
+export type LaunchProvenance = z.output<typeof LaunchProvenanceSchema>;
+/** The `policy` of a launch a handler chose to run unconfined: what a host or a listing marks as such. */
+export declare const UNCONFINED_LAUNCH = "unconfined";
+/**
+ * What runs. `shell` is text for `/bin/sh -c`, launched with stdout and stderr joined in order, as a
+ * command line is. `argv` is a program and its arguments, run without a shell, launched with a
+ * writable stdin and stdout and stderr apart, as a tool that parses a program's output needs them.
+ */
+export type LaunchProgram = {
+    readonly shell: string;
+} | {
+    readonly argv: readonly [string, ...string[]];
+};
+/**
+ * What to launch and the geometry to confine (`root`, `scratch`). The thread it serves, the subject
+ * of a handler's per-thread policy, is the one its operation was opened for.
+ */
+export type LaunchRequest = {
+    readonly program: LaunchProgram;
+    /** Absolute: where it starts. */
+    readonly workdir: string;
+    /** The writable root the protected names are rebuilt for: the thread's working directory for commands. */
+    readonly root: string;
+    /** Keys the process's temporary directory: `threadScratch(id)` for commands. Equal keys share one directory. */
+    readonly scratch: string;
+    /** The process's environment: the caller's. */
+    readonly environment: SpawnEnvironment;
+    /** Aborting it stops the launch: preparation at once, and the process within its stop bound. */
+    readonly signal: AbortSignal;
+};
+export type LaunchOptions = {
+    readonly timeoutMs?: number;
+    readonly killGraceMs: number;
+    /** Awaited before the process is released, as `spawnCommand`'s, with the launch it got. */
+    readonly beforeRelease?: (pgid: number, launch: LaunchProvenance | null) => Promise<void>;
+};
+/** The program a launch runs when nothing confines it: the argv itself, or `/bin/sh -c` for shell text. */
+export declare function plainArgv(program: LaunchProgram): readonly [string, ...string[]];
+/** A local process to spawn in place of the request's program, from the same stdio form. */
+export type PreparedLaunch = {
+    readonly argv: readonly [string, ...string[]];
+    readonly cwd: string;
+    readonly env: SpawnEnvironment;
+    readonly provenance: LaunchProvenance;
+    /** After the process ended: bounded report lines, or `null`. Never rejects the process's outcome. */
+    violations(): Promise<string | null>;
+};
+/** What a tool does to a path. */
+export type FileAccess = 'read' | 'write';
+/** A path's verdict: allowed, or refused with a message for the model. */
+export type FileVerdict = {
+    readonly allowed: true;
+} | {
+    readonly allowed: false;
+    readonly reason: string;
+};
+/**
+ * What a handler lets file tools reach, judged by name over absolute paths and never from the file
+ * system: a tool that follows links asks about the path it was given and about where it resolves,
+ * and needs both allowed.
+ */
+export type FilePolicy = {
+    check(path: string, access: FileAccess): FileVerdict;
+    /**
+     * Names how this policy judges a read: two policies with equal identities answer every read alike.
+     * What a reader that shares its result between threads (a catalog of skills) keys it by, so what
+     * one thread was allowed to read is never handed to another that was not.
+     */
+    readonly identity: string;
+};
+/** The `scratch` key of a thread's own processes, which is also the directory its file tools may write besides its root. */
+export declare const threadScratch: (threadId: string) => string;
+/**
+ * What one operation's launches are prepared under: the handler's decisions for a thread, taken
+ * once, so every launch of the operation gets the same ones whatever changes meanwhile.
+ */
+export type ConfinementSnapshot = {
+    /** The thread's file policy, the one its launches are confined by; `null` for no path policy at all. */
+    readonly files: FilePolicy | null;
+    /** Rejects, with a message for the model, to refuse the launch. */
+    prepare(request: LaunchRequest): Promise<PreparedLaunch>;
+};
+/** What confines launches, such as the OS sandbox of `@leuduan/lagent/plugins/sandbox`. */
+export type ConfinementHandler = {
+    /** Rejects, with a message for the model, to refuse the operation: nothing of it is admitted. */
+    snapshot(threadId: string): Promise<ConfinementSnapshot>;
+};
+export type ConfinementHandle = {
+    /**
+     * Says that what an operation opened from now on would be allowed has changed, such as a thread's
+     * mode: content a reader prepared before (`ConfinementService.epoch` then differs from the one it
+     * noted) was read under what no longer holds, and is not delivered.
+     */
+    changed(): void;
+    /**
+     * Stops admitting through the handler, aborts every launch it prepared, and waits for each one's
+     * preparation, process and report within `timeoutMs`. Resolves `true` only when every group was
+     * confirmed stopped: no `stopFailed` result, ever, and nothing still running at the bound.
+     * Idempotent: every caller shares the first call's result.
+     */
+    release(timeoutMs: number): Promise<boolean>;
+};
+/**
+ * A launched process: its group, what it was launched as, and the handler's report once it ends.
+ * A `shell` program is a joined {@link SpawnedCommand}, an `argv` program {@link SpawnedPipes}.
+ */
+export type Launched<Spawned extends SpawnedGroup = SpawnedCommand> = {
+    /** The actual directory selected for the process, including a confinement handler's choice. */
+    readonly cwd: string;
+    readonly spawned: Spawned;
+    readonly launch: LaunchProvenance | null;
+    /** Settles after `spawned.result`, within {@link DIAGNOSTICS_MS}; `null` for nothing to report. Never rejects. */
+    readonly diagnostics: Promise<string | null>;
+};
+/** How long after a process ended its report may take. */
+export declare const DIAGNOSTICS_MS = 1000;
+/**
+ * What one piece of model-driven work does under confinement: its launches and its file access, all
+ * under the one snapshot the operation takes on first use. What `run_command` takes for one command,
+ * and what the execution of one tool call is handed (`InvocationContext.operation`).
+ */
+export type ConfinementOperation = {
+    /** Launches under the operation's snapshot, or plainly when no handler is registered. */
+    launch(request: LaunchRequest & {
+        program: {
+            shell: string;
+        };
+    }, options: LaunchOptions): Promise<Launched>;
+    launch(request: LaunchRequest & {
+        program: {
+            argv: readonly [string, ...string[]];
+        };
+    }, options: LaunchOptions): Promise<Launched<SpawnedPipes>>;
+    /**
+     * File access under the snapshot's {@link FilePolicy}, or none: the one way a tool touches files.
+     * Valid until {@link end}.
+     */
+    readonly files: FileScope;
+    /**
+     * Ends the file access: calls in flight settle, every handle it opened is closed, and every later
+     * use of `files`, or of a handle, fails. Launches are not ended with it: a process has a lifetime
+     * of its own. Idempotent.
+     */
+    end(): Promise<void>;
+};
+/**
+ * The confinement seam. With no handler, a launch is a plain spawn: `/bin/sh -c <command>` for shell
+ * text, the argv itself for an argv. The first {@link handle} declares for the root's lifetime that
+ * launches go through a handler, which decides what each operation gets (confinement, or refusal):
+ * from then on an operation with no live handler, because it was released, failed or never mounted
+ * again, is refused, and nothing falls back to a plain spawn. A host mounts the handler before
+ * anything launches.
+ *
+ * A handler is told nothing about consumers. It is released as a whole: core aborts what it
+ * admitted and reports whether every group stopped, so the handler may then free what confined them.
+ */
+export declare class ConfinementService extends Service {
+    private readonly root;
+    private changes;
+    private holdReads;
+    constructor(ctx: Context);
+    /**
+     * Registers the one handler. Throws while another is live. Afterwards, until the root ends, an
+     * operation with no live handler is refused.
+     */
+    handle(handler: ConfinementHandler): ConfinementHandle;
+    /**
+     * A count of the changes to what an operation would be allowed: a handler registered or released,
+     * or one saying so (`ConfinementHandle.changed`). A reader that prepares content ahead of its
+     * delivery notes it before it reads, and delivers only if it still reads the same.
+     */
+    get epoch(): number;
+    /**
+     * Opens one operation for `threadId`. Nothing happens until it is used: its first launch or file
+     * access takes the handler's snapshot, once, which everything the operation does is prepared and
+     * checked under, and a refusal (the handler refuses the operation, or has stopped, or the caller's
+     * `signal` aborts first) rejects that use with a {@link CommandStartFailure}. With no handler
+     * registered the operation launches plainly and its file access has no policy. The caller ends it
+     * (`end`) when its call does.
+     */
+    open(threadId: string, signal: AbortSignal): ConfinementOperation;
+    /** The thread and the callers out to its origin root, held loaded; none for a thread the journal does not hold. */
+    private retainReads;
+    /**
+     * For the threads service, which owns what is loaded: how a thread and the histories a snapshot
+     * of it reads (its callers out to its origin root) are held loaded while the snapshot is taken;
+     * `null` for a thread the journal does not hold. Core's own, so that the dependency runs from
+     * threads to confinement. Returns what takes it back.
+     */
+    holdReadsWith(hold: (threadId: string) => Promise<{
+        release(): void;
+    } | null>): () => void;
+    /** The operation's one snapshot, tracked from before the handler hears of it, or none when no handler is registered. */
+    private takeSnapshot;
+    private requireLive;
+    /** One launch under a snapshot. */
+    private launchThrough;
+    private spawnPlain;
+    private spawnThrough;
+    private release;
+    /** Whether every operation settled within `timeoutMs` and no stop ever failed. */
+    private settle;
+}

package/dist/services/core.d.ts

@@ -1,17 +1,11 @@
 import type { Plugin } from '@leuduan/cordis';
 import type { JournalStore } from '../journal/index.js';
-import { type TurnLimits } from '../loop/index.js';
+import { type TurnLimits } from '../state/index.js';
 export type CoreConfig = {
     /** The journal's backing, constructed by the application. */
     store: JournalStore;
     /** Default `environment.cwd` for new threads; absolute. */
     cwd: string;
-    /**
-     * Absolute application data directory holding each thread's own directory, or `null` for none:
-     * plugins that need directories then refuse to mount. Required: where to keep files is the
-     * application's choice.
-     */
-    dataDir: string | null;
     limits?: Partial<TurnLimits>;
     /**
      * What becomes of a thread the owner loaded to run once its run lets go: `retire` takes it out of
@@ -28,7 +22,7 @@ export type CoreConfig = {
 };
 /**
  * Mounts the core services on one root: `ctx.journal`, `ctx.llm`, `ctx.agents`, `ctx.tools`,
- * `ctx.prompts`, `ctx.threadDirs`, `ctx.launches`, `ctx.presets` and `ctx.threads`. Providers, tools, agents and
+ * `ctx.prompts`, `ctx.confinement`, `ctx.presets` and `ctx.threads`. Providers, tools, agents and
  * capability plugins mount beside it.
  */
 export declare const core: Plugin.Object<CoreConfig>;

package/dist/{kit/extension.d.ts → services/extensionEvents.d.ts}

@@ -1,10 +1,11 @@
 import type { Context } from '@leuduan/cordis';
 import type { z } from 'zod';
 import type { AppendOptions, PluginJournal, PluginProjection } from '../journal/index.js';
-import type { ContentPartInput } from '../llm/index.js';
-import { type ModelStep, type RowRef } from '../loop/index.js';
-import { type AgentSelector } from './scope.js';
-import type { ExtensionRecord, InputRole, JournalEvent, Seq, StepContribution } from '../models/index.js';
+import type { ContentPartInput } from '../llm/content.js';
+import { type ModelStep } from '../loop/index.js';
+import { type RowRef } from '../state/index.js';
+import { type AgentSelector } from './agents.js';
+import type { ExtensionRecord, InputRole, JournalEvent, Seq, StepContribution } from '../records/journal.js';
 import type { ReadonlyState } from '../util/foldState.js';
 import type { DeepReadonly } from '../util/json.js';
 export declare class ExtensionVersionError extends Error {

package/dist/services/journal.d.ts

@@ -1,6 +1,6 @@
 import type { Context, Plugin } from '@leuduan/cordis';
 import { Journal, type JournalStore } from '../journal/index.js';
-import { type TurnLimits } from '../loop/index.js';
+import { type TurnLimits } from '../state/index.js';
 export type JournalConfig = {
     /** Durable backing. A store that is already open stays caller-owned. */
     store: JournalStore;

package/dist/services/llm.d.ts

@@ -1,7 +1,9 @@
 import { Context, Service } from '@leuduan/cordis';
 import { z } from 'zod';
-import { type LLMProvider, type ModelCallClient, type ModelCapacity, type ModelRoute } from '../llm/index.js';
-import { type ModelSelection } from '../loop/index.js';
+import { type ModelCallClient } from '../llm/failure.js';
+import { type LLMProvider, type ModelRoute } from '../llm/provider.js';
+import { type ModelCapacity } from '../llm/client.js';
+import { type ModelSelection } from '../llm/provider.js';
 /**
  * How `ctx.llm` retries a provider's failed call, required at registration. `maxAttempts` counts the
  * first request, so `1` retries nothing. The wait before a retry is exponential from `baseDelayMs`

package/dist/{kit → services}/modes.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from '@leuduan/cordis';
 import type { PluginJournal } from '../journal/index.js';
-import type { WriteRows } from '../loop/index.js';
+import type { WriteRows } from '../state/index.js';
 /** One set of durable modes, as {@link defineModes} takes it. */
 export type ModesDefinition<Mode extends string> = {
     /** Names the modes in the journal, so two sets never mix. */

package/dist/services/plugins.d.ts

@@ -0,0 +1,34 @@
+import { type Context } from '@leuduan/cordis';
+/**
+ * Claims `key`, a thread by its id or by its activation's scope, for the calling plugin within
+ * `kind`, for as long as the calling plugin's fiber lives: for a behaviour a thread runs at most
+ * once, such as an `AGENTS.md` briefing. `holder` is
+ * how a later refusal names this claim. Throws `refusal(holder)` with the holder of a live claim of
+ * the same kind on the same key, so the plugin that claimed later fails, and with it the
+ * activation, rather than running beside the first. Claims of different kinds never meet.
+ *
+ * Synchronous: the check and the claim are one step, and the claim is an effect of the caller's
+ * fiber, so a release, an unload or a failed setup frees the thread for the next activation.
+ */
+export declare function claimThread(ctx: Context, kind: string, key: unknown, holder: string, refusal: (holder: string) => string): void;
+/**
+ * Runs `drain` before any owner of `ctx` starts its cleanup, and before the journal's owner does:
+ * as an unload guard on every fiber from `ctx` up to the root, and on the fiber that provides the
+ * journal. Guards on one fiber run together before its disposers, so every service draining this
+ * way is signalled before any of them is awaited, and the journal is still writable for their final
+ * rows. `drain` must be idempotent, since several owners can unload, and must not await its own
+ * owner's teardown, which waits for the guard.
+ */
+export declare function drainBeforeUnload(ctx: Context, drain: () => Promise<void>): void;
+/**
+ * The root service `name`, or a refusal naming `user`, the plugin or tool that depends on it, when
+ * it is not mounted. Checked where a plugin mounts, so a composition without the service fails
+ * there rather than leaving the plugin silently inactive, and looked up again at each call.
+ */
+export declare function requireService<K extends string & keyof Context>(ctx: Context, name: K, user: string): NonNullable<Context[K]>;
+/**
+ * Refuses a plugin mounted in a thread's scope when `name`, the thing mounted, serves every thread
+ * from the application root. The predicate is `scopeOf(ctx) === undefined`: an untagged application
+ * context passes, so this is not a root-identity check.
+ */
+export declare function requireUnscoped(ctx: Context, name: string): void;

package/dist/services/{preset.d.ts → presets/definition.d.ts}

@@ -1,9 +1,9 @@
 import { type Context, type Fiber, type Inject, type Plugin } from '@leuduan/cordis';
 import type { z } from 'zod';
-import type { InstallationLifetime } from '../models/index.js';
-import { type JsonValue } from '../util/json.js';
-import { type AgentSelector } from '../kit/scope.js';
-import type { Thread } from './thread.js';
+import type { InstallationLifetime } from '../../records/journal.js';
+import { type JsonValue } from '../../util/json.js';
+import { type AgentSelector } from '../agents.js';
+import type { Thread } from '../threads/index.js';
 /** What a preset's setup is told when it is mounted as one thread's recorded installation. */
 export type PresetInstallation = {
     readonly kind: 'installation';

package/dist/services/{presets.d.ts → presets/installations.d.ts}

@@ -1,7 +1,7 @@
 import { Service, type Context, type ScopeKey } from '@leuduan/cordis';
-import type { InitialInstallation, Installation, InstallationLifetime } from '../models/index.js';
-import { type AnyPreset } from './preset.js';
-import type { Thread } from './thread.js';
+import type { InitialInstallation, Installation, InstallationLifetime } from '../../records/journal.js';
+import { type AnyPreset } from './definition.js';
+import type { Thread } from '../threads/index.js';
 /**
  * An installation a caller asks for, at creation (as an {@link InitialInstallationInput}) or later
  * (`Thread.configure`).

package/dist/services/prompts.d.ts

@@ -1,8 +1,9 @@
 import { Context, Service, type ScopeKey } from '@leuduan/cordis';
-import type { PromptBlock } from '../llm/index.js';
-import type { ToolEntry } from '../loop/index.js';
-import type { AgentDefinition, ThreadSummary } from '../models/index.js';
-import { type AgentSelector } from '../kit/scope.js';
+import { type PromptBlock } from '../llm/prompt.js';
+import { type ToolEntry } from '../loop/index.js';
+import type { AgentDefinition } from '../loop/index.js';
+import type { ThreadSummary } from '../records/journal.js';
+import { type AgentSelector } from './agents.js';
 export type PromptSlot = 'base' | 'instruction' | 'context';
 /**
  * What a contribution is rendered against: the agent, where the thread works, and the tools it
@@ -11,7 +12,7 @@ export type PromptSlot = 'base' | 'instruction' | 'context';
  * Deliberately not the thread's id or metadata. A recorded prompt is the head of every request a
  * provider caches, so it must not depend on which thread it is: threads of one agent in one
  * workspace then render the same prompt. Anything thread-specific belongs in the conversation, as
- * a step contribution (see `workspaceContext`).
+ * a step contribution (see `workspaceNotice`).
  */
 export type PromptRenderInput = {
     readonly agent: AgentDefinition;
@@ -65,3 +66,20 @@ export declare class PromptsService extends Service {
 }
 /** Registers a contribution in the calling plugin's layer for the lifetime of its fiber. */
 export declare const contributePrompt: (ctx: Context, contribution: PromptContribution) => (() => void | Promise<void>);
+export type TaggedSection = {
+    tag: string;
+    content: string;
+};
+/**
+ * A prompt as `ctx.prompts` assembles it: the agent's base prompt, then instruction sections, then
+ * context sections, so a section's bucket is what decides its position. The rendered result is
+ * recorded per thread.
+ */
+export type SystemPrompt = {
+    basePrompt: string;
+    instructions: TaggedSection[];
+    contextSections: TaggedSection[];
+};
+/** The prompt as ordered blocks — the one place its order is decided. */
+export declare function systemPromptBlocks(prompt: SystemPrompt): PromptBlock[];
+export declare const renderSystemPrompt: (prompt: SystemPrompt) => string;

package/dist/services/{threadActivation.d.ts → threads/activation.d.ts}

@@ -1,9 +1,9 @@
 import { type Context, type Scope, type Scoped, type ScopeKey } from '@leuduan/cordis';
-import { type CompactOptions, type Lease, type LoopServices, type SurfacePrepareOutcome } from '../loop/index.js';
-import type { ServedRun } from '../loop/index.js';
+import { type CompactOptions, type Lease, type LoopServices, type SurfacePrepareOutcome } from '../../loop/index.js';
+import type { ServedRun } from '../../loop/index.js';
 import type { Thread } from './thread.js';
 import type { AdmissionView } from './admission.js';
-import type { ThreadsService } from './threads.js';
+import type { ThreadsService } from './service.js';
 /**
  * One process-local activation: the thread's Cordis scope, the plugins mounted in it, their
  * readiness, and the loop that runs in it. It owns resources, never admission: which operation

package/dist/services/{admission.d.ts → threads/admission.d.ts}

@@ -1,5 +1,5 @@
-import type { Lease } from '../loop/index.js';
-import type { CancelIntent, InboxTarget } from '../models/index.js';
+import type { Lease } from '../../loop/index.js';
+import type { CancelIntent, InboxTarget } from '../../records/journal.js';
 /**
  * An exclusive operation on one thread; see `Admission.onOperation`. A `cancel` holds the thread from a
  * `cancel()` until its write has landed and what it cancelled has released the thread.
@@ -62,7 +62,7 @@ export type CancelHandle = {
 /**
  * The one owner of which operation holds each thread: admission or refusal, the releasing phase,
  * cancellation, and the publication of admission and settlement in the order
- * docs/lifecycle.md#ordering states. It knows nothing of activations; the threads service runs
+ * docs/guides/threads.md#ordering states. It knows nothing of activations; the threads service runs
  * each operation's work, and disposes activations under it, through `hold`.
  */
 export declare class Admission {

package/dist/services/{birth.d.ts → threads/birth.d.ts}

@@ -1,10 +1,11 @@
-import { type ModelRoute } from '../llm/index.js';
-import type { Journal } from '../journal/index.js';
-import { type BirthConflict, type BirthSpec, type ForkOpening, type FreshOpening, type RowRef, type WriteRows } from '../loop/index.js';
-import type { InitialInstallation, Installation, JournalEventInput, Seq, ThreadEnvironment, ThreadInput, ThreadOrigin, ThreadSummary } from '../models/index.js';
-import type { Wake } from '../loop/index.js';
-import { type DeepReadonly, type ReadonlyJsonValue } from '../util/json.js';
-import type { InitialInstallationInput, PresetsService } from './presets.js';
+import { type ModelRoute } from '../../llm/provider.js';
+import type { Journal } from '../../journal/index.js';
+import { type BirthConflict } from '../../loop/index.js';
+import { type BirthSpec, type ForkOpening, type FreshOpening, type RowRef, type WriteRows } from '../../state/index.js';
+import type { InitialInstallation, Installation, JournalEventInput, Seq, ThreadEnvironment, ThreadInput, ThreadOrigin, ThreadSummary } from '../../records/journal.js';
+import type { Wake } from '../../state/index.js';
+import { type DeepReadonly, type ReadonlyJsonValue } from '../../util/json.js';
+import type { InitialInstallationInput, PresetsService } from '../presets/installations.js';
 /**
  * What must match when a creation or fork finds its id taken: `identity` is the thread's agent,
  * origin and whether it is a fork, and for a fork its cut; `configuration` also compares the
@@ -49,7 +50,7 @@ export type BirthInput<I> = {
     route: ModelRoute;
     /**
      * Where the thread's work happens, field by field. An omitted field is the default: the root's
-     * `cwd` and no read roots, or with `caller` the caller's. The cwd and every read root must be absolute.
+     * `cwd`, or with `caller` the caller's. The cwd must be absolute.
      */
     environment?: Partial<DeepReadonly<ThreadEnvironment>>;
     /**
@@ -169,8 +170,6 @@ export type ResolvedOpening = {
     readonly kind: 'fork';
     readonly opening: ForkOpening;
 };
-/** Read roots as a spawn row records them: each normalized, once, in the order given. A relative one is refused. */
-export declare function readRoots(roots: readonly string[]): string[];
 /** Constraint owners as a spawn row records them: a set, sorted and without repeats. */
 export declare const canonicalRequires: (requires: readonly string[] | undefined) => string[];
 /**

package/dist/services/threads/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * What the rest of the package uses of `services/threads/`: the thread handle and its read view, run
+ * events, run-owner registration and the creation and fork shapes. Code outside this folder imports
+ * from here; `admission.ts`, `activation.ts` and the run owner's internals stay private to it.
+ */
+export { ThreadsService } from './service.js';
+export type { ConfigurationChange, ConfigurationResult, RetainOptions, RetainedMembers, Retention, ThreadFilter, Threads, ThreadsConfig, } from './service.js';
+export type { Thread } from './thread.js';
+export type { CancelOptions, ConfirmationAnswer } from './thread.js';
+export type { ThreadView } from './view.js';
+export type { BirthChoice, BirthInput, CreateThreadOptions, ForkCut, ForkOptions, Opening, Reuse } from './birth.js';
+export type { MissingDetail, OwnerHandle, OwnerReadiness, OwnerRegistration, StartOptions, StartupPolicy, ThreadInspection, WaitResolution, WaitValue, } from './runOwner.js';
+export { UnknownRunError, heldOrSettled, waitForRun } from './runEvents.js';
+export type { RunEvent, RunSource, RunState } from './runEvents.js';

package/dist/services/{runEvents.d.ts → threads/runEvents.d.ts}

@@ -1,5 +1,5 @@
-import type { RunOutcomeKind, RunSettledReason } from '../models/index.js';
-import type { DurableRunState, Hold, HoldBasis } from '../loop/index.js';
+import type { RunOutcomeKind, RunSettledReason } from '../../records/journal.js';
+import type { DurableRunState, Hold, HoldBasis } from '../../state/index.js';
 /**
  * Where one run request stands, as its waiters see it: waiting to be admitted (`requested`), with
  * an execution serving it (`running`, finalization included), held with the request still pending,

package/dist/services/{owner.d.ts → threads/runOwner.d.ts}

@@ -1,7 +1,8 @@
-import type { JsonValue, Seq, ThreadSummary } from '../models/index.js';
-import type { ReadonlyJsonValue } from '../util/json.js';
-import { type Continuation, type ConstraintAnswer, type DecisionTurn, type Hold, type HoldBasis, type TurnLimits, type WaitDeclaration } from '../loop/index.js';
-import type { Journal, OriginBreak } from '../journal/index.js';
+import type { Seq, ThreadSummary } from '../../records/journal.js';
+import type { JsonValue } from '../../util/json.js';
+import type { ReadonlyJsonValue } from '../../util/json.js';
+import { type Continuation, type ConstraintAnswer, type DecisionTurn, type Hold, type HoldBasis, type TurnLimits, type WaitDeclaration } from '../../state/index.js';
+import type { Journal, OriginBreak } from '../../journal/index.js';
 import type { Admission, AdmittedOperation, OperationKind } from './admission.js';
 import { type RunEvent, type RunState } from './runEvents.js';
 /**

package/dist/services/{threads.d.ts → threads/service.d.ts}

@@ -1,15 +1,16 @@
 import { Context, Service, type ScopeKey } from '@leuduan/cordis';
-import type { PromptBlock } from '../llm/index.js';
-import type { ChainStanding, CompactOptions, ConfirmationState, RouteAuthority, StreamedChunk, SurfacePrepareOutcome, Target, TurnLimits, BirthConflict, BirthSpec, HoldBasis } from '../loop/index.js';
-import { ChunkChannel } from '../loop/index.js';
-import type { ThreadOrigin } from '../models/index.js';
-import { type DeepReadonly } from '../util/json.js';
-import { type OwnerHandle, type OwnerRegistration, type StartOptions, type ThreadInspection } from './owner.js';
+import type { PromptBlock } from '../../llm/prompt.js';
+import type { ChainStanding, ConfirmationState, RouteAuthority, Target, TurnLimits, BirthSpec, HoldBasis } from '../../state/index.js';
+import type { CompactOptions, StreamedChunk, SurfacePrepareOutcome, BirthConflict } from '../../loop/index.js';
+import { ChunkChannel } from '../../loop/index.js';
+import type { ThreadOrigin } from '../../records/journal.js';
+import { type DeepReadonly } from '../../util/json.js';
+import { type OwnerHandle, type OwnerRegistration, type StartOptions, type ThreadInspection } from './runOwner.js';
 import type { RunEvent, RunState } from './runEvents.js';
-import type { InstallationInput } from './presets.js';
+import type { InstallationInput } from '../presets/installations.js';
 import { type CreateThreadOptions, type ForkOptions } from './birth.js';
 import { Thread } from './thread.js';
-import { ThreadView } from './threadView.js';
+import { ThreadView } from './view.js';
 export type ThreadsConfig = {
     /** Default `environment.cwd` for threads created without one; absolute. */
     cwd: string;

package/dist/services/{thread.d.ts → threads/thread.d.ts}

@@ -1,13 +1,14 @@
 import type { Context } from '@leuduan/cordis';
-import type { AppendEntry, Journal } from '../journal/index.js';
-import type { PromptBlock } from '../llm/index.js';
-import type { CompactOptions, RouteStatement, RowRef, SendOptions, SendOutcome, StreamedChunk, SurfacePrepareOutcome, WithdrawOptions, WithdrawOutcome } from '../loop/index.js';
-import type { CancelIntent, JournalEvent, ThreadInput, ThreadOrigin, ThreadSummary, TurnEndReason } from '../models/index.js';
-import type { DeepReadonly } from '../util/json.js';
+import type { AppendEntry, Journal } from '../../journal/index.js';
+import type { PromptBlock } from '../../llm/prompt.js';
+import type { CompactOptions, StreamedChunk, SurfacePrepareOutcome } from '../../loop/index.js';
+import type { RouteStatement, RowRef, SendOptions, SendOutcome, WithdrawOptions, WithdrawOutcome } from '../../state/index.js';
+import type { CancelIntent, JournalEvent, ThreadInput, ThreadOrigin, ThreadSummary, TurnEndReason } from '../../records/journal.js';
+import type { DeepReadonly } from '../../util/json.js';
 import type { AdmissionView } from './admission.js';
 import type { ForkOptions } from './birth.js';
-import type { ConfigurationChange, ConfigurationResult, ThreadsService } from './threads.js';
-import type { ThreadView } from './threadView.js';
+import type { ConfigurationChange, ConfigurationResult, ThreadsService } from './service.js';
+import type { ThreadView } from './view.js';
 /** One answer to a parked confirmation. */
 export type ConfirmationAnswer = {
     request_id: string;

package/dist/services/{threadView.d.ts → threads/view.d.ts}

@@ -1,9 +1,10 @@
-import type { ConversationMessage, PromptBlock, ToolSpec } from '../llm/index.js';
-import type { ConfirmationState, ForkPoint, InputFate, InstallationRecord, RowRef, RunOutcome, Target, WaitEntry } from '../loop/index.js';
-import type { JournalEvent, QueuedInput, Seq } from '../models/index.js';
-import type { DeepReadonly } from '../util/json.js';
-import type { Journal } from '../journal/index.js';
-import type { ReadonlyState } from '../util/foldState.js';
+import type { ConversationMessage, ToolSpec } from '../../llm/primitives.js';
+import type { PromptBlock } from '../../llm/prompt.js';
+import type { ConfirmationState, ForkPoint, InputFate, InstallationRecord, RowRef, RunOutcome, Target, WaitEntry } from '../../state/index.js';
+import type { JournalEvent, QueuedInput, Seq } from '../../records/journal.js';
+import type { DeepReadonly } from '../../util/json.js';
+import type { Journal } from '../../journal/index.js';
+import type { ReadonlyState } from '../../util/foldState.js';
 /**
  * What one thread's folds say, read synchronously (`ctx.threads.view`, `thread.read`): valid while
  * something holds the thread in memory — a journal write or a contributor running for it, a run, a