@loopingai/core 0.3.1 → 0.5.0

package/dist/a2a/verify.d.ts

@@ -1,47 +1,39 @@
 import { type JWTPayload } from "jose";
+import { type GatewayIdentity } from "@loopingai/a2a-protocol";
 /**
- * Default namespaced claim carrying the minimal caller identity.
+ * Verify the gateway identity JWT (the "B authenticates A" half of zero-trust).
  *
- * Overridable via {@link VerifyOptions.identityClaim} for a deployment that
- * isn't behind looping-gateway; the default is the Looping namespace so an
- * agent built on this package needs no configuration to interoperate.
- */
-export declare const IDENTITY_CLAIM = "https://loopingai.org/identity";
-/**
- * Default namespaced claim naming the **tenant** the gateway minted this token
- * for — which of the agents on this origin it authorizes the call to reach.
+ * The gateway signs a short-lived EdDSA JWT and sends it as a Bearer token on
+ * every A2A call. Per RFC 7515 §4.1.2 it embeds a `jku` header pointing at its
+ * public JWKS, so remote agents don't need a separately configured JWKS URL —
+ * they read `jku` straight from the token and verify the key from there.
+ *
+ * Security: the `jku` origin is validated against the allowed origins before
+ * fetching, preventing key-injection attacks (an attacker cannot point `jku` at
+ * their own JWKS and have it accepted).
  *
- * Several agents share one endpoint, so they also share an `aud`: the audience
- * proves the token was minted for *this deployment*, and can say nothing about
- * which agent on it. This claim is the only thing that can, which is why the
- * Worker refuses a token that omits it rather than falling back to a default.
- * Without it `tenant` would be an unauthenticated field in the request body,
- * and a token legitimately issued for one agent could be replayed against any
- * of its siblings.
+ * **This file is a guardian.** The four checks below — `jku` present → origin
+ * allowlist → `iss` origin equals `jku` origin → `jwtVerify` pinned to EdDSA —
+ * are the whole zero-trust contract, and they arrived here byte-identical from
+ * two independently-evolved agents. Do not weaken any of them, do not make any
+ * of them optional, and do not add a bypass for local development: run a local
+ * gateway instead.
  */
-export declare const TENANT_CLAIM = "https://loopingai.org/tenant";
 /**
- * The gateway-agent instance identity forwarded by the gateway — i.e. which
- * registered agent instance dispatched this call, not the human end user.
- * Mirrors `RemoteIdentity` in looping-gateway's `src/auth/agent-jwt.ts`.
+ * The wire contract — claim names, algorithm, identity shape — comes from
+ * `@loopingai/a2a-protocol`, which the gateway also depends on directly.
  *
- * Any end user travels unverified, inline in the message text; the gateway
- * deliberately excludes it from this signed claim so a remote agent cannot read
- * the full caller auth context. Every field is optional because the claim is
- * whatever the issuer put there — {@link GatewayIdentity.key} is the only one
- * anything downstream depends on, and a caller without it is rejected before a
- * DO is ever addressed.
+ * It used to be declared here and again in the gateway, each with a comment
+ * saying it must match the other, because the gateway is not an agent and must
+ * not import this package. That failed exactly as it always does: one side
+ * moved to the `loopingai.org` namespace while the other still minted
+ * `https://looping.ai/tenant`, verification read an empty tenant, and every
+ * request 401'd with both builds green.
+ *
+ * Re-exported below so nothing downstream of `@loopingai/core/a2a` has to know
+ * the split happened — an agent still imports these from here.
  */
-export interface GatewayIdentity {
-    /** Canonical instance key, e.g. `custom:7:analytics`. */
-    key?: string;
-    /** Registry name of the logical agent instance. */
-    name?: string;
-    /** Dispatch kind of the caller (`"custom"` for remote agents). */
-    kind?: string;
-    /** Workspace the calling agent instance belongs to. */
-    workspaceId?: number | null;
-}
+export { IDENTITY_CLAIM, TENANT_CLAIM, type GatewayIdentity } from "@loopingai/a2a-protocol";
 /** Thrown when a gateway token is missing or fails verification. */
 export declare class GatewayAuthError extends Error {
     constructor(message: string);

package/dist/a2a/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AAyBd;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,mCAAmC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,iCAAiC,CAAC;AAE3D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAcD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAenE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IACT,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CA8CD"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AACd,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,cAAc,EACd,YAAY,EACZ,KAAK,eAAe,EACrB,MAAM,yBAAyB,CAAC;AAEjC,oEAAoE;AACpE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAcD,wEAAwE;AACxE,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED,MAAM,WAAW,aAAa;IAC5B,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAenE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC;IACT,OAAO,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAgDD"}

package/dist/a2a/verify.js

@@ -1,4 +1,5 @@
 import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from "jose";
+import { A2A_JWS_ALG, readIdentityClaim, readTenantClaim } from "@loopingai/a2a-protocol";
 /**
  * Verify the gateway identity JWT (the "B authenticates A" half of zero-trust).
  *
@@ -18,29 +19,21 @@ import { createRemoteJWKSet, decodeJwt, decodeProtectedHeader, jwtVerify } from
  * of them optional, and do not add a bypass for local development: run a local
  * gateway instead.
  */
-/** Algorithm the gateway signs with — reject anything else. */
-const ALG = "EdDSA";
 /**
- * Default namespaced claim carrying the minimal caller identity.
+ * The wire contract — claim names, algorithm, identity shape — comes from
+ * `@loopingai/a2a-protocol`, which the gateway also depends on directly.
  *
- * Overridable via {@link VerifyOptions.identityClaim} for a deployment that
- * isn't behind looping-gateway; the default is the Looping namespace so an
- * agent built on this package needs no configuration to interoperate.
- */
-export const IDENTITY_CLAIM = "https://loopingai.org/identity";
-/**
- * Default namespaced claim naming the **tenant** the gateway minted this token
- * for — which of the agents on this origin it authorizes the call to reach.
+ * It used to be declared here and again in the gateway, each with a comment
+ * saying it must match the other, because the gateway is not an agent and must
+ * not import this package. That failed exactly as it always does: one side
+ * moved to the `loopingai.org` namespace while the other still minted
+ * `https://looping.ai/tenant`, verification read an empty tenant, and every
+ * request 401'd with both builds green.
  *
- * Several agents share one endpoint, so they also share an `aud`: the audience
- * proves the token was minted for *this deployment*, and can say nothing about
- * which agent on it. This claim is the only thing that can, which is why the
- * Worker refuses a token that omits it rather than falling back to a default.
- * Without it `tenant` would be an unauthenticated field in the request body,
- * and a token legitimately issued for one agent could be replayed against any
- * of its siblings.
+ * Re-exported below so nothing downstream of `@loopingai/core/a2a` has to know
+ * the split happened — an agent still imports these from here.
  */
-export const TENANT_CLAIM = "https://loopingai.org/tenant";
+export { IDENTITY_CLAIM, TENANT_CLAIM } from "@loopingai/a2a-protocol";
 /** Thrown when a gateway token is missing or fails verification. */
 export class GatewayAuthError extends Error {
     constructor(message) {
@@ -125,15 +118,17 @@ export async function verifyGatewayToken(token, opts) {
         const { payload } = await jwtVerify(token, jwksFor(jku), {
             issuer: allowedOrigins,
             audience: opts.audience,
-            algorithms: [ALG]
+            algorithms: [A2A_JWS_ALG]
         });
-        const claim = opts.identityClaim ?? IDENTITY_CLAIM;
-        const identity = payload[claim] ?? {};
-        const tenant = payload[opts.tenantClaim ?? TENANT_CLAIM];
+        // Read through the protocol package's readers rather than indexing the
+        // payload here: they are where "an absent or malformed claim yields an
+        // empty value, never a default" has its single implementation, and the
+        // emptiness is load-bearing — `createA2AWorker` compares the tenant against
+        // the one the request body addressed, and `""` matches none of them.
         return {
             payload,
-            identity,
-            tenant: typeof tenant === "string" ? tenant : ""
+            identity: readIdentityClaim(payload, opts.identityClaim),
+            tenant: readTenantClaim(payload, opts.tenantClaim)
         };
     }
     catch (err) {

package/dist/a2a/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AAEd;;;;;;;;;;;;;;;;;;GAkBG;AAEH,+DAA+D;AAC/D,MAAM,GAAG,GAAG,OAAO,CAAC;AAEpB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAyB3D,oEAAoE;AACpE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,MAAM,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAmB;IAMnB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAqB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,yCAAyC,CAClE,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,gCAAgC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACvD,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,GAAG,CAAC;SAClB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,cAAc,CAAC;QACnD,MAAM,QAAQ,GAAI,OAAO,CAAC,KAAK,CAAiC,IAAI,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;QACzD,OAAO;YACL,OAAO;YACP,QAAQ;YACR,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACjD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/a2a/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,qBAAqB,EACrB,SAAS,EAEV,MAAM,MAAM,CAAC;AACd,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,eAAe,EAEhB,MAAM,yBAAyB,CAAC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,cAAc,EACd,YAAY,EAEb,MAAM,yBAAyB,CAAC;AAEjC,oEAAoE;AACpE,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,8EAA8E;AAC9E,oDAAoD;AACpD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAC3E,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,wCAAwC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,WAAW,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,gBAAgB,CACxB,mCAAmC,MAAM,MAAM,OAAO,EAAE,CACzD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAa,EACb,IAAmB;IAMnB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpE,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAqB,CAAC;QAChE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,CACnD,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,oEAAoE;QACpE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,yCAAyC,CAClE,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CACxB,eAAe,SAAS,gCAAgC,SAAS,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACvD,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,WAAW,CAAC;SAC1B,CAAC,CAAC;QACH,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,4EAA4E;QAC5E,qEAAqE;QACrE,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC;YACxD,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC;SACnD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,MAAM,IAAI,gBAAgB,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/agent/index.d.ts

@@ -1,11 +1,22 @@
 /**
  * `@loopingai/core/agent` — the primitives a loop is built from.
  *
- * Core ships no loop. `turn.ts` / `loop.ts` are the agent's, because how a round
- * ends is the one thing every agent genuinely differs on. What core owns is
- * everything both predecessor loops needed identically: the session, the model
- * pair with its fallback, the budget, and the control-tool abstraction that
- * turns "the model called something that ends the round" into a checked value.
+ * The session, the model pair with its fallback, the budget, and the
+ * control-tool abstraction that turns "the model called something that ends the
+ * round" into a checked value. Everything both predecessor loops needed
+ * identically, and nothing about how a round is shaped.
+ *
+ * This subpath ships **no loop** — that is what makes it importable by one. A
+ * loop module needs these primitives without also pulling in a Durable Object
+ * base class and drizzle, which is why `LoopingAgent` lives in
+ * `@loopingai/core/host` and the delegating round loop in
+ * `@loopingai/core/round`.
+ *
+ * Core as a whole *does* now ship a loop, opt-in, in `/round`. The rule it
+ * still keeps is narrower and better: **core ships no prompt copy and no
+ * policy** — see `AGENTS.md`, "The line core does not cross". An agent that
+ * wants a different round shape imports none of `/round` and builds it from
+ * exactly what is here.
  */
 export { newTurnBudget, stepAllowance, type TurnBudget } from "./budget.js";
 export { createModelRuntime, type GatewayMetadata, type ModelOverrides, type ModelPair, type ModelRuntime, type ModelRuntimeDeps } from "./model.js";

package/dist/agent/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAClB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,KAAK,UAAU,EAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAClB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}

package/dist/agent/index.js

@@ -1,11 +1,22 @@
 /**
  * `@loopingai/core/agent` — the primitives a loop is built from.
  *
- * Core ships no loop. `turn.ts` / `loop.ts` are the agent's, because how a round
- * ends is the one thing every agent genuinely differs on. What core owns is
- * everything both predecessor loops needed identically: the session, the model
- * pair with its fallback, the budget, and the control-tool abstraction that
- * turns "the model called something that ends the round" into a checked value.
+ * The session, the model pair with its fallback, the budget, and the
+ * control-tool abstraction that turns "the model called something that ends the
+ * round" into a checked value. Everything both predecessor loops needed
+ * identically, and nothing about how a round is shaped.
+ *
+ * This subpath ships **no loop** — that is what makes it importable by one. A
+ * loop module needs these primitives without also pulling in a Durable Object
+ * base class and drizzle, which is why `LoopingAgent` lives in
+ * `@loopingai/core/host` and the delegating round loop in
+ * `@loopingai/core/round`.
+ *
+ * Core as a whole *does* now ship a loop, opt-in, in `/round`. The rule it
+ * still keeps is narrower and better: **core ships no prompt copy and no
+ * policy** — see `AGENTS.md`, "The line core does not cross". An agent that
+ * wants a different round shape imports none of `/round` and builds it from
+ * exactly what is here.
  */
 export { newTurnBudget, stepAllowance } from "./budget.js";
 export { createModelRuntime } from "./model.js";

package/dist/agent/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAMnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EAIpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EAGf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agent/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAmB,MAAM,aAAa,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAMnB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EAIpB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,EACnB,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,eAAe,EAEhB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,+BAA+B,EAC/B,kBAAkB,EAEnB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,cAAc,EAGf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,cAAc,EACf,MAAM,kBAAkB,CAAC"}

package/dist/config.d.ts

@@ -13,11 +13,29 @@
  */
 /** Model ids and per-call generation settings. */
 export interface ModelConfig {
-    /** Workers AI model for the tool loop. Must support function calling. */
+    /**
+     * Workers AI model for the tool loop. Must support function calling.
+     *
+     * **Required — core ships no default.** Which model an agent runs on is the
+     * single most consequential thing about it: it sets the cost of every turn,
+     * the tool-calling reliability the whole control-tool design rests on, and the
+     * failure modes the fallback exists to escape. A default here would be core
+     * making that choice on a consumer's behalf, silently, and being wrong for
+     * most of them — the same reason core ships no prompt copy.
+     *
+     * It is also the value most likely to age badly. A model id baked into a
+     * published package survives every deprecation until someone bumps the
+     * package; one written in the agent that uses it is read by whoever owns the
+     * bill.
+     */
     chatModelId: string;
     /**
-     * Tried when the primary throws. Should be a *different vendor and family* —
-     * a same-family fallback shares the failure mode you are falling back from.
+     * Tried when the primary throws. **Required — core ships no default.**
+     *
+     * Should be a *different vendor and family* — a same-family fallback shares
+     * the failure mode you are falling back from, which makes it a retry wearing
+     * a costume. Core cannot pick this for you precisely because it depends on
+     * what you chose as primary.
      */
     fallbackChatModelId: string;
     /** AI Gateway slug; `"default"` auto-provisions on first request. */
@@ -117,15 +135,39 @@ export interface CoreConfig {
     maxSubtasks: number;
     session: SessionConfig;
 }
+/** The two ids an agent must choose for itself. Core has no opinion. */
+export type RequiredModelIds = Pick<ModelConfig, "chatModelId" | "fallbackChatModelId">;
+/**
+ * The baseline, which is everything core *does* still have an opinion about.
+ *
+ * Note what is missing: the model pair. This type is `CoreConfig` minus those
+ * two ids precisely so that no value of it can supply them — a default nobody
+ * declared is how an agent ends up billing a model its author never chose.
+ */
+export type CoreConfigBaseline = Omit<CoreConfig, "model"> & {
+    model: Omit<ModelConfig, keyof RequiredModelIds>;
+};
 /**
  * A working baseline. Every value is overridable; none is a ceiling. These are
  * the values both predecessor agents converged on in production, so they are a
  * reasonable place to start rather than an opinion about your domain.
+ *
+ * **It carries no model ids.** See {@link ModelConfig.chatModelId}.
+ */
+export declare const DEFAULT_CORE_CONFIG: CoreConfigBaseline;
+/**
+ * One level of optionality per nested group — enough for a config this shallow.
+ *
+ * `model` is the exception, and deliberately not optional: an agent must name
+ * its own primary and fallback. That is a compile error rather than a runtime
+ * one, so the omission is found while writing the agent rather than on the first
+ * request it serves.
  */
-export declare const DEFAULT_CORE_CONFIG: CoreConfig;
-/** One level of optionality per nested group — enough for a config this shallow. */
 export type CoreConfigOverrides = {
-    [K in keyof CoreConfig]?: CoreConfig[K] extends object ? Partial<CoreConfig[K]> : CoreConfig[K];
+    [K in Exclude<keyof CoreConfig, "model">]?: CoreConfig[K] extends object ? Partial<CoreConfig[K]> : CoreConfig[K];
+} & {
+    /** Required: the two model ids, plus any generation setting you want changed. */
+    model: RequiredModelIds & Partial<Omit<ModelConfig, keyof RequiredModelIds>>;
 };
 export declare class ConfigError extends Error {
     constructor(message: string);
@@ -138,5 +180,5 @@ export declare class ConfigError extends Error {
  * not call it per-request: the point of resolving is that every module downstream
  * reads the same object.
  */
-export declare function resolveConfig(overrides?: CoreConfigOverrides): CoreConfig;
+export declare function resolveConfig(overrides: CoreConfigOverrides): CoreConfig;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,eAAe,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,iEAAiE;IACjE,eAAe,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,cAAc,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAoBjC,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,MAAM,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,MAAM,GAClD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GACtB,UAAU,CAAC,CAAC,CAAC;CAClB,CAAC;AAEF,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,GAAE,mBAAwB,GAAG,UAAU,CA2C7E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,kDAAkD;AAClD,MAAM,WAAW,WAAW;IAC1B;;;;;;;;;;;;;;OAcG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,eAAe,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAC5C;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,eAAe,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;OAaG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,iEAAiE;IACjE,eAAe,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,cAAc,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;OAUG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,WAAW,EACX,aAAa,GAAG,qBAAqB,CACtC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG;IAC3D,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,gBAAgB,CAAC,CAAC;CAClD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,kBAoBjC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;KAC/B,CAAC,IAAI,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,MAAM,GACpE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GACtB,UAAU,CAAC,CAAC,CAAC;CAClB,GAAG;IACF,iFAAiF;IACjF,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,gBAAgB,CAAC,CAAC,CAAC;CAC9E,CAAC;AAEF,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,mBAAmB,GAAG,UAAU,CAsExE"}

package/dist/config.js

@@ -15,11 +15,13 @@
  * A working baseline. Every value is overridable; none is a ceiling. These are
  * the values both predecessor agents converged on in production, so they are a
  * reasonable place to start rather than an opinion about your domain.
+ *
+ * **It carries no model ids.** See {@link ModelConfig.chatModelId}.
  */
 export const DEFAULT_CORE_CONFIG = {
     model: {
-        chatModelId: "@cf/zai-org/glm-5.2",
-        fallbackChatModelId: "@cf/moonshotai/kimi-k2.7-code",
+        // Not a model: an AI Gateway slug, and `"default"` is Cloudflare's own
+        // auto-provision behaviour rather than a choice core is making for anyone.
         aiGatewayId: "default",
         maxOutputTokens: 16_384,
         reasoningEffort: "medium"
@@ -50,7 +52,7 @@ export class ConfigError extends Error {
  * not call it per-request: the point of resolving is that every module downstream
  * reads the same object.
  */
-export function resolveConfig(overrides = {}) {
+export function resolveConfig(overrides) {
     const config = {
         model: { ...DEFAULT_CORE_CONFIG.model, ...overrides.model },
         mainAgentLimits: {
@@ -70,6 +72,26 @@ export function resolveConfig(overrides = {}) {
             throw new ConfigError(`${name} must be a positive number, got ${value}`);
         }
     };
+    // The type already requires both ids; this catches the JavaScript consumer,
+    // the `as CoreConfigOverrides` cast, and the empty string — which typechecks
+    // and then reaches Workers AI as a model that does not exist, failing on the
+    // first generation with a binding error that names nothing useful.
+    const modelId = (value, name) => {
+        if (typeof value !== "string" || value.trim() === "") {
+            throw new ConfigError(`model.${name} is required and must be a non-empty model id — core ` +
+                `ships no default, because which model an agent runs on is the agent's ` +
+                `most consequential choice and cannot be made on its behalf`);
+        }
+    };
+    modelId(config.model.chatModelId, "chatModelId");
+    modelId(config.model.fallbackChatModelId, "fallbackChatModelId");
+    // A fallback identical to the primary is a retry wearing a costume: it shares
+    // the outage, the rate limit and the deprecation you are falling back from.
+    if (config.model.chatModelId === config.model.fallbackChatModelId) {
+        throw new ConfigError(`model.fallbackChatModelId must differ from model.chatModelId (both are ` +
+            `'${config.model.chatModelId}') — a same-model fallback shares every ` +
+            `failure mode you are falling back from`);
+    }
     positive(config.mainAgentLimits.maxTurns, "mainAgentLimits.maxTurns");
     positive(config.mainAgentLimits.maxWallMs, "mainAgentLimits.maxWallMs");
     positive(config.subagentLimits.maxTurns, "subagentLimits.maxTurns");

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAgHH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAe;IAC7C,KAAK,EAAE;QACL,WAAW,EAAE,qBAAqB;QAClC,mBAAmB,EAAE,+BAA+B;QACpD,WAAW,EAAE,SAAS;QACtB,eAAe,EAAE,MAAM;QACvB,eAAe,EAAE,QAAQ;KAC1B;IACD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACzD,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACxD,gBAAgB,EAAE,CAAC;IACnB,WAAW,EAAE,CAAC;IACd,OAAO,EAAE;QACP,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,MAAM;QAC1B,iBAAiB,EAAE,KAAK;QACxB,iBAAiB,EACf,8EAA8E;YAC9E,sEAAsE;KACzE;CACF,CAAC;AASF,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,YAAiC,EAAE;IAC/D,MAAM,MAAM,GAAe;QACzB,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE;QAC3D,eAAe,EAAE;YACf,GAAG,mBAAmB,CAAC,eAAe;YACtC,GAAG,SAAS,CAAC,eAAe;SAC7B;QACD,cAAc,EAAE;YACd,GAAG,mBAAmB,CAAC,cAAc;YACrC,GAAG,SAAS,CAAC,cAAc;SAC5B;QACD,gBAAgB,EACd,SAAS,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,gBAAgB;QACpE,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,mBAAmB,CAAC,WAAW;QACrE,OAAO,EAAE,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,IAAY,EAAQ,EAAE;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACxE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACvE,IAAI,QAAQ,GAAG,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,gFAAgF,QAAQ,IAAI;YAC1F,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAmJH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAuB;IACrD,KAAK,EAAE;QACL,uEAAuE;QACvE,2EAA2E;QAC3E,WAAW,EAAE,SAAS;QACtB,eAAe,EAAE,MAAM;QACvB,eAAe,EAAE,QAAQ;KAC1B;IACD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACzD,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE;IACxD,gBAAgB,EAAE,CAAC;IACnB,WAAW,EAAE,CAAC;IACd,OAAO,EAAE;QACP,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,MAAM;QAC1B,iBAAiB,EAAE,KAAK;QACxB,iBAAiB,EACf,8EAA8E;YAC9E,sEAAsE;KACzE;CACF,CAAC;AAmBF,MAAM,OAAO,WAAY,SAAQ,KAAK;IACpC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAA8B;IAC1D,MAAM,MAAM,GAAe;QACzB,KAAK,EAAE,EAAE,GAAG,mBAAmB,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE;QAC3D,eAAe,EAAE;YACf,GAAG,mBAAmB,CAAC,eAAe;YACtC,GAAG,SAAS,CAAC,eAAe;SAC7B;QACD,cAAc,EAAE;YACd,GAAG,mBAAmB,CAAC,cAAc;YACrC,GAAG,SAAS,CAAC,cAAc;SAC5B;QACD,gBAAgB,EACd,SAAS,CAAC,gBAAgB,IAAI,mBAAmB,CAAC,gBAAgB;QACpE,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,mBAAmB,CAAC,WAAW;QACrE,OAAO,EAAE,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE;KAClE,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,IAAY,EAAQ,EAAE;QACrD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,mCAAmC,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC;IAEF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mEAAmE;IACnE,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,IAAY,EAAQ,EAAE;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrD,MAAM,IAAI,WAAW,CACnB,SAAS,IAAI,uDAAuD;gBAClE,wEAAwE;gBACxE,4DAA4D,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;IAEjE,8EAA8E;IAC9E,4EAA4E;IAC5E,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC;QAClE,MAAM,IAAI,WAAW,CACnB,yEAAyE;YACvE,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,0CAA0C;YACtE,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IACxE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;IACpE,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,0BAA0B,CAAC,CAAC;IACtE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IACtD,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,QAAQ,GACZ,MAAM,CAAC,OAAO,CAAC,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACvE,IAAI,QAAQ,GAAG,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CACnB,gFAAgF,QAAQ,IAAI;YAC1F,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/contract/recipe.d.ts

@@ -76,8 +76,6 @@ export type RecipeLimits = AgentLimits;
 export interface ResolvedRecipe {
     key: string;
     version: number;
-    primaryModelId: string;
-    fallbackModelId: string;
     /** Required, never defaulted — see `validateRecipe`. */
     soul: string;
     toolFamilies: string[];
@@ -104,6 +102,20 @@ export interface ResolvedRecipe {
  */
 export interface ValidatedRecipe extends ResolvedRecipe {
     limits: RecipeLimits;
+    /**
+     * The pair this recipe will actually run on — **the host's, always**.
+     *
+     * These exist only here, never on {@link ResolvedRecipe}, and that asymmetry
+     * is the design: a recipe cannot state a model, so the only way to hold one is
+     * to have been through {@link validateRecipe}, which copies the host's. Recipe
+     * data has no path to influence them.
+     *
+     * Guaranteed non-empty and guaranteed distinct, because `resolveConfig`
+     * refuses a config that is either — so the fallback is always a genuinely
+     * different model from the primary, which is the entire point of having one.
+     */
+    primaryModelId: string;
+    fallbackModelId: string;
 }
 /**
  * One entry in the closed set of Subtask types the main agent may delegate,

package/dist/contract/recipe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"recipe.d.ts","sourceRoot":"","sources":["../../src/contract/recipe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;OASG;IACH,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC;IACxD,wDAAwD;IACxD,MAAM,EAAE,cAAc,CAAC;CACxB"}
+{"version":3,"file":"recipe.d.ts","sourceRoot":"","sources":["../../src/contract/recipe.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAC7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;;;;;;;;;GAeG;AAEH,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;AAElE;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAyBhB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,MAAM,EAAE,YAAY,CAAC;IACrB;;;;;;;;;;;OAWG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;OASG;IACH,MAAM,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACnC,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;;;OASG;IACH,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,MAAM,CAAC;IACxD,wDAAwD;IACxD,MAAM,EAAE,cAAc,CAAC;CACxB"}

package/dist/contract/validation.d.ts

@@ -4,12 +4,12 @@ import type { ResolvedRecipe, ValidatedRecipe } from "./recipe.js";
  * The capability boundary every recipe passes through, whatever declared it.
  *
  * This module imports no domain. It owns only what code must be able to say
- * about *any* recipe: which models and tool families it may select, and how a
- * malformed one is made safe or refused. A domain cannot widen its
- * *capabilities* by declaring them, because the allowlists do not come from the
- * declaration — they come from {@link RecipePolicy}, which the host builds from
- * its resolved config and its installed plugins. Its budget is the deliberate
- * exception; see {@link resolveLimits}.
+ * about *any* recipe: which tool families it may select, which models it runs
+ * on, and how a malformed one is made safe or refused. A domain cannot widen
+ * its *capabilities* by declaring them — the legal tool families come from
+ * {@link RecipePolicy}, which the host builds from its installed plugins, and
+ * the model pair comes from the host's config with no declaration involved at
+ * all. Its budget is the deliberate exception; see {@link resolveLimits}.
  *
  * In the predecessor repo the two allowlists were module constants, and one of
  * them hardcoded a domain key (`"arc-game"`) inside otherwise generic code. That
@@ -18,15 +18,19 @@ import type { ResolvedRecipe, ValidatedRecipe } from "./recipe.js";
  */
 export interface RecipePolicy {
     /**
-     * Model ids a recipe may select — normally the two configured chat models, the
-     * only ones proven with this tool-loop pipeline. Extend deliberately, one
-     * validated model at a time.
+     * The pair every recipe runs on: the host agent's own, copied verbatim onto
+     * each {@link ValidatedRecipe}.
+     *
+     * There is no allowlist any more, because there is nothing to check against
+     * it — a recipe cannot state a model. `modelAllowlist` existed to police
+     * recipe-stated preferences, and it could only ever contain these same two
+     * ids, so the "preference" it policed could never reach a third model. It
+     * could only swap the primary for the fallback, which is not a capability
+     * anyone wants and which broke the pair's distinctness.
      */
-    modelAllowlist: ReadonlySet<string>;
-    /** Substituted when a recipe names a primary model outside the allowlist. */
-    defaultPrimaryModelId: string;
-    /** Substituted when a recipe names a fallback model outside the allowlist. */
-    defaultFallbackModelId: string;
+    primaryModelId: string;
+    /** See {@link primaryModelId}. Guaranteed distinct from it by `resolveConfig`. */
+    fallbackModelId: string;
     /**
      * Tool-family keys the runtime recognizes — derived from the installed
      * plugins, never hardcoded.
@@ -69,12 +73,12 @@ export declare class RecipeValidationError extends Error {
 }
 /**
  * Code-owned defensive validation of an already-resolved recipe. Returns a
- * normalized copy (never mutates the input): a model id outside the policy's
- * allowlist is substituted with the default for its slot — independently per
- * slot — and unknown tool families are dropped (deduped, order-preserving).
+ * normalized copy (never mutates the input): the host's model pair is stamped
+ * on, and unknown tool families are dropped (deduped, order-preserving).
  * Applied by the parent when it resolves a recipe and re-applied by the subagent
  * on its inbound request, so recipe data can never select arbitrary models or
- * tools.
+ * tools — models because there is no field to select one with, tools because
+ * the legal set comes from the installed plugins rather than the declaration.
  *
  * The split between what is normalized and what is refused follows one rule:
  * **the host declares a baseline ⇒ merge; it does not ⇒ require.** `limits`

package/dist/contract/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/contract/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,6EAA6E;IAC7E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,4DAA4D;IAC5D,cAAc,EAAE,WAAW,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,EAC5B,QAAQ,EAAE,WAAW,GACpB,WAAW,CAOb;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,YAAY,GACnB,eAAe,CA+BjB"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/contract/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;;;;;;OAUG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;OAUG;IACH,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC,4DAA4D;IAC5D,cAAc,EAAE,WAAW,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,EAC5B,QAAQ,EAAE,WAAW,GACpB,WAAW,CAOb;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,YAAY,GACnB,eAAe,CAwCjB"}

package/dist/contract/validation.js

@@ -34,12 +34,12 @@ export class RecipeValidationError extends Error {
 }
 /**
  * Code-owned defensive validation of an already-resolved recipe. Returns a
- * normalized copy (never mutates the input): a model id outside the policy's
- * allowlist is substituted with the default for its slot — independently per
- * slot — and unknown tool families are dropped (deduped, order-preserving).
+ * normalized copy (never mutates the input): the host's model pair is stamped
+ * on, and unknown tool families are dropped (deduped, order-preserving).
  * Applied by the parent when it resolves a recipe and re-applied by the subagent
  * on its inbound request, so recipe data can never select arbitrary models or
- * tools.
+ * tools — models because there is no field to select one with, tools because
+ * the legal set comes from the installed plugins rather than the declaration.
  *
  * The split between what is normalized and what is refused follows one rule:
  * **the host declares a baseline ⇒ merge; it does not ⇒ require.** `limits`
@@ -63,12 +63,21 @@ export function validateRecipe(recipe, policy) {
     const toolFamilies = [...new Set(recipe.toolFamilies)].filter((family) => policy.knownToolFamilies.has(family));
     return {
         ...recipe,
-        primaryModelId: policy.modelAllowlist.has(recipe.primaryModelId)
-            ? recipe.primaryModelId
-            : policy.defaultPrimaryModelId,
-        fallbackModelId: policy.modelAllowlist.has(recipe.fallbackModelId)
-            ? recipe.fallbackModelId
-            : policy.defaultFallbackModelId,
+        // The host's pair, copied. Not selected, not substituted, not merged —
+        // there is nothing on a `ResolvedRecipe` to select *from*.
+        //
+        // This used to substitute a recipe's stated preference against
+        // an allowlist, per slot and independently. That produced a real defect:
+        // a recipe preferring the host's *fallback* as its primary, and stating no
+        // fallback of its own, resolved to the same id in both slots — so the
+        // fallback retried the model that had just failed, defeating the distinct-
+        // pair invariant `resolveConfig` enforces one layer up.
+        //
+        // Copying wholesale makes that unrepresentable: the pair here is exactly the
+        // pair the agent configured, which `resolveConfig` has already guaranteed is
+        // non-empty and distinct.
+        primaryModelId: policy.primaryModelId,
+        fallbackModelId: policy.fallbackModelId,
         toolFamilies,
         limits: resolveLimits(recipe.limits, policy.baselineLimits)
     };

package/dist/contract/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/contract/validation.ts"],"names":[],"mappings":"AA8CA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA4B,EAC5B,QAAqB;IAErB,MAAM,WAAW,GAAG,CAAC,CAAqB,EAAE,QAAgB,EAAU,EAAE,CACtE,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,OAAO;QACL,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC1D,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,MAAoB;IAEpB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,WAAW,MAAM,CAAC,GAAG,OAAO,MAAM,CAAC,OAAO,eAAe,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,qBAAqB,CAC7B,WAAW,MAAM,CAAC,GAAG,OAAO,MAAM,CAAC,OAAO,eAAe,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,qBAAqB,CAC7B,WAAW,MAAM,CAAC,GAAG,OAAO,MAAM,CAAC,OAAO,gCAAgC;YACxE,QAAQ,MAAM,CAAC,aAAa,gCAAgC,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CACrC,CAAC;IACF,OAAO;QACL,GAAG,MAAM;QACT,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,cAAc;YACvB,CAAC,CAAC,MAAM,CAAC,qBAAqB;QAChC,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC;YAChE,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,MAAM,CAAC,sBAAsB;QACjC,YAAY;QACZ,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;KAC5D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/contract/validation.ts"],"names":[],"mappings":"AAkDA;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,MAA4B,EAC5B,QAAqB;IAErB,MAAM,WAAW,GAAG,CAAC,CAAqB,EAAE,QAAgB,EAAU,EAAE,CACtE,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACvE,OAAO;QACL,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC1D,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC5B,MAAsB,EACtB,MAAoB;IAEpB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,qBAAqB,CAC7B,WAAW,MAAM,CAAC,GAAG,OAAO,MAAM,CAAC,OAAO,eAAe,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,qBAAqB,CAC7B,WAAW,MAAM,CAAC,GAAG,OAAO,MAAM,CAAC,OAAO,eAAe,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,qBAAqB,CAC7B,WAAW,MAAM,CAAC,GAAG,OAAO,MAAM,CAAC,OAAO,gCAAgC;YACxE,QAAQ,MAAM,CAAC,aAAa,gCAAgC,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvE,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,CACrC,CAAC;IACF,OAAO;QACL,GAAG,MAAM;QACT,uEAAuE;QACvE,2DAA2D;QAC3D,EAAE;QACF,+DAA+D;QAC/D,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,2EAA2E;QAC3E,wDAAwD;QACxD,EAAE;QACF,6EAA6E;QAC7E,6EAA6E;QAC7E,0BAA0B;QAC1B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY;QACZ,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;KAC5D,CAAC;AACJ,CAAC"}