@namzu/sdk 43.0.0 → 44.1.0

package/dist/types/run/stop-reason.d.ts

@@ -1,67 +0,0 @@
-export type StopReason = 'end_turn' | 'token_budget' | 'cost_limit'
-/**
- * A `costLimitUsd` was set and part of the run ran at a rate nobody has, so
- * the limit could not be measured.
- *
- * Distinct from `cost_limit`, and the distinction is the reason this value
- * exists: nothing was overspent. Reporting `cost_limit` would send the
- * reader to look at spend that was never computed, and would hide the one
- * fact they need — that the budget they configured was unenforceable for
- * part of this run.
- *
- * `query()` refuses the same combination up front, so this is the case
- * preflight cannot see: a step naming its own model, or a chain member
- * declaring one, arriving at a model the price catalogue has no row for.
- * `costInfo.unpricedTokens` says how much of the run it covers.
- *
- * A hard stop issues no further model request. Completed messages and
- * tool results remain in the run even when no closing prose was produced.
- */
- | 'cost_unmeasurable' | 'timeout' | 'max_iterations' | 'cancelled' | 'plan_rejected'
-/** A caller-supplied `stopWhen` predicate returned true. */
- | 'stop_condition'
-/**
- * A host's `beforeStep` refused the next model call.
- *
- * Distinct from `stop_condition`, which reads `steps` and therefore
- * only fires AFTER the step it disliked ran and was paid for. This one
- * fires before the provider is called at all — the case a host with a
- * live rate limit, a revoked tenant or a spend ceiling actually has.
- */
- | 'step_refused'
-/** The model never produced a valid structured output within its retries. */
- | 'structured_output_failed'
-/**
- * A host reviewer kept rejecting the answer and the run ran out of
- * attempts.
- *
- * Distinct from a budget stop on purpose: without it the run would end
- * on `max_iterations` or a token cap, naming the resource it exhausted
- * rather than the judgement that exhausted it — and the reader would go
- * looking for a loop instead of at the reviewer.
- */
- | 'answer_rejected'
-/** An input guardrail refused the run before it started. */
- | 'input_guardrail'
-/** An output guardrail refused the produced result. */
- | 'output_guardrail' | 'paused' | 'error';
-/**
- * Per-LLM-message stop reason — distinct from the run-level {@link StopReason}.
- *
- * The union of the finish reasons providers report, normalised into a
- * provider-agnostic vocabulary. `forced_finalize` is a Namzu-specific value
- * emitted by the orchestrator when budget warnings request a final response
- * without a model-issued stop reason.
- */
-export type MessageStopReason = 'end_turn' | 'tool_use' | 'max_tokens' | 'stop_sequence' | 'pause_turn' | 'refusal' | 'forced_finalize'
-/**
- * The turn was cancelled mid-stream.
- *
- * Also Namzu-specific, and added because the cancel path had no way to
- * close the message it had opened: it re-threw from inside the chunk
- * loop, so the terminal event never fired and a host consuming the
- * message lifecycle saw a message begin and never end. A turn that
- * stops is still a turn that finished streaming, whatever stopped it.
- */
- | 'cancelled';
-//# sourceMappingURL=stop-reason.d.ts.map

package/dist/types/run/stop-reason.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"stop-reason.d.ts","sourceRoot":"","sources":["../../../src/types/run/stop-reason.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GACnB,UAAU,GACV,cAAc,GACd,YAAY;AACd;;;;;;;;;;;;;;;;;GAiBG;GACD,mBAAmB,GACnB,SAAS,GACT,gBAAgB,GAChB,WAAW,GACX,eAAe;AACjB,4DAA4D;GAC1D,gBAAgB;AAClB;;;;;;;GAOG;GACD,cAAc;AAChB,6EAA6E;GAC3E,0BAA0B;AAC5B;;;;;;;;GAQG;GACD,iBAAiB;AACnB,4DAA4D;GAC1D,iBAAiB;AACnB,uDAAuD;GACrD,kBAAkB,GAClB,QAAQ,GACR,OAAO,CAAA;AAEV;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAC1B,UAAU,GACV,UAAU,GACV,YAAY,GACZ,eAAe,GACf,YAAY,GACZ,SAAS,GACT,iBAAiB;AACnB;;;;;;;;GAQG;GACD,WAAW,CAAA"}

package/dist/types/run/stop-reason.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"stop-reason.js","sourceRoot":"","sources":["../../../src/types/run/stop-reason.ts"],"names":[],"mappings":""}

package/dist/types/run/store.d.ts

@@ -1,300 +0,0 @@
-import type { RunEvidenceScope, RunTextEvidenceSource } from '../../store/evidence/types.js';
-/**
- * RunStore — persistence contract for a run's own evidence.
- *
- * The checkpoint store got an injectable seam and this did not, which left
- * the run record, its messages, its transcript and its report reachable only
- * through a concrete filesystem class. For a kernel whose stated purpose is
- * auditable evidence, the evidence was the one thing that could not be
- * pointed at durable storage: on ephemeral infrastructure the transcript dies
- * with the container, and behind a load balancer two replicas write two
- * disjoint run trees for one tenant.
- *
- * The location was already injectable through a path builder — but that
- * returns filesystem path strings, so it relocates the directory without
- * changing the medium.
- *
- * ## Bound to one run, unlike {@link CheckpointStore}
- *
- * Every accessor here addresses the run the store was bound to by
- * {@link RunStore.initRun}, where a `CheckpointStore` takes an explicit scope
- * per call. That asymmetry is inherited rather than chosen: this contract is
- * extracted from a class the runtime already constructs per run and holds for
- * the run's lifetime, and re-keying it would change every call site in the
- * same change that introduces the seam — two risks where one will do.
- *
- * A host implementing a shared backend therefore keys its rows by the
- * attribution it was constructed with plus the bound run id. If this is later
- * re-keyed per call, it happens once, deliberately, as its own change.
- */
-import type { RunExecutionStatus } from '../common/index.js';
-import type { Message } from '../message/index.js';
-import type { AuditEvent } from './audit.js';
-import type { Run } from './entity.js';
-import type { PersistedRunEvent, RunEvent } from './events.js';
-/**
- * The run's surviving message history, and whether it can be placed against
- * the durable event log without guessing.
- *
- * `available` is stronger than "some bytes were found": `throughEventSeq`
- * names the exact event-log head the snapshot was published after. A caller
- * can therefore refuse a stale snapshot left by an earlier pause or a crash
- * during final persistence instead of presenting it as the whole run.
- *
- * `legacy-unverified` preserves read access to the raw message arrays written
- * before snapshots carried that boundary. Those messages are real, but no
- * stored fact proves which event-log head they represent, so they must not be
- * used to claim a complete transcript.
- */
-export type RunMessageSnapshot = {
-    readonly kind: 'available';
-    readonly throughEventSeq: number;
-    readonly messages: readonly Message[];
-} | {
-    readonly kind: 'legacy-unverified';
-    readonly messages: readonly Message[];
-} | {
-    readonly kind: 'unavailable';
-    readonly reason: 'not-persisted';
-};
-/** What a caller asks the log for. See {@link RunStore.readEvents}. */
-export interface ReadRunEventsOptions {
-    /**
-     * Return only events ABOVE this sequence — strictly greater, never equal.
-     *
-     * The exclusive boundary is what makes a cursor round-trip: a consumer that
-     * last saw `seq: 12` passes 12 and receives 13 onward, so nothing is
-     * delivered twice. Absent means the whole log.
-     */
-    readonly sinceSeq?: number;
-    /**
-     * Refuse a disk transcript with a torn, malformed, or discontinuously
-     * numbered record instead of skipping past it.
-     *
-     * The default stays `tolerant`: an incident viewer is usually better served
-     * by every intact event around one damaged line. A caller making a
-     * completeness claim — an export, a replay proof, an archive — chooses
-     * `strict`, because one skipped line makes that claim false even when the
-     * rest of the log remains useful.
-     */
-    readonly integrity?: 'tolerant' | 'strict';
-}
-/**
- * One finished tool call, recovered from the run's own transcript.
- *
- * Re-declared here rather than imported from the disk store so the contract
- * does not depend on an implementation of itself.
- */
-export interface CompletedToolRecord {
-    readonly toolUseId: string;
-    readonly toolName: string;
-    readonly result: string;
-    readonly isError: boolean;
-}
-/** The latest recorded execution boundary of a tool call, not its inferred external effect. */
-export type ToolExecutionRecord = (CompletedToolRecord & {
-    readonly status: 'completed';
-}) | {
-    readonly toolUseId: string;
-    readonly toolName: string;
-    readonly status: 'started';
-};
-/**
- * One delegated child run found on disk under its parent's `children/`
- * directory, as {@link import('../../store/run/disk.js').RunDiskStore.listChildren}
- * reports it.
- *
- * A DISCOVERY record, not the child's evidence: every field here comes from
- * the child's `run.json`, and the transcript, message snapshot and report
- * beside it stay on disk until something asks for them. {@link dir} is what
- * that something reads from.
- *
- * Everything the file supplies is optional, because a `run.json` is written
- * by the child's own terminal path and a process killed before it got there
- * leaves a directory whose other evidence is still worth opening. An absent
- * field is "this file did not say", never a zero or an empty string.
- */
-export interface DelegatedChildRun {
-    /**
-     * The child's run id, taken from the directory name.
-     *
-     * The location is the fact: `initRun` names the directory after the run
-     * it binds, so a `run.json` whose `id` disagrees with its own directory
-     * was moved or hand-edited, and the directory is the half that decides
-     * where the evidence actually is.
-     */
-    readonly id: string;
-    /** The parent run whose `children/` directory holds this one. */
-    readonly parentRunId: string;
-    /** Absolute path to the child's evidence directory. */
-    readonly dir: string;
-    readonly agentId?: string;
-    readonly agentName?: string;
-    /** `metadata.config.model` — the model the child was configured with. */
-    readonly model?: string;
-    readonly status?: RunExecutionStatus;
-    readonly startedAt?: number;
-    readonly endedAt?: number;
-    /** `tokenUsage.totalTokens` — this child's own cumulative spend. */
-    readonly totalTokens?: number;
-    readonly depth?: number;
-}
-/** Absence proves no recorded start only when the whole selected log is complete. */
-export interface ToolExecutionSnapshot {
-    readonly complete: boolean;
-    readonly records: ReadonlyMap<string, ToolExecutionRecord>;
-}
-export interface RunStore {
-    /**
-     * Optional bounded recovery scan for selected call IDs. A started call without
-     * a completion has an unknown outcome and must not be automatically replayed.
-     * The runtime falls back to strict readEvents for stores without this method.
-     */
-    readToolExecutions?(toolUseIds: readonly string[], signal?: AbortSignal): Promise<ToolExecutionSnapshot>;
-    /**
-     * Optional bounded read capability anchored to this writer's completed event
-     * boundary. Observe signal while waiting/reading; cancellation must not release
-     * a writer lock before its pending operation settles.
-     */
-    captureTextEvidence?(scope: RunEvidenceScope, maxReadBytes?: number, signal?: AbortSignal): Promise<RunTextEvidenceSource | undefined>;
-    /**
-     * Bind this store to a run, before any other call.
-     *
-     * Returns a location when the backend has one — the built-in disk store
-     * returns the run's directory — and `null` when it does not. A caller
-     * that renders the value must treat `null` as "this run is not on a
-     * filesystem" rather than as an error: an in-memory or object-storage
-     * backend has nothing to print, and inventing a path for it would put a
-     * directory that does not exist in front of an operator.
-     */
-    initRun(runId: string, parentRunId?: string): Promise<string | null>;
-    /** Persist the run record: status, metadata, usage, timings. */
-    writeRunMeta(run: Run): Promise<void>;
-    /**
-     * Publish the run's surviving message history through a durable event.
-     *
-     * The boundary is required. Messages are written after the terminal or
-     * pause event, and a resumed run reuses the same run id; without the
-     * boundary an older, valid file is indistinguishable from the current
-     * run's final snapshot.
-     */
-    writeMessages(run: Run, throughEventSeq: number): Promise<void>;
-    /**
-     * Read the published message snapshot back.
-     *
-     * Missing data is `unavailable`, never an available empty list. An empty
-     * list is a real snapshot only after {@link RunStore.writeMessages}
-     * explicitly published it. This distinction closes the crash window where
-     * the run's terminal event and metadata landed but its messages did not.
-     */
-    readMessages(): Promise<RunMessageSnapshot>;
-    /**
-     * Append one event to the run's durable event log.
-     *
-     * High-frequency streaming deltas are excluded before they reach here —
-     * that exclusion is a deliberate trade and belongs to the emitter, not to
-     * the backend, so a store must not re-filter.
-     */
-    appendEvent(event: RunEvent): Promise<void>;
-    /**
-     * Read the run's durable event log back, oldest first.
-     *
-     * Required, unlike {@link RunStore.addToIndex}, and the asymmetry is the
-     * point: a store that records a transcript it cannot read back is
-     * write-only evidence, which is the defect the whole contract exists to
-     * fix one level up. It is also what a reconnecting consumer catches up
-     * through — "refresh the page and keep watching the answer arrive" is this
-     * method plus a cursor and nothing else.
-     *
-     * Three obligations, each of which a consumer relies on:
-     *
-     *  1. **Ascending by `seq`, in the order the events were appended.** Do not
-     *     sort a log back into order — a log that needs sorting was written by
-     *     two processes, and hiding that produces a plausible transcript of a
-     *     run that never happened.
-     *  2. **`sinceSeq` is exclusive.** See {@link ReadRunEventsOptions}.
-     *  3. **Contiguous, or honestly short.** A backend that prunes may return a
-     *     first event above `sinceSeq + 1`; that is a gap, the caller detects
-     *     it, and the reconnect is refused rather than spliced. Do NOT
-     *     manufacture placeholders to close it.
-     *
-     * High-frequency events never enter the log (see
-     * {@link RunStore.appendEvent}), so what a late subscriber recovers is
-     * message-granular, not keystroke-granular. Aggregated assistant text,
-     * every tool result and the full message list are all intact; the deltas
-     * that composed them are not, and are not meant to be.
-     */
-    readEvents(options?: ReadRunEventsOptions): Promise<readonly PersistedRunEvent[]>;
-    /**
-     * Persist the run's final report. Returns a location, or `null` when the
-     * backend has none. See {@link RunStore.initRun}.
-     */
-    writeReport(content: string): Promise<string | null>;
-    /**
-     * Every tool call this run has already finished, keyed by `toolUseId`.
-     *
-     * A batch's results reach the message history only once the WHOLE batch
-     * settles, so a hard kill part-way through loses every result that had
-     * already come back, and the resumed run re-executes those calls. For a
-     * file write that is waste; for a payment or an email it is a second one.
-     *
-     * This completed-only view cannot distinguish an unstarted call from an
-     * interrupted effect. It is not authority to execute an absent call. Runtime
-     * recovery uses readToolExecutions or a strict readEvents scan instead.
-     */
-    readCompletedTools(): Promise<Map<string, CompletedToolRecord>>;
-    /**
-     * Where this run's evidence lives, or `null` when it is not on a
-     * filesystem. Valid only after {@link RunStore.initRun}.
-     */
-    getRunDir(): string | null;
-    /**
-     * Append one entry to this run's AUDIT trail. OPTIONAL on the contract,
-     * the same way {@link RunStore.addToIndex} is — an existing custom
-     * `RunStore` keeps compiling without it. Unlike `addToIndex`, though, its
-     * absence is not a shrug:
-     * {@link import('../../manager/run/persistence.js').RunPersistence.recordAudit}
-     * REFUSES rather than silently running a bound store that lacks it, per
-     * `refuse-do-not-degrade` — an audit trail nobody can point at is not a
-     * degraded feature, it is the kernel's central claim quietly not being
-     * true. NOTE: because `recordAudit` is called from every run's terminal
-     * path, a `RunStore` implementer that adopts this contract without also
-     * implementing this method will see every run throw. See the major-bump
-     * changeset.
-     *
-     * A SEPARATE trail from {@link RunStore.appendEvent}: an operational log
-     * is level-filtered, sampled, rotatable and legitimately absent when no
-     * host installed a sink. None of that is acceptable for evidence of what
-     * an agent did, under whose identity, at what cost, and whether it was
-     * allowed — see `types/run/audit.ts` for the full reasoning (ses_020's
-     * logging design §5).
-     *
-     * A write that rejects here must fail the caller's operation. This is the
-     * one place on this whole contract where that is true — every other write
-     * here may be retried or reported by a caller that chooses to; this one
-     * is durability's last line, and a caller that catches and continues past
-     * a rejection here has silently degraded the audit trail into decoration.
-     */
-    appendAuditEvent?(event: AuditEvent): Promise<void>;
-    /**
-     * Read the run's audit trail back, oldest first. OPTIONAL for the same
-     * reason {@link RunStore.appendAuditEvent} is. What a resumed run seeds
-     * its next audit `seq` from, and the input to
-     * {@link import('./audit.js').replayRun}. See {@link RunStore.readEvents}
-     * for the ordering and gap obligations — the same three apply here,
-     * against this trail's own sequence space.
-     */
-    readAuditEvents?(): Promise<readonly AuditEvent[]>;
-    /**
-     * Record the run in a browsable catalogue of runs. OPTIONAL.
-     *
-     * Optional because it is the one method here that is not evidence: it
-     * maintains a convenience listing for a human reading the directory, and
-     * a backend whose runs are already queryable has nothing to add. The
-     * programmatic answer to "which runs are there" is
-     * `CheckpointStore.listDurableRuns`, which carries attribution and
-     * includes sub-runs; this does neither.
-     */
-    addToIndex?(run: Run): Promise<void>;
-}
-//# sourceMappingURL=store.d.ts.map

package/dist/types/run/store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/types/run/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAA;AAC5F;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAC5C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE9D;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,kBAAkB,GAC3B;IACA,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;CACpC,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAA;CACpC,GACD;IACA,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAC/B,CAAA;AAEJ,uEAAuE;AACvE,MAAM,WAAW,oBAAoB;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAA;CAC1C;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CACzB;AAED,+FAA+F;AAC/F,MAAM,MAAM,mBAAmB,GAC5B,CAAC,mBAAmB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,GACxD;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAA;AAExF;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,uDAAuD;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,qFAAqF;AACrF,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;CAC1D;AAED,MAAM,WAAW,QAAQ;IACxB;;;;OAIG;IACH,kBAAkB,CAAC,CAClB,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,qBAAqB,CAAC,CAAA;IACjC;;;;OAIG;IACH,mBAAmB,CAAC,CACnB,KAAK,EAAE,gBAAgB,EACvB,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;IAE7C;;;;;;;;;OASG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpE,gEAAgE;IAChE,YAAY,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAErC;;;;;;;OAOG;IACH,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE/D;;;;;;;OAOG;IACH,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE3C;;;;;;OAMG;IACH,WAAW,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3C;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,UAAU,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAA;IAEjF;;;OAGG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpD;;;;;;;;;;;OAWG;IACH,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAE/D;;;OAGG;IACH,SAAS,IAAI,MAAM,GAAG,IAAI,CAAA;IAE1B;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,gBAAgB,CAAC,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEnD;;;;;;;OAOG;IACH,eAAe,CAAC,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IAElD;;;;;;;;;OASG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC"}

package/dist/types/run/store.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=store.js.map

package/dist/types/run/store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/types/run/store.ts"],"names":[],"mappings":""}

package/dist/types/run/subsession-events.d.ts

@@ -1,64 +0,0 @@
-import type { MessageId, RunId, SessionId } from '../ids/index.js';
-import type { ActorRef } from '../session/actor.js';
-import type { SubSessionId } from '../session/ids.js';
-import type { Lineage } from './lineage.js';
-import type { RunEventSchemaVersion } from './schema-version.js';
-/**
- * Sub-session lifecycle events that splice into {@link RunEvent}.
- *
- * See session-hierarchy.md §10.4 (Parent-Child Linkage). These cover the
- * in-flight visibility gap that the terminal-only `SessionSummaryRef` does
- * not address. Every sub-session emission carries the full {@link Lineage}
- * chain — consumers can reconstruct the delegation tree without walking the
- * store (§10.4 invariant).
- *
- * Note: these events are spliced into the `RunEvent` union in
- * `types/run/events.ts` rather than kept as a separate top-level union.
- * A dedicated `SessionHierarchyEvent` top-level type lands in Phase 3+.
- */
-/**
- * Emitted when the kernel creates a new sub-session. Precedes the child
- * session's `run_started`. See §10.4 / §10.5 example stream.
- */
-export interface SubsessionSpawnedEvent {
-    type: 'subsession_spawned';
-    runId: RunId;
-    subSessionId: SubSessionId;
-    parentSessionId: SessionId;
-    spawnedBy: ActorRef;
-    lineage: Lineage;
-    schemaVersion: RunEventSchemaVersion;
-    at: Date;
-}
-/**
- * Emitted each time the child session's Run appends a message. Gives parents
- * and platform consumers in-flight visibility without requiring a drill into
- * the child transcript. See §10.4.
- */
-export interface SubsessionMessagedEvent {
-    type: 'subsession_messaged';
-    runId: RunId;
-    subSessionId: SubSessionId;
-    parentSessionId: SessionId;
-    messageId: MessageId;
-    lineage: Lineage;
-    schemaVersion: RunEventSchemaVersion;
-    at: Date;
-}
-/**
- * Emitted when the child session transitions to `idle` (terminal persistent
- * state per §5.3 — sub-sessions never close). A separate
- * `sub_session.summarized` event carries the `SessionSummaryRef` (§8); this
- * event only reports the lifecycle transition.
- */
-export interface SubsessionIdledEvent {
-    type: 'subsession_idled';
-    runId: RunId;
-    subSessionId: SubSessionId;
-    parentSessionId: SessionId;
-    lineage: Lineage;
-    schemaVersion: RunEventSchemaVersion;
-    at: Date;
-}
-export type SubsessionLifecycleEvent = SubsessionSpawnedEvent | SubsessionMessagedEvent | SubsessionIdledEvent;
-//# sourceMappingURL=subsession-events.d.ts.map

package/dist/types/run/subsession-events.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"subsession-events.d.ts","sourceRoot":"","sources":["../../../src/types/run/subsession-events.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAClE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAEhE;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,oBAAoB,CAAA;IAC1B,KAAK,EAAE,KAAK,CAAA;IACZ,YAAY,EAAE,YAAY,CAAA;IAC1B,eAAe,EAAE,SAAS,CAAA;IAC1B,SAAS,EAAE,QAAQ,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,qBAAqB,CAAA;IACpC,EAAE,EAAE,IAAI,CAAA;CACR;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,qBAAqB,CAAA;IAC3B,KAAK,EAAE,KAAK,CAAA;IACZ,YAAY,EAAE,YAAY,CAAA;IAC1B,eAAe,EAAE,SAAS,CAAA;IAC1B,SAAS,EAAE,SAAS,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,qBAAqB,CAAA;IACpC,EAAE,EAAE,IAAI,CAAA;CACR;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,kBAAkB,CAAA;IACxB,KAAK,EAAE,KAAK,CAAA;IACZ,YAAY,EAAE,YAAY,CAAA;IAC1B,eAAe,EAAE,SAAS,CAAA;IAC1B,OAAO,EAAE,OAAO,CAAA;IAChB,aAAa,EAAE,qBAAqB,CAAA;IACpC,EAAE,EAAE,IAAI,CAAA;CACR;AAED,MAAM,MAAM,wBAAwB,GACjC,sBAAsB,GACtB,uBAAuB,GACvB,oBAAoB,CAAA"}

package/dist/types/run/subsession-events.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=subsession-events.js.map

package/dist/types/run/subsession-events.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"subsession-events.js","sourceRoot":"","sources":["../../../src/types/run/subsession-events.ts"],"names":[],"mappings":""}

package/dist/types/run/token-budget-store.d.ts

@@ -1,29 +0,0 @@
-import type { TokenBudgetSnapshot } from '../../run/token-budget.js';
-import type { ProjectId, RunId, SessionId, TenantId } from '../ids/index.js';
-/** The root run owns the ledger, including every descendant account. */
-export interface TokenBudgetScope {
-    readonly tenantId: TenantId;
-    readonly projectId: ProjectId;
-    readonly sessionId: SessionId;
-    readonly runId: RunId;
-}
-/** JSON-safe checkpoint reference; the latest ledger remains authoritative. */
-export interface TokenBudgetBinding {
-    readonly scope: TokenBudgetScope;
-    readonly accountId: string;
-}
-/**
- * Durable storage for one canonical token ledger per root run.
- *
- * A root and all its descendants share one writer. Save must atomically
- * replace a complete record; a missing record is null and corrupt records
- * throw. This interface provides no compare-and-swap or distributed lease.
- * Hosts must ensure exclusive root ownership when resuming in another process.
- */
-export interface TokenBudgetStore {
-    load(scope: TokenBudgetScope): Promise<TokenBudgetSnapshot | null>;
-    save(scope: TokenBudgetScope, snapshot: TokenBudgetSnapshot): Promise<void>;
-}
-/** Validate an untrusted checkpoint reference without inventing missing identity. */
-export declare function validateTokenBudgetBinding(value: unknown): TokenBudgetBinding;
-//# sourceMappingURL=token-budget-store.d.ts.map

package/dist/types/run/token-budget-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-budget-store.d.ts","sourceRoot":"","sources":["../../../src/types/run/token-budget-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAGpE,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAE5E,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;CACrB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAChC,IAAI,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAA;IAClE,IAAI,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3E;AAED,qFAAqF;AACrF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAoB7E"}

package/dist/types/run/token-budget-store.js

@@ -1,25 +0,0 @@
-import { entityIdPattern } from '../../utils/id-format.js';
-import { asProjectId, asRunId, asSessionId, asTenantId } from '../../utils/id.js';
-/** Validate an untrusted checkpoint reference without inventing missing identity. */
-export function validateTokenBudgetBinding(value) {
-    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
-        throw new Error('Invalid token budget binding');
-    }
-    const binding = value;
-    if (typeof binding.accountId !== 'string' || !entityIdPattern().test(binding.accountId)) {
-        throw new Error('Invalid token budget account identity');
-    }
-    if (typeof binding.scope !== 'object' || binding.scope === null) {
-        throw new Error('Token budget binding is missing its root scope');
-    }
-    return {
-        accountId: binding.accountId,
-        scope: {
-            tenantId: asTenantId(binding.scope.tenantId),
-            projectId: asProjectId(binding.scope.projectId),
-            sessionId: asSessionId(binding.scope.sessionId),
-            runId: asRunId(binding.scope.runId),
-        },
-    };
-}
-//# sourceMappingURL=token-budget-store.js.map

package/dist/types/run/token-budget-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token-budget-store.js","sourceRoot":"","sources":["../../../src/types/run/token-budget-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AA8BjF,qFAAqF;AACrF,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,KAAoC,CAAA;IACpD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IACzD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IAClE,CAAC;IACD,OAAO;QACN,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE;YACN,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5C,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YAC/C,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;SACnC;KACD,CAAA;AACF,CAAC"}

package/dist/types/workspace/shared-run.d.ts

@@ -1,61 +0,0 @@
-export interface SharedRunWorkspacePaths {
-    root: string;
-    manifest: string;
-    sharedContext: string;
-    sources: string;
-    plans: string;
-    agents: string;
-}
-export interface SharedRunWorkspaceSource {
-    id: string;
-    label: string;
-    path: string;
-    kind?: string;
-    sizeBytes?: number;
-}
-export interface SharedRunWorkspacePlan {
-    id: string;
-    briefPath: string;
-    status: 'seeded' | 'ready' | 'running' | 'completed' | 'failed';
-    updatedAt: string;
-}
-export interface SharedRunWorkspaceAgentRecord {
-    agentId: string;
-    taskId?: string;
-    workPath: string;
-    status: 'assigned' | 'running' | 'completed' | 'failed' | 'canceled';
-    updatedAt: string;
-}
-export interface SharedRunWorkspaceManifest {
-    schemaVersion: 1;
-    kind: 'shared-run-workspace';
-    createdAt: string;
-    updatedAt: string;
-    label?: string;
-    paths: SharedRunWorkspacePaths;
-    sources: SharedRunWorkspaceSource[];
-    plans: SharedRunWorkspacePlan[];
-    agents: SharedRunWorkspaceAgentRecord[];
-}
-export interface SharedRunWorkspaceRefs {
-    rootPath: string;
-    manifestPath: string;
-    /**
-     * Path to the shared coordination packet for this run. Workers read this
-     * before the larger task context or source inventory so common runtime
-     * instructions, source summaries, and workspace paths are not rediscovered
-     * independently by every specialist.
-     */
-    sharedContextPath: string;
-    sourceInventoryPath: string;
-    supervisorBriefPath: string;
-    /**
-     * Path to the canonical, full-fidelity user task description for this run.
-     * Workers read this instead of receiving the user's request text inline in
-     * every child prompt — keeps child prompts compact and lets the request
-     * grow without bloating per-worker handoffs.
-     */
-    taskContextPath: string;
-    agentsPath: string;
-}
-//# sourceMappingURL=shared-run.d.ts.map

package/dist/types/workspace/shared-run.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"shared-run.d.ts","sourceRoot":"","sources":["../../../src/types/workspace/shared-run.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;IAC/D,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC7C,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,UAAU,CAAA;IACpE,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,0BAA0B;IAC1C,aAAa,EAAE,CAAC,CAAA;IAChB,IAAI,EAAE,sBAAsB,CAAA;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,uBAAuB,CAAA;IAC9B,OAAO,EAAE,wBAAwB,EAAE,CAAA;IACnC,KAAK,EAAE,sBAAsB,EAAE,CAAA;IAC/B,MAAM,EAAE,6BAA6B,EAAE,CAAA;CACvC;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAA;IACzB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB,EAAE,MAAM,CAAA;IAC3B;;;;;OAKG;IACH,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;CAClB"}

package/dist/types/workspace/shared-run.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=shared-run.js.map

package/dist/types/workspace/shared-run.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"shared-run.js","sourceRoot":"","sources":["../../../src/types/workspace/shared-run.ts"],"names":[],"mappings":""}

package/src/constants/emergency.ts

@@ -1,3 +0,0 @@
-export const EMERGENCY_DIR_NAME = 'emergency'
-export const EMERGENCY_SIGNALS = ['SIGINT', 'SIGTERM'] as const
-export const EMERGENCY_EVENTS = ['uncaughtException'] as const

package/src/contracts/run-status.ts

@@ -1,43 +0,0 @@
-import type { RunStatus } from '../types/run/status.js'
-import type { WireRunStatus } from './api.js'
-
-/**
- * Collapse a domain run status onto the wire enum.
- *
- * The mapping was documented on `WireRunStatus` and implemented nowhere, so
- * every surface that needed it open-coded the collapse or, more often,
- * passed a domain status where a wire one was expected and relied on the
- * two enums happening to share spellings. They do not share all of them:
- * `succeeded` and `awaiting_*` have no wire counterpart at all.
- *
- * Total over the domain enum, and exhaustive by construction so a new
- * domain status is a type error here rather than an `undefined` on the
- * wire.
- */
-export function toWireRunStatus(status: RunStatus): WireRunStatus {
-	switch (status) {
-		case 'queued':
-			return 'queued'
-		case 'running':
-			return 'running'
-		// A run waiting on a human is still a live run to a wire consumer:
-		// it has not settled, and nothing it can do will make it settle.
-		// `awaiting_hitl_resolution` is the persisted variant — the user is
-		// absent and the run survives until answered or cancelled — which is
-		// waiting, not finished.
-		case 'awaiting_hitl':
-		case 'awaiting_hitl_resolution':
-		case 'awaiting_subsession':
-			return 'running'
-		case 'succeeded':
-			return 'completed'
-		case 'failed':
-			return 'failed'
-		case 'cancelled':
-			return 'cancelled'
-		default: {
-			const _exhaustive: never = status
-			throw new Error(`Unmapped run status: ${_exhaustive as string}`)
-		}
-	}
-}