@namzu/sdk 45.1.0 → 48.0.0

package/dist/tools/schedules/types.d.ts

@@ -9,10 +9,29 @@
  */
 /** A rule effect, in the vocabulary of the CLI's `[permissions]` table. */
 export type ScheduleRuleEffect = 'allow' | 'ask' | 'deny';
-/** What the model proposes. Validated by the tool's schema, then by the host. */
+/**
+ * What the model proposes. Validated by the tool's schema, then by the host.
+ *
+ * `runKind` absent means `'agent'`, unchanged from before this field
+ * existed — every existing host keeps compiling and behaving the same.
+ * `prompt` is optional ONLY because a pure `'script'` draft has none; a
+ * `ScheduleToolHost` that read it as a bare `string` before this field
+ * existed now needs a null check under `strictNullChecks` (see the SDK's
+ * changeset for this release: this is a breaking change to the type, not a
+ * free widening).
+ */
 export interface ScheduleJobDraft {
     readonly name: string;
-    readonly prompt: string;
+    /** Required unless `runKind` is `'script'`, whose prompt is unused. */
+    readonly prompt?: string;
+    /** Absent: `'agent'`. */
+    readonly runKind?: 'agent' | 'script' | 'script+agent';
+    /** Required when `runKind` is `'script'` or `'script+agent'` (the wake-gate). */
+    readonly script?: {
+        readonly body: string;
+        readonly shell: 'bash' | 'sh';
+        readonly timeoutMs?: number;
+    };
     /** Schedule words: `every 30m`, `0 9 * * 1-5`, `at 09:00`, `in 2h`. */
     readonly when: string;
     /** Folder the job runs in. Absent: the session's working directory. */
@@ -71,7 +90,16 @@ export interface ScheduleJobPreview {
     readonly folder: string;
     /** True when `folder` is outside the session's working directory and added directories. */
     readonly outsideSessionRoots: boolean;
+    /** Empty for a pure `'script'` job, whose prompt is unused. */
     readonly prompt: string;
+    /** Absent: `'agent'`. */
+    readonly runKind?: 'agent' | 'script' | 'script+agent';
+    /** Present for `runKind: 'script'`/`'script+agent'`: the exact confirmed text. */
+    readonly script?: {
+        readonly body: string;
+        readonly shell: 'bash' | 'sh';
+        readonly timeoutMs: number;
+    };
     /** The schedule in words, with its zone. */
     readonly schedule: string;
     /** The next fire times, ISO-8601 UTC. */
@@ -80,8 +108,11 @@ export interface ScheduleJobPreview {
     readonly rules: readonly string[];
     readonly unmatched: 'park' | 'deny' | 'allow';
     readonly execution: 'host' | 'sandbox';
-    /** A rule lets the run reach the network. */
+    /** The run can reach the network, including through a fixed host script. */
     readonly networkAccess: boolean;
+    /** Web/browser permissions grant network access, separate from a script's own capability. */
+    readonly networkGrantAccess?: boolean;
+    /** Effective run limits. A pure script has zero model iterations/tokens and its script timeout. */
     readonly budget: {
         readonly maxIterations: number;
         readonly tokenBudget: number;
@@ -89,8 +120,8 @@ export interface ScheduleJobPreview {
     };
     /** Runs per day at most, times the token budget. Absent for a one-shot. */
     readonly dailyTokenCeiling?: number;
-    /** Provider and model the job is pinned to. */
-    readonly model: string;
+    /** Provider and model the agent phase is pinned to. Absent for a pure script job. */
+    readonly model?: string;
     /** Where the run's credential comes from, in words. */
     readonly credentialSource?: string;
     /** Anything the host wants said in the warning colour. */
@@ -106,6 +137,59 @@ export interface ScheduleJobSummary {
     readonly lastStatus?: string;
     /** Present only for jobs in the session's own folder. */
     readonly prompt?: string;
+    /**
+     * True for a job whose folder is the session's own. A host that lists
+     * other folders' jobs sets it so the model can tell them apart; the tool
+     * marks such a job `(this folder)`.
+     */
+    readonly inSessionFolder?: boolean;
+}
+/**
+ * What the model proposes to change in an existing job. Every field left
+ * out keeps the job's current value. `permissions`, when given, is the whole
+ * new set, with the same limits as a new job's; the host keeps the job's
+ * `execution` when it is not given, and its additional directories.
+ */
+export interface ScheduleJobChanges {
+    readonly prompt?: string;
+    readonly when?: string;
+    readonly folder?: string;
+    readonly tz?: string;
+    readonly permissions?: ScheduleJobDraft['permissions'];
+    readonly budget?: ScheduleJobDraft['budget'];
+    /**
+     * Changes what kind of run this is. Absent: keeps the job's current kind.
+     * Moving to `'script'`/`'script+agent'` needs `script`; moving to
+     * `'agent'` drops whatever script the job had, whether or not one is
+     * given here — an agent job cannot carry one.
+     */
+    readonly runKind?: 'agent' | 'script' | 'script+agent';
+    /**
+     * Replaces the whole script (or, for `'script+agent'`, wake-gate) body,
+     * shell and timeout — never a partial edit of just one of them. Absent:
+     * keeps the job's current script. Re-verified fresh against the
+     * scheduled-run floor and every `deny` rule, the same as a new job's.
+     */
+    readonly script?: ScheduleJobDraft['script'];
+}
+/** A proposed change to a job, as the host computed it. */
+export interface ScheduleJobUpdateProposal {
+    /** The job as it would be once changed. Every field is the host's own computation. */
+    readonly preview: ScheduleJobPreview;
+    /**
+     * What differs from the job as it stands (and from edits saved since it
+     * was last confirmed), one line each: `- ` what goes, `+ ` what comes.
+     */
+    readonly changes: readonly string[];
+    /** The change touches what a run may do: its rules, `unmatched`, where it runs, its browser grant. */
+    readonly permissionsChange: boolean;
+}
+/** What the person confirming a change is shown. */
+export interface ScheduleUpdateRequest extends ScheduleJobUpdateProposal {
+    /** The prompt tripwire's findings over `preview.prompt`. */
+    readonly promptFindings: readonly string[];
+    /** Always `model` from this tool. */
+    readonly proposedBy: 'model';
 }
 /** What the person answered to a proposed job. */
 export type ScheduleConfirmAnswer = 'create' | 'create-paused' | 'cancel';
@@ -147,7 +231,15 @@ export interface ScheduleToolHost {
         readonly name: string;
         readonly note?: string;
     }>;
-    /** Jobs, the session folder's in full, other folders' without their prompts. */
+    /**
+     * Jobs, the session folder's in full, other folders' without their
+     * prompts. `allFolders: false` lets a host list only the session
+     * folder's; a host may list every job regardless, marking the session
+     * folder's with {@link ScheduleJobSummary.inSessionFolder}. The tool says
+     * "No scheduled jobs." when this returns none, so a host that filters
+     * says so only for its folder. Throw on an unreadable job store: the tool
+     * reports the error rather than claiming there are no jobs.
+     */
     list(options: {
         readonly allFolders: boolean;
     }): Promise<readonly ScheduleJobSummary[]>;
@@ -158,6 +250,28 @@ export interface ScheduleToolHost {
     pause(job: string): Promise<void>;
     resume(job: string): Promise<void>;
     delete(job: string): Promise<void>;
+    /**
+     * Validate a change to `job` (a name or id prefix) and compute what the
+     * person will be shown. Throws with a message on a refusal. The tool
+     * offers `update` only when a host has all three of `previewUpdate`,
+     * `confirmUpdate` and `update`.
+     */
+    previewUpdate?(job: string, changes: ScheduleJobChanges): Promise<ScheduleJobUpdateProposal>;
+    /**
+     * Ask the person whether to save the change. Anything but `true` — a
+     * thrown error, a closed screen — changes nothing. See `confirm` on
+     * `signal`.
+     */
+    confirmUpdate?(request: ScheduleUpdateRequest, signal?: AbortSignal): Promise<boolean>;
+    /**
+     * Save the change the person confirmed, to the same job: its id and its
+     * history are kept, and the confirmation is the person's. `note` as for
+     * `create`.
+     */
+    update?(preview: ScheduleJobPreview): Promise<{
+        readonly name: string;
+        readonly note?: string;
+    }>;
 }
 /** A prompt the session re-sends to itself on an interval. */
 export interface SessionLoop {

package/dist/tools/schedules/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/tools/schedules/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAEzD,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,gBAAgB,CAAA;QAChD;;;;WAIG;QACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;QACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CACxB,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CACjF,CAAA;QACD;;;;;;WAMG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;KACvC,CAAA;IACD,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;QAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACD;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAA;AAE7D,uCAAuC;AACvC,MAAM,WAAW,oBAAoB;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAA;IAClE,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yCAAyC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,6CAA6C;IAC7C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,2EAA2E;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,uDAAuD;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,kDAAkD;AAClD,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAA;AAEzE,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,wGAAwG;IACxG,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC9F;;;;;OAKG;IACH,MAAM,CACL,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D,gFAAgF;IAChF,IAAI,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAA;IACvF,gDAAgD;IAChD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC1D,uFAAuF;IACvF,aAAa,CACZ,GAAG,EAAE,kBAAkB,EACvB,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAC3B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClC;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAA;CACxC;AAED,MAAM,WAAW,eAAe;IAC/B,0FAA0F;IAC1F,MAAM,CAAC,OAAO,EAAE;QACf,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAC3B,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACxB,IAAI,IAAI,SAAS,WAAW,EAAE,CAAA;IAC9B,+EAA+E;IAC/E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACnC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/tools/schedules/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,yBAAyB;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;IACtD,iFAAiF;IACjF,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;IACD,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,uEAAuE;IACvE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,EAAE;QACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,gBAAgB,CAAA;QAChD;;;;WAIG;QACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAA;QACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CACxB,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC,CACjF,CAAA;QACD;;;;;;WAMG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAA;KACvC,CAAA;IACD,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;QAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;QAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACD;AAED;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAA;AAE7D,uCAAuC;AACvC,MAAM,WAAW,oBAAoB;IACpC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAA;IAClE,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,iDAAiD;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAA;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,yBAAyB;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;IACtD,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yCAAyC;IACzC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAA;IAC7C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAA;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,mGAAmG;IACnG,QAAQ,CAAC,MAAM,EAAE;QAChB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAC1B,CAAA;IACD,2EAA2E;IAC3E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,uDAAuD;IACvD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,yDAAyD;IACzD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAA;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,cAAc,CAAA;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;CAC5C;AAED,2DAA2D;AAC3D,MAAM,WAAW,yBAAyB;IACzC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,sGAAsG;IACtG,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;CACnC;AAED,oDAAoD;AACpD,MAAM,WAAW,qBAAsB,SAAQ,yBAAyB;IACvE,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,kDAAkD;AAClD,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,eAAe,GAAG,QAAQ,CAAA;AAEzE,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,wGAAwG;IACxG,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAC7D;;;;;;;OAOG;IACH,OAAO,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAA;IAC9F;;;;;OAKG;IACH,MAAM,CACL,KAAK,EAAE,gBAAgB,EACvB,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7D;;;;;;;;OAQG;IACH,IAAI,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,kBAAkB,EAAE,CAAC,CAAA;IACvF,gDAAgD;IAChD,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CAAA;IAC1D,uFAAuF;IACvF,aAAa,CACZ,GAAG,EAAE,kBAAkB,EACvB,MAAM,EAAE,QAAQ,GAAG,QAAQ,EAC3B,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClC;;;;;OAKG;IACH,aAAa,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAA;IAC5F;;;;OAIG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtF;;;;OAIG;IACH,MAAM,CAAC,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAChG;AAED,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,CAAA;CACxC;AAED,MAAM,WAAW,eAAe;IAC/B,0FAA0F;IAC1F,MAAM,CAAC,OAAO,EAAE;QACf,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAC3B,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IACxB,IAAI,IAAI,SAAS,WAAW,EAAE,CAAA;IAC9B,+EAA+E;IAC/E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACnC"}

package/dist/tools/trusted-read-only.d.ts

@@ -1,3 +1,4 @@
+import type { ToolSourceRef } from '../toolsets/types.js';
 import type { ToolDefinition } from '../types/tool/index.js';
 /**
  * May this tool's read-only claim settle a gate on its own?
@@ -29,14 +30,17 @@ import type { ToolDefinition } from '../types/tool/index.js';
  *    opening its own gate.
  *
  * Trust for the second case comes from the operator, per server, and is
- * recorded on the tool as `provenance.readOnlyHintTrusted`. Never a global
- * switch: one flag meaning "trust annotations" hands every connected
- * server the same reach, which is the hole restated.
+ * carried on the OWNING TOOLSET's source (`ToolSourceRef.readOnlyHintTrusted`,
+ * `toolsets/manager.ts`'s `sourceOf`) rather than stamped onto the tool
+ * itself — `ToolDefinition` has no `provenance` field to read; a definition
+ * cannot claim its own source. Never a global switch: one flag meaning
+ * "trust annotations" hands every connected server the same reach, which is
+ * the hole restated.
  *
  * `isReadOnly` itself is left reporting faithfully what the server said.
- * Provenance and policy are different questions, and collapsing them would
+ * Source and policy are different questions, and collapsing them would
  * corrupt the outbound re-export and the prompt's own destructive label in
  * order to fix a gate.
  */
-export declare function isTrustedReadOnly(tool: ToolDefinition | undefined, input: unknown): boolean;
+export declare function isTrustedReadOnly(tool: ToolDefinition | undefined, input: unknown, source?: ToolSourceRef): boolean;
 //# sourceMappingURL=trusted-read-only.d.ts.map

package/dist/tools/trusted-read-only.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-read-only.d.ts","sourceRoot":"","sources":["../../src/tools/trusted-read-only.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAU3F"}
+{"version":3,"file":"trusted-read-only.d.ts","sourceRoot":"","sources":["../../src/tools/trusted-read-only.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,iBAAiB,CAChC,IAAI,EAAE,cAAc,GAAG,SAAS,EAChC,KAAK,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,aAAa,GACpB,OAAO,CAWT"}

package/dist/tools/trusted-read-only.js

@@ -28,23 +28,27 @@
  *    opening its own gate.
  *
  * Trust for the second case comes from the operator, per server, and is
- * recorded on the tool as `provenance.readOnlyHintTrusted`. Never a global
- * switch: one flag meaning "trust annotations" hands every connected
- * server the same reach, which is the hole restated.
+ * carried on the OWNING TOOLSET's source (`ToolSourceRef.readOnlyHintTrusted`,
+ * `toolsets/manager.ts`'s `sourceOf`) rather than stamped onto the tool
+ * itself — `ToolDefinition` has no `provenance` field to read; a definition
+ * cannot claim its own source. Never a global switch: one flag meaning
+ * "trust annotations" hands every connected server the same reach, which is
+ * the hole restated.
  *
  * `isReadOnly` itself is left reporting faithfully what the server said.
- * Provenance and policy are different questions, and collapsing them would
+ * Source and policy are different questions, and collapsing them would
  * corrupt the outbound re-export and the prompt's own destructive label in
  * order to fix a gate.
  */
-export function isTrustedReadOnly(tool, input) {
+export function isTrustedReadOnly(tool, input, source) {
     if (!tool?.isReadOnly)
         return false;
-    // No provenance means the tool is host-defined: it came from this
-    // process, from code the operator installed, and there is no untrusted
-    // party in the chain. Requiring an opt-in for a builtin would break
-    // every read-only exemption for no gain in trust.
-    if (tool.provenance && !tool.provenance.readOnlyHintTrusted)
+    // A source that is not `mcp_server` is host-defined: this process, code
+    // the operator installed, no untrusted party in the chain. Requiring an
+    // opt-in for a builtin would break every read-only exemption for no gain
+    // in trust. `source` itself absent (a caller with no manager to ask)
+    // is treated the same way, matching the old "no provenance" default.
+    if (source?.kind === 'mcp_server' && !source.readOnlyHintTrusted)
         return false;
     return tool.isReadOnly(input);
 }

package/dist/tools/trusted-read-only.js.map

@@ -1 +1 @@
-{"version":3,"file":"trusted-read-only.js","sourceRoot":"","sources":["../../src/tools/trusted-read-only.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAgC,EAAE,KAAc;IACjF,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO,KAAK,CAAA;IAEnC,kEAAkE;IAClE,uEAAuE;IACvE,oEAAoE;IACpE,kDAAkD;IAClD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAA;IAEzE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC"}
+{"version":3,"file":"trusted-read-only.js","sourceRoot":"","sources":["../../src/tools/trusted-read-only.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,UAAU,iBAAiB,CAChC,IAAgC,EAChC,KAAc,EACd,MAAsB;IAEtB,IAAI,CAAC,IAAI,EAAE,UAAU;QAAE,OAAO,KAAK,CAAA;IAEnC,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,CAAC,MAAM,CAAC,mBAAmB;QAAE,OAAO,KAAK,CAAA;IAE9E,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;AAC9B,CAAC"}

package/dist/tools/untrusted-envelope.d.ts

@@ -24,19 +24,41 @@
  * boundaries are of that kind — the permission gate, the sandbox, the
  * egress proxy deciding by resolved address.
  *
- * The two details below still matter. They are what stops the framing
- * being trivially removable by the content itself, which is a lower bar
- * than stopping an attacker and worth clearing anyway.
+ * The details below still matter. They are what stops the framing being
+ * trivially removable by the content itself, which is a lower bar than
+ * stopping an attacker and worth clearing anyway.
  *
- * Two details make the difference between a boundary and a decoration, and
- * both were missing from this repo's first envelope:
+ * 1. **The real delimiter is bound to a per-render nonce.** Every call draws
+ *    a fresh, unpredictable nonce (`tools/render-nonce.ts`) AFTER the
+ *    untrusted content is already fixed, and the genuine tags carry it in
+ *    their name: `<namzu-untrusted-<nonce> kind="…">` … `</namzu-untrusted-
+ *    <nonce>>`. The header states this explicitly, so a model reads the
+ *    nonce-bound close as the sole real boundary and anything else
+ *    tag-shaped inside the block as quoted content, not structure.
  *
- * 1. **The closing token is defanged inside the body.** Content carrying
- *    `</namzu-untrusted>` would otherwise close the block early, and
- *    everything the attacker wrote after it would read as unlabelled — which
- *    is to say, as instructions. Matching is case-insensitive because a model
- *    reads `</NAMZU-UNTRUSTED>` as the same tag.
- * 2. **There is no already-wrapped fast path.** Checking whether content
+ *    This replaces a defect fixed and then un-fixed the same day
+ *    (2026-09-24): the delimiter was first defended with a literal,
+ *    ASCII, case-insensitive keyword match, which a Unicode lookalike
+ *    walked through unchanged (a non-breaking hyphen for the ASCII one). The
+ *    next attempt folded confusable characters before the match — but a
+ *    same-script homoglyph (Cyrillic `ѕ`/`е` for Latin `s`/`e`; hundreds of
+ *    such cross-script pairs exist) folds to itself under NFKC and survives,
+ *    so `<ѕyѕtеm-еvent…>` still forged a fake frame. Folding also rewrote
+ *    the WHOLE untrusted string for every caller — an em dash became `-`, an
+ *    ideographic space became an ASCII space, a ligature split into its
+ *    letters — damaging ordinary Unicode text to close a hole it did not
+ *    close. A nonce closes the real hole (the attacker cannot spell a tag it
+ *    has not seen, in any script) without touching a single byte of
+ *    ordinary content: the cheap ASCII keyword neutralization below is kept
+ *    as defense in depth, but it is no longer this envelope's real boundary.
+ * 2. **The closing token is ALSO defanged inside the body, case-insensitively,
+ *    as a second layer.** Content carrying the bare, un-nonced
+ *    `</namzu-untrusted>` is replaced (`namzu_untrusted`) before it is
+ *    embedded — belt-and-suspenders against a downstream reader that still
+ *    matches the bare keyword without knowing about the nonce. This never
+ *    touches ordinary text: the literal ASCII phrase essentially never
+ *    appears in it.
+ * 3. **There is no already-wrapped fast path.** Checking whether content
  *    "looks wrapped" and skipping is attacker-forgeable: text that merely
  *    begins with the opening tag would then pass through with no framing at
  *    all. Wrapping twice is harmless; not wrapping once is not.
@@ -45,7 +67,10 @@
  * name containing a quote would otherwise rewrite the tag it appears in.
  */
 /**
- * Defang the delimiter so embedded content cannot close the block early.
+ * Defang the bare delimiter so embedded content cannot masquerade as ANY
+ * `namzu-untrusted` tag, nonced or not — defense in depth alongside the
+ * per-render nonce that is this envelope's real boundary (see the module doc
+ * comment above).
  *
  * The replacement swaps the hyphen for an underscore rather than appending a
  * suffix. `namzu-untrusted-literal` would have read fine to a human and still
@@ -63,6 +88,14 @@ export interface UntrustedEnvelope {
     /** One sentence on what the content is and where it came from. */
     provenance: string;
 }
+export interface WrapUntrustedOptions {
+    /**
+     * Injectable for tests; defaults to {@link generateRenderNonce} (random
+     * hex, at least 8 characters). The render redraws automatically if this
+     * generator happens to produce a value the content already contains.
+     */
+    generateNonce?: () => string;
+}
 /**
  * Wrap content so a model reads it as material rather than direction.
  *
@@ -71,7 +104,7 @@ export interface UntrustedEnvelope {
  * is under a hundred characters — and the tokens saved by skipping short
  * results do not pay for a boundary that holds only sometimes.
  */
-export declare function wrapUntrusted(envelope: UntrustedEnvelope, content: string): string;
+export declare function wrapUntrusted(envelope: UntrustedEnvelope, content: string, options?: WrapUntrustedOptions): string;
 /**
  * The body of a single wrapped block, when `text` is one.
  *
@@ -84,27 +117,33 @@ export declare function wrapUntrusted(envelope: UntrustedEnvelope, content: stri
  * the consumer, which is the drift this module exists to prevent.
  *
  * `undefined` for anything that is not exactly one wrapped block: text that
- * merely starts or ends like one, text with no well-formed opening tag, text
- * with no blank line after the header, and two blocks laid end to end. A body
- * is allowed to contain a blank line and often does; the two header lines
- * never do, so the first blank line is the end of the header regardless of
- * what the content says.
+ * merely starts or ends like one, text with no well-formed opening tag (nonce
+ * included), a closing tag whose nonce does not match the opening one, text
+ * with no blank line after the header, and two blocks laid end to end (their
+ * nonces almost certainly differ, so the second block's closing tag does not
+ * match the first's opening one, and the check below already refuses that).
+ * A body is allowed to contain a blank line and often does; the two header
+ * lines never do, so the first blank line is the end of the header regardless
+ * of what the content says.
  *
  * Empty content is NOT one of those cases. `wrapUntrusted` frames it like
  * anything else — the "skip a zero-length body" branch is in
  * `frameServerResult`, which is a different decision made by a different
  * caller — so an empty body reads back as `''`, which is what it is.
  *
- * The nested-block test is exact rather than best-effort, and it looks at the
- * BODY. Every occurrence of the token is defanged in the content before it is
- * wrapped, opening tag included — the replacement matches the token, not the
- * closing form — so a live one there means the text is not one block, and
- * content that arrived already framed comes back as the body of the outer one.
- * An ATTRIBUTE is a different matter: attribute values are escaped, not
- * defanged, so a server or agent whose name contains the token puts it in the
- * tag. Checking the tag would make a frame this module produced unreadable by
- * the reader written to read it, which is the one failure this function must
- * not have.
+ * The nested-block test looks at the BODY for a live, BARE (un-nonced)
+ * occurrence of the keyword — every occurrence is defanged in the content
+ * before it is wrapped, opening tag included, and the defanging matches the
+ * bare keyword regardless of what nonce follows it, so a real inner
+ * `<namzu-untrusted-…>` from a nested `wrapUntrusted` call is flattened into
+ * `<namzu_untrusted-…>` by the OUTER call the same as any other occurrence —
+ * a live one surviving means the text was assembled by hand rather than
+ * produced by this function, and content that arrived already framed comes
+ * back as the (flattened) body of the outer one. An ATTRIBUTE is a different
+ * matter: attribute values are escaped, not defanged, so a server or agent
+ * whose name contains the token puts it in the tag. Checking the tag would
+ * make a frame this module produced unreadable by the reader written to read
+ * it, which is the one failure this function must not have.
  */
 export declare function untrustedEnvelopeBody(text: string): string | undefined;
 //# sourceMappingURL=untrusted-envelope.d.ts.map

package/dist/tools/untrusted-envelope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"untrusted-envelope.d.ts","sourceRoot":"","sources":["../../src/tools/untrusted-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAIH;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnE;AAqBD,MAAM,WAAW,iBAAiB;IACjC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAA;CAClB;AAwBD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAqBlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAkBtE"}
+{"version":3,"file":"untrusted-envelope.d.ts","sourceRoot":"","sources":["../../src/tools/untrusted-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AAiBH;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnE;AAqBD,MAAM,WAAW,iBAAiB;IACjC,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACnC,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACpC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B;AAkBD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC5B,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,oBAAyB,GAChC,MAAM,CA8BR;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsBtE"}