@namzu/sdk 49.0.0 → 50.0.0

package/dist/pals/activity/subscriptions.d.ts

@@ -0,0 +1,32 @@
+import type { PalIngressStore } from '../communication/ingress-types.js';
+import type { PalMessageAuthorization } from '../communication/types.js';
+import type { PalStore } from '../types.js';
+import type { PalActivitySubscriptionAuthorizationRequest, PalActivitySubscriptionResult, PalActivitySubscriptionStore } from './subscription-types.js';
+import type { PalActivityFact, PalActivityReadOptions, PalActivityScope, PalActivitySourceOptions } from './types.js';
+export declare class PalActivitySubscriptionDeniedError extends Error {
+    readonly name = "PalActivitySubscriptionDeniedError";
+    constructor();
+}
+export interface PalActivitySubscriptionRunnerOptions {
+    readonly subscriptions: PalActivitySubscriptionStore;
+    readonly ingress: PalIngressStore;
+    readonly pals: PalStore;
+    readonly openJournal: PalActivitySourceOptions['openJournal'];
+    /**
+     * Trusted current host policy. Observation, disclosure and receipt are independent decisions;
+     * the final `accept` phase must require all three together under current consent.
+     */
+    readonly authorize: (request: PalActivitySubscriptionAuthorizationRequest, signal: AbortSignal) => Promise<PalMessageAuthorization>;
+    /**
+     * Resolve prior subscription IDs from original turn delivery evidence retained by the host.
+     * An independent turn yields []; unknown or incomplete evidence must reject. Never accept
+     * a model, renderer or remote client's assertion about its own provenance.
+     */
+    readonly resolveCausality: (scope: PalActivityScope, fact: PalActivityFact, signal: AbortSignal) => Promise<readonly string[]>;
+    readonly now?: () => number;
+    /** Hint only. Observer failures and pending promises cannot prevent acceptance/progress. */
+    readonly notify?: (palId: string) => void | Promise<void>;
+}
+/** One bounded page, no daemon and no inference. Progress follows durable inbox acceptance. */
+export declare function publishPalActivityOnce(options: PalActivitySubscriptionRunnerOptions, id: string, input: Omit<PalActivityReadOptions, 'cursor'>): Promise<PalActivitySubscriptionResult>;
+//# sourceMappingURL=subscriptions.d.ts.map

package/dist/pals/activity/subscriptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.d.ts","sourceRoot":"","sources":["../../../src/pals/activity/subscriptions.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAwB,MAAM,mCAAmC,CAAA;AAE9F,OAAO,KAAK,EAAE,uBAAuB,EAAmB,MAAM,2BAA2B,CAAA;AACzF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAG3C,OAAO,KAAK,EACX,2CAA2C,EAC3C,6BAA6B,EAC7B,4BAA4B,EAC5B,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EACX,eAAe,EACf,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,MAAM,YAAY,CAAA;AAEnB,qBAAa,kCAAmC,SAAQ,KAAK;IAC5D,SAAkB,IAAI,wCAAuC;;CAI7D;AAED,MAAM,WAAW,oCAAoC;IACpD,QAAQ,CAAC,aAAa,EAAE,4BAA4B,CAAA;IACpD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC,aAAa,CAAC,CAAA;IAC7D;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,CACnB,OAAO,EAAE,2CAA2C,EACpD,MAAM,EAAE,WAAW,KACf,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACrC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,CAC1B,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,WAAW,KACf,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B,4FAA4F;IAC5F,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACzD;AAED,+FAA+F;AAC/F,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,oCAAoC,EAC7C,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC,GAC3C,OAAO,CAAC,6BAA6B,CAAC,CAmJxC"}

package/dist/pals/activity/subscriptions.js

@@ -0,0 +1,151 @@
+import { isDeepStrictEqual } from 'node:util';
+import { z } from 'zod';
+import { ingressIntentDigest, ingressIntentId } from '../communication/ingress-schema.js';
+import { freezeCommunicationValue, hash, label } from '../communication/schema.js';
+import { createPalActivitySource } from './source.js';
+import { subscriptionSchema } from './subscription-schema.js';
+export class PalActivitySubscriptionDeniedError extends Error {
+    name = 'PalActivitySubscriptionDeniedError';
+    constructor() {
+        super('Current Pal observation, disclosure and recipient consent are required.');
+    }
+}
+/** One bounded page, no daemon and no inference. Progress follows durable inbox acceptance. */
+export async function publishPalActivityOnce(options, id, input) {
+    const subscriptionId = z.string().uuid().parse(id);
+    const { signal } = input;
+    const { subscriptions, ingress, pals, openJournal, authorize, resolveCausality, notify } = options;
+    const now = options.now ?? Date.now;
+    if (typeof authorize !== 'function' ||
+        typeof resolveCausality !== 'function' ||
+        typeof openJournal !== 'function')
+        throw new TypeError('Pal subscriptions require trusted policy, causality and original journal ports.');
+    signal.throwIfAborted();
+    const stored = await subscriptions.get(subscriptionId);
+    if (!stored)
+        throw new PalActivitySubscriptionDeniedError();
+    const subscription = freezeCommunicationValue(subscriptionSchema.parse(stored));
+    async function current() {
+        signal.throwIfAborted();
+        const value = await subscriptions.get(subscriptionId);
+        signal.throwIfAborted();
+        if (!value?.enabled ||
+            value.configurationRevision !== subscription.configurationRevision ||
+            !isDeepStrictEqual(value.scope, subscription.scope) ||
+            !isDeepStrictEqual(value.recipient, subscription.recipient))
+            throw new PalActivitySubscriptionDeniedError();
+    }
+    async function permitted(phase, fact) {
+        await current();
+        const decision = await authorize(freezeCommunicationValue({
+            phase,
+            subscription,
+            ...(fact ? { fact } : {}),
+        }), signal);
+        signal.throwIfAborted();
+        if (!decision.allow)
+            throw new PalActivitySubscriptionDeniedError();
+        const grant = freezeCommunicationValue(z.object({ id: label, revision: label }).strict().parse(decision.grant));
+        await current();
+        return grant;
+    }
+    const source = createPalActivitySource({
+        scope: subscription.scope,
+        pals,
+        openJournal,
+        async authorize() {
+            await permitted('observe');
+            return true;
+        },
+    });
+    const page = await source.read({
+        signal,
+        maxRecords: input.maxRecords,
+        maxReadBytes: input.maxReadBytes,
+        ...(subscription.cursor ? { cursor: subscription.cursor } : {}),
+    });
+    const accepted = [];
+    const suppressed = [];
+    for (const fact of page.facts) {
+        const observed = await permitted('observe', fact);
+        const lineage = z
+            .array(z.string().uuid())
+            .refine((ids) => new Set(ids).size === ids.length)
+            .parse(await resolveCausality(subscription.scope, fact, signal));
+        signal.throwIfAborted();
+        await current();
+        if (lineage.includes(subscription.id)) {
+            suppressed.push(fact.id);
+            continue;
+        }
+        const disclosed = await permitted('disclose', fact);
+        const received = await permitted('receive', fact);
+        const recipient = pals.get(subscription.recipient.palId);
+        if (!recipient)
+            throw new PalActivitySubscriptionDeniedError();
+        const acceptedGrant = await permitted('accept', fact);
+        const draft = {
+            kind: 'observation',
+            operationId: fact.id,
+            source: {
+                kind: 'host-observation',
+                subscriptionId: subscription.id,
+                scope: subscription.scope,
+            },
+            recipient: subscription.recipient,
+            routeKey: {
+                v: 1,
+                kind: 'observation',
+                recipient: subscription.recipient,
+                subscriptionId: subscription.id,
+                scope: subscription.scope,
+            },
+            fact,
+            subscriptionTrail: [...lineage, subscription.id],
+            replyTo: null,
+            grant: {
+                id: hash([
+                    'pal-observation-grants/1',
+                    subscription.id,
+                    observed.id,
+                    disclosed.id,
+                    received.id,
+                    acceptedGrant.id,
+                ]),
+                revision: hash([
+                    subscription.configurationRevision,
+                    observed.revision,
+                    disclosed.revision,
+                    received.revision,
+                    acceptedGrant.revision,
+                ]),
+            },
+            createdAt: now(),
+        };
+        const intentId = ingressIntentId(draft);
+        const intent = freezeCommunicationValue({
+            ...draft,
+            id: intentId,
+            digest: ingressIntentDigest({ ...draft, id: intentId }),
+        });
+        await ingress.acceptIngress(intent, recipient.revision);
+        accepted.push(intent.id);
+        if (notify) {
+            try {
+                Promise.resolve(notify(subscription.recipient.palId)).catch(() => { });
+            }
+            catch { }
+        }
+    }
+    await permitted('observe');
+    const next = subscription.cursor && isDeepStrictEqual(subscription.cursor, page.cursor)
+        ? subscription
+        : await subscriptions.advance(subscription, page.cursor);
+    return freezeCommunicationValue({
+        subscription: next,
+        accepted,
+        suppressed,
+        complete: page.complete,
+    });
+}
+//# sourceMappingURL=subscriptions.js.map

package/dist/pals/activity/subscriptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscriptions.js","sourceRoot":"","sources":["../../../src/pals/activity/subscriptions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AAEzF,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAGlF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAa7D,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAC1C,IAAI,GAAG,oCAAoC,CAAA;IAC7D;QACC,KAAK,CAAC,yEAAyE,CAAC,CAAA;IACjF,CAAC;CACD;AA8BD,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAA6C,EAC7C,EAAU,EACV,KAA6C;IAE7C,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAClD,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IACxB,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAClG,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,IACC,OAAO,SAAS,KAAK,UAAU;QAC/B,OAAO,gBAAgB,KAAK,UAAU;QACtC,OAAO,WAAW,KAAK,UAAU;QAEjC,MAAM,IAAI,SAAS,CAClB,iFAAiF,CACjF,CAAA;IACF,MAAM,CAAC,cAAc,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACtD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAC3D,MAAM,YAAY,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/E,KAAK,UAAU,OAAO;QACrB,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QACrD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IACC,CAAC,KAAK,EAAE,OAAO;YACf,KAAK,CAAC,qBAAqB,KAAK,YAAY,CAAC,qBAAqB;YAClE,CAAC,iBAAiB,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC;YACnD,CAAC,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC;YAE3D,MAAM,IAAI,kCAAkC,EAAE,CAAA;IAChD,CAAC;IACD,KAAK,UAAU,SAAS,CACvB,KAA2D,EAC3D,IAAsB;QAEtB,MAAM,OAAO,EAAE,CAAA;QACf,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC/B,wBAAwB,CAAC;YACxB,KAAK;YACL,YAAY;YACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzB,CAAC,EACF,MAAM,CACN,CAAA;QACD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,kCAAkC,EAAE,CAAA;QACnE,MAAM,KAAK,GAAG,wBAAwB,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CACvE,CAAA;QACD,MAAM,OAAO,EAAE,CAAA;QACf,OAAO,KAAK,CAAA;IACb,CAAC;IACD,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACtC,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,IAAI;QACJ,WAAW;QACX,KAAK,CAAC,SAAS;YACd,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;YAC1B,OAAO,IAAI,CAAA;QACZ,CAAC;KACD,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;QAC9B,MAAM;QACN,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC,CAAA;IACF,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,CAAC;aACf,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,MAAM,CAAC;aACjD,KAAK,CAAC,MAAM,gBAAgB,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACjE,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,OAAO,EAAE,CAAA;QACf,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;YACvC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACxB,SAAQ;QACT,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACnD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxD,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,kCAAkC,EAAE,CAAA;QAC9D,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,KAAK,GAAG;YACb,IAAI,EAAE,aAAsB;YAC5B,WAAW,EAAE,IAAI,CAAC,EAAE;YACpB,MAAM,EAAE;gBACP,IAAI,EAAE,kBAA2B;gBACjC,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,KAAK,EAAE,YAAY,CAAC,KAAK;aACzB;YACD,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,QAAQ,EAAE;gBACT,CAAC,EAAE,CAAU;gBACb,IAAI,EAAE,aAAsB;gBAC5B,SAAS,EAAE,YAAY,CAAC,SAAS;gBACjC,cAAc,EAAE,YAAY,CAAC,EAAE;gBAC/B,KAAK,EAAE,YAAY,CAAC,KAAK;aACzB;YACD,IAAI;YACJ,iBAAiB,EAAE,CAAC,GAAG,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YAChD,OAAO,EAAE,IAAI;YACb,KAAK,EAAE;gBACN,EAAE,EAAE,IAAI,CAAC;oBACR,0BAA0B;oBAC1B,YAAY,CAAC,EAAE;oBACf,QAAQ,CAAC,EAAE;oBACX,SAAS,CAAC,EAAE;oBACZ,QAAQ,CAAC,EAAE;oBACX,aAAa,CAAC,EAAE;iBAChB,CAAC;gBACF,QAAQ,EAAE,IAAI,CAAC;oBACd,YAAY,CAAC,qBAAqB;oBAClC,QAAQ,CAAC,QAAQ;oBACjB,SAAS,CAAC,QAAQ;oBAClB,QAAQ,CAAC,QAAQ;oBACjB,aAAa,CAAC,QAAQ;iBACtB,CAAC;aACF;YACD,SAAS,EAAE,GAAG,EAAE;SAChB,CAAA;QACD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,MAAM,GAAG,wBAAwB,CAAC;YACvC,GAAG,KAAK;YACR,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,mBAAmB,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;SACvD,CAAyB,CAAA;QAC1B,MAAM,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;QACvD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACxB,IAAI,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBACJ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACtE,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACX,CAAC;IACF,CAAC;IACD,MAAM,SAAS,CAAC,SAAS,CAAC,CAAA;IAC1B,MAAM,IAAI,GACT,YAAY,CAAC,MAAM,IAAI,iBAAiB,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACzE,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,wBAAwB,CAAC;QAC/B,YAAY,EAAE,IAAI;QAClB,QAAQ;QACR,UAAU;QACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACvB,CAAC,CAAA;AACH,CAAC"}

package/dist/pals/activity/types.d.ts

@@ -0,0 +1,77 @@
+import type { LogBytes } from '../../store/session-log/chain.js';
+import type { SessionLog } from '../../store/session-log/core.js';
+import type { ActivityStatus, ActivityType } from '../../types/activity/index.js';
+import type { ActivityId, CheckpointId, ProjectId, SessionId, TenantId, ToolUseId, TurnId } from '../../types/ids/index.js';
+import type { RecordPointer } from '../../types/session/records.js';
+import type { PalStore } from '../types.js';
+export interface PalActivityScope {
+    readonly tenantId: TenantId;
+    readonly projectId: ProjectId;
+    readonly palId: string;
+    readonly profileRevision: number;
+    readonly sessionId: SessionId;
+}
+/**
+ * An unchanged previously emitted cursor, stored and resolved by the trusted host.
+ * Never accept a model, renderer or remote client's anchor directly. scopeHash binds
+ * ownership but does not authenticate a cursor; consumed prefixes are not rescanned.
+ */
+export interface PalActivityCursor {
+    readonly v: 1;
+    readonly scopeHash: string;
+    readonly root: RecordPointer;
+    readonly after: RecordPointer;
+    readonly generation: number;
+}
+export type PalActivityFactType = 'turn_started' | 'turn_resuming' | 'turn_paused' | 'turn_completed' | 'turn_failed' | 'activity_created' | 'activity_updated' | 'tool_executing' | 'tool_completed' | 'tool_review_requested' | 'tool_review_completed' | 'checkpoint_created';
+/** Allow-listed facts only. No descriptions, tool names, arguments, results or errors. */
+export interface PalActivityFact {
+    readonly id: string;
+    readonly type: PalActivityFactType;
+    readonly sessionId: SessionId;
+    readonly turnId?: TurnId;
+    readonly seq: number;
+    readonly generation: number;
+    readonly at: string;
+    readonly activityId?: ActivityId;
+    readonly activityType?: ActivityType;
+    readonly status?: ActivityStatus;
+    readonly toolUseId?: ToolUseId;
+    readonly checkpointId?: CheckpointId;
+    readonly reviewDecision?: 'approved' | 'modified' | 'rejected';
+}
+/** Host-owned read ports MUST address the same original journal, never a transcript cache. */
+export interface PalActivityJournal {
+    readonly log: Pick<SessionLog, 'sessionId'>;
+    readonly bytes: LogBytes;
+}
+export interface PalActivitySourceOptions {
+    readonly scope: PalActivityScope;
+    readonly pals: PalStore;
+    /** Current observation consent; checked before opening, original byte reads and output. */
+    readonly authorize: (scope: PalActivityScope, signal: AbortSignal) => Promise<boolean>;
+    readonly openJournal: (scope: PalActivityScope, signal: AbortSignal) => Promise<PalActivityJournal>;
+}
+export interface PalActivityReadOptions {
+    readonly signal: AbortSignal;
+    /** Trusted host-stored output of an earlier read; never untrusted client input. */
+    readonly cursor?: PalActivityCursor;
+    /** Maximum new history records inspected, including omitted records, excluding anchors (1–256). */
+    readonly maxRecords: number;
+    /** Total bytes requested from the journal, including root/cursor anchors (1–16 MiB). */
+    readonly maxReadBytes: number;
+}
+export interface PalActivityPage {
+    readonly scope: PalActivityScope;
+    readonly facts: readonly PalActivityFact[];
+    readonly cursor: PalActivityCursor;
+    /** Only the captured byte boundary was reached; later appends require another read. */
+    readonly complete: boolean;
+    readonly scannedRecords: number;
+    readonly readBytes: number;
+}
+export interface PalActivitySource {
+    readonly scope: PalActivityScope;
+    read(options: PalActivityReadOptions): Promise<PalActivityPage>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/pals/activity/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/pals/activity/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAA;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AACjF,OAAO,KAAK,EACX,UAAU,EACV,YAAY,EACZ,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,MAAM,EACN,MAAM,0BAA0B,CAAA;AACjC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;CAC7B;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAA;IACb,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,MAAM,mBAAmB,GAC5B,cAAc,GACd,eAAe,GACf,aAAa,GACb,gBAAgB,GAChB,aAAa,GACb,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,uBAAuB,GACvB,oBAAoB,CAAA;AAEvB,0FAA0F;AAC1F,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAA;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAA;IACpC,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAA;CAC9D;AAED,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAA;IAC3C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CACxB;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACtF,QAAQ,CAAC,WAAW,EAAE,CACrB,KAAK,EAAE,gBAAgB,EACvB,MAAM,EAAE,WAAW,KACf,OAAO,CAAC,kBAAkB,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5B,mFAAmF;IACnF,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;IACnC,mGAAmG;IACnG,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,wFAAwF;IACxF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;IAChC,IAAI,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAA;CAC/D"}

package/dist/pals/activity/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/pals/activity/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/pals/activity/types.ts"],"names":[],"mappings":""}

package/dist/pals/channels/ingress.d.ts

@@ -0,0 +1,9 @@
+import type { PalChannelIngressOptions } from './types.js';
+/** Authenticated channel ingress. Raw event fields never choose host credentials or Namzu identities. */
+export declare class PalChannelIngress {
+    private readonly connection;
+    private readonly options;
+    constructor(options: PalChannelIngressOptions);
+    accept(raw: unknown, signal?: AbortSignal): Promise<import("../communication/types.js").PalMessageReceipt>;
+}
+//# sourceMappingURL=ingress.d.ts.map

package/dist/pals/channels/ingress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.d.ts","sourceRoot":"","sources":["../../../src/pals/channels/ingress.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAkC,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAE1F,yGAAyG;AACzG,qBAAa,iBAAiB;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAA;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;gBACtC,OAAO,EAAE,wBAAwB;IAYvC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,WAA0C;CAwH7E"}

package/dist/pals/channels/ingress.js

@@ -0,0 +1,131 @@
+import { isDeepStrictEqual } from 'node:util';
+import { ingressIntentDigest, ingressIntentId, ingressIntentSchema, } from '../communication/ingress-schema.js';
+import { addressSchema, freezeCommunicationValue } from '../communication/schema.js';
+import { captureConnection, checkedDecision, checkedIdentity, verifiedMessageSchema, } from './schema.js';
+/** Authenticated channel ingress. Raw event fields never choose host credentials or Namzu identities. */
+export class PalChannelIngress {
+    connection;
+    options;
+    constructor(options) {
+        if (typeof options.verify !== 'function' ||
+            typeof options.authorize !== 'function' ||
+            typeof options.selectRecipient !== 'function')
+            throw new Error('Channel ingress requires trusted verification, target selection and current authorization.');
+        this.connection = captureConnection(options.connection);
+        this.options = Object.freeze({ ...options });
+    }
+    async accept(raw, signal = new AbortController().signal) {
+        signal.throwIfAborted();
+        // Capture before the verifier's first asynchronous boundary, including JavaScript host input.
+        const event = freezeCommunicationValue(verifiedMessageSchema.parse(await this.options.verify(structuredClone(raw), this.connection, signal)));
+        signal.throwIfAborted();
+        const source = checkedIdentity(this.connection, {
+            externalTenantId: event.externalTenantId,
+            nativeConversationId: event.nativeConversationId,
+            nativeChannelId: event.nativeChannelId,
+            nativeThreadId: event.nativeThreadId,
+            actorId: event.actorId,
+            eventId: event.eventId,
+            kind: 'channel',
+            tenantId: this.connection.tenantId,
+            provider: this.connection.provider,
+            connectionId: this.connection.connectionId,
+        });
+        const identity = {
+            provider: source.provider,
+            connectionId: source.connectionId,
+            externalTenantId: source.externalTenantId,
+            nativeConversationId: source.nativeConversationId,
+            nativeChannelId: source.nativeChannelId,
+            nativeThreadId: source.nativeThreadId,
+        };
+        const { routes, pals, store } = this.options;
+        const existing = await routes.get(this.connection, identity);
+        let decision = existing ? checkedDecision(existing) : null;
+        if (!decision) {
+            const recipient = freezeCommunicationValue(addressSchema.parse(await this.options.selectRecipient(event, this.connection)));
+            if (recipient.tenantId !== this.connection.tenantId)
+                throw new Error('Cross-tenant channel routing is refused.');
+            const pal = pals.get(recipient.palId);
+            if (!pal)
+                throw new Error('Channel recipient Pal is unavailable.');
+            decision = checkedDecision({
+                v: 1,
+                revision: 1,
+                identity,
+                recipient,
+                profileRevision: pal.revision,
+            });
+        }
+        const request = freezeCommunicationValue({
+            phase: 'accept',
+            kind: 'channel',
+            source,
+            recipient: decision.recipient,
+            routeKey: {
+                v: 1,
+                kind: 'channel',
+                ...identity,
+                recipient: decision.recipient,
+            },
+            body: event.body,
+            replyTo: null,
+        });
+        let allowed = freezeCommunicationValue(structuredClone(await this.options.authorize(request)));
+        signal.throwIfAborted();
+        if (allowed.allow !== true)
+            throw new Error(`Channel ingress refused: ${allowed.reason}`);
+        // Only authorized traffic can publish a routing decision. Concurrent first events share one target.
+        const reserved = checkedDecision(await routes.reserve(decision));
+        if (!isDeepStrictEqual(reserved, decision))
+            throw new Error('Channel routing decision changed during acceptance.');
+        decision = reserved;
+        pals.getRevision(decision.recipient.palId, decision.profileRevision);
+        if (!pals.get(decision.recipient.palId))
+            throw new Error('Channel recipient Pal is unavailable.');
+        // Routing publication can await another process. Re-read event authority before committing its input.
+        allowed = freezeCommunicationValue(structuredClone(await this.options.authorize(request)));
+        signal.throwIfAborted();
+        if (allowed.allow !== true)
+            throw new Error(`Channel ingress refused: ${allowed.reason}`);
+        const intent = {
+            kind: 'channel',
+            source,
+            recipient: decision.recipient,
+            routeKey: request.routeKey,
+            body: event.body,
+            replyTo: null,
+            operationId: source.eventId,
+            grant: allowed.grant,
+            createdAt: (this.options.now ?? Date.now)(),
+        };
+        const identified = { ...intent, id: ingressIntentId(intent) };
+        const immutable = freezeCommunicationValue(ingressIntentSchema.parse({
+            ...identified,
+            digest: ingressIntentDigest(identified),
+        }));
+        signal.throwIfAborted();
+        const receipt = await store.acceptIngress(immutable, decision.profileRevision);
+        const binding = await store.routeIngress(immutable.routeKey);
+        if (!binding ||
+            binding.sessionId !== receipt.sessionId ||
+            binding.profileRevision !== decision.profileRevision)
+            throw new Error('Channel acceptance does not match its immutable target binding.');
+        const report = (error) => {
+            try {
+                void Promise.resolve(this.options.onNotificationError?.(error, receipt)).catch(() => undefined);
+            }
+            catch {
+                /* Committed receipt remains accepted. */
+            }
+        };
+        try {
+            void Promise.resolve(this.options.host?.notify?.(decision.recipient)).catch(report);
+        }
+        catch (error) {
+            report(error);
+        }
+        return receipt;
+    }
+}
+//# sourceMappingURL=ingress.js.map

package/dist/pals/channels/ingress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.js","sourceRoot":"","sources":["../../../src/pals/channels/ingress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EACN,mBAAmB,EACnB,eAAe,EACf,mBAAmB,GACnB,MAAM,oCAAoC,CAAA;AAE3C,OAAO,EAAE,aAAa,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAA;AACpF,OAAO,EACN,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,qBAAqB,GACrB,MAAM,aAAa,CAAA;AAGpB,yGAAyG;AACzG,MAAM,OAAO,iBAAiB;IACZ,UAAU,CAAA;IACV,OAAO,CAA0B;IAClD,YAAY,OAAiC;QAC5C,IACC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;YACpC,OAAO,OAAO,CAAC,SAAS,KAAK,UAAU;YACvC,OAAO,OAAO,CAAC,eAAe,KAAK,UAAU;YAE7C,MAAM,IAAI,KAAK,CACd,4FAA4F,CAC5F,CAAA;QACF,IAAI,CAAC,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACvD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;IAC7C,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAY,EAAE,SAAsB,IAAI,eAAe,EAAE,CAAC,MAAM;QAC5E,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,8FAA8F;QAC9F,MAAM,KAAK,GAAG,wBAAwB,CACrC,qBAAqB,CAAC,KAAK,CAC1B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CACxE,CACD,CAAA;QACD,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE;YAC/C,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAClC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY;SAC1C,CAAC,CAAA;QACF,MAAM,QAAQ,GAAuB;YACpC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;YACjD,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,cAAc,EAAE,MAAM,CAAC,cAAc;SACrC,CAAA;QACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAC5D,IAAI,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,SAAS,GAAG,wBAAwB,CACzC,aAAa,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAC/E,CAAA;YACD,IAAI,SAAS,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ;gBAClD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YACrC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;YAClE,QAAQ,GAAG,eAAe,CAAC;gBAC1B,CAAC,EAAE,CAAC;gBACJ,QAAQ,EAAE,CAAC;gBACX,QAAQ;gBACR,SAAS;gBACT,eAAe,EAAE,GAAG,CAAC,QAAQ;aAC7B,CAAC,CAAA;QACH,CAAC;QACD,MAAM,OAAO,GAAmC,wBAAwB,CAAC;YACxE,KAAK,EAAE,QAAQ;YACf,IAAI,EAAE,SAAS;YACf,MAAM;YACN,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE;gBACT,CAAC,EAAE,CAAC;gBACJ,IAAI,EAAE,SAAS;gBACf,GAAG,QAAQ;gBACX,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC7B;YACD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,IAAI;SACb,CAAC,CAAA;QACF,IAAI,OAAO,GAAG,wBAAwB,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC9F,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACzF,oGAAoG;QACpG,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QACvE,QAAQ,GAAG,QAAQ,CAAA;QACnB,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;QACpE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QACzD,sGAAsG;QACtG,OAAO,GAAG,wBAAwB,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;QAC1F,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACzF,MAAM,MAAM,GAAG;YACd,IAAI,EAAE,SAAkB;YACxB,MAAM;YACN,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,MAAM,CAAC,OAAO;YAC3B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,SAAS,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE;SAC3C,CAAA;QACD,MAAM,UAAU,GAAG,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAA;QAC7D,MAAM,SAAS,GAAG,wBAAwB,CACzC,mBAAmB,CAAC,KAAK,CAAC;YACzB,GAAG,UAAU;YACb,MAAM,EAAE,mBAAmB,CAAC,UAAU,CAAC;SACvC,CAAC,CACkB,CAAA;QACrB,MAAM,CAAC,cAAc,EAAE,CAAA;QACvB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;QAC9E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC5D,IACC,CAAC,OAAO;YACR,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;YACvC,OAAO,CAAC,eAAe,KAAK,QAAQ,CAAC,eAAe;YAEpD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACnF,MAAM,MAAM,GAAG,CAAC,KAAc,EAAE,EAAE;YACjC,IAAI,CAAC;gBACJ,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAC7E,GAAG,EAAE,CAAC,SAAS,CACf,CAAA;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,yCAAyC;YAC1C,CAAC;QACF,CAAC,CAAA;QACD,IAAI,CAAC;YACJ,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,KAAK,CAAC,CAAA;QACd,CAAC;QACD,OAAO,OAAO,CAAA;IACf,CAAC;CACD"}

package/dist/pals/channels/routes.d.ts

@@ -0,0 +1,20 @@
+import type { PalChannelIdentity } from '../communication/ingress-types.js';
+import type { PalChannelConnection, PalChannelRouteDecision, PalChannelRoutes } from './types.js';
+export declare class PalChannelRouteConflictError extends Error {
+    readonly name = "PalChannelRouteConflictError";
+}
+/** Immutable target decisions only. Session and delivery ownership remain in PalIngressStore. */
+export declare class DiskPalChannelRoutes implements PalChannelRoutes {
+    private readonly root;
+    private readonly secure;
+    private readonly records;
+    constructor(options: {
+        root: string;
+        secureDirectory?: (path: string) => void;
+    });
+    private directory;
+    private location;
+    get(input: PalChannelConnection, value: PalChannelIdentity): Promise<PalChannelRouteDecision | null>;
+    reserve(input: PalChannelRouteDecision): Promise<PalChannelRouteDecision>;
+}
+//# sourceMappingURL=routes.d.ts.map

package/dist/pals/channels/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/pals/channels/routes.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AAE3E,OAAO,KAAK,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAEjG,qBAAa,4BAA6B,SAAQ,KAAK;IACtD,SAAkB,IAAI,kCAAiC;CACvD;AAcD,iGAAiG;AACjG,qBAAa,oBAAqB,YAAW,gBAAgB;IAC5D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwB;IAC/C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAIvB;gBACW,OAAO,EAAE;QACpB,IAAI,EAAE,MAAM,CAAA;QACZ,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KACxC;IASD,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,QAAQ;IAsBV,GAAG,CAAC,KAAK,EAAE,oBAAoB,EAAE,KAAK,EAAE,kBAAkB;IAsB1D,OAAO,CAAC,KAAK,EAAE,uBAAuB;CAmB5C"}

package/dist/pals/channels/routes.js

@@ -0,0 +1,111 @@
+import { chmodSync, lstatSync, mkdirSync, readdirSync, realpathSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
+import { DiskRevisionRecordStore } from '../../store/kv/revision-record-store.js';
+import { defineSchema } from '../../store/schema.js';
+import { channelRouteKeySchema } from '../communication/ingress-schema.js';
+import { captureConnection, checkedDecision, decisionId } from './schema.js';
+export class PalChannelRouteConflictError extends Error {
+    name = 'PalChannelRouteConflictError';
+}
+class ExistingDecision extends Error {
+    decision;
+    constructor(decision) {
+        super('Existing immutable channel route.');
+        this.decision = decision;
+    }
+}
+function storedDecision(value) {
+    // DiskRecordStore validates its own envelope; it is not part of the public route identity.
+    const { schemaVersion: _version, ...body } = value;
+    return checkedDecision(body);
+}
+/** Immutable target decisions only. Session and delivery ownership remain in PalIngressStore. */
+export class DiskPalChannelRoutes {
+    root;
+    secure;
+    records = new DiskRevisionRecordStore(defineSchema({ kind: 'pal-channel-route', current: 1, migrations: {} }), 'Pal channel route', (record) => record.revision);
+    constructor(options) {
+        this.root = resolve(options.root);
+        this.secure =
+            options.secureDirectory ??
+                ((path) => {
+                    if (process.platform !== 'win32')
+                        chmodSync(path, 0o700);
+                });
+        this.directory(this.root);
+    }
+    directory(path) {
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+        const entry = lstatSync(path);
+        if (!entry.isDirectory() || entry.isSymbolicLink() || realpathSync(path) !== path)
+            throw new Error('Channel routes require real directories without aliases.');
+        this.secure(path);
+    }
+    location(id) {
+        this.directory(this.root);
+        const directory = join(this.root, id);
+        this.directory(directory);
+        const revisionsDir = join(directory, 'revisions');
+        this.directory(revisionsDir);
+        for (const name of readdirSync(revisionsDir)) {
+            if (!/^[1-9][0-9]*\.json$/u.test(name))
+                continue;
+            const entry = lstatSync(join(revisionsDir, name));
+            if (!entry.isFile() || entry.isSymbolicLink())
+                throw new Error('Channel route commits must be real files.');
+        }
+        const legacyPath = join(directory, 'route.json');
+        try {
+            const legacy = lstatSync(legacyPath);
+            if (!legacy.isFile() || legacy.isSymbolicLink())
+                throw new Error('Channel route projections must be real files.');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        return { legacyPath, revisionsDir, publishLegacyProjection: false };
+    }
+    async get(input, value) {
+        const connection = captureConnection(input);
+        const identity = channelRouteKeySchema
+            .omit({ v: true, kind: true, recipient: true })
+            .parse(value);
+        if (identity.provider !== connection.provider ||
+            identity.connectionId !== connection.connectionId ||
+            identity.externalTenantId !== connection.externalTenantId)
+            throw new Error('Foreign channel route connection.');
+        const id = decisionId({
+            identity,
+            recipient: { tenantId: connection.tenantId, palId: '' },
+        });
+        const stored = await this.records.read(this.location(id));
+        if (!stored)
+            return null;
+        const decision = storedDecision(stored);
+        if (decisionId(decision) !== id || !isDeepStrictEqual(decision.identity, identity))
+            throw new Error('Channel route identity changed.');
+        return decision;
+    }
+    async reserve(input) {
+        const decision = checkedDecision(input);
+        try {
+            return await this.records.transact(this.location(decisionId(decision)), (stored) => {
+                if (stored) {
+                    const current = storedDecision(stored);
+                    if (!isDeepStrictEqual(current, decision))
+                        throw new PalChannelRouteConflictError('This native conversation already has an immutable Pal target.');
+                    throw new ExistingDecision(current);
+                }
+                return { record: decision, result: decision };
+            });
+        }
+        catch (error) {
+            if (error instanceof ExistingDecision)
+                return error.decision;
+            throw error;
+        }
+    }
+}
+//# sourceMappingURL=routes.js.map

package/dist/pals/channels/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../src/pals/channels/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAA;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAE1E,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAG5E,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IACpC,IAAI,GAAG,8BAA8B,CAAA;CACvD;AACD,MAAM,gBAAiB,SAAQ,KAAK;IACd;IAArB,YAAqB,QAAiC;QACrD,KAAK,CAAC,mCAAmC,CAAC,CAAA;QADtB,aAAQ,GAAR,QAAQ,CAAyB;IAEtD,CAAC;CACD;AACD,SAAS,cAAc,CAAC,KAA8B;IACrD,2FAA2F;IAC3F,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAE5C,CAAA;IACD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAA;AAC7B,CAAC;AAED,iGAAiG;AACjG,MAAM,OAAO,oBAAoB;IACf,IAAI,CAAQ;IACZ,MAAM,CAAwB;IAC9B,OAAO,GAAG,IAAI,uBAAuB,CACrD,YAAY,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,EACvE,mBAAmB,EACnB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAC3B,CAAA;IACD,YAAY,OAGX;QACA,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,CAAC,MAAM;YACV,OAAO,CAAC,eAAe;gBACvB,CAAC,CAAC,IAAI,EAAE,EAAE;oBACT,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;wBAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACzD,CAAC,CAAC,CAAA;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACO,SAAS,CAAC,IAAY;QAC7B,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAChF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;QAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAClB,CAAC;IACO,QAAQ,CAAC,EAAU;QAC1B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;QACjD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QAC5B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;YACjD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;gBAC5C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;QAChD,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,CAAC,CAAA;YACpC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE;gBAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAA;QACpE,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,uBAAuB,EAAE,KAAK,EAAE,CAAA;IACpE,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,KAA2B,EAAE,KAAyB;QAC/D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,qBAAqB;aACpC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aAC9C,KAAK,CAAC,KAAK,CAAC,CAAA;QACd,IACC,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;YACzC,QAAQ,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;YACjD,QAAQ,CAAC,gBAAgB,KAAK,UAAU,CAAC,gBAAgB;YAEzD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QACrD,MAAM,EAAE,GAAG,UAAU,CAAC;YACrB,QAAQ;YACR,SAAS,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;SACvD,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACxB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QACnD,OAAO,QAAQ,CAAA;IAChB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,KAA8B;QAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;QACvC,IAAI,CAAC;YACJ,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE;gBAClF,IAAI,MAAM,EAAE,CAAC;oBACZ,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;oBACtC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC;wBACxC,MAAM,IAAI,4BAA4B,CACrC,+DAA+D,CAC/D,CAAA;oBACF,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;gBACpC,CAAC;gBACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;YAC9C,CAAC,CAAC,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gBAAgB;gBAAE,OAAO,KAAK,CAAC,QAAQ,CAAA;YAC5D,MAAM,KAAK,CAAA;QACZ,CAAC;IACF,CAAC;CACD"}

package/dist/pals/channels/routing.d.ts

@@ -0,0 +1,37 @@
+import type { InboundDeliveryRef } from '../../types/message/inbound-delivery.js';
+import type { PalChannelExecutionContext, PalChannelResolvedRoute, PalChannelRouterOptions } from './types.js';
+/** Resolves original authenticated destinations. It does not imply remote delivery. */
+export declare class PalChannelRouter {
+    private readonly options;
+    private readonly connection;
+    constructor(options: PalChannelRouterOptions);
+    private assertRecipient;
+    private recorded;
+    private resolve;
+    replyRoute(input: InboundDeliveryRef, execution: PalChannelExecutionContext, signal?: AbortSignal): Promise<PalChannelResolvedRoute>;
+    actionRoute(raw: unknown, execution: PalChannelExecutionContext, signal?: AbortSignal): Promise<{
+        route: PalChannelResolvedRoute;
+        action: {
+            kind: "action";
+            payload: string;
+            externalTenantId: string;
+            nativeConversationId: string;
+            nativeChannelId: string | null;
+            nativeThreadId: string | null;
+            actorId: string;
+            eventId: string;
+            deliveryRef: {
+                id: string;
+                digest: string;
+                namespace: "namzu-pal-channel/1";
+            };
+            actionId: string;
+            payloadDigest: string;
+        };
+    }>;
+    executeAction(raw: unknown, execution: PalChannelExecutionContext, signal?: AbortSignal): Promise<{
+        status: "rejected" | "applied";
+        receiptId: string;
+    }>;
+}
+//# sourceMappingURL=routing.d.ts.map

package/dist/pals/channels/routing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../../src/pals/channels/routing.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AAQjF,OAAO,KAAK,EACX,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EAEvB,MAAM,YAAY,CAAA;AAiBnB,uFAAuF;AACvF,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAA;gBACf,OAAO,EAAE,uBAAuB;IAM5C,OAAO,CAAC,eAAe;YAOT,QAAQ;YAiDR,OAAO;IAqDf,UAAU,CACf,KAAK,EAAE,kBAAkB,EACzB,SAAS,EAAE,0BAA0B,EACrC,MAAM,GAAE,WAA0C;IAO7C,WAAW,CAChB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,0BAA0B,EACrC,MAAM,GAAE,WAA0C;;;;;;;;;;;;;;;;;;;;IAa7C,aAAa,CAClB,GAAG,EAAE,OAAO,EACZ,SAAS,EAAE,0BAA0B,EACrC,MAAM,GAAE,WAA0C;;;;CAenD"}