@nebutra/agent-runtime 0.2.0 → 0.2.2

package/dist/chunk-Q62VKHIT.js

@@ -0,0 +1,178 @@
+// src/orchestration.ts
+import { hasCycleFrom } from "@nebutra/graph-model";
+import { z } from "zod";
+var budgetCapSchema = z.object({
+  durationMs: z.number().positive(),
+  costUsd: z.number().nonnegative(),
+  tokenLimit: z.number().positive()
+});
+var briefSchema = z.object({
+  id: z.string().trim().min(1),
+  objective: z.string().trim().min(1),
+  outputFormat: z.record(z.string(), z.unknown()),
+  allowedTools: z.array(z.string()).min(1),
+  contextRefs: z.array(z.string()),
+  boundaries: z.array(z.string()).min(1),
+  budget: budgetCapSchema,
+  dependsOn: z.array(z.string()).optional(),
+  model: z.object({
+    id: z.string().trim().min(1).optional(),
+    reasoningEffort: z.enum(["low", "medium", "high", "xhigh"]).optional(),
+    modality: z.enum(["text", "image", "video", "audio", "embedding"]).optional(),
+    capabilities: z.object({
+      vision: z.boolean().optional(),
+      toolCall: z.boolean().optional(),
+      reasoning: z.boolean().optional()
+    }).optional()
+  }).optional()
+});
+function fail(message, suggestion) {
+  throw new Error(`${message}. Suggestion: ${suggestion}`);
+}
+var BRIEF_FIELD_FAILURE = {
+  id: { message: "brief.id is required", suggestion: "Use a stable role or task id." },
+  objective: {
+    message: "brief.objective is required",
+    suggestion: "Write a concrete objective before dispatching."
+  },
+  outputFormat: {
+    message: "brief.outputFormat is invalid",
+    suggestion: "Provide an output schema object the worker must conform to."
+  },
+  allowedTools: {
+    message: "brief.allowedTools is required",
+    suggestion: "Constrain each subagent to an explicit tool scope."
+  },
+  contextRefs: {
+    message: "brief.contextRefs is invalid",
+    suggestion: "Pass an array of context references (may be empty)."
+  },
+  boundaries: {
+    message: "brief.boundaries is required",
+    suggestion: "State at least one boundary for the worker."
+  },
+  budget: {
+    message: "brief.budget is invalid",
+    suggestion: "Set positive token/time caps and a non-negative cost cap."
+  },
+  dependsOn: {
+    message: "brief.dependsOn is invalid",
+    suggestion: "List dependency brief ids as an array of strings."
+  },
+  model: {
+    message: "brief.model is invalid",
+    suggestion: "Use a preset alias or 'provider/model' id, or omit to inherit the run default."
+  }
+};
+function validateBrief(brief) {
+  const result = briefSchema.safeParse(brief);
+  if (result.success) return;
+  const topLevelField = result.error.issues[0]?.path[0];
+  const failure = typeof topLevelField === "string" ? BRIEF_FIELD_FAILURE[topLevelField] : void 0;
+  if (failure) fail(failure.message, failure.suggestion);
+  fail("brief is invalid", "Provide every required brief field with valid values.");
+}
+function dependencySet(briefs) {
+  const dependencies = /* @__PURE__ */ new Set();
+  for (const brief of briefs) {
+    for (const dep of brief.dependsOn ?? []) dependencies.add(dep);
+  }
+  return dependencies;
+}
+function briefEdges(briefs) {
+  const ids = new Set(briefs.map((brief) => brief.id));
+  const edges = [];
+  for (const brief of briefs) {
+    for (const dep of brief.dependsOn ?? []) {
+      if (ids.has(dep)) edges.push({ from: dep, to: brief.id });
+    }
+  }
+  return edges;
+}
+function assertAcyclic(briefs, edges) {
+  for (const brief of briefs) {
+    if (hasCycleFrom(edges, brief.id)) {
+      fail(
+        `subagent dependency cycle includes '${brief.id}'`,
+        "Remove the cycle or collapse the dependent work into one sequential brief."
+      );
+    }
+  }
+}
+function planWaves(briefs) {
+  const edges = briefEdges(briefs);
+  assertAcyclic(briefs, edges);
+  const byId = new Map(briefs.map((brief) => [brief.id, brief]));
+  const done = /* @__PURE__ */ new Set();
+  const waves = [];
+  while (done.size < briefs.length) {
+    const wave = [];
+    for (const brief of briefs) {
+      if (done.has(brief.id)) continue;
+      const deps = (brief.dependsOn ?? []).filter((dep) => byId.has(dep));
+      if (deps.every((dep) => done.has(dep))) wave.push(brief);
+    }
+    if (wave.length === 0) {
+      fail(
+        "subagent dependencies cannot be resolved into waves",
+        "Ensure every dependsOn id references a brief in the set."
+      );
+    }
+    for (const brief of wave) done.add(brief.id);
+    waves.push(wave);
+  }
+  return waves;
+}
+function topologicalOrder(briefs) {
+  return planWaves(briefs).flat();
+}
+function planSubagentDispatch(briefs, options = {}) {
+  if (briefs.length === 0) {
+    fail("at least one brief is required", "Create a concrete worker brief before dispatching.");
+  }
+  for (const brief of briefs) validateBrief(brief);
+  const dependencies = dependencySet(briefs);
+  if ((options.strategy ?? "auto") === "fanout" && dependencies.size > 0) {
+    fail(
+      "fan-out cannot run briefs that depend on each other",
+      "Use sequential dispatch for dependent work or split independent briefs only."
+    );
+  }
+  const order = topologicalOrder(briefs);
+  const strategy = options.strategy === "fanout" || options.strategy === "auto" && dependencies.size === 0 ? "fanout" : "sequential";
+  return { strategy, order };
+}
+async function fanOutSubagents(briefs, run) {
+  const plan = planSubagentDispatch(briefs, { strategy: "fanout" });
+  return Promise.all(plan.order.map((brief) => run(brief)));
+}
+async function runAgentWaves(briefs, run) {
+  for (const brief of briefs) validateBrief(brief);
+  const results = [];
+  for (const wave of planWaves(briefs)) {
+    const waveResults = await Promise.all(wave.map((brief) => run(brief)));
+    results.push(...waveResults);
+  }
+  return results;
+}
+function costReport(results) {
+  return {
+    totalInputTokens: results.reduce((sum, result) => sum + result.usage.inputTokens, 0),
+    totalOutputTokens: results.reduce((sum, result) => sum + result.usage.outputTokens, 0),
+    totalReasoningTokens: results.reduce(
+      (sum, result) => sum + result.usage.reasoningOutputTokens,
+      0
+    ),
+    maxDurationMs: results.reduce((max, result) => Math.max(max, result.durationMs), 0),
+    subagents: results.length
+  };
+}
+
+export {
+  planWaves,
+  planSubagentDispatch,
+  fanOutSubagents,
+  runAgentWaves,
+  costReport
+};
+//# sourceMappingURL=chunk-Q62VKHIT.js.map

package/dist/chunk-Q62VKHIT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/orchestration.ts"],"sourcesContent":["import { type GraphEdge, hasCycleFrom } from \"@nebutra/graph-model\";\nimport { z } from \"zod\";\nimport type { TurnUsage } from \"./model\";\n\nexport interface BudgetCap {\n  readonly durationMs: number;\n  readonly costUsd: number;\n  readonly tokenLimit: number;\n}\n\n/** Thinking/reasoning effort for a node (maps to provider reasoning controls). */\nexport type ReasoningEffort = \"low\" | \"medium\" | \"high\" | \"xhigh\";\n\n/** Output modality a node produces. Mirrors @nebutra/ai-providers ModelModality. */\nexport type ModelModality = \"text\" | \"image\" | \"video\" | \"audio\" | \"embedding\";\n\n/**\n * Per-node model selection — the full model meta-info a node can declare. ALL\n * fields optional; an unset field inherits the run-level default\n * (WorkflowDefinition.defaultModel / runTurn config). The executor resolves\n * these HINTS against @nebutra/ai-providers/catalog (listModelsByModality /\n * resolveFrontierModel) to a concrete model — so a node can either PIN one\n * (`id`) or DESCRIBE what it needs (\"the latest fast text model with vision\").\n */\nexport interface NodeModelSpec {\n  /** Explicit pin: preset alias (`flagship`/`reasoning`/`fast`) or `provider/model` id. */\n  readonly id?: string;\n  /** Thinking effort: `low` → cheap/quick, `xhigh` → deepest reasoning. */\n  readonly reasoningEffort?: ReasoningEffort;\n  /** Output modality — selects a model of this modality when `id` is unset. */\n  readonly modality?: ModelModality;\n  /** Capabilities the selected model MUST have (e.g. a node needing image input). */\n  readonly capabilities?: {\n    readonly vision?: boolean;\n    readonly toolCall?: boolean;\n    readonly reasoning?: boolean;\n  };\n}\n\nexport interface Brief {\n  readonly id: string;\n  readonly objective: string;\n  readonly outputFormat: Record<string, unknown>;\n  readonly allowedTools: readonly string[];\n  readonly contextRefs: readonly string[];\n  readonly boundaries: readonly string[];\n  readonly budget: BudgetCap;\n  readonly dependsOn?: readonly string[];\n  /** Per-node model meta-info (id/preset · thinking effort · modality · capabilities). */\n  readonly model?: NodeModelSpec;\n}\n\n/**\n * Runtime shape + semantic validation for {@link Brief}. The public type keeps\n * its `readonly` immutability contract (see project immutability rules), so we\n * validate against this schema at the boundary rather than deriving the type\n * from it. Each rule mirrors a tailored DX suggestion surfaced via {@link fail}.\n */\nconst budgetCapSchema = z.object({\n  durationMs: z.number().positive(),\n  costUsd: z.number().nonnegative(),\n  tokenLimit: z.number().positive(),\n});\n\nconst briefSchema = z.object({\n  id: z.string().trim().min(1),\n  objective: z.string().trim().min(1),\n  outputFormat: z.record(z.string(), z.unknown()),\n  allowedTools: z.array(z.string()).min(1),\n  contextRefs: z.array(z.string()),\n  boundaries: z.array(z.string()).min(1),\n  budget: budgetCapSchema,\n  dependsOn: z.array(z.string()).optional(),\n  model: z\n    .object({\n      id: z.string().trim().min(1).optional(),\n      reasoningEffort: z.enum([\"low\", \"medium\", \"high\", \"xhigh\"]).optional(),\n      modality: z.enum([\"text\", \"image\", \"video\", \"audio\", \"embedding\"]).optional(),\n      capabilities: z\n        .object({\n          vision: z.boolean().optional(),\n          toolCall: z.boolean().optional(),\n          reasoning: z.boolean().optional(),\n        })\n        .optional(),\n    })\n    .optional(),\n});\n\nexport type DispatchStrategy = \"auto\" | \"sequential\" | \"fanout\";\n\nexport interface DispatchPlan {\n  readonly strategy: Exclude<DispatchStrategy, \"auto\">;\n  readonly order: readonly Brief[];\n}\n\nexport interface DispatchPlanOptions {\n  readonly strategy?: DispatchStrategy;\n}\n\nexport interface SubagentResult {\n  readonly briefId: string;\n  readonly output: unknown;\n  readonly usage: TurnUsage;\n  readonly durationMs: number;\n}\n\nexport interface SubagentCostReport {\n  readonly totalInputTokens: number;\n  readonly totalOutputTokens: number;\n  readonly totalReasoningTokens: number;\n  readonly maxDurationMs: number;\n  readonly subagents: number;\n}\n\nfunction fail(message: string, suggestion: string): never {\n  throw new Error(`${message}. Suggestion: ${suggestion}`);\n}\n\n/**\n * Per-top-level-field DX messages, keyed by the failing schema path. Keeps the\n * exact \"message. Suggestion: …\" surface the callers (and tests) rely on while\n * the heavy lifting (shape + bounds) moves into {@link briefSchema}.\n */\nconst BRIEF_FIELD_FAILURE: Record<string, { message: string; suggestion: string }> = {\n  id: { message: \"brief.id is required\", suggestion: \"Use a stable role or task id.\" },\n  objective: {\n    message: \"brief.objective is required\",\n    suggestion: \"Write a concrete objective before dispatching.\",\n  },\n  outputFormat: {\n    message: \"brief.outputFormat is invalid\",\n    suggestion: \"Provide an output schema object the worker must conform to.\",\n  },\n  allowedTools: {\n    message: \"brief.allowedTools is required\",\n    suggestion: \"Constrain each subagent to an explicit tool scope.\",\n  },\n  contextRefs: {\n    message: \"brief.contextRefs is invalid\",\n    suggestion: \"Pass an array of context references (may be empty).\",\n  },\n  boundaries: {\n    message: \"brief.boundaries is required\",\n    suggestion: \"State at least one boundary for the worker.\",\n  },\n  budget: {\n    message: \"brief.budget is invalid\",\n    suggestion: \"Set positive token/time caps and a non-negative cost cap.\",\n  },\n  dependsOn: {\n    message: \"brief.dependsOn is invalid\",\n    suggestion: \"List dependency brief ids as an array of strings.\",\n  },\n  model: {\n    message: \"brief.model is invalid\",\n    suggestion: \"Use a preset alias or 'provider/model' id, or omit to inherit the run default.\",\n  },\n};\n\nfunction validateBrief(brief: Brief): void {\n  const result = briefSchema.safeParse(brief);\n  if (result.success) return;\n\n  const topLevelField = result.error.issues[0]?.path[0];\n  const failure =\n    typeof topLevelField === \"string\" ? BRIEF_FIELD_FAILURE[topLevelField] : undefined;\n  if (failure) fail(failure.message, failure.suggestion);\n  fail(\"brief is invalid\", \"Provide every required brief field with valid values.\");\n}\n\nfunction dependencySet(briefs: readonly Brief[]): Set<string> {\n  const dependencies = new Set<string>();\n  for (const brief of briefs) {\n    for (const dep of brief.dependsOn ?? []) dependencies.add(dep);\n  }\n  return dependencies;\n}\n\n/** Dependency edges (dep → brief) over the brief set; refs to unknown ids drop. */\nfunction briefEdges(briefs: readonly Brief[]): GraphEdge[] {\n  const ids = new Set(briefs.map((brief) => brief.id));\n  const edges: GraphEdge[] = [];\n  for (const brief of briefs) {\n    for (const dep of brief.dependsOn ?? []) {\n      if (ids.has(dep)) edges.push({ from: dep, to: brief.id });\n    }\n  }\n  return edges;\n}\n\n/**\n * Cycle guard via the SINGLE repo-wide cycle-detection algorithm\n * (`@nebutra/graph-model` `hasCycleFrom`). No private DFS cycle-walker lives here.\n */\nfunction assertAcyclic(briefs: readonly Brief[], edges: readonly GraphEdge[]): void {\n  for (const brief of briefs) {\n    if (hasCycleFrom(edges, brief.id)) {\n      fail(\n        `subagent dependency cycle includes '${brief.id}'`,\n        \"Remove the cycle or collapse the dependent work into one sequential brief.\",\n      );\n    }\n  }\n}\n\n/**\n * Dependency-resolved execution WAVES — the agent node-topology scheduler. Each\n * wave is the set of briefs whose dependencies are satisfied by earlier waves;\n * waves run in order, briefs within a wave run in parallel. Input order is\n * preserved within a wave.\n */\nexport function planWaves(briefs: readonly Brief[]): readonly (readonly Brief[])[] {\n  const edges = briefEdges(briefs);\n  assertAcyclic(briefs, edges);\n\n  const byId = new Map(briefs.map((brief) => [brief.id, brief]));\n  const done = new Set<string>();\n  const waves: Brief[][] = [];\n\n  while (done.size < briefs.length) {\n    const wave: Brief[] = [];\n    for (const brief of briefs) {\n      if (done.has(brief.id)) continue;\n      const deps = (brief.dependsOn ?? []).filter((dep) => byId.has(dep));\n      if (deps.every((dep) => done.has(dep))) wave.push(brief);\n    }\n    if (wave.length === 0) {\n      // assertAcyclic already ruled out cycles; only a logic bug reaches here.\n      fail(\n        \"subagent dependencies cannot be resolved into waves\",\n        \"Ensure every dependsOn id references a brief in the set.\",\n      );\n    }\n    for (const brief of wave) done.add(brief.id);\n    waves.push(wave);\n  }\n  return waves;\n}\n\nfunction topologicalOrder(briefs: readonly Brief[]): Brief[] {\n  return planWaves(briefs).flat();\n}\n\nexport function planSubagentDispatch(\n  briefs: readonly Brief[],\n  options: DispatchPlanOptions = {},\n): DispatchPlan {\n  if (briefs.length === 0) {\n    fail(\"at least one brief is required\", \"Create a concrete worker brief before dispatching.\");\n  }\n  for (const brief of briefs) validateBrief(brief);\n\n  const dependencies = dependencySet(briefs);\n  if ((options.strategy ?? \"auto\") === \"fanout\" && dependencies.size > 0) {\n    fail(\n      \"fan-out cannot run briefs that depend on each other\",\n      \"Use sequential dispatch for dependent work or split independent briefs only.\",\n    );\n  }\n\n  const order = topologicalOrder(briefs);\n  const strategy =\n    options.strategy === \"fanout\" || (options.strategy === \"auto\" && dependencies.size === 0)\n      ? \"fanout\"\n      : \"sequential\";\n  return { strategy, order };\n}\n\nexport async function fanOutSubagents(\n  briefs: readonly Brief[],\n  run: (brief: Brief) => Promise<SubagentResult>,\n): Promise<readonly SubagentResult[]> {\n  const plan = planSubagentDispatch(briefs, { strategy: \"fanout\" });\n  return Promise.all(plan.order.map((brief) => run(brief)));\n}\n\n/**\n * Execute briefs as a dependency graph: each wave runs in parallel, waves run\n * sequentially. The node-topology execution path — `fanOutSubagents` is the\n * degenerate single-wave (all-independent) case of this.\n */\nexport async function runAgentWaves(\n  briefs: readonly Brief[],\n  run: (brief: Brief) => Promise<SubagentResult>,\n): Promise<readonly SubagentResult[]> {\n  for (const brief of briefs) validateBrief(brief);\n  const results: SubagentResult[] = [];\n  for (const wave of planWaves(briefs)) {\n    const waveResults = await Promise.all(wave.map((brief) => run(brief)));\n    results.push(...waveResults);\n  }\n  return results;\n}\n\nexport function costReport(results: readonly SubagentResult[]): SubagentCostReport {\n  return {\n    totalInputTokens: results.reduce((sum, result) => sum + result.usage.inputTokens, 0),\n    totalOutputTokens: results.reduce((sum, result) => sum + result.usage.outputTokens, 0),\n    totalReasoningTokens: results.reduce(\n      (sum, result) => sum + result.usage.reasoningOutputTokens,\n      0,\n    ),\n    maxDurationMs: results.reduce((max, result) => Math.max(max, result.durationMs), 0),\n    subagents: results.length,\n  };\n}\n"],"mappings":";AAAA,SAAyB,oBAAoB;AAC7C,SAAS,SAAS;AAyDlB,IAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,YAAY;AAAA,EAChC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,IAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EAClC,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC9C,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACvC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC/B,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC;AAAA,EACrC,QAAQ;AAAA,EACR,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACxC,OAAO,EACJ,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,IACtC,iBAAiB,EAAE,KAAK,CAAC,OAAO,UAAU,QAAQ,OAAO,CAAC,EAAE,SAAS;AAAA,IACrE,UAAU,EAAE,KAAK,CAAC,QAAQ,SAAS,SAAS,SAAS,WAAW,CAAC,EAAE,SAAS;AAAA,IAC5E,cAAc,EACX,OAAO;AAAA,MACN,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC7B,UAAU,EAAE,QAAQ,EAAE,SAAS;AAAA,MAC/B,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA,IAClC,CAAC,EACA,SAAS;AAAA,EACd,CAAC,EACA,SAAS;AACd,CAAC;AA4BD,SAAS,KAAK,SAAiB,YAA2B;AACxD,QAAM,IAAI,MAAM,GAAG,OAAO,iBAAiB,UAAU,EAAE;AACzD;AAOA,IAAM,sBAA+E;AAAA,EACnF,IAAI,EAAE,SAAS,wBAAwB,YAAY,gCAAgC;AAAA,EACnF,WAAW;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AAAA,EACA,cAAc;AAAA,IACZ,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AAAA,EACA,cAAc;AAAA,IACZ,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AAAA,EACA,aAAa;AAAA,IACX,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AAAA,EACA,YAAY;AAAA,IACV,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AAAA,EACA,WAAW;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AAAA,EACA,OAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY;AAAA,EACd;AACF;AAEA,SAAS,cAAc,OAAoB;AACzC,QAAM,SAAS,YAAY,UAAU,KAAK;AAC1C,MAAI,OAAO,QAAS;AAEpB,QAAM,gBAAgB,OAAO,MAAM,OAAO,CAAC,GAAG,KAAK,CAAC;AACpD,QAAM,UACJ,OAAO,kBAAkB,WAAW,oBAAoB,aAAa,IAAI;AAC3E,MAAI,QAAS,MAAK,QAAQ,SAAS,QAAQ,UAAU;AACrD,OAAK,oBAAoB,uDAAuD;AAClF;AAEA,SAAS,cAAc,QAAuC;AAC5D,QAAM,eAAe,oBAAI,IAAY;AACrC,aAAW,SAAS,QAAQ;AAC1B,eAAW,OAAO,MAAM,aAAa,CAAC,EAAG,cAAa,IAAI,GAAG;AAAA,EAC/D;AACA,SAAO;AACT;AAGA,SAAS,WAAW,QAAuC;AACzD,QAAM,MAAM,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC;AACnD,QAAM,QAAqB,CAAC;AAC5B,aAAW,SAAS,QAAQ;AAC1B,eAAW,OAAO,MAAM,aAAa,CAAC,GAAG;AACvC,UAAI,IAAI,IAAI,GAAG,EAAG,OAAM,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,GAAG,CAAC;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;AAMA,SAAS,cAAc,QAA0B,OAAmC;AAClF,aAAW,SAAS,QAAQ;AAC1B,QAAI,aAAa,OAAO,MAAM,EAAE,GAAG;AACjC;AAAA,QACE,uCAAuC,MAAM,EAAE;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAQO,SAAS,UAAU,QAAyD;AACjF,QAAM,QAAQ,WAAW,MAAM;AAC/B,gBAAc,QAAQ,KAAK;AAE3B,QAAM,OAAO,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAC7D,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,QAAmB,CAAC;AAE1B,SAAO,KAAK,OAAO,OAAO,QAAQ;AAChC,UAAM,OAAgB,CAAC;AACvB,eAAW,SAAS,QAAQ;AAC1B,UAAI,KAAK,IAAI,MAAM,EAAE,EAAG;AACxB,YAAM,QAAQ,MAAM,aAAa,CAAC,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC;AAClE,UAAI,KAAK,MAAM,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,EAAG,MAAK,KAAK,KAAK;AAAA,IACzD;AACA,QAAI,KAAK,WAAW,GAAG;AAErB;AAAA,QACE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,eAAW,SAAS,KAAM,MAAK,IAAI,MAAM,EAAE;AAC3C,UAAM,KAAK,IAAI;AAAA,EACjB;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,SAAO,UAAU,MAAM,EAAE,KAAK;AAChC;AAEO,SAAS,qBACd,QACA,UAA+B,CAAC,GAClB;AACd,MAAI,OAAO,WAAW,GAAG;AACvB,SAAK,kCAAkC,oDAAoD;AAAA,EAC7F;AACA,aAAW,SAAS,OAAQ,eAAc,KAAK;AAE/C,QAAM,eAAe,cAAc,MAAM;AACzC,OAAK,QAAQ,YAAY,YAAY,YAAY,aAAa,OAAO,GAAG;AACtE;AAAA,MACE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAAQ,iBAAiB,MAAM;AACrC,QAAM,WACJ,QAAQ,aAAa,YAAa,QAAQ,aAAa,UAAU,aAAa,SAAS,IACnF,WACA;AACN,SAAO,EAAE,UAAU,MAAM;AAC3B;AAEA,eAAsB,gBACpB,QACA,KACoC;AACpC,QAAM,OAAO,qBAAqB,QAAQ,EAAE,UAAU,SAAS,CAAC;AAChE,SAAO,QAAQ,IAAI,KAAK,MAAM,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC;AAC1D;AAOA,eAAsB,cACpB,QACA,KACoC;AACpC,aAAW,SAAS,OAAQ,eAAc,KAAK;AAC/C,QAAM,UAA4B,CAAC;AACnC,aAAW,QAAQ,UAAU,MAAM,GAAG;AACpC,UAAM,cAAc,MAAM,QAAQ,IAAI,KAAK,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,CAAC;AACrE,YAAQ,KAAK,GAAG,WAAW;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,WAAW,SAAwD;AACjF,SAAO;AAAA,IACL,kBAAkB,QAAQ,OAAO,CAAC,KAAK,WAAW,MAAM,OAAO,MAAM,aAAa,CAAC;AAAA,IACnF,mBAAmB,QAAQ,OAAO,CAAC,KAAK,WAAW,MAAM,OAAO,MAAM,cAAc,CAAC;AAAA,IACrF,sBAAsB,QAAQ;AAAA,MAC5B,CAAC,KAAK,WAAW,MAAM,OAAO,MAAM;AAAA,MACpC;AAAA,IACF;AAAA,IACA,eAAe,QAAQ,OAAO,CAAC,KAAK,WAAW,KAAK,IAAI,KAAK,OAAO,UAAU,GAAG,CAAC;AAAA,IAClF,WAAW,QAAQ;AAAA,EACrB;AACF;","names":[]}

package/dist/{chunk-MUF7ZZTO.js → chunk-R5HOSQUW.js}

@@ -18,6 +18,7 @@ var SandboxDelegationError = class extends Error {
     this.status = status;
     this.name = "SandboxDelegationError";
   }
+  status;
 };
 function createHttpSandbox(baseUrl, fetchImpl = fetch) {
   const endpoint = `${baseUrl.replace(/\/$/, "")}/api/v1/sandbox/exec`;
@@ -54,4 +55,4 @@ export {
   createHttpSandbox,
   assertSafePosture
 };
-//# sourceMappingURL=chunk-MUF7ZZTO.js.map
+//# sourceMappingURL=chunk-R5HOSQUW.js.map

package/dist/{chunk-MUF7ZZTO.js.map → chunk-R5HOSQUW.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/sandbox.ts"],"sourcesContent":["/**\n * External-sandbox delegation seam (PORT — capability #11).\n *\n * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant\n * web runtime NEVER executes untrusted code itself and introduces no isolation\n * infrastructure. It only:\n *   1. carries the capability policy (see ./policy),\n *   2. delegates execution to an external isolator behind this interface\n *      (a self-hosted kernel sidecar — Track B — or any other executor),\n *   3. records the outcome as a `command_execution` item (see ./model).\n *\n * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows\n * restricted token) are deliberately NOT ported — they are single-host and\n * out of scope for a multi-tenant web product.\n */\n\nimport type { CapabilityPolicy } from \"./policy\";\n\nexport interface SandboxExecRequest {\n  /** Mandatory tenant scope — every delegated exec is tenant-bound. */\n  readonly tenantId: string;\n  readonly threadId: string;\n  readonly command: string;\n  /** The capabilities the external isolator must honor. */\n  readonly capabilityPolicy: CapabilityPolicy;\n  /** Optional inputs the executor should materialize before running. */\n  readonly inputs?: Readonly<Record<string, string>>;\n}\n\nexport interface SandboxExecResult {\n  readonly exitCode: number;\n  readonly aggregatedOutput: string;\n  /** Identifier of the isolator that actually ran the command. */\n  readonly executedOn: string;\n}\n\n/**\n * The only thing Track A depends on for execution. Implemented by a decoupled\n * isolator over the ./protocol contract; never implemented in-process here.\n */\nexport interface ExternalSandbox {\n  exec(request: SandboxExecRequest): Promise<SandboxExecResult>;\n}\n\n/**\n * Fail-closed default. Wiring this in production requires a real\n * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.\n */\nexport class NoExecutorConfiguredError extends Error {\n  constructor() {\n    super(\n      \"No ExternalSandbox configured. This runtime never executes untrusted \" +\n        \"code in-process; delegate to a decoupled isolator (Track B).\",\n    );\n    this.name = \"NoExecutorConfiguredError\";\n  }\n}\n\nexport const REFUSING_SANDBOX: ExternalSandbox = {\n  async exec(): Promise<SandboxExecResult> {\n    throw new NoExecutorConfiguredError();\n  },\n};\n\nexport class SandboxDelegationError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n  ) {\n    super(message);\n    this.name = \"SandboxDelegationError\";\n  }\n}\n\n/**\n * The concrete Track-B coupling: delegate execution over HTTP to the decoupled\n * Rust isolator (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`). The\n * isolator is fail-closed; a non-2xx (e.g. 403 refusal) is surfaced as an\n * error and never coerced into a fabricated result.\n */\nexport function createHttpSandbox(\n  baseUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): ExternalSandbox {\n  const endpoint = `${baseUrl.replace(/\\/$/, \"\")}/api/v1/sandbox/exec`;\n  return {\n    async exec(request: SandboxExecRequest): Promise<SandboxExecResult> {\n      const response = await fetchImpl(endpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        body: JSON.stringify(request),\n      });\n      if (!response.ok) {\n        const detail = await response.text().catch(() => \"\");\n        throw new SandboxDelegationError(\n          `Isolator refused execution (${response.status}): ${detail}`,\n          response.status,\n        );\n      }\n      return (await response.json()) as SandboxExecResult;\n    },\n  };\n}\n\n/** Guard: reject the most dangerous posture unless explicitly opted in. */\nexport function assertSafePosture(policy: CapabilityPolicy, allowDanger = false): void {\n  if (policy.kind === \"danger_full_access\" && !allowDanger) {\n    throw new Error(\n      \"danger_full_access capability policy refused: not permitted for \" +\n        \"multi-tenant delegation without explicit opt-in.\",\n    );\n  }\n}\n"],"mappings":";AAgDO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,cAAc;AACZ;AAAA,MACE;AAAA,IAEF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAoC;AAAA,EAC/C,MAAM,OAAmC;AACvC,UAAM,IAAI,0BAA0B;AAAA,EACtC;AACF;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AACF;AAQO,SAAS,kBACd,SACA,YAA0B,OACT;AACjB,QAAM,WAAW,GAAG,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAC9C,SAAO;AAAA,IACL,MAAM,KAAK,SAAyD;AAClE,YAAM,WAAW,MAAM,UAAU,UAAU;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,SAAS,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACnD,cAAM,IAAI;AAAA,UACR,+BAA+B,SAAS,MAAM,MAAM,MAAM;AAAA,UAC1D,SAAS;AAAA,QACX;AAAA,MACF;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAGO,SAAS,kBAAkB,QAA0B,cAAc,OAAa;AACrF,MAAI,OAAO,SAAS,wBAAwB,CAAC,aAAa;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/sandbox.ts"],"sourcesContent":["/**\n * External-sandbox delegation seam (PORT — capability #11).\n *\n * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant\n * web runtime NEVER executes untrusted code itself and introduces no isolation\n * infrastructure. It only:\n *   1. carries the capability policy (see ./policy),\n *   2. delegates execution to an external isolator behind this interface\n *      (a self-hosted kernel sidecar — Track B — or any other executor),\n *   3. records the outcome as a `command_execution` item (see ./model).\n *\n * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows\n * restricted token) are deliberately NOT ported — they are single-host and\n * out of scope for a multi-tenant web product.\n */\n\nimport type { CapabilityPolicy } from \"./policy\";\n\nexport interface SandboxExecRequest {\n  /** Mandatory tenant scope — every delegated exec is tenant-bound. */\n  readonly tenantId: string;\n  readonly threadId: string;\n  readonly command: string;\n  /** The capabilities the external isolator must honor. */\n  readonly capabilityPolicy: CapabilityPolicy;\n  /** Optional inputs the executor should materialize before running. */\n  readonly inputs?: Readonly<Record<string, string>>;\n}\n\nexport interface SandboxExecResult {\n  readonly exitCode: number;\n  readonly aggregatedOutput: string;\n  /** Identifier of the isolator that actually ran the command. */\n  readonly executedOn: string;\n}\n\n/**\n * The only thing Track A depends on for execution. Implemented by a decoupled\n * isolator over the ./protocol contract; never implemented in-process here.\n */\nexport interface ExternalSandbox {\n  exec(request: SandboxExecRequest): Promise<SandboxExecResult>;\n}\n\n/**\n * Fail-closed default. Wiring this in production requires a real\n * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.\n */\nexport class NoExecutorConfiguredError extends Error {\n  constructor() {\n    super(\n      \"No ExternalSandbox configured. This runtime never executes untrusted \" +\n        \"code in-process; delegate to a decoupled isolator (Track B).\",\n    );\n    this.name = \"NoExecutorConfiguredError\";\n  }\n}\n\nexport const REFUSING_SANDBOX: ExternalSandbox = {\n  async exec(): Promise<SandboxExecResult> {\n    throw new NoExecutorConfiguredError();\n  },\n};\n\nexport class SandboxDelegationError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n  ) {\n    super(message);\n    this.name = \"SandboxDelegationError\";\n  }\n}\n\n/**\n * The concrete Track-B coupling: delegate execution over HTTP to the decoupled\n * Rust isolator (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`). The\n * isolator is fail-closed; a non-2xx (e.g. 403 refusal) is surfaced as an\n * error and never coerced into a fabricated result.\n */\nexport function createHttpSandbox(\n  baseUrl: string,\n  fetchImpl: typeof fetch = fetch,\n): ExternalSandbox {\n  const endpoint = `${baseUrl.replace(/\\/$/, \"\")}/api/v1/sandbox/exec`;\n  return {\n    async exec(request: SandboxExecRequest): Promise<SandboxExecResult> {\n      const response = await fetchImpl(endpoint, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        body: JSON.stringify(request),\n      });\n      if (!response.ok) {\n        const detail = await response.text().catch(() => \"\");\n        throw new SandboxDelegationError(\n          `Isolator refused execution (${response.status}): ${detail}`,\n          response.status,\n        );\n      }\n      return (await response.json()) as SandboxExecResult;\n    },\n  };\n}\n\n/** Guard: reject the most dangerous posture unless explicitly opted in. */\nexport function assertSafePosture(policy: CapabilityPolicy, allowDanger = false): void {\n  if (policy.kind === \"danger_full_access\" && !allowDanger) {\n    throw new Error(\n      \"danger_full_access capability policy refused: not permitted for \" +\n        \"multi-tenant delegation without explicit opt-in.\",\n    );\n  }\n}\n"],"mappings":";AAgDO,IAAM,4BAAN,cAAwC,MAAM;AAAA,EACnD,cAAc;AACZ;AAAA,MACE;AAAA,IAEF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAoC;AAAA,EAC/C,MAAM,OAAmC;AACvC,UAAM,IAAI,0BAA0B;AAAA,EACtC;AACF;AAEO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YACE,SACS,QACT;AACA,UAAM,OAAO;AAFJ;AAGT,SAAK,OAAO;AAAA,EACd;AAAA,EAJW;AAKb;AAQO,SAAS,kBACd,SACA,YAA0B,OACT;AACjB,QAAM,WAAW,GAAG,QAAQ,QAAQ,OAAO,EAAE,CAAC;AAC9C,SAAO;AAAA,IACL,MAAM,KAAK,SAAyD;AAClE,YAAM,WAAW,MAAM,UAAU,UAAU;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,MAC9B,CAAC;AACD,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,SAAS,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACnD,cAAM,IAAI;AAAA,UACR,+BAA+B,SAAS,MAAM,MAAM,MAAM;AAAA,UAC1D,SAAS;AAAA,QACX;AAAA,MACF;AACA,aAAQ,MAAM,SAAS,KAAK;AAAA,IAC9B;AAAA,EACF;AACF;AAGO,SAAS,kBAAkB,QAA0B,cAAc,OAAa;AACrF,MAAI,OAAO,SAAS,wBAAwB,CAAC,aAAa;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACF;","names":[]}

package/dist/{chunk-5N4644PB.js → chunk-SD2ZJ7XG.js}

@@ -1,9 +1,9 @@
-import {
-  isTurnTerminal
-} from "./chunk-6EGG2OZC.js";
 import {
   replay
 } from "./chunk-37BBB2P2.js";
+import {
+  isTurnTerminal
+} from "./chunk-6EGG2OZC.js";
 
 // src/durable-turn.ts
 import { z } from "zod";
@@ -64,4 +64,4 @@ function createDurableTurn(deps) {
 export {
   createDurableTurn
 };
-//# sourceMappingURL=chunk-5N4644PB.js.map
+//# sourceMappingURL=chunk-SD2ZJ7XG.js.map

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/cli.js

@@ -0,0 +1,52 @@
+// src/cli.ts
+import { readCapabilityDebug } from "@nebutra/capability-kit/debug";
+var command = process.argv[2] ?? "doctor";
+if (command === "doctor") {
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        capability: "agent-runtime",
+        ok: true,
+        checks: ["thread-turn-item", "rollout-store", "pulsar-facade", "subagent-briefs"]
+      },
+      null,
+      2
+    )}
+`
+  );
+} else if (command === "debug" || command === "replay") {
+  const threadId = process.argv[3];
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        capability: "agent-runtime",
+        threadId,
+        entries: await readCapabilityDebug("agent-runtime", { limit: 20 }),
+        suggestion: "Use a RolloutStore-backed host to replay full thread events; this CLI reports local debug lines."
+      },
+      null,
+      2
+    )}
+`
+  );
+} else if (command === "subagent-trace" || command === "subagent-cost") {
+  const threadId = process.argv[3];
+  process.stdout.write(
+    `${JSON.stringify(
+      {
+        capability: "agent-runtime",
+        command,
+        threadId,
+        entries: await readCapabilityDebug("agent-runtime", { limit: 20 })
+      },
+      null,
+      2
+    )}
+`
+  );
+} else {
+  process.stderr.write(`Unknown agent-runtime command: ${command}
+`);
+  process.exitCode = 1;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["import { readCapabilityDebug } from \"@nebutra/capability-kit/debug\";\n\nconst command = process.argv[2] ?? \"doctor\";\n\nif (command === \"doctor\") {\n  process.stdout.write(\n    `${JSON.stringify(\n      {\n        capability: \"agent-runtime\",\n        ok: true,\n        checks: [\"thread-turn-item\", \"rollout-store\", \"pulsar-facade\", \"subagent-briefs\"],\n      },\n      null,\n      2,\n    )}\\n`,\n  );\n} else if (command === \"debug\" || command === \"replay\") {\n  const threadId = process.argv[3];\n  process.stdout.write(\n    `${JSON.stringify(\n      {\n        capability: \"agent-runtime\",\n        threadId,\n        entries: await readCapabilityDebug(\"agent-runtime\", { limit: 20 }),\n        suggestion:\n          \"Use a RolloutStore-backed host to replay full thread events; this CLI reports local debug lines.\",\n      },\n      null,\n      2,\n    )}\\n`,\n  );\n} else if (command === \"subagent-trace\" || command === \"subagent-cost\") {\n  const threadId = process.argv[3];\n  process.stdout.write(\n    `${JSON.stringify(\n      {\n        capability: \"agent-runtime\",\n        command,\n        threadId,\n        entries: await readCapabilityDebug(\"agent-runtime\", { limit: 20 }),\n      },\n      null,\n      2,\n    )}\\n`,\n  );\n} else {\n  process.stderr.write(`Unknown agent-runtime command: ${command}\\n`);\n  process.exitCode = 1;\n}\n"],"mappings":";AAAA,SAAS,2BAA2B;AAEpC,IAAM,UAAU,QAAQ,KAAK,CAAC,KAAK;AAEnC,IAAI,YAAY,UAAU;AACxB,UAAQ,OAAO;AAAA,IACb,GAAG,KAAK;AAAA,MACN;AAAA,QACE,YAAY;AAAA,QACZ,IAAI;AAAA,QACJ,QAAQ,CAAC,oBAAoB,iBAAiB,iBAAiB,iBAAiB;AAAA,MAClF;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA;AAAA,EACH;AACF,WAAW,YAAY,WAAW,YAAY,UAAU;AACtD,QAAM,WAAW,QAAQ,KAAK,CAAC;AAC/B,UAAQ,OAAO;AAAA,IACb,GAAG,KAAK;AAAA,MACN;AAAA,QACE,YAAY;AAAA,QACZ;AAAA,QACA,SAAS,MAAM,oBAAoB,iBAAiB,EAAE,OAAO,GAAG,CAAC;AAAA,QACjE,YACE;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA;AAAA,EACH;AACF,WAAW,YAAY,oBAAoB,YAAY,iBAAiB;AACtE,QAAM,WAAW,QAAQ,KAAK,CAAC;AAC/B,UAAQ,OAAO;AAAA,IACb,GAAG,KAAK;AAAA,MACN;AAAA,QACE,YAAY;AAAA,QACZ;AAAA,QACA;AAAA,QACA,SAAS,MAAM,oBAAoB,iBAAiB,EAAE,OAAO,GAAG,CAAC;AAAA,MACnE;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA;AAAA,EACH;AACF,OAAO;AACL,UAAQ,OAAO,MAAM,kCAAkC,OAAO;AAAA,CAAI;AAClE,UAAQ,WAAW;AACrB;","names":[]}

package/dist/commands.js

@@ -3,6 +3,7 @@ import {
   expandCommand
 } from "./chunk-YYFPDBJG.js";
 import "./chunk-7BUOF367.js";
+import "./chunk-424PT5DM.js";
 export {
   CommandRegistry,
   expandCommand

package/dist/definitions.js

@@ -5,6 +5,7 @@ import {
   parseFrontmatter,
   substituteArguments
 } from "./chunk-7BUOF367.js";
+import "./chunk-424PT5DM.js";
 export {
   DefinitionResolver,
   SOURCE_TIERS,

package/dist/dispatcher.js

@@ -2,6 +2,7 @@ import {
   ProtocolDispatcher
 } from "./chunk-RDKYDMXT.js";
 import "./chunk-FUG5DT2C.js";
+import "./chunk-424PT5DM.js";
 export {
   ProtocolDispatcher
 };

package/dist/durable-turn.js

@@ -1,8 +1,9 @@
 import {
   createDurableTurn
-} from "./chunk-5N4644PB.js";
-import "./chunk-6EGG2OZC.js";
+} from "./chunk-SD2ZJ7XG.js";
 import "./chunk-37BBB2P2.js";
+import "./chunk-6EGG2OZC.js";
+import "./chunk-424PT5DM.js";
 export {
   createDurableTurn
 };

package/dist/hook-pipeline.js

@@ -4,6 +4,7 @@ import {
   onHookEvent,
   runHooks
 } from "./chunk-LO24VOA3.js";
+import "./chunk-424PT5DM.js";
 export {
   fromToolHooks,
   matchesMatcher,

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { BodyLoader, CommandRecord, CommandRegistry, ContentBlock, ExpandedCommand, expandCommand } from './commands.js';
 import { z } from 'zod';
+import { BaseTokenEstimator } from '@nebutra/ai-primitives';
 export { Definition, DefinitionResolver, Frontmatter, ResolveContext, SOURCE_TIERS, SourceTier, frontmatterSchema, parseFrontmatter, substituteArguments } from './definitions.js';
 export { JsonRpcResponse, MethodHandler, NotificationListener, ProtocolDispatcher } from './dispatcher.js';
 export { CreateDurableTurnDeps, DurableTurn, DurableTurnJob, DurableTurnQueuePort, DurableTurnRunner, TurnContext, createDurableTurn } from './durable-turn.js';
@@ -7,14 +8,17 @@ export { FunctionTransport, HookConfig, HookContext, HookEvent, HookExitResult,
 export { ApprovalGate, ModelEmission, ModelInvoker, ModelRoundRequest, ModelRoundResult, RuleEvaluator, RunTurnDeps, runTurn } from './loop.js';
 export { ActivateMcpToolsResult, McpServerCatalogPort, activateMcpTools } from './mcp-bridge.js';
 export { AgentMessageItem, CommandExecutionItem, ErrorItem, FileChangeItem, FileUpdateChange, McpToolCallItem, PatchApplyStatus, PatchChangeKind, ReasoningItem, RunStatus, ThreadError, ThreadEvent, ThreadEventType, ThreadItem, ThreadItemType, TodoEntry, TodoListItem, TurnConfig, TurnConfigOverrides, TurnUsage, WebSearchItem, isTurnTerminal, mergeTurnConfig } from './model.js';
+export { Brief, BudgetCap, DispatchPlan, DispatchPlanOptions, DispatchStrategy, ModelModality, NodeModelSpec, ReasoningEffort, SubagentCostReport, SubagentResult, costReport, fanOutSubagents, planSubagentDispatch, planWaves, runAgentWaves } from './orchestration.js';
+export * from '@nebutra/execution-policy';
 export { ApprovalPolicy, CapabilityPolicy, DEFAULT_APPROVAL_POLICY, DEFAULT_CAPABILITY_POLICY, DENIED, GranularApprovalConfig, NetworkPolicyAmendment, ReviewDecision, RuleAmendment, RuleDecision, WritableRoot, approvalPolicySchema, capabilityPolicySchema, granularApprovalConfigSchema, isApproval, resolveRuleDecision, writableRootSchema } from './policy.js';
 export { METHOD_REGISTRY, MethodName, MethodSpec, NOTIFICATIONS, NotificationName, RequestEnvelope, ScopeRule, SerializationScope, ServerRequest, requestEnvelopeSchema, resolveScope, scopeKey } from './protocol.js';
+export { Pulsar, PulsarBranchRecord, PulsarBuilder, PulsarDeps, PulsarEventInput, PulsarEventLogPort, PulsarThread, StartThreadOptions } from './pulsar.js';
 export { EventPersistenceMode, InMemoryRolloutStore, PERSISTED_OUTPUT_MAX_BYTES, RolloutLine, RolloutStore, ThreadProjection, isPersisted, replay, sanitizeForPersist } from './rollout.js';
 export { PersistentRolloutStore, RolloutPersistencePort, RoundTripError } from './rollout-store-persistent.js';
 export { ExternalSandbox, NoExecutorConfiguredError, REFUSING_SANDBOX, SandboxDelegationError, SandboxExecRequest, SandboxExecResult, assertSafePosture, createHttpSandbox } from './sandbox.js';
 export { ExpandContext, ExpandedSkill, SkillListing, SkillListingEntry, SkillListingOptions, SkillMessage, SkillRecord, buildSkillListing, expandSkill } from './skills.js';
 export { DeferredEnvelope, DispatchCtx, DispatchEnvelope, DispatchMode, PrepareDispatchInput, PreparedDispatch, SettleDeferredTarget, SubagentRecord, SyncEnvelope, TASK_KINDS, TASK_STATUSES, TaskKind, TaskRecord, TaskRegistry, TaskStatus, assertNotPeeking, makeDeferred, prepareDispatch, resolveSubagentTools, settleDeferred } from './subagents.js';
-export { McpClientLike, RegisteredTool, ToolDefinition, ToolDispatchContext, ToolHandler, ToolHooks, ToolOrigin, ToolRegistry, adaptMcpTool } from './tools.js';
+export { McpClientLike, RegisteredTool, RuntimeToolRegistry, ToolDefinition, ToolDispatchContext, ToolHandler, ToolHooks, ToolOrigin, RuntimeToolRegistry as ToolRegistry, adaptMcpTool } from './tools.js';
 
 /**
  * Streaming artifact/action protocol.
@@ -711,6 +715,7 @@ declare function generateCommitMessage(args: {
  * transcript plus the injected `summarize` and `base` estimator. The transcript
  * is never mutated; every transformation builds new arrays/strings.
  */
+
 /** Tokenizers undercount real BPE by ~15-30%; scale the base estimate up. */
 declare const TOKEN_CORRECTION = 1.3;
 /** Fraction of the usable window the recap is allowed to occupy. */
@@ -753,7 +758,7 @@ type Transcript = readonly Message[];
  */
 type Summarize = (prompt: string) => Promise<string>;
 /** Caller-injected cheap token heuristic; defaults to chars/4. */
-type BaseEstimator = (text: string) => number;
+type BaseEstimator = BaseTokenEstimator;
 /** The eligibility signal this module keys on (also the failure sentinel). */
 declare const COMPACT_SENTINEL = "compact";
 /**
@@ -1312,88 +1317,6 @@ declare class MemoryManager {
     shutdown(): Promise<void>;
 }
 
-/**
- * Permission ruleset evaluator.
- *
- * A small, pure, stateless re-expression of a two-dimensional wildcard
- * permission model plus a bash-command-prefix extractor. No global state,
- * no I/O, no mutation of inputs — every function is referentially transparent.
- *
- * The model has two independent dimensions per rule:
- *   - `permission` — the capability namespace (e.g. "bash", "edit", "net")
- *   - `pattern`    — the concrete subject within that namespace
- * A rule applies only when BOTH dimensions match the query via {@link wildcardMatch}.
- */
-/** The decision a rule yields. Unknown queries fail safe to "ask". */
-type Action = "allow" | "deny" | "ask";
-/** A single permission rule. Both dimensions are matched as wildcard globs. */
-interface Rule {
-    permission: string;
-    pattern: string;
-    action: Action;
-}
-/** An ordered list of rules. Earlier rules take precedence. */
-type Ruleset = Rule[];
-/**
- * Anchored full-string glob matcher.
- *
- * Semantics:
- *   - `*` matches any run of characters, including the empty run.
- *   - `?` matches exactly one character.
- *   - Every other character is matched literally (regex metacharacters in
- *     `pattern` carry no special meaning).
- *   - The match is anchored: the entire `str` must be consumed.
- *
- * Special rule (ported faithfully): if `pattern` ends with `" *"` (a single
- * space immediately followed by `*`), that trailing ` *` is OPTIONAL. The
- * pattern then matches both `"<head> <rest>"` and exactly `"<head>"` with
- * nothing after it. For example `"git *"` matches `"git"` and `"git status"`.
- *
- * Implemented with a backtracking two-pointer scan whose `*` handling uses a
- * single saved restart position, giving O(|str| * |pattern|) worst case with
- * no catastrophic blow-up.
- */
-declare function wildcardMatch(str: string, pattern: string): boolean;
-/**
- * Resolve a permission query against one or more rulesets.
- *
- * Rulesets are concatenated in argument order (no mutation) and scanned
- * front-to-back. The FIRST rule whose `permission` and `pattern` both match
- * the query (via {@link wildcardMatch}) is returned. If no rule matches, a
- * fail-safe default is returned: the queried permission/pattern with action
- * `"ask"` (unknown → ask, never silently allow).
- */
-declare function evaluate(permission: string, pattern: string, ...rulesets: Ruleset[]): Rule;
-/**
- * Built-in command arity table. Maps a (possibly multi-word) command prefix
- * to the number of leading tokens that constitute its "human-understandable
- * command" for permission matching. Longest matching prefix wins.
- *
- * Frozen so the shared default cannot be mutated by callers.
- */
-declare const BUILTIN_ARITY: Readonly<Record<string, number>>;
-/**
- * Extract the human-understandable command from already-split, flag-free
- * shell tokens.
- *
- * Strategy: try the longest prefix first. For `len` from `tokens.length` down
- * to 1, if `tokens.slice(0, len).join(" ")` is a key in the (merged) arity
- * table, return `tokens.slice(0, arity[thatPrefix])`. If the tokens are empty,
- * return `[]`. Otherwise default to the first token only.
- *
- * `arity` is shallow-merged OVER the built-in table; neither the caller's
- * object nor the built-in table is mutated.
- */
-declare function commandPrefix(tokens: string[], arity?: Record<string, number> | undefined): string[];
-/**
- * Derive the `pattern` to feed {@link evaluate} for a bash permission.
- *
- * Splits `command` on arbitrary whitespace, drops tokens that begin with `-`
- * (flags are not conceptually part of the command identity), applies
- * {@link commandPrefix}, and joins the result with single spaces.
- */
-declare function commandPermissionKey(command: string): string;
-
 /**
  * Git-backed project repository model.
  *
@@ -1871,4 +1794,4 @@ declare class InMemoryProjectStore implements ProjectPersistencePort {
     get(tenant: string, project: string): Promise<Project | undefined>;
 }
 
-export { type Action, type ActionEvent, type ActionPorts, ActionRunner, type ActionState, type ActionStatus, type AdmissionDeps, type AdmissionPolicy, type AdmissionReason, type AdmissionResult, type AllowlistMatch, type ApplyEditResult, type ArtifactEvent, type ArtifactStreamCallbacks, ArtifactStreamParser, BUDGET_RATIO, BUILTIN_ARITY, type BaseEstimator, type BuildAction, CLIP_TEXT_CHARS, CLIP_TOOL_CHARS, COMPACT_SENTINEL, CONCURRENCY, CONVERSATIONS_DIR, type ChannelAdapter, type ChannelCapabilities, ChannelGateway, type ChannelId, type ChannelMeta, ChannelRegistry, type ChatType, type Clock, CommitMessageError, type CommitRef, type CompactTranscriptInput, type CompiledAllowlist, type CompletionModel, type ConversationSummary, DEFAULT_ABORT_MS, DEFAULT_TEMPERATURE, type DataAction, type DebounceResult, type DeployState, type DeploymentCommitRef, type DeploymentRecord, type DeploymentState, DeploymentStateError, type DeploymentSummary, type DeploymentTimelineEntry, type DeploymentUiStatus, type DesignContext, type DiffFile, type DiffResult, type DistillOptions, type DistilledSkill, type DistilledSkillFrontmatter, type DistilledSkillProvenance, DuplicateChannelError, type EditBlock, type EditIntent, type EditMerger, EditType, type EligibilityOptions, type FileAction, type FileContext, type FileEntry, type FileInfo, type FileKind, type FileManifest, type FileMap, type FileMutationInput, type FuzzyMatch, type FuzzyMatchFn, type GenerateOptions, type GitContext, type GitHostPort, type GroupBinding, type Hunk, type IdMint, InMemoryProjectStore, InMemoryShareStore, InMemorySuggestionHistoryStore, type InboundAttachment, InboundDebouncer, type InboundLike, type InboundMessage, LARGE_SET, type LatestStatusInput, MAX_RETRIES, MEMORY_CONTEXT_BANNER_CLOSE, MEMORY_CONTEXT_BANNER_OPEN, METADATA_PATH, MIN_BUDGET, type MatchClassification, type MatchType, type MemoryContext, MemoryManager, type MemoryProvider, type MentionContext, type Message, type NudgeOptions, OUTPUT_TOKEN_CAP, type OutboundMessage, type OwnsRepoPredicate, type Part, type PlanAction, type Project, type ProjectDiff, type ProjectMetadata, type ProjectPersistencePort, ProjectRepo, type ProjectRepoDeps, ProjectRepoError, type ProjectRepoErrorCode, type ProjectSnapshot, REDUCE_DEPTH, type RankOptions, type RankedFuzzyResult, type RankedSuggestion, type RawScrapeResult, type ReplyOptions, type ReviewFinding, type ReviewModel, ReviewParseError, type ReviewScope, type Rule, type Ruleset, type RunQueueOptions, type ScrapeFormat, type ScrapeProvider, type SessionKeyOptions, type SessionRef, SessionShare, type SessionShareOptions, ShareDisabledError, type ShareRecord, type ShareStore, type ShareSyncEvent, type ShellAction, SnapshotHistory, type StartAction, StreamingContextScrubber, type SuggestionHistoryStore, type SuggestionItem, type SuggestionResults, type SuggestionType, type Summarize, type SyncSink, type Synthesizer, TOKEN_CORRECTION, type TenantContext, TenantMismatchError, type TextPart, type TimelineOpts, type ToolPart, type Trajectory, type TrajectoryStep, type Transcript, UnknownChannelError, type UrlBuilder, type ViewerVerdict, WorkbenchError, admitInbound, advanceState, analyzeEditIntent, appendJsonlLine, applyEditBlock, applyFileMutation, asChannelId, assertTenantContext, buildCommitPrompt, buildDistillationPrompt, buildEditInstructions, buildImprovementPrompt, buildMemoryContextBlock, buildReviewPrompt, classifyMatch, commandPermissionKey, commandPrefix, compactTranscript, compileAllowlist, computeBudget, constantTimeEquals, dedupeByText, deriveLatestStatus, deriveTimelineFromCommits, diffProjects, distillSkill, domainForCommit, emptyFileMap, emptyProjectMetadata, estimateTokens, evaluate, fallbackMerger, generateCommitMessage, getDeploymentStatus, getDeploymentTimeline, getFile, hasMention, historyCandidates, improveSkill, ingestDesignContext, isDistillable, kebab, listFiles, makeProject, matchIndices, matchIndicesCaseInsensitive, matchIndicesCaseInsensitiveIgnoreSpaces, matchWildcardPattern, matchWildcardPatternCaseInsensitive, matchesAllowlist, nextMode, normalizeScrapeResult, parseDiff, parseEditBlocks, parseFindings, parseJsonl, planEdit, rankByFuzzy, rankSuggestions, recordHistory, removeFile, renderClipped, replyTo, requiresMention, resolveBranchBase, resolveSessionKey, restore, runReview, sanitizeContext, selectFilesForEdit, setFile, shouldCompact, shouldNudgePersist, snapshot, split, stripFencedWrapper, stripFormatting, toGenerationSeed, unescapeEntities, wildcardMatch };
+export { type ActionEvent, type ActionPorts, ActionRunner, type ActionState, type ActionStatus, type AdmissionDeps, type AdmissionPolicy, type AdmissionReason, type AdmissionResult, type AllowlistMatch, type ApplyEditResult, type ArtifactEvent, type ArtifactStreamCallbacks, ArtifactStreamParser, BUDGET_RATIO, type BaseEstimator, type BuildAction, CLIP_TEXT_CHARS, CLIP_TOOL_CHARS, COMPACT_SENTINEL, CONCURRENCY, CONVERSATIONS_DIR, type ChannelAdapter, type ChannelCapabilities, ChannelGateway, type ChannelId, type ChannelMeta, ChannelRegistry, type ChatType, type Clock, CommitMessageError, type CommitRef, type CompactTranscriptInput, type CompiledAllowlist, type CompletionModel, type ConversationSummary, DEFAULT_ABORT_MS, DEFAULT_TEMPERATURE, type DataAction, type DebounceResult, type DeployState, type DeploymentCommitRef, type DeploymentRecord, type DeploymentState, DeploymentStateError, type DeploymentSummary, type DeploymentTimelineEntry, type DeploymentUiStatus, type DesignContext, type DiffFile, type DiffResult, type DistillOptions, type DistilledSkill, type DistilledSkillFrontmatter, type DistilledSkillProvenance, DuplicateChannelError, type EditBlock, type EditIntent, type EditMerger, EditType, type EligibilityOptions, type FileAction, type FileContext, type FileEntry, type FileInfo, type FileKind, type FileManifest, type FileMap, type FileMutationInput, type FuzzyMatch, type FuzzyMatchFn, type GenerateOptions, type GitContext, type GitHostPort, type GroupBinding, type Hunk, type IdMint, InMemoryProjectStore, InMemoryShareStore, InMemorySuggestionHistoryStore, type InboundAttachment, InboundDebouncer, type InboundLike, type InboundMessage, LARGE_SET, type LatestStatusInput, MAX_RETRIES, MEMORY_CONTEXT_BANNER_CLOSE, MEMORY_CONTEXT_BANNER_OPEN, METADATA_PATH, MIN_BUDGET, type MatchClassification, type MatchType, type MemoryContext, MemoryManager, type MemoryProvider, type MentionContext, type Message, type NudgeOptions, OUTPUT_TOKEN_CAP, type OutboundMessage, type OwnsRepoPredicate, type Part, type PlanAction, type Project, type ProjectDiff, type ProjectMetadata, type ProjectPersistencePort, ProjectRepo, type ProjectRepoDeps, ProjectRepoError, type ProjectRepoErrorCode, type ProjectSnapshot, REDUCE_DEPTH, type RankOptions, type RankedFuzzyResult, type RankedSuggestion, type RawScrapeResult, type ReplyOptions, type ReviewFinding, type ReviewModel, ReviewParseError, type ReviewScope, type RunQueueOptions, type ScrapeFormat, type ScrapeProvider, type SessionKeyOptions, type SessionRef, SessionShare, type SessionShareOptions, ShareDisabledError, type ShareRecord, type ShareStore, type ShareSyncEvent, type ShellAction, SnapshotHistory, type StartAction, StreamingContextScrubber, type SuggestionHistoryStore, type SuggestionItem, type SuggestionResults, type SuggestionType, type Summarize, type SyncSink, type Synthesizer, TOKEN_CORRECTION, type TenantContext, TenantMismatchError, type TextPart, type TimelineOpts, type ToolPart, type Trajectory, type TrajectoryStep, type Transcript, UnknownChannelError, type UrlBuilder, type ViewerVerdict, WorkbenchError, admitInbound, advanceState, analyzeEditIntent, appendJsonlLine, applyEditBlock, applyFileMutation, asChannelId, assertTenantContext, buildCommitPrompt, buildDistillationPrompt, buildEditInstructions, buildImprovementPrompt, buildMemoryContextBlock, buildReviewPrompt, classifyMatch, compactTranscript, compileAllowlist, computeBudget, constantTimeEquals, dedupeByText, deriveLatestStatus, deriveTimelineFromCommits, diffProjects, distillSkill, domainForCommit, emptyFileMap, emptyProjectMetadata, estimateTokens, fallbackMerger, generateCommitMessage, getDeploymentStatus, getDeploymentTimeline, getFile, hasMention, historyCandidates, improveSkill, ingestDesignContext, isDistillable, kebab, listFiles, makeProject, matchIndices, matchIndicesCaseInsensitive, matchIndicesCaseInsensitiveIgnoreSpaces, matchWildcardPattern, matchWildcardPatternCaseInsensitive, matchesAllowlist, nextMode, normalizeScrapeResult, parseDiff, parseEditBlocks, parseFindings, parseJsonl, planEdit, rankByFuzzy, rankSuggestions, recordHistory, removeFile, renderClipped, replyTo, requiresMention, resolveBranchBase, resolveSessionKey, restore, runReview, sanitizeContext, selectFilesForEdit, setFile, shouldCompact, shouldNudgePersist, snapshot, split, stripFencedWrapper, stripFormatting, toGenerationSeed, unescapeEntities };