@nebutra/agent-runtime 0.2.0

package/dist/loop.d.ts

@@ -0,0 +1,78 @@
+import { TurnConfig, TurnUsage, ThreadEvent } from './model.js';
+import { ReviewDecision, RuleDecision, ApprovalPolicy } from './policy.js';
+import { ServerRequest } from './protocol.js';
+import { RolloutStore } from './rollout.js';
+import { ToolRegistry } from './tools.js';
+import 'zod';
+
+/**
+ * Agent loop runner (WRAP — the turn engine).
+ *
+ * Faithful re-expression of the upstream loop: a turn is
+ * `loop { model_call → emit items → execute tools → feed results back }`
+ * until the model stops requesting tools or a bounded step ceiling is hit.
+ * Single-threaded (Cognition teaching: shared context, no conflicting
+ * sub-agent decisions). Every item is appended to the tenant-scoped rollout
+ * as it reaches a terminal state, so the turn is resumable by replay.
+ *
+ * The model call is abstracted behind {@link ModelInvoker} so this WRAPs an
+ * existing model stack (e.g. `@nebutra/agents`) rather than re-porting
+ * provider/routing/fallback. No untrusted code runs here — command items are
+ * dispatched through the tool registry / external-sandbox seam.
+ */
+
+/** A single thing the model emitted in one round. */
+type ModelEmission = {
+    readonly kind: "text";
+    readonly text: string;
+} | {
+    readonly kind: "tool_call";
+    readonly id: string;
+    readonly name: string;
+    readonly args: unknown;
+};
+interface ModelRoundResult {
+    readonly emissions: readonly ModelEmission[];
+    readonly usage?: Partial<TurnUsage>;
+}
+interface ModelRoundRequest {
+    readonly config: TurnConfig;
+    /** Running transcript: user input, agent text, and tool results. */
+    readonly history: readonly {
+        readonly role: string;
+        readonly content: string;
+    }[];
+    readonly toolNames: readonly string[];
+}
+/** Abstracts the model stack — implement over `@nebutra/agents`, etc. */
+interface ModelInvoker {
+    invoke(request: ModelRoundRequest): Promise<ModelRoundResult>;
+}
+/** Server-initiated approval transport (see {@link ServerRequest}). */
+interface ApprovalGate {
+    request(serverRequest: ServerRequest): Promise<ReviewDecision>;
+}
+/** Classifies a tool call into a static rule decision before approval. */
+type RuleEvaluator = (toolName: string, args: unknown) => RuleDecision;
+interface RunTurnDeps {
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly config: TurnConfig;
+    readonly approvalPolicy: ApprovalPolicy;
+    readonly model: ModelInvoker;
+    readonly tools: ToolRegistry;
+    readonly store: RolloutStore;
+    readonly approvalGate: ApprovalGate;
+    /** Defaults to: everything requires a prompt (safe). */
+    readonly ruleEvaluator?: RuleEvaluator;
+    /** Bounded steps (parity with upstream step ceiling). Default 20. */
+    readonly maxSteps?: number;
+}
+/**
+ * Drive one turn to completion. Yields the {@link ThreadEvent} stream and
+ * appends each terminal item + the turn outcome to the rollout store.
+ * Never throws to the caller — failures surface as a `turn.failed` event.
+ */
+declare function runTurn(userInput: string, deps: RunTurnDeps): AsyncGenerator<ThreadEvent>;
+
+export { type ApprovalGate, type ModelEmission, type ModelInvoker, type ModelRoundRequest, type ModelRoundResult, type RuleEvaluator, type RunTurnDeps, runTurn };

package/dist/loop.js

@@ -0,0 +1,9 @@
+import {
+  runTurn
+} from "./chunk-BJBBR3QA.js";
+import "./chunk-CGRCUKGT.js";
+import "./chunk-37BBB2P2.js";
+export {
+  runTurn
+};
+//# sourceMappingURL=loop.js.map

package/dist/loop.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/mcp-bridge.d.ts

@@ -0,0 +1,48 @@
+import { ToolDefinition, ToolRegistry, McpClientLike } from './tools.js';
+import 'zod';
+
+/**
+ * MCP activation bridge (WRAP — capability #9, activation seam).
+ *
+ * Concrete bridge that registers external MCP-server tools into the runtime's
+ * uniform tool model. It does NOT import `@nebutra/mcp` (WIP / do-not-import):
+ * instead it defines minimal injectable ports so callers wire `@nebutra/mcp`
+ * (`serverRegistry` + `mcpClient`) without this package taking a hard dep.
+ *
+ * Tenant-scoped by construction: the catalog port is always queried with the
+ * caller's `{ tenantId, plan }`, so a tenant only ever sees its own MCP
+ * servers/tools. Fail-closed on missing tenant.
+ */
+
+/**
+ * Port over an MCP server catalog (satisfied by `@nebutra/mcp`'s
+ * `serverRegistry` + plan middleware). Returns only the tools visible to the
+ * given tenant/plan — visibility/plan-gating is the port's responsibility.
+ */
+interface McpServerCatalogPort {
+    listTools(ctx: {
+        tenantId: string;
+        plan?: string;
+    }): Promise<{
+        server: string;
+        definition: ToolDefinition;
+    }[]>;
+}
+interface ActivateMcpToolsResult {
+    /** Tool names newly registered into the registry, in catalog order. */
+    readonly registered: readonly string[];
+    /** Tool names skipped because the name was already registered. */
+    readonly skipped: readonly string[];
+}
+/**
+ * List the tenant/plan-visible MCP tools, adapt each via {@link adaptMcpTool},
+ * and register them into the {@link ToolRegistry}. A tool whose name is already
+ * registered is skipped (reported, never thrown). Empty/blank tenantId fails
+ * closed before any catalog call.
+ */
+declare function activateMcpTools(registry: ToolRegistry, catalog: McpServerCatalogPort, client: McpClientLike, ctx: {
+    tenantId: string;
+    plan?: string;
+}): Promise<ActivateMcpToolsResult>;
+
+export { type ActivateMcpToolsResult, type McpServerCatalogPort, activateMcpTools };

package/dist/mcp-bridge.js

@@ -0,0 +1,8 @@
+import {
+  activateMcpTools
+} from "./chunk-PGGWSUTM.js";
+import "./chunk-NN7DATXA.js";
+export {
+  activateMcpTools
+};
+//# sourceMappingURL=mcp-bridge.js.map

package/dist/mcp-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/model.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Thread / Turn / Item model + event lifecycle (WRAP — capability #6).
+ *
+ * Faithful re-expression of the upstream agent-runtime item taxonomy and event
+ * stream (generated TS types in the source SDK, themselves derived from the
+ * Rust `exec_events` definitions). Renamed to neutral domain terms and made
+ * tenant-scoped. No enforcement here — pure data + state machine.
+ *
+ * Hierarchy: Thread -> Turn -> Item.
+ *   Thread : a durable, tenant-scoped conversation (resumable by replay).
+ *   Turn   : one user-input -> model-completion cycle.
+ *   Item   : the atomic recorded unit inside a turn.
+ */
+/** Lifecycle of a stateful item that runs over time. */
+type RunStatus = "in_progress" | "completed" | "failed";
+/** Terminal status for an applied patch (no `in_progress` terminal form). */
+type PatchApplyStatus = "completed" | "failed";
+/** Kind of a single file mutation within a patch. */
+type PatchChangeKind = "add" | "delete" | "update";
+interface FileUpdateChange {
+    readonly path: string;
+    readonly kind: PatchChangeKind;
+}
+interface ItemBase {
+    /** Stable identifier, unique within the owning thread. */
+    readonly id: string;
+}
+/** Natural-language (or structured-JSON) response from the agent. */
+interface AgentMessageItem extends ItemBase {
+    readonly type: "agent_message";
+    readonly text: string;
+}
+/** The agent's reasoning summary. */
+interface ReasoningItem extends ItemBase {
+    readonly type: "reasoning";
+    readonly text: string;
+}
+/**
+ * A command the agent asked to run. The runtime itself never executes it —
+ * see {@link ./sandbox} for the external-sandbox delegation seam.
+ */
+interface CommandExecutionItem extends ItemBase {
+    readonly type: "command_execution";
+    readonly command: string;
+    /** Aggregated stdout+stderr captured by the external executor. */
+    readonly aggregatedOutput: string;
+    /** Present once the command exits. */
+    readonly exitCode?: number;
+    readonly status: RunStatus;
+}
+/** A patch produced by the agent. Emitted once it succeeds or fails. */
+interface FileChangeItem extends ItemBase {
+    readonly type: "file_change";
+    readonly changes: readonly FileUpdateChange[];
+    readonly status: PatchApplyStatus;
+}
+/** A call to a tool exposed via an MCP server. */
+interface McpToolCallItem extends ItemBase {
+    readonly type: "mcp_tool_call";
+    readonly server: string;
+    readonly tool: string;
+    readonly arguments: unknown;
+    readonly result?: {
+        readonly content: unknown;
+        readonly structuredContent?: unknown;
+    };
+    readonly error?: {
+        readonly message: string;
+    };
+    readonly status: RunStatus;
+}
+/** A web-search request issued by the agent. */
+interface WebSearchItem extends ItemBase {
+    readonly type: "web_search";
+    readonly query: string;
+}
+interface TodoEntry {
+    readonly text: string;
+    readonly completed: boolean;
+}
+/** The agent's running to-do list for the turn. */
+interface TodoListItem extends ItemBase {
+    readonly type: "todo_list";
+    readonly items: readonly TodoEntry[];
+}
+/** A non-fatal error surfaced as an item (the turn may continue). */
+interface ErrorItem extends ItemBase {
+    readonly type: "error";
+    readonly message: string;
+}
+/** Canonical closed union of thread items. */
+type ThreadItem = AgentMessageItem | ReasoningItem | CommandExecutionItem | FileChangeItem | McpToolCallItem | WebSearchItem | TodoListItem | ErrorItem;
+type ThreadItemType = ThreadItem["type"];
+/** Token accounting for a completed turn. */
+interface TurnUsage {
+    readonly inputTokens: number;
+    readonly cachedInputTokens: number;
+    readonly outputTokens: number;
+    readonly reasoningOutputTokens: number;
+}
+/** Fatal error payload emitted by the stream. */
+interface ThreadError {
+    readonly message: string;
+}
+/**
+ * Event lifecycle observed by a client:
+ *   thread.started -> turn.started -> (item.started -> item.updated* ->
+ *   item.completed)* -> turn.completed | turn.failed, with a terminal `error`.
+ */
+type ThreadEvent = {
+    readonly type: "thread.started";
+    readonly threadId: string;
+} | {
+    readonly type: "turn.started";
+} | {
+    readonly type: "turn.completed";
+    readonly usage: TurnUsage;
+} | {
+    readonly type: "turn.failed";
+    readonly error: ThreadError;
+} | {
+    readonly type: "item.started";
+    readonly item: ThreadItem;
+} | {
+    readonly type: "item.updated";
+    readonly item: ThreadItem;
+} | {
+    readonly type: "item.completed";
+    readonly item: ThreadItem;
+} | {
+    readonly type: "error";
+    readonly message: string;
+};
+type ThreadEventType = ThreadEvent["type"];
+/**
+ * Per-turn config snapshot. Immutable within a turn; rebindable between turns.
+ * Tenant defaults are merged with per-request overrides via {@link mergeTurnConfig}.
+ */
+interface TurnConfig {
+    readonly model: string;
+    readonly provider: string;
+    /** Stringly-typed approval-policy tag — see {@link ./policy}. */
+    readonly approvalPolicy: string;
+    /** Stringly-typed capability-policy tag — see {@link ./policy}. */
+    readonly capabilityPolicy: string;
+    readonly reasoningEffort?: "low" | "medium" | "high";
+}
+type TurnConfigOverrides = Partial<TurnConfig>;
+/** Freeze a tenant-default config against per-turn overrides. */
+declare function mergeTurnConfig(base: TurnConfig, overrides?: TurnConfigOverrides): TurnConfig;
+/** Whether an event is a terminal turn outcome. */
+declare function isTurnTerminal(event: ThreadEvent): boolean;
+
+export { type AgentMessageItem, type CommandExecutionItem, type ErrorItem, type FileChangeItem, type FileUpdateChange, type McpToolCallItem, type PatchApplyStatus, type PatchChangeKind, type ReasoningItem, type RunStatus, type ThreadError, type ThreadEvent, type ThreadEventType, type ThreadItem, type ThreadItemType, type TodoEntry, type TodoListItem, type TurnConfig, type TurnConfigOverrides, type TurnUsage, type WebSearchItem, isTurnTerminal, mergeTurnConfig };

package/dist/model.js

@@ -0,0 +1,9 @@
+import {
+  isTurnTerminal,
+  mergeTurnConfig
+} from "./chunk-6EGG2OZC.js";
+export {
+  isTurnTerminal,
+  mergeTurnConfig
+};
+//# sourceMappingURL=model.js.map

package/dist/model.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/policy.d.ts

@@ -0,0 +1,130 @@
+import { z } from 'zod';
+
+/**
+ * Approval + capability policy (WRAP — capability #8).
+ *
+ * Faithful re-expression of the upstream two orthogonal axes:
+ *   1. Approval policy  — *when* to ask a human (AskForApproval).
+ *   2. Capability policy — *what* an external executor is permitted to do
+ *      (SandboxPolicy). Policy/semantics only; enforcement is out of scope
+ *      and lives behind the external-sandbox seam (see ./sandbox).
+ *
+ * Plus the static rule decision (execpolicy `Decision`) and the human's rich
+ * answer (`ReviewDecision`). Built on `@nebutra/permissions` for *who may
+ * approve*; this module models *what tier / what answer*.
+ */
+
+/** Fine-grained per-category gates. `false` = auto-reject (not auto-ask). */
+declare const granularApprovalConfigSchema: z.ZodObject<{
+    sandboxApproval: z.ZodBoolean;
+    rules: z.ZodBoolean;
+    skillApproval: z.ZodDefault<z.ZodBoolean>;
+    requestPermissions: z.ZodDefault<z.ZodBoolean>;
+    mcpElicitations: z.ZodBoolean;
+}, z.core.$strip>;
+type GranularApprovalConfig = z.infer<typeof granularApprovalConfigSchema>;
+/**
+ * Approval tier.
+ *  - `unless_trusted` : only known-safe read-only ops auto-approved; else ask.
+ *  - `on_failure`     : DEPRECATED — auto-run sandboxed, escalate on failure.
+ *  - `on_request`     : the model decides when to ask (default).
+ *  - `granular`       : per-category booleans.
+ *  - `never`          : failures returned to the model, never escalated.
+ */
+declare const approvalPolicySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"unless_trusted">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"on_failure">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"on_request">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"granular">;
+    config: z.ZodObject<{
+        sandboxApproval: z.ZodBoolean;
+        rules: z.ZodBoolean;
+        skillApproval: z.ZodDefault<z.ZodBoolean>;
+        requestPermissions: z.ZodDefault<z.ZodBoolean>;
+        mcpElicitations: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"never">;
+}, z.core.$strip>], "kind">;
+type ApprovalPolicy = z.infer<typeof approvalPolicySchema>;
+declare const DEFAULT_APPROVAL_POLICY: ApprovalPolicy;
+/** A writable root with read-only sub-paths and escalation-protected names. */
+declare const writableRootSchema: z.ZodObject<{
+    root: z.ZodString;
+    readOnlySubpaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    protectedMetadataNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type WritableRoot = z.infer<typeof writableRootSchema>;
+/**
+ * Capability policy — a vocabulary of *capabilities*, not OS mechanisms.
+ * Per the dual-track governance decision, `external_sandbox` is the default
+ * posture: this runtime never enforces isolation itself.
+ */
+declare const capabilityPolicySchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"danger_full_access">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"read_only">;
+    networkAccess: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"external_sandbox">;
+    networkAccess: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"workspace_write">;
+    writableRoots: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        root: z.ZodString;
+        readOnlySubpaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        protectedMetadataNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
+    networkAccess: z.ZodDefault<z.ZodBoolean>;
+    excludeTmpdir: z.ZodDefault<z.ZodBoolean>;
+    excludeSlashTmp: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>], "kind">;
+type CapabilityPolicy = z.infer<typeof capabilityPolicySchema>;
+/** Default posture for a multi-tenant web runtime (governance: ExternalSandbox). */
+declare const DEFAULT_CAPABILITY_POLICY: CapabilityPolicy;
+/** Classification of a command *before* approval. */
+type RuleDecision = "allow" | "prompt" | "forbidden";
+/** A session-scoped amendment that remembers an allowed command prefix. */
+interface RuleAmendment {
+    readonly allowPrefix: readonly string[];
+}
+/** Persist allow/deny for future requests to the same host. */
+interface NetworkPolicyAmendment {
+    readonly host: string;
+    readonly effect: "allow" | "deny";
+}
+/**
+ * The reviewer's rich answer. Mirrors upstream `ReviewDecision`; `denied`
+ * is the safe default.
+ */
+type ReviewDecision = {
+    readonly kind: "approved";
+} | {
+    readonly kind: "approved_rule_amendment";
+    readonly amendment: RuleAmendment;
+} | {
+    readonly kind: "approved_for_session";
+} | {
+    readonly kind: "network_policy_amendment";
+    readonly amendment: NetworkPolicyAmendment;
+} | {
+    readonly kind: "denied";
+} | {
+    readonly kind: "timed_out";
+} | {
+    readonly kind: "abort";
+};
+declare const DENIED: ReviewDecision;
+/** Whether a decision permits the action to proceed. */
+declare function isApproval(decision: ReviewDecision): boolean;
+/**
+ * Resolve a static rule decision against an approval policy into whether the
+ * action proceeds without a human, must be asked, or is auto-rejected.
+ * Pure; the actual prompting/escalation transport lives in ./protocol.
+ */
+declare function resolveRuleDecision(rule: RuleDecision, policy: ApprovalPolicy): "auto_allow" | "ask_human" | "auto_reject";
+
+export { type ApprovalPolicy, type CapabilityPolicy, DEFAULT_APPROVAL_POLICY, DEFAULT_CAPABILITY_POLICY, DENIED, type GranularApprovalConfig, type NetworkPolicyAmendment, type ReviewDecision, type RuleAmendment, type RuleDecision, type WritableRoot, approvalPolicySchema, capabilityPolicySchema, granularApprovalConfigSchema, isApproval, resolveRuleDecision, writableRootSchema };

package/dist/policy.js

@@ -0,0 +1,23 @@
+import {
+  DEFAULT_APPROVAL_POLICY,
+  DEFAULT_CAPABILITY_POLICY,
+  DENIED,
+  approvalPolicySchema,
+  capabilityPolicySchema,
+  granularApprovalConfigSchema,
+  isApproval,
+  resolveRuleDecision,
+  writableRootSchema
+} from "./chunk-CGRCUKGT.js";
+export {
+  DEFAULT_APPROVAL_POLICY,
+  DEFAULT_CAPABILITY_POLICY,
+  DENIED,
+  approvalPolicySchema,
+  capabilityPolicySchema,
+  granularApprovalConfigSchema,
+  isApproval,
+  resolveRuleDecision,
+  writableRootSchema
+};
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/protocol.d.ts

@@ -0,0 +1,170 @@
+import { z } from 'zod';
+
+/**
+ * App-server protocol contract (WRAP — capability #5).
+ *
+ * Faithful re-expression of the upstream JSON-RPC method registry, the
+ * serialization-scope concurrency model, server-initiated approval requests,
+ * and the notification event stream.
+ *
+ * Multi-tenant adaptation (non-negotiable): every serialization scope is
+ * additionally keyed by `tenantId`. Upstream `Thread { thread_id }` becomes
+ * `{ tenantId, threadId }` — natural per-tenant ordering + isolation for free.
+ * This is the only coupling seam to an optional decoupled kernel sidecar
+ * (Track B); transport (WS/SSE/stdio) is pluggable and not defined here.
+ */
+
+/**
+ * Requests sharing a scope are serialized; distinct scopes run in parallel.
+ * `tenantId` is mandatory on every scope — cross-tenant requests can never
+ * share a scope.
+ */
+type SerializationScope = {
+    readonly tenantId: string;
+    readonly kind: "none";
+} | {
+    readonly tenantId: string;
+    readonly kind: "global";
+    readonly key: string;
+} | {
+    readonly tenantId: string;
+    readonly kind: "global_shared_read";
+    readonly key: string;
+} | {
+    readonly tenantId: string;
+    readonly kind: "thread";
+    readonly threadId: string;
+} | {
+    readonly tenantId: string;
+    readonly kind: "command_exec";
+    readonly processId: string;
+} | {
+    readonly tenantId: string;
+    readonly kind: "mcp_oauth";
+    readonly server: string;
+};
+/** Stable string key used to coalesce requests into the same serial lane. */
+declare function scopeKey(scope: SerializationScope): string;
+/** How a method's scope is derived from its params. */
+type ScopeRule = {
+    readonly kind: "none";
+} | {
+    readonly kind: "global";
+    readonly key: string;
+} | {
+    readonly kind: "thread";
+};
+interface MethodSpec {
+    /** Namespaced `domain/verb` wire name. */
+    readonly method: string;
+    readonly scope: ScopeRule;
+    readonly experimental?: boolean;
+}
+/**
+ * The faithful subset of the upstream registry relevant to a multi-tenant web
+ * product. `thread`-scoped methods derive `{ tenantId, threadId }`.
+ */
+declare const METHOD_REGISTRY: {
+    readonly initialize: {
+        readonly method: "initialize";
+        readonly scope: {
+            readonly kind: "none";
+        };
+    };
+    readonly threadStart: {
+        readonly method: "thread/start";
+        readonly scope: {
+            readonly kind: "none";
+        };
+    };
+    readonly threadResume: {
+        readonly method: "thread/resume";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly threadFork: {
+        readonly method: "thread/fork";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly threadArchive: {
+        readonly method: "thread/archive";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly threadCompactStart: {
+        readonly method: "thread/compact/start";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly threadRollback: {
+        readonly method: "thread/rollback";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly turnStart: {
+        readonly method: "turn/start";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly turnSteer: {
+        readonly method: "turn/steer";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly turnInterrupt: {
+        readonly method: "turn/interrupt";
+        readonly scope: {
+            readonly kind: "thread";
+        };
+    };
+    readonly modelList: {
+        readonly method: "model/list";
+        readonly scope: {
+            readonly kind: "none";
+        };
+    };
+};
+type MethodName = (typeof METHOD_REGISTRY)[keyof typeof METHOD_REGISTRY]["method"];
+/** Resolve a method's runtime scope from tenant + params. */
+declare function resolveScope(spec: MethodSpec, tenantId: string, params: {
+    threadId?: string;
+}): SerializationScope;
+/** Approvals are server-initiated RPC, not side channels. */
+type ServerRequest = {
+    readonly type: "command_execution.request_approval";
+    readonly requestId: string;
+    readonly command: string;
+} | {
+    readonly type: "file_change.request_approval";
+    readonly requestId: string;
+    readonly paths: readonly string[];
+} | {
+    readonly type: "permissions.request_approval";
+    readonly requestId: string;
+    readonly summary: string;
+} | {
+    readonly type: "mcp.elicitation";
+    readonly requestId: string;
+    readonly server: string;
+    readonly schema: unknown;
+};
+declare const NOTIFICATIONS: readonly ["thread/started", "turn/started", "turn/completed", "turn/failed", "item/started", "item/updated", "item/completed", "model/rerouted", "thread/compacted"];
+type NotificationName = (typeof NOTIFICATIONS)[number];
+declare const requestEnvelopeSchema: z.ZodObject<{
+    jsonrpc: z.ZodLiteral<"2.0">;
+    id: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+    method: z.ZodString;
+    tenantId: z.ZodString;
+    params: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strip>;
+type RequestEnvelope = z.infer<typeof requestEnvelopeSchema>;
+
+export { METHOD_REGISTRY, type MethodName, type MethodSpec, NOTIFICATIONS, type NotificationName, type RequestEnvelope, type ScopeRule, type SerializationScope, type ServerRequest, requestEnvelopeSchema, resolveScope, scopeKey };

package/dist/protocol.js

@@ -0,0 +1,15 @@
+import {
+  METHOD_REGISTRY,
+  NOTIFICATIONS,
+  requestEnvelopeSchema,
+  resolveScope,
+  scopeKey
+} from "./chunk-FUG5DT2C.js";
+export {
+  METHOD_REGISTRY,
+  NOTIFICATIONS,
+  requestEnvelopeSchema,
+  resolveScope,
+  scopeKey
+};
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}