@nebutra/agent-runtime 0.2.0

package/dist/chunk-ZTSKS42I.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapters/dispatcher-sse.ts"],"sourcesContent":["/**\n * Runtime-agnostic SSE / HTTP transport binding for `ProtocolDispatcher`.\n *\n * Built on Web-standard primitives ONLY — `Request`, `Response`,\n * `ReadableStream`, `TextEncoder`, `AbortSignal`. There is no Hono / Express /\n * `node:http` dependency, so the same code runs unchanged on edge runtimes,\n * Cloudflare Workers, Deno, Bun, and Node (>=18, where these globals exist).\n *\n * Design goals:\n *  - Pure functions returning Web objects; nothing is mutated in place.\n *  - The dispatcher already fails closed on a missing `tenantId` (its\n *    `requestEnvelopeSchema` makes `tenantId` mandatory). This binding does\n *    not re-implement that policy — it faithfully relays the JSON-RPC error.\n *  - Never throw across the transport boundary and never leak a stack trace:\n *    a malformed body becomes a well-formed JSON-RPC parse error.\n *\n * Wire framing (SSE): each event is emitted as\n *   `event: <ThreadEvent.type>\\n` + `data: <JSON(event)>\\n\\n`\n */\n\nimport type { ProtocolDispatcher } from \"../dispatcher\";\nimport type { ThreadEvent } from \"../model\";\nimport type { NotificationName } from \"../protocol\";\n\n// ── JSON-RPC constants ───────────────────────────────────────────────────────\n\n/** Spec code for \"Parse error\" — the request body was not valid JSON. */\nconst ERR_PARSE = -32700;\n\nconst JSON_HEADERS: Readonly<Record<string, string>> = {\n  \"content-type\": \"application/json; charset=utf-8\",\n};\n\n/** A self-contained JSON-RPC failure envelope (used only for parse errors;\n *  every other failure path is produced by the dispatcher itself). */\nfunction parseErrorEnvelope(message: string): {\n  readonly jsonrpc: \"2.0\";\n  readonly id: null;\n  readonly error: { readonly code: number; readonly message: string };\n} {\n  return { jsonrpc: \"2.0\", id: null, error: { code: ERR_PARSE, message } };\n}\n\nfunction jsonResponse(payload: unknown, status: number): Response {\n  return new Response(JSON.stringify(payload), { status, headers: { ...JSON_HEADERS } });\n}\n\n// ── HTTP / JSON-RPC handler ──────────────────────────────────────────────────\n\n/**\n * Build a Web-standard request handler bound to a dispatcher.\n *\n * Contract:\n *  - Unparseable body → `400` with a JSON-RPC parse-error envelope.\n *  - Any parseable body (incl. missing tenant / unknown method / handler\n *    failure) → `200` with the dispatcher's own JSON-RPC envelope. The HTTP\n *    layer stays `200` for business-level JSON-RPC errors per JSON-RPC-over-\n *    HTTP convention; the error lives in the envelope, not the status line.\n *  - The returned function never throws and never emits a 500-with-stack.\n */\nexport function createRpcHandler(\n  dispatcher: ProtocolDispatcher,\n): (request: Request) => Promise<Response> {\n  return async (request: Request): Promise<Response> => {\n    let raw: unknown;\n    try {\n      raw = await request.json();\n    } catch {\n      return jsonResponse(parseErrorEnvelope(\"Request body is not valid JSON\"), 400);\n    }\n\n    // `dispatch` is documented to never throw; the try/catch is defence in\n    // depth so the transport boundary is total under any future change.\n    try {\n      const envelope = await dispatcher.dispatch(raw);\n      return jsonResponse(envelope, 200);\n    } catch {\n      return jsonResponse(parseErrorEnvelope(\"Dispatcher failure\"), 400);\n    }\n  };\n}\n\n// ── SSE streaming ────────────────────────────────────────────────────────────\n\nexport interface SseOptions {\n  /** Cancels the stream cleanly; closing the consumer also cancels it. */\n  readonly signal?: AbortSignal;\n}\n\n/** Encode one `ThreadEvent` as a single SSE frame. */\nfunction frame(event: ThreadEvent): string {\n  return `event: ${event.type}\\ndata: ${JSON.stringify(event)}\\n\\n`;\n}\n\n/** Encode a terminal transport-level error as an `event: error` SSE frame. */\nfunction errorFrame(message: string): string {\n  return `event: error\\ndata: ${JSON.stringify({ type: \"error\", message })}\\n\\n`;\n}\n\n/**\n * Adapt an async `ThreadEvent` stream into a Web-standard\n * `text/event-stream` `Response`.\n *\n * Guarantees:\n *  - Incremental flush: each event is enqueued as soon as it is produced.\n *  - Clean termination: the stream closes when the iterable is exhausted.\n *  - Error surfacing: an iterable error is emitted as a final\n *    `event: error` frame, then the stream closes (it never hangs).\n *  - Cancellation: an aborted `signal` (or a cancelled reader) stops\n *    pulling from the source and releases its iterator.\n */\nexport function sseResponse(stream: AsyncIterable<ThreadEvent>, opts?: SseOptions): Response {\n  const encoder = new TextEncoder();\n  const signal = opts?.signal;\n\n  const body = new ReadableStream<Uint8Array>({\n    async start(controller) {\n      const iterator = stream[Symbol.asyncIterator]();\n\n      const onAbort = () => {\n        void iterator.return?.(undefined);\n      };\n      if (signal) {\n        if (signal.aborted) {\n          await iterator.return?.(undefined);\n          controller.close();\n          return;\n        }\n        signal.addEventListener(\"abort\", onAbort, { once: true });\n      }\n\n      try {\n        for (;;) {\n          if (signal?.aborted) break;\n          const next = await iterator.next();\n          if (next.done) break;\n          controller.enqueue(encoder.encode(frame(next.value)));\n        }\n      } catch (error) {\n        const message = error instanceof Error ? error.message : \"Stream error\";\n        controller.enqueue(encoder.encode(errorFrame(message)));\n      } finally {\n        signal?.removeEventListener(\"abort\", onAbort);\n        controller.close();\n      }\n    },\n    cancel() {\n      // Consumer hung up: best-effort release of the upstream iterator.\n      void stream[Symbol.asyncIterator]().return?.(undefined);\n    },\n  });\n\n  return new Response(body, {\n    status: 200,\n    headers: {\n      \"content-type\": \"text/event-stream; charset=utf-8\",\n      \"cache-control\": \"no-cache, no-transform\",\n      connection: \"keep-alive\",\n    },\n  });\n}\n\n// ── Notification → async-iterable bridge ─────────────────────────────────────\n\nexport interface NotificationFrame {\n  readonly name: NotificationName;\n  readonly payload: unknown;\n}\n\n/**\n * Bridge `dispatcher.onNotification` (a push listener API) into a pull-based\n * `AsyncIterable`. A bounded backlog buffers events that arrive between\n * `next()` calls; pending readers are resolved immediately when an event\n * arrives. Calling `return()` (or breaking a `for await`) unsubscribes every\n * underlying listener — no leaks, fail-closed teardown.\n */\nexport function subscribeNotifications(\n  dispatcher: ProtocolDispatcher,\n  names: readonly NotificationName[],\n): AsyncIterable<NotificationFrame> {\n  return {\n    [Symbol.asyncIterator](): AsyncIterator<NotificationFrame> {\n      const backlog: NotificationFrame[] = [];\n      const waiters: Array<(r: IteratorResult<NotificationFrame>) => void> = [];\n      let closed = false;\n\n      const unsubscribers = names.map((name) =>\n        dispatcher.onNotification(name, (payload) => {\n          if (closed) return;\n          const value: NotificationFrame = { name, payload };\n          const waiter = waiters.shift();\n          if (waiter) waiter({ value, done: false });\n          else backlog.push(value);\n        }),\n      );\n\n      const teardown = (): void => {\n        if (closed) return;\n        closed = true;\n        for (const off of unsubscribers) off();\n        let waiter = waiters.shift();\n        while (waiter) {\n          waiter({ value: undefined, done: true });\n          waiter = waiters.shift();\n        }\n      };\n\n      return {\n        next(): Promise<IteratorResult<NotificationFrame>> {\n          const buffered = backlog.shift();\n          if (buffered) return Promise.resolve({ value: buffered, done: false });\n          if (closed) return Promise.resolve({ value: undefined, done: true });\n          return new Promise((resolve) => waiters.push(resolve));\n        },\n        return(): Promise<IteratorResult<NotificationFrame>> {\n          teardown();\n          return Promise.resolve({ value: undefined, done: true });\n        },\n      };\n    },\n  };\n}\n"],"mappings":";AA2BA,IAAM,YAAY;AAElB,IAAM,eAAiD;AAAA,EACrD,gBAAgB;AAClB;AAIA,SAAS,mBAAmB,SAI1B;AACA,SAAO,EAAE,SAAS,OAAO,IAAI,MAAM,OAAO,EAAE,MAAM,WAAW,QAAQ,EAAE;AACzE;AAEA,SAAS,aAAa,SAAkB,QAA0B;AAChE,SAAO,IAAI,SAAS,KAAK,UAAU,OAAO,GAAG,EAAE,QAAQ,SAAS,EAAE,GAAG,aAAa,EAAE,CAAC;AACvF;AAeO,SAAS,iBACd,YACyC;AACzC,SAAO,OAAO,YAAwC;AACpD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,QAAQ,KAAK;AAAA,IAC3B,QAAQ;AACN,aAAO,aAAa,mBAAmB,gCAAgC,GAAG,GAAG;AAAA,IAC/E;AAIA,QAAI;AACF,YAAM,WAAW,MAAM,WAAW,SAAS,GAAG;AAC9C,aAAO,aAAa,UAAU,GAAG;AAAA,IACnC,QAAQ;AACN,aAAO,aAAa,mBAAmB,oBAAoB,GAAG,GAAG;AAAA,IACnE;AAAA,EACF;AACF;AAUA,SAAS,MAAM,OAA4B;AACzC,SAAO,UAAU,MAAM,IAAI;AAAA,QAAW,KAAK,UAAU,KAAK,CAAC;AAAA;AAAA;AAC7D;AAGA,SAAS,WAAW,SAAyB;AAC3C,SAAO;AAAA,QAAuB,KAAK,UAAU,EAAE,MAAM,SAAS,QAAQ,CAAC,CAAC;AAAA;AAAA;AAC1E;AAcO,SAAS,YAAY,QAAoC,MAA6B;AAC3F,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,MAAM;AAErB,QAAM,OAAO,IAAI,eAA2B;AAAA,IAC1C,MAAM,MAAM,YAAY;AACtB,YAAM,WAAW,OAAO,OAAO,aAAa,EAAE;AAE9C,YAAM,UAAU,MAAM;AACpB,aAAK,SAAS,SAAS,MAAS;AAAA,MAClC;AACA,UAAI,QAAQ;AACV,YAAI,OAAO,SAAS;AAClB,gBAAM,SAAS,SAAS,MAAS;AACjC,qBAAW,MAAM;AACjB;AAAA,QACF;AACA,eAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,MAC1D;AAEA,UAAI;AACF,mBAAS;AACP,cAAI,QAAQ,QAAS;AACrB,gBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,cAAI,KAAK,KAAM;AACf,qBAAW,QAAQ,QAAQ,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,QACtD;AAAA,MACF,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,mBAAW,QAAQ,QAAQ,OAAO,WAAW,OAAO,CAAC,CAAC;AAAA,MACxD,UAAE;AACA,gBAAQ,oBAAoB,SAAS,OAAO;AAC5C,mBAAW,MAAM;AAAA,MACnB;AAAA,IACF;AAAA,IACA,SAAS;AAEP,WAAK,OAAO,OAAO,aAAa,EAAE,EAAE,SAAS,MAAS;AAAA,IACxD;AAAA,EACF,CAAC;AAED,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,YAAY;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAgBO,SAAS,uBACd,YACA,OACkC;AAClC,SAAO;AAAA,IACL,CAAC,OAAO,aAAa,IAAsC;AACzD,YAAM,UAA+B,CAAC;AACtC,YAAM,UAAiE,CAAC;AACxE,UAAI,SAAS;AAEb,YAAM,gBAAgB,MAAM;AAAA,QAAI,CAAC,SAC/B,WAAW,eAAe,MAAM,CAAC,YAAY;AAC3C,cAAI,OAAQ;AACZ,gBAAM,QAA2B,EAAE,MAAM,QAAQ;AACjD,gBAAM,SAAS,QAAQ,MAAM;AAC7B,cAAI,OAAQ,QAAO,EAAE,OAAO,MAAM,MAAM,CAAC;AAAA,cACpC,SAAQ,KAAK,KAAK;AAAA,QACzB,CAAC;AAAA,MACH;AAEA,YAAM,WAAW,MAAY;AAC3B,YAAI,OAAQ;AACZ,iBAAS;AACT,mBAAW,OAAO,cAAe,KAAI;AACrC,YAAI,SAAS,QAAQ,MAAM;AAC3B,eAAO,QAAQ;AACb,iBAAO,EAAE,OAAO,QAAW,MAAM,KAAK,CAAC;AACvC,mBAAS,QAAQ,MAAM;AAAA,QACzB;AAAA,MACF;AAEA,aAAO;AAAA,QACL,OAAmD;AACjD,gBAAM,WAAW,QAAQ,MAAM;AAC/B,cAAI,SAAU,QAAO,QAAQ,QAAQ,EAAE,OAAO,UAAU,MAAM,MAAM,CAAC;AACrE,cAAI,OAAQ,QAAO,QAAQ,QAAQ,EAAE,OAAO,QAAW,MAAM,KAAK,CAAC;AACnE,iBAAO,IAAI,QAAQ,CAAC,YAAY,QAAQ,KAAK,OAAO,CAAC;AAAA,QACvD;AAAA,QACA,SAAqD;AACnD,mBAAS;AACT,iBAAO,QAAQ,QAAQ,EAAE,OAAO,QAAW,MAAM,KAAK,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;","names":[]}

package/dist/commands.d.ts

@@ -0,0 +1,74 @@
+import { Definition, ResolveContext } from './definitions.js';
+import 'zod';
+
+/**
+ * Slash-command registry — faithful re-expression of the unified command model.
+ *
+ * Semantic model:
+ *  - A command and a skill are the SAME underlying type. `CommandRecord` is just
+ *    a `Definition`. The only differences are carried in the record itself:
+ *    `sourceTier`, and the `userInvocable` / `modelInvocable` frontmatter flags.
+ *  - Slash invocation (a human types `/deploy`) and model invocation (the model
+ *    auto-triggers) are two FRONT-DOORS to ONE expansion path.
+ *  - The registry IS a `DefinitionResolver<CommandRecord>` (layered tier merge +
+ *    precedence + dual gate are provided by definitions.ts — reused, not rebuilt).
+ *    `CommandRegistry` is a thin wrapper exposing the two front-doors; both
+ *    recompute per call so entitlement/flag changes apply live.
+ *
+ * Scope note: the source harness also has `local` / `local-jsx` command kinds
+ * that run TUI-side JSX. Those are intentionally DROPPED here — a server runtime
+ * only needs the prompt-expansion path. This module models that path only.
+ *
+ * Multi-tenant: `tenantId` is mandatory at every entry point; an empty tenant
+ * throws (fail-closed); cross-tenant resolution is impossible (the underlying
+ * resolver rejects foreign-tenant records).
+ */
+
+/**
+ * A command IS a Definition. No new fields — the distinction between "command"
+ * and "skill" is purely the `sourceTier` + invocability flags already present.
+ */
+type CommandRecord = Definition;
+/** Lazily loads a command's body text (FS / blob / remote — caller's choice). */
+type BodyLoader = (cmd: CommandRecord) => Promise<string>;
+/** One content block destined for the model turn. */
+interface ContentBlock {
+    readonly role: "user";
+    readonly content: string;
+}
+/** Result of expanding a command — declarative only; no enforcement here. */
+interface ExpandedCommand {
+    /** Prompt blocks to splice into the turn. */
+    readonly contentBlocks: readonly ContentBlock[];
+    /** Tools the command self-declares for the permission context. */
+    readonly allowedTools: readonly string[];
+    /** Model alias to switch to, if the command pins one (not "inherit"). */
+    readonly modelOverride?: string | undefined;
+    /** Reasoning effort hint, if declared. */
+    readonly effort?: "low" | "medium" | "high" | undefined;
+    /** inline = expand into current turn; fork = isolated child. */
+    readonly executionMode: "inline" | "fork";
+}
+/**
+ * Pure expansion. Loads the body lazily (exactly once), substitutes named args
+ * and a tenant-safe variable map (only the explicitly injected `variables` —
+ * never `process.env`), and returns the declarative execution context.
+ */
+declare function expandCommand(cmd: CommandRecord, argInput: string, variables: Readonly<Record<string, string>>, bodyLoader: BodyLoader): Promise<ExpandedCommand>;
+/**
+ * Thin tenant-scoped wrapper over `DefinitionResolver<CommandRecord>`. Exposes
+ * the two front-doors. Tier merge / precedence / dual gate / tenant isolation
+ * are delegated to the resolver — this class only filters by invocability.
+ */
+declare class CommandRegistry {
+    #private;
+    constructor(commands: readonly CommandRecord[]);
+    /** Commands a human may type as a slash command. */
+    listForUser(ctx: ResolveContext): CommandRecord[];
+    /** Commands the model may auto-trigger. */
+    listForModel(ctx: ResolveContext): CommandRecord[];
+    /** Highest-precedence gated record for a slug (no invocability filter). */
+    resolveOne(slug: string, ctx: ResolveContext): CommandRecord | undefined;
+}
+
+export { type BodyLoader, type CommandRecord, CommandRegistry, type ContentBlock, type ExpandedCommand, expandCommand };

package/dist/commands.js

@@ -0,0 +1,10 @@
+import {
+  CommandRegistry,
+  expandCommand
+} from "./chunk-YYFPDBJG.js";
+import "./chunk-7BUOF367.js";
+export {
+  CommandRegistry,
+  expandCommand
+};
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/definitions.d.ts

@@ -0,0 +1,94 @@
+import { z } from 'zod';
+
+/**
+ * Shared definition kernel (WRAP — Claude-Code-class harness, the delta).
+ *
+ * Faithful re-expression of the source harness's layered-merge + precedence +
+ * dual-gate resolver and its frontmatter→record parser. One implementation
+ * backs the command registry, the skill catalog, and the subagent-definition
+ * registry (the source uses the same loader for all three).
+ *
+ * Multi-tenant: every resolution is keyed by `tenantId`; tiers from one tenant
+ * never merge into another. Pure data/logic — no FS scan, no shell, no TUI.
+ */
+
+/**
+ * Source-tier precedence, low → high authority. A later tier overrides an
+ * earlier one on slug collision (mirrors the upstream merge order:
+ * bundled → builtin → workspace → workflow → plugin → dynamic, with
+ * org policy as the final, non-overridable authority).
+ */
+declare const SOURCE_TIERS: readonly ["bundled", "builtin", "workspace", "workflow", "plugin", "dynamic", "policy"];
+type SourceTier = (typeof SOURCE_TIERS)[number];
+/** Frontmatter shared by skills / commands / subagents (faithful subset). */
+declare const frontmatterSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodDefault<z.ZodString>;
+    allowedTools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    disallowedTools: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    argumentHint: z.ZodOptional<z.ZodString>;
+    argNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    whenToUse: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    model: z.ZodOptional<z.ZodString>;
+    effort: z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>;
+    modelInvocable: z.ZodDefault<z.ZodBoolean>;
+    userInvocable: z.ZodDefault<z.ZodBoolean>;
+    executionMode: z.ZodDefault<z.ZodEnum<{
+        inline: "inline";
+        fork: "fork";
+    }>>;
+    agent: z.ZodOptional<z.ZodString>;
+    paths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type Frontmatter = z.infer<typeof frontmatterSchema>;
+/**
+ * Parse a `--- … ---` frontmatter block + remaining body. Dependency-light
+ * line parser (the package only depends on zod) — sufficient for the simple
+ * key: value / list frontmatter the source uses. Throws on missing block.
+ */
+declare function parseFrontmatter(raw: string): {
+    frontmatter: Frontmatter;
+    body: string;
+};
+/** A resolvable definition of any kind (skill / command / subagent). */
+interface Definition {
+    readonly slug: string;
+    readonly tenantId: string;
+    readonly sourceTier: SourceTier;
+    readonly frontmatter: Frontmatter;
+    readonly bodyRef: string;
+    /** Entitlement gate — who may have this at all. */
+    readonly availabilityPlans?: readonly string[];
+    /** Runtime/feature toggle, recomputed per request. */
+    readonly enabled?: boolean;
+}
+interface ResolveContext {
+    readonly tenantId: string;
+    readonly plan?: string;
+    /** Names already loaded this session (suppressed from re-listing). */
+    readonly loadedSlugs?: ReadonlySet<string>;
+}
+/**
+ * Tenant-scoped layered resolver. Merges definitions by slug with tier
+ * precedence and applies the dual gate (availability ∧ enabled), recomputed
+ * per call so entitlement/flag changes apply live. Cross-tenant inputs are
+ * rejected — fail closed.
+ */
+declare class DefinitionResolver<T extends Definition = Definition> {
+    #private;
+    constructor(definitions: readonly T[]);
+    /** Entitlement gate. */
+    static available(def: Definition, plan?: string): boolean;
+    resolve(ctx: ResolveContext): T[];
+    /** Resolve a single slug (highest-precedence, gated). */
+    resolveOne(slug: string, ctx: ResolveContext): T | undefined;
+}
+/** Substitute `${name}` / positional `$1` args + session/dir variables. */
+declare function substituteArguments(template: string, args: Record<string, string>, variables?: Record<string, string>): string;
+
+export { type Definition, DefinitionResolver, type Frontmatter, type ResolveContext, SOURCE_TIERS, type SourceTier, frontmatterSchema, parseFrontmatter, substituteArguments };

package/dist/definitions.js

@@ -0,0 +1,15 @@
+import {
+  DefinitionResolver,
+  SOURCE_TIERS,
+  frontmatterSchema,
+  parseFrontmatter,
+  substituteArguments
+} from "./chunk-7BUOF367.js";
+export {
+  DefinitionResolver,
+  SOURCE_TIERS,
+  frontmatterSchema,
+  parseFrontmatter,
+  substituteArguments
+};
+//# sourceMappingURL=definitions.js.map

package/dist/definitions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/dispatcher.d.ts

@@ -0,0 +1,50 @@
+import { SerializationScope, NotificationName } from './protocol.js';
+import 'zod';
+
+/**
+ * Transport-agnostic JSON-RPC dispatcher for the app-server protocol.
+ *
+ * Pure and testable: no sockets. WS/SSE/stdio adapters wrap this dispatcher
+ * and are intentionally out of scope here.
+ *
+ * Faithful concurrency model (see `protocol.ts`): requests sharing a
+ * `scopeKey` are serialized FIFO; distinct scope keys run concurrently.
+ * Because every scope is tenant-prefixed, cross-tenant requests can never
+ * share a serial lane (fail-closed multi-tenancy by construction).
+ */
+
+type MethodHandler = (params: unknown, scope: SerializationScope) => Promise<unknown>;
+type NotificationListener = (payload: unknown) => void;
+interface JsonRpcSuccess {
+    readonly jsonrpc: "2.0";
+    readonly id: string | number | null;
+    readonly result: unknown;
+}
+interface JsonRpcFailure {
+    readonly jsonrpc: "2.0";
+    readonly id: string | number | null;
+    readonly error: {
+        readonly code: number;
+        readonly message: string;
+    };
+}
+type JsonRpcResponse = JsonRpcSuccess | JsonRpcFailure;
+declare class ProtocolDispatcher {
+    #private;
+    /** Register a handler for a wire method name (e.g. `"turn/start"`). */
+    register(methodName: string, handler: MethodHandler): this;
+    /** Subscribe to a server→client notification. */
+    onNotification(name: NotificationName, listener: NotificationListener): () => void;
+    /**
+     * Emit a server→client notification. Validates the name against the
+     * `NOTIFICATIONS` allow-list (fail-closed: unknown name throws).
+     */
+    emitNotification(name: NotificationName, payload: unknown): void;
+    /**
+     * Dispatch a single raw envelope. Never throws — every failure path maps
+     * to a JSON-RPC error response.
+     */
+    dispatch(rawEnvelope: unknown): Promise<JsonRpcResponse>;
+}
+
+export { type JsonRpcResponse, type MethodHandler, type NotificationListener, ProtocolDispatcher };

package/dist/dispatcher.js

@@ -0,0 +1,8 @@
+import {
+  ProtocolDispatcher
+} from "./chunk-RDKYDMXT.js";
+import "./chunk-FUG5DT2C.js";
+export {
+  ProtocolDispatcher
+};
+//# sourceMappingURL=dispatcher.js.map

package/dist/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/durable-turn.d.ts

@@ -0,0 +1,58 @@
+import { ThreadEvent } from './model.js';
+import { RolloutStore } from './rollout.js';
+
+/**
+ * Durable / resumable turn (WRAP — capability #10).
+ *
+ * Wraps the existing {@link runTurn} async generator so a turn survives a
+ * process crash. `start` enqueues a tenant+thread-scoped durable job whose
+ * handler drains `runTurn` (the loop runner already appends every event to the
+ * tenant-scoped {@link RolloutStore}); the durable layer guarantees the job is
+ * replayable if the worker dies mid-turn. `resume` inspects the persisted
+ * rollout: if the last recorded event is non-terminal the turn is re-driven to
+ * completion, otherwise the recorded terminal stream is replayed.
+ *
+ * Queue binding is interface-only — callers wire `@nebutra/queue` by
+ * implementing {@link DurableTurnQueuePort}; this package never depends on it.
+ * Tenant scoping is mandatory and fail-closed: a missing tenant or thread
+ * throws, and resume can never read another tenant's rollout.
+ */
+
+/** A durable job handed to the queue. Mirrors `@nebutra/queue` job shape. */
+interface DurableTurnJob {
+    /** Logical job name — used for handler routing. */
+    readonly name: string;
+    /** Tenant+thread-scoped id; the queue must de-dupe / make idempotent on it. */
+    readonly jobId: string;
+    /** Opaque Zod-validated payload (kept narrow on purpose). */
+    readonly payload: unknown;
+}
+/**
+ * Minimal injectable queue seam (enqueue + handler registration). Mirrors
+ * `@nebutra/queue`'s `defineQueueJob` / `createJobRouter` contract without a
+ * hard dependency, so this package stays provider-agnostic.
+ */
+interface DurableTurnQueuePort {
+    enqueue(job: DurableTurnJob): Promise<void>;
+    registerHandler(name: string, handler: (payload: unknown) => Promise<void>): void;
+}
+/** Drives one turn, yielding the event stream (persists internally). */
+type DurableTurnRunner = (input: string, ctx: TurnContext) => AsyncGenerator<ThreadEvent>;
+interface TurnContext {
+    readonly tenantId: string;
+    readonly threadId: string;
+}
+interface CreateDurableTurnDeps {
+    readonly store: RolloutStore;
+    readonly queue: DurableTurnQueuePort;
+    readonly runner: DurableTurnRunner;
+}
+interface DurableTurn {
+    start(input: string, ctx: TurnContext): Promise<{
+        readonly turnId: string;
+    }>;
+    resume(tenantId: string, threadId: string): AsyncGenerator<ThreadEvent>;
+}
+declare function createDurableTurn(deps: CreateDurableTurnDeps): DurableTurn;
+
+export { type CreateDurableTurnDeps, type DurableTurn, type DurableTurnJob, type DurableTurnQueuePort, type DurableTurnRunner, type TurnContext, createDurableTurn };

package/dist/durable-turn.js

@@ -0,0 +1,9 @@
+import {
+  createDurableTurn
+} from "./chunk-5N4644PB.js";
+import "./chunk-6EGG2OZC.js";
+import "./chunk-37BBB2P2.js";
+export {
+  createDurableTurn
+};
+//# sourceMappingURL=durable-turn.js.map

package/dist/durable-turn.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/hook-pipeline.d.ts

@@ -0,0 +1,114 @@
+import { ToolDispatchContext, ToolHooks } from './tools.js';
+import 'zod';
+
+/**
+ * Hook pipeline (WRAP — config-driven orchestrator hooks).
+ *
+ * Faithful re-expression of the upstream config-driven, decision-returning
+ * hook system. This is the configuration layer ABOVE the bare {@link ToolHooks}
+ * interface in `./tools.js`: events are matched by an event + matcher
+ * (+ optional ifCondition), fanned out to transports in parallel, and merged
+ * into a single deterministic {@link HookOutcome}.
+ *
+ * MULTI-TENANT SAFETY — the upstream `command`/shell/async (host-process)
+ * transports are deliberately DROPPED. In a multi-tenant runtime, executing a
+ * tenant-supplied host command is unbounded RCE against the shared process and
+ * cannot be sandboxed at this layer. Only in-process `function`, caller-fetched
+ * `http`, and caller-injected `prompt` transports are supported — each fails
+ * closed and cannot reach the host shell.
+ */
+
+/**
+ * Event taxonomy — ported verbatim from the upstream hook system.
+ * The matcher is matched against the tool name (tool events) or the event
+ * name itself (lifecycle events).
+ */
+type HookEvent = "PreToolUse" | "PostToolUse" | "PostToolUseFailure" | "UserPromptSubmit" | "SessionStart" | "SessionEnd" | "Stop" | "StopFailure" | "SubagentStart" | "SubagentStop" | "PreCompact" | "PostCompact" | "PermissionRequest" | "PermissionDenied" | "TaskCreated" | "TaskCompleted" | "ConfigChange" | "FileChanged";
+/** Tenant-scoped context — reuses the dispatch context shape from `./tools.js`. */
+type HookContext = ToolDispatchContext;
+/** The event payload presented to a transport. */
+interface HookPayload {
+    /** The tool name (tool events) or event name (lifecycle events). */
+    readonly name: string;
+    /** Parsed tool/event input. */
+    readonly input: unknown;
+    /** Tool output (only present for Post* events). */
+    readonly toolOutput?: unknown;
+}
+/**
+ * Decision protocol — ported verbatim. A transport returns a PARTIAL outcome;
+ * the pipeline merges all partials with deterministic precedence.
+ */
+interface HookOutcome {
+    readonly preventContinuation?: boolean | undefined;
+    readonly stopReason?: string | undefined;
+    readonly permissionBehavior?: "allow" | "deny" | "ask" | undefined;
+    readonly blockingError?: string | undefined;
+    readonly additionalContext?: string | undefined;
+    readonly updatedInput?: unknown;
+    readonly updatedToolOutput?: unknown;
+    readonly systemMessage?: string | undefined;
+}
+/** Exit-code-style lane for the function transport. */
+interface HookExitResult {
+    readonly code: number;
+    readonly stdout?: string;
+    readonly stderr?: string;
+}
+type FunctionRunResult = Partial<HookOutcome> | HookExitResult;
+/** In-process transport — the tenant-safe default. */
+interface FunctionTransport {
+    readonly kind: "function";
+    readonly run: (payload: HookPayload, ctx: HookContext) => Promise<FunctionRunResult>;
+}
+/** HTTP transport — caller injects `fetchImpl`; absolute https + fail-closed. */
+interface HttpTransport {
+    readonly kind: "http";
+    readonly url: string;
+    readonly allowEnvVars?: readonly string[];
+    readonly fetchImpl: (url: string, init: RequestInit) => Promise<Response>;
+}
+/** Prompt transport — caller injects the LLM evaluator. */
+interface PromptTransport {
+    readonly kind: "prompt";
+    readonly model: string;
+    readonly llmEval: (payload: HookPayload, ctx: HookContext) => Promise<Partial<HookOutcome>>;
+}
+type HookTransport = FunctionTransport | HttpTransport | PromptTransport;
+/** A single hook configuration entry. */
+interface HookConfig {
+    readonly event: HookEvent;
+    /** `"*"` | exact | pipe-list (`"Write|Edit"`) | `/regex/`. */
+    readonly matcher: string;
+    /** Predicate over parsed input, evaluated BEFORE the transport runs. */
+    readonly ifCondition?: (input: unknown, ctx: HookContext) => boolean;
+    readonly transport: HookTransport;
+}
+/** Out-of-band progress event — decoupled from outcomes. */
+interface HookProgressEvent {
+    readonly phase: "started" | "completed";
+    readonly event: HookEvent;
+    readonly matcher: string;
+    readonly tenantId: string;
+}
+type HookProgressListener = (e: HookProgressEvent) => void;
+/** Subscribe to out-of-band hook progress. Returns an unsubscribe function. */
+declare function onHookEvent(listener: HookProgressListener): () => void;
+/**
+ * Pure matcher: `"*"` | exact | pipe-list | `/regex/`.
+ */
+declare function matchesMatcher(matcher: string, name: string): boolean;
+/**
+ * Select matching hooks, fan out in parallel, merge with deterministic
+ * precedence. tenantId is mandatory — empty fails closed (throws).
+ */
+declare function runHooks(event: HookEvent, payload: HookPayload, hooks: ReadonlyArray<HookConfig>, ctx: HookContext): Promise<HookOutcome>;
+/**
+ * Adapt the bare {@link ToolHooks} interface (from `./tools.js`) into
+ * config-driven function-transport entries — the in-process transport feeding
+ * the lower layer. preToolUse/postToolUse are void-returning, so the produced
+ * outcome is always empty (they observe; they do not decide here).
+ */
+declare function fromToolHooks(toolHooks: ToolHooks): HookConfig[];
+
+export { type FunctionTransport, type HookConfig, type HookContext, type HookEvent, type HookExitResult, type HookOutcome, type HookPayload, type HookProgressEvent, type HookTransport, type HttpTransport, type PromptTransport, fromToolHooks, matchesMatcher, onHookEvent, runHooks };

package/dist/hook-pipeline.js

@@ -0,0 +1,13 @@
+import {
+  fromToolHooks,
+  matchesMatcher,
+  onHookEvent,
+  runHooks
+} from "./chunk-LO24VOA3.js";
+export {
+  fromToolHooks,
+  matchesMatcher,
+  onHookEvent,
+  runHooks
+};
+//# sourceMappingURL=hook-pipeline.js.map

package/dist/hook-pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}