@probelabs/probe 0.6.0-rc335 → 0.6.0-rc337

package/cjs/agent/ProbeAgent.cjs

@@ -26535,7 +26535,7 @@ var init_dist5 = __esm({
         return combineHeaders(await resolve(this.config.headers), headers);
       }
       async doGenerate(options) {
-        var _a17, _b16, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o;
+        var _a17, _b16, _c, _d, _e, _f, _g, _h, _i, _j, _k, _l, _m, _n, _o, _p, _q, _r;
         const {
           command: args,
           warnings,
@@ -26564,10 +26564,12 @@ var init_dist5 = __esm({
         let isJsonResponseFromTool = false;
         const jsonObjectTextExtractor = usesJsonInstruction ? new JsonObjectTextExtractor() : void 0;
         for (const part of response.output.message.content) {
-          if (part.text != null) {
+          const citationText = (_b16 = (_a17 = part.citationsContent) == null ? void 0 : _a17.content) == null ? void 0 : _b16.map((generatedContent) => generatedContent.text).filter((text2) => text2 != null).join("");
+          const text = (_c = part.text) != null ? _c : citationText ? citationText : void 0;
+          if (text != null) {
             content.push({
               type: "text",
-              text: (_a17 = jsonObjectTextExtractor == null ? void 0 : jsonObjectTextExtractor.process(part.text)) != null ? _a17 : part.text
+              text: (_d = jsonObjectTextExtractor == null ? void 0 : jsonObjectTextExtractor.process(text)) != null ? _d : text
             });
           }
           if (part.reasoningContent) {
@@ -26590,7 +26592,7 @@ var init_dist5 = __esm({
                 text: "",
                 providerMetadata: {
                   bedrock: {
-                    redactedData: (_b16 = part.reasoningContent.redactedReasoning.data) != null ? _b16 : ""
+                    redactedData: (_e = part.reasoningContent.redactedReasoning.data) != null ? _e : ""
                   }
                 }
               });
@@ -26616,17 +26618,17 @@ var init_dist5 = __esm({
               });
             } else {
               const isMistral = isMistralModel(this.modelId);
-              const rawToolCallId = (_d = (_c = part.toolUse) == null ? void 0 : _c.toolUseId) != null ? _d : this.config.generateId();
+              const rawToolCallId = (_g = (_f = part.toolUse) == null ? void 0 : _f.toolUseId) != null ? _g : this.config.generateId();
               content.push({
                 type: "tool-call",
                 toolCallId: normalizeToolCallId(rawToolCallId, isMistral),
-                toolName: (_f = (_e = part.toolUse) == null ? void 0 : _e.name) != null ? _f : `tool-${this.config.generateId()}`,
-                input: JSON.stringify((_h = (_g = part.toolUse) == null ? void 0 : _g.input) != null ? _h : {})
+                toolName: (_i = (_h = part.toolUse) == null ? void 0 : _h.name) != null ? _i : `tool-${this.config.generateId()}`,
+                input: JSON.stringify((_k = (_j = part.toolUse) == null ? void 0 : _j.input) != null ? _k : {})
               });
             }
           }
         }
-        const stopSequence = (_k = (_j = (_i = response.additionalModelResponseFields) == null ? void 0 : _i.delta) == null ? void 0 : _j.stop_sequence) != null ? _k : null;
+        const stopSequence = (_n = (_m = (_l = response.additionalModelResponseFields) == null ? void 0 : _l.delta) == null ? void 0 : _m.stop_sequence) != null ? _n : null;
         const providerMetadata = response.trace || response.usage || response.performanceConfig || response.serviceTier || isJsonResponseFromTool || stopSequence ? {
           bedrock: {
             ...response.trace && typeof response.trace === "object" ? { trace: response.trace } : {},
@@ -26636,7 +26638,7 @@ var init_dist5 = __esm({
             ...response.serviceTier && {
               serviceTier: response.serviceTier
             },
-            ...(((_l = response.usage) == null ? void 0 : _l.cacheWriteInputTokens) != null || ((_m = response.usage) == null ? void 0 : _m.cacheDetails) != null) && {
+            ...(((_o = response.usage) == null ? void 0 : _o.cacheWriteInputTokens) != null || ((_p = response.usage) == null ? void 0 : _p.cacheDetails) != null) && {
               usage: {
                 ...response.usage.cacheWriteInputTokens != null && {
                   cacheWriteInputTokens: response.usage.cacheWriteInputTokens
@@ -26657,11 +26659,11 @@ var init_dist5 = __esm({
               response.stopReason,
               isJsonResponseFromTool
             ),
-            raw: (_n = response.stopReason) != null ? _n : void 0
+            raw: (_q = response.stopReason) != null ? _q : void 0
           },
           usage: convertBedrockUsage(response.usage),
           response: {
-            id: (_o = responseHeaders == null ? void 0 : responseHeaders["x-amzn-requestid"]) != null ? _o : void 0,
+            id: (_r = responseHeaders == null ? void 0 : responseHeaders["x-amzn-requestid"]) != null ? _r : void 0,
             timestamp: (responseHeaders == null ? void 0 : responseHeaders["date"]) != null ? new Date(responseHeaders["date"]) : void 0,
             modelId: this.modelId,
             headers: responseHeaders
@@ -27102,6 +27104,13 @@ var init_dist5 = __esm({
           content: external_exports.array(
             external_exports.object({
               text: external_exports.string().nullish(),
+              citationsContent: external_exports.object({
+                content: external_exports.array(
+                  external_exports.object({
+                    text: external_exports.string().nullish()
+                  })
+                ).nullish()
+              }).nullish(),
               toolUse: BedrockToolUseSchema.nullish(),
               reasoningContent: external_exports.union([
                 external_exports.object({
@@ -27564,7 +27573,7 @@ var init_dist5 = __esm({
       details: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
       preview: external_exports.unknown().optional()
     });
-    VERSION3 = true ? "4.0.169" : "0.0.0-test";
+    VERSION3 = true ? "4.0.172" : "0.0.0-test";
     bedrockRerankingResponseSchema = lazySchema(
       () => zodSchema(
         external_exports.object({
@@ -90864,6 +90873,7 @@ var require_utils2 = __commonJS({
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv42 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+    var isPort = RegExp.prototype.test.bind(/^\d*$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
@@ -91329,8 +91339,12 @@ var require_utils2 = __commonJS({
         uriTokens.push(host);
       }
       if (typeof component.port === "number" || typeof component.port === "string") {
+        const port = String(component.port);
+        if (!isPort(port)) {
+          throw new TypeError("URI port is malformed.");
+        }
         uriTokens.push(":");
-        uriTokens.push(String(component.port));
+        uriTokens.push(port);
       }
       return uriTokens.length ? uriTokens.join("") : void 0;
     }
@@ -91773,12 +91787,15 @@ var require_fast_uri = __commonJS({
       }
       return false;
     }
+    function isIPLiteral(host) {
+      return host[0] === "[" && host[host.length - 1] === "]";
+    }
     function hasMalformedComponentPercentEncoding(matches) {
       const host = matches[4];
-      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+      return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
     }
     function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
         try {
           parsed.host = new URL("http://" + parsed.host).hostname;
         } catch (e) {
@@ -91865,10 +91882,11 @@ var require_fast_uri = __commonJS({
         if (parsed.host) {
           const ipv4result = isIPv42(parsed.host);
           if (ipv4result === false) {
-            const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
+            const bracketedIPLiteral = isIPLiteral(parsed.host);
+            const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
             const ipv6result = normalizeIPv6(parsed.host);
             isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
-            malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+            malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
             parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
             if (malformedIPLiteral) {
               parsed.error = parsed.error || "URI host is malformed.";
@@ -91891,7 +91909,9 @@ var require_fast_uri = __commonJS({
           parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
         }
         const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-        malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        if (!malformedIPLiteral) {
+          malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+        }
         if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
           if (uri.indexOf("%") !== -1) {
             if (parsed.host !== void 0 && !malformedIPLiteral) {
@@ -106862,7 +106882,7 @@ var init_governed_codex_profile = __esm({
 function governedAttestationPredicate(error40) {
   return error40 instanceof TypeError ? GOVERNED_ATTESTATION_ERROR_PREDICATES.get(error40.message) ?? null : null;
 }
-function governedAnswerFailure(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null) {
+function governedAnswerFailure(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null, providerEngineFailureBoundary = null) {
   return new GovernedAnswerFailure(
     stage,
     nativeEventFailureBoundary,
@@ -106870,21 +106890,23 @@ function governedAnswerFailure(stage, nativeEventFailureBoundary = null, nativeE
     nativeEventFailureCorrelationOperand,
     nativeEventFailureAttestationPredicate,
     schemaResultValidationSubreason,
-    schemaResultValidationKeyword
+    schemaResultValidationKeyword,
+    providerEngineFailureBoundary
   );
 }
-function normalizeGovernedAnswerFailure(error40, fallback = "unknown", nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null) {
+function normalizeGovernedAnswerFailure(error40, fallback = "unknown", nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null, providerEngineFailureBoundary = null, nativeEventFailureAttestationPredicate = null) {
   return error40 instanceof GovernedAnswerFailure ? error40 : governedAnswerFailure(
     fallback,
     nativeEventFailureBoundary,
     nativeEventFailureSubreason,
     nativeEventFailureCorrelationOperand,
-    fallback === "native_event_grammar" && nativeEventFailureBoundary === "live_envelope_session" && nativeEventFailureSubreason === "attestation" ? governedAttestationPredicate(error40) : null,
+    fallback === "native_event_grammar" && nativeEventFailureBoundary === "live_envelope_session" && nativeEventFailureSubreason === "attestation" ? nativeEventFailureAttestationPredicate ?? governedAttestationPredicate(error40) : null,
     schemaResultValidationSubreason,
-    schemaResultValidationKeyword
+    schemaResultValidationKeyword,
+    providerEngineFailureBoundary
   );
 }
-var GOVERNED_ANSWER_FAILURE_STAGES, GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES, GOVERNED_NATIVE_EVENT_FAILURE_SUBREASONS, GOVERNED_NATIVE_EVENT_FAILURE_CORRELATION_OPERANDS, GOVERNED_NATIVE_EVENT_FAILURE_ATTESTATION_PREDICATES, GOVERNED_SCHEMA_RESULT_VALIDATION_SUBREASONS, GOVERNED_SCHEMA_RESULT_VALIDATION_KEYWORDS, GOVERNED_ATTESTATION_ERROR_PREDICATES, GovernedAnswerFailure;
+var GOVERNED_ANSWER_FAILURE_STAGES, GOVERNED_PROVIDER_ENGINE_FAILURE_BOUNDARIES, GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES, GOVERNED_NATIVE_EVENT_FAILURE_SUBREASONS, GOVERNED_NATIVE_EVENT_FAILURE_CORRELATION_OPERANDS, GOVERNED_NATIVE_EVENT_FAILURE_ATTESTATION_PREDICATES, GOVERNED_SCHEMA_RESULT_VALIDATION_SUBREASONS, GOVERNED_SCHEMA_RESULT_VALIDATION_KEYWORDS, GOVERNED_ATTESTATION_ERROR_PREDICATES, GovernedAnswerFailure;
 var init_governed_answer_failure = __esm({
   "src/agent/engines/governed-answer-failure.js"() {
     "use strict";
@@ -106892,8 +106914,10 @@ var init_governed_answer_failure = __esm({
       "native_event_grammar",
       "provider_engine",
       "schema_result_validation",
+      "internal_contract",
       "unknown"
     ]);
+    GOVERNED_PROVIDER_ENGINE_FAILURE_BOUNDARIES = /* @__PURE__ */ new Set(["acquire", "query", "close"]);
     GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES = /* @__PURE__ */ new Set([
       "raw_item_predicate",
       "live_envelope_session"
@@ -106937,7 +106961,9 @@ var init_governed_answer_failure = __esm({
       "value_shape",
       "kind",
       "native_tool_evidence",
-      "internal_contract"
+      "internal_contract",
+      "invocation_attestation",
+      "native_capability_aggregate"
     ]);
     GOVERNED_SCHEMA_RESULT_VALIDATION_SUBREASONS = /* @__PURE__ */ new Set([
       "response_json",
@@ -107020,7 +107046,7 @@ var init_governed_answer_failure = __esm({
       ["Invalid profile capability overlap", "internal_contract"]
     ]);
     GovernedAnswerFailure = class extends Error {
-      constructor(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null) {
+      constructor(stage, nativeEventFailureBoundary = null, nativeEventFailureSubreason = null, nativeEventFailureCorrelationOperand = null, nativeEventFailureAttestationPredicate = null, schemaResultValidationSubreason = null, schemaResultValidationKeyword = null, providerEngineFailureBoundary = null) {
         super();
         delete this.stack;
         const answerFailureStage = GOVERNED_ANSWER_FAILURE_STAGES.has(stage) ? stage : "unknown";
@@ -107029,6 +107055,10 @@ var init_governed_answer_failure = __esm({
           value: answerFailureStage,
           enumerable: true
         });
+        if (answerFailureStage === "provider_engine") Object.defineProperty(this, "providerEngineFailureBoundary", {
+          value: GOVERNED_PROVIDER_ENGINE_FAILURE_BOUNDARIES.has(providerEngineFailureBoundary) ? providerEngineFailureBoundary : null,
+          enumerable: true
+        });
         if (answerFailureStage === "native_event_grammar") Object.defineProperty(this, "nativeEventFailureBoundary", {
           value: GOVERNED_NATIVE_EVENT_FAILURE_BOUNDARIES.has(nativeEventFailureBoundary) ? nativeEventFailureBoundary : null,
           enumerable: true
@@ -108039,7 +108069,9 @@ async function createCodexEngine(options = {}) {
           }
         });
         if (opts.abortSignal) {
-          if (opts.abortSignal.aborted) throw new Error("Codex query cancelled");
+          if (opts.abortSignal.aborted) {
+            throw governedProfile ? governedAnswerFailure("provider_engine", null, null, null, null, null, null, "query") : new Error("Codex query cancelled");
+          }
           abortHandler = () => {
             void cleanup(new Error("Codex query cancelled")).catch(() => {
             });
@@ -108072,7 +108104,16 @@ async function createCodexEngine(options = {}) {
         try {
           result = await resultPromise;
         } catch (error40) {
-          throw governedProfile ? governedAnswerFailure(evidenceFailure ? "unknown" : "provider_engine") : error40;
+          throw governedProfile ? evidenceFailure || normalizeGovernedAnswerFailure(
+            error40,
+            "provider_engine",
+            null,
+            null,
+            null,
+            null,
+            null,
+            "query"
+          ) : error40;
         }
         eventHandlers.delete(reqId);
         governedEvidenceHandlers.delete(reqId);
@@ -108090,17 +108131,50 @@ async function createCodexEngine(options = {}) {
               profile: governedProfile,
               events: governedProfile.version === "probe.governed-codex-profile/v2" ? [collected.sessionEvent, collected.capabilities.nativeTools] : [collected.sessionEvent]
             });
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation"
+            );
+          }
+          try {
             probeMcpCallCount = governedProfile.version === "probe.governed-codex-profile/v2" ? governedProbeMcpCallCount(mcpServer?.getGovernedCallEvidence()) : 0;
           } catch (error40) {
-            throw normalizeGovernedAnswerFailure(error40, "native_event_grammar", "live_envelope_session", "attestation");
-          }
-          attestation = hasInvocationDigest ? externalBoundReceipt(internal, dispatch, invocationDigest, {
-            nativeCallCount: collected.capabilities.nativeTools.total,
-            probeMcpCallCount
-          }) : externalReceipt(internal, {
-            nativeCallCount: collected.capabilities.nativeTools.total,
-            probeMcpCallCount
-          });
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              null,
+              null,
+              null,
+              "native_capability_aggregate"
+            );
+          }
+          try {
+            attestation = hasInvocationDigest ? externalBoundReceipt(internal, dispatch, invocationDigest, {
+              nativeCallCount: collected.capabilities.nativeTools.total,
+              probeMcpCallCount
+            }) : externalReceipt(internal, {
+              nativeCallCount: collected.capabilities.nativeTools.total,
+              probeMcpCallCount
+            });
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              null,
+              null,
+              null,
+              "invocation_attestation"
+            );
+          }
           session.setConversationId(collected.sessionEvent.params.msg.session_id);
         }
         if (result && result.content && Array.isArray(result.content)) {
@@ -108137,7 +108211,7 @@ async function createCodexEngine(options = {}) {
           }
         };
       } catch (error40) {
-        if (governedProfile) error40 = normalizeGovernedAnswerFailure(error40, "unknown");
+        if (governedProfile) error40 = normalizeGovernedAnswerFailure(error40, "internal_contract");
         queryError = error40;
         if (debug) {
           console.error("[DEBUG] Codex query error:", error40);
@@ -108152,7 +108226,16 @@ async function createCodexEngine(options = {}) {
           try {
             await cleanup();
           } catch (cleanupError) {
-            if (!queryError) throw cleanupError;
+            if (!queryError) throw normalizeGovernedAnswerFailure(
+              cleanupError,
+              "provider_engine",
+              null,
+              null,
+              null,
+              null,
+              null,
+              "close"
+            );
           }
         }
       }
@@ -110239,7 +110322,6 @@ var init_ProbeAgent = __esm({
               agent: this,
               // Pass reference to ProbeAgent for tool access
               systemPrompt,
-              customPrompt: this.customPrompt,
               sessionId: this.options?.sessionId,
               debug: this.debug,
               allowedTools: this.allowedTools,
@@ -110256,7 +110338,18 @@ var init_ProbeAgent = __esm({
             }
             return this.engine;
           } catch (error40) {
-            if (this.governedCodexProfile) throw error40;
+            if (this.governedCodexProfile) {
+              throw normalizeGovernedAnswerFailure(
+                error40,
+                "provider_engine",
+                null,
+                null,
+                null,
+                null,
+                null,
+                "acquire"
+              );
+            }
             console.warn("[WARNING] Failed to load Codex CLI engine:", error40.message);
             console.warn("[WARNING] Falling back to Vercel AI SDK");
             this.clientApiProvider = null;
@@ -110937,7 +111030,7 @@ Workspace: ${this.allowedFolders.join(", ")}`;
         const { prompt } = this._prepareGovernedAnswerPrompt(message, options);
         const systemPrompt = await this._getCachedCodexNativeSystemPrompt();
         const { previewGovernedCodexInitialDispatch: previewGovernedCodexInitialDispatch2 } = await Promise.resolve().then(() => (init_codex(), codex_exports));
-        return previewGovernedCodexInitialDispatch2({ systemPrompt, customPrompt: this.customPrompt, prompt });
+        return previewGovernedCodexInitialDispatch2({ systemPrompt, prompt });
       }
       /**
        * Get the system message with instructions for the AI (XML Tool Format)
@@ -111127,38 +111220,99 @@ You are working with a workspace. Available paths: ${workspaceDesc}
         try {
           try {
             engine = await this.getEngine();
-          } catch {
-            throw governedAnswerFailure("provider_engine");
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "provider_engine",
+              null,
+              null,
+              null,
+              null,
+              null,
+              "acquire"
+            );
           }
-          if (!engine?.query) throw governedAnswerFailure("provider_engine");
+          if (!engine?.query) throw governedAnswerFailure("internal_contract");
           const candidateChunks = [];
           let runtimeAttestation;
           let attestationCount = 0;
           let nativeToolBatch;
           let nativeToolBatchCount = 0;
           const queryOptions = hasInvocationDigest ? { abortSignal: this._abortController.signal, invocationDigest } : { abortSignal: this._abortController.signal };
-          for await (const chunk of engine.query(prompt, queryOptions)) {
-            if (chunk.type === "text" && chunk.content) candidateChunks.push(chunk.content);
-            else if (chunk.type === "metadata" && chunk.data?.attestation) {
-              runtimeAttestation = chunk.data.attestation;
-              attestationCount++;
-            } else if (chunk.type === "toolBatch") {
-              nativeToolBatch = chunk;
-              nativeToolBatchCount++;
-            } else if (chunk.type === "error") throw normalizeGovernedAnswerFailure(chunk.error, "unknown");
+          try {
+            for await (const chunk of engine.query(prompt, queryOptions)) {
+              if (chunk.type === "text" && chunk.content) candidateChunks.push(chunk.content);
+              else if (chunk.type === "metadata" && chunk.data?.attestation) {
+                runtimeAttestation = chunk.data.attestation;
+                attestationCount++;
+              } else if (chunk.type === "toolBatch") {
+                nativeToolBatch = chunk;
+                nativeToolBatchCount++;
+              } else if (chunk.type === "error") {
+                throw normalizeGovernedAnswerFailure(
+                  chunk.error,
+                  "provider_engine",
+                  null,
+                  null,
+                  null,
+                  null,
+                  null,
+                  "query"
+                );
+              }
+            }
+          } catch (error40) {
+            throw normalizeGovernedAnswerFailure(
+              error40,
+              "provider_engine",
+              null,
+              null,
+              null,
+              null,
+              null,
+              "query"
+            );
           }
           if (hasInvocationDigest) {
             const expectedAttestation = this.governedCodexProfile?.version === "probe.governed-codex-profile/v2" ? "probe.governed-codex-attestation/v3" : "probe.governed-codex-attestation/v2";
             if (attestationCount !== 1 || runtimeAttestation?.version !== expectedAttestation || runtimeAttestation?.executionContext?.source !== "caller" || runtimeAttestation?.executionContext?.invocationDigest !== invocationDigest) {
-              throw new Error("Expected exactly one matching governed invocation attestation");
+              throw governedAnswerFailure(
+                "native_event_grammar",
+                "live_envelope_session",
+                "attestation",
+                null,
+                "invocation_attestation"
+              );
             }
-          } else if (attestationCount !== 1) throw new Error(`Expected exactly one governed runtime attestation; received ${attestationCount}`);
+          } else if (attestationCount !== 1) {
+            throw governedAnswerFailure(
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              "invocation_attestation"
+            );
+          }
           if (this.governedCodexProfile?.version === "probe.governed-codex-profile/v2") {
             if (nativeToolBatchCount !== 1 || !Number.isSafeInteger(nativeToolBatch?.total) || !Array.isArray(nativeToolBatch?.tools) || nativeToolBatch.total !== runtimeAttestation?.observed?.nativeTools?.total || JSON.stringify(nativeToolBatch.tools) !== JSON.stringify(runtimeAttestation?.observed?.nativeTools?.tools)) {
-              throw new Error("Expected exactly one matching governed native capability aggregate");
+              throw governedAnswerFailure(
+                "native_event_grammar",
+                "live_envelope_session",
+                "attestation",
+                null,
+                "native_capability_aggregate"
+              );
             }
             for (const toolEvent of nativeToolBatch.tools) this.events.emit("toolCall", toolEvent);
-          } else if (nativeToolBatchCount !== 0) throw new Error("Unexpected governed native capability aggregate");
+          } else if (nativeToolBatchCount !== 0) {
+            throw governedAnswerFailure(
+              "native_event_grammar",
+              "live_envelope_session",
+              "attestation",
+              null,
+              "native_capability_aggregate"
+            );
+          }
           const validation = validateJsonResponse(candidateChunks.join(""), { debug: this.debug, schema });
           if (!validation.isValid) throw governedSchemaResultValidationFailure(validation);
           if (hasResultIdentity) {
@@ -111174,14 +111328,23 @@ You are working with a workspace. Available paths: ${workspaceDesc}
           }
           return { data: validation.parsed, runtimeAttestation };
         } catch (error40) {
-          answerFailure = normalizeGovernedAnswerFailure(error40, "unknown");
+          answerFailure = normalizeGovernedAnswerFailure(error40, "internal_contract");
           throw answerFailure;
         } finally {
           if (engine) {
             try {
               await engine.close();
-            } catch {
-              if (!answerFailure) throw governedAnswerFailure("unknown");
+            } catch (error40) {
+              if (!answerFailure) throw normalizeGovernedAnswerFailure(
+                error40,
+                "provider_engine",
+                null,
+                null,
+                null,
+                null,
+                null,
+                "close"
+              );
             }
           }
         }