@qduc/term2 0.21.0 → 0.22.1

package/dist/services/retry/provider-failure-classification.js

@@ -34,6 +34,51 @@ export function classifyProviderFailure(error) {
         retryable: errorKind !== 'cancelled' && errorKind !== 'authentication' && retryable,
     };
 }
+/**
+ * Cancellation classification is intentionally stricter at logging/UI
+ * boundaries than at retry policy boundaries. A provider error can mention
+ * "abort" while still being a real failure (for example, a failure that races
+ * a user stop), so those boundaries require an explicit abort marker as well
+ * as the shared typed classification.
+ */
+export function isClassifiedCancellation(error) {
+    return classifyProviderFailure(error).errorKind === 'cancelled' && hasExplicitCancellationMarker(error);
+}
+/**
+ * Returns true only when an error tree contains an explicit cancellation and
+ * no concrete provider or transport failure. `classifyProviderFailure` keeps
+ * its broad abort-like precedence for retry policy; this stricter predicate is
+ * for boundaries where hiding a real failure would be worse than showing an
+ * abort from the same race.
+ */
+export function hasExplicitCancellationMarker(error) {
+    const result = inspectCancellationTree(error, new Set());
+    return result.hasCancellation && !result.hasFailure;
+}
+function inspectCancellationTree(error, seen) {
+    if (!error || typeof error !== 'object' || seen.has(error)) {
+        return { hasCancellation: false, hasFailure: false };
+    }
+    seen.add(error);
+    const value = error;
+    let hasCancellation = value.name === 'AbortError' || value.code === 'ABORT_ERR';
+    let hasFailure = isConcreteProviderFailure(value);
+    const children = [...(Array.isArray(value.errors) ? value.errors : []), value.cause];
+    for (const child of children) {
+        const childResult = inspectCancellationTree(child, seen);
+        hasCancellation ||= childResult.hasCancellation;
+        hasFailure ||= childResult.hasFailure;
+    }
+    return { hasCancellation, hasFailure };
+}
+function isConcreteProviderFailure(value) {
+    const statusRaw = value.status ?? value.statusCode;
+    const status = typeof statusRaw === 'number' ? statusRaw : Number(statusRaw);
+    return ((Number.isInteger(status) && status >= 400) ||
+        value instanceof OpenRouterError ||
+        value instanceof OpenAICompatibleError ||
+        isNetworkProtocolError(value));
+}
 function findSafeField(error, field) {
     const seen = new Set();
     const visit = (value) => {

package/dist/services/retry/provider-failure-classification.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-failure-classification.js","sourceRoot":"","sources":["../../../source/services/retry/provider-failure-classification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAa5E,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAa,CAAC,MAAM,IAAK,KAAa,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,SAAS,GAAwB,gBAAgB,CAAC,KAAK,CAAC;QAC5D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAClC,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAC3C,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS;wBACT,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,CAAC;wBACvC,KAAK,YAAY,eAAe;wBAChC,KAAK,YAAY,qBAAqB;wBACxC,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;QAC7B,SAAS,EAAE,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,gBAAgB,IAAI,SAAS;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAW,EAAE;QACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"provider-failure-classification.js","sourceRoot":"","sources":["../../../source/services/retry/provider-failure-classification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,2CAA2C,CAAC;AACnG,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AACpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAa5E,mEAAmE;AACnE,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAa,CAAC,MAAM,IAAK,KAAa,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtH,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACtF,MAAM,SAAS,GAAwB,gBAAgB,CAAC,KAAK,CAAC;QAC5D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAClC,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAC3C,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,SAAS;wBACT,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,CAAC;wBACvC,KAAK,YAAY,eAAe;wBAChC,KAAK,YAAY,qBAAqB;wBACxC,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,SAAS;QACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;QAC7B,SAAS,EAAE,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,gBAAgB,IAAI,SAAS;KACpF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,uBAAuB,CAAC,KAAK,CAAC,CAAC,SAAS,KAAK,WAAW,IAAI,6BAA6B,CAAC,KAAK,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,EAAE,IAAI,GAAG,EAAW,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,eAAe,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;AACtD,CAAC;AAOD,SAAS,uBAAuB,CAAC,KAAc,EAAE,IAAkB;IACjE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEhB,MAAM,KAAK,GAAG,KAAgC,CAAC;IAC/C,IAAI,eAAe,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC;IAChF,IAAI,UAAU,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACrF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACzD,eAAe,KAAK,WAAW,CAAC,eAAe,CAAC;QAChD,UAAU,KAAK,WAAW,CAAC,UAAU,CAAC;IACxC,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,yBAAyB,CAAC,KAA8B;IAC/D,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7E,OAAO,CACL,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,GAAG,CAAC;QAC3C,KAAK,YAAY,eAAe;QAChC,KAAK,YAAY,qBAAqB;QACtC,sBAAsB,CAAC,KAAK,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAW,EAAE;QACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5D,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACzG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;QACxC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC"}

package/dist/services/retry/retry-recovery-budget.d.ts

@@ -1,7 +1,7 @@
 /**
  * One bounded capability shared by provider transport retries and session
  * recovery. The owner is deliberately the retry/session layer: providers can
- * consume claims, but cannot extend or reset the envelope.
+ * consume claims; only accepted terminal model completion ends an episode.
  */
 export declare const RETRY_RECOVERY_LIMITS: {
     readonly maxRecoveryTimeMs: 90000;
@@ -14,6 +14,21 @@ export type RetryRecoveryBudgetOptions = {
     maxPhysicalAttempts?: number;
     maxAutomaticReplays?: number;
 };
+export type RetryRecoveryBudgetSnapshot = {
+    physicalAttempts: number;
+    maxPhysicalAttempts: number;
+    automaticReplays: number;
+    maxAutomaticReplays: number;
+    elapsedMs: number;
+    maxRecoveryTimeMs: number;
+    deadlineExceeded: boolean;
+};
+export type RetryRecoveryAdmission = RetryRecoveryBudgetSnapshot & {
+    automaticReplayRequired: boolean;
+    automaticReplayAllowed: boolean;
+    physicalAttemptAllowed: boolean;
+    admitted: boolean;
+};
 export declare class RetryRecoveryBudget {
     #private;
     readonly maxRecoveryTimeMs: number;
@@ -26,7 +41,17 @@ export declare class RetryRecoveryBudget {
     get elapsedMs(): number;
     /** Starts the recovery clock only after a retryable failure is observed. */
     noteRetryableFailure(): void;
+    /** Only the run-loop terminal-response owner may end a recovery episode. */
+    noteModelResponseCompleted(): void;
     get deadlineExceeded(): boolean;
+    /**
+     * Return the complete non-secret state used by a recovery admission gate.
+     * Recovery decisions are otherwise difficult to explain from logs because
+     * claims mutate the counters before the next dispatch is made.
+     */
+    describeAdmission(options: {
+        automaticReplayRequired: boolean;
+    }): RetryRecoveryAdmission;
     /**
      * Claim one physical dispatch made because recovery is in progress.
      * Ordinary first attempts and successful tool-loop continuations are not

package/dist/services/retry/retry-recovery-budget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"retry-recovery-budget.d.ts","sourceRoot":"","sources":["../../../source/services/retry/retry-recovery-budget.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;aAChC,iBAAiB,EAAE,KAAM;aACzB,mBAAmB,EAAE,CAAC;aACtB,mBAAmB,EAAE,CAAC;CACd,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,qBAAa,mBAAmB;;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAMrC,YAAY,OAAO,GAAE,0BAA+B,EAKnD;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,4EAA4E;IAC5E,oBAAoB,IAAI,IAAI,CAE3B;IAED,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAI9B;IAED,uEAAuE;IACvE,oBAAoB,IAAI,OAAO,CAI9B;IAED,WAAW,IAAI,MAAM,GAAG,SAAS,CAGhC;CACF;AAED;;;;;GAKG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAExB,YAAY,KAAK,CAAC,EAAE,OAAO,EAI1B;CACF;AAED,eAAO,MAAM,mCAAmC,UAAW,OAAO,KAAG,KAAK,IAAI,iCAC1B,CAAC"}
+{"version":3,"file":"retry-recovery-budget.d.ts","sourceRoot":"","sources":["../../../source/services/retry/retry-recovery-budget.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;aAChC,iBAAiB,EAAE,KAAM;aACzB,mBAAmB,EAAE,CAAC;aACtB,mBAAmB,EAAE,CAAC;CACd,CAAC;AAEX,MAAM,MAAM,0BAA0B,GAAG;IACvC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG,2BAA2B,GAAG;IACjE,uBAAuB,EAAE,OAAO,CAAC;IACjC,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,OAAO,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,qBAAa,mBAAmB;;IAC9B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IAMrC,YAAY,OAAO,GAAE,0BAA+B,EAKnD;IAED,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,4EAA4E;IAC5E,oBAAoB,IAAI,IAAI,CAE3B;IAED,4EAA4E;IAC5E,0BAA0B,IAAI,IAAI,CAIjC;IAED,IAAI,gBAAgB,IAAI,OAAO,CAE9B;IAED;;;;OAIG;IACH,iBAAiB,CAAC,OAAO,EAAE;QAAE,uBAAuB,EAAE,OAAO,CAAA;KAAE,GAAG,sBAAsB,CAsBvF;IAED;;;;OAIG;IACH,oBAAoB,IAAI,OAAO,CAI9B;IAED,uEAAuE;IACvE,oBAAoB,IAAI,OAAO,CAI9B;IAED,WAAW,IAAI,MAAM,GAAG,SAAS,CAGhC;CACF;AAED;;;;;GAKG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;IAC1D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IAExB,YAAY,KAAK,CAAC,EAAE,OAAO,EAI1B;CACF;AAED,eAAO,MAAM,mCAAmC,UAAW,OAAO,KAAG,KAAK,IAAI,iCAC1B,CAAC"}

package/dist/services/retry/retry-recovery-budget.js

@@ -1,7 +1,7 @@
 /**
  * One bounded capability shared by provider transport retries and session
  * recovery. The owner is deliberately the retry/session layer: providers can
- * consume claims, but cannot extend or reset the envelope.
+ * consume claims; only accepted terminal model completion ends an episode.
  */
 export const RETRY_RECOVERY_LIMITS = {
     maxRecoveryTimeMs: 90_000,
@@ -39,9 +39,41 @@ export class RetryRecoveryBudget {
         if (this.#startedAt === undefined)
             this.#startedAt = this.#now();
     }
+    /** Only the run-loop terminal-response owner may end a recovery episode. */
+    noteModelResponseCompleted() {
+        this.#startedAt = undefined;
+        this.#physicalAttempts = 0;
+        this.#automaticReplays = 0;
+    }
     get deadlineExceeded() {
         return this.#startedAt !== undefined && this.elapsedMs >= this.maxRecoveryTimeMs;
     }
+    /**
+     * Return the complete non-secret state used by a recovery admission gate.
+     * Recovery decisions are otherwise difficult to explain from logs because
+     * claims mutate the counters before the next dispatch is made.
+     */
+    describeAdmission(options) {
+        const elapsedMs = this.elapsedMs;
+        const snapshot = {
+            physicalAttempts: this.physicalAttempts,
+            maxPhysicalAttempts: this.maxPhysicalAttempts,
+            automaticReplays: this.automaticReplays,
+            maxAutomaticReplays: this.maxAutomaticReplays,
+            elapsedMs,
+            maxRecoveryTimeMs: this.maxRecoveryTimeMs,
+            deadlineExceeded: this.#startedAt !== undefined && elapsedMs >= this.maxRecoveryTimeMs,
+        };
+        const physicalAttemptAllowed = snapshot.physicalAttempts < snapshot.maxPhysicalAttempts && !snapshot.deadlineExceeded;
+        const automaticReplayAllowed = snapshot.automaticReplays < snapshot.maxAutomaticReplays && !snapshot.deadlineExceeded;
+        return {
+            ...snapshot,
+            automaticReplayRequired: options.automaticReplayRequired,
+            automaticReplayAllowed,
+            physicalAttemptAllowed,
+            admitted: physicalAttemptAllowed && (!options.automaticReplayRequired || automaticReplayAllowed),
+        };
+    }
     /**
      * Claim one physical dispatch made because recovery is in progress.
      * Ordinary first attempts and successful tool-loop continuations are not

package/dist/services/retry/retry-recovery-budget.js.map

@@ -1 +1 @@
-{"version":3,"file":"retry-recovery-budget.js","sourceRoot":"","sources":["../../../source/services/retry/retry-recovery-budget.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,CAAC;CACd,CAAC;AASX,MAAM,OAAO,mBAAmB;IACrB,iBAAiB,CAAS;IAC1B,mBAAmB,CAAS;IAC5B,mBAAmB,CAAS;IAC5B,IAAI,CAAe;IAC5B,UAAU,CAAqB;IAC/B,iBAAiB,GAAG,CAAC,CAAC;IACtB,iBAAiB,GAAG,CAAC,CAAC;IAEtB,YAAY,OAAO,GAA+B,EAAE;QAClD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qBAAqB,CAAC,iBAAiB,CAAC;QAC9F,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,mBAAmB,CAAC;QACpG,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,mBAAmB,CAAC;IACtG,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;QAClB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC9F,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,oBAAoB;QAClB,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC9F,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IACjD,KAAK,CAAU;IAExB,YAAY,KAAe;QACzB,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,KAAc,EAA8C,EAAE,CAChH,KAAK,YAAY,iCAAiC,CAAC"}
+{"version":3,"file":"retry-recovery-budget.js","sourceRoot":"","sources":["../../../source/services/retry/retry-recovery-budget.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,iBAAiB,EAAE,MAAM;IACzB,mBAAmB,EAAE,CAAC;IACtB,mBAAmB,EAAE,CAAC;CACd,CAAC;AA0BX,MAAM,OAAO,mBAAmB;IACrB,iBAAiB,CAAS;IAC1B,mBAAmB,CAAS;IAC5B,mBAAmB,CAAS;IAC5B,IAAI,CAAe;IAC5B,UAAU,CAAqB;IAC/B,iBAAiB,GAAG,CAAC,CAAC;IACtB,iBAAiB,GAAG,CAAC,CAAC;IAEtB,YAAY,OAAO,GAA+B,EAAE;QAClD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,qBAAqB,CAAC,iBAAiB,CAAC;QAC9F,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,mBAAmB,CAAC;QACpG,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,qBAAqB,CAAC,mBAAmB,CAAC;IACtG,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACxF,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;QAClB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,4EAA4E;IAC5E,0BAA0B;QACxB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,iBAAiB,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACH,iBAAiB,CAAC,OAA6C;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,QAAQ,GAAgC;YAC5C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;YAC7C,SAAS;YACT,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,gBAAgB,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,IAAI,IAAI,CAAC,iBAAiB;SACvF,CAAC;QACF,MAAM,sBAAsB,GAC1B,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACzF,MAAM,sBAAsB,GAC1B,QAAQ,CAAC,gBAAgB,GAAG,QAAQ,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACzF,OAAO;YACL,GAAG,QAAQ;YACX,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;YACxD,sBAAsB;YACtB,sBAAsB;YACtB,QAAQ,EAAE,sBAAsB,IAAI,CAAC,CAAC,OAAO,CAAC,uBAAuB,IAAI,sBAAsB,CAAC;SACjG,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,oBAAoB;QAClB,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC9F,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,oBAAoB;QAClB,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAC9F,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IACjD,KAAK,CAAU;IAExB,YAAY,KAAe;QACzB,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,KAAc,EAA8C,EAAE,CAChH,KAAK,YAAY,iCAAiC,CAAC"}

package/dist/services/sandboxed-code-host/host-types.d.ts

@@ -0,0 +1,135 @@
+import type { JsonValue } from '../agent-runtime/workflow/workflow-types.js';
+export type { JsonValue };
+/**
+ * Failure codes the host itself can produce. Capability handlers reuse the same
+ * union so a fatal capability outcome and a host failure are indistinguishable
+ * to the caller, which is what lets `run_agent_workflow` keep its existing
+ * error contract while sharing this engine with `run_code`.
+ */
+export type HostErrorCode = 'syntax_error' | 'runtime_error' | 'timeout' | 'deadline' | 'cancelled' | 'limit_exceeded' | 'approval_required' | 'sandbox_unavailable' | 'invalid_output' | 'code_too_large';
+export interface HostError {
+    code: HostErrorCode;
+    message: string;
+}
+export type HostResult = {
+    ok: true;
+    output: JsonValue;
+    voidOutput?: boolean;
+} | {
+    ok: false;
+    error: HostError;
+};
+/**
+ * How a capability appears to the script.
+ *
+ * - `factory`: `name(config).run(input)` — the shape `run_agent_workflow` uses.
+ * - `namespace`: `name.<member>(params)` — the shape `run_code` uses. A member
+ *   speaks an `{ ok, result | error }` envelope: a failed call rejects inside
+ *   the script rather than resolving to an error value.
+ *
+ * Only these two shapes exist, and both live verbatim in the worker template;
+ * generating a capability injects its *name* (and member names), never code.
+ */
+export type CapabilityKind = 'factory' | 'namespace';
+/** The generated part of the worker source: names only. */
+export type CapabilityBinding = {
+    name: string;
+    kind: 'factory';
+} | {
+    name: string;
+    kind: 'namespace';
+    members: readonly string[];
+};
+/** A call that passed `prepare` and is waiting to be invoked. */
+export interface CapabilityCallContext {
+    /** One-based admission order, stable across concurrency. */
+    readonly callId: number;
+    /** Worker-local request id from the inbound `.run` message. Not `callId`. */
+    readonly requestId: string;
+    readonly signal: AbortSignal;
+}
+/**
+ * What a capability does with one call. `result` is delivered to the script;
+ * `fail` aborts the whole run with that error, which is how the workflow
+ * capability reports a prohibited tool.
+ */
+export type CapabilityOutcome = {
+    kind: 'result';
+    result: JsonValue;
+} | {
+    kind: 'fail';
+    code: HostErrorCode;
+    message: string;
+};
+export interface CapabilityLimits {
+    /** Total calls one run may admit for this capability. */
+    maxCalls: number;
+    /** How many admitted calls may be in flight at once in the default lane. */
+    maxConcurrency: number;
+    /** Message used when the budget is exhausted and the run is aborted. */
+    limitExceededMessage: string;
+}
+export interface CapabilityHandler<Prepared = unknown> {
+    /** How the capability is bound inside the sandbox. */
+    binding: CapabilityBinding;
+    limits: CapabilityLimits;
+    /**
+     * Validates one raw request before it consumes budget or a permit. Returning
+     * an outcome short-circuits; returning a value hands it to {@link invoke}.
+     */
+    prepare(payload: Record<string, unknown>): Promise<Prepared | CapabilityOutcome> | Prepared | CapabilityOutcome;
+    /** Called once the call has been admitted and holds a concurrency permit. */
+    invoke(prepared: Prepared, context: CapabilityCallContext): Promise<CapabilityOutcome>;
+    /** Fires when a call is admitted, before it runs. Used for run bookkeeping. */
+    onAdmitted?(prepared: Prepared, context: CapabilityCallContext): void;
+    /**
+     * Nested-approval wait started. The host keys its waiting-set by
+     * {@link CapabilityCallContext.requestId}. Missing {@link onResumed} is work.
+     */
+    onWaiting?(context: CapabilityCallContext): void;
+    /** Nested-approval wait ended. Pair with {@link onWaiting}. */
+    onResumed?(context: CapabilityCallContext): void;
+    /**
+     * Which permit pool the call takes. `serial` is a strict FIFO lane of one,
+     * for calls that mutate shared state (the run loop's non-`parallelSafe`
+     * rule); `default` is bounded by {@link CapabilityLimits.maxConcurrency}.
+     * Omitted means every call is in the default lane.
+     */
+    lane?(prepared: Prepared): 'serial' | 'default';
+    /**
+     * What to do with a call that exceeds {@link CapabilityLimits.maxCalls}.
+     * Omitting it aborts the run with `limit_exceeded`; a capability that would
+     * rather let the script keep the work it has already done returns a result
+     * in its own envelope instead. The usage argument describes calls admitted
+     * before the rejected call; `prepared` is the exact already-validated call
+     * rejected by the budget and does not expose worker or host objects.
+     */
+    overBudget?(usage: {
+        usedCalls: number;
+        maxCalls: number;
+    }, prepared: Prepared): CapabilityOutcome;
+}
+export interface HostLimits {
+    timeoutMs: number;
+    maxCodeBytes: number;
+    maxOutputBytes: number;
+    maxConsoleBytes: number;
+}
+export interface HostRunInput {
+    code: string;
+    capabilities: Record<string, CapabilityHandler<any>>;
+    limits: HostLimits;
+    signal?: AbortSignal;
+    /** Noun used in host-generated messages, e.g. 'Workflow' or 'Script'. */
+    subject: string;
+    /** When set, code that returns nothing completes with `null` rather than failing. */
+    allowVoidOutput?: boolean;
+    onConsole?: (values: JsonValue[]) => void;
+    /** Test seam; defaults to a worker built from `capabilities`. */
+    workerFactory?: (code: string, syncTimeoutMs: number) => import('node:worker_threads').Worker;
+}
+export interface SandboxedCodeHost {
+    run(input: HostRunInput): Promise<HostResult>;
+}
+export declare function isCapabilityOutcome(value: unknown): value is CapabilityOutcome;
+//# sourceMappingURL=host-types.d.ts.map

package/dist/services/sandboxed-code-host/host-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-types.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6CAA6C,CAAC;AAE7E,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,SAAS,GACT,UAAU,GACV,WAAW,GACX,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,gBAAgB,GAChB,gBAAgB,CAAC;AAErB,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,WAAW,CAAC;AAErD,2DAA2D;AAC3D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEpE,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB,CAAC,QAAQ,GAAG,OAAO;IACnD,sDAAsD;IACtD,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,iBAAiB,CAAC,GAAG,QAAQ,GAAG,iBAAiB,CAAC;IAChH,6EAA6E;IAC7E,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACvF,+EAA+E;IAC/E,UAAU,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACtE;;;OAGG;IACH,SAAS,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACjD,+DAA+D;IAC/D,SAAS,CAAC,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CAAC;IACjD;;;;;OAKG;IACH,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,iBAAiB,CAAC;CACpG;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,IAAI,CAAC;IAC1C,iEAAiE;IACjE,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,qBAAqB,EAAE,MAAM,CAAC;CAC/F;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC/C;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAM9E"}

package/dist/services/sandboxed-code-host/host-types.js

@@ -0,0 +1,6 @@
+export function isCapabilityOutcome(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        (value.kind === 'result' || value.kind === 'fail'));
+}
+//# sourceMappingURL=host-types.js.map

package/dist/services/sandboxed-code-host/host-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-types.js","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-types.ts"],"names":[],"mappings":"AAyIA,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAE,KAA2B,CAAC,IAAI,KAAK,QAAQ,IAAK,KAA2B,CAAC,IAAI,KAAK,MAAM,CAAC,CACjG,CAAC;AACJ,CAAC"}

package/dist/services/sandboxed-code-host/host-worker.d.ts

@@ -0,0 +1,9 @@
+import type { CapabilityBinding } from './host-types.js';
+/**
+ * Builds the worker source for a set of capabilities.
+ *
+ * Only names reach the template, and they go through `JSON.stringify`, so a
+ * capability name can never become executable source.
+ */
+export declare function buildWorkerSource(bindings: readonly CapabilityBinding[]): string;
+//# sourceMappingURL=host-worker.d.ts.map

package/dist/services/sandboxed-code-host/host-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-worker.d.ts","sourceRoot":"","sources":["../../../source/services/sandboxed-code-host/host-worker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAwVzD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAEhF"}