@reticlehq/server 2.14.0 → 3.2.0

package/dist/tools/lineage-tools.d.ts

@@ -1,14 +0,0 @@
-/**
- * `reticle_lineage` — where a runtime value came from.
- *
- * When a verdict is `no`, or a contradiction fires, the next question is always the same. Today an
- * agent answers it by hand: `reticle_state` for the value, `reticle_network` for the requests,
- * `reticle_observe` for the window, then correlates the three itself — spending tokens and judgement
- * on a join the daemon can do once from data it already holds.
- *
- * READ-ONLY BY CONSTRUCTION. It produces no verdict, so it is registered in `TOOLS` and deliberately
- * NOT in the verification set, and nothing on an assert path reaches it. The decision logic lives in
- * `events/lineage.ts` and is where the honesty rules are argued; this file is the surface.
- */
-import type { ToolDef } from './tools.js';
-export declare const LINEAGE_TOOLS: ToolDef[];

package/dist/tools/lineage-tools.js

@@ -1,64 +0,0 @@
-/**
- * `reticle_lineage` — where a runtime value came from.
- *
- * When a verdict is `no`, or a contradiction fires, the next question is always the same. Today an
- * agent answers it by hand: `reticle_state` for the value, `reticle_network` for the requests,
- * `reticle_observe` for the window, then correlates the three itself — spending tokens and judgement
- * on a join the daemon can do once from data it already holds.
- *
- * READ-ONLY BY CONSTRUCTION. It produces no verdict, so it is registered in `TOOLS` and deliberately
- * NOT in the verification set, and nothing on an assert path reaches it. The decision logic lives in
- * `events/lineage.ts` and is where the honesty rules are argued; this file is the surface.
- */
-import { z } from 'zod';
-import { ReticleTool } from './tool-names.js';
-import { traceLineage } from '../events/lineage.js';
-import { asString } from './tools-helpers.js';
-import { cursorSchema } from './numeric-bounds.js';
-export const LINEAGE_TOOLS = [
-    {
-        name: ReticleTool.LINEAGE,
-        example: { path: 'user.profile.name' },
-        description: 'Trace BACKWARDS from a runtime value: which state change set it, which signal preceded that, and which request preceded the signal. Read-only — it draws no verdict and changes nothing. The state change is OBSERVED; every link above it is an INFERENCE from timing and says so in its own text. Where several candidates could explain a link it names ALL of them rather than choosing, because timing alone cannot justify the choice — so a chain here is a place to look, never a proven cause. Use it after a `no` verdict or a contradiction, instead of correlating reticle_state, reticle_network and reticle_observe by hand.',
-        inputSchema: {
-            path: z
-                .string()
-                .describe('The state path to trace, e.g. "user.profile.name". Matched as a substring.'),
-            value: z
-                .string()
-                .optional()
-                .describe('Narrow to the change that set THIS value, when the path changed more than once.'),
-            since: cursorSchema
-                .optional()
-                .describe('Only consider events after this cursor (from an act or observe result).'),
-            ...{},
-        },
-        outputSchema: {
-            found: z
-                .boolean()
-                .describe('False when the path was never seen to change — not the same as an empty chain.'),
-            chain: z
-                .array(z.object({
-                kind: z.string(),
-                text: z.string(),
-                observed: z.boolean(),
-                candidates: z.array(z.string()).optional(),
-            }))
-                .describe('Most recent change first. `observed` is true only for events we hold; every join is false.'),
-            note: z
-                .string()
-                .optional()
-                .describe('Why the chain stops where it does, when it stops early.'),
-        },
-        handler: (deps, args) => {
-            const session = deps.sessions.resolve(asString(args['sessionId']));
-            const since = 'number' === typeof args['since'] ? args['since'] : 0;
-            const path = asString(args['path']) ?? '';
-            const value = asString(args['value']);
-            return Promise.resolve(traceLineage(session.eventsSince(since), {
-                path,
-                ...(value === undefined ? {} : { value }),
-            }));
-        },
-    },
-];

package/dist/tools/merge-tools.d.ts

@@ -1,51 +0,0 @@
-import type { ToolDef } from './tool-kit.js';
-/**
- * Surface consolidation. Tool definitions are re-sent to the model EVERY turn, so the named-def
- * count is a per-turn tax multiplied by loop length. This merges a family of sibling tools
- * (`baseline_save`/`baseline_list`/`diff`) into one action-dispatched tool (`reticle_baseline {action}`)
- * WITHOUT rewriting any handler — each original handler is kept verbatim and selected by `action`, so a
- * merge cannot change behavior, only the advertised shape.
- *
- * The merged input schema is `{ action }` plus the union of the members' fields, each made optional
- * (different actions need different fields). Every handler already narrows its own args, so validation
- * strength is unchanged in practice.
- *
- * TRADEOFF (deliberate): a merged tool carries NO `outputSchema`, because its members return different
- * shapes and one schema cannot describe them. Schema-aware clients lose output validation for merged
- * families. That is why tools whose result contract matters — the 12-tool core hot-set, and hot verbs
- * like flow_replay/flow_verify/flow_heal that return their own documented verdict shapes — are NOT
- * merged. Only sibling families whose value is the capability, not the contract, are consolidated.
- */
-interface MergeSpec {
-    name: string;
-    description: string;
-    /** action value → the original tool whose handler serves it. */
-    actions: Record<string, ToolDef>;
-    /** A concrete call, carried through to the merged def (see ToolDef.example). */
-    example?: Record<string, unknown>;
-}
-/** A merge declared by member NAME, resolved against the assembled tool list. */
-export interface MergePlan {
-    name: string;
-    description: string;
-    /** action value → the existing tool name whose handler serves it. */
-    members: Record<string, string>;
-    /**
-     * A concrete call for the merged tool. Merging discards the members' own examples — the schema is
-     * a union and theirs are per-member — so a merged tool that reaches the core surface has no
-     * example at all unless the plan states one.
-     */
-    example?: Record<string, unknown>;
-}
-/**
- * Apply the consolidation to an assembled tool list: drop each plan's members and each retired name from
- * the advertised surface, and append one action-dispatched tool per plan. Member ToolDefs stay defined in
- * their own modules (handlers untouched) — they simply stop being advertised separately, which is the
- * whole point: the cost is the advertised count, not the code.
- *
- * A plan naming a member that does not exist is a build error, not a silent no-op — a typo would
- * otherwise quietly drop a capability from the surface.
- */
-export declare function applyMerges(tools: readonly ToolDef[], plans: readonly MergePlan[], retired?: readonly string[]): ToolDef[];
-export declare function mergeTools(spec: MergeSpec): ToolDef;
-export {};

package/dist/tools/merge-tools.js

@@ -1,69 +0,0 @@
-import { z } from 'zod';
-/** The union of member input shapes, every field optional so one schema serves every action. */
-function unionShape(actions) {
-    const shape = {};
-    for (const tool of Object.values(actions)) {
-        for (const [key, schema] of Object.entries(tool.inputSchema)) {
-            // First definition wins; siblings share field names/meanings by construction.
-            shape[key] ??= schema.isOptional() ? schema : schema.optional();
-        }
-    }
-    return shape;
-}
-/**
- * Apply the consolidation to an assembled tool list: drop each plan's members and each retired name from
- * the advertised surface, and append one action-dispatched tool per plan. Member ToolDefs stay defined in
- * their own modules (handlers untouched) — they simply stop being advertised separately, which is the
- * whole point: the cost is the advertised count, not the code.
- *
- * A plan naming a member that does not exist is a build error, not a silent no-op — a typo would
- * otherwise quietly drop a capability from the surface.
- */
-export function applyMerges(tools, plans, retired = []) {
-    const byName = new Map(tools.map((t) => [t.name, t]));
-    const consumed = new Set(retired);
-    const merged = [];
-    for (const plan of plans) {
-        const actions = {};
-        for (const [action, memberName] of Object.entries(plan.members)) {
-            const member = byName.get(memberName);
-            if (member === undefined) {
-                throw new Error(`applyMerges(${plan.name}): unknown member tool '${memberName}'`);
-            }
-            actions[action] = member;
-            consumed.add(memberName);
-        }
-        merged.push(mergeTools({
-            name: plan.name,
-            description: plan.description,
-            actions,
-            ...(plan.example === undefined ? {} : { example: plan.example }),
-        }));
-    }
-    return [...tools.filter((t) => !consumed.has(t.name)), ...merged];
-}
-export function mergeTools(spec) {
-    const actionNames = Object.keys(spec.actions);
-    if (0 === actionNames.length)
-        throw new Error(`mergeTools(${spec.name}): no actions`);
-    return {
-        name: spec.name,
-        description: spec.description,
-        ...(spec.example === undefined ? {} : { example: spec.example }),
-        inputSchema: {
-            action: z.enum(actionNames).describe('Which operation to run.'),
-            ...unionShape(spec.actions),
-        },
-        handler: (deps, args) => {
-            const action = args['action'];
-            const chosen = 'string' === typeof action ? spec.actions[action] : undefined;
-            if (chosen === undefined) {
-                return Promise.resolve({
-                    error: `unknown action '${String(action)}' for ${spec.name}`,
-                    expected: actionNames,
-                });
-            }
-            return chosen.handler(deps, args);
-        },
-    };
-}

package/dist/tools/merged-name-redirect.d.ts

@@ -1,26 +0,0 @@
-interface MergedNameRedirect {
-    /** The tool to call instead. */
-    tool: string;
-    /** The action that selects the old behaviour, when the name was merged rather than retired. */
-    action?: string;
-    /** Why there is no direct replacement, for a retired name. */
-    note?: string;
-}
-/** Where `name` went, or undefined when it is a live tool or not ours. */
-export declare function mergedNameRedirect(name: string): MergedNameRedirect | undefined;
-/**
- * Every retired name against the call that replaces it — the tombstones, as one block.
- *
- * The redirect above answers an agent that already guessed the old name. This answers the one that
- * is reading the surface to find out what exists, and is the case a redirect cannot reach: nothing
- * in the catalogue says `reticle_crawl` became `reticle_verify { action: "crawl" }`, so instructions
- * written against an earlier release lead either to an error string or to nothing at all.
- *
- * Derived from the same two declarations as `BY_OLD_NAME`, for the same reason: a hand-written
- * migration list is one merge away from being wrong, and wrong is worse than absent here — the agent
- * retries into it.
- */
-export declare function retiredToolNames(): Readonly<Record<string, string>>;
-/** The sentence handed to an agent that called `name`. */
-export declare function mergedNameMessage(name: string, redirect: MergedNameRedirect): string;
-export {};

package/dist/tools/merged-name-redirect.js

@@ -1,77 +0,0 @@
-/**
- * Where a merged or retired tool's old name went.
- *
- * Twenty-two names exported from `ReticleTool` are no longer tools: `reticle_record_start` became
- * `reticle_record { action: "start" }`, `reticle_diff` became `reticle_baseline { action: "diff" }`,
- * and three were retired outright. Confirmed live in a field sweep, they all answered `unknown tool`
- * — which is the wrong answer, because the capability exists and only moved. An agent trained on an
- * earlier release, or reading the merged tool's own description (which names every action), reaches
- * for exactly these.
- *
- * DERIVED from `MERGE_PLANS` and `RETIRED_FROM_SURFACE` rather than written out, so the next merge is
- * covered the day it lands instead of the day someone notices.
- */
-import { MERGE_PLANS, RETIRED_FROM_SURFACE } from './tools.js';
-import { ReticleTool } from './tool-names.js';
-/** Retired names, and where the capability actually lives now. */
-const RETIRED_NOTE = {
-    [ReticleTool.REFRESH]: {
-        tool: ReticleTool.NAVIGATE,
-        note: 'reloading was absorbed into reticle_navigate { reload: true }',
-    },
-    [ReticleTool.RUN_RECORD]: {
-        tool: ReticleTool.PROJECT,
-        note: 'run outcomes are persisted automatically by reticle_flow_replay; read them with reticle_project',
-    },
-    [ReticleTool.WAIT_READY]: {
-        tool: ReticleTool.SESSIONS,
-        note: 'waiting is implicit — the first live call already blocks until the session is ready',
-    },
-};
-const BY_OLD_NAME = (() => {
-    const map = new Map();
-    for (const plan of MERGE_PLANS) {
-        for (const [action, oldName] of Object.entries(plan.members)) {
-            map.set(oldName, { tool: plan.name, action });
-        }
-    }
-    for (const name of RETIRED_FROM_SURFACE) {
-        const known = RETIRED_NOTE[name];
-        if (known !== undefined)
-            map.set(name, known);
-    }
-    return map;
-})();
-/** Where `name` went, or undefined when it is a live tool or not ours. */
-export function mergedNameRedirect(name) {
-    return BY_OLD_NAME.get(name);
-}
-/**
- * Every retired name against the call that replaces it — the tombstones, as one block.
- *
- * The redirect above answers an agent that already guessed the old name. This answers the one that
- * is reading the surface to find out what exists, and is the case a redirect cannot reach: nothing
- * in the catalogue says `reticle_crawl` became `reticle_verify { action: "crawl" }`, so instructions
- * written against an earlier release lead either to an error string or to nothing at all.
- *
- * Derived from the same two declarations as `BY_OLD_NAME`, for the same reason: a hand-written
- * migration list is one merge away from being wrong, and wrong is worse than absent here — the agent
- * retries into it.
- */
-export function retiredToolNames() {
-    const tombstones = {};
-    for (const [old, redirect] of BY_OLD_NAME) {
-        tombstones[old] =
-            redirect.action === undefined
-                ? `retired; ${redirect.note ?? `use ${redirect.tool}`}`
-                : `retired; use ${redirect.tool} { action: "${redirect.action}" }`;
-    }
-    return tombstones;
-}
-/** The sentence handed to an agent that called `name`. */
-export function mergedNameMessage(name, redirect) {
-    return redirect.action === undefined
-        ? `${name} no longer exists — ${redirect.note ?? `use ${redirect.tool}`}.`
-        : `${name} was merged into ${redirect.tool}. Call ${redirect.tool} { action: "${redirect.action}", ... } — ` +
-            `through reticle_run if it is not advertised under this profile.`;
-}

package/dist/tools/navigate-arrival.d.ts

@@ -1,68 +0,0 @@
-/**
- * Wait, briefly, for the SDK to reconnect after a navigation — so `confirmed` can mean something.
- *
- * `window.location.assign(url)` destroys the SDK that would report on the new document, so the
- * navigation itself cannot be confirmed from inside the page. But the SDK reconnects TO THE DAEMON,
- * which makes the daemon the only party that can see arrival happen. Before this, it did not look,
- * and told the agent to poll `reticle_sessions` instead — a tool call on every navigation, on the
- * least reliable tool we ship.
- *
- * Bounded and best-effort by construction: a navigation to a page that is not instrumented, or not
- * there at all, must still return promptly with `confirmed:false` rather than hanging. The clock and
- * the sleep are injected so this is testable without waiting on a real one.
- *
- * The bound is the CALLER'S to set. It was a fixed 5s that `reticle_navigate` did not expose, and a
- * Nuxt SPA reattaching under HMR was measured coming back in 30–60s — so every navigation to it
- * answered `confirmed:false` while the app was still on its way, and nothing the agent could pass
- * would make the daemon wait. `assert` / `wait_for` / `act_and_wait` all spend the caller's
- * `timeout_ms` (resolve-within.ts); this is the same budget applied to the same wait.
- */
-import type { SessionManager } from '../session/session-manager.js';
-import type { NavigateArrival } from './navigate-result.js';
-/**
- * The default when the caller gives no `timeout_ms`: long enough for a dev server to serve a page
- * and the SDK to dial back; short enough to not hang. A caller who knows the app is slower says so.
- */
-export declare const ARRIVAL_TIMEOUT_MS = 5000;
-/**
- * Which session an arrival may be attributed to.
- *
- * Arrival means a session is at the target BECAUSE OF THIS NAVIGATION. The scan had no notion of
- * that: it returned the first session whose page matched, whoever it belonged to. A stale row parked
- * on the origin — in the field report, one belonging to a different app that had previously held the
- * same port — therefore answered for a navigation it had nothing to do with, and `reticle_navigate`
- * reported ITS id as the session the caller had arrived at. Targeting was never wrong; the result
- * was (#785).
- *
- * `sessions.all()` is Map insertion order, so the older stale row is scanned FIRST. That made the
- * wrong id the likely answer rather than a coin flip.
- */
-export interface ArrivalScope {
-    /**
-     * The session the navigation was dispatched to.
-     *
-     * Exempt from the exclusion below, because it is legitimately at the target both before and after
-     * a navigation that keeps the document — a reload, or a same-page route change. Excluding it would
-     * report `confirmed: false` for the navigations most likely to have worked.
-     */
-    navigatedId: string;
-    /** Sessions already on the target BEFORE dispatch. They cannot be evidence of this arrival. */
-    priorIds: ReadonlySet<string>;
-}
-/**
- * The sessions already on `target` — the set `ArrivalScope.priorIds` is built from, sampled before
- * the navigation is dispatched.
- *
- * Shares `samePage` with the arrival scan on purpose: "was it already there" and "is it there now"
- * are the same question asked at two moments, and two spellings of it would eventually disagree.
- */
-export declare function idsAtTarget(sessions: SessionManager, target: string): ReadonlySet<string>;
-export interface ArrivalClock {
-    now: () => number;
-    sleep: (ms: number) => Promise<void>;
-}
-/**
- * Poll until a session is present at `target`, or the budget runs out. Returns `null` on timeout —
- * never throws, because a failure to confirm is a legitimate answer, not an error.
- */
-export declare function awaitArrival(sessions: SessionManager, target: string, scope: ArrivalScope, timeoutMs?: number, clock?: ArrivalClock): Promise<NavigateArrival | null>;

package/dist/tools/numeric-bounds.d.ts

@@ -1,89 +0,0 @@
-/**
- * Shared bounds for numeric TOOL INPUTS.
- *
- * An unknown parameter is refused with "They were NOT applied — a result computed without them
- * would look like an answer." A known parameter carrying a value the code cannot honour is the
- * same failure: `reticle_state { depth: -5 }` used to return the full unscoped store, because
- * `capDepth` treats a negative budget as "no cap". The agent cannot tell a bound it asked for
- * from a bound that was dropped.
- *
- * A single rule for every number would be wrong (`since: 0` is a real cursor; `timeout_ms: 0`
- * on assert means evaluate now; `threshold` is a 0–1 ratio). Each helper below is one policy,
- * with the sentence for why that bound and not another.
- */
-import { z } from 'zod';
-/**
- * Hard cap on "return the first N". The ring buffer holds this many events; asking for a billion
- * cannot be honoured from memory we do not keep, and would look like a complete listing.
- */
-export declare const MAX_RESULT_COUNT: 2000;
-/**
- * Hard cap on a numeric millisecond argument that does NOT block the caller's request.
- * `timeout_ms: 0` stays legal — it means evaluate once, do not wait.
- */
-export declare const MAX_TIMEOUT_MS = 120000;
-export declare const MAX_BLOCKING_WAIT_MS: number;
-/**
- * `capDepth` at this many levels is already past any store an agent can read.
- *
- * Not lower: `numeric-args-are-bounded.test.ts` pins depth 50 as legal, because a large depth is a
- * SCOPE choice and not an error. A ceiling that refuses it would turn a working call into a refusal
- * in the name of bounding one that never worked.
- */
-export declare const MAX_STATE_DEPTH = 256;
-/** Scroll-to-find steps. Default is 20; hundreds is searching, thousands is a hang. */
-export declare const MAX_SCROLLS = 200;
-/** Viewport CSS px — matches the clamp the handler already applied, now as a refusal. */
-export declare const MIN_VIEWPORT_PX = 64;
-export declare const MAX_VIEWPORT_PX = 10000;
-/**
- * A page cursor. 0 is the start of the buffer, so `.positive()` would refuse a legitimate first
- * page. Negative is not a cursor.
- */
-export declare const cursorSchema: z.ZodNumber;
-/**
- * A wait budget in ms. 0 means evaluate now (documented on assert). Negative cannot be honoured.
- */
-export declare const timeoutMsSchema: z.ZodNumber;
-/**
- * A count / cap. 0 means "return none", which is a real request. Negative is not.
- * Capped at the ring-buffer size so a `limit: 1e9` cannot pretend the buffer is larger than it is.
- */
-export declare const countSchema: z.ZodNumber;
-/**
- * Store projection depth. Negative used to mean "no cap" inside `capDepth`, which is how
- * `depth: -5` silently returned the full store — that is the defect this bound closes.
- *
- * 0 stays REFUSED, which is the policy already on the surface (a zero-level read is not a read).
- * `capDepth(v, 0)` does return a size marker, so accepting it would be defensible — but that is a
- * change to what the tool answers, not a bound on what it cannot honour, and it belongs in its own
- * change with its own reason.
- */
-export declare const depthSchema: z.ZodNumber;
-/**
- * Pixel-diff ratios (`threshold`, `maxRatio`). pixelmatch's threshold and our pass ratio are both
- * 0..1; `.int()` would refuse 0.01.
- */
-export declare const ratioSchema: z.ZodNumber;
-/** HTTP status on a mock or a filter. */
-export declare const httpStatusSchema: z.ZodNumber;
-/** Viewport CSS px. `.int()` alone still accepted 5 and 999999, then the handler silently clamped. */
-export declare const viewportPxSchema: z.ZodNumber;
-/** Crawl / scroll step budgets. 0 is a documented no-op on crawl ("raise it to crawl at all"). */
-export declare const stepCountSchema: z.ZodNumber;
-export declare const scrollCountSchema: z.ZodNumber;
-export declare const advanceMsSchema: z.ZodNumber;
-export declare const idleMsSchema: z.ZodNumber;
-/** Delay before a mocked response. 0 is immediate. */
-export declare const delayMsSchema: z.ZodNumber;
-/**
- * Observe lookback. Must be > 0 — a non-positive window used to mint a FUTURE cursor, so the
- * tool returned zero events and looked like a quiet page. Capped so `window_ms: 1e12` cannot hang.
- */
-export declare const windowMsSchema: z.ZodNumber;
-/**
- * Parallelism for suite replay. 0 (and omit) means sequential. Capped at the session/pool ceiling;
- * asking for a thousand workers cannot be honoured.
- */
-export declare const workerCountSchema: z.ZodNumber;
-export declare const listIndexSchema: z.ZodNumber;

package/dist/tools/numeric-bounds.js

@@ -1,125 +0,0 @@
-/**
- * Shared bounds for numeric TOOL INPUTS.
- *
- * An unknown parameter is refused with "They were NOT applied — a result computed without them
- * would look like an answer." A known parameter carrying a value the code cannot honour is the
- * same failure: `reticle_state { depth: -5 }` used to return the full unscoped store, because
- * `capDepth` treats a negative budget as "no cap". The agent cannot tell a bound it asked for
- * from a bound that was dropped.
- *
- * A single rule for every number would be wrong (`since: 0` is a real cursor; `timeout_ms: 0`
- * on assert means evaluate now; `threshold` is a 0–1 ratio). Each helper below is one policy,
- * with the sentence for why that bound and not another.
- */
-import { z } from 'zod';
-import { RING_BUFFER_DEFAULTS, TRANSPORT_LIMITS } from '@reticlehq/core';
-/**
- * Hard cap on "return the first N". The ring buffer holds this many events; asking for a billion
- * cannot be honoured from memory we do not keep, and would look like a complete listing.
- */
-export const MAX_RESULT_COUNT = RING_BUFFER_DEFAULTS.MAX_EVENTS;
-/**
- * Hard cap on a numeric millisecond argument that does NOT block the caller's request.
- * `timeout_ms: 0` stays legal — it means evaluate once, do not wait.
- */
-export const MAX_TIMEOUT_MS = 120_000;
-/**
- * Hard cap on a wait the CALLER BLOCKS ON, which is a different ceiling from the one above.
- *
- * A blocking wait is bounded by the client's patience, not by ours. The MCP SDK's default request
- * timeout is 60s and clients configure it lower; we advertised 120s. A caller who believed the
- * advertised bound and asked for 90s got a TRANSPORT error at 60s — not a Reticle verdict, not a
- * near-miss diagnosis, nothing to act on. The wait was honoured right up to the point where the
- * only thing that could report it had gone.
- *
- * So the ceiling is set below the SDK default rather than at it: the margin is what lets Reticle's
- * own "timed out, here is the near miss" answer beat the client's abort. A refused argument is a
- * bad ceiling costing one round trip; an accepted one that cannot be delivered costs the drive.
- *
- * This does not make long waits possible, and is not meant to — it makes the ADVERTISED bound one
- * that can actually be honoured. A caller that genuinely needs to outlast this polls: several short
- * waits, each of which returns a verdict. See #601 for the bounded-wait cursor that would let one
- * call do it properly.
- */
-const MCP_SDK_DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
-export const MAX_BLOCKING_WAIT_MS = MCP_SDK_DEFAULT_REQUEST_TIMEOUT_MS - 5_000;
-/**
- * `capDepth` at this many levels is already past any store an agent can read.
- *
- * Not lower: `numeric-args-are-bounded.test.ts` pins depth 50 as legal, because a large depth is a
- * SCOPE choice and not an error. A ceiling that refuses it would turn a working call into a refusal
- * in the name of bounding one that never worked.
- */
-export const MAX_STATE_DEPTH = 256;
-/** A crawl that clicks forever is not a bound. */
-const MAX_CRAWL_STEPS = 500;
-/** Scroll-to-find steps. Default is 20; hundreds is searching, thousands is a hang. */
-export const MAX_SCROLLS = 200;
-/** Fake-clock jump. One day of timers is a test; a billion ms is not. */
-const MAX_ADVANCE_MS = 86_400_000;
-/** Presenter idle window. One hour is a slow app; larger values never fire. */
-const MAX_IDLE_MS = 3_600_000;
-/** Viewport CSS px — matches the clamp the handler already applied, now as a refusal. */
-export const MIN_VIEWPORT_PX = 64;
-export const MAX_VIEWPORT_PX = 10_000;
-/**
- * A page cursor. 0 is the start of the buffer, so `.positive()` would refuse a legitimate first
- * page. Negative is not a cursor.
- */
-export const cursorSchema = z.number().finite().int().nonnegative();
-/**
- * A wait budget in ms. 0 means evaluate now (documented on assert). Negative cannot be honoured.
- */
-export const timeoutMsSchema = z.number().finite().int().nonnegative().max(MAX_BLOCKING_WAIT_MS);
-/**
- * A count / cap. 0 means "return none", which is a real request. Negative is not.
- * Capped at the ring-buffer size so a `limit: 1e9` cannot pretend the buffer is larger than it is.
- */
-export const countSchema = z.number().finite().int().nonnegative().max(MAX_RESULT_COUNT);
-/**
- * Store projection depth. Negative used to mean "no cap" inside `capDepth`, which is how
- * `depth: -5` silently returned the full store — that is the defect this bound closes.
- *
- * 0 stays REFUSED, which is the policy already on the surface (a zero-level read is not a read).
- * `capDepth(v, 0)` does return a size marker, so accepting it would be defensible — but that is a
- * change to what the tool answers, not a bound on what it cannot honour, and it belongs in its own
- * change with its own reason.
- */
-export const depthSchema = z.number().finite().int().positive().max(MAX_STATE_DEPTH);
-/**
- * Pixel-diff ratios (`threshold`, `maxRatio`). pixelmatch's threshold and our pass ratio are both
- * 0..1; `.int()` would refuse 0.01.
- */
-export const ratioSchema = z.number().finite().min(0).max(1);
-/** HTTP status on a mock or a filter. */
-export const httpStatusSchema = z.number().finite().int().min(100).max(599);
-/** Viewport CSS px. `.int()` alone still accepted 5 and 999999, then the handler silently clamped. */
-export const viewportPxSchema = z.number().finite().int().min(MIN_VIEWPORT_PX).max(MAX_VIEWPORT_PX);
-/** Crawl / scroll step budgets. 0 is a documented no-op on crawl ("raise it to crawl at all"). */
-export const stepCountSchema = z.number().finite().int().nonnegative().max(MAX_CRAWL_STEPS);
-export const scrollCountSchema = z.number().finite().int().nonnegative().max(MAX_SCROLLS);
-export const advanceMsSchema = z.number().finite().int().nonnegative().max(MAX_ADVANCE_MS);
-export const idleMsSchema = z.number().finite().int().nonnegative().max(MAX_IDLE_MS);
-/** Delay before a mocked response. 0 is immediate. */
-export const delayMsSchema = z.number().finite().int().nonnegative().max(MAX_TIMEOUT_MS);
-/**
- * Observe lookback. Must be > 0 — a non-positive window used to mint a FUTURE cursor, so the
- * tool returned zero events and looked like a quiet page. Capped so `window_ms: 1e12` cannot hang.
- */
-export const windowMsSchema = z.number().finite().int().positive().max(MAX_TIMEOUT_MS);
-/**
- * Parallelism for suite replay. 0 (and omit) means sequential. Capped at the session/pool ceiling;
- * asking for a thousand workers cannot be honoured.
- */
-export const workerCountSchema = z
-    .number()
-    .finite()
-    .int()
-    .nonnegative()
-    .max(TRANSPORT_LIMITS.MAX_SESSIONS);
-/**
- * A row index / list length in a virtualized table. Those lists are large on purpose; the ring
- * buffer's 2000 is the wrong ceiling. A billion-row claim is not a list, it is a hang.
- */
-const MAX_LIST_INDEX = 1_000_000;
-export const listIndexSchema = z.number().finite().int().nonnegative().max(MAX_LIST_INDEX);