@rkat/web 0.6.33 → 0.7.0

package/wasm/meerkat_web_runtime.d.ts

@@ -49,18 +49,29 @@ export function clear_tool_callbacks(): void;
 /**
  * Close a subscription and free resources.
  */
-export function close_subscription(handle: number): void;
+export function close_subscription(stream_id: string): void;
 
 /**
  * Create a session from a mobpack + config.
  *
  * Allocates a real session through the initialized runtime-backed session
  * service, then returns a browser-local session handle for convenience.
+ *
+ * The pack's skills/definition become session prompt truth here, so this
+ * ingress runs the same canonical [`meerkat_mob_pack::trust`] verification
+ * as `init_runtime` — never the local parse-only path. The trust store is
+ * the one the host installed at bootstrap (Strict + empty when none was
+ * supplied, so unsigned/unknown-signer packs fail closed).
  */
 export function create_session(mobpack_bytes: Uint8Array, config_json: string): number;
 
 /**
  * Create a standalone session through initialized runtime state.
+ *
+ * When the runtime was bootstrapped from a trust-verified mobpack
+ * (`init_runtime`), that pack's skills and definition are folded into the
+ * system prompt so the verified bootstrap pack is actually consumed rather
+ * than discarded.
  */
 export function create_session_simple(config_json: string): number;
 
@@ -74,6 +85,12 @@ export function destroy_runtime(): void;
 
 /**
  * Remove a session.
+ *
+ * The browser-local handle is retired on success: subsequent
+ * `get_session_state`/`start_turn`/`poll_events` on this handle fail closed
+ * with `invalid_session_handle` rather than returning an addressable archived
+ * projection. The handle is only removed after cleanup succeeds, so a failed
+ * destroy leaves the handle live for retry.
  */
 export function destroy_session(handle: number): void;
 
@@ -90,10 +107,19 @@ export function get_session_state(handle: number): string;
 export function has_external_auth_resolver(): boolean;
 
 /**
- * Primary bootstrap: parse a mobpack and create service infrastructure.
+ * Primary bootstrap: trust-verify a mobpack and create service infrastructure.
  *
- * `mobpack_bytes`: tar.gz mobpack archive.
- * `credentials_json`: `{ "anthropic_api_key"?: "...", "openai_api_key"?: "...", "gemini_api_key"?: "...", "model"?: "claude-sonnet-4-5" }`
+ * `mobpack_bytes`: tar.gz mobpack archive. Verified via the canonical
+ * [`meerkat_mob_pack::trust`] authority under the host-supplied
+ * `mobpack_trust` configuration ([`TrustPolicy::Strict`] + empty trust store
+ * when omitted) — an unsigned or unknown-signer pack fails closed with a
+ * typed error unless the host registered the signer (or explicitly opted in
+ * to `permissive`).
+ * `credentials_json`: `{ "anthropic_api_key"?: "...", "openai_api_key"?: "...",
+ * "gemini_api_key"?: "...", "model"?: "<catalog default for configured provider>",
+ * "max_sessions"?: 100000,
+ * "mobpack_trust"?: { "policy"?: "strict"|"permissive",
+ *                     "trusted_signers"?: { "signers": { "<signer_id>": "<ed25519 pubkey hex>" } } } }`
  *
  * Stores an `EphemeralSessionService<FactoryAgentBuilder>` and a `MobMcpState`
  * in a `thread_local! RuntimeState` for subsequent mob/comms calls.
@@ -103,12 +129,19 @@ export function init_runtime(mobpack_bytes: Uint8Array, credentials_json: string
 /**
  * Advanced bare-bones bootstrap without a mobpack.
  *
- * `config_json`: `{ "anthropic_api_key"?: "...", "openai_api_key"?: "...", "gemini_api_key"?: "...", "model"?: "claude-sonnet-4-5", "max_sessions"?: 100000 }`
+ * `config_json`: `{ "anthropic_api_key"?: "...", "openai_api_key"?: "...",
+ * "gemini_api_key"?: "...", "model"?: "<catalog default for configured provider>",
+ * "max_sessions"?: 100000 }`
  */
 export function init_runtime_from_config(config_json: string): any;
 
 /**
  * Inspect a mobpack without creating a session.
+ *
+ * Read-only metadata projection: nothing from the pack is consumed as
+ * runtime/prompt authority here, so (matching `rkat mob inspect`) unsigned
+ * packs are inspectable and trust verification is deliberately not applied.
+ * Every consuming ingress (`init_runtime`, `create_session`) verifies trust.
  */
 export function inspect_mobpack(mobpack_bytes: Uint8Array): string;
 
@@ -134,10 +167,13 @@ export function mob_create(definition_json: string): Promise<any>;
  *
  * Returns JSON array of mob events.
  *
- * Note: `after_cursor` is u32 at the JS boundary (wasm_bindgen limitation),
- * internally widened to u64. Cursors beyond 4B are not supported via this export.
+ * `after_cursor` is carried as an opaque string so the full u64 runtime cursor
+ * survives the JS boundary — JS numbers cannot represent all u64 values and the
+ * prior `u32` parameter both truncated and (on the SDK side) silently rewound
+ * the stream to position 0 for large/non-finite values. An empty string means
+ * "from the start" (cursor 0); a non-numeric cursor fails closed.
  */
-export function mob_events(mob_id: string, after_cursor: number, limit: number): Promise<any>;
+export function mob_events(mob_id: string, after_cursor: string, limit: number): Promise<any>;
 
 /**
  * Read flow run status.
@@ -162,8 +198,13 @@ export function mob_fork_helper(mob_id: string, request_json: string): Promise<a
  *
  * `action` is a compatibility string carrier that is immediately
  * deserialized into the typed wire lifecycle action contract.
+ *
+ * Returns the canonical [`meerkat_contracts::MobLifecycleResult`] envelope as
+ * JSON, mirroring the public MCP/RPC shape. For `destroy`, this carries the
+ * structured `MobDestroyReport` (destroyed bridge sessions, retained mobs,
+ * cleanup errors) instead of discarding it.
  */
-export function mob_lifecycle(mob_id: string, action: string): Promise<void>;
+export function mob_lifecycle(mob_id: string, action: string): Promise<any>;
 
 /**
  * List all mobs.
@@ -194,13 +235,14 @@ export function mob_member_status(mob_id: string, agent_identity: string): Promi
 /**
  * Subscribe to a mob member's session event stream.
  *
- * Returns a subscription handle. Use `poll_subscription(handle)` to drain
- * buffered events. Each call returns all events since the last poll.
+ * Returns a canonical `stream_id` string ([`StreamRef`] wire form). Use
+ * `poll_subscription(stream_id)` to drain buffered events. Each call returns
+ * all events since the last poll.
  *
  * The subscription captures ALL agent activity: text deltas, tool calls
  * (including comms send_message/peers), turn completions, etc.
  */
-export function mob_member_subscribe(mob_id: string, agent_identity: string): Promise<number>;
+export function mob_member_subscribe(mob_id: string, agent_identity: string): Promise<string>;
 
 /**
  * Retire and re-spawn a member with the same profile.
@@ -239,21 +281,22 @@ export function mob_spawn_helper(mob_id: string, request_json: string): Promise<
 /**
  * Get the status of a mob.
  *
- * Returns JSON with the generated mob status plus the legacy state projection.
+ * Returns the generated `MobStatusResult` JSON envelope.
  */
 export function mob_status(mob_id: string): Promise<any>;
 
 /**
  * Subscribe to mob-wide events (all members, continuously updated).
  *
- * Returns a subscription handle. Use `poll_subscription(handle)` to drain
- * buffered events. Each call returns all events since the last poll.
+ * Returns a canonical `stream_id` string ([`StreamRef`] wire form). Use
+ * `poll_subscription(stream_id)` to drain buffered events. Each call returns
+ * all events since the last poll.
  *
  * Unlike `mob_member_subscribe` which streams a single member's agent events,
  * this streams [`AttributedEvent`]s tagged with source runtime identity and role
  * for every member in the mob, automatically tracking roster changes.
  */
-export function mob_subscribe_events(mob_id: string): Promise<number>;
+export function mob_subscribe_events(mob_id: string): Promise<string>;
 
 /**
  * Unwire bidirectional trust between two members.
@@ -265,11 +308,6 @@ export function mob_unwire(mob_id: string, a: string, b: string): Promise<void>;
  */
 export function mob_unwire_peer(mob_id: string, member: string, peer_json: string): Promise<void>;
 
-/**
- * Unwire a local member from a local or external peer target.
- */
-export function mob_unwire_target(mob_id: string, local: string, target_json: string): Promise<void>;
-
 /**
  * Wire bidirectional trust between two members.
  */
@@ -280,11 +318,6 @@ export function mob_wire(mob_id: string, a: string, b: string): Promise<void>;
  */
 export function mob_wire_peer(mob_id: string, member: string, peer_json: string): Promise<void>;
 
-/**
- * Wire a local member to a local or external peer target.
- */
-export function mob_wire_target(mob_id: string, local: string, target_json: string): Promise<void>;
-
 /**
  * Drain and return all pending agent events from the last turn(s).
  *
@@ -302,11 +335,12 @@ export function poll_events(handle: number): string;
  * `serialize_error` instead of silently omitting the event.
  *
  * For per-member subscriptions (`mob_member_subscribe`), returns
- * `EventEnvelope<AgentEvent>` objects. For mob-wide subscriptions
- * (`mob_subscribe_events`), returns `AttributedEvent` objects with
- * `source`, `profile`, and `envelope` fields.
+ * `EventEnvelope<AgentEvent>` objects — a lagging receiver yields the
+ * generated `AgentEvent::StreamTruncated` envelope, exactly like the RPC
+ * event stream. For mob-wide subscriptions (`mob_subscribe_events`), returns
+ * `AttributedEvent` objects with `source`, `profile`, and `envelope` fields.
  */
-export function poll_subscription(handle: number): string;
+export function poll_subscription(stream_id: string): string;
 
 /**
  * Register a JS-side external-auth resolver. The callback receives a
@@ -381,11 +415,16 @@ export function runtime_version(): string;
 /**
  * Run a turn through the runtime-backed session service.
  *
- * Returns JSON: `{ "text", "usage", "status", "session_id", "turns", "tool_calls" }`
+ * On success, resolves (Ok) with a JSON-serialized [`meerkat_contracts::WireRunResult`]
+ * — the same canonical wire shape RPC's `turn/start` returns — exposing
+ * `terminal_cause_kind` so callers read the runtime-owned terminal class
+ * instead of a fabricated status string.
  *
- * Convention: always resolves (Ok). Check `status` field for "completed" vs "failed".
- * Only rejects (Err) for infrastructure errors (session not found, busy, etc).
- * Agent-level errors (LLM failure, timeout) resolve with `status: "failed"` + `error` field.
+ * On any [`meerkat_core::SessionError`] (including `Agent`), rejects (Err)
+ * with the typed error envelope (`{ code, message }`), carrying the stable
+ * `SessionError::code()`. Agent-level failures surface on the Err channel as
+ * `AGENT_ERROR`; they are NOT laundered into an Ok value with a `status`
+ * string.
  */
 export function start_turn(handle: number, prompt: string): Promise<any>;
 
@@ -394,34 +433,25 @@ export function start_turn(handle: number, prompt: string): Promise<any>;
  */
 export function task_worker_entry_point(ptr: number): void;
 
-/**
- * Wire bidirectional comms trust between meerkats in DIFFERENT mobs.
- *
- * Unlike `mob_wire` (which is intra-mob), this establishes peer trust across
- * mob boundaries by accessing each member's comms runtime through the shared
- * session service. Both members must have comms enabled.
- */
-export function wire_cross_mob(mob_a: string, agent_a: string, mob_b: string, agent_b: string): Promise<void>;
-
 export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
 
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
     readonly append_system_context: (a: number, b: number, c: number) => any;
-    readonly close_subscription: (a: number) => [number, number];
+    readonly clear_tool_callbacks: () => void;
+    readonly close_subscription: (a: number, b: number) => [number, number];
     readonly create_session: (a: number, b: number, c: number, d: number) => [number, number, number];
     readonly create_session_simple: (a: number, b: number) => [number, number, number];
     readonly destroy_runtime: () => [number, number];
     readonly destroy_session: (a: number) => [number, number];
     readonly get_session_state: (a: number) => [number, number, number, number];
-    readonly has_external_auth_resolver: () => number;
     readonly init_runtime: (a: number, b: number, c: number, d: number) => [number, number, number];
     readonly init_runtime_from_config: (a: number, b: number) => [number, number, number];
     readonly inspect_mobpack: (a: number, b: number) => [number, number, number, number];
     readonly mob_append_system_context: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
     readonly mob_cancel_flow: (a: number, b: number, c: number, d: number) => any;
     readonly mob_create: (a: number, b: number) => any;
-    readonly mob_events: (a: number, b: number, c: number, d: number) => any;
+    readonly mob_events: (a: number, b: number, c: number, d: number, e: number) => any;
     readonly mob_flow_status: (a: number, b: number, c: number, d: number) => any;
     readonly mob_force_cancel: (a: number, b: number, c: number, d: number) => any;
     readonly mob_fork_helper: (a: number, b: number, c: number, d: number) => any;
@@ -440,21 +470,44 @@ export interface InitOutput {
     readonly mob_subscribe_events: (a: number, b: number) => any;
     readonly mob_unwire: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
     readonly mob_unwire_peer: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
-    readonly mob_unwire_target: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
     readonly mob_wire: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
     readonly mob_wire_peer: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
-    readonly mob_wire_target: (a: number, b: number, c: number, d: number, e: number, f: number) => any;
     readonly poll_events: (a: number) => [number, number, number, number];
-    readonly poll_subscription: (a: number) => [number, number, number, number];
-    readonly register_external_auth_resolver: (a: any) => [number, number];
+    readonly poll_subscription: (a: number, b: number) => [number, number, number, number];
     readonly register_js_tool: (a: number, b: number, c: number, d: number, e: number, f: number) => [number, number];
     readonly register_tool_callback: (a: number, b: number, c: number, d: number, e: number, f: number, g: any) => [number, number];
     readonly runtime_version: () => [number, number];
     readonly start_turn: (a: number, b: number, c: number) => any;
-    readonly wire_cross_mob: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number) => any;
-    readonly clear_tool_callbacks: () => void;
-    readonly __meerkat_agent_factory_policy_build_v3_28173aef5e818afd: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => void;
-    readonly __meerkat_agent_factory_policy_bridge_token_is_valid_v1_28173aef5e818afd: (a: number, b: number) => number;
+    readonly has_external_auth_resolver: () => number;
+    readonly register_external_auth_resolver: (a: any) => [number, number];
+    readonly __meerkat_core_mob_generated_comms_trust_authority_build_v1_2f05f3560301ed64: (a: number, b: number, c: number, d: number, e: bigint, f: number, g: number, h: number, i: number, j: number, k: number, l: number) => void;
+    readonly __meerkat_mob_generated_authority_bridge_token_is_valid_v1_mob_member_trust_wiring_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_mob_generated_authority_bridge_token_is_valid_v1_mob_external_peer_reciprocal_trust_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_mob_generated_authority_bridge_token_is_valid_v1_mob_external_peer_trust_repair_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_mob_generated_authority_bridge_token_is_valid_v1_mob_member_trust_unwiring_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_mob_generated_authority_bridge_token_is_valid_v1_mob_external_peer_trust_wiring_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_mob_generated_authority_bridge_token_is_valid_v1_mob_external_peer_trust_unwiring_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_agent_factory_parent_tool_composition_authority_new_v1_e38475a6e39af951: (a: number, b: number, c: number) => void;
+    readonly __meerkat_agent_factory_policy_build_v3_e38475a6e39af951: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => void;
+    readonly __meerkat_agent_factory_parent_tool_composition_authority_set_tool_scope_v1_e38475a6e39af951: (a: number, b: number, c: number, d: number, e: number) => void;
+    readonly __meerkat_agent_factory_policy_bridge_token_is_valid_v1_e38475a6e39af951: (a: number, b: number) => number;
+    readonly __meerkat_core_runtime_generated_tool_visibility_owner_build_v1_2f05f3560301ed64: (a: number, b: number, c: number, d: number, e: number) => void;
+    readonly __meerkat_runtime_generated_authority_bridge_token_is_valid_v1_tool_visibility_owner_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_core_runtime_generated_comms_trust_authority_build_v1_2f05f3560301ed64: (a: number, b: number, c: number, d: number, e: bigint, f: number, g: number, h: number, i: number, j: number, k: number, l: number) => void;
+    readonly __meerkat_runtime_generated_authority_bridge_token_is_valid_v1_comms_trust_reconcile_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_runtime_generated_authority_bridge_token_is_valid_v1_supervisor_trust_publish_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_core_runtime_generated_mob_tool_authority_context_build_v1_2f05f3560301ed64: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => void;
+    readonly __meerkat_runtime_generated_authority_bridge_token_is_valid_v1_mob_operator_authority_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_runtime_generated_authority_bridge_token_is_valid_v1_supervisor_trust_revoke_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __meerkat_core_runtime_generated_auth_lease_handle_build_v1_2f05f3560301ed64: (a: number, b: number, c: number, d: number, e: number) => void;
+    readonly __meerkat_core_runtime_generated_auth_lease_transition_build_v1_2f05f3560301ed64: (a: number, b: number, c: number, d: number, e: number, f: bigint, g: bigint, h: bigint, i: bigint) => void;
+    readonly __meerkat_runtime_generated_authority_bridge_token_is_valid_v1_auth_lease_lifecycle_publication_2f05f3560301ed64: (a: number, b: number) => number;
+    readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
+    readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
+    readonly intounderlyingbytesource_cancel: (a: number) => void;
+    readonly intounderlyingbytesource_pull: (a: number, b: any) => any;
+    readonly intounderlyingbytesource_start: (a: number, b: any) => void;
+    readonly intounderlyingbytesource_type: (a: number) => number;
     readonly __wbg_intounderlyingsink_free: (a: number, b: number) => void;
     readonly intounderlyingsink_abort: (a: number, b: any) => any;
     readonly intounderlyingsink_close: (a: number) => any;
@@ -462,20 +515,14 @@ export interface InitOutput {
     readonly __wbg_intounderlyingsource_free: (a: number, b: number) => void;
     readonly intounderlyingsource_cancel: (a: number) => void;
     readonly intounderlyingsource_pull: (a: number, b: any) => any;
-    readonly __wbg_intounderlyingbytesource_free: (a: number, b: number) => void;
-    readonly intounderlyingbytesource_autoAllocateChunkSize: (a: number) => number;
-    readonly intounderlyingbytesource_cancel: (a: number) => void;
-    readonly intounderlyingbytesource_pull: (a: number, b: any) => any;
-    readonly intounderlyingbytesource_start: (a: number, b: any) => void;
-    readonly intounderlyingbytesource_type: (a: number) => number;
     readonly task_worker_entry_point: (a: number) => [number, number];
-    readonly wasm_bindgen__closure__destroy__h0c356ef0a5cea603: (a: number, b: number) => void;
-    readonly wasm_bindgen__closure__destroy__hb9425d9e23a9d6e3: (a: number, b: number) => void;
-    readonly wasm_bindgen__closure__destroy__h650c11e6baa55c49: (a: number, b: number) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__h05fc08dbf10243fb: (a: number, b: number, c: any, d: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__had033df66a0cb233: (a: number, b: number, c: any) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__h6c0ce486df807cd6: (a: number, b: number) => void;
-    readonly wasm_bindgen__convert__closures_____invoke__hd9d99acd02017ac0: (a: number, b: number) => void;
+    readonly wasm_bindgen__closure__destroy__h3d635b500c28087d: (a: number, b: number) => void;
+    readonly wasm_bindgen__closure__destroy__he5a3e8c7a4c47308: (a: number, b: number) => void;
+    readonly wasm_bindgen__closure__destroy__h635ec94650d9deab: (a: number, b: number) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__h78395309139ae66e: (a: number, b: number, c: any, d: any) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__ha64c8385490fcaa0: (a: number, b: number, c: any) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__h1f1def1b077165d5: (a: number, b: number) => void;
+    readonly wasm_bindgen__convert__closures_____invoke__hcb95b65c3fdb947b: (a: number, b: number) => void;
     readonly __wbindgen_malloc_command_export: (a: number, b: number) => number;
     readonly __wbindgen_realloc_command_export: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store_command_export: (a: number) => void;