@robota-sdk/agent-transport-http 3.0.0-beta.88 → 3.0.0-beta.90

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @robota-sdk/agent-transport-http
 
+## 3.0.0-beta.90
+### Patch Changes
+
+  - @robota-sdk/agent-interface-session@3.0.0-beta.90
+  - @robota-sdk/agent-interface-transport@3.0.0-beta.90
+  - @robota-sdk/agent-transport@3.0.0-beta.90
+
+## 3.0.0-beta.89
+### Minor Changes
+
+- ca44ac6: HTTP clients can now receive and answer permission and ask prompts. `POST /submit` with `receivePrompts: true` streams `permission_request`, `ask_request` and `prompt_resolved`. `GET /prompts` lists the prompts still open, so a client that attaches later can see them, and `POST /prompts/:id` answers one; an id that is not open returns 404, and an answer the session did not take returns 409. Clients that omit `receivePrompts` see no change. `IHttpTransportSession` now also requires `resolvePermission` and `resolveAsk`, which `InteractiveSession` already implements. The `--serve --http-port` API gains these routes as well.
+
+### Patch Changes
+
+- Updated dependencies [3427887]
+  - @robota-sdk/agent-transport@3.0.0-beta.89
+  - @robota-sdk/agent-interface-session@3.0.0-beta.89
+  - @robota-sdk/agent-interface-transport@3.0.0-beta.89
+
 ## 3.0.0-beta.88
 
 ### Patch Changes

package/README.md

@@ -72,16 +72,31 @@ check on `getSession().getSessionId()`, not on object identity.
 
 ## Routes
 
-| Method | Path            | Purpose                                                                                                                                                                                           |
-| ------ | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| POST   | `/submit`       | Body `{ "prompt": string }`. Runs a turn and streams `text_delta`, `tool_start`, `tool_end`, `thinking`, then `complete`, `interrupted` or `error` as SSE. `409` while a turn is already running. |
-| POST   | `/command`      | Body `{ "name": string, "args"?: string }`. Runs a session command on behalf of a remote caller.                                                                                                  |
-| POST   | `/abort`        | Aborts the running turn.                                                                                                                                                                          |
-| POST   | `/cancel-queue` | Drops the queued prompt.                                                                                                                                                                          |
-| GET    | `/messages`     | The conversation history.                                                                                                                                                                         |
-| GET    | `/context`      | The context-window state.                                                                                                                                                                         |
-| GET    | `/executing`    | `{ "executing": boolean }`, using the same rule `/submit` uses to answer `409`.                                                                                                                   |
-| GET    | `/pending`      | `{ "pending": … }`, the queued prompt, if any.                                                                                                                                                    |
+| Method | Path            | Purpose                                                                                                                                                                                                                                                                                                                                                 |
+| ------ | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| POST   | `/submit`       | Body `{ "prompt": string, "receivePrompts"?: boolean }`. Runs a turn and streams `text_delta`, `tool_start`, `tool_end`, `thinking`, then `complete`, `interrupted` or `error` as SSE. With `receivePrompts: true` the stream also carries `permission_request`, `ask_request` and `prompt_resolved`. `409` while a turn is already running.            |
+| POST   | `/command`      | Body `{ "name": string, "args"?: string }`. Runs a session command on behalf of a remote caller.                                                                                                                                                                                                                                                        |
+| POST   | `/abort`        | Aborts the running turn.                                                                                                                                                                                                                                                                                                                                |
+| POST   | `/cancel-queue` | Drops the queued prompt.                                                                                                                                                                                                                                                                                                                                |
+| GET    | `/messages`     | The conversation history.                                                                                                                                                                                                                                                                                                                               |
+| GET    | `/context`      | The context-window state.                                                                                                                                                                                                                                                                                                                               |
+| GET    | `/executing`    | `{ "executing": boolean }`, using the same rule `/submit` uses to answer `409`.                                                                                                                                                                                                                                                                         |
+| GET    | `/pending`      | `{ "pending": … }`, the queued prompt, if any.                                                                                                                                                                                                                                                                                                          |
+| GET    | `/prompts`      | `{ "prompts": [{ "type", "event" }] }`, the prompts a prompt-receiving `/submit` stream forwarded that are still open, oldest first.                                                                                                                                                                                                                    |
+| POST   | `/prompts/:id`  | Answers an open prompt: `{ "result": true \| false \| "allow-session" \| "allow-project" }` for a permission, `{ "response": { "type": "answer", "values": string[], "text"?: string } \| { "type": "cancelled" } }` for an ask. `404` when the id is not open, `400` for an answer of the wrong shape, `409` when the session did not take the answer. |
+
+### Permission and ask prompts
+
+A turn can stop to ask whether a tool may run (`permission_request`) or to ask the user a question
+(`ask_request`). Only a client that says it can answer receives them: send `receivePrompts: true` with
+`/submit`, and answer each prompt by its `event.id` through `POST /prompts/:id`. `prompt_resolved`
+follows when a prompt is settled, by this client or by another surface on the same session. A
+client that comes later reads the open prompts from `GET /prompts` and answers the same way.
+
+Without `receivePrompts`, nothing changes: a turn whose prompt no surface can answer is denied (or the
+question cancelled) at once rather than left waiting. Closing the stream aborts the turn, which settles
+its open prompts the same way. The answer is recorded as the host's `attribution.driverId`, never as
+anything the request claims.
 
 Paths are relative to where the routes are mounted (`basePath`, or the prefix you pass to
 `app.route`).
@@ -97,12 +112,12 @@ Paths are relative to where the routes are mounted (`basePath`, or the prefix yo
 | `IAgentRoutesOptions`    | interface | `{ sessionFactory, admission, onStreamFailure?, attribution? }`                                       |
 | `TSessionFactory`        | type      | `(c: Context) => IHttpTransportSession \| Promise<IHttpTransportSession>`                             |
 | `IHttpTransportSession`  | interface | The session capabilities the routes use; a full interactive session satisfies it                      |
-| `TTurnAttribution`       | type      | Host-assigned `driverId`/`surface` for `/submit` turns; never read from the request                   |
+| `TTurnAttribution`       | type      | Host-assigned `driverId`/`surface` for turns and prompt answers; never read from the request          |
 | `TStreamFailureListener` | type      | Receives the details of a stream that fails after headers were sent (the client sees a generic error) |
 
 ## Related
 
-- [`@robota-sdk/agent-transport`](../agent-transport/README.md) — the admission helpers these routes use.
+- [`@robota-sdk/agent-transport`](../agent-transport/README.md) — the admission helpers and the prompt-answer decoder these routes use.
 - [`@robota-sdk/agent-transport-ws`](../agent-transport-ws/README.md) — the WebSocket transport, which
   carries the full session protocol (this HTTP surface covers a subset).
 - [docs/SPEC.md](./docs/SPEC.md) — package contract and invariants.

package/dist/node/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@robota-sdk/agent-transport/node"),t=require("hono"),n=require("hono/streaming");function r(e,t,n,r){let a=(t,r)=>{e.on(t,r),n.push(()=>e.off(t,r))},o=(e,n)=>t.writeSSE({event:e,data:JSON.stringify(n)}).catch(()=>{}),s,c=new Promise(e=>{s=e});return a(`text_delta`,e=>void o(`text_delta`,{delta:e})),a(`tool_start`,e=>void o(`tool_start`,e)),a(`tool_end`,e=>void o(`tool_end`,e)),a(`thinking`,e=>void o(`thinking`,{isThinking:e})),a(`complete`,async e=>{await o(`complete`,e),s()}),a(`interrupted`,async e=>{await o(`interrupted`,e),s()}),a(`error`,async e=>{await o(`error`,{message:e.message}),s()}),t.onAbort(()=>i(e,r,s)),c}function i(e,t,n){try{e.abort()}catch(e){try{t?.(e instanceof Error?e:Error(String(e)))}catch{}}finally{n()}}function a(e,t){for(let t of e)try{t()}catch{}t()}function o(e,t,n,i,o){return async c=>{try{let s=[];try{let n=r(e,c,s,i);await(o===void 0?e.submit(t):e.submit(t,void 0,void 0,{...o})),await n}finally{a(s,n)}}catch(e){await s(e instanceof Error?e:Error(String(e)),c,i)}}}async function s(e,t,n){try{n?.(e)}catch{}await t.writeSSE({event:`error`,data:JSON.stringify({message:`the stream failed on the server after it opened — the turn may not have run`})}).catch(()=>{})}function c(e,t,n){let r=n.keyFor(t);return r===void 0?e.json({error:`concurrent-turn tracking is unavailable for this session, so this request cannot be served safely. Refusing rather than starting a turn that cannot be guaranteed to be yours.`},500):n.isHeld(r)||t.isExecuting()?e.json({error:`session busy — a turn is already in flight`},409):(n.hold(r),{claim:r})}function l(e,t,r,i){return async a=>{let s=await e(a),l=await a.req.json();if(!l.prompt||typeof l.prompt!=`string`)return a.json({error:`prompt is required`},400);if(s.whenInitialized!==void 0)try{await s.whenInitialized()}catch{return a.json({error:`the session could not be started`},500)}let u=c(a,s,t);if(u instanceof Response)return u;let{claim:d}=u,f=!1,p=()=>{f||(f=!0,t.release(d))};try{return await(0,n.streamSSE)(a,o(s,l.prompt,p,r,i))}catch(e){throw p(),e}}}function u(){let e=new Set;return{keyFor(e){try{let t=e.getSession().getSessionId();return typeof t==`string`&&t!==``?t:void 0}catch{return}},isHeld:t=>e.has(t),hold:t=>void e.add(t),release:t=>void e.delete(t)}}function d(n){let{sessionFactory:r,onStreamFailure:i,attribution:a}=n,o=new t.Hono,s=u(),c=(0,e.resolveAdmission)(n.admission);return o.use(`*`,async(t,n)=>c.token===null||(0,e.credentialMatches)(c.token,(0,e.bearerCredential)(t.req.header(`authorization`)))?n():t.json({error:`unauthorized`},401)),o.post(`/submit`,l(r,s,i,a)),o.post(`/command`,async e=>{let t=await r(e),n=await e.req.json();if(!n.name||typeof n.name!=`string`)return e.json({error:`name is required`},400);let i=await t.executeCommand(n.name,n.args??``,`remote`);return i?e.json(i):e.json({error:`Unknown command: ${n.name}`},404)}),o.post(`/abort`,async e=>((await r(e)).abort(),e.json({ok:!0}))),o.post(`/cancel-queue`,async e=>((await r(e)).cancelQueue(),e.json({ok:!0}))),o.get(`/messages`,async e=>{let t=await r(e);return e.json(t.getMessages())}),o.get(`/context`,async e=>{let t=await r(e);return e.json(t.getContextState())}),o.get(`/executing`,async e=>{let t=await r(e),n=s.keyFor(t),i=n!==void 0&&s.isHeld(n);return e.json({executing:i||t.isExecuting()})}),o.get(`/pending`,async e=>{let t=await r(e);return e.json({pending:t.getPendingPrompt()})}),o}function f(n){let r=null,i=null,a=(0,e.resolveAdmission)(n?.admission),o=e=>Object.assign(Error(`HTTP transport ${e}.`),{name:`TransportLifecycleError`,code:e,transportName:`http`});return{name:`http`,lifecycle:Object.freeze({kind:`service`}),attach(e){r=e},async start(){if(!r)throw o(`not-attached`);if(i)throw o(`already-started`);let e=d({sessionFactory:()=>r,admission:a,onStreamFailure:n?.onStreamFailure,attribution:n?.attribution});i=n?.basePath?new t.Hono().route(n.basePath,e):e},async stop(){i=null,r=null},getApp(){if(!i)throw Error(`Transport not started. Call start() first.`);return i},getAdmissionToken(){return a.token}}}exports.createAgentRoutes=d,exports.createHttpTransport=f;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@robota-sdk/agent-transport/node"),t=require("hono"),n=require("@robota-sdk/agent-transport"),r=require("hono/streaming");function i(){let e=new Map;return{record(t,n){let r=e.get(t);r===void 0&&(r=new Map,e.set(t,r)),r.set(n.event.id,n)},forget(t,n){e.get(t)?.delete(n)},list:t=>[...e.get(t)?.values()??[]],find:(t,n)=>e.get(t)?.get(n),clear(t){e.delete(t)}}}function a(e){return async t=>{let n=await e.sessionFactory(t),r=e.claims.keyFor(n);return t.json({prompts:r===void 0?[]:e.openPrompts.list(r)})}}function o(e){let{sessionFactory:t,claims:r,openPrompts:i,attribution:a}=e;return async e=>{let o=await t(e),s=e.req.param(`id`)??``,c;try{c=await e.req.json()}catch{return e.json({error:`the body must be a JSON object`},400)}let l=r.keyFor(o),u=l===void 0?void 0:i.find(l,s);if(l===void 0||u===void 0)return e.json({error:`no open prompt with this id`},404);if(u.type===`permission_request`){let t=(0,n.decodeClientMessage)({type:`permission-response`,id:s,result:c?.result});if(!t.ok||t.message.type!==`permission-response`)return e.json({error:`result must be true, false, "allow-session" or "allow-project"`},400);o.resolvePermission(s,t.message.result,a?.driverId)}else{let t=(0,n.decodeClientMessage)({type:`ask-response`,id:s,response:c?.response});if(!t.ok||t.message.type!==`ask-response`)return e.json({error:`response must be { "type": "answer", "values": string[], "text"?: string } or { "type": "cancelled" }`},400);o.resolveAsk(s,t.message.response,a?.driverId)}return i.find(l,s)===void 0?e.json({ok:!0}):e.json({error:`the session did not accept this answer`},409)}}function s(e,t,n,r,i){let a=(t,r)=>{e.on(t,r),n.push(()=>e.off(t,r))},o=(e,n)=>t.writeSSE({event:e,data:JSON.stringify(n)}).catch(()=>{}),s,u=new Promise(e=>{s=e});return a(`text_delta`,e=>void o(`text_delta`,{delta:e})),a(`tool_start`,e=>void o(`tool_start`,e)),a(`tool_end`,e=>void o(`tool_end`,e)),a(`thinking`,e=>void o(`thinking`,{isThinking:e})),i!==void 0&&c(a,o,i),a(`complete`,async e=>{await o(`complete`,e),s()}),a(`interrupted`,async e=>{await o(`interrupted`,e),s()}),a(`error`,async e=>{await o(`error`,{message:e.message}),s()}),t.onAbort(()=>l(e,r,s)),u}function c(e,t,n){e(`permission_request`,e=>{n.record({type:`permission_request`,event:e}),t(`permission_request`,e)}),e(`ask_request`,e=>{n.record({type:`ask_request`,event:e}),t(`ask_request`,e)}),e(`prompt_resolved`,e=>{n.forget(e.id),t(`prompt_resolved`,e)})}function l(e,t,n){try{e.abort()}catch(e){try{t?.(e instanceof Error?e:Error(String(e)))}catch{}}finally{n()}}function u(e,t){for(let t of e)try{t()}catch{}t()}function d(e,t,n,r,i,a){return async o=>{try{let c=[];try{let n=s(e,o,c,r,a);await(i===void 0?e.submit(t):e.submit(t,void 0,void 0,{...i})),await n}finally{u(c,n)}}catch(e){await f(e instanceof Error?e:Error(String(e)),o,r)}}}async function f(e,t,n){try{n?.(e)}catch{}await t.writeSSE({event:`error`,data:JSON.stringify({message:`the stream failed on the server after it opened — the turn may not have run`})}).catch(()=>{})}function p(e,t,n){let r=n.keyFor(t);return r===void 0?e.json({error:`concurrent-turn tracking is unavailable for this session, so this request cannot be served safely. Refusing rather than starting a turn that cannot be guaranteed to be yours.`},500):n.isHeld(r)||t.isExecuting()?e.json({error:`session busy — a turn is already in flight`},409):(n.hold(r),{claim:r})}function m(e){let{sessionFactory:t,claims:n,openPrompts:i,onStreamFailure:a,attribution:o}=e;return async e=>{let s=await t(e),c=await e.req.json();if(!c.prompt||typeof c.prompt!=`string`)return e.json({error:`prompt is required`},400);if(c.receivePrompts!==void 0&&typeof c.receivePrompts!=`boolean`)return e.json({error:`receivePrompts must be a boolean`},400);if(s.whenInitialized!==void 0)try{await s.whenInitialized()}catch{return e.json({error:`the session could not be started`},500)}let l=p(e,s,n);if(l instanceof Response)return l;let{claim:u}=l,f=!1,m=()=>{f||(f=!0,i.clear(u),n.release(u))},h=c.receivePrompts===!0?{record:e=>i.record(u,e),forget:e=>i.forget(u,e)}:void 0;try{return await(0,r.streamSSE)(e,d(s,c.prompt,m,a,o,h))}catch(e){throw m(),e}}}function h(){let e=new Set;return{keyFor(e){try{let t=e.getSession().getSessionId();return typeof t==`string`&&t!==``?t:void 0}catch{return}},isHeld:t=>e.has(t),hold:t=>void e.add(t),release:t=>void e.delete(t)}}function g(n){let{sessionFactory:r,onStreamFailure:s,attribution:c}=n,l=new t.Hono,u=h(),d=i(),f=(0,e.resolveAdmission)(n.admission);return l.use(`*`,async(t,n)=>f.token===null||(0,e.credentialMatches)(f.token,(0,e.bearerCredential)(t.req.header(`authorization`)))?n():t.json({error:`unauthorized`},401)),l.post(`/submit`,m({sessionFactory:r,claims:u,openPrompts:d,onStreamFailure:s,attribution:c})),l.get(`/prompts`,a({sessionFactory:r,claims:u,openPrompts:d,attribution:c})),l.post(`/prompts/:id`,o({sessionFactory:r,claims:u,openPrompts:d,attribution:c})),l.post(`/command`,async e=>{let t=await r(e),n=await e.req.json();if(!n.name||typeof n.name!=`string`)return e.json({error:`name is required`},400);let i=await t.executeCommand(n.name,n.args??``,`remote`);return i?e.json(i):e.json({error:`Unknown command: ${n.name}`},404)}),l.post(`/abort`,async e=>((await r(e)).abort(),e.json({ok:!0}))),l.post(`/cancel-queue`,async e=>((await r(e)).cancelQueue(),e.json({ok:!0}))),l.get(`/messages`,async e=>{let t=await r(e);return e.json(t.getMessages())}),l.get(`/context`,async e=>{let t=await r(e);return e.json(t.getContextState())}),l.get(`/executing`,async e=>{let t=await r(e),n=u.keyFor(t),i=n!==void 0&&u.isHeld(n);return e.json({executing:i||t.isExecuting()})}),l.get(`/pending`,async e=>{let t=await r(e);return e.json({pending:t.getPendingPrompt()})}),l}function _(n){let r=null,i=null,a=(0,e.resolveAdmission)(n?.admission),o=e=>Object.assign(Error(`HTTP transport ${e}.`),{name:`TransportLifecycleError`,code:e,transportName:`http`});return{name:`http`,lifecycle:Object.freeze({kind:`service`}),attach(e){r=e},async start(){if(!r)throw o(`not-attached`);if(i)throw o(`already-started`);let e=g({sessionFactory:()=>r,admission:a,onStreamFailure:n?.onStreamFailure,attribution:n?.attribution});i=n?.basePath?new t.Hono().route(n.basePath,e):e},async stop(){i=null,r=null},getApp(){if(!i)throw Error(`Transport not started. Call start() first.`);return i},getAdmissionToken(){return a.token}}}exports.createAgentRoutes=g,exports.createHttpTransport=_;

package/dist/node/index.d.cts

@@ -1,10 +1,10 @@
 import { Context, Hono } from "hono";
-import { ISessionCommands, ISessionConversationRead, ISessionEvents, ISessionExecutionState, ISessionIdentity, ISessionTurnControl, ISessionTurnSubmission, ISubmitOptions } from "@robota-sdk/agent-interface-session";
+import { ISessionCommands, ISessionConversationRead, ISessionEvents, ISessionExecutionState, ISessionIdentity, ISessionPromptResolution, ISessionTurnControl, ISessionTurnSubmission, ISubmitOptions } from "@robota-sdk/agent-interface-session";
 import "hono/streaming";
 import { ITransportAdapter, ITransportAdmission, ITransportAdmissionConfig } from "@robota-sdk/agent-interface-transport";
 //#region src/http-session.d.ts
 /** The exact session capabilities consumed by the public HTTP transport. */
-interface IHttpTransportSession extends ISessionTurnSubmission, ISessionEvents, ISessionTurnControl, ISessionIdentity, ISessionCommands, ISessionConversationRead, ISessionExecutionState {
+interface IHttpTransportSession extends ISessionTurnSubmission, ISessionEvents, ISessionTurnControl, ISessionIdentity, ISessionPromptResolution, ISessionCommands, ISessionConversationRead, ISessionExecutionState {
   /**
    * Resolves once the session can name itself, and rejects if it failed to start. A session that
    * builds itself in the background (`InteractiveSession`) has no id before then, so `/submit` waits
@@ -77,9 +77,9 @@ interface IAgentRoutesOptions {
    */
   admission: ITransportAdmissionConfig | ITransportAdmission;
   /**
-   * Who `/submit` turns are attributed to — the driver and product surface the HOST assigns, as the
-   * WebSocket transport's `driverId`/`surface` do. Never taken from the request body. Absent leaves
-   * the session's own default.
+   * Who `/submit` turns and prompt answers are attributed to — the driver and product surface the
+   * HOST assigns, as the WebSocket transport's `driverId`/`surface` do. Never taken from the request
+   * body. Absent leaves the session's own default.
    */
   attribution?: TTurnAttribution;
 }

package/dist/node/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/http-session.ts","../../src/submit-stream.ts","../../src/submit-route.ts","../../src/routes.ts","../../src/http-transport.ts"],"mappings":";;;;;;UAWiB,8BAEb,wBACA,gBACA,qBACA,kBACA,kBACA,0BACA;;;;;;EAMF,oBAAoB;;;;;;;;;;;;;;;;;KCCV,0BAA0B,OAAO;;;;;;KAOjC,mBAAmB,KAAK;;;;;;;;;;;;;;;;;;;;;;;KCIxB,mBACV,GAAG,YACA,wBAAwB,QAAQ;;;UCVpB;;EAEf,gBAAgB;;;;;;EAMhB,kBAAkB;;;;;;;;EAQlB,WAAW,4BAA4B;;;;;;EAMvC,cAAc;;;;;;;;;;;;iBAaA,kBAAkB,SAAS,sBAAsB;;;UC5ChD;;EAEf;;;;;;;;EAQA,YAAY;;;;;;;EAOZ,kBAAkB;;EAElB,cAAc;;UAGC,uBAAuB,kBAAkB;EACxD,UAAU;EACV;;iBAGc,oBAAoB,UAAU,wBAAwB"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/http-session.ts","../../src/submit-stream.ts","../../src/submit-route.ts","../../src/routes.ts","../../src/http-transport.ts"],"mappings":";;;;;;UAYiB,8BAEb,wBACA,gBACA,qBACA,kBACA,0BACA,kBACA,0BACA;;;;;;EAMF,oBAAoB;;;;;;;;;;;;;;;;;KCKV,0BAA0B,OAAO;;;;;;KAOjC,mBAAmB,KAAK;;;;;;;;;;;;;;;;;;;;;;;KCDxB,mBACV,GAAG,YACA,wBAAwB,QAAQ;;;UCTpB;;EAEf,gBAAgB;;;;;;EAMhB,kBAAkB;;;;;;;;EAQlB,WAAW,4BAA4B;;;;;;EAMvC,cAAc;;;;;;;;;;;;iBAaA,kBAAkB,SAAS,sBAAsB;;;UC9ChD;;EAEf;;;;;;;;EAQA,YAAY;;;;;;;EAOZ,kBAAkB;;EAElB,cAAc;;UAGC,uBAAuB,kBAAkB;EACxD,UAAU;EACV;;iBAGc,oBAAoB,UAAU,wBAAwB"}

package/dist/node/index.d.ts

@@ -1,10 +1,10 @@
 import { Context, Hono } from "hono";
 import "hono/streaming";
-import { ISessionCommands, ISessionConversationRead, ISessionEvents, ISessionExecutionState, ISessionIdentity, ISessionTurnControl, ISessionTurnSubmission, ISubmitOptions } from "@robota-sdk/agent-interface-session";
+import { ISessionCommands, ISessionConversationRead, ISessionEvents, ISessionExecutionState, ISessionIdentity, ISessionPromptResolution, ISessionTurnControl, ISessionTurnSubmission, ISubmitOptions } from "@robota-sdk/agent-interface-session";
 import { ITransportAdapter, ITransportAdmission, ITransportAdmissionConfig } from "@robota-sdk/agent-interface-transport";
 //#region src/http-session.d.ts
 /** The exact session capabilities consumed by the public HTTP transport. */
-interface IHttpTransportSession extends ISessionTurnSubmission, ISessionEvents, ISessionTurnControl, ISessionIdentity, ISessionCommands, ISessionConversationRead, ISessionExecutionState {
+interface IHttpTransportSession extends ISessionTurnSubmission, ISessionEvents, ISessionTurnControl, ISessionIdentity, ISessionPromptResolution, ISessionCommands, ISessionConversationRead, ISessionExecutionState {
   /**
    * Resolves once the session can name itself, and rejects if it failed to start. A session that
    * builds itself in the background (`InteractiveSession`) has no id before then, so `/submit` waits
@@ -77,9 +77,9 @@ interface IAgentRoutesOptions {
    */
   admission: ITransportAdmissionConfig | ITransportAdmission;
   /**
-   * Who `/submit` turns are attributed to — the driver and product surface the HOST assigns, as the
-   * WebSocket transport's `driverId`/`surface` do. Never taken from the request body. Absent leaves
-   * the session's own default.
+   * Who `/submit` turns and prompt answers are attributed to — the driver and product surface the
+   * HOST assigns, as the WebSocket transport's `driverId`/`surface` do. Never taken from the request
+   * body. Absent leaves the session's own default.
    */
   attribution?: TTurnAttribution;
 }

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/http-session.ts","../../src/submit-stream.ts","../../src/submit-route.ts","../../src/routes.ts","../../src/http-transport.ts"],"mappings":";;;;;;UAWiB,8BAEb,wBACA,gBACA,qBACA,kBACA,kBACA,0BACA;;;;;;EAMF,oBAAoB;;;;;;;;;;;;;;;;;KCCV,0BAA0B,OAAO;;;;;;KAOjC,mBAAmB,KAAK;;;;;;;;;;;;;;;;;;;;;;;KCIxB,mBACV,GAAG,YACA,wBAAwB,QAAQ;;;UCVpB;;EAEf,gBAAgB;;;;;;EAMhB,kBAAkB;;;;;;;;EAQlB,WAAW,4BAA4B;;;;;;EAMvC,cAAc;;;;;;;;;;;;iBAaA,kBAAkB,SAAS,sBAAsB;;;UC5ChD;;EAEf;;;;;;;;EAQA,YAAY;;;;;;;EAOZ,kBAAkB;;EAElB,cAAc;;UAGC,uBAAuB,kBAAkB;EACxD,UAAU;EACV;;iBAGc,oBAAoB,UAAU,wBAAwB"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../src/http-session.ts","../../src/submit-stream.ts","../../src/submit-route.ts","../../src/routes.ts","../../src/http-transport.ts"],"mappings":";;;;;;UAYiB,8BAEb,wBACA,gBACA,qBACA,kBACA,0BACA,kBACA,0BACA;;;;;;EAMF,oBAAoB;;;;;;;;;;;;;;;;;KCKV,0BAA0B,OAAO;;;;;;KAOjC,mBAAmB,KAAK;;;;;;;;;;;;;;;;;;;;;;;KCDxB,mBACV,GAAG,YACA,wBAAwB,QAAQ;;;UCTpB;;EAEf,gBAAgB;;;;;;EAMhB,kBAAkB;;;;;;;;EAQlB,WAAW,4BAA4B;;;;;;EAMvC,cAAc;;;;;;;;;;;;iBAaA,kBAAkB,SAAS,sBAAsB;;;UC9ChD;;EAEf;;;;;;;;EAQA,YAAY;;;;;;;EAOZ,kBAAkB;;EAElB,cAAc;;UAGC,uBAAuB,kBAAkB;EACxD,UAAU;EACV;;iBAGc,oBAAoB,UAAU,wBAAwB"}

package/dist/node/index.js

@@ -1,2 +1,2 @@
-import{bearerCredential as e,credentialMatches as t,resolveAdmission as n}from"@robota-sdk/agent-transport/node";import{Hono as r}from"hono";import{streamSSE as i}from"hono/streaming";function a(e,t,n,r){let i=(t,r)=>{e.on(t,r),n.push(()=>e.off(t,r))},a=(e,n)=>t.writeSSE({event:e,data:JSON.stringify(n)}).catch(()=>{}),s,c=new Promise(e=>{s=e});return i(`text_delta`,e=>void a(`text_delta`,{delta:e})),i(`tool_start`,e=>void a(`tool_start`,e)),i(`tool_end`,e=>void a(`tool_end`,e)),i(`thinking`,e=>void a(`thinking`,{isThinking:e})),i(`complete`,async e=>{await a(`complete`,e),s()}),i(`interrupted`,async e=>{await a(`interrupted`,e),s()}),i(`error`,async e=>{await a(`error`,{message:e.message}),s()}),t.onAbort(()=>o(e,r,s)),c}function o(e,t,n){try{e.abort()}catch(e){try{t?.(e instanceof Error?e:Error(String(e)))}catch{}}finally{n()}}function s(e,t){for(let t of e)try{t()}catch{}t()}function c(e,t,n,r,i){return async o=>{try{let c=[];try{let n=a(e,o,c,r);await(i===void 0?e.submit(t):e.submit(t,void 0,void 0,{...i})),await n}finally{s(c,n)}}catch(e){await l(e instanceof Error?e:Error(String(e)),o,r)}}}async function l(e,t,n){try{n?.(e)}catch{}await t.writeSSE({event:`error`,data:JSON.stringify({message:`the stream failed on the server after it opened — the turn may not have run`})}).catch(()=>{})}function u(e,t,n){let r=n.keyFor(t);return r===void 0?e.json({error:`concurrent-turn tracking is unavailable for this session, so this request cannot be served safely. Refusing rather than starting a turn that cannot be guaranteed to be yours.`},500):n.isHeld(r)||t.isExecuting()?e.json({error:`session busy — a turn is already in flight`},409):(n.hold(r),{claim:r})}function d(e,t,n,r){return async a=>{let o=await e(a),s=await a.req.json();if(!s.prompt||typeof s.prompt!=`string`)return a.json({error:`prompt is required`},400);if(o.whenInitialized!==void 0)try{await o.whenInitialized()}catch{return a.json({error:`the session could not be started`},500)}let l=u(a,o,t);if(l instanceof Response)return l;let{claim:d}=l,f=!1,p=()=>{f||(f=!0,t.release(d))};try{return await i(a,c(o,s.prompt,p,n,r))}catch(e){throw p(),e}}}function f(){let e=new Set;return{keyFor(e){try{let t=e.getSession().getSessionId();return typeof t==`string`&&t!==``?t:void 0}catch{return}},isHeld:t=>e.has(t),hold:t=>void e.add(t),release:t=>void e.delete(t)}}function p(i){let{sessionFactory:a,onStreamFailure:o,attribution:s}=i,c=new r,l=f(),u=n(i.admission);return c.use(`*`,async(n,r)=>u.token===null||t(u.token,e(n.req.header(`authorization`)))?r():n.json({error:`unauthorized`},401)),c.post(`/submit`,d(a,l,o,s)),c.post(`/command`,async e=>{let t=await a(e),n=await e.req.json();if(!n.name||typeof n.name!=`string`)return e.json({error:`name is required`},400);let r=await t.executeCommand(n.name,n.args??``,`remote`);return r?e.json(r):e.json({error:`Unknown command: ${n.name}`},404)}),c.post(`/abort`,async e=>((await a(e)).abort(),e.json({ok:!0}))),c.post(`/cancel-queue`,async e=>((await a(e)).cancelQueue(),e.json({ok:!0}))),c.get(`/messages`,async e=>{let t=await a(e);return e.json(t.getMessages())}),c.get(`/context`,async e=>{let t=await a(e);return e.json(t.getContextState())}),c.get(`/executing`,async e=>{let t=await a(e),n=l.keyFor(t),r=n!==void 0&&l.isHeld(n);return e.json({executing:r||t.isExecuting()})}),c.get(`/pending`,async e=>{let t=await a(e);return e.json({pending:t.getPendingPrompt()})}),c}function m(e){let t=null,i=null,a=n(e?.admission),o=e=>Object.assign(Error(`HTTP transport ${e}.`),{name:`TransportLifecycleError`,code:e,transportName:`http`});return{name:`http`,lifecycle:Object.freeze({kind:`service`}),attach(e){t=e},async start(){if(!t)throw o(`not-attached`);if(i)throw o(`already-started`);let n=p({sessionFactory:()=>t,admission:a,onStreamFailure:e?.onStreamFailure,attribution:e?.attribution});i=e?.basePath?new r().route(e.basePath,n):n},async stop(){i=null,t=null},getApp(){if(!i)throw Error(`Transport not started. Call start() first.`);return i},getAdmissionToken(){return a.token}}}export{p as createAgentRoutes,m as createHttpTransport};
+import{bearerCredential as e,credentialMatches as t,resolveAdmission as n}from"@robota-sdk/agent-transport/node";import{Hono as r}from"hono";import{decodeClientMessage as i}from"@robota-sdk/agent-transport";import{streamSSE as a}from"hono/streaming";function o(){let e=new Map;return{record(t,n){let r=e.get(t);r===void 0&&(r=new Map,e.set(t,r)),r.set(n.event.id,n)},forget(t,n){e.get(t)?.delete(n)},list:t=>[...e.get(t)?.values()??[]],find:(t,n)=>e.get(t)?.get(n),clear(t){e.delete(t)}}}function s(e){return async t=>{let n=await e.sessionFactory(t),r=e.claims.keyFor(n);return t.json({prompts:r===void 0?[]:e.openPrompts.list(r)})}}function c(e){let{sessionFactory:t,claims:n,openPrompts:r,attribution:a}=e;return async e=>{let o=await t(e),s=e.req.param(`id`)??``,c;try{c=await e.req.json()}catch{return e.json({error:`the body must be a JSON object`},400)}let l=n.keyFor(o),u=l===void 0?void 0:r.find(l,s);if(l===void 0||u===void 0)return e.json({error:`no open prompt with this id`},404);if(u.type===`permission_request`){let t=i({type:`permission-response`,id:s,result:c?.result});if(!t.ok||t.message.type!==`permission-response`)return e.json({error:`result must be true, false, "allow-session" or "allow-project"`},400);o.resolvePermission(s,t.message.result,a?.driverId)}else{let t=i({type:`ask-response`,id:s,response:c?.response});if(!t.ok||t.message.type!==`ask-response`)return e.json({error:`response must be { "type": "answer", "values": string[], "text"?: string } or { "type": "cancelled" }`},400);o.resolveAsk(s,t.message.response,a?.driverId)}return r.find(l,s)===void 0?e.json({ok:!0}):e.json({error:`the session did not accept this answer`},409)}}function l(e,t,n,r,i){let a=(t,r)=>{e.on(t,r),n.push(()=>e.off(t,r))},o=(e,n)=>t.writeSSE({event:e,data:JSON.stringify(n)}).catch(()=>{}),s,c=new Promise(e=>{s=e});return a(`text_delta`,e=>void o(`text_delta`,{delta:e})),a(`tool_start`,e=>void o(`tool_start`,e)),a(`tool_end`,e=>void o(`tool_end`,e)),a(`thinking`,e=>void o(`thinking`,{isThinking:e})),i!==void 0&&u(a,o,i),a(`complete`,async e=>{await o(`complete`,e),s()}),a(`interrupted`,async e=>{await o(`interrupted`,e),s()}),a(`error`,async e=>{await o(`error`,{message:e.message}),s()}),t.onAbort(()=>d(e,r,s)),c}function u(e,t,n){e(`permission_request`,e=>{n.record({type:`permission_request`,event:e}),t(`permission_request`,e)}),e(`ask_request`,e=>{n.record({type:`ask_request`,event:e}),t(`ask_request`,e)}),e(`prompt_resolved`,e=>{n.forget(e.id),t(`prompt_resolved`,e)})}function d(e,t,n){try{e.abort()}catch(e){try{t?.(e instanceof Error?e:Error(String(e)))}catch{}}finally{n()}}function f(e,t){for(let t of e)try{t()}catch{}t()}function p(e,t,n,r,i,a){return async o=>{try{let s=[];try{let n=l(e,o,s,r,a);await(i===void 0?e.submit(t):e.submit(t,void 0,void 0,{...i})),await n}finally{f(s,n)}}catch(e){await m(e instanceof Error?e:Error(String(e)),o,r)}}}async function m(e,t,n){try{n?.(e)}catch{}await t.writeSSE({event:`error`,data:JSON.stringify({message:`the stream failed on the server after it opened — the turn may not have run`})}).catch(()=>{})}function h(e,t,n){let r=n.keyFor(t);return r===void 0?e.json({error:`concurrent-turn tracking is unavailable for this session, so this request cannot be served safely. Refusing rather than starting a turn that cannot be guaranteed to be yours.`},500):n.isHeld(r)||t.isExecuting()?e.json({error:`session busy — a turn is already in flight`},409):(n.hold(r),{claim:r})}function g(e){let{sessionFactory:t,claims:n,openPrompts:r,onStreamFailure:i,attribution:o}=e;return async e=>{let s=await t(e),c=await e.req.json();if(!c.prompt||typeof c.prompt!=`string`)return e.json({error:`prompt is required`},400);if(c.receivePrompts!==void 0&&typeof c.receivePrompts!=`boolean`)return e.json({error:`receivePrompts must be a boolean`},400);if(s.whenInitialized!==void 0)try{await s.whenInitialized()}catch{return e.json({error:`the session could not be started`},500)}let l=h(e,s,n);if(l instanceof Response)return l;let{claim:u}=l,d=!1,f=()=>{d||(d=!0,r.clear(u),n.release(u))},m=c.receivePrompts===!0?{record:e=>r.record(u,e),forget:e=>r.forget(u,e)}:void 0;try{return await a(e,p(s,c.prompt,f,i,o,m))}catch(e){throw f(),e}}}function _(){let e=new Set;return{keyFor(e){try{let t=e.getSession().getSessionId();return typeof t==`string`&&t!==``?t:void 0}catch{return}},isHeld:t=>e.has(t),hold:t=>void e.add(t),release:t=>void e.delete(t)}}function v(i){let{sessionFactory:a,onStreamFailure:l,attribution:u}=i,d=new r,f=_(),p=o(),m=n(i.admission);return d.use(`*`,async(n,r)=>m.token===null||t(m.token,e(n.req.header(`authorization`)))?r():n.json({error:`unauthorized`},401)),d.post(`/submit`,g({sessionFactory:a,claims:f,openPrompts:p,onStreamFailure:l,attribution:u})),d.get(`/prompts`,s({sessionFactory:a,claims:f,openPrompts:p,attribution:u})),d.post(`/prompts/:id`,c({sessionFactory:a,claims:f,openPrompts:p,attribution:u})),d.post(`/command`,async e=>{let t=await a(e),n=await e.req.json();if(!n.name||typeof n.name!=`string`)return e.json({error:`name is required`},400);let r=await t.executeCommand(n.name,n.args??``,`remote`);return r?e.json(r):e.json({error:`Unknown command: ${n.name}`},404)}),d.post(`/abort`,async e=>((await a(e)).abort(),e.json({ok:!0}))),d.post(`/cancel-queue`,async e=>((await a(e)).cancelQueue(),e.json({ok:!0}))),d.get(`/messages`,async e=>{let t=await a(e);return e.json(t.getMessages())}),d.get(`/context`,async e=>{let t=await a(e);return e.json(t.getContextState())}),d.get(`/executing`,async e=>{let t=await a(e),n=f.keyFor(t),r=n!==void 0&&f.isHeld(n);return e.json({executing:r||t.isExecuting()})}),d.get(`/pending`,async e=>{let t=await a(e);return e.json({pending:t.getPendingPrompt()})}),d}function y(e){let t=null,i=null,a=n(e?.admission),o=e=>Object.assign(Error(`HTTP transport ${e}.`),{name:`TransportLifecycleError`,code:e,transportName:`http`});return{name:`http`,lifecycle:Object.freeze({kind:`service`}),attach(e){t=e},async start(){if(!t)throw o(`not-attached`);if(i)throw o(`already-started`);let n=v({sessionFactory:()=>t,admission:a,onStreamFailure:e?.onStreamFailure,attribution:e?.attribution});i=e?.basePath?new r().route(e.basePath,n):n},async stop(){i=null,t=null},getApp(){if(!i)throw Error(`Transport not started. Call start() first.`);return i},getAdmissionToken(){return a.token}}}export{v as createAgentRoutes,y as createHttpTransport};
 //# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/submit-stream.ts","../../src/submit-route.ts","../../src/turn-claims.ts","../../src/routes.ts","../../src/http-transport.ts"],"sourcesContent":["/**\n * RUNTIME-14 / RUNTIME-38 — relaying ONE turn to an SSE client, and letting go of it afterwards.\n *\n * Split out of `routes.ts` under the file-size ceiling. The route's job is to decide whether this\n * request may start a turn; relaying the turn's events, tearing the subscriptions down, and telling\n * a client whose stream broke after the headers went out is a different job with its own failure\n * modes, and it was four fifths of the handler.\n */\n\nimport type { IHttpTransportSession } from './http-session.js';\nimport type { SSEStreamingApi } from 'hono/streaming';\nimport type { ISubmitOptions } from '@robota-sdk/agent-interface-session';\n\n/**\n * Where the DETAIL of a post-headers stream failure goes — injected, never imported.\n *\n * The first version imported `createLogger` from `agent-core`, and review held it against two\n * authorities at once: `project-structure.md` declares this package contract-pure (transports\n * depend on the contracts and the protocol, nothing else), and its side-concern rule says a logging\n * destination \"must be injected, not imported directly\". The host that mounts this router decides\n * where diagnostics go; a module-level singleton decided it for every host, with no override.\n *\n * Absent, the detail is dropped — by the HOST's explicit default, which is a different thing from\n * this module deleting it: the client still learns the stream failed, and the host was offered the\n * detail at the boundary where it mounts the route.\n */\nexport type TStreamFailureListener = (error: Error) => void;\n\n/**\n * Who a submitted turn is attributed to, assigned by the HOST that composed the routes — never read\n * from the request, because a client could otherwise claim to be the local operator or another\n * surface in the usage record. Absent means the session's own default.\n */\nexport type TTurnAttribution = Pick<ISubmitOptions, 'driverId' | 'surface'>;\n\n/**\n * Wire every relay subscription and the abort path; answer with the promise that settles when the\n * turn is over (or refused one).\n *\n * The subscriptions are wired OUTSIDE the promise executor. Inside it, a throw from `session.on` —\n * a bad handler, an EventEmitter listener cap — is caught by the Promise constructor and becomes an\n * already-rejected `done` instead of propagating. Execution then reaches `await session.submit`, so\n * a REAL TURN is consumed with only some of its listeners attached and nothing to relay it, and the\n * rejection surfaces afterwards at `await done` — by which point the turn is gone.\n */\nfunction wireRelay(\n  session: IHttpTransportSession,\n  stream: SSEStreamingApi,\n  cleanup: Array<() => void>,\n  onFailure: TStreamFailureListener | undefined,\n): Promise<void> {\n  const subscribe = <T>(event: string, handler: (data: T) => void): void => {\n    session.on(event as 'text_delta', handler as () => void);\n    cleanup.push(() => session.off(event as 'text_delta', handler as () => void));\n  };\n\n  // RUNTIME-14: await + catch every SSE write so a write to a client-closed stream is a blessed\n  // no-op, not an unhandled rejection (post-headers errors bypass Hono's onError).\n  const write = (event: string, data: unknown): Promise<void> =>\n    stream.writeSSE({ event, data: JSON.stringify(data) }).catch(() => {\n      // allow-fallback: client closed the stream mid-write — nothing to deliver; the finally teardown\n      // (RUNTIME-14) removes the listeners, so this write has nothing left to do.\n    });\n\n  let settle!: () => void;\n  const done = new Promise<void>((resolve) => {\n    settle = resolve;\n  });\n\n  subscribe('text_delta', (delta: string) => void write('text_delta', { delta }));\n  subscribe('tool_start', (state) => void write('tool_start', state));\n  subscribe('tool_end', (state) => void write('tool_end', state));\n  subscribe('thinking', (isThinking: boolean) => void write('thinking', { isThinking }));\n\n  // Flush the terminal event before resolving, so the resolve → cleanup → stream-close\n  // continuation cannot race ahead of the write.\n  subscribe('complete', async (result) => {\n    await write('complete', result);\n    settle();\n  });\n  subscribe('interrupted', async (result) => {\n    await write('interrupted', result);\n    settle();\n  });\n  subscribe('error', async (error: Error) => {\n    await write('error', { message: error.message });\n    settle();\n  });\n\n  // RUNTIME-14: on client disconnect, CANCEL the underlying run (not merely stop writing) and\n  // unblock `done` so the finally teardown runs — otherwise `done` would never resolve and the\n  // listeners leak.\n  stream.onAbort(() => onClientAbort(session, onFailure, settle));\n\n  return done;\n}\n\n/**\n * The abort path, alone, because every clause of it is load-bearing and review shaped each one.\n *\n * `settle` in a `finally`: an `abort()` that throws used to cost a listener leak, and with the\n * claim registry it costs the SESSION — `done` never resolves, the teardown never runs, the claim\n * is held forever, and every future /submit is 409.\n *\n * The throw is REPORTED, not rethrown: this handler runs inside Hono's abort dispatch, OUTSIDE the\n * relay's try/catch, so a rethrow is an unhandled rejection rather than a reported failure. The\n * detail goes where every other stream failure's detail goes.\n */\nfunction onClientAbort(\n  session: IHttpTransportSession,\n  onFailure: TStreamFailureListener | undefined,\n  settle: () => void,\n): void {\n  try {\n    session.abort();\n  } catch (error) {\n    // allow-fallback: an abort that throws is the HOST's news, not the runner's\n    try {\n      onFailure?.(error instanceof Error ? error : new Error(String(error)));\n    } catch {\n      // allow-fallback: a listener that throws must not replace the abort path's settle\n      // Same rule as reportStreamFailure: the host's listener failing is the host's to see.\n    }\n  } finally {\n    settle();\n  }\n}\n\n/**\n * Teardown that cannot take the claim with it.\n *\n * Each entry individually, and review is why: these are `session.off` calls, and one that throws\n * inside a bare loop would end the caller's `finally` before `release()` ran — the same\n * claim-held-forever the abort path closes, reintroduced two lines down. A failed unsubscribe\n * forfeits one listener; taking the release with it forfeits the session.\n */\nfunction teardown(cleanup: Array<() => void>, release: () => void): void {\n  for (const fn of cleanup) {\n    try {\n      fn();\n    } catch {\n      // allow-fallback: a failed unsubscribe must not take the claim release with it\n      // The listener stays attached — the lesser loss, and the one the next turn can survive.\n    }\n  }\n  // RUNTIME-38: released here for the same reason — a turn that throws must not wedge the session\n  // it claimed.\n  release();\n}\n\n/**\n * The `streamSSE` callback for one submitted prompt.\n *\n * `release` is called in the teardown, ALWAYS — on completion, on error, and on client disconnect.\n * It is passed in rather than taken here because the claim is made before the stream opens: a claim\n * whose release lives only inside the stream is a lock that outlives the request that took it.\n * (This block sat on `wireRelay` for one round after the split stranded it — the stale-doc shape\n * this file keeps writing about, caught doing it.)\n */\nexport function relayTurn(\n  session: IHttpTransportSession,\n  prompt: string,\n  release: () => void,\n  onFailure?: TStreamFailureListener,\n  attribution?: TTurnAttribution,\n): (stream: SSEStreamingApi) => Promise<void> {\n  return async (stream) => {\n    // NOTHING may escape this callback, and the reason is measured rather than stylistic. Hono's\n    // `streamSSE` runner calls its `onError` argument and then UNCONDITIONALLY writes\n    // `event: error, data: e.message` to the stream — so an escaped exception reaches the client\n    // verbatim no matter what the handler withheld. The probe that found it saw TWO error events:\n    // this module's generic line, then Hono's raw one. The only place the trust boundary can be\n    // held is here, before the throw reaches the runner at all.\n    try {\n      // The inner `try` opens BEFORE the wiring: a throw from `session.on` inside `wireRelay`\n      // leaves the session claimed, and the `finally` is what releases it — opened later, every\n      // later request gets 409 forever.\n      const cleanup: Array<() => void> = [];\n      try {\n        const done = wireRelay(session, stream, cleanup, onFailure);\n        await (attribution === undefined\n          ? session.submit(prompt)\n          : session.submit(prompt, undefined, undefined, { ...attribution }));\n        await done;\n      } finally {\n        // RUNTIME-14: teardown ALWAYS runs — on completion, error, OR client disconnect — so the\n        // session event listeners can never leak, and the claim always comes back.\n        teardown(cleanup, release);\n      }\n    } catch (error) {\n      await reportStreamFailure(\n        error instanceof Error ? error : new Error(String(error)),\n        stream,\n        onFailure,\n      );\n    }\n  };\n}\n\n/**\n * What to tell a client whose stream failed AFTER the response headers were sent.\n *\n * A throw at that point cannot become an error status — the client already has a 200 and an open\n * stream. Without this the throw is an UNHANDLED rejection: it left the process silently in a\n * browser and turned the `quality` job red under vitest, which is how it was found.\n *\n * By the time this runs, `relayTurn`'s teardown has removed the listeners and released the claim.\n * This handler owes only the telling.\n *\n * The CLIENT gets a generic line and the HOST gets the detail, and review moved this three times.\n * The first version sent `error.message` verbatim; the second sent it to a package logger imported\n * from `agent-core`, which the layering rule refuses (see `TStreamFailureListener`). What survives\n * both rounds is the boundary itself: an exception escaping the stream callback is not a message\n * anything composed for a client — it can carry provider internals, paths, or stack fragments,\n * exactly what the 500 branch in `routes.ts` withholds at the same boundary.\n *\n * The session's own `error` EVENT is different and stays verbatim in `relayTurn` above: that is the\n * session's client-facing error channel, worded by the session (`humanizeApiError`) and relayed\n * identically by the WS transport. One is a message meant for the client; this one never was.\n */\nexport async function reportStreamFailure(\n  error: Error,\n  stream: SSEStreamingApi,\n  onFailure?: TStreamFailureListener,\n): Promise<void> {\n  try {\n    onFailure?.(error);\n  } catch {\n    // allow-fallback: a listener that throws must not take the client's only notification with it\n    // The listener is the host's code; its failure is the host's to see, and the write below is the\n    // one thing this function owes the client either way.\n  }\n  await stream\n    .writeSSE({\n      event: 'error',\n      data: JSON.stringify({\n        message: 'the stream failed on the server after it opened — the turn may not have run',\n      }),\n    })\n    .catch(() => {\n      // allow-fallback: the stream is already gone, which is the one case where there is nobody\n      // left to tell. Rethrowing here would restore the unhandled rejection this exists to remove.\n    });\n}\n","/**\n * `POST /submit` — the admission decision and the handler that hands an admitted turn to the relay.\n *\n * Split from `routes.ts` under the file-size ceiling, along the same seam the review rounds carved:\n * the route factory is a LIST of routes, and this one carries the concurrency-admission decision\n * plus the claim lifecycle, which is a different job from mounting endpoints.\n */\n\nimport { streamSSE } from 'hono/streaming';\n\nimport { relayTurn } from './submit-stream.js';\n\nimport type { IHttpTransportSession } from './http-session.js';\nimport type { TStreamFailureListener, TTurnAttribution } from './submit-stream.js';\nimport type { ITurnClaims } from './turn-claims.js';\nimport type { Context } from 'hono';\n\n/**\n * Callback that resolves an HTTP session port from the request context.\n *\n * It need NOT return the same object twice for the same logical session. It briefly did: `/submit`\n * keyed its concurrent-turn claim on object identity, so a factory building a fresh wrapper per\n * call — a proxy, an adapter, a `{...session}` copy — defeated the guard in silence. The first\n * answer was to document that as a requirement callers had to keep, and a requirement neither the\n * type system nor a test can check is not a contract, it is a hope.\n *\n * What the session already promises is enough. `getSession(): { getSessionId(): string }` names the\n * session, the claim is keyed by that name, and the requirement is gone rather than written down.\n *\n * The session must therefore BE nameable. `/submit` refuses with 500 when `getSessionId()` returns\n * nothing, because without an id the concurrent-turn guarantee does not exist and serving anyway\n * would hand back the bug to whoever could least tell. The contract types that method as returning\n * a `string`, so a conformant session never meets it.\n *\n * (Review moved this block here: it sat on the RE-EXPORT in `routes.ts` after the split, where the\n * person editing the definition would never see it.)\n */\nexport type TSessionFactory = (\n  c: Context,\n) => IHttpTransportSession | Promise<IHttpTransportSession>;\n\n/**\n * Admit this request to ONE turn on its session, or answer why not.\n *\n * Returns the claim key it HOLDS on success — the caller owes its release — or the refusal\n * Response. A named unit, and review is why: the admission decision (nameable? busy? claim) is what\n * this route decides, independently testable from the stream wiring it hands the turn to.\n */\nfunction admitTurn(\n  c: Context,\n  session: IHttpTransportSession,\n  claims: ITurnClaims,\n): Response | { claim: string } {\n  // RUNTIME-38: the session is single-threaded (one turn at a time) and shared across requests, so a\n  // concurrent /submit would cross-subscribe to the same emitter and interleave two clients' events.\n  //\n  // The route CLAIMS the turn rather than asking whether one is running, and that difference is the\n  // whole fix. `session.isExecuting()` is set inside `submit()` past an `await ensureInitialized()`\n  // — an unconditional suspension point — so two requests both read `false`, both call `submit`, and\n  // the loser coalesces into the pending queue while its HTTP response streams back the WINNER'S\n  // events. One turn delivered to two clients as if each had asked for it, which is worse than the\n  // race the earlier comment described and then wrongly declared absent.\n  //\n  // A synchronous flag on the route closes it because there is no suspension point between reading\n  // and setting it. It is released in the stream's `finally`, so a turn that throws does not leave\n  // the route wedged.\n  //\n  // BOTH are asked because neither subsumes the other. The claim is what this ROUTE knows;\n  // `isExecuting()` is what the SESSION knows, including a turn started by another surface — the\n  // TUI, a WS client, a previous process — which the claim cannot see.\n  // A session that cannot name itself is REFUSED, not served racily. The busy check is a guarantee\n  // only while the claim is keyed by a real id: with no id it falls back to `isExecuting()` alone,\n  // which the comment above documents as the racy read this route exists to stop relying on.\n  // Serving anyway would degrade the fix back into the bug for exactly the callers who could not\n  // be told they were affected.\n  //\n  // `getSession(): { getSessionId(): string }` is required by the contract, so this is unreachable\n  // for a conformant session. It is a 500 rather than a 503: the session is not temporarily\n  // unavailable, it does not meet the contract this route is built on, which is a defect on the\n  // server side of the boundary and not a condition that clears on retry.\n  const claim = claims.keyFor(session);\n  if (claim === undefined) {\n    return c.json(\n      {\n        // No internal method signature: this route can be mounted outside a trust boundary, and\n        // the caller cannot act on `getSession().getSessionId()` anyway — it names a contract\n        // they do not implement. The HOST needs the detail and gets it from the comment above\n        // this branch; the client needs to know its request was refused and why in its own terms.\n        error:\n          'concurrent-turn tracking is unavailable for this session, so this request cannot be ' +\n          'served safely. Refusing rather than starting a turn that cannot be guaranteed to be ' +\n          'yours.',\n      },\n      500,\n    );\n  }\n  if (claims.isHeld(claim) || session.isExecuting()) {\n    return c.json({ error: 'session busy — a turn is already in flight' }, 409);\n  }\n  claims.hold(claim);\n  return { claim };\n}\n\nexport function submitHandler(\n  sessionFactory: TSessionFactory,\n  claims: ITurnClaims,\n  onStreamFailure?: TStreamFailureListener,\n  attribution?: TTurnAttribution,\n) {\n  return async (c: Context) => {\n    const session = await sessionFactory(c);\n    const body = await c.req.json<{ prompt: string }>();\n\n    if (!body.prompt || typeof body.prompt !== 'string') {\n      return c.json({ error: 'prompt is required' }, 400);\n    }\n\n    // A session still building itself cannot name itself yet, and the claim needs its name. The\n    // claim itself is still taken synchronously after this, so two requests that both waited here\n    // start one turn between them.\n    if (session.whenInitialized !== undefined) {\n      try {\n        await session.whenInitialized();\n      } catch {\n        // The reason can name host paths or settings; the client only needs to know it failed.\n        return c.json({ error: 'the session could not be started' }, 500);\n      }\n    }\n\n    const admitted = admitTurn(c, session, claims);\n    if (admitted instanceof Response) {\n      return admitted;\n    }\n    const { claim } = admitted;\n    // SINGLE-SHOT, and review traced the double-release it prevents: the relay's teardown releases\n    // this claim on the normal path, and if a future Hono ever rejected the outer promise AFTER the\n    // callback completed, the catch below would release the SAME KEY a second time — by which point\n    // another request may hold it, and the second release would free that request's claim, which is\n    // the cross-talk this registry exists to prevent. A release that has happened is not a release\n    // that can happen again.\n    let released = false;\n    const releaseOnce = (): void => {\n      if (!released) {\n        released = true;\n        claims.release(claim);\n      }\n    };\n\n    // The claim is taken OUTSIDE the callback, so its release cannot live only in the callback's\n    // `finally` — a claim whose release is not in the same protected region is a lock, not a claim,\n    // which this file states one level in. If `streamSSE` throws before it ever runs the callback,\n    // this releases and rethrows; the callback's own `finally` covers everything after it starts.\n    //\n    // REPRODUCED at the module boundary: `routes-streamsse-throw.test.ts` mocks `hono/streaming`\n    // to throw before the callback ever runs and asserts the second request is not 409 — a leaked\n    // claim is what this catch exists to prevent. Two rounds shipped it as honestly-labelled\n    // unverified code (a throw from `session.on` lands INSIDE the callback, where the inner\n    // `finally` releases — measured, a case built that way is green with this catch removed), and\n    // review supplied the third option: stub the boundary, not Hono's internals.\n    try {\n      // NO third argument, deliberately: Hono's runner follows any `onError` by writing the raw\n      // `e.message` to the stream, so the only leak-proof shape is a callback nothing escapes —\n      // `relayTurn` catches its own failures and reports them generically. An onError here would be\n      // dead code that turns into a leak the day it stops being dead.\n      // `await`, so the catch below covers a REJECTION as well as a synchronous throw. Today's\n      // Hono returns the Response synchronously and only the sync path is real — but review is\n      // right that a version returning a rejecting promise would sail past a bare `return`, and\n      // the cost of closing that class is one keyword.\n      return await streamSSE(\n        c,\n        relayTurn(session, body.prompt, releaseOnce, onStreamFailure, attribution),\n      );\n    } catch (error) {\n      releaseOnce();\n      throw error;\n    }\n  };\n}\n","/**\n * RUNTIME-38 — who currently holds the one turn a session can run.\n *\n * Split out of `routes.ts`, which had grown past its size ceiling: routing is one job and deciding\n * whether a second turn may start on a session is another, and the second is the only part of that\n * file with state of its own.\n *\n * PER SESSION, not one flag for the router. `sessionFactory` resolves a session per request (the\n * documented multi-tenant shape), so a single flag made one tenant's turn refuse every other\n * tenant's — a busy neighbour is not a reason to refuse you, and that is a worse defect than the\n * race it closed.\n */\n\nimport type { IHttpTransportSession } from './http-session.js';\n\nexport interface ITurnClaims {\n  /** The key this session is claimed under, or `undefined` when it will not name itself. */\n  keyFor(session: IHttpTransportSession): string | undefined;\n  isHeld(key: string): boolean;\n  hold(key: string): void;\n  release(key: string): void;\n}\n\n/**\n * A claim registry keyed by the session's declared ID, not by object identity.\n *\n * Keying on the OBJECT makes identity-stability a requirement of every caller that nothing can\n * check: a `sessionFactory` returning a fresh wrapper per call for the same logical session — a\n * proxy, an adapter, a spread copy — defeats the guard in silence, and every request looks\n * unclaimed. `getSession(): { getSessionId(): string }` already names the session, so asking for the\n * id turns an unenforceable requirement into no requirement at all.\n *\n * A claim is released in the caller's `finally`, so this does not grow with the number of sessions\n * the host has ever served — which is what weak keying would otherwise buy.\n */\nexport function createTurnClaims(): ITurnClaims {\n  const held = new Set<string>();\n\n  return {\n    keyFor(session) {\n      try {\n        // No `?.`: `getSession(): { getSessionId(): string }` is non-nullable, and optional chaining\n        // here would suggest the contract allows an absent session when it does not. A session that\n        // breaks the contract anyway is caught below.\n        const id = session.getSession().getSessionId();\n        return typeof id === 'string' && id !== '' ? id : undefined;\n      } catch {\n        // allow-fallback: an unnameable session must not be guessed at\n        // A session that throws while naming itself has not told us who it is, and guessing would\n        // claim the wrong turn. The CALLER refuses on `undefined`, so nothing is swallowed here.\n        //\n        // `undefined` rather than a placeholder — a shared fallback key would collide every\n        // unnameable session into one claim and refuse them all as each other's neighbours. There is\n        // no `isExecuting()` fallback on the submit path, and an earlier comment said there was.\n        return undefined;\n      }\n    },\n    isHeld: (key) => held.has(key),\n    hold: (key) => void held.add(key),\n    release: (key) => void held.delete(key),\n  };\n}\n","/**\n * HTTP transport adapter — exposes the declared session capabilities over REST API.\n *\n * Built on Hono for Cloudflare Workers + Node.js + AWS Lambda compatibility.\n * Exposes the core session methods (a subset; background-task, job-group, and\n * execution-workspace methods are WS-only).\n */\n\nimport {\n  bearerCredential,\n  credentialMatches,\n  resolveAdmission,\n} from '@robota-sdk/agent-transport/node';\nimport { Hono } from 'hono';\n\nimport { submitHandler } from './submit-route.js';\nimport { createTurnClaims } from './turn-claims.js';\n\nimport type { TSessionFactory } from './submit-route.js';\nimport type { TStreamFailureListener, TTurnAttribution } from './submit-stream.js';\nimport type {\n  ITransportAdmission,\n  ITransportAdmissionConfig,\n} from '@robota-sdk/agent-interface-transport';\n\n// Re-exported so existing importers keep their path; the definition and its rationale live with\n// the code that enforces them, in `submit-route.ts`.\nexport type { TSessionFactory } from './submit-route.js';\n\nexport interface IAgentRoutesOptions {\n  /** Resolve an HTTP session port per request (e.g., by auth token, session ID). */\n  sessionFactory: TSessionFactory;\n  /**\n   * Where the DETAIL of a post-headers stream failure goes (the client gets only a generic line —\n   * see `submit-stream.ts`). Injected per the side-concern rule: the host decides the destination,\n   * and absent means the host chose to drop it.\n   */\n  onStreamFailure?: TStreamFailureListener;\n  /**\n   * SEC-008: what a peer must present to reach the session. REQUIRED — there is no shape of this\n   * option that means \"I did not think about it\", which is the state these routes shipped in.\n   *\n   * `{ open: true, openReason: '…' }` still runs with no credential, and that is a legitimate answer\n   * for a host that has its own boundary in front. It just has to be written down.\n   */\n  admission: ITransportAdmissionConfig | ITransportAdmission;\n  /**\n   * Who `/submit` turns are attributed to — the driver and product surface the HOST assigns, as the\n   * WebSocket transport's `driverId`/`surface` do. Never taken from the request body. Absent leaves\n   * the session's own default.\n   */\n  attribution?: TTurnAttribution;\n}\n\n/**\n * Create a Hono router with all agent HTTP endpoints.\n *\n * Usage:\n * ```typescript\n * const routes = createAgentRoutes({ sessionFactory });\n * app.route('/agent', routes);          // mount on existing app\n * export default routes;                // or use standalone (CF Workers)\n * ```\n */\nexport function createAgentRoutes(options: IAgentRoutesOptions): Hono {\n  const { sessionFactory, onStreamFailure, attribution } = options;\n  const app = new Hono();\n\n  // RUNTIME-38: one turn at a time, per session — `turn-claims.ts` owns what that means and why it\n  // is keyed by the session's declared ID rather than by object identity.\n  const claims = createTurnClaims();\n\n  // SEC-008: resolved ONCE, at construction, so a transport that cannot mint a credential fails to\n  // build rather than serving without one. Resolving per request would also mint a new token per\n  // request, which no peer could ever present.\n  // Either shape goes in: `resolveAdmission` is idempotent, so an already-resolved admission comes\n  // back unchanged and a config is resolved. `http-transport.ts` therefore does not have to take\n  // its resolved admission apart and rebuild a config for this to resolve again — two resolutions\n  // of one decision, and a mint on the second if the first had opened without a reason (review).\n  //\n  // This used to pick between the two with `'token' in options.admission`, and review showed that\n  // cannot work: BOTH interfaces declare a `token`, so the shapes differ only by VALUE. A config of\n  // `{ token: '' }` — documented as \"mint a fresh one\" — was read as pre-resolved and installed the\n  // EMPTY STRING as the required credential, which a peer sending an empty bearer would match. The\n  // discriminator is gone rather than repaired; there is nothing here left to get wrong.\n  const admission = resolveAdmission(options.admission);\n\n  /**\n   * The trust boundary, installed BEFORE every route rather than checked inside each one.\n   *\n   * Before this, `POST /submit` reached `session.submit` and `POST /command` reached\n   * `session.executeCommand` with nothing in between — remote arbitrary execution with no gate, and\n   * an unauthenticated request looked exactly like an authorised one in both directions.\n   *\n   * A missing credential and a wrong one get the same answer, deliberately: telling them apart tells\n   * a caller which half they got right.\n   */\n  app.use('*', async (c, next) => {\n    if (admission.token === null) return next();\n    if (credentialMatches(admission.token, bearerCredential(c.req.header('authorization')))) {\n      return next();\n    }\n    return c.json({ error: 'unauthorized' }, 401);\n  });\n\n  // POST /submit — execute prompt, stream events via SSE\n  app.post('/submit', submitHandler(sessionFactory, claims, onStreamFailure, attribution));\n\n  // POST /command — execute system command\n  app.post('/command', async (c) => {\n    const session = await sessionFactory(c);\n    const body = await c.req.json<{ name: string; args?: string }>();\n\n    if (!body.name || typeof body.name !== 'string') {\n      return c.json({ error: 'name is required' }, 400);\n    }\n\n    // SEC-008: 'remote', not the default 'user'. A peer over HTTP is not the person at the keyboard,\n    // and defaulting to the local operator both mis-attributes the call and skips the 'remote' policy\n    // seam that exists to treat the two differently. Admission decided WHO may reach the session; it\n    // does not say who they are. (The MCP adapter had the same defect; this is its sibling.)\n    const result = await session.executeCommand(body.name, body.args ?? '', 'remote');\n    if (!result) {\n      return c.json({ error: `Unknown command: ${body.name}` }, 404);\n    }\n    return c.json(result);\n  });\n\n  // POST /abort — abort current execution\n  app.post('/abort', async (c) => {\n    const session = await sessionFactory(c);\n    session.abort();\n    return c.json({ ok: true });\n  });\n\n  // POST /cancel-queue — cancel queued prompt\n  app.post('/cancel-queue', async (c) => {\n    const session = await sessionFactory(c);\n    session.cancelQueue();\n    return c.json({ ok: true });\n  });\n\n  // GET /messages — get message history\n  app.get('/messages', async (c) => {\n    const session = await sessionFactory(c);\n    return c.json(session.getMessages());\n  });\n\n  // GET /context — get context window state\n  app.get('/context', async (c) => {\n    const session = await sessionFactory(c);\n    return c.json(session.getContextState());\n  });\n\n  // GET /executing — check if currently executing\n  //\n  // Reports the SAME \"busy\" that `/submit` refuses on: the route's own claim OR the session's\n  // `isExecuting()`. Asking only the session lets a client polling here see `executing: false` and\n  // still get a 409 from `/submit`, and two endpoints disagreeing about one word is a worse answer\n  // than either of them alone.\n  app.get('/executing', async (c) => {\n    const session = await sessionFactory(c);\n    const claim = claims.keyFor(session);\n    const claimed = claim !== undefined && claims.isHeld(claim);\n    return c.json({ executing: claimed || session.isExecuting() });\n  });\n\n  // GET /pending — get pending queued prompt\n  app.get('/pending', async (c) => {\n    const session = await sessionFactory(c);\n    return c.json({ pending: session.getPendingPrompt() });\n  });\n\n  return app;\n}\n","/**\n * ITransportAdapter implementation for HTTP transport.\n *\n * Wraps createAgentRoutes into the unified ITransportAdapter interface\n * while exposing the underlying Hono app via getApp().\n */\n\nimport { resolveAdmission } from '@robota-sdk/agent-transport/node';\nimport { Hono } from 'hono';\n\nimport { createAgentRoutes } from './routes.js';\n\nimport type { IHttpTransportSession } from './http-session.js';\nimport type { TStreamFailureListener, TTurnAttribution } from './submit-stream.js';\nimport type {\n  ITransportAdapter,\n  ITransportAdmissionConfig,\n  ITransportLifecycleError,\n} from '@robota-sdk/agent-interface-transport';\n\nexport interface IHttpTransportOptions {\n  /** Optional: base path prefix for routes. */\n  basePath?: string;\n  /**\n   * SEC-008: what a peer must present. Omitted means SECURE — a credential is minted and\n   * `getAdmissionToken()` returns it for the host to hand to its client.\n   *\n   * This transport previously had no gate at all, so omitting the option used to mean \"anyone may\n   * execute anything\". Omission now means the safe thing, and running open takes saying so.\n   */\n  admission?: ITransportAdmissionConfig;\n  /**\n   * Where the DETAIL of a post-headers stream failure goes — forwarded to `createAgentRoutes`.\n   * Review found this seam missing: the option existed on the routes and not on the entry point\n   * README and the examples actually use, so \"the host decides the destination\" was a decision no\n   * host on this path could make. Same forwarding rule as `admission`, which sat beside it.\n   */\n  onStreamFailure?: TStreamFailureListener;\n  /** Who `/submit` turns are attributed to — forwarded to `createAgentRoutes`, like `admission`. */\n  attribution?: TTurnAttribution;\n}\n\nexport interface IHttpTransport extends ITransportAdapter<IHttpTransportSession> {\n  getApp(): Hono;\n  getAdmissionToken(): string | null;\n}\n\nexport function createHttpTransport(options?: IHttpTransportOptions): IHttpTransport {\n  let session: IHttpTransportSession | null = null;\n  let app: Hono | null = null;\n  // Resolved at CONSTRUCTION, not at start: a host needs the credential to hand to its client, and\n  // a transport that cannot mint one must fail before anything is served.\n  const admission = resolveAdmission(options?.admission);\n  const lifecycleError = (code: ITransportLifecycleError['code']): ITransportLifecycleError =>\n    Object.assign(new Error(`HTTP transport ${code}.`), {\n      name: 'TransportLifecycleError' as const,\n      code,\n      transportName: 'http',\n    });\n\n  return {\n    name: 'http',\n    lifecycle: Object.freeze({ kind: 'service' }),\n    attach(s: IHttpTransportSession) {\n      session = s;\n    },\n    async start() {\n      if (!session) throw lifecycleError('not-attached');\n      if (app) throw lifecycleError('already-started');\n      const routes = createAgentRoutes({\n        sessionFactory: () => session!,\n        // The decision already made, passed through — not taken apart and rebuilt for the routes to\n        // resolve a second time.\n        admission,\n        onStreamFailure: options?.onStreamFailure,\n        attribution: options?.attribution,\n      });\n      // TRANS-002 (issue #2480): `basePath` was declared and advertised but never read, so routes\n      // always mounted at root. It is honored here — or absent, in which case the routes ARE the app.\n      app = options?.basePath ? new Hono().route(options.basePath, routes) : routes;\n    },\n    async stop() {\n      app = null;\n      session = null;\n    },\n    getApp() {\n      if (!app) throw new Error('Transport not started. Call start() first.');\n      return app;\n    },\n    /** The credential this transport requires, or `null` when the host explicitly opened it. */\n    getAdmissionToken() {\n      return admission.token;\n    },\n  };\n}\n"],"mappings":"wLA6CA,SAAS,EACP,EACA,EACA,EACA,EACe,CACf,IAAM,GAAgB,EAAe,IAAqC,CACxE,EAAQ,GAAG,EAAuB,CAAqB,EACvD,EAAQ,SAAW,EAAQ,IAAI,EAAuB,CAAqB,CAAC,CAC9E,EAIM,GAAS,EAAe,IAC5B,EAAO,SAAS,CAAE,QAAO,KAAM,KAAK,UAAU,CAAI,CAAE,CAAC,CAAC,CAAC,UAAY,CAGnE,CAAC,EAEC,EACE,EAAO,IAAI,QAAe,GAAY,CAC1C,EAAS,CACX,CAAC,EA2BD,OAzBA,EAAU,aAAe,GAAkB,KAAK,EAAM,aAAc,CAAE,OAAM,CAAC,CAAC,EAC9E,EAAU,aAAe,GAAU,KAAK,EAAM,aAAc,CAAK,CAAC,EAClE,EAAU,WAAa,GAAU,KAAK,EAAM,WAAY,CAAK,CAAC,EAC9D,EAAU,WAAa,GAAwB,KAAK,EAAM,WAAY,CAAE,YAAW,CAAC,CAAC,EAIrF,EAAU,WAAY,KAAO,IAAW,CACtC,MAAM,EAAM,WAAY,CAAM,EAC9B,EAAO,CACT,CAAC,EACD,EAAU,cAAe,KAAO,IAAW,CACzC,MAAM,EAAM,cAAe,CAAM,EACjC,EAAO,CACT,CAAC,EACD,EAAU,QAAS,KAAO,IAAiB,CACzC,MAAM,EAAM,QAAS,CAAE,QAAS,EAAM,OAAQ,CAAC,EAC/C,EAAO,CACT,CAAC,EAKD,EAAO,YAAc,EAAc,EAAS,EAAW,CAAM,CAAC,EAEvD,CACT,CAaA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CACF,EAAQ,MAAM,CAChB,OAAS,EAAO,CAEd,GAAI,CACF,IAAY,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CAAC,CACvE,MAAQ,CAGR,CACF,QAAU,CACR,EAAO,CACT,CACF,CAUA,SAAS,EAAS,EAA4B,EAA2B,CACvE,IAAK,IAAM,KAAM,EACf,GAAI,CACF,EAAG,CACL,MAAQ,CAGR,CAIF,EAAQ,CACV,CAWA,SAAgB,EACd,EACA,EACA,EACA,EACA,EAC4C,CAC5C,OAAO,KAAO,IAAW,CAOvB,GAAI,CAIF,IAAM,EAA6B,CAAC,EACpC,GAAI,CACF,IAAM,EAAO,EAAU,EAAS,EAAQ,EAAS,CAAS,EAC1D,MAAO,IAAgB,IAAA,GACnB,EAAQ,OAAO,CAAM,EACrB,EAAQ,OAAO,EAAQ,IAAA,GAAW,IAAA,GAAW,CAAE,GAAG,CAAY,CAAC,GACnE,MAAM,CACR,QAAU,CAGR,EAAS,EAAS,CAAO,CAC3B,CACF,OAAS,EAAO,CACd,MAAM,EACJ,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,EACxD,EACA,CACF,CACF,CACF,CACF,CAuBA,eAAsB,EACpB,EACA,EACA,EACe,CACf,GAAI,CACF,IAAY,CAAK,CACnB,MAAQ,CAIR,CACA,MAAM,EACH,SAAS,CACR,MAAO,QACP,KAAM,KAAK,UAAU,CACnB,QAAS,6EACX,CAAC,CACH,CAAC,CAAC,CACD,UAAY,CAGb,CAAC,CACL,CCnMA,SAAS,EACP,EACA,EACA,EAC8B,CA4B9B,IAAM,EAAQ,EAAO,OAAO,CAAO,EAoBnC,OAnBI,IAAU,IAAA,GACL,EAAE,KACP,CAKE,MACE,gLAGJ,EACA,GACF,EAEE,EAAO,OAAO,CAAK,GAAK,EAAQ,YAAY,EACvC,EAAE,KAAK,CAAE,MAAO,4CAA6C,EAAG,GAAG,GAE5E,EAAO,KAAK,CAAK,EACV,CAAE,OAAM,EACjB,CAEA,SAAgB,EACd,EACA,EACA,EACA,EACA,CACA,OAAO,KAAO,IAAe,CAC3B,IAAM,EAAU,MAAM,EAAe,CAAC,EAChC,EAAO,MAAM,EAAE,IAAI,KAAyB,EAElD,GAAI,CAAC,EAAK,QAAU,OAAO,EAAK,QAAW,SACzC,OAAO,EAAE,KAAK,CAAE,MAAO,oBAAqB,EAAG,GAAG,EAMpD,GAAI,EAAQ,kBAAoB,IAAA,GAC9B,GAAI,CACF,MAAM,EAAQ,gBAAgB,CAChC,MAAQ,CAEN,OAAO,EAAE,KAAK,CAAE,MAAO,kCAAmC,EAAG,GAAG,CAClE,CAGF,IAAM,EAAW,EAAU,EAAG,EAAS,CAAM,EAC7C,GAAI,aAAoB,SACtB,OAAO,EAET,GAAM,CAAE,SAAU,EAOd,EAAW,GACT,MAA0B,CACzB,IACH,EAAW,GACX,EAAO,QAAQ,CAAK,EAExB,EAaA,GAAI,CASF,OAAO,MAAM,EACX,EACA,EAAU,EAAS,EAAK,OAAQ,EAAa,EAAiB,CAAW,CAC3E,CACF,OAAS,EAAO,CAEd,MADA,EAAY,EACN,CACR,CACF,CACF,CC9IA,SAAgB,GAAgC,CAC9C,IAAM,EAAO,IAAI,IAEjB,MAAO,CACL,OAAO,EAAS,CACd,GAAI,CAIF,IAAM,EAAK,EAAQ,WAAW,CAAC,CAAC,aAAa,EAC7C,OAAO,OAAO,GAAO,UAAY,IAAO,GAAK,EAAK,IAAA,EACpD,MAAQ,CAQN,MACF,CACF,EACA,OAAS,GAAQ,EAAK,IAAI,CAAG,EAC7B,KAAO,GAAQ,KAAK,EAAK,IAAI,CAAG,EAChC,QAAU,GAAQ,KAAK,EAAK,OAAO,CAAG,CACxC,CACF,CCGA,SAAgB,EAAkB,EAAoC,CACpE,GAAM,CAAE,iBAAgB,kBAAiB,eAAgB,EACnD,EAAM,IAAI,EAIV,EAAS,EAAiB,EAe1B,EAAY,EAAiB,EAAQ,SAAS,EAwFpD,OA5EA,EAAI,IAAI,IAAK,MAAO,EAAG,IACjB,EAAU,QAAU,MACpB,EAAkB,EAAU,MAAO,EAAiB,EAAE,IAAI,OAAO,eAAe,CAAC,CAAC,EAC7E,EAAK,EAEP,EAAE,KAAK,CAAE,MAAO,cAAe,EAAG,GAAG,CAC7C,EAGD,EAAI,KAAK,UAAW,EAAc,EAAgB,EAAQ,EAAiB,CAAW,CAAC,EAGvF,EAAI,KAAK,WAAY,KAAO,IAAM,CAChC,IAAM,EAAU,MAAM,EAAe,CAAC,EAChC,EAAO,MAAM,EAAE,IAAI,KAAsC,EAE/D,GAAI,CAAC,EAAK,MAAQ,OAAO,EAAK,MAAS,SACrC,OAAO,EAAE,KAAK,CAAE,MAAO,kBAAmB,EAAG,GAAG,EAOlD,IAAM,EAAS,MAAM,EAAQ,eAAe,EAAK,KAAM,EAAK,MAAQ,GAAI,QAAQ,EAIhF,OAHK,EAGE,EAAE,KAAK,CAAM,EAFX,EAAE,KAAK,CAAE,MAAO,oBAAoB,EAAK,MAAO,EAAG,GAAG,CAGjE,CAAC,EAGD,EAAI,KAAK,SAAU,KAAO,MAExB,MADsB,EAAe,CAAC,EAAA,CAC9B,MAAM,EACP,EAAE,KAAK,CAAE,GAAI,EAAK,CAAC,EAC3B,EAGD,EAAI,KAAK,gBAAiB,KAAO,MAE/B,MADsB,EAAe,CAAC,EAAA,CAC9B,YAAY,EACb,EAAE,KAAK,CAAE,GAAI,EAAK,CAAC,EAC3B,EAGD,EAAI,IAAI,YAAa,KAAO,IAAM,CAChC,IAAM,EAAU,MAAM,EAAe,CAAC,EACtC,OAAO,EAAE,KAAK,EAAQ,YAAY,CAAC,CACrC,CAAC,EAGD,EAAI,IAAI,WAAY,KAAO,IAAM,CAC/B,IAAM,EAAU,MAAM,EAAe,CAAC,EACtC,OAAO,EAAE,KAAK,EAAQ,gBAAgB,CAAC,CACzC,CAAC,EAQD,EAAI,IAAI,aAAc,KAAO,IAAM,CACjC,IAAM,EAAU,MAAM,EAAe,CAAC,EAChC,EAAQ,EAAO,OAAO,CAAO,EAC7B,EAAU,IAAU,IAAA,IAAa,EAAO,OAAO,CAAK,EAC1D,OAAO,EAAE,KAAK,CAAE,UAAW,GAAW,EAAQ,YAAY,CAAE,CAAC,CAC/D,CAAC,EAGD,EAAI,IAAI,WAAY,KAAO,IAAM,CAC/B,IAAM,EAAU,MAAM,EAAe,CAAC,EACtC,OAAO,EAAE,KAAK,CAAE,QAAS,EAAQ,iBAAiB,CAAE,CAAC,CACvD,CAAC,EAEM,CACT,CC/HA,SAAgB,EAAoB,EAAiD,CACnF,IAAI,EAAwC,KACxC,EAAmB,KAGjB,EAAY,EAAiB,GAAS,SAAS,EAC/C,EAAkB,GACtB,OAAO,OAAW,MAAM,kBAAkB,EAAK,EAAE,EAAG,CAClD,KAAM,0BACN,OACA,cAAe,MACjB,CAAC,EAEH,MAAO,CACL,KAAM,OACN,UAAW,OAAO,OAAO,CAAE,KAAM,SAAU,CAAC,EAC5C,OAAO,EAA0B,CAC/B,EAAU,CACZ,EACA,MAAM,OAAQ,CACZ,GAAI,CAAC,EAAS,MAAM,EAAe,cAAc,EACjD,GAAI,EAAK,MAAM,EAAe,iBAAiB,EAC/C,IAAM,EAAS,EAAkB,CAC/B,mBAAsB,EAGtB,YACA,gBAAiB,GAAS,gBAC1B,YAAa,GAAS,WACxB,CAAC,EAGD,EAAM,GAAS,SAAW,IAAI,EAAK,CAAC,CAAC,MAAM,EAAQ,SAAU,CAAM,EAAI,CACzE,EACA,MAAM,MAAO,CACX,EAAM,KACN,EAAU,IACZ,EACA,QAAS,CACP,GAAI,CAAC,EAAK,MAAU,MAAM,4CAA4C,EACtE,OAAO,CACT,EAEA,mBAAoB,CAClB,OAAO,EAAU,KACnB,CACF,CACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/open-prompts.ts","../../src/prompt-routes.ts","../../src/submit-stream.ts","../../src/submit-route.ts","../../src/turn-claims.ts","../../src/routes.ts","../../src/http-transport.ts"],"sourcesContent":["/**\n * The permission and ask prompts a `/submit` stream forwarded and that are still open, per session.\n *\n * The session emits a prompt once, when it is asked, so a client that comes later would never see\n * it; `GET /prompts` answers from here, and `POST /prompts/:id` refuses an id that is not here.\n *\n * Keyed by the session's id, the same key as the turn claim, and not by object identity: the session\n * factory may return a fresh wrapper per request, so the `agent-transport` registry (a WeakMap on the\n * session object) would never find the prompt a different request recorded.\n *\n * It learns only through the prompt-receiving stream's own subscriptions and never listens to the\n * session itself. A listener of its own would keep an unattended turn's prompt parked instead of\n * letting the session fail it closed. A session's entries go when that stream's claim is released.\n */\n\nimport type {\n  IAskRequestEvent,\n  IPermissionRequestEvent,\n} from '@robota-sdk/agent-interface-session';\n\nexport type THttpPromptFrame =\n  | { readonly type: 'permission_request'; readonly event: IPermissionRequestEvent }\n  | { readonly type: 'ask_request'; readonly event: IAskRequestEvent };\n\nexport interface IHttpOpenPrompts {\n  record(sessionKey: string, frame: THttpPromptFrame): void;\n  forget(sessionKey: string, id: string): void;\n  /** The session's open prompts, oldest first. */\n  list(sessionKey: string): readonly THttpPromptFrame[];\n  find(sessionKey: string, id: string): THttpPromptFrame | undefined;\n  /** The stream that received the session's prompts has ended. */\n  clear(sessionKey: string): void;\n}\n\nexport function createHttpOpenPrompts(): IHttpOpenPrompts {\n  const bySession = new Map<string, Map<string, THttpPromptFrame>>();\n\n  return {\n    record(sessionKey, frame) {\n      let open = bySession.get(sessionKey);\n      if (open === undefined) {\n        open = new Map();\n        bySession.set(sessionKey, open);\n      }\n      open.set(frame.event.id, frame);\n    },\n    forget(sessionKey, id) {\n      bySession.get(sessionKey)?.delete(id);\n    },\n    list: (sessionKey) => [...(bySession.get(sessionKey)?.values() ?? [])],\n    find: (sessionKey, id) => bySession.get(sessionKey)?.get(id),\n    clear(sessionKey) {\n      bySession.delete(sessionKey);\n    },\n  };\n}\n","/**\n * `GET /prompts` and `POST /prompts/:id` — reading and answering the permission and ask prompts a\n * prompt-receiving `/submit` stream forwarded.\n *\n * Split from `routes.ts` for the same reason `/submit` is: these routes carry a decision of their own\n * (is this id open here, and is this answer the right kind for it), not just a mount.\n */\n\nimport { decodeClientMessage } from '@robota-sdk/agent-transport';\n\nimport type { IHttpOpenPrompts } from './open-prompts.js';\nimport type { TSessionFactory } from './submit-route.js';\nimport type { TTurnAttribution } from './submit-stream.js';\nimport type { ITurnClaims } from './turn-claims.js';\nimport type { Context } from 'hono';\n\nexport interface IPromptRouteDeps {\n  readonly sessionFactory: TSessionFactory;\n  readonly claims: ITurnClaims;\n  readonly openPrompts: IHttpOpenPrompts;\n  readonly attribution?: TTurnAttribution;\n}\n\n/** The open prompts of the request's session, oldest first: what a client that came later reads. */\nexport function listPromptsHandler(deps: IPromptRouteDeps) {\n  return async (c: Context) => {\n    const session = await deps.sessionFactory(c);\n    const key = deps.claims.keyFor(session);\n    return c.json({ prompts: key === undefined ? [] : deps.openPrompts.list(key) });\n  };\n}\n\n/**\n * Answer one open prompt by id.\n *\n * The id must be one this session's prompt-receiving stream forwarded and that is still open. An id\n * that never was and one already settled get the same 404: the client cannot act differently on the\n * two, and the registry forgets a prompt once it settles.\n *\n * The answerer is the HOST's `attribution.driverId`, never the request, for the same reason `/submit`\n * attribution is: a client must not record its answer as another surface's.\n *\n * Nothing awaits between the lookup and the resolve. The session settles synchronously and emits\n * `prompt_resolved`, which the stream forwards and the registry forgets, so a second answer for the\n * same id finds nothing open and is refused rather than reported as accepted.\n *\n * `200` means the prompt settled, not merely that the answer was handed over: the session ignores an\n * answer it does not take (one in an outside party's name, say), and a prompt still open after the\n * resolve is answered `409` so the client does not believe it decided something it did not.\n */\nexport function answerPromptHandler(deps: IPromptRouteDeps) {\n  const { sessionFactory, claims, openPrompts, attribution } = deps;\n  return async (c: Context) => {\n    const session = await sessionFactory(c);\n    const id = c.req.param('id') ?? '';\n    let body: { result?: unknown; response?: unknown };\n    try {\n      body = await c.req.json();\n    } catch {\n      return c.json({ error: 'the body must be a JSON object' }, 400);\n    }\n\n    const key = claims.keyFor(session);\n    const frame = key === undefined ? undefined : openPrompts.find(key, id);\n    if (key === undefined || frame === undefined) {\n      return c.json({ error: 'no open prompt with this id' }, 404);\n    }\n\n    if (frame.type === 'permission_request') {\n      const decoded = decodeClientMessage({\n        type: 'permission-response',\n        id,\n        result: body?.result,\n      });\n      if (!decoded.ok || decoded.message.type !== 'permission-response') {\n        return c.json(\n          { error: 'result must be true, false, \"allow-session\" or \"allow-project\"' },\n          400,\n        );\n      }\n      session.resolvePermission(id, decoded.message.result, attribution?.driverId);\n    } else {\n      const decoded = decodeClientMessage({ type: 'ask-response', id, response: body?.response });\n      if (!decoded.ok || decoded.message.type !== 'ask-response') {\n        return c.json(\n          {\n            error:\n              'response must be { \"type\": \"answer\", \"values\": string[], \"text\"?: string } or ' +\n              '{ \"type\": \"cancelled\" }',\n          },\n          400,\n        );\n      }\n      session.resolveAsk(id, decoded.message.response, attribution?.driverId);\n    }\n    if (openPrompts.find(key, id) !== undefined) {\n      return c.json({ error: 'the session did not accept this answer' }, 409);\n    }\n    return c.json({ ok: true });\n  };\n}\n","/**\n * RUNTIME-14 / RUNTIME-38 — relaying ONE turn to an SSE client, and letting go of it afterwards.\n *\n * Split out of `routes.ts` under the file-size ceiling. The route's job is to decide whether this\n * request may start a turn; relaying the turn's events, tearing the subscriptions down, and telling\n * a client whose stream broke after the headers went out is a different job with its own failure\n * modes, and it was four fifths of the handler.\n */\n\nimport type { IHttpTransportSession } from './http-session.js';\nimport type { THttpPromptFrame } from './open-prompts.js';\nimport type { SSEStreamingApi } from 'hono/streaming';\nimport type {\n  IAskRequestEvent,\n  IPermissionRequestEvent,\n  IPromptResolvedEvent,\n  ISubmitOptions,\n} from '@robota-sdk/agent-interface-session';\n\n/**\n * Where the DETAIL of a post-headers stream failure goes — injected, never imported.\n *\n * The first version imported `createLogger` from `agent-core`, and review held it against two\n * authorities at once: `project-structure.md` declares this package contract-pure (transports\n * depend on the contracts and the protocol, nothing else), and its side-concern rule says a logging\n * destination \"must be injected, not imported directly\". The host that mounts this router decides\n * where diagnostics go; a module-level singleton decided it for every host, with no override.\n *\n * Absent, the detail is dropped — by the HOST's explicit default, which is a different thing from\n * this module deleting it: the client still learns the stream failed, and the host was offered the\n * detail at the boundary where it mounts the route.\n */\nexport type TStreamFailureListener = (error: Error) => void;\n\n/**\n * Who a submitted turn is attributed to, assigned by the HOST that composed the routes — never read\n * from the request, because a client could otherwise claim to be the local operator or another\n * surface in the usage record. Absent means the session's own default.\n */\nexport type TTurnAttribution = Pick<ISubmitOptions, 'driverId' | 'surface'>;\n\n/**\n * Where a prompt-receiving stream reports the prompts it forwarded, so a later request can list or\n * answer them. Present only when the client asked to receive prompts.\n */\nexport interface IRelayPrompts {\n  record(frame: THttpPromptFrame): void;\n  forget(id: string): void;\n}\n\n/**\n * Wire every relay subscription and the abort path; answer with the promise that settles when the\n * turn is over (or refused one).\n *\n * The subscriptions are wired OUTSIDE the promise executor. Inside it, a throw from `session.on` —\n * a bad handler, an EventEmitter listener cap — is caught by the Promise constructor and becomes an\n * already-rejected `done` instead of propagating. Execution then reaches `await session.submit`, so\n * a REAL TURN is consumed with only some of its listeners attached and nothing to relay it, and the\n * rejection surfaces afterwards at `await done` — by which point the turn is gone.\n */\nfunction wireRelay(\n  session: IHttpTransportSession,\n  stream: SSEStreamingApi,\n  cleanup: Array<() => void>,\n  onFailure: TStreamFailureListener | undefined,\n  prompts: IRelayPrompts | undefined,\n): Promise<void> {\n  const subscribe = <T>(event: string, handler: (data: T) => void): void => {\n    session.on(event as 'text_delta', handler as () => void);\n    cleanup.push(() => session.off(event as 'text_delta', handler as () => void));\n  };\n\n  // RUNTIME-14: await + catch every SSE write so a write to a client-closed stream is a blessed\n  // no-op, not an unhandled rejection (post-headers errors bypass Hono's onError).\n  const write = (event: string, data: unknown): Promise<void> =>\n    stream.writeSSE({ event, data: JSON.stringify(data) }).catch(() => {\n      // allow-fallback: client closed the stream mid-write — nothing to deliver; the finally teardown\n      // (RUNTIME-14) removes the listeners, so this write has nothing left to do.\n    });\n\n  let settle!: () => void;\n  const done = new Promise<void>((resolve) => {\n    settle = resolve;\n  });\n\n  subscribe('text_delta', (delta: string) => void write('text_delta', { delta }));\n  subscribe('tool_start', (state) => void write('tool_start', state));\n  subscribe('tool_end', (state) => void write('tool_end', state));\n  subscribe('thinking', (isThinking: boolean) => void write('thinking', { isThinking }));\n  if (prompts !== undefined) subscribePrompts(subscribe, write, prompts);\n\n  // Flush the terminal event before resolving, so the resolve → cleanup → stream-close\n  // continuation cannot race ahead of the write.\n  subscribe('complete', async (result) => {\n    await write('complete', result);\n    settle();\n  });\n  subscribe('interrupted', async (result) => {\n    await write('interrupted', result);\n    settle();\n  });\n  subscribe('error', async (error: Error) => {\n    await write('error', { message: error.message });\n    settle();\n  });\n\n  // RUNTIME-14: on client disconnect, CANCEL the underlying run (not merely stop writing) and\n  // unblock `done` so the finally teardown runs — otherwise `done` would never resolve and the\n  // listeners leak.\n  stream.onAbort(() => onClientAbort(session, onFailure, settle));\n\n  return done;\n}\n\n/**\n * Forward the turn's permission and ask prompts, and their settlement, to a client that said it can\n * answer them.\n *\n * Only such a client subscribes: the session parks a prompt only while someone listens for it, so a\n * client that cannot answer must not listen, or the turn would wait on a prompt nobody settles\n * instead of failing it closed at once.\n */\nfunction subscribePrompts(\n  subscribe: <T>(event: string, handler: (data: T) => void) => void,\n  write: (event: string, data: unknown) => Promise<void>,\n  prompts: IRelayPrompts,\n): void {\n  subscribe('permission_request', (event: IPermissionRequestEvent) => {\n    prompts.record({ type: 'permission_request', event });\n    void write('permission_request', event);\n  });\n  subscribe('ask_request', (event: IAskRequestEvent) => {\n    prompts.record({ type: 'ask_request', event });\n    void write('ask_request', event);\n  });\n  subscribe('prompt_resolved', (event: IPromptResolvedEvent) => {\n    prompts.forget(event.id);\n    void write('prompt_resolved', event);\n  });\n}\n\n/**\n * The abort path, alone, because every clause of it is load-bearing and review shaped each one.\n *\n * `settle` in a `finally`: an `abort()` that throws used to cost a listener leak, and with the\n * claim registry it costs the SESSION — `done` never resolves, the teardown never runs, the claim\n * is held forever, and every future /submit is 409.\n *\n * The throw is REPORTED, not rethrown: this handler runs inside Hono's abort dispatch, OUTSIDE the\n * relay's try/catch, so a rethrow is an unhandled rejection rather than a reported failure. The\n * detail goes where every other stream failure's detail goes.\n */\nfunction onClientAbort(\n  session: IHttpTransportSession,\n  onFailure: TStreamFailureListener | undefined,\n  settle: () => void,\n): void {\n  try {\n    session.abort();\n  } catch (error) {\n    // allow-fallback: an abort that throws is the HOST's news, not the runner's\n    try {\n      onFailure?.(error instanceof Error ? error : new Error(String(error)));\n    } catch {\n      // allow-fallback: a listener that throws must not replace the abort path's settle\n      // Same rule as reportStreamFailure: the host's listener failing is the host's to see.\n    }\n  } finally {\n    settle();\n  }\n}\n\n/**\n * Teardown that cannot take the claim with it.\n *\n * Each entry individually, and review is why: these are `session.off` calls, and one that throws\n * inside a bare loop would end the caller's `finally` before `release()` ran — the same\n * claim-held-forever the abort path closes, reintroduced two lines down. A failed unsubscribe\n * forfeits one listener; taking the release with it forfeits the session.\n */\nfunction teardown(cleanup: Array<() => void>, release: () => void): void {\n  for (const fn of cleanup) {\n    try {\n      fn();\n    } catch {\n      // allow-fallback: a failed unsubscribe must not take the claim release with it\n      // The listener stays attached — the lesser loss, and the one the next turn can survive.\n    }\n  }\n  // RUNTIME-38: released here for the same reason — a turn that throws must not wedge the session\n  // it claimed.\n  release();\n}\n\n/**\n * The `streamSSE` callback for one submitted prompt.\n *\n * `release` is called in the teardown, ALWAYS — on completion, on error, and on client disconnect.\n * It is passed in rather than taken here because the claim is made before the stream opens: a claim\n * whose release lives only inside the stream is a lock that outlives the request that took it.\n * (This block sat on `wireRelay` for one round after the split stranded it — the stale-doc shape\n * this file keeps writing about, caught doing it.)\n */\nexport function relayTurn(\n  session: IHttpTransportSession,\n  prompt: string,\n  release: () => void,\n  onFailure?: TStreamFailureListener,\n  attribution?: TTurnAttribution,\n  prompts?: IRelayPrompts,\n): (stream: SSEStreamingApi) => Promise<void> {\n  return async (stream) => {\n    // NOTHING may escape this callback, and the reason is measured rather than stylistic. Hono's\n    // `streamSSE` runner calls its `onError` argument and then UNCONDITIONALLY writes\n    // `event: error, data: e.message` to the stream — so an escaped exception reaches the client\n    // verbatim no matter what the handler withheld. The probe that found it saw TWO error events:\n    // this module's generic line, then Hono's raw one. The only place the trust boundary can be\n    // held is here, before the throw reaches the runner at all.\n    try {\n      // The inner `try` opens BEFORE the wiring: a throw from `session.on` inside `wireRelay`\n      // leaves the session claimed, and the `finally` is what releases it — opened later, every\n      // later request gets 409 forever.\n      const cleanup: Array<() => void> = [];\n      try {\n        const done = wireRelay(session, stream, cleanup, onFailure, prompts);\n        await (attribution === undefined\n          ? session.submit(prompt)\n          : session.submit(prompt, undefined, undefined, { ...attribution }));\n        await done;\n      } finally {\n        // RUNTIME-14: teardown ALWAYS runs — on completion, error, OR client disconnect — so the\n        // session event listeners can never leak, and the claim always comes back.\n        teardown(cleanup, release);\n      }\n    } catch (error) {\n      await reportStreamFailure(\n        error instanceof Error ? error : new Error(String(error)),\n        stream,\n        onFailure,\n      );\n    }\n  };\n}\n\n/**\n * What to tell a client whose stream failed AFTER the response headers were sent.\n *\n * A throw at that point cannot become an error status — the client already has a 200 and an open\n * stream. Without this the throw is an UNHANDLED rejection: it left the process silently in a\n * browser and turned the `quality` job red under vitest, which is how it was found.\n *\n * By the time this runs, `relayTurn`'s teardown has removed the listeners and released the claim.\n * This handler owes only the telling.\n *\n * The CLIENT gets a generic line and the HOST gets the detail, and review moved this three times.\n * The first version sent `error.message` verbatim; the second sent it to a package logger imported\n * from `agent-core`, which the layering rule refuses (see `TStreamFailureListener`). What survives\n * both rounds is the boundary itself: an exception escaping the stream callback is not a message\n * anything composed for a client — it can carry provider internals, paths, or stack fragments,\n * exactly what the 500 branch in `routes.ts` withholds at the same boundary.\n *\n * The session's own `error` EVENT is different and stays verbatim in `relayTurn` above: that is the\n * session's client-facing error channel, worded by the session (`humanizeApiError`) and relayed\n * identically by the WS transport. One is a message meant for the client; this one never was.\n */\nexport async function reportStreamFailure(\n  error: Error,\n  stream: SSEStreamingApi,\n  onFailure?: TStreamFailureListener,\n): Promise<void> {\n  try {\n    onFailure?.(error);\n  } catch {\n    // allow-fallback: a listener that throws must not take the client's only notification with it\n    // The listener is the host's code; its failure is the host's to see, and the write below is the\n    // one thing this function owes the client either way.\n  }\n  await stream\n    .writeSSE({\n      event: 'error',\n      data: JSON.stringify({\n        message: 'the stream failed on the server after it opened — the turn may not have run',\n      }),\n    })\n    .catch(() => {\n      // allow-fallback: the stream is already gone, which is the one case where there is nobody\n      // left to tell. Rethrowing here would restore the unhandled rejection this exists to remove.\n    });\n}\n","/**\n * `POST /submit` — the admission decision and the handler that hands an admitted turn to the relay.\n *\n * Split from `routes.ts` under the file-size ceiling, along the same seam the review rounds carved:\n * the route factory is a LIST of routes, and this one carries the concurrency-admission decision\n * plus the claim lifecycle, which is a different job from mounting endpoints.\n */\n\nimport { streamSSE } from 'hono/streaming';\n\nimport { relayTurn } from './submit-stream.js';\n\nimport type { IHttpTransportSession } from './http-session.js';\nimport type { IHttpOpenPrompts } from './open-prompts.js';\nimport type { IRelayPrompts, TStreamFailureListener, TTurnAttribution } from './submit-stream.js';\nimport type { ITurnClaims } from './turn-claims.js';\nimport type { Context } from 'hono';\n\n/**\n * Callback that resolves an HTTP session port from the request context.\n *\n * It need NOT return the same object twice for the same logical session. It briefly did: `/submit`\n * keyed its concurrent-turn claim on object identity, so a factory building a fresh wrapper per\n * call — a proxy, an adapter, a `{...session}` copy — defeated the guard in silence. The first\n * answer was to document that as a requirement callers had to keep, and a requirement neither the\n * type system nor a test can check is not a contract, it is a hope.\n *\n * What the session already promises is enough. `getSession(): { getSessionId(): string }` names the\n * session, the claim is keyed by that name, and the requirement is gone rather than written down.\n *\n * The session must therefore BE nameable. `/submit` refuses with 500 when `getSessionId()` returns\n * nothing, because without an id the concurrent-turn guarantee does not exist and serving anyway\n * would hand back the bug to whoever could least tell. The contract types that method as returning\n * a `string`, so a conformant session never meets it.\n *\n * (Review moved this block here: it sat on the RE-EXPORT in `routes.ts` after the split, where the\n * person editing the definition would never see it.)\n */\nexport type TSessionFactory = (\n  c: Context,\n) => IHttpTransportSession | Promise<IHttpTransportSession>;\n\n/**\n * Admit this request to ONE turn on its session, or answer why not.\n *\n * Returns the claim key it HOLDS on success — the caller owes its release — or the refusal\n * Response. A named unit, and review is why: the admission decision (nameable? busy? claim) is what\n * this route decides, independently testable from the stream wiring it hands the turn to.\n */\nfunction admitTurn(\n  c: Context,\n  session: IHttpTransportSession,\n  claims: ITurnClaims,\n): Response | { claim: string } {\n  // RUNTIME-38: the session is single-threaded (one turn at a time) and shared across requests, so a\n  // concurrent /submit would cross-subscribe to the same emitter and interleave two clients' events.\n  //\n  // The route CLAIMS the turn rather than asking whether one is running, and that difference is the\n  // whole fix. `session.isExecuting()` is set inside `submit()` past an `await ensureInitialized()`\n  // — an unconditional suspension point — so two requests both read `false`, both call `submit`, and\n  // the loser coalesces into the pending queue while its HTTP response streams back the WINNER'S\n  // events. One turn delivered to two clients as if each had asked for it, which is worse than the\n  // race the earlier comment described and then wrongly declared absent.\n  //\n  // A synchronous flag on the route closes it because there is no suspension point between reading\n  // and setting it. It is released in the stream's `finally`, so a turn that throws does not leave\n  // the route wedged.\n  //\n  // BOTH are asked because neither subsumes the other. The claim is what this ROUTE knows;\n  // `isExecuting()` is what the SESSION knows, including a turn started by another surface — the\n  // TUI, a WS client, a previous process — which the claim cannot see.\n  // A session that cannot name itself is REFUSED, not served racily. The busy check is a guarantee\n  // only while the claim is keyed by a real id: with no id it falls back to `isExecuting()` alone,\n  // which the comment above documents as the racy read this route exists to stop relying on.\n  // Serving anyway would degrade the fix back into the bug for exactly the callers who could not\n  // be told they were affected.\n  //\n  // `getSession(): { getSessionId(): string }` is required by the contract, so this is unreachable\n  // for a conformant session. It is a 500 rather than a 503: the session is not temporarily\n  // unavailable, it does not meet the contract this route is built on, which is a defect on the\n  // server side of the boundary and not a condition that clears on retry.\n  const claim = claims.keyFor(session);\n  if (claim === undefined) {\n    return c.json(\n      {\n        // No internal method signature: this route can be mounted outside a trust boundary, and\n        // the caller cannot act on `getSession().getSessionId()` anyway — it names a contract\n        // they do not implement. The HOST needs the detail and gets it from the comment above\n        // this branch; the client needs to know its request was refused and why in its own terms.\n        error:\n          'concurrent-turn tracking is unavailable for this session, so this request cannot be ' +\n          'served safely. Refusing rather than starting a turn that cannot be guaranteed to be ' +\n          'yours.',\n      },\n      500,\n    );\n  }\n  if (claims.isHeld(claim) || session.isExecuting()) {\n    return c.json({ error: 'session busy — a turn is already in flight' }, 409);\n  }\n  claims.hold(claim);\n  return { claim };\n}\n\nexport interface ISubmitRouteDeps {\n  readonly sessionFactory: TSessionFactory;\n  readonly claims: ITurnClaims;\n  readonly openPrompts: IHttpOpenPrompts;\n  readonly onStreamFailure?: TStreamFailureListener;\n  readonly attribution?: TTurnAttribution;\n}\n\nexport function submitHandler(deps: ISubmitRouteDeps) {\n  const { sessionFactory, claims, openPrompts, onStreamFailure, attribution } = deps;\n  return async (c: Context) => {\n    const session = await sessionFactory(c);\n    const body = await c.req.json<{ prompt: string; receivePrompts?: unknown }>();\n\n    if (!body.prompt || typeof body.prompt !== 'string') {\n      return c.json({ error: 'prompt is required' }, 400);\n    }\n    if (body.receivePrompts !== undefined && typeof body.receivePrompts !== 'boolean') {\n      return c.json({ error: 'receivePrompts must be a boolean' }, 400);\n    }\n\n    // A session still building itself cannot name itself yet, and the claim needs its name. The\n    // claim itself is still taken synchronously after this, so two requests that both waited here\n    // start one turn between them.\n    if (session.whenInitialized !== undefined) {\n      try {\n        await session.whenInitialized();\n      } catch {\n        // The reason can name host paths or settings; the client only needs to know it failed.\n        return c.json({ error: 'the session could not be started' }, 500);\n      }\n    }\n\n    const admitted = admitTurn(c, session, claims);\n    if (admitted instanceof Response) {\n      return admitted;\n    }\n    const { claim } = admitted;\n    // SINGLE-SHOT, and review traced the double-release it prevents: the relay's teardown releases\n    // this claim on the normal path, and if a future Hono ever rejected the outer promise AFTER the\n    // callback completed, the catch below would release the SAME KEY a second time — by which point\n    // another request may hold it, and the second release would free that request's claim, which is\n    // the cross-talk this registry exists to prevent. A release that has happened is not a release\n    // that can happen again.\n    let released = false;\n    const releaseOnce = (): void => {\n      if (!released) {\n        released = true;\n        // The stream that held this session's prompts is gone; what is still open is the session's\n        // to settle, and no longer this route's to list or answer.\n        openPrompts.clear(claim);\n        claims.release(claim);\n      }\n    };\n    const prompts: IRelayPrompts | undefined =\n      body.receivePrompts === true\n        ? {\n            record: (frame) => openPrompts.record(claim, frame),\n            forget: (id) => openPrompts.forget(claim, id),\n          }\n        : undefined;\n\n    // The claim is taken OUTSIDE the callback, so its release cannot live only in the callback's\n    // `finally` — a claim whose release is not in the same protected region is a lock, not a claim,\n    // which this file states one level in. If `streamSSE` throws before it ever runs the callback,\n    // this releases and rethrows; the callback's own `finally` covers everything after it starts.\n    //\n    // REPRODUCED at the module boundary: `routes-streamsse-throw.test.ts` mocks `hono/streaming`\n    // to throw before the callback ever runs and asserts the second request is not 409 — a leaked\n    // claim is what this catch exists to prevent. Two rounds shipped it as honestly-labelled\n    // unverified code (a throw from `session.on` lands INSIDE the callback, where the inner\n    // `finally` releases — measured, a case built that way is green with this catch removed), and\n    // review supplied the third option: stub the boundary, not Hono's internals.\n    try {\n      // NO third argument, deliberately: Hono's runner follows any `onError` by writing the raw\n      // `e.message` to the stream, so the only leak-proof shape is a callback nothing escapes —\n      // `relayTurn` catches its own failures and reports them generically. An onError here would be\n      // dead code that turns into a leak the day it stops being dead.\n      // `await`, so the catch below covers a REJECTION as well as a synchronous throw. Today's\n      // Hono returns the Response synchronously and only the sync path is real — but review is\n      // right that a version returning a rejecting promise would sail past a bare `return`, and\n      // the cost of closing that class is one keyword.\n      return await streamSSE(\n        c,\n        relayTurn(session, body.prompt, releaseOnce, onStreamFailure, attribution, prompts),\n      );\n    } catch (error) {\n      releaseOnce();\n      throw error;\n    }\n  };\n}\n","/**\n * RUNTIME-38 — who currently holds the one turn a session can run.\n *\n * Split out of `routes.ts`, which had grown past its size ceiling: routing is one job and deciding\n * whether a second turn may start on a session is another, and the second is the only part of that\n * file with state of its own.\n *\n * PER SESSION, not one flag for the router. `sessionFactory` resolves a session per request (the\n * documented multi-tenant shape), so a single flag made one tenant's turn refuse every other\n * tenant's — a busy neighbour is not a reason to refuse you, and that is a worse defect than the\n * race it closed.\n */\n\nimport type { IHttpTransportSession } from './http-session.js';\n\nexport interface ITurnClaims {\n  /** The key this session is claimed under, or `undefined` when it will not name itself. */\n  keyFor(session: IHttpTransportSession): string | undefined;\n  isHeld(key: string): boolean;\n  hold(key: string): void;\n  release(key: string): void;\n}\n\n/**\n * A claim registry keyed by the session's declared ID, not by object identity.\n *\n * Keying on the OBJECT makes identity-stability a requirement of every caller that nothing can\n * check: a `sessionFactory` returning a fresh wrapper per call for the same logical session — a\n * proxy, an adapter, a spread copy — defeats the guard in silence, and every request looks\n * unclaimed. `getSession(): { getSessionId(): string }` already names the session, so asking for the\n * id turns an unenforceable requirement into no requirement at all.\n *\n * A claim is released in the caller's `finally`, so this does not grow with the number of sessions\n * the host has ever served — which is what weak keying would otherwise buy.\n */\nexport function createTurnClaims(): ITurnClaims {\n  const held = new Set<string>();\n\n  return {\n    keyFor(session) {\n      try {\n        // No `?.`: `getSession(): { getSessionId(): string }` is non-nullable, and optional chaining\n        // here would suggest the contract allows an absent session when it does not. A session that\n        // breaks the contract anyway is caught below.\n        const id = session.getSession().getSessionId();\n        return typeof id === 'string' && id !== '' ? id : undefined;\n      } catch {\n        // allow-fallback: an unnameable session must not be guessed at\n        // A session that throws while naming itself has not told us who it is, and guessing would\n        // claim the wrong turn. The CALLER refuses on `undefined`, so nothing is swallowed here.\n        //\n        // `undefined` rather than a placeholder — a shared fallback key would collide every\n        // unnameable session into one claim and refuse them all as each other's neighbours. There is\n        // no `isExecuting()` fallback on the submit path, and an earlier comment said there was.\n        return undefined;\n      }\n    },\n    isHeld: (key) => held.has(key),\n    hold: (key) => void held.add(key),\n    release: (key) => void held.delete(key),\n  };\n}\n","/**\n * HTTP transport adapter — exposes the declared session capabilities over REST API.\n *\n * Built on Hono for Cloudflare Workers + Node.js + AWS Lambda compatibility.\n * Exposes the core session methods (a subset; background-task, job-group, and\n * execution-workspace methods are WS-only).\n */\n\nimport {\n  bearerCredential,\n  credentialMatches,\n  resolveAdmission,\n} from '@robota-sdk/agent-transport/node';\nimport { Hono } from 'hono';\n\nimport { createHttpOpenPrompts } from './open-prompts.js';\nimport { answerPromptHandler, listPromptsHandler } from './prompt-routes.js';\nimport { submitHandler } from './submit-route.js';\nimport { createTurnClaims } from './turn-claims.js';\n\nimport type { TSessionFactory } from './submit-route.js';\nimport type { TStreamFailureListener, TTurnAttribution } from './submit-stream.js';\nimport type {\n  ITransportAdmission,\n  ITransportAdmissionConfig,\n} from '@robota-sdk/agent-interface-transport';\n\n// Re-exported so existing importers keep their path; the definition and its rationale live with\n// the code that enforces them, in `submit-route.ts`.\nexport type { TSessionFactory } from './submit-route.js';\n\nexport interface IAgentRoutesOptions {\n  /** Resolve an HTTP session port per request (e.g., by auth token, session ID). */\n  sessionFactory: TSessionFactory;\n  /**\n   * Where the DETAIL of a post-headers stream failure goes (the client gets only a generic line —\n   * see `submit-stream.ts`). Injected per the side-concern rule: the host decides the destination,\n   * and absent means the host chose to drop it.\n   */\n  onStreamFailure?: TStreamFailureListener;\n  /**\n   * SEC-008: what a peer must present to reach the session. REQUIRED — there is no shape of this\n   * option that means \"I did not think about it\", which is the state these routes shipped in.\n   *\n   * `{ open: true, openReason: '…' }` still runs with no credential, and that is a legitimate answer\n   * for a host that has its own boundary in front. It just has to be written down.\n   */\n  admission: ITransportAdmissionConfig | ITransportAdmission;\n  /**\n   * Who `/submit` turns and prompt answers are attributed to — the driver and product surface the\n   * HOST assigns, as the WebSocket transport's `driverId`/`surface` do. Never taken from the request\n   * body. Absent leaves the session's own default.\n   */\n  attribution?: TTurnAttribution;\n}\n\n/**\n * Create a Hono router with all agent HTTP endpoints.\n *\n * Usage:\n * ```typescript\n * const routes = createAgentRoutes({ sessionFactory });\n * app.route('/agent', routes);          // mount on existing app\n * export default routes;                // or use standalone (CF Workers)\n * ```\n */\nexport function createAgentRoutes(options: IAgentRoutesOptions): Hono {\n  const { sessionFactory, onStreamFailure, attribution } = options;\n  const app = new Hono();\n\n  // RUNTIME-38: one turn at a time, per session — `turn-claims.ts` owns what that means and why it\n  // is keyed by the session's declared ID rather than by object identity.\n  const claims = createTurnClaims();\n  const openPrompts = createHttpOpenPrompts();\n\n  // SEC-008: resolved ONCE, at construction, so a transport that cannot mint a credential fails to\n  // build rather than serving without one. Resolving per request would also mint a new token per\n  // request, which no peer could ever present.\n  // Either shape goes in: `resolveAdmission` is idempotent, so an already-resolved admission comes\n  // back unchanged and a config is resolved. `http-transport.ts` therefore does not have to take\n  // its resolved admission apart and rebuild a config for this to resolve again — two resolutions\n  // of one decision, and a mint on the second if the first had opened without a reason (review).\n  //\n  // This used to pick between the two with `'token' in options.admission`, and review showed that\n  // cannot work: BOTH interfaces declare a `token`, so the shapes differ only by VALUE. A config of\n  // `{ token: '' }` — documented as \"mint a fresh one\" — was read as pre-resolved and installed the\n  // EMPTY STRING as the required credential, which a peer sending an empty bearer would match. The\n  // discriminator is gone rather than repaired; there is nothing here left to get wrong.\n  const admission = resolveAdmission(options.admission);\n\n  /**\n   * The trust boundary, installed BEFORE every route rather than checked inside each one.\n   *\n   * Before this, `POST /submit` reached `session.submit` and `POST /command` reached\n   * `session.executeCommand` with nothing in between — remote arbitrary execution with no gate, and\n   * an unauthenticated request looked exactly like an authorised one in both directions.\n   *\n   * A missing credential and a wrong one get the same answer, deliberately: telling them apart tells\n   * a caller which half they got right.\n   */\n  app.use('*', async (c, next) => {\n    if (admission.token === null) return next();\n    if (credentialMatches(admission.token, bearerCredential(c.req.header('authorization')))) {\n      return next();\n    }\n    return c.json({ error: 'unauthorized' }, 401);\n  });\n\n  // POST /submit — execute prompt, stream events via SSE\n  app.post(\n    '/submit',\n    submitHandler({ sessionFactory, claims, openPrompts, onStreamFailure, attribution }),\n  );\n\n  // GET /prompts — the open permission/ask prompts a prompt-receiving /submit stream forwarded\n  app.get('/prompts', listPromptsHandler({ sessionFactory, claims, openPrompts, attribution }));\n\n  // POST /prompts/:id — answer one of them\n  app.post(\n    '/prompts/:id',\n    answerPromptHandler({ sessionFactory, claims, openPrompts, attribution }),\n  );\n\n  // POST /command — execute system command\n  app.post('/command', async (c) => {\n    const session = await sessionFactory(c);\n    const body = await c.req.json<{ name: string; args?: string }>();\n\n    if (!body.name || typeof body.name !== 'string') {\n      return c.json({ error: 'name is required' }, 400);\n    }\n\n    // SEC-008: 'remote', not the default 'user'. A peer over HTTP is not the person at the keyboard,\n    // and defaulting to the local operator both mis-attributes the call and skips the 'remote' policy\n    // seam that exists to treat the two differently. Admission decided WHO may reach the session; it\n    // does not say who they are. (The MCP adapter had the same defect; this is its sibling.)\n    const result = await session.executeCommand(body.name, body.args ?? '', 'remote');\n    if (!result) {\n      return c.json({ error: `Unknown command: ${body.name}` }, 404);\n    }\n    return c.json(result);\n  });\n\n  // POST /abort — abort current execution\n  app.post('/abort', async (c) => {\n    const session = await sessionFactory(c);\n    session.abort();\n    return c.json({ ok: true });\n  });\n\n  // POST /cancel-queue — cancel queued prompt\n  app.post('/cancel-queue', async (c) => {\n    const session = await sessionFactory(c);\n    session.cancelQueue();\n    return c.json({ ok: true });\n  });\n\n  // GET /messages — get message history\n  app.get('/messages', async (c) => {\n    const session = await sessionFactory(c);\n    return c.json(session.getMessages());\n  });\n\n  // GET /context — get context window state\n  app.get('/context', async (c) => {\n    const session = await sessionFactory(c);\n    return c.json(session.getContextState());\n  });\n\n  // GET /executing — check if currently executing\n  //\n  // Reports the SAME \"busy\" that `/submit` refuses on: the route's own claim OR the session's\n  // `isExecuting()`. Asking only the session lets a client polling here see `executing: false` and\n  // still get a 409 from `/submit`, and two endpoints disagreeing about one word is a worse answer\n  // than either of them alone.\n  app.get('/executing', async (c) => {\n    const session = await sessionFactory(c);\n    const claim = claims.keyFor(session);\n    const claimed = claim !== undefined && claims.isHeld(claim);\n    return c.json({ executing: claimed || session.isExecuting() });\n  });\n\n  // GET /pending — get pending queued prompt\n  app.get('/pending', async (c) => {\n    const session = await sessionFactory(c);\n    return c.json({ pending: session.getPendingPrompt() });\n  });\n\n  return app;\n}\n","/**\n * ITransportAdapter implementation for HTTP transport.\n *\n * Wraps createAgentRoutes into the unified ITransportAdapter interface\n * while exposing the underlying Hono app via getApp().\n */\n\nimport { resolveAdmission } from '@robota-sdk/agent-transport/node';\nimport { Hono } from 'hono';\n\nimport { createAgentRoutes } from './routes.js';\n\nimport type { IHttpTransportSession } from './http-session.js';\nimport type { TStreamFailureListener, TTurnAttribution } from './submit-stream.js';\nimport type {\n  ITransportAdapter,\n  ITransportAdmissionConfig,\n  ITransportLifecycleError,\n} from '@robota-sdk/agent-interface-transport';\n\nexport interface IHttpTransportOptions {\n  /** Optional: base path prefix for routes. */\n  basePath?: string;\n  /**\n   * SEC-008: what a peer must present. Omitted means SECURE — a credential is minted and\n   * `getAdmissionToken()` returns it for the host to hand to its client.\n   *\n   * This transport previously had no gate at all, so omitting the option used to mean \"anyone may\n   * execute anything\". Omission now means the safe thing, and running open takes saying so.\n   */\n  admission?: ITransportAdmissionConfig;\n  /**\n   * Where the DETAIL of a post-headers stream failure goes — forwarded to `createAgentRoutes`.\n   * Review found this seam missing: the option existed on the routes and not on the entry point\n   * README and the examples actually use, so \"the host decides the destination\" was a decision no\n   * host on this path could make. Same forwarding rule as `admission`, which sat beside it.\n   */\n  onStreamFailure?: TStreamFailureListener;\n  /** Who `/submit` turns are attributed to — forwarded to `createAgentRoutes`, like `admission`. */\n  attribution?: TTurnAttribution;\n}\n\nexport interface IHttpTransport extends ITransportAdapter<IHttpTransportSession> {\n  getApp(): Hono;\n  getAdmissionToken(): string | null;\n}\n\nexport function createHttpTransport(options?: IHttpTransportOptions): IHttpTransport {\n  let session: IHttpTransportSession | null = null;\n  let app: Hono | null = null;\n  // Resolved at CONSTRUCTION, not at start: a host needs the credential to hand to its client, and\n  // a transport that cannot mint one must fail before anything is served.\n  const admission = resolveAdmission(options?.admission);\n  const lifecycleError = (code: ITransportLifecycleError['code']): ITransportLifecycleError =>\n    Object.assign(new Error(`HTTP transport ${code}.`), {\n      name: 'TransportLifecycleError' as const,\n      code,\n      transportName: 'http',\n    });\n\n  return {\n    name: 'http',\n    lifecycle: Object.freeze({ kind: 'service' }),\n    attach(s: IHttpTransportSession) {\n      session = s;\n    },\n    async start() {\n      if (!session) throw lifecycleError('not-attached');\n      if (app) throw lifecycleError('already-started');\n      const routes = createAgentRoutes({\n        sessionFactory: () => session!,\n        // The decision already made, passed through — not taken apart and rebuilt for the routes to\n        // resolve a second time.\n        admission,\n        onStreamFailure: options?.onStreamFailure,\n        attribution: options?.attribution,\n      });\n      // TRANS-002 (issue #2480): `basePath` was declared and advertised but never read, so routes\n      // always mounted at root. It is honored here — or absent, in which case the routes ARE the app.\n      app = options?.basePath ? new Hono().route(options.basePath, routes) : routes;\n    },\n    async stop() {\n      app = null;\n      session = null;\n    },\n    getApp() {\n      if (!app) throw new Error('Transport not started. Call start() first.');\n      return app;\n    },\n    /** The credential this transport requires, or `null` when the host explicitly opened it. */\n    getAdmissionToken() {\n      return admission.token;\n    },\n  };\n}\n"],"mappings":"0PAkCA,SAAgB,GAA0C,CACxD,IAAM,EAAY,IAAI,IAEtB,MAAO,CACL,OAAO,EAAY,EAAO,CACxB,IAAI,EAAO,EAAU,IAAI,CAAU,EAC/B,IAAS,IAAA,KACX,EAAO,IAAI,IACX,EAAU,IAAI,EAAY,CAAI,GAEhC,EAAK,IAAI,EAAM,MAAM,GAAI,CAAK,CAChC,EACA,OAAO,EAAY,EAAI,CACrB,EAAU,IAAI,CAAU,CAAC,EAAE,OAAO,CAAE,CACtC,EACA,KAAO,GAAe,CAAC,GAAI,EAAU,IAAI,CAAU,CAAC,EAAE,OAAO,GAAK,CAAC,CAAE,EACrE,MAAO,EAAY,IAAO,EAAU,IAAI,CAAU,CAAC,EAAE,IAAI,CAAE,EAC3D,MAAM,EAAY,CAChB,EAAU,OAAO,CAAU,CAC7B,CACF,CACF,CC/BA,SAAgB,EAAmB,EAAwB,CACzD,OAAO,KAAO,IAAe,CAC3B,IAAM,EAAU,MAAM,EAAK,eAAe,CAAC,EACrC,EAAM,EAAK,OAAO,OAAO,CAAO,EACtC,OAAO,EAAE,KAAK,CAAE,QAAS,IAAQ,IAAA,GAAY,CAAC,EAAI,EAAK,YAAY,KAAK,CAAG,CAAE,CAAC,CAChF,CACF,CAoBA,SAAgB,EAAoB,EAAwB,CAC1D,GAAM,CAAE,iBAAgB,SAAQ,cAAa,eAAgB,EAC7D,OAAO,KAAO,IAAe,CAC3B,IAAM,EAAU,MAAM,EAAe,CAAC,EAChC,EAAK,EAAE,IAAI,MAAM,IAAI,GAAK,GAC5B,EACJ,GAAI,CACF,EAAO,MAAM,EAAE,IAAI,KAAK,CAC1B,MAAQ,CACN,OAAO,EAAE,KAAK,CAAE,MAAO,gCAAiC,EAAG,GAAG,CAChE,CAEA,IAAM,EAAM,EAAO,OAAO,CAAO,EAC3B,EAAQ,IAAQ,IAAA,GAAY,IAAA,GAAY,EAAY,KAAK,EAAK,CAAE,EACtE,GAAI,IAAQ,IAAA,IAAa,IAAU,IAAA,GACjC,OAAO,EAAE,KAAK,CAAE,MAAO,6BAA8B,EAAG,GAAG,EAG7D,GAAI,EAAM,OAAS,qBAAsB,CACvC,IAAM,EAAU,EAAoB,CAClC,KAAM,sBACN,KACA,OAAQ,GAAM,MAChB,CAAC,EACD,GAAI,CAAC,EAAQ,IAAM,EAAQ,QAAQ,OAAS,sBAC1C,OAAO,EAAE,KACP,CAAE,MAAO,gEAAiE,EAC1E,GACF,EAEF,EAAQ,kBAAkB,EAAI,EAAQ,QAAQ,OAAQ,GAAa,QAAQ,CAC7E,KAAO,CACL,IAAM,EAAU,EAAoB,CAAE,KAAM,eAAgB,KAAI,SAAU,GAAM,QAAS,CAAC,EAC1F,GAAI,CAAC,EAAQ,IAAM,EAAQ,QAAQ,OAAS,eAC1C,OAAO,EAAE,KACP,CACE,MACE,uGAEJ,EACA,GACF,EAEF,EAAQ,WAAW,EAAI,EAAQ,QAAQ,SAAU,GAAa,QAAQ,CACxE,CAIA,OAHI,EAAY,KAAK,EAAK,CAAE,IAAM,IAAA,GAG3B,EAAE,KAAK,CAAE,GAAI,EAAK,CAAC,EAFjB,EAAE,KAAK,CAAE,MAAO,wCAAyC,EAAG,GAAG,CAG1E,CACF,CCxCA,SAAS,EACP,EACA,EACA,EACA,EACA,EACe,CACf,IAAM,GAAgB,EAAe,IAAqC,CACxE,EAAQ,GAAG,EAAuB,CAAqB,EACvD,EAAQ,SAAW,EAAQ,IAAI,EAAuB,CAAqB,CAAC,CAC9E,EAIM,GAAS,EAAe,IAC5B,EAAO,SAAS,CAAE,QAAO,KAAM,KAAK,UAAU,CAAI,CAAE,CAAC,CAAC,CAAC,UAAY,CAGnE,CAAC,EAEC,EACE,EAAO,IAAI,QAAe,GAAY,CAC1C,EAAS,CACX,CAAC,EA4BD,OA1BA,EAAU,aAAe,GAAkB,KAAK,EAAM,aAAc,CAAE,OAAM,CAAC,CAAC,EAC9E,EAAU,aAAe,GAAU,KAAK,EAAM,aAAc,CAAK,CAAC,EAClE,EAAU,WAAa,GAAU,KAAK,EAAM,WAAY,CAAK,CAAC,EAC9D,EAAU,WAAa,GAAwB,KAAK,EAAM,WAAY,CAAE,YAAW,CAAC,CAAC,EACjF,IAAY,IAAA,IAAW,EAAiB,EAAW,EAAO,CAAO,EAIrE,EAAU,WAAY,KAAO,IAAW,CACtC,MAAM,EAAM,WAAY,CAAM,EAC9B,EAAO,CACT,CAAC,EACD,EAAU,cAAe,KAAO,IAAW,CACzC,MAAM,EAAM,cAAe,CAAM,EACjC,EAAO,CACT,CAAC,EACD,EAAU,QAAS,KAAO,IAAiB,CACzC,MAAM,EAAM,QAAS,CAAE,QAAS,EAAM,OAAQ,CAAC,EAC/C,EAAO,CACT,CAAC,EAKD,EAAO,YAAc,EAAc,EAAS,EAAW,CAAM,CAAC,EAEvD,CACT,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,EAAU,qBAAuB,GAAmC,CAClE,EAAQ,OAAO,CAAE,KAAM,qBAAsB,OAAM,CAAC,EACpD,EAAW,qBAAsB,CAAK,CACxC,CAAC,EACD,EAAU,cAAgB,GAA4B,CACpD,EAAQ,OAAO,CAAE,KAAM,cAAe,OAAM,CAAC,EAC7C,EAAW,cAAe,CAAK,CACjC,CAAC,EACD,EAAU,kBAAoB,GAAgC,CAC5D,EAAQ,OAAO,EAAM,EAAE,EACvB,EAAW,kBAAmB,CAAK,CACrC,CAAC,CACH,CAaA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,CACF,EAAQ,MAAM,CAChB,OAAS,EAAO,CAEd,GAAI,CACF,IAAY,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,CAAC,CACvE,MAAQ,CAGR,CACF,QAAU,CACR,EAAO,CACT,CACF,CAUA,SAAS,EAAS,EAA4B,EAA2B,CACvE,IAAK,IAAM,KAAM,EACf,GAAI,CACF,EAAG,CACL,MAAQ,CAGR,CAIF,EAAQ,CACV,CAWA,SAAgB,EACd,EACA,EACA,EACA,EACA,EACA,EAC4C,CAC5C,OAAO,KAAO,IAAW,CAOvB,GAAI,CAIF,IAAM,EAA6B,CAAC,EACpC,GAAI,CACF,IAAM,EAAO,EAAU,EAAS,EAAQ,EAAS,EAAW,CAAO,EACnE,MAAO,IAAgB,IAAA,GACnB,EAAQ,OAAO,CAAM,EACrB,EAAQ,OAAO,EAAQ,IAAA,GAAW,IAAA,GAAW,CAAE,GAAG,CAAY,CAAC,GACnE,MAAM,CACR,QAAU,CAGR,EAAS,EAAS,CAAO,CAC3B,CACF,OAAS,EAAO,CACd,MAAM,EACJ,aAAiB,MAAQ,EAAY,MAAM,OAAO,CAAK,CAAC,EACxD,EACA,CACF,CACF,CACF,CACF,CAuBA,eAAsB,EACpB,EACA,EACA,EACe,CACf,GAAI,CACF,IAAY,CAAK,CACnB,MAAQ,CAIR,CACA,MAAM,EACH,SAAS,CACR,MAAO,QACP,KAAM,KAAK,UAAU,CACnB,QAAS,6EACX,CAAC,CACH,CAAC,CAAC,CACD,UAAY,CAGb,CAAC,CACL,CC/OA,SAAS,EACP,EACA,EACA,EAC8B,CA4B9B,IAAM,EAAQ,EAAO,OAAO,CAAO,EAoBnC,OAnBI,IAAU,IAAA,GACL,EAAE,KACP,CAKE,MACE,gLAGJ,EACA,GACF,EAEE,EAAO,OAAO,CAAK,GAAK,EAAQ,YAAY,EACvC,EAAE,KAAK,CAAE,MAAO,4CAA6C,EAAG,GAAG,GAE5E,EAAO,KAAK,CAAK,EACV,CAAE,OAAM,EACjB,CAUA,SAAgB,EAAc,EAAwB,CACpD,GAAM,CAAE,iBAAgB,SAAQ,cAAa,kBAAiB,eAAgB,EAC9E,OAAO,KAAO,IAAe,CAC3B,IAAM,EAAU,MAAM,EAAe,CAAC,EAChC,EAAO,MAAM,EAAE,IAAI,KAAmD,EAE5E,GAAI,CAAC,EAAK,QAAU,OAAO,EAAK,QAAW,SACzC,OAAO,EAAE,KAAK,CAAE,MAAO,oBAAqB,EAAG,GAAG,EAEpD,GAAI,EAAK,iBAAmB,IAAA,IAAa,OAAO,EAAK,gBAAmB,UACtE,OAAO,EAAE,KAAK,CAAE,MAAO,kCAAmC,EAAG,GAAG,EAMlE,GAAI,EAAQ,kBAAoB,IAAA,GAC9B,GAAI,CACF,MAAM,EAAQ,gBAAgB,CAChC,MAAQ,CAEN,OAAO,EAAE,KAAK,CAAE,MAAO,kCAAmC,EAAG,GAAG,CAClE,CAGF,IAAM,EAAW,EAAU,EAAG,EAAS,CAAM,EAC7C,GAAI,aAAoB,SACtB,OAAO,EAET,GAAM,CAAE,SAAU,EAOd,EAAW,GACT,MAA0B,CACzB,IACH,EAAW,GAGX,EAAY,MAAM,CAAK,EACvB,EAAO,QAAQ,CAAK,EAExB,EACM,EACJ,EAAK,iBAAmB,GACpB,CACE,OAAS,GAAU,EAAY,OAAO,EAAO,CAAK,EAClD,OAAS,GAAO,EAAY,OAAO,EAAO,CAAE,CAC9C,EACA,IAAA,GAaN,GAAI,CASF,OAAO,MAAM,EACX,EACA,EAAU,EAAS,EAAK,OAAQ,EAAa,EAAiB,EAAa,CAAO,CACpF,CACF,OAAS,EAAO,CAEd,MADA,EAAY,EACN,CACR,CACF,CACF,CChKA,SAAgB,GAAgC,CAC9C,IAAM,EAAO,IAAI,IAEjB,MAAO,CACL,OAAO,EAAS,CACd,GAAI,CAIF,IAAM,EAAK,EAAQ,WAAW,CAAC,CAAC,aAAa,EAC7C,OAAO,OAAO,GAAO,UAAY,IAAO,GAAK,EAAK,IAAA,EACpD,MAAQ,CAQN,MACF,CACF,EACA,OAAS,GAAQ,EAAK,IAAI,CAAG,EAC7B,KAAO,GAAQ,KAAK,EAAK,IAAI,CAAG,EAChC,QAAU,GAAQ,KAAK,EAAK,OAAO,CAAG,CACxC,CACF,CCKA,SAAgB,EAAkB,EAAoC,CACpE,GAAM,CAAE,iBAAgB,kBAAiB,eAAgB,EACnD,EAAM,IAAI,EAIV,EAAS,EAAiB,EAC1B,EAAc,EAAsB,EAepC,EAAY,EAAiB,EAAQ,SAAS,EAoGpD,OAxFA,EAAI,IAAI,IAAK,MAAO,EAAG,IACjB,EAAU,QAAU,MACpB,EAAkB,EAAU,MAAO,EAAiB,EAAE,IAAI,OAAO,eAAe,CAAC,CAAC,EAC7E,EAAK,EAEP,EAAE,KAAK,CAAE,MAAO,cAAe,EAAG,GAAG,CAC7C,EAGD,EAAI,KACF,UACA,EAAc,CAAE,iBAAgB,SAAQ,cAAa,kBAAiB,aAAY,CAAC,CACrF,EAGA,EAAI,IAAI,WAAY,EAAmB,CAAE,iBAAgB,SAAQ,cAAa,aAAY,CAAC,CAAC,EAG5F,EAAI,KACF,eACA,EAAoB,CAAE,iBAAgB,SAAQ,cAAa,aAAY,CAAC,CAC1E,EAGA,EAAI,KAAK,WAAY,KAAO,IAAM,CAChC,IAAM,EAAU,MAAM,EAAe,CAAC,EAChC,EAAO,MAAM,EAAE,IAAI,KAAsC,EAE/D,GAAI,CAAC,EAAK,MAAQ,OAAO,EAAK,MAAS,SACrC,OAAO,EAAE,KAAK,CAAE,MAAO,kBAAmB,EAAG,GAAG,EAOlD,IAAM,EAAS,MAAM,EAAQ,eAAe,EAAK,KAAM,EAAK,MAAQ,GAAI,QAAQ,EAIhF,OAHK,EAGE,EAAE,KAAK,CAAM,EAFX,EAAE,KAAK,CAAE,MAAO,oBAAoB,EAAK,MAAO,EAAG,GAAG,CAGjE,CAAC,EAGD,EAAI,KAAK,SAAU,KAAO,MAExB,MADsB,EAAe,CAAC,EAAA,CAC9B,MAAM,EACP,EAAE,KAAK,CAAE,GAAI,EAAK,CAAC,EAC3B,EAGD,EAAI,KAAK,gBAAiB,KAAO,MAE/B,MADsB,EAAe,CAAC,EAAA,CAC9B,YAAY,EACb,EAAE,KAAK,CAAE,GAAI,EAAK,CAAC,EAC3B,EAGD,EAAI,IAAI,YAAa,KAAO,IAAM,CAChC,IAAM,EAAU,MAAM,EAAe,CAAC,EACtC,OAAO,EAAE,KAAK,EAAQ,YAAY,CAAC,CACrC,CAAC,EAGD,EAAI,IAAI,WAAY,KAAO,IAAM,CAC/B,IAAM,EAAU,MAAM,EAAe,CAAC,EACtC,OAAO,EAAE,KAAK,EAAQ,gBAAgB,CAAC,CACzC,CAAC,EAQD,EAAI,IAAI,aAAc,KAAO,IAAM,CACjC,IAAM,EAAU,MAAM,EAAe,CAAC,EAChC,EAAQ,EAAO,OAAO,CAAO,EAC7B,EAAU,IAAU,IAAA,IAAa,EAAO,OAAO,CAAK,EAC1D,OAAO,EAAE,KAAK,CAAE,UAAW,GAAW,EAAQ,YAAY,CAAE,CAAC,CAC/D,CAAC,EAGD,EAAI,IAAI,WAAY,KAAO,IAAM,CAC/B,IAAM,EAAU,MAAM,EAAe,CAAC,EACtC,OAAO,EAAE,KAAK,CAAE,QAAS,EAAQ,iBAAiB,CAAE,CAAC,CACvD,CAAC,EAEM,CACT,CC9IA,SAAgB,EAAoB,EAAiD,CACnF,IAAI,EAAwC,KACxC,EAAmB,KAGjB,EAAY,EAAiB,GAAS,SAAS,EAC/C,EAAkB,GACtB,OAAO,OAAW,MAAM,kBAAkB,EAAK,EAAE,EAAG,CAClD,KAAM,0BACN,OACA,cAAe,MACjB,CAAC,EAEH,MAAO,CACL,KAAM,OACN,UAAW,OAAO,OAAO,CAAE,KAAM,SAAU,CAAC,EAC5C,OAAO,EAA0B,CAC/B,EAAU,CACZ,EACA,MAAM,OAAQ,CACZ,GAAI,CAAC,EAAS,MAAM,EAAe,cAAc,EACjD,GAAI,EAAK,MAAM,EAAe,iBAAiB,EAC/C,IAAM,EAAS,EAAkB,CAC/B,mBAAsB,EAGtB,YACA,gBAAiB,GAAS,gBAC1B,YAAa,GAAS,WACxB,CAAC,EAGD,EAAM,GAAS,SAAW,IAAI,EAAK,CAAC,CAAC,MAAM,EAAQ,SAAU,CAAM,EAAI,CACzE,EACA,MAAM,MAAO,CACX,EAAM,KACN,EAAU,IACZ,EACA,QAAS,CACP,GAAI,CAAC,EAAK,MAAU,MAAM,4CAA4C,EACtE,OAAO,CACT,EAEA,mBAAoB,CAClB,OAAO,EAAU,KACnB,CACF,CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@robota-sdk/agent-transport-http",
-  "version": "3.0.0-beta.88",
+  "version": "3.0.0-beta.90",
   "description": "HTTP (Hono) transport for the Robota SDK",
   "type": "module",
   "main": "dist/node/index.js",
@@ -41,9 +41,9 @@
   ],
   "dependencies": {
     "hono": "^4.12.32",
-    "@robota-sdk/agent-transport": "3.0.0-beta.88",
-    "@robota-sdk/agent-interface-transport": "3.0.0-beta.88",
-    "@robota-sdk/agent-interface-session": "3.0.0-beta.88"
+    "@robota-sdk/agent-interface-session": "3.0.0-beta.90",
+    "@robota-sdk/agent-interface-transport": "3.0.0-beta.90",
+    "@robota-sdk/agent-transport": "3.0.0-beta.90"
   },
   "devDependencies": {
     "rimraf": "^5.0.10",

package/src/__tests__/http-transport.test.ts

@@ -27,6 +27,8 @@ function createMockSession(): IHttpTransportSession {
     isExecuting,
     getPendingPrompt,
     getPendingCount,
+    resolvePermission,
+    resolveAsk,
   } = full;
   return {
     submit,
@@ -46,6 +48,8 @@ function createMockSession(): IHttpTransportSession {
     isExecuting,
     getPendingPrompt,
     getPendingCount,
+    resolvePermission,
+    resolveAsk,
   };
 }
 
@@ -58,8 +62,8 @@ describe('createHttpTransport', () => {
     >();
     expectTypeOf<IHttpTransportSession>().not.toHaveProperty('listRuntimeTools');
     // #3282 §2 added `listModels` to `ISessionCommands` (15 + 1); #3288 §2 added `getMessagesDisplay`
-    // to `ISessionConversationRead` (16 + 1).
-    expect(Object.keys(createMockSession())).toHaveLength(17);
+    // to `ISessionConversationRead` (16 + 1); #3449 added `ISessionPromptResolution` (17 + 2).
+    expect(Object.keys(createMockSession())).toHaveLength(19);
   });
 
   it('returns an adapter with name "http"', () => {

package/src/__tests__/prompt-routes.test.ts

@@ -0,0 +1,299 @@
+/**
+ * Permission and ask prompts over the HTTP routes: forwarded on a prompt-receiving `/submit` stream,
+ * listed by `GET /prompts` for a client that came later, and answered by `POST /prompts/:id`.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import { createTestInteractiveSession } from '@robota-sdk/agent-interface-session/testing';
+
+import { createAgentRoutes } from '../routes.js';
+
+import type {
+  IInteractiveSession,
+  ITurnHandle,
+  TPermissionResultValue,
+} from '@robota-sdk/agent-interface-session';
+
+type TActionResponse = Parameters<IInteractiveSession['resolveAsk']>[1];
+
+const DRIVER = 'remote:http';
+
+function stubHandle(): ITurnHandle {
+  return {
+    turnId: 'turn-1',
+    completed: Promise.resolve({
+      response: '',
+      history: [],
+      toolSummaries: [],
+      contextState: { usedTokens: 0, maxTokens: 0, usedPercentage: 0, remainingPercentage: 100 },
+    }),
+  };
+}
+
+/**
+ * A session whose turn asks once, the way the real prompt registry does: it parks the prompt only
+ * while someone listens for it and fails closed otherwise, settles the first answer for an id, and
+ * emits `prompt_resolved` synchronously as it settles.
+ */
+function createAskingSession(
+  kind: 'permission' | 'ask',
+  options: { ignoreAnswers?: boolean; throwAfterAsk?: boolean } = {},
+) {
+  const listeners = new Map<string, Set<(data: unknown) => void>>();
+  const emit = (event: string, data: unknown): void => {
+    for (const h of [...(listeners.get(event) ?? [])]) h(data);
+  };
+  const parked = new Map<string, (value: TPermissionResultValue | TActionResponse) => void>();
+  const settle = (id: string, value: TPermissionResultValue | TActionResponse): void => {
+    const resolve = parked.get(id);
+    if (resolve === undefined) return;
+    parked.delete(id);
+    resolve(value);
+    emit('prompt_resolved', { id });
+  };
+  const gate = kind === 'permission' ? 'permission_request' : 'ask_request';
+  const ask = (): Promise<TPermissionResultValue | TActionResponse> => {
+    if ((listeners.get(gate)?.size ?? 0) === 0) {
+      return Promise.resolve(kind === 'permission' ? false : { type: 'cancelled' });
+    }
+    const id = kind === 'permission' ? 'p1' : 'a1';
+    return new Promise((resolve) => {
+      parked.set(id, resolve);
+      emit(
+        gate,
+        kind === 'permission'
+          ? { id, toolName: 'Bash', toolArgs: { command: 'ls' } }
+          : { id, request: { id: 'q', title: 'Pick one', options: [{ value: 'x', label: 'X' }] } },
+      );
+    });
+  };
+  const resolvePermission = vi.fn((id: string, result: TPermissionResultValue) => {
+    if (options.ignoreAnswers !== true) settle(id, result);
+  });
+  const resolveAsk = vi.fn((id: string, response: TActionResponse) => {
+    if (options.ignoreAnswers !== true) settle(id, response);
+  });
+  const failAllClosed = (): void => {
+    for (const id of [...parked.keys()]) {
+      settle(id, kind === 'permission' ? false : { type: 'cancelled' });
+    }
+  };
+  const session = createTestInteractiveSession({
+    // Like the real session: an aborted turn settles every prompt it left parked.
+    abort: failAllClosed,
+    submit: (async () => {
+      if (options.throwAfterAsk === true) {
+        void ask();
+        await new Promise((r) => setTimeout(r, 5));
+        throw new Error('the turn failed while its prompt was open');
+      }
+      const answer = await ask();
+      emit('complete', { success: true, content: JSON.stringify(answer) });
+      return stubHandle();
+    }) as IInteractiveSession['submit'],
+    resolvePermission: resolvePermission as IInteractiveSession['resolvePermission'],
+    resolveAsk: resolveAsk as IInteractiveSession['resolveAsk'],
+    on: ((event: string, handler: (data: unknown) => void) => {
+      if (!listeners.has(event)) listeners.set(event, new Set());
+      listeners.get(event)?.add(handler);
+    }) as IInteractiveSession['on'],
+    off: ((event: string, handler: (data: unknown) => void) => {
+      listeners.get(event)?.delete(handler);
+      // Like the real session: the last prompt listener leaving settles what it left parked.
+      if ((listeners.get(gate)?.size ?? 0) === 0) failAllClosed();
+    }) as IInteractiveSession['off'],
+  });
+  return {
+    session,
+    resolvePermission,
+    resolveAsk,
+    listenerCount: (e: string) => listeners.get(e)?.size ?? 0,
+  };
+}
+
+function routesFor(session: IInteractiveSession) {
+  return createAgentRoutes({
+    sessionFactory: () => ({ ...session }),
+    admission: { open: true, openReason: 'unit test' },
+    attribution: { driverId: DRIVER, surface: 'remote' },
+  });
+}
+
+const json = (body: unknown): RequestInit => ({
+  method: 'POST',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify(body),
+});
+
+/** Read an SSE response until `until` appears in it; returns everything read so far. */
+async function readUntil(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  seen: { text: string },
+  until: string,
+): Promise<string> {
+  const decoder = new TextDecoder();
+  while (!seen.text.includes(until)) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    seen.text += decoder.decode(value, { stream: true });
+  }
+  return seen.text;
+}
+
+async function openTurn(routes: ReturnType<typeof routesFor>, receivePrompts?: boolean) {
+  const res = await routes.request(
+    '/submit',
+    json({ prompt: 'go', ...(receivePrompts === undefined ? {} : { receivePrompts }) }),
+  );
+  expect(res.status).toBe(200);
+  const reader = res.body!.getReader();
+  return { reader, seen: { text: '' } };
+}
+
+describe('HTTP prompt routes', () => {
+  it('forwards a live permission prompt, lists it for a late client, and settles it on approve', async () => {
+    const { session, resolvePermission } = createAskingSession('permission');
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+
+    expect(await readUntil(reader, seen, 'event: permission_request')).toContain(
+      '"toolName":"Bash"',
+    );
+
+    const late = await routes.request('/prompts');
+    expect(await late.json()).toEqual({
+      prompts: [
+        {
+          type: 'permission_request',
+          event: { id: 'p1', toolName: 'Bash', toolArgs: { command: 'ls' } },
+        },
+      ],
+    });
+
+    const answer = await routes.request('/prompts/p1', json({ result: true }));
+    expect(answer.status).toBe(200);
+    expect(resolvePermission).toHaveBeenCalledWith('p1', true, DRIVER);
+
+    const rest = await readUntil(reader, seen, 'event: complete');
+    expect(rest).toContain('event: prompt_resolved');
+    expect(rest).toContain('"content":"true"');
+    expect(await (await routes.request('/prompts')).json()).toEqual({ prompts: [] });
+  });
+
+  it('settles the turn denied when the client answers false', async () => {
+    const { session } = createAskingSession('permission');
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+    await readUntil(reader, seen, 'event: permission_request');
+
+    expect((await routes.request('/prompts/p1', json({ result: false }))).status).toBe(200);
+    expect(await readUntil(reader, seen, 'event: complete')).toContain('"content":"false"');
+  });
+
+  it('answers an ask prompt', async () => {
+    const { session, resolveAsk } = createAskingSession('ask');
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+    await readUntil(reader, seen, 'event: ask_request');
+
+    const response = { type: 'answer', values: ['x'] };
+    expect((await routes.request('/prompts/a1', json({ response }))).status).toBe(200);
+    expect(resolveAsk).toHaveBeenCalledWith('a1', response, DRIVER);
+    await readUntil(reader, seen, 'event: complete');
+  });
+
+  it('refuses an unknown id and an already-settled id with 404', async () => {
+    const { session, resolvePermission } = createAskingSession('permission');
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+    await readUntil(reader, seen, 'event: permission_request');
+
+    expect((await routes.request('/prompts/nope', json({ result: true }))).status).toBe(404);
+    expect((await routes.request('/prompts/p1', json({ result: true }))).status).toBe(200);
+    const again = await routes.request('/prompts/p1', json({ result: false }));
+    expect(again.status).toBe(404);
+    expect(resolvePermission).toHaveBeenCalledTimes(1);
+    await readUntil(reader, seen, 'event: complete');
+  });
+
+  it('refuses a malformed answer and an answer of the wrong kind with 400', async () => {
+    const { session, resolvePermission } = createAskingSession('permission');
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+    await readUntil(reader, seen, 'event: permission_request');
+
+    expect((await routes.request('/prompts/p1', json({ result: 'yes' }))).status).toBe(400);
+    expect(
+      (await routes.request('/prompts/p1', json({ response: { type: 'cancelled' } }))).status,
+    ).toBe(400);
+    expect(
+      (
+        await routes.request('/prompts/p1', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: 'not json',
+        })
+      ).status,
+    ).toBe(400);
+    expect(resolvePermission).not.toHaveBeenCalled();
+
+    await routes.request('/prompts/p1', json({ result: true }));
+    await readUntil(reader, seen, 'event: complete');
+  });
+
+  it('leaves prompts unsubscribed without receivePrompts, so the turn fails closed as before', async () => {
+    const { session, listenerCount } = createAskingSession('permission');
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes);
+
+    const all = await readUntil(reader, seen, 'event: complete');
+    expect(all).not.toContain('permission_request');
+    expect(all).toContain('"content":"false"');
+    expect(listenerCount('permission_request')).toBe(0);
+    expect(await (await routes.request('/prompts')).json()).toEqual({ prompts: [] });
+  });
+
+  it('refuses a receivePrompts that is not a boolean', async () => {
+    const { session } = createAskingSession('permission');
+    const res = await routesFor(session).request(
+      '/submit',
+      json({ prompt: 'go', receivePrompts: 'yes' }),
+    );
+    expect(res.status).toBe(400);
+  });
+
+  it('forgets the session prompts when the prompt-receiving stream ends', async () => {
+    const { session } = createAskingSession('permission');
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+    await readUntil(reader, seen, 'event: permission_request');
+
+    await reader.cancel();
+    await vi.waitFor(async () => {
+      expect(await (await routes.request('/prompts')).json()).toEqual({ prompts: [] });
+    });
+    expect((await routes.request('/prompts/p1', json({ result: true }))).status).toBe(404);
+  });
+
+  it('answers 409 when the session did not take the answer', async () => {
+    const { session } = createAskingSession('permission', { ignoreAnswers: true });
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+    await readUntil(reader, seen, 'event: permission_request');
+
+    expect((await routes.request('/prompts/p1', json({ result: true }))).status).toBe(409);
+    await reader.cancel();
+  });
+
+  it('stops listing a prompt another surface still holds once this stream ended', async () => {
+    const { session } = createAskingSession('permission', { throwAfterAsk: true });
+    // Another surface listening keeps the prompt parked after this stream lets go of it.
+    session.on('permission_request', () => {});
+    const routes = routesFor(session);
+    const { reader, seen } = await openTurn(routes, true);
+
+    await readUntil(reader, seen, 'event: error');
+    expect(await (await routes.request('/prompts')).json()).toEqual({ prompts: [] });
+    expect((await routes.request('/prompts/p1', json({ result: true }))).status).toBe(404);
+  });
+});

package/src/__tests__/routes.test.ts

@@ -137,6 +137,8 @@ describe('HTTP Transport Routes', () => {
       isExecuting,
       getPendingPrompt,
       getPendingCount,
+      resolvePermission,
+      resolveAsk,
     } = full;
     const port: IHttpTransportSession = {
       submit,
@@ -156,10 +158,13 @@ describe('HTTP Transport Routes', () => {
       isExecuting,
       getPendingPrompt,
       getPendingCount,
+      resolvePermission,
+      resolveAsk,
     };
     // #3282 §2 added `listModels` to `ISessionCommands` (15 + 1); #3288 §2 added
-    // `getMessagesDisplay` to `ISessionConversationRead` (16 + 1).
-    expect(Object.keys(port)).toHaveLength(17);
+    // `getMessagesDisplay` to `ISessionConversationRead` (16 + 1); #3449 added the two prompt
+    // answers of `ISessionPromptResolution` (17 + 2).
+    expect(Object.keys(port)).toHaveLength(19);
     const transport = createHttpTransport({
       admission: { open: true, openReason: 'least-authority HTTP port scenario' },
     });

package/src/http-session.ts

@@ -4,6 +4,7 @@ import type {
   ISessionEvents,
   ISessionExecutionState,
   ISessionIdentity,
+  ISessionPromptResolution,
   ISessionTurnControl,
   ISessionTurnSubmission,
 } from '@robota-sdk/agent-interface-session';
@@ -15,6 +16,7 @@ export interface IHttpTransportSession
     ISessionEvents,
     ISessionTurnControl,
     ISessionIdentity,
+    ISessionPromptResolution,
     ISessionCommands,
     ISessionConversationRead,
     ISessionExecutionState {

package/src/open-prompts.ts

@@ -0,0 +1,56 @@
+/**
+ * The permission and ask prompts a `/submit` stream forwarded and that are still open, per session.
+ *
+ * The session emits a prompt once, when it is asked, so a client that comes later would never see
+ * it; `GET /prompts` answers from here, and `POST /prompts/:id` refuses an id that is not here.
+ *
+ * Keyed by the session's id, the same key as the turn claim, and not by object identity: the session
+ * factory may return a fresh wrapper per request, so the `agent-transport` registry (a WeakMap on the
+ * session object) would never find the prompt a different request recorded.
+ *
+ * It learns only through the prompt-receiving stream's own subscriptions and never listens to the
+ * session itself. A listener of its own would keep an unattended turn's prompt parked instead of
+ * letting the session fail it closed. A session's entries go when that stream's claim is released.
+ */
+
+import type {
+  IAskRequestEvent,
+  IPermissionRequestEvent,
+} from '@robota-sdk/agent-interface-session';
+
+export type THttpPromptFrame =
+  | { readonly type: 'permission_request'; readonly event: IPermissionRequestEvent }
+  | { readonly type: 'ask_request'; readonly event: IAskRequestEvent };
+
+export interface IHttpOpenPrompts {
+  record(sessionKey: string, frame: THttpPromptFrame): void;
+  forget(sessionKey: string, id: string): void;
+  /** The session's open prompts, oldest first. */
+  list(sessionKey: string): readonly THttpPromptFrame[];
+  find(sessionKey: string, id: string): THttpPromptFrame | undefined;
+  /** The stream that received the session's prompts has ended. */
+  clear(sessionKey: string): void;
+}
+
+export function createHttpOpenPrompts(): IHttpOpenPrompts {
+  const bySession = new Map<string, Map<string, THttpPromptFrame>>();
+
+  return {
+    record(sessionKey, frame) {
+      let open = bySession.get(sessionKey);
+      if (open === undefined) {
+        open = new Map();
+        bySession.set(sessionKey, open);
+      }
+      open.set(frame.event.id, frame);
+    },
+    forget(sessionKey, id) {
+      bySession.get(sessionKey)?.delete(id);
+    },
+    list: (sessionKey) => [...(bySession.get(sessionKey)?.values() ?? [])],
+    find: (sessionKey, id) => bySession.get(sessionKey)?.get(id),
+    clear(sessionKey) {
+      bySession.delete(sessionKey);
+    },
+  };
+}

package/src/prompt-routes.ts

@@ -0,0 +1,101 @@
+/**
+ * `GET /prompts` and `POST /prompts/:id` — reading and answering the permission and ask prompts a
+ * prompt-receiving `/submit` stream forwarded.
+ *
+ * Split from `routes.ts` for the same reason `/submit` is: these routes carry a decision of their own
+ * (is this id open here, and is this answer the right kind for it), not just a mount.
+ */
+
+import { decodeClientMessage } from '@robota-sdk/agent-transport';
+
+import type { IHttpOpenPrompts } from './open-prompts.js';
+import type { TSessionFactory } from './submit-route.js';
+import type { TTurnAttribution } from './submit-stream.js';
+import type { ITurnClaims } from './turn-claims.js';
+import type { Context } from 'hono';
+
+export interface IPromptRouteDeps {
+  readonly sessionFactory: TSessionFactory;
+  readonly claims: ITurnClaims;
+  readonly openPrompts: IHttpOpenPrompts;
+  readonly attribution?: TTurnAttribution;
+}
+
+/** The open prompts of the request's session, oldest first: what a client that came later reads. */
+export function listPromptsHandler(deps: IPromptRouteDeps) {
+  return async (c: Context) => {
+    const session = await deps.sessionFactory(c);
+    const key = deps.claims.keyFor(session);
+    return c.json({ prompts: key === undefined ? [] : deps.openPrompts.list(key) });
+  };
+}
+
+/**
+ * Answer one open prompt by id.
+ *
+ * The id must be one this session's prompt-receiving stream forwarded and that is still open. An id
+ * that never was and one already settled get the same 404: the client cannot act differently on the
+ * two, and the registry forgets a prompt once it settles.
+ *
+ * The answerer is the HOST's `attribution.driverId`, never the request, for the same reason `/submit`
+ * attribution is: a client must not record its answer as another surface's.
+ *
+ * Nothing awaits between the lookup and the resolve. The session settles synchronously and emits
+ * `prompt_resolved`, which the stream forwards and the registry forgets, so a second answer for the
+ * same id finds nothing open and is refused rather than reported as accepted.
+ *
+ * `200` means the prompt settled, not merely that the answer was handed over: the session ignores an
+ * answer it does not take (one in an outside party's name, say), and a prompt still open after the
+ * resolve is answered `409` so the client does not believe it decided something it did not.
+ */
+export function answerPromptHandler(deps: IPromptRouteDeps) {
+  const { sessionFactory, claims, openPrompts, attribution } = deps;
+  return async (c: Context) => {
+    const session = await sessionFactory(c);
+    const id = c.req.param('id') ?? '';
+    let body: { result?: unknown; response?: unknown };
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ error: 'the body must be a JSON object' }, 400);
+    }
+
+    const key = claims.keyFor(session);
+    const frame = key === undefined ? undefined : openPrompts.find(key, id);
+    if (key === undefined || frame === undefined) {
+      return c.json({ error: 'no open prompt with this id' }, 404);
+    }
+
+    if (frame.type === 'permission_request') {
+      const decoded = decodeClientMessage({
+        type: 'permission-response',
+        id,
+        result: body?.result,
+      });
+      if (!decoded.ok || decoded.message.type !== 'permission-response') {
+        return c.json(
+          { error: 'result must be true, false, "allow-session" or "allow-project"' },
+          400,
+        );
+      }
+      session.resolvePermission(id, decoded.message.result, attribution?.driverId);
+    } else {
+      const decoded = decodeClientMessage({ type: 'ask-response', id, response: body?.response });
+      if (!decoded.ok || decoded.message.type !== 'ask-response') {
+        return c.json(
+          {
+            error:
+              'response must be { "type": "answer", "values": string[], "text"?: string } or ' +
+              '{ "type": "cancelled" }',
+          },
+          400,
+        );
+      }
+      session.resolveAsk(id, decoded.message.response, attribution?.driverId);
+    }
+    if (openPrompts.find(key, id) !== undefined) {
+      return c.json({ error: 'the session did not accept this answer' }, 409);
+    }
+    return c.json({ ok: true });
+  };
+}

package/src/routes.ts

@@ -13,6 +13,8 @@ import {
 } from '@robota-sdk/agent-transport/node';
 import { Hono } from 'hono';
 
+import { createHttpOpenPrompts } from './open-prompts.js';
+import { answerPromptHandler, listPromptsHandler } from './prompt-routes.js';
 import { submitHandler } from './submit-route.js';
 import { createTurnClaims } from './turn-claims.js';
 
@@ -45,9 +47,9 @@ export interface IAgentRoutesOptions {
    */
   admission: ITransportAdmissionConfig | ITransportAdmission;
   /**
-   * Who `/submit` turns are attributed to — the driver and product surface the HOST assigns, as the
-   * WebSocket transport's `driverId`/`surface` do. Never taken from the request body. Absent leaves
-   * the session's own default.
+   * Who `/submit` turns and prompt answers are attributed to — the driver and product surface the
+   * HOST assigns, as the WebSocket transport's `driverId`/`surface` do. Never taken from the request
+   * body. Absent leaves the session's own default.
    */
   attribution?: TTurnAttribution;
 }
@@ -69,6 +71,7 @@ export function createAgentRoutes(options: IAgentRoutesOptions): Hono {
   // RUNTIME-38: one turn at a time, per session — `turn-claims.ts` owns what that means and why it
   // is keyed by the session's declared ID rather than by object identity.
   const claims = createTurnClaims();
+  const openPrompts = createHttpOpenPrompts();
 
   // SEC-008: resolved ONCE, at construction, so a transport that cannot mint a credential fails to
   // build rather than serving without one. Resolving per request would also mint a new token per
@@ -104,7 +107,19 @@ export function createAgentRoutes(options: IAgentRoutesOptions): Hono {
   });
 
   // POST /submit — execute prompt, stream events via SSE
-  app.post('/submit', submitHandler(sessionFactory, claims, onStreamFailure, attribution));
+  app.post(
+    '/submit',
+    submitHandler({ sessionFactory, claims, openPrompts, onStreamFailure, attribution }),
+  );
+
+  // GET /prompts — the open permission/ask prompts a prompt-receiving /submit stream forwarded
+  app.get('/prompts', listPromptsHandler({ sessionFactory, claims, openPrompts, attribution }));
+
+  // POST /prompts/:id — answer one of them
+  app.post(
+    '/prompts/:id',
+    answerPromptHandler({ sessionFactory, claims, openPrompts, attribution }),
+  );
 
   // POST /command — execute system command
   app.post('/command', async (c) => {

package/src/submit-route.ts

@@ -11,7 +11,8 @@ import { streamSSE } from 'hono/streaming';
 import { relayTurn } from './submit-stream.js';
 
 import type { IHttpTransportSession } from './http-session.js';
-import type { TStreamFailureListener, TTurnAttribution } from './submit-stream.js';
+import type { IHttpOpenPrompts } from './open-prompts.js';
+import type { IRelayPrompts, TStreamFailureListener, TTurnAttribution } from './submit-stream.js';
 import type { ITurnClaims } from './turn-claims.js';
 import type { Context } from 'hono';
 
@@ -101,19 +102,26 @@ function admitTurn(
   return { claim };
 }
 
-export function submitHandler(
-  sessionFactory: TSessionFactory,
-  claims: ITurnClaims,
-  onStreamFailure?: TStreamFailureListener,
-  attribution?: TTurnAttribution,
-) {
+export interface ISubmitRouteDeps {
+  readonly sessionFactory: TSessionFactory;
+  readonly claims: ITurnClaims;
+  readonly openPrompts: IHttpOpenPrompts;
+  readonly onStreamFailure?: TStreamFailureListener;
+  readonly attribution?: TTurnAttribution;
+}
+
+export function submitHandler(deps: ISubmitRouteDeps) {
+  const { sessionFactory, claims, openPrompts, onStreamFailure, attribution } = deps;
   return async (c: Context) => {
     const session = await sessionFactory(c);
-    const body = await c.req.json<{ prompt: string }>();
+    const body = await c.req.json<{ prompt: string; receivePrompts?: unknown }>();
 
     if (!body.prompt || typeof body.prompt !== 'string') {
       return c.json({ error: 'prompt is required' }, 400);
     }
+    if (body.receivePrompts !== undefined && typeof body.receivePrompts !== 'boolean') {
+      return c.json({ error: 'receivePrompts must be a boolean' }, 400);
+    }
 
     // A session still building itself cannot name itself yet, and the claim needs its name. The
     // claim itself is still taken synchronously after this, so two requests that both waited here
@@ -142,9 +150,19 @@ export function submitHandler(
     const releaseOnce = (): void => {
       if (!released) {
         released = true;
+        // The stream that held this session's prompts is gone; what is still open is the session's
+        // to settle, and no longer this route's to list or answer.
+        openPrompts.clear(claim);
         claims.release(claim);
       }
     };
+    const prompts: IRelayPrompts | undefined =
+      body.receivePrompts === true
+        ? {
+            record: (frame) => openPrompts.record(claim, frame),
+            forget: (id) => openPrompts.forget(claim, id),
+          }
+        : undefined;
 
     // The claim is taken OUTSIDE the callback, so its release cannot live only in the callback's
     // `finally` — a claim whose release is not in the same protected region is a lock, not a claim,
@@ -168,7 +186,7 @@ export function submitHandler(
       // the cost of closing that class is one keyword.
       return await streamSSE(
         c,
-        relayTurn(session, body.prompt, releaseOnce, onStreamFailure, attribution),
+        relayTurn(session, body.prompt, releaseOnce, onStreamFailure, attribution, prompts),
       );
     } catch (error) {
       releaseOnce();

package/src/submit-stream.ts

@@ -8,8 +8,14 @@
  */
 
 import type { IHttpTransportSession } from './http-session.js';
+import type { THttpPromptFrame } from './open-prompts.js';
 import type { SSEStreamingApi } from 'hono/streaming';
-import type { ISubmitOptions } from '@robota-sdk/agent-interface-session';
+import type {
+  IAskRequestEvent,
+  IPermissionRequestEvent,
+  IPromptResolvedEvent,
+  ISubmitOptions,
+} from '@robota-sdk/agent-interface-session';
 
 /**
  * Where the DETAIL of a post-headers stream failure goes — injected, never imported.
@@ -33,6 +39,15 @@ export type TStreamFailureListener = (error: Error) => void;
  */
 export type TTurnAttribution = Pick<ISubmitOptions, 'driverId' | 'surface'>;
 
+/**
+ * Where a prompt-receiving stream reports the prompts it forwarded, so a later request can list or
+ * answer them. Present only when the client asked to receive prompts.
+ */
+export interface IRelayPrompts {
+  record(frame: THttpPromptFrame): void;
+  forget(id: string): void;
+}
+
 /**
  * Wire every relay subscription and the abort path; answer with the promise that settles when the
  * turn is over (or refused one).
@@ -48,6 +63,7 @@ function wireRelay(
   stream: SSEStreamingApi,
   cleanup: Array<() => void>,
   onFailure: TStreamFailureListener | undefined,
+  prompts: IRelayPrompts | undefined,
 ): Promise<void> {
   const subscribe = <T>(event: string, handler: (data: T) => void): void => {
     session.on(event as 'text_delta', handler as () => void);
@@ -71,6 +87,7 @@ function wireRelay(
   subscribe('tool_start', (state) => void write('tool_start', state));
   subscribe('tool_end', (state) => void write('tool_end', state));
   subscribe('thinking', (isThinking: boolean) => void write('thinking', { isThinking }));
+  if (prompts !== undefined) subscribePrompts(subscribe, write, prompts);
 
   // Flush the terminal event before resolving, so the resolve → cleanup → stream-close
   // continuation cannot race ahead of the write.
@@ -95,6 +112,33 @@ function wireRelay(
   return done;
 }
 
+/**
+ * Forward the turn's permission and ask prompts, and their settlement, to a client that said it can
+ * answer them.
+ *
+ * Only such a client subscribes: the session parks a prompt only while someone listens for it, so a
+ * client that cannot answer must not listen, or the turn would wait on a prompt nobody settles
+ * instead of failing it closed at once.
+ */
+function subscribePrompts(
+  subscribe: <T>(event: string, handler: (data: T) => void) => void,
+  write: (event: string, data: unknown) => Promise<void>,
+  prompts: IRelayPrompts,
+): void {
+  subscribe('permission_request', (event: IPermissionRequestEvent) => {
+    prompts.record({ type: 'permission_request', event });
+    void write('permission_request', event);
+  });
+  subscribe('ask_request', (event: IAskRequestEvent) => {
+    prompts.record({ type: 'ask_request', event });
+    void write('ask_request', event);
+  });
+  subscribe('prompt_resolved', (event: IPromptResolvedEvent) => {
+    prompts.forget(event.id);
+    void write('prompt_resolved', event);
+  });
+}
+
 /**
  * The abort path, alone, because every clause of it is load-bearing and review shaped each one.
  *
@@ -163,6 +207,7 @@ export function relayTurn(
   release: () => void,
   onFailure?: TStreamFailureListener,
   attribution?: TTurnAttribution,
+  prompts?: IRelayPrompts,
 ): (stream: SSEStreamingApi) => Promise<void> {
   return async (stream) => {
     // NOTHING may escape this callback, and the reason is measured rather than stylistic. Hono's
@@ -177,7 +222,7 @@ export function relayTurn(
       // later request gets 409 forever.
       const cleanup: Array<() => void> = [];
       try {
-        const done = wireRelay(session, stream, cleanup, onFailure);
+        const done = wireRelay(session, stream, cleanup, onFailure, prompts);
         await (attribution === undefined
           ? session.submit(prompt)
           : session.submit(prompt, undefined, undefined, { ...attribution }));