@sema-agent/client-core 0.100.0 → 0.102.0

package/dist/hitl/sessionPolicyDeliverable.js

@@ -1,8 +1,8 @@
 import { CONFIG_LEGACY_TOOL_NAME } from '../engineErrorCodes.js';
 import { rosterMountedNames } from '../rosterMountedNames.js';
-import { ruleCompileVerdict } from '../ruleCompileVerdict.js';
-import { readRuleEntry } from '../coreValuePorts.js';
+import { msg, renderMessage } from '../i18n/translate.js';
 import { readOwnDataValue } from '../ownKey.js';
+import { denyEntryReading, ruleCompileVerdict } from '../ruleCompileVerdict.js';
 import { ruleToolNameVerdictOf } from '../protocolSegment.js';
 import { PREFIXES_IN_PROSE, REFUSED_NAME_FIX } from './refusedToolNameProse.js';
 import { prepareRefusalNoteOf } from '../prepareRefusal.js';
@@ -16,17 +16,60 @@ const WITHHELD_NOTICE = {
     not_a_tool_name: 'Not written to this session’s rule record: this entry is not exactly one tool name — it is empty, not text, has spaces around the name, is not a single tool name in rule syntax (for example it contains a backslash or a parenthesis, or is longer than a rule can be), or spells its server or agent peer part in a way the engine never uses when naming tools (for example with a dot or a space), so no tool would ever match it.',
     legacy_tool_name: `Not written to this session’s rule record: unless a tool by exactly this name is available, the engine refuses it — it is a retired tool name, or it contains "__" but does not start with ${PREFIXES_IN_PROSE} — and with it in that record every later run of this session would fail at startup until that entry is removed from the record. ${REFUSED_NAME_FIX}`,
     not_in_roster: 'Not written to this session’s rule record: the tool roster supplied for this check has no tool by exactly this name, as a name or an alias, with letter case counted — it may be misspelled, or name a tool this deployment does not provide — so recorded as it is it would block nothing here.',
+    namespace_covering_unconfirmed: msg('session.policy.withheld.namespaceCoveringUnconfirmed'),
 };
 export const SESSION_POLICY_WITHHELD_WHY = Object.freeze(Object.keys(WITHHELD_NOTICE));
 const MAX_RULES = 10_000;
 function unreadable() {
     return { deliverable: {}, withheld: [], unreadable: true };
 }
-function withheldWhyOf(rule) {
+function namespaceCoveringFormOf(rule) {
+    if (rule.trim() !== rule)
+        return undefined;
+    for (const prefix of COVERING_NAMESPACE_PREFIXES) {
+        if (!rule.startsWith(prefix))
+            continue;
+        const segments = rule.slice(prefix.length).split('__');
+        const peer = segments[0];
+        if (peer === undefined || peer === '' || peer.includes('*'))
+            return undefined;
+        if (segments.length === 1)
+            return 'peer';
+        const tool = segments.slice(1).join('__');
+        if (tool === '*')
+            return 'tool_star';
+        return /^[^*]+\*$/.test(tool) ? 'tool_glob' : undefined;
+    }
+    return undefined;
+}
+function suppliedNamespaceForms(opts) {
+    if (opts === undefined || opts === null || typeof opts !== 'object')
+        return 'unsupplied';
+    let reading;
+    try {
+        reading = readOwnDataValue(opts, 'namespaceForms');
+    }
+    catch {
+        return 'unsupplied';
+    }
+    if (reading === undefined || reading === null)
+        return 'unsupplied';
+    if (typeof reading !== 'object')
+        return 'unconfirmed';
+    try {
+        return readOwnDataValue(reading, 'kind') === 'confirmed' ? 'confirmed' : 'unconfirmed';
+    }
+    catch {
+        return 'unconfirmed';
+    }
+}
+function withheldWhyOf(rule, covering, forms) {
     if (rule.length === 0)
         return 'not_a_tool_name';
     if (/(?:^|[^\\])\(/.test(rule))
         return 'qualified_deny';
+    if (covering !== undefined)
+        return forms === 'confirmed' ? undefined : 'namespace_covering_unconfirmed';
     if (rule.includes('*'))
         return 'wildcard';
     for (const prefix of COVERING_NAMESPACE_PREFIXES) {
@@ -80,6 +123,7 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
     if (known === 'unreadable')
         return unreadable();
     const mounted = known === 'absent' ? undefined : known;
+    const forms = suppliedNamespaceForms(opts);
     const withheld = [];
     if (behavior === 'ask') {
         for (const r of entries)
@@ -92,7 +136,8 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
             withheld.push({ rule: '', why: 'not_a_tool_name' });
             continue;
         }
-        let why = withheldWhyOf(r);
+        const covering = forms === 'unsupplied' ? undefined : namespaceCoveringFormOf(r);
+        let why = withheldWhyOf(r, covering, forms);
         const engineAsked = why === undefined;
         let currentName;
         if (engineAsked) {
@@ -125,7 +170,7 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
             if (grammar === 'refused')
                 why = 'not_a_tool_name';
         }
-        if (why === undefined && mounted !== undefined && !mounted.has(r))
+        if (why === undefined && mounted !== undefined && !mounted.has(r) && covering === undefined)
             why = 'not_in_roster';
         if (why === undefined)
             exact.push(r);
@@ -144,32 +189,20 @@ export function sessionPolicyDeliverable(behavior, rules, opts) {
     return { deliverable: { toolDeny: exact }, withheld };
 }
 function entryReadingOf(rule) {
-    try {
-        const reading = readRuleEntry(rule, 'deny');
-        if (typeof reading !== 'object' || reading === null)
-            return 'unknown';
-        const kind = readOwnDataValue(reading, 'kind');
-        if (kind === 'row') {
-            const compiled = readOwnDataValue(reading, 'compiled');
-            return typeof compiled === 'object' && compiled !== null ? 'row' : 'unknown';
-        }
-        if (kind !== 'inert')
-            return 'unknown';
-        const reason = readOwnDataValue(reading, 'reason');
-        if (reason === 'grammar' || reason === 'content_unsupported')
-            return { why: 'not_a_tool_name', reason };
-        if (reason === 'wildcard_all' || reason === 'namespace_wildcard')
-            return { why: 'wildcard', reason };
-        return 'unknown';
-    }
-    catch {
+    const reading = denyEntryReading(rule);
+    if (reading.kind === 'row')
+        return 'row';
+    if (reading.kind === 'unknown')
         return 'unknown';
-    }
+    const reason = reading.reason;
+    return reason === 'grammar' || reason === 'content_unsupported' ? { why: 'not_a_tool_name', reason } : { why: 'wildcard', reason };
 }
-export function sessionPolicyWithheldNotice(why) {
-    return typeof why === 'string' && Object.hasOwn(WITHHELD_NOTICE, why)
-        ? WITHHELD_NOTICE[why]
-        : 'Not written to this session’s rule record.';
+export function sessionPolicyWithheldNotice(why, lang) {
+    if (typeof why === 'string' && Object.hasOwn(WITHHELD_NOTICE, why)) {
+        const sentence = WITHHELD_NOTICE[why];
+        return typeof sentence === 'string' ? sentence : renderMessage(sentence, lang);
+    }
+    return 'Not written to this session’s rule record.';
 }
 export function legacyToolNameFailureNoteOf(code) {
     return code === CONFIG_LEGACY_TOOL_NAME ? prepareRefusalNoteOf(code) : undefined;

package/dist/hitl/sessionPolicyWire.d.ts

@@ -128,14 +128,24 @@ export interface SessionPolicyInertEntryRefusal {
 export declare function tightenSessionPolicy(facade: SessionPolicyFacade, req: SessionPolicyTightenRequest, opts?: {
     signal?: AbortSignal;
 }): Promise<SessionPolicyTightenOutcome>;
-export declare function sessionPolicyTightenNotice(outcome: SessionPolicyTightenOutcome, lang?: UiLanguage): string;
+export interface SessionPolicyTightenFacts {
+    readonly agentsStartedBeforeFirstRule?: number | undefined;
+    readonly workflowsRunning?: number | undefined;
+    readonly untrackedBackgroundItems?: number | undefined;
+    readonly inFlightUnreadable?: true | undefined;
+}
+export interface SessionPolicyDeploymentFacts {
+    readonly operator?: 'present' | 'absent';
+    readonly identityAttach?: 'available' | 'unavailable';
+}
+export declare function sessionPolicyTightenNotice(outcome: SessionPolicyTightenOutcome, lang?: UiLanguage, facts?: SessionPolicyTightenFacts, deployment?: SessionPolicyDeploymentFacts): string;
 export declare function sessionPolicyReadNotice(outcome: Exclude<SessionPolicyReadOutcome, {
     kind: 'present';
 }> | {
     kind: 'no_target';
 } | {
     kind: 'not_started';
-}): string;
+}, deployment?: SessionPolicyDeploymentFacts): string;
 export interface SessionPolicyRemovedEntry {
     readonly field: 'toolDeny' | 'toolAllow';
     readonly rule: string;
@@ -178,4 +188,4 @@ export type SessionPolicyRosterRequiredWhy = 'absent' | 'unreadable';
 export declare function removeRefusedSessionRules(facade: SessionPolicyFacade, sessionId: string, roster: ToolRosterView | undefined, opts?: {
     signal?: AbortSignal;
 }): Promise<SessionPolicyRemovalOutcome>;
-export declare function sessionPolicyRemovalNotice(outcome: SessionPolicyRemovalOutcome): string;
+export declare function sessionPolicyRemovalNotice(outcome: SessionPolicyRemovalOutcome, deployment?: SessionPolicyDeploymentFacts): string;

package/dist/hitl/sessionPolicyWire.js

@@ -1,3 +1,4 @@
+import { appendOwnElement } from '../ownKey.js';
 import { wireFailureShapeOf } from '../wireFailureShape.js';
 import { hostLog } from '../host.js';
 import { msg, renderMessage } from '../i18n/translate.js';
@@ -97,7 +98,7 @@ function narrowBucket(raw, field) {
         const x = raw[i];
         if (typeof x !== 'string')
             return { ok: false, detail: `rule field "${field}" entry ${i} is not a string` };
-        list.push(x);
+        appendOwnElement(list, x);
     }
     return { ok: true, list };
 }
@@ -195,13 +196,13 @@ export function tightenedSessionRules(prior, add) {
             if (seen.has(x))
                 continue;
             seen.add(x);
-            merged.push(x);
+            appendOwnElement(merged, x);
         }
         for (const x of al ?? []) {
             if (seen.has(x))
                 continue;
             seen.add(x);
-            merged.push(x);
+            appendOwnElement(merged, x);
         }
         out[field] = merged;
     }
@@ -329,7 +330,7 @@ function earlierGrammarEntriesOf(prior, outgoing) {
         if (name === undefined || name === rule)
             continue;
         seen.add(rule);
-        out.push({ field: 'toolAllow', rule });
+        appendOwnElement(out, { field: 'toolAllow', rule });
     }
     return out;
 }
@@ -413,11 +414,67 @@ export async function tightenSessionPolicy(facade, req, opts) {
     return { kind: 'conflict', rev: second.retryAtRev };
 }
 const earlierGrammarNote = (lang) => renderMessage(msg('rules.sessionPolicy.tighten.earlierGrammar'), lang);
-export function sessionPolicyTightenNotice(outcome, lang) {
+function factSlot(facts, key) {
+    try {
+        return ownRead(facts, key);
+    }
+    catch {
+        return undefined;
+    }
+}
+function factCount(facts, key) {
+    const n = factSlot(facts, key);
+    return typeof n === 'number' && Number.isSafeInteger(n) && n >= 1 ? n : undefined;
+}
+function firstRuleWorkFactsOf(facts) {
+    const none = { agents: undefined, workflows: undefined, untracked: undefined, unreadable: false };
+    if (typeof facts !== 'object' || facts === null)
+        return none;
+    return {
+        agents: factCount(facts, 'agentsStartedBeforeFirstRule'),
+        workflows: factCount(facts, 'workflowsRunning'),
+        untracked: factCount(facts, 'untrackedBackgroundItems'),
+        unreadable: factSlot(facts, 'inFlightUnreadable') === true,
+    };
+}
+function deploymentHasNoOperator(d) {
+    try {
+        return typeof d === 'object' && d !== null && ownRead(d, 'operator') === 'absent';
+    }
+    catch {
+        return false;
+    }
+}
+function deploymentHasNoIdentity(d) {
+    try {
+        return typeof d === 'object' && d !== null && ownRead(d, 'identityAttach') === 'unavailable';
+    }
+    catch {
+        return false;
+    }
+}
+export function sessionPolicyTightenNotice(outcome, lang, facts, deployment) {
     const say = (key, params) => renderMessage(msg(key, params), lang);
     switch (outcome.kind) {
-        case 'written':
-            return say('rules.sessionPolicy.tighten.written', { rev: outcome.rev });
+        case 'written': {
+            const head = say('rules.sessionPolicy.tighten.written', { rev: outcome.rev });
+            const w = firstRuleWorkFactsOf(facts);
+            const unseen = msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.unseen');
+            if (w.unreadable)
+                return `${head} ${renderMessage(msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.unreadable'), lang)} ${renderMessage(unseen, lang)}`;
+            const parts = [];
+            if (w.agents !== undefined)
+                appendOwnElement(parts, msg(w.agents === 1 ? 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.one' : 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.agents.many', { n: w.agents }));
+            if (w.workflows !== undefined)
+                appendOwnElement(parts, msg(w.workflows === 1 ? 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.one' : 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.workflows.many', { n: w.workflows }));
+            if (w.untracked !== undefined)
+                appendOwnElement(parts, msg(w.untracked === 1 ? 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.one' : 'rules.sessionPolicy.tighten.writtenBeforeFirstRule.untracked.many', { n: w.untracked }));
+            const [p0, p1, p2] = parts;
+            if (p0 === undefined)
+                return head;
+            const list = p1 === undefined ? p0 : p2 === undefined ? msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.two', { a: p0, b: p1 }) : msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.list.three', { a: p0, b: p1, c: p2 });
+            return `${head} ${renderMessage(msg('rules.sessionPolicy.tighten.writtenBeforeFirstRule.counts', { list }), lang)} ${renderMessage(unseen, lang)}`;
+        }
         case 'conflict':
             return say('rules.sessionPolicy.tighten.conflict');
         case 'loosen_forbidden':
@@ -435,13 +492,13 @@ export function sessionPolicyTightenNotice(outcome, lang) {
                 case 'session_not_found':
                     return say('rules.sessionPolicy.tighten.unknown.sessionNotFound');
                 case 'session_ownerless':
-                    return say('rules.sessionPolicy.tighten.unknown.sessionOwnerless');
+                    return say(deploymentHasNoIdentity(deployment) ? 'rules.sessionPolicy.tighten.unknown.sessionOwnerless.noIdentity' : 'rules.sessionPolicy.tighten.unknown.sessionOwnerless');
                 case 'unauthorized':
                     return say('rules.sessionPolicy.tighten.unknown.unauthorized');
                 case 'request_rejected':
                     return say('rules.sessionPolicy.tighten.unknown.requestRejected');
                 case 'store_corrupt':
-                    return say('rules.sessionPolicy.tighten.unknown.storeCorrupt');
+                    return say(deploymentHasNoOperator(deployment) ? 'rules.sessionPolicy.tighten.unknown.storeCorrupt.noOperator' : 'rules.sessionPolicy.tighten.unknown.storeCorrupt');
                 case 'read_unreadable':
                     return say('rules.sessionPolicy.tighten.unknown.readUnreadable');
                 case 'read_failed':
@@ -460,13 +517,15 @@ export function sessionPolicyTightenNotice(outcome, lang) {
 const READ_NOTICE_GENERIC = 'This session’s rule record could not be shown, so what it holds is not known. Try reading it again.';
 const READ_NOTICE_NO_TARGET = 'There is no engine connection for this session, so its rule record cannot be read and what it holds is not known. Look again once it is connected.';
 const READ_NOTICE_NOT_STARTED = 'This session has not begun on the engine yet — nothing has been sent in it — so it has no rule record to read. Send a first message, then look again.';
-function readFailureSentence(kind) {
+function readFailureSentence(kind, deployment) {
     switch (kind) {
         case 'face-unavailable':
             return 'This deployment does not keep per-session tool rules, so there is no session rule record to read.';
         case 'loosen-forbidden':
             return 'The engine answered this read with a refusal that only applies to relaxing rules, so this session’s rule record could not be read. Try again; if it keeps happening, whoever runs the engine needs to look at it.';
         case 'store-corrupt':
+            if (deploymentHasNoOperator(deployment))
+                return renderMessage(msg('rules.sessionPolicy.deployment.noOperator.readStoreCorrupt'));
             return 'The engine could not establish which version this session’s rules are at, so it would not hand the record over. This needs an operator to look at the rule store.';
         case 'cas-conflict':
             return 'The engine reported a version clash on this session’s rule record, so it could not be read this time. Try again.';
@@ -504,7 +563,7 @@ function ownRead(o, key) {
     const d = Object.getOwnPropertyDescriptor(o, key);
     return d !== undefined && Object.hasOwn(d, 'value') ? d.value : undefined;
 }
-export function sessionPolicyReadNotice(outcome) {
+export function sessionPolicyReadNotice(outcome, deployment) {
     try {
         if (outcome === null || typeof outcome !== 'object')
             return READ_NOTICE_GENERIC;
@@ -513,7 +572,7 @@ export function sessionPolicyReadNotice(outcome) {
             const failure = ownRead(outcome, 'failure');
             if (failure === null || typeof failure !== 'object')
                 return READ_NOTICE_GENERIC;
-            return readFailureSentence(ownRead(failure, 'kind')) ?? READ_NOTICE_GENERIC;
+            return readFailureSentence(ownRead(failure, 'kind'), deployment) ?? READ_NOTICE_GENERIC;
         }
         if (arm === 'malformed')
             return readMalformedSentence(ownRead(outcome, 'why')) ?? READ_NOTICE_GENERIC;
@@ -544,20 +603,20 @@ function withoutRefusedEntries(prior, mounted) {
         const seen = new Set();
         for (const x of list) {
             if (mounted.has(x)) {
-                kept.push(x);
+                appendOwnElement(kept, x);
                 continue;
             }
             const kind = ruleToolNameVerdictOf(x).kind;
             if (kind === 'unknown')
                 return 'judge_failed';
             if (kind === 'current') {
-                kept.push(x);
+                appendOwnElement(kept, x);
                 continue;
             }
             if (seen.has(x))
                 continue;
             seen.add(x);
-            removed.push({ field, rule: x });
+            appendOwnElement(removed, { field, rule: x });
         }
         next[field] = kept;
     }
@@ -656,7 +715,7 @@ export async function removeRefusedSessionRules(facade, sessionId, roster, opts)
         return second.done;
     return { kind: 'conflict', rev: second.retryAtRev };
 }
-export function sessionPolicyRemovalNotice(outcome) {
+export function sessionPolicyRemovalNotice(outcome, deployment) {
     const generic = 'The session’s rule record may not have changed — re-read it before doing anything else.';
     if (outcome === null || typeof outcome !== 'object')
         return generic;
@@ -683,6 +742,8 @@ export function sessionPolicyRemovalNotice(outcome) {
         case 'judge_failed':
             return 'Nothing was changed: this client could not check which entries in this session’s rule record name a tool the engine refuses (its copy of the engine’s tool-name check is unavailable or gave no clear answer), so it removed none rather than guess. Removing them needs that check available in this client.';
         case 'loosen_forbidden':
+            if (deploymentHasNoOperator(deployment))
+                return renderMessage(msg('rules.sessionPolicy.deployment.noOperator.removeLoosenForbidden'));
             return 'The engine refused to take these entries out of this session’s rule record: on this engine only an operator can remove entries from it, so the record is unchanged. Ask an operator to remove them, or continue in a new session.';
         case 'conflict':
             return 'This session’s rule record was changed by someone else while the refused entries were being removed, twice in a row — nothing was changed. Try again once the other change has finished.';
@@ -697,6 +758,8 @@ export function sessionPolicyRemovalNotice(outcome) {
                 case 'unauthorized':
                     return 'This call could not present a verifiable identity, so nothing was changed.';
                 case 'store_corrupt':
+                    if (deploymentHasNoOperator(deployment))
+                        return renderMessage(msg('rules.sessionPolicy.deployment.noOperator.removeReadStoreCorrupt'));
                     return 'The engine could not establish which version this session’s rules are at, so nothing was changed. This needs an operator to look at the rule store.';
                 case 'read_unreadable':
                     return 'The session’s current rules could not be read, so nothing was changed — rewriting a record that cannot be read could replace real restrictions.';
@@ -706,6 +769,8 @@ export function sessionPolicyRemovalNotice(outcome) {
         case 'write_refused':
             switch (outcome.why) {
                 case 'store_corrupt':
+                    if (deploymentHasNoOperator(deployment))
+                        return renderMessage(msg('rules.sessionPolicy.deployment.noOperator.removeWriteStoreCorrupt'));
                     return 'The engine could not establish which version this session’s rules are at and refused to stamp a new one, so nothing was changed. This needs an operator to look at the rule store.';
                 case 'session_not_found':
                     return 'This session is not writable from here — it may not exist, or it may belong to someone else (the engine answers both the same way, so this client cannot tell which); nothing was changed.';

package/dist/hitl/standingRows.js

@@ -8,7 +8,7 @@ const UNREADABLE = Symbol('unreadable');
 function ownData(v, key) {
     try {
         const d = Object.getOwnPropertyDescriptor(v, key);
-        return d !== undefined && 'value' in d ? d.value : undefined;
+        return d !== undefined && Object.hasOwn(d, 'value') ? d.value : undefined;
     }
     catch {
         return undefined;

package/dist/hitl/toolApprovalWire.d.ts

@@ -1,4 +1,5 @@
 import { type HitlClientLike, type DecideOperationObserver } from './hitlBridge.js';
+import { readApprovalCardWord, type ApprovalCardWord } from './approvalCardReading.js';
 import { type ApprovalAllowRuleShadow } from './allowRuleShadow.js';
 import type { UiLanguage } from '../env/uiLanguage.js';
 import type { SessionRuleInertReason } from './sessionPolicyWire.js';
@@ -8,13 +9,15 @@ import { type ApprovalMandateWord } from '../gateVocabulary.js';
 import type { ToolPermissionRequest } from '../seatContract.js';
 import { type ApprovalDecidedByReading } from '../approvalDecidedByCapability.js';
 import { RULE_OFFER_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, RULE_OFFER_UNCOVERED_REASONS, RULE_OFFERS_ABSENCE_REASONS } from '@sema-agent/sdk';
-import type { ApprovalDecidedBy, ToolApprovalDecision as SdkToolApprovalDecision, ToolApprovalRespondAck, ToolApprovalRespondReplayed, PersistedRuleAnchor, RuleOfferMatch, RuleOfferBatchMember, RuleOfferUncoveredDetail, RuleOfferUncoveredReason, AskOrigin, RuleOffersAbsence, DenialLimitKind, DenialLimitFallback, ToolApprovalFrame, RuleOffer as SdkRuleOffer, ToolApprovalCardWord } from '@sema-agent/sdk';
+import type { ApprovalDecidedBy, ApprovalCardDelegation, ToolApprovalDecision as SdkToolApprovalDecision, ToolApprovalRespondAck, ToolApprovalRespondReplayed, PersistedRuleAnchor, RuleOfferMatch, RuleOfferBatchMember, RuleOfferUncoveredDetail, RuleOfferUncoveredReason, AskOrigin, RuleOffersAbsence, DenialLimitKind, DenialLimitFallback, ToolApprovalFrame, RuleOffer as SdkRuleOffer } from '@sema-agent/sdk';
 export declare function toolNameIsFsWrite(name: string): boolean;
 export declare function toolNameIsShellExec(name: string): boolean;
-export declare function isToolApprovalGate(gate: {
+export interface ToolApprovalGateLike {
     kind?: unknown;
     toolName?: unknown;
-} | undefined | null): boolean;
+    approvalCard?: string | undefined;
+}
+export declare function isToolApprovalGate(gate: ToolApprovalGateLike | undefined | null): boolean;
 export interface FsApprovalWireDeps {
     client: HitlClientLike;
     onPresented?: () => void;
@@ -106,7 +109,7 @@ export interface ApprovalCardRequest {
     mandate?: ApprovalMandateWord;
     denialLimitFallback?: DenialLimitFallback;
     origin?: string;
-    approvalCard?: ToolApprovalCardWord;
+    approvalCard?: ApprovalCardWord;
     askClass?: string;
     classes?: readonly string[];
     boundGrants?: BoundSkillGrantsWire;
@@ -162,11 +165,7 @@ export interface ReadRootCandidateView {
     clearsThisAsk: true;
     covers?: 'exact';
 }
-export interface ToolApprovalDelegation {
-    parentToolCallId: string;
-    depth: number;
-    agentName?: string;
-}
+export type ToolApprovalDelegation = ApprovalCardDelegation;
 export declare const TOOL_APPROVAL_FRAME_KEYS_MIRROR: readonly ["type", "approvalId", "toolCallId", "toolName", "sourceTaskId", "fromSubagent", "sourceAgentName", "message", "args", "argsOmitted", "governanceForced", "ruleOffers", "ruleOffersAbsence", "denialLimitFallback", "readRootCandidate", "mandated", "mandate", "origin", "approvalCard", "askClass", "classes", "inputHasBidi", "parked", "persistedRuleShadowed", "allowRuleShadowed", "probeCause", "probeReason", "rememberRefused", "boundGrantDigest", "boundGrantAbsence", "boundGrants", "classifierNoRuling", "ruleEvidence", "requiresRealApproval", "expiresInMs", "expiresAtMs", "serverNowMs", "delegation", "outcome", "cause"];
 export interface ApprovalMandatedFacts {
     readonly mandated?: true;
@@ -177,7 +176,7 @@ export declare function approvalIsMandated(v: ApprovalMandatedFacts | undefined
 export declare function readApprovalMandate(v: {
     readonly mandate?: string;
 } | undefined | null): ApprovalMandateWord | undefined;
-export declare function readApprovalCardWord(carrier: unknown): ToolApprovalCardWord | undefined;
+export { readApprovalCardWord };
 export declare function toolPermissionRequestAskBits(card: object | null | undefined, requestId?: string): Pick<ToolPermissionRequest, 'mandated' | 'mandate' | 'origin' | 'ruleOffersAbsence' | 'askClass' | 'classes' | 'sessionRow'>;
 export declare function isFromSubagent(frame: ToolApprovalFrame): boolean;
 export type ToolApprovalRespondDecision = SdkToolApprovalDecision;