@sema-agent/client-core 0.100.0 → 0.102.0

package/dist/resultFrameKeys.d.ts

@@ -2,3 +2,4 @@ export declare function resultErrorCodeOf(frame: unknown): string | undefined;
 export declare function resultSelectedModelOf(frame: unknown): string | undefined;
 export declare function resultSalvagedResultOf(frame: unknown): string | undefined;
 export declare function resultParkFailedReasonOf(frame: unknown): string | undefined;
+export declare function resultErrorCodeInTextOf(frame: object | null | undefined): true | undefined;

package/dist/resultFrameKeys.js

@@ -1,4 +1,4 @@
-import { readFrameStringKey } from './ownKey.js';
+import { readFrameStringKey, readFrameTrueMark } from './ownKey.js';
 export function resultErrorCodeOf(frame) {
     return readFrameStringKey(frame, '_sema_error_code');
 }
@@ -11,3 +11,6 @@ export function resultSalvagedResultOf(frame) {
 export function resultParkFailedReasonOf(frame) {
     return readFrameStringKey(frame, '_sema_park_failed_reason');
 }
+export function resultErrorCodeInTextOf(frame) {
+    return readFrameTrueMark(frame, '_sema_error_code_in_text') ? true : undefined;
+}

package/dist/retryStatus.d.ts

@@ -1,3 +1,4 @@
+import type { UiLanguage } from './env/uiLanguage.js';
 export type RetryStatus = {
     kind: 'stalled';
     deadline: number;
@@ -134,4 +135,11 @@ export interface ApiErrorNoticeCtx {
 }
 export declare function apiErrorFactsOfRow(row: ApiErrorRowLike | null | undefined): ApiErrorRowFacts;
 export declare function apiErrorNotice(facts: ApiErrorRowFacts | null | undefined, ctx?: ApiErrorNoticeCtx): ApiErrorNotice | undefined;
+export type ResultWayOutWord = NonNullable<ApiErrorNotice['recourse']>;
+export interface ResultWayOut {
+    readonly word: ResultWayOutWord;
+    readonly keySource?: string;
+}
+export declare function resultWayOutOf(frame: object | null | undefined): ResultWayOut | undefined;
+export declare function wayOutSentence(wayOut: ResultWayOut | null | undefined, lang?: UiLanguage): string | undefined;
 export {};

package/dist/retryStatus.js

@@ -1,6 +1,7 @@
 import { displayUntrusted } from './displayUntrusted.js';
 import { guardedRead, readOwnDataFiniteNumber, readOwnDataNonEmptyString, readOwnDataValue } from './ownKey.js';
 import { msg, renderMessage } from './i18n/translate.js';
+import { conditionRecourseOf, isHttpStatus, isServiceSideStatus, terminalRecourseOf } from './providerRejection.js';
 export const BRAIN_STATUS_PHASES = [
     'rate_limited',
     'retrying',
@@ -122,10 +123,10 @@ export function retryStatusFromArm(arm, nowMs) {
 }
 const WAIT_SWITCH_FRACTION = 0.5;
 const CONDITION_READINGS = Object.freeze({
-    quota_exhausted: { clause: 'this account cannot be served by the model service until someone acts or its usage window resets', recourse: 'switch_model' },
-    throttled: { clause: 'the model service is rate limiting requests, which clears on its own', recourse: 'switch_model' },
-    overloaded: { clause: 'the model service is overloaded', recourse: 'switch_model' },
-    stop_other: { clause: 'the model service refused this request', resendNote: 'resending will not change it', recourse: 'fix_request' },
+    quota_exhausted: { clause: 'this account cannot be served by the model service until someone acts or its usage window resets' },
+    throttled: { clause: 'the model service is rate limiting requests, which clears on its own' },
+    overloaded: { clause: 'the model service is overloaded' },
+    stop_other: { clause: 'the model service refused this request', resendNote: 'resending will not change it' },
     unknown: null,
 });
 function conditionReadingOf(word) {
@@ -152,7 +153,7 @@ function noticeCount(n) {
     return n !== undefined && Number.isInteger(n) && n >= 1 ? n : undefined;
 }
 function noticeHttp(n) {
-    return n !== undefined && Number.isInteger(n) && n >= 100 && n <= 999 ? n : undefined;
+    return isHttpStatus(n) ? n : undefined;
 }
 function spanText(ms) {
     const total = Math.floor(ms / 1000);
@@ -216,7 +217,8 @@ export function retryStatusParts(status, ctx) {
         return sealParts({ phase: 'waiting_first_token', model, elapsedMs: elapsed, timeoutMs: ceiling, recourse: offerSwitch ? 'switch_model' : 'wait' });
     }
     const terminal = kind === 'error' && noticeValue(status, 'terminal') === true;
-    const reading = conditionReadingOf(noticeText(status, 'providerCondition'));
+    const conditionWord = noticeText(status, 'providerCondition');
+    const reading = conditionReadingOf(conditionWord);
     const http = noticeHttp(noticeNumber(status, 'errorStatus'));
     const attempt = noticeCount(noticeNumber(status, 'attempt'));
     const maxRetries = noticeCount(noticeNumber(status, 'maxRetries'));
@@ -224,12 +226,12 @@ export function retryStatusParts(status, ctx) {
     const note = washedText(engineWords);
     const source = reading === undefined ? undefined : sourcePhraseOf(noticeText(status, 'providerConditionSource'));
     const condition = reading === undefined ? undefined : `${reading.clause.charAt(0).toUpperCase()}${reading.clause.slice(1)}`;
-    const serviceSide = http !== undefined && (http === 429 || (http >= 500 && http <= 599));
+    const serviceSide = http !== undefined && isServiceSideStatus(http);
     const knownArm = armWord === 'stalled' || armWord === 'error';
     const recourse = !knownArm
         ? undefined
         : reading !== undefined
-            ? reading.recourse
+            ? conditionRecourseOf(conditionWord)
             : serviceSide
                 ? 'switch_model'
                 : !terminal
@@ -312,6 +314,52 @@ export function apiErrorNotice(facts, ctx) {
     };
     const modelName = noticeText(ctx, 'modelName');
     const notice = retryStatusNotice(terminal, modelName !== undefined ? { modelName } : undefined);
-    const recourse = status === 401 || status === 403 ? 'check_credentials' : notice.recourse;
+    const recourse = terminalRecourseOf(status, providerCondition);
     return Object.freeze(recourse === undefined ? { line: notice.line } : { line: notice.line, recourse });
 }
+const RESULT_WAY_OUT_WORDS = Object.freeze(['check_credentials', 'switch_model', 'wait', 'fix_request']);
+const _wayOutWordPins = [true, true];
+void _wayOutWordPins;
+const KEY_SOURCE_DISPLAY_MAX = 60;
+const WAY_OUT_SENTENCE_KEYS = Object.freeze({
+    check_credentials: 'notice.wayOut.checkCredentials',
+    switch_model: 'notice.wayOut.switchModel',
+    wait: 'notice.wayOut.wait',
+    fix_request: 'notice.wayOut.fixRequest',
+});
+function isResultWayOutWord(v) {
+    return typeof v === 'string' && RESULT_WAY_OUT_WORDS.includes(v);
+}
+export function resultWayOutOf(frame) {
+    try {
+        const raw = guardedRead(() => readOwnDataValue(frame, '_sema_wayOut'));
+        if (typeof raw !== 'object' || raw === null || Array.isArray(raw))
+            return undefined;
+        const word = guardedRead(() => readOwnDataNonEmptyString(raw, 'word'));
+        if (!isResultWayOutWord(word))
+            return undefined;
+        const keySource = guardedRead(() => readOwnDataNonEmptyString(raw, 'keySource'));
+        return Object.freeze(keySource === undefined ? { word } : { word, keySource });
+    }
+    catch {
+        return undefined;
+    }
+}
+export function wayOutSentence(wayOut, lang) {
+    try {
+        if (typeof wayOut !== 'object' || wayOut === null)
+            return undefined;
+        const word = readOwnDataNonEmptyString(wayOut, 'word');
+        if (!isResultWayOutWord(word))
+            return undefined;
+        if (word === 'check_credentials') {
+            const keySource = readOwnDataNonEmptyString(wayOut, 'keySource');
+            if (keySource !== undefined)
+                return renderMessage(msg('notice.wayOut.checkCredentialsFrom', { source: displayUntrusted(keySource, { max: KEY_SOURCE_DISPLAY_MAX }) }), lang);
+        }
+        return renderMessage(msg(WAY_OUT_SENTENCE_KEYS[word]), lang);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/rewindArchiveCapability.js

@@ -1,8 +1,8 @@
-import { engineWireTarget } from './engineWireTarget.js';
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
 import { rewindArchiveReadingAt, rewindConversationAvailability, } from './rewindArchiveReading.js';
 import { unreadableReadingDetail } from './engineCapReader.js';
 export { projectRewindArchiveCapability, rewindConversationAvailability } from './rewindArchiveReading.js';
-export function observedRewindArchive(baseUrl = engineWireTarget()?.baseUrl) {
+export function observedRewindArchive(baseUrl = engineWireTargetBaseUrl()) {
     return rewindArchiveReadingAt(baseUrl);
 }
 export function rewindCodeArchiveAvailability(reading, mode) {

package/dist/rewindEngineAction.d.ts

@@ -1,3 +1,4 @@
+import type { UiLanguage } from './env/uiLanguage.js';
 import { type RewindArchiveReading } from './rewindArchiveCapability.js';
 import { type RewindMode, type SeamRewindSpec } from './rewindWireCaps.js';
 export type RewindRestoreOption = RewindMode | 'summarize' | 'summarize_up_to' | 'nevermind';
@@ -19,3 +20,4 @@ export type RewindEngineAction = {
 };
 export declare function decideRewindEngineAction(option: RewindRestoreOption, resolved: RewindTargetResolution, reading?: RewindArchiveReading): RewindEngineAction;
 export declare function previewEngineRewind(option: RewindRestoreOption, resolved: RewindTargetResolution, reading?: RewindArchiveReading): RewindEngineAction['kind'];
+export declare function rewindConversationOnlyNotice(option: RewindRestoreOption, action: RewindEngineAction | null | undefined, lang?: UiLanguage, reading?: RewindArchiveReading): string | undefined;

package/dist/rewindEngineAction.js

@@ -1,4 +1,5 @@
-import { observedRewindArchive } from './rewindArchiveCapability.js';
+import { msg, renderMessage } from './i18n/translate.js';
+import { engineRewindRefusedNow, observedRewindArchive } from './rewindArchiveCapability.js';
 import { REWIND_MODES, rewindSpecForMode } from './rewindWireCaps.js';
 import { readOwnDataNonEmptyString, readOwnDataValue } from './ownKey.js';
 function modeOfOption(option) {
@@ -34,3 +35,24 @@ export function decideRewindEngineAction(option, resolved, reading = observedRew
 export function previewEngineRewind(option, resolved, reading = observedRewindArchive()) {
     return decideRewindEngineAction(option, resolved, reading).kind;
 }
+const UNOBSERVED_READING = { kind: 'unobserved' };
+export function rewindConversationOnlyNotice(option, action, lang, reading = observedRewindArchive()) {
+    try {
+        const mode = modeOfOption(option);
+        if (mode === undefined || rewindSpecForMode(mode, 'x', UNOBSERVED_READING).restoreFiles !== true)
+            return undefined;
+        if (typeof action !== 'object' || action === null || readOwnDataValue(action, 'kind') !== 'arm')
+            return undefined;
+        const spec = readOwnDataValue(action, 'spec');
+        if (typeof spec !== 'object' || spec === null)
+            return undefined;
+        if (readOwnDataValue(spec, 'restoreFiles') === true)
+            return undefined;
+        const codeOnlyMode = REWIND_MODES.find((m) => !carriesResumeAt(m));
+        const codeRouteDeadEnd = codeOnlyMode !== undefined && engineRewindRefusedNow(codeOnlyMode, reading);
+        return renderMessage(msg(codeRouteDeadEnd ? 'session.rewind.conversationOnly.noCodeRoute' : 'session.rewind.conversationOnly.withCodeRoute'), lang);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/rowKind.d.ts

@@ -0,0 +1,36 @@
+export declare const RUN_STOPPED_MESSAGE_PREFIX = "Run stopped";
+export declare const RUN_BLOCKED_MESSAGE_PREFIX = "Run blocked";
+export declare const PROMPT_BLOCKED_BY_HOOK_ROW_LEAD = "UserPromptSubmit operation blocked by hook";
+export declare const MODEL_OUTPUT_ERROR_PREFIX = "Model output error";
+export declare const OUTCOME_UNKNOWN_ROW_PREFIX = "Outcome unknown";
+export declare const SESSION_BUSY_ROW_LEAD = "This session is locked by an earlier run";
+export declare const SEMA_ROW_KIND_KEY = "_sema_row_kind";
+export declare const SEMA_ROW_KINDS: readonly [Readonly<{
+    kind: "api_error";
+    owner: "client-core";
+}>, Readonly<{
+    kind: "governance_stop";
+    owner: "client-core";
+}>, Readonly<{
+    kind: "model_output_error";
+    owner: "client-core";
+}>, Readonly<{
+    kind: "outcome_unknown";
+    owner: "client-core";
+}>, Readonly<{
+    kind: "session_busy";
+    owner: "client-core";
+}>, Readonly<{
+    kind: "engine_link";
+    owner: "client-core";
+}>];
+export type SemaRowKind = (typeof SEMA_ROW_KINDS)[number]['kind'];
+export declare function rowKindOf(m: object | null | undefined): SemaRowKind | undefined;
+export declare function rowKindOf<H extends string>(m: object | null | undefined, opts: {
+    readonly hostKinds: readonly H[];
+}): SemaRowKind | H | undefined;
+export declare function isSyntheticRow(m: object | null | undefined): boolean;
+export declare function legacyRowKindOfText(text: string): SemaRowKind | undefined;
+export declare function inferLegacyRowKind(m: object | null | undefined, opts?: {
+    readonly requireFlag?: boolean;
+}): SemaRowKind | undefined;

package/dist/rowKind.js

@@ -0,0 +1,97 @@
+import { guardedRead, readOwnDataValue } from './ownKey.js';
+export const RUN_STOPPED_MESSAGE_PREFIX = 'Run stopped';
+export const RUN_BLOCKED_MESSAGE_PREFIX = 'Run blocked';
+export const PROMPT_BLOCKED_BY_HOOK_ROW_LEAD = 'UserPromptSubmit operation blocked by hook';
+export const MODEL_OUTPUT_ERROR_PREFIX = 'Model output error';
+export const OUTCOME_UNKNOWN_ROW_PREFIX = 'Outcome unknown';
+export const SESSION_BUSY_ROW_LEAD = 'This session is locked by an earlier run';
+const API_ERROR_ROW_PREFIX = 'API Error';
+const LOGIN_API_ERROR_ROW_PREFIX = `Please run /login · ${API_ERROR_ROW_PREFIX}`;
+export const SEMA_ROW_KIND_KEY = '_sema_row_kind';
+export const SEMA_ROW_KINDS = Object.freeze([
+    Object.freeze({ kind: 'api_error', owner: 'client-core' }),
+    Object.freeze({ kind: 'governance_stop', owner: 'client-core' }),
+    Object.freeze({ kind: 'model_output_error', owner: 'client-core' }),
+    Object.freeze({ kind: 'outcome_unknown', owner: 'client-core' }),
+    Object.freeze({ kind: 'session_busy', owner: 'client-core' }),
+    Object.freeze({ kind: 'engine_link', owner: 'client-core' }),
+]);
+const KIND_WORDS = new Set(SEMA_ROW_KINDS.map((e) => e.kind));
+const ownData = (o, key) => guardedRead(() => readOwnDataValue(o, key));
+export function rowKindOf(m, opts) {
+    const v = ownData(m, SEMA_ROW_KIND_KEY);
+    if (typeof v !== 'string' || v.length === 0)
+        return undefined;
+    if (KIND_WORDS.has(v))
+        return v;
+    const hostKinds = opts === undefined ? undefined : ownData(opts, 'hostKinds');
+    if (Array.isArray(hostKinds)) {
+        try {
+            if (hostKinds.includes(v))
+                return v;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+function hasSyntheticFlag(m) {
+    return ownData(m, '_sema_api_error_message') === true || ownData(m, 'isApiErrorMessage') === true;
+}
+export function isSyntheticRow(m) {
+    const v = ownData(m, SEMA_ROW_KIND_KEY);
+    if (typeof v === 'string' && v.length > 0)
+        return true;
+    return hasSyntheticFlag(m);
+}
+export function legacyRowKindOfText(text) {
+    const t = text.trimStart();
+    if (t.startsWith(API_ERROR_ROW_PREFIX) || t.startsWith(LOGIN_API_ERROR_ROW_PREFIX))
+        return 'api_error';
+    if (t.startsWith(`${RUN_STOPPED_MESSAGE_PREFIX}:`) || t.startsWith(RUN_BLOCKED_MESSAGE_PREFIX) || t.startsWith(PROMPT_BLOCKED_BY_HOOK_ROW_LEAD))
+        return 'governance_stop';
+    if (t.startsWith(`${MODEL_OUTPUT_ERROR_PREFIX}:`))
+        return 'model_output_error';
+    if (t.startsWith(`${OUTCOME_UNKNOWN_ROW_PREFIX}:`))
+        return 'outcome_unknown';
+    if (t.startsWith(SESSION_BUSY_ROW_LEAD))
+        return 'session_busy';
+    return undefined;
+}
+function singleTextOf(m) {
+    if (ownData(m, 'type') !== 'assistant')
+        return undefined;
+    const envelope = ownData(m, 'message');
+    if (typeof envelope !== 'object' || envelope === null)
+        return undefined;
+    const content = ownData(envelope, 'content');
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content))
+        return undefined;
+    try {
+        if (content.length !== 1)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    const block = ownData(content, '0');
+    if (ownData(block, 'type') !== 'text')
+        return undefined;
+    const text = ownData(block, 'text');
+    return typeof text === 'string' ? text : undefined;
+}
+export function inferLegacyRowKind(m, opts) {
+    const present = rowKindOf(m);
+    if (present !== undefined)
+        return present;
+    if (ownData(m, SEMA_ROW_KIND_KEY) !== undefined)
+        return undefined;
+    const requireFlag = opts === undefined ? true : ownData(opts, 'requireFlag') !== false;
+    if (requireFlag && !hasSyntheticFlag(m))
+        return undefined;
+    const text = singleTextOf(m);
+    return text === undefined ? undefined : legacyRowKindOfText(text);
+}

package/dist/ruleCompileVerdict.d.ts

@@ -8,3 +8,21 @@ export type RuleCompileVerdict = {
     readonly kind: 'unknown';
 };
 export declare function ruleCompileVerdict(rule: string, behavior: 'deny' | 'ask'): RuleCompileVerdict;
+export interface RuleCompilePathBases {
+    readonly cwd?: string;
+    readonly root?: string;
+    readonly home?: string;
+}
+export declare function ruleCompileVerdictUnder(rule: string, behavior: 'deny' | 'ask', pathBases: RuleCompilePathBases): RuleCompileVerdict;
+export type DenyEntryInertReason = 'grammar' | 'content_unsupported' | 'wildcard_all' | 'namespace_wildcard';
+export type DenyEntryReading = {
+    readonly kind: 'row';
+} | {
+    readonly kind: 'inert';
+    readonly reason: DenyEntryInertReason;
+} | {
+    readonly kind: 'unknown';
+};
+export declare function denyEntryReading(rule: string): DenyEntryReading;
+export declare const DOMAIN_TIGHTEN_HONORED_FROM = "7.135.0";
+export declare function tightenEntryNeverMatches(rule: string, serverVersion: string | undefined): boolean;

package/dist/ruleCompileVerdict.js

@@ -1,4 +1,6 @@
-import { validatePermissionRules } from './coreValuePorts.js';
+import { readRuleEntry, validatePermissionRules } from './coreValuePorts.js';
+import { guardedRead, readOwnDataValue } from './ownKey.js';
+import { engineVersionTier } from './supportFloor.js';
 const RULE_COMPILE_ROOT = '/';
 function issueText(issue, key) {
     try {
@@ -20,9 +22,21 @@ function firstIssue(issues) {
     }
 }
 export function ruleCompileVerdict(rule, behavior) {
+    return compileUnder(rule, behavior, { root: RULE_COMPILE_ROOT });
+}
+export function ruleCompileVerdictUnder(rule, behavior, pathBases) {
+    const given = {};
+    for (const base of ['cwd', 'root', 'home']) {
+        const v = guardedRead(() => readOwnDataValue(pathBases, base));
+        if (typeof v === 'string')
+            given[base] = v;
+    }
+    return compileUnder(rule, behavior, given);
+}
+function compileUnder(rule, behavior, pathBases) {
     let issues;
     try {
-        issues = validatePermissionRules([{ rule, behavior }], { pathBases: { root: RULE_COMPILE_ROOT } });
+        issues = validatePermissionRules([{ rule, behavior }], { pathBases });
         if (!Array.isArray(issues))
             return { kind: 'unknown' };
         if (issues.length === 0)
@@ -36,3 +50,54 @@ export function ruleCompileVerdict(rule, behavior) {
     const message = issueText(issue, 'message');
     return { kind: 'refused', ...(code !== undefined ? { code } : {}), ...(message !== undefined ? { message } : {}) };
 }
+export function denyEntryReading(rule) {
+    try {
+        const reading = readRuleEntry(rule, 'deny');
+        if (typeof reading !== 'object' || reading === null)
+            return { kind: 'unknown' };
+        const kind = readOwnDataValue(reading, 'kind');
+        if (kind === 'row') {
+            const compiled = readOwnDataValue(reading, 'compiled');
+            return typeof compiled === 'object' && compiled !== null ? { kind: 'row' } : { kind: 'unknown' };
+        }
+        if (kind !== 'inert')
+            return { kind: 'unknown' };
+        const reason = readOwnDataValue(reading, 'reason');
+        if (reason === 'grammar' || reason === 'content_unsupported' || reason === 'wildcard_all' || reason === 'namespace_wildcard')
+            return { kind: 'inert', reason };
+        return { kind: 'unknown' };
+    }
+    catch {
+        return { kind: 'unknown' };
+    }
+}
+function readsAsDomainSpelling(rule) {
+    try {
+        const reading = readRuleEntry(rule, 'allow');
+        if (typeof reading !== 'object' || reading === null)
+            return false;
+        if (readOwnDataValue(reading, 'kind') !== 'row')
+            return false;
+        const compiled = readOwnDataValue(reading, 'compiled');
+        if (typeof compiled !== 'object' || compiled === null)
+            return false;
+        return readOwnDataValue(compiled, 'kind') === 'domain';
+    }
+    catch {
+        return false;
+    }
+}
+export const DOMAIN_TIGHTEN_HONORED_FROM = '7.135.0';
+function targetLeavesDomainTightenInert(serverVersion) {
+    return engineVersionTier(serverVersion) === 'engine' && engineVersionTier(serverVersion, DOMAIN_TIGHTEN_HONORED_FROM) === 'legacy';
+}
+export function tightenEntryNeverMatches(rule, serverVersion) {
+    if (!targetLeavesDomainTightenInert(serverVersion))
+        return false;
+    const r = denyEntryReading(rule);
+    if (r.kind !== 'inert' || r.reason !== 'content_unsupported')
+        return false;
+    if (!readsAsDomainSpelling(rule))
+        return false;
+    return ruleCompileVerdict(rule, 'deny').kind === 'compiles';
+}

package/dist/ruleReadings.d.ts

@@ -0,0 +1,58 @@
+import type { UiLanguage } from './env/uiLanguage.js';
+import { type PermissionsDeclarationInput, type PermissionsKeptReason, type WireRuleOrigin } from './permissionsDeclaration.js';
+import type { PermissionsAllowGrantReading } from './permissionsAllowGrantCapability.js';
+import { type RuleCompileVerdict } from './ruleCompileVerdict.js';
+import type { ToolRosterView } from './toolRoster.js';
+export interface RuleReadingBases {
+    readonly cwd?: string;
+    readonly root?: string;
+    readonly home?: string;
+}
+export interface RuleReadingFacts {
+    readonly bases?: RuleReadingBases;
+    readonly roster?: ToolRosterView | null;
+}
+export interface RuleReadingEntryRow {
+    readonly kind: 'row';
+    readonly grammar: string;
+}
+export interface RuleReadingEntryInert {
+    readonly kind: 'inert';
+    readonly reason: string;
+    readonly verdict?: string;
+    readonly currentName?: string;
+    readonly currentNameShown?: string;
+}
+export interface RuleReadingEntryUnread {
+    readonly kind: 'unread';
+}
+export type RuleReadingEntry = RuleReadingEntryRow | RuleReadingEntryInert | RuleReadingEntryUnread;
+export type PermissionsRuleCompileReading = RuleCompileVerdict;
+export interface PermissionsRuleWireSent {
+    readonly sent: true;
+    readonly as: string;
+}
+export interface PermissionsRuleWireKept {
+    readonly sent: false;
+    readonly reason: PermissionsKeptReason;
+    readonly code?: string;
+    readonly message?: string;
+}
+export type PermissionsRuleWire = PermissionsRuleWireSent | PermissionsRuleWireKept;
+export interface PermissionsRuleReading {
+    readonly rule: string;
+    readonly list: 'deny' | 'cliDeny' | 'ask' | 'allow';
+    readonly bucket: 'deny' | 'ask' | 'allow';
+    readonly origin?: WireRuleOrigin;
+    readonly wire: PermissionsRuleWire;
+    readonly entry: RuleReadingEntry;
+    readonly compile?: PermissionsRuleCompileReading;
+}
+export type RuleReadingEntryMode = 'with_roster' | 'grammar_only' | 'unavailable';
+export interface PermissionsRuleReadings {
+    readonly rules: readonly PermissionsRuleReading[];
+    readonly entryMode: RuleReadingEntryMode;
+}
+export declare function ruleReadingsOf(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading, facts?: RuleReadingFacts | null): PermissionsRuleReadings;
+export type RuleNearMissRow = Pick<PermissionsRuleReading, 'rule' | 'wire' | 'entry'>;
+export declare function ruleNearMissSentence(rows: readonly RuleNearMissRow[], lang?: UiLanguage): string | undefined;

package/dist/ruleReadings.js

@@ -0,0 +1,132 @@
+import { displayUntrusted } from './displayUntrusted.js';
+import { capForDisplay } from './fleetTaskDesc.js';
+import { hasCoreValuePort, readRuleEntry } from './coreValuePorts.js';
+import { msg, renderMessage } from './i18n/translate.js';
+import { guardedRead, readOwnDataValue } from './ownKey.js';
+import { assembledRuleRows } from './permissionsDeclaration.js';
+import { ruleCompileVerdictUnder } from './ruleCompileVerdict.js';
+import { rosterMountedNames } from './rosterMountedNames.js';
+const unread = () => Object.freeze({ kind: 'unread' });
+function text(v) {
+    return typeof v === 'string' && v !== '' ? v : undefined;
+}
+function entryOf(rule, direction, roster) {
+    try {
+        const reading = readRuleEntry(rule, direction, roster);
+        if (typeof reading !== 'object' || reading === null)
+            return unread();
+        const kind = readOwnDataValue(reading, 'kind');
+        if (kind === 'row') {
+            const compiled = readOwnDataValue(reading, 'compiled');
+            if (typeof compiled !== 'object' || compiled === null)
+                return unread();
+            const grammar = text(readOwnDataValue(compiled, 'kind'));
+            return grammar === undefined ? unread() : Object.freeze({ kind: 'row', grammar });
+        }
+        if (kind !== 'inert')
+            return unread();
+        const reason = text(readOwnDataValue(reading, 'reason'));
+        if (reason === undefined)
+            return unread();
+        const verdict = text(readOwnDataValue(reading, 'verdict'));
+        const currentName = text(readOwnDataValue(reading, 'currentName'));
+        return Object.freeze({
+            kind: 'inert',
+            reason,
+            ...(verdict !== undefined ? { verdict } : {}),
+            ...(currentName !== undefined ? { currentName, currentNameShown: displayUntrusted(currentName) } : {}),
+        });
+    }
+    catch {
+        return unread();
+    }
+}
+function factsOf(facts) {
+    if (typeof facts !== 'object' || facts === null)
+        return { bases: undefined, roster: undefined };
+    const bases = guardedRead(() => readOwnDataValue(facts, 'bases'));
+    const roster = guardedRead(() => readOwnDataValue(facts, 'roster'));
+    return {
+        bases: typeof bases === 'object' && bases !== null ? bases : undefined,
+        roster: (roster ?? undefined),
+    };
+}
+export function ruleReadingsOf(input, caps, facts) {
+    const rows = assembledRuleRows(input, caps);
+    const { bases, roster: rosterView } = factsOf(facts);
+    const readerInstalled = hasCoreValuePort('readRuleEntry');
+    const mounted = readerInstalled ? rosterMountedNames(rosterView) : 'absent';
+    const roster = typeof mounted === 'object' ? mounted : undefined;
+    const rules = rows.map((r) => {
+        const wire = r.fate.sent
+            ? Object.freeze({ sent: true, as: r.fate.wire })
+            : Object.freeze({
+                sent: false,
+                reason: r.fate.reason,
+                ...(r.fate.code !== undefined ? { code: r.fate.code } : {}),
+                ...(r.fate.message !== undefined ? { message: r.fate.message } : {}),
+            });
+        const entry = readerInstalled ? entryOf(r.rule, r.bucket === 'allow' ? 'allow' : 'deny', roster) : unread();
+        const compile = bases !== undefined && r.bucket !== 'allow' ? ruleCompileVerdictUnder(r.rule, r.bucket, bases) : undefined;
+        return Object.freeze({
+            rule: r.rule,
+            list: r.list,
+            bucket: r.bucket,
+            ...(r.origin !== undefined ? { origin: r.origin } : {}),
+            wire,
+            entry,
+            ...(compile !== undefined ? { compile } : {}),
+        });
+    });
+    const anyRead = rules.some((r) => r.entry.kind !== 'unread');
+    const entryMode = !readerInstalled || (rules.length > 0 && !anyRead) ? 'unavailable' : roster !== undefined ? 'with_roster' : 'grammar_only';
+    return Object.freeze({ rules: Object.freeze(rules), entryMode });
+}
+const NEAR_MISS_NAMED_MAX = 5;
+const NEAR_MISS_RULE_MAX = 120;
+const NEAR_MISS_NAME_MAX = 80;
+export function ruleNearMissSentence(rows, lang) {
+    const seen = new Set();
+    const items = [];
+    try {
+        if (!Array.isArray(rows))
+            return undefined;
+        for (const row of rows) {
+            if (typeof row !== 'object' || row === null)
+                continue;
+            const rule = guardedRead(() => readOwnDataValue(row, 'rule'));
+            if (typeof rule !== 'string' || rule === '' || seen.has(rule))
+                continue;
+            const wire = guardedRead(() => readOwnDataValue(row, 'wire'));
+            if (typeof wire !== 'object' || wire === null || guardedRead(() => readOwnDataValue(wire, 'sent')) !== true)
+                continue;
+            const entry = guardedRead(() => readOwnDataValue(row, 'entry'));
+            if (typeof entry !== 'object' || entry === null)
+                continue;
+            if (guardedRead(() => readOwnDataValue(entry, 'kind')) !== 'inert' || guardedRead(() => readOwnDataValue(entry, 'reason')) !== 'near_miss')
+                continue;
+            const mounted = text(guardedRead(() => readOwnDataValue(entry, 'currentName')));
+            if (mounted === undefined)
+                continue;
+            seen.add(rule);
+            items.push({ rule, mounted });
+        }
+    }
+    catch {
+        return undefined;
+    }
+    if (items.length === 0)
+        return undefined;
+    const shown = items.slice(0, NEAR_MISS_NAMED_MAX);
+    const separator = renderMessage(msg('rules.refusal.itemSeparator'), lang);
+    const named = shown
+        .map((it) => renderMessage(msg('rules.refusal.item', {
+        rule: `"${capForDisplay(it.rule, NEAR_MISS_RULE_MAX)}"`,
+        reason: renderMessage(msg('rules.nearMiss.reason', { mounted: capForDisplay(displayUntrusted(it.mounted), NEAR_MISS_NAME_MAX) }), lang),
+    }), lang))
+        .join(separator);
+    const rest = items.length - shown.length;
+    const list = rest > 0 ? msg('rules.refusal.list.more', { shown: named, count: rest }) : named;
+    const listText = typeof list === 'string' ? list : renderMessage(list, lang);
+    return renderMessage(items.length === 1 ? msg('rules.nearMiss.sentence.one', { list: listText }) : msg('rules.nearMiss.sentence.other', { count: items.length, list: listText }), lang);
+}

package/dist/ruleRefusalSentence.d.ts

@@ -2,3 +2,7 @@ import type { UiLanguage } from './env/uiLanguage.js';
 import type { PermissionsKeptRule } from './permissionsDeclaration.js';
 export type RuleRefusalRow = Pick<PermissionsKeptRule, 'rule' | 'reason' | 'code' | 'message'>;
 export declare function ruleRefusalSentence(rows: readonly RuleRefusalRow[], lang?: UiLanguage): string | undefined;
+export declare function ruleRefusalListText(items: readonly {
+    readonly rule?: string;
+    readonly reason: string;
+}[], lang?: UiLanguage): string;