@sema-agent/client-core 0.104.1 → 0.106.0

package/dist/ownKey.d.ts

@@ -43,7 +43,6 @@ export interface PromptManifestSectionRow {
     locale?: string;
     variant?: string;
     contentHash?: string;
-    slot?: string;
 }
 export interface PromptManifestIdentityRow {
     readonly artifact: string;
@@ -71,3 +70,7 @@ export interface SampledRecord {
 export declare function ownSnapshotWhenTyped<V>(value: V, word: string): SampledJson;
 export declare function ownSnapshotTyped<T extends object>(value: T): T | undefined;
 export declare function ownSnapshotRecord<V>(value: V): SampledRecord | undefined;
+export declare function workflowCompletionExtrasOf(c: object): {
+    completionId?: string;
+    diagnostics?: string;
+};

package/dist/ownKey.js

@@ -221,7 +221,6 @@ export function promptManifestSectionViewOf(row) {
     const locale = str(o.locale);
     const variant = str(o.variant);
     const contentHash = band !== undefined ? str(o.contentHash) : undefined;
-    const slot = str(o.slot);
     return {
         id,
         chars,
@@ -229,7 +228,6 @@ export function promptManifestSectionViewOf(row) {
         ...(locale !== undefined ? { locale } : {}),
         ...(variant !== undefined ? { variant } : {}),
         ...(contentHash !== undefined ? { contentHash } : {}),
-        ...(slot !== undefined ? { slot } : {}),
     };
 }
 export function promptManifestIdentityOfFrame(frame) {
@@ -440,3 +438,11 @@ function sampleObject(src, depth, run) {
         run.path.delete(src);
     }
 }
+export function workflowCompletionExtrasOf(c) {
+    const completionId = guardedRead(() => readOwnDataNonEmptyString(c, 'completionId'));
+    const diagnostics = guardedRead(() => readOwnDataNonEmptyString(c, 'diagnostics'));
+    return {
+        ...(completionId !== undefined ? { completionId } : {}),
+        ...(diagnostics !== undefined ? { diagnostics } : {}),
+    };
+}

package/dist/permissionModeWriteCapability.d.ts

@@ -0,0 +1,13 @@
+export type PermissionModeWriteReading = {
+    kind: 'unobserved';
+} | {
+    kind: 'unreadable';
+} | {
+    kind: 'not_reported';
+} | {
+    kind: 'present';
+    value: boolean;
+};
+export declare function projectPermissionModeWriteCapability(caps: unknown): PermissionModeWriteReading | undefined;
+export declare function observedPermissionModeWrite(baseUrl?: string | undefined): PermissionModeWriteReading;
+export declare function permissionModeWriteAvailable(reading: PermissionModeWriteReading | undefined): boolean;

package/dist/permissionModeWriteCapability.js

@@ -0,0 +1,35 @@
+import { engineWireTargetBaseUrl } from './engineWireTarget.js';
+import { createEngineCapReader } from './engineCapReader.js';
+import { ownDataField, readOwnDataValue } from './ownKey.js';
+export function projectPermissionModeWriteCapability(caps) {
+    try {
+        if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
+            return undefined;
+        const v = ownDataField(caps, 'permissionModeWrite');
+        if (v === undefined)
+            return { kind: 'not_reported' };
+        return typeof v === 'boolean' ? { kind: 'present', value: v } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const reader = createEngineCapReader({
+    name: 'permissionModeWrite',
+    project: projectPermissionModeWriteCapability,
+});
+export function observedPermissionModeWrite(baseUrl = engineWireTargetBaseUrl()) {
+    return reader.observed(baseUrl);
+}
+export function permissionModeWriteAvailable(reading) {
+    try {
+        if (reading === null || reading === undefined || typeof reading !== 'object' || Array.isArray(reading))
+            return false;
+        if (readOwnDataValue(reading, 'kind') !== 'present')
+            return false;
+        return readOwnDataValue(reading, 'value') === true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/permissionsAllowGrantCapability.d.ts

@@ -1,3 +1,4 @@
+export declare const RULE_LAYERS_CAP_LEAF: "layers";
 export type PermissionsAllowGrantReading = {
     kind: 'unobserved';
 } | {
@@ -8,10 +9,12 @@ export type PermissionsAllowGrantReading = {
     kind: 'present';
     grants: boolean;
     layer?: boolean;
+    layers?: boolean;
 };
 export declare function projectPermissionsAllowGrantCapability(caps: unknown): PermissionsAllowGrantReading | undefined;
 export declare function observedPermissionsAllowGrant(baseUrl?: string | undefined): PermissionsAllowGrantReading;
 export declare function permissionsAllowGrantAvailable(reading: PermissionsAllowGrantReading): boolean;
 export declare function allowWireForm(reading: PermissionsAllowGrantReading): 'layer' | 'grant' | 'off';
 export declare function allowRulesGate(reading: PermissionsAllowGrantReading, settingsRead: 'clean' | 'partial' | 'unreadable' | undefined): 'open' | 'capability_off' | 'settings_read_not_clean';
+export declare function permissionRuleLayersOn(reading: PermissionsAllowGrantReading | undefined): boolean;
 export declare function permissionsAllowGrantDoctorDetail(reading: PermissionsAllowGrantReading, settingsRead?: 'clean' | 'partial' | 'unreadable'): string;

package/dist/permissionsAllowGrantCapability.js

@@ -4,6 +4,7 @@ import { ownDataField } from './ownKey.js';
 import { hasCoreValuePort } from './coreValuePorts.js';
 const ALLOW_GRANT_CAP_PATH = ['settings', 'permissions', 'allowGrant'];
 const ALLOW_LAYER_CAP_LEAF = 'allowLayer';
+export const RULE_LAYERS_CAP_LEAF = 'layers';
 export function projectPermissionsAllowGrantCapability(caps) {
     try {
         if (caps === null || typeof caps !== 'object' || Array.isArray(caps))
@@ -18,9 +19,21 @@ export function projectPermissionsAllowGrantCapability(caps) {
                 if (typeof v !== 'boolean')
                     return undefined;
                 const layer = ownDataField(node, ALLOW_LAYER_CAP_LEAF);
-                if (layer === undefined)
-                    return { kind: 'present', grants: v };
-                return typeof layer === 'boolean' ? { kind: 'present', grants: v, layer } : undefined;
+                if (layer !== undefined && typeof layer !== 'boolean')
+                    return undefined;
+                let layers;
+                try {
+                    layers = ownDataField(node, RULE_LAYERS_CAP_LEAF);
+                }
+                catch {
+                    layers = undefined;
+                }
+                return {
+                    kind: 'present',
+                    grants: v,
+                    ...(layer !== undefined ? { layer } : {}),
+                    ...(typeof layers === 'boolean' ? { layers } : {}),
+                };
             }
             if (v === null || typeof v !== 'object' || Array.isArray(v))
                 return undefined;
@@ -61,6 +74,16 @@ export function allowRulesGate(reading, settingsRead) {
         return 'capability_off';
     return settingsRead === 'clean' ? 'open' : 'settings_read_not_clean';
 }
+export function permissionRuleLayersOn(reading) {
+    try {
+        if (reading === null || typeof reading !== 'object' || Array.isArray(reading))
+            return false;
+        return ownDataField(reading, 'kind') === 'present' && ownDataField(reading, RULE_LAYERS_CAP_LEAF) === true;
+    }
+    catch {
+        return false;
+    }
+}
 function ownReadingField(reading, key) {
     try {
         if (reading === null || typeof reading !== 'object' || Array.isArray(reading))

package/dist/permissionsDeclaration.d.ts

@@ -6,6 +6,7 @@ declare const SETTINGS_SOURCE_TIERS: Readonly<{
     readonly userSettings: "global";
     readonly localSettings: "project";
     readonly projectSettings: "project";
+    readonly foreignProjectSettings: "project";
 }>;
 declare const OFF_LADDER_ROWS: readonly [{
     readonly origin: "cliArg";
@@ -29,7 +30,6 @@ export interface PermissionsDeclarationInput {
     readonly cliDeny?: readonly string[];
     readonly settingsRead: 'clean' | 'partial' | 'unreadable';
     readonly clientOwnedServers?: readonly string[];
-    readonly serverVersion?: string;
 }
 export interface PermissionsDeclarationBuckets {
     deny?: string[];
@@ -39,7 +39,25 @@ export interface PermissionsDeclarationBuckets {
 export interface PermissionsDeclaration {
     permissions?: PermissionsDeclarationBuckets;
 }
-export declare const PERMISSIONS_KEPT_REASONS: readonly ["allow_capability_off", "settings_read_not_clean", "empty_rule", "paren_in_tool_name", "retired_tool_name", "unprefixed_namespaced_name", "incomplete_protocol_name", "unminted_protocol_segment", "home_relative_path", "compile_refused", "content_form_not_grantable", "content_form_never_matches", "judge_failed", "duplicate", "voids_allow_list"];
+export type SettingsRuleLayerOrigin = keyof typeof SETTINGS_SOURCE_TIERS;
+export interface TightenRuleContribution {
+    readonly rule: string;
+    readonly origin: WireRuleOrigin;
+}
+export interface LayeredTightenEntry {
+    readonly rule: string;
+    readonly layer: SettingsRuleLayerOrigin;
+}
+export type TightenWireEntry = string | LayeredTightenEntry;
+export interface HostPermissionsBuckets {
+    deny?: TightenWireEntry[];
+    ask?: TightenWireEntry[];
+    allow?: string[];
+}
+export interface HostPermissionsDeclaration {
+    permissions?: HostPermissionsBuckets;
+}
+export declare const PERMISSIONS_KEPT_REASONS: readonly ["allow_capability_off", "settings_read_not_clean", "empty_rule", "paren_in_tool_name", "retired_tool_name", "unprefixed_namespaced_name", "incomplete_protocol_name", "unminted_protocol_segment", "home_relative_path", "compile_refused", "content_form_not_grantable", "judge_failed", "duplicate", "voids_allow_list"];
 export type PermissionsKeptReason = (typeof PERMISSIONS_KEPT_REASONS)[number];
 export interface PermissionsKeptRule {
     rule: string;
@@ -86,8 +104,12 @@ export interface AssembledRuleRow {
     readonly origin?: WireRuleOrigin;
     readonly fate: AssembledRuleFate;
 }
+export interface LayeredTightenSources {
+    readonly deny: readonly TightenRuleContribution[];
+    readonly ask: readonly TightenRuleContribution[];
+}
 export declare function permissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclaration;
-export declare function projectPermissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading, projection: RulePortsProjection): PermissionsDeclaration;
+export declare function projectPermissionsDeclaration(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading, projection: RulePortsProjection, layered?: LayeredTightenSources): HostPermissionsDeclaration;
 export declare function permissionsDeclarationReport(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): PermissionsDeclarationReport;
 export declare function assembledRuleRows(input: PermissionsDeclarationInput, caps: PermissionsAllowGrantReading): readonly AssembledRuleRow[];
 export interface PermissionsAllowKeptFacts {

package/dist/permissionsDeclaration.js

@@ -1,6 +1,6 @@
 import { compileAllowList, hasCoreValuePort, protocolOf, ruleToolGrammarOf } from './coreValuePorts.js';
 import { clientOwnedServerPrefix, ruleToolNameVerdictOf } from './protocolSegment.js';
-import { ruleCompileVerdict, tightenEntryNeverMatches } from './ruleCompileVerdict.js';
+import { ruleCompileVerdict } from './ruleCompileVerdict.js';
 import { allowRulesGate, allowWireForm } from './permissionsAllowGrantCapability.js';
 import { SETTINGS_IS_AT_LEAST } from './generated/settingsSchemaFns.js';
 import { THROWN_SLOT_UNREADABLE, asAssemblyRefusal, assemblyRefusalOf, isSlotCarrier, readThrownSlot, withAssemblyRefusal } from './wireFailureShape.js';
@@ -11,8 +11,9 @@ const SETTINGS_SOURCE_TIERS = Object.freeze({
     userSettings: 'global',
     localSettings: 'project',
     projectSettings: 'project',
+    foreignProjectSettings: 'project',
 });
-const SAME_TIER_ORDER = ['flagSettings', 'userSettings', 'localSettings', 'projectSettings'];
+const SAME_TIER_ORDER = ['flagSettings', 'userSettings', 'localSettings', 'projectSettings', 'foreignProjectSettings'];
 const OFF_LADDER_ROWS = Object.freeze([
     { origin: 'cliArg', after: 'policySettings' },
     { origin: 'session', after: 'flagSettings' },
@@ -47,7 +48,6 @@ export const PERMISSIONS_KEPT_REASONS = Object.freeze([
     'home_relative_path',
     'compile_refused',
     'content_form_not_grantable',
-    'content_form_never_matches',
     'judge_failed',
     'duplicate',
     'voids_allow_list',
@@ -154,7 +154,7 @@ function tighteningWholeName(name, check) {
     const next = nameCheck(successor);
     return 'retired' in next || 'issue' in next ? name : successor;
 }
-function judgeList(rules, behavior, allowForm = 'grant', serverVersion) {
+function judgeList(rules, behavior, allowForm = 'grant') {
     let portsChecked = false;
     return rules.map((rule) => {
         if (rule === '')
@@ -184,7 +184,7 @@ function judgeList(rules, behavior, allowForm = 'grant', serverVersion) {
         }
         const check = nameCheck(parsed.toolName);
         if (behavior !== 'allow')
-            return tightenEntryNeverMatches(rule, serverVersion) ? kept('content_form_never_matches') : { sent: true, wire: rule };
+            return { sent: true, wire: rule };
         if ('retired' in check)
             return kept('retired_tool_name');
         if ('issue' in check)
@@ -244,45 +244,60 @@ function allowListVoiders(sent) {
         return 'unknown';
     }
 }
-function judgeBucket(raw, behavior, originOf, cli, settingsGate, allowForm = 'grant', dropWire, owned = [], serverVersion) {
+function judgeBucket(raw, behavior, originOf, cli, settingsGate, allowForm = 'grant', dropWire, owned = [], layeredFrom) {
     const firstSlot = new Map();
     for (const s of raw)
         if (!firstSlot.has(s.rule))
             firstSlot.set(s.rule, s);
     const groups = WIRE_RULE_TRUST_ORDER.map(() => []);
     const rankOf = (origin) => WIRE_RULE_TRUST_ORDER.indexOf(origin);
-    if (originOf !== undefined) {
-        for (const [r, origin] of originOf) {
+    const pairs = layeredFrom !== undefined ? layeredFrom.map((c) => [c.rule, c.origin]) : originOf;
+    const known = new Set();
+    if (pairs !== undefined) {
+        for (const [r, origin] of pairs) {
             const rank = rankOf(origin);
-            if (rank >= 0 && typeof r === 'string' && firstSlot.has(r))
+            if (rank >= 0 && typeof r === 'string' && firstSlot.has(r)) {
                 appendOwnElement(groups[rank], r);
+                known.add(r);
+            }
         }
     }
-    const unknownOrigin = [...firstSlot.keys()].filter((r) => originOf === undefined || rankOf(originOf.get(r)) < 0);
+    const unknownOrigin = [...firstSlot.keys()].filter((r) => !known.has(r));
     const fateOfRule = new Map();
     const sent = [];
+    const sentLayers = [];
+    const sentIds = [];
     const winnerOf = new Map();
     const cliFates = cli === undefined ? [] : [...cli.fates];
-    const place = (slot, fate) => {
+    const layerOf = (origin) => layeredFrom !== undefined && origin !== undefined && Object.hasOwn(SETTINGS_SOURCE_TIERS, origin) ? origin : undefined;
+    const place = (slot, fate, origin) => {
         if (!fate.sent)
             return fate;
         const dropped = dropWire?.(fate.wire);
         if (dropped !== undefined)
             return kept(dropped);
-        if (winnerOf.has(fate.wire))
+        const layer = layerOf(origin);
+        const id = layeredFrom === undefined ? fate.wire : JSON.stringify([layer ?? null, fate.wire]);
+        if (winnerOf.has(id))
             return kept('duplicate');
-        winnerOf.set(fate.wire, slot);
+        winnerOf.set(id, slot);
         appendOwnElement(sent, fate.wire);
+        appendOwnElement(sentLayers, layer);
+        appendOwnElement(sentIds, id);
         return fate;
     };
     const appendGroup = (group, origin) => {
         const held = settingsGate !== undefined && !outsideSettingsFiles(origin);
-        const fates = held ? group.map(() => kept(settingsGate)) : judgeList(group, behavior, allowForm, serverVersion);
-        group.forEach((r, k) => fateOfRule.set(r, place(firstSlot.get(r), fates[k])));
+        const fates = held ? group.map(() => kept(settingsGate)) : judgeList(group, behavior, allowForm);
+        group.forEach((r, k) => {
+            const f = place(firstSlot.get(r), fates[k], origin);
+            if (!fateOfRule.has(r))
+                fateOfRule.set(r, f);
+        });
     };
     WIRE_RULE_TRUST_ORDER.forEach((origin, rank) => {
         if (origin === 'cliArg' && cli !== undefined)
-            cli.slots.forEach((s, k) => (cliFates[k] = place(s, cliFates[k])));
+            cli.slots.forEach((s, k) => (cliFates[k] = place(s, cliFates[k], 'cliArg')));
         appendGroup(groups[rank], origin);
     });
     const ownedFates = owned.map((fate, k) => place({ rule: fate.sent ? fate.wire : '', list: 'allow', at: -1 - k }, fate));
@@ -293,7 +308,7 @@ function judgeBucket(raw, behavior, originOf, cli, settingsGate, allowForm = 'gr
             return f;
         return f.sent || f.reason === 'duplicate' ? kept('duplicate') : f;
     });
-    return { sent, fates: [...fates, ...cliFates], winnerOf, ownedFates };
+    return { sent, sentLayers, sentIds, fates: [...fates, ...cliFates], winnerOf, ownedFates };
 }
 function clientOwnedFate(server) {
     if (server.length === 0)
@@ -312,7 +327,7 @@ function ownField(obj, key, where) {
         throw malformed(`${WHO}: ${where}${key} 只在原型链上,不是自有字段 —— 拒绝读取(请交普通对象)。`);
     return undefined;
 }
-function ruleList(v, key) {
+function ruleList(v, key, tighten = false) {
     if (v === undefined || v === null)
         return undefined;
     if (!Array.isArray(v))
@@ -326,6 +341,9 @@ function ruleList(v, key) {
             continue;
         }
         const r = v[i];
+        if (tighten && r !== null && typeof r === 'object') {
+            throw malformed(`${WHO}: ${key}[${i}] 是对象(带出处层的条目形)—— 本口只收规则串:收紧方向的条目不静默丢,拒绝装配(带层条目由宿主设置入口在能力位恰真时铸)。`);
+        }
         if (typeof r === 'string')
             appendOwnElement(out, r);
     }
@@ -348,17 +366,17 @@ function originMap(v, key) {
     return snap;
 }
 const slotsOf = (list, name) => (list ?? []).map((rule, at) => ({ rule, list: name, at }));
-function assemble(input, caps, projection) {
+function assemble(input, caps, projection, layered) {
     const outer = activeRulePortsProjection;
     activeRulePortsProjection = projection;
     try {
-        return assembleNow(input, caps);
+        return assembleNow(input, caps, layered);
     }
     finally {
         activeRulePortsProjection = outer;
     }
 }
-function assembleNow(input, caps) {
+function assembleNow(input, caps, layered) {
     let read;
     try {
         read = readAssemblyInput(input, caps);
@@ -367,7 +385,7 @@ function assembleNow(input, caps) {
         throw asAssemblyRefusal(e, 'input_malformed', WHO);
     }
     try {
-        return judgeAssembly(read, caps);
+        return judgeAssembly(read, caps, layered);
     }
     catch (e) {
         throw asAssemblyRefusal(e, 'judge_unanswerable', WHO);
@@ -377,10 +395,10 @@ function readAssemblyInput(input, caps) {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) {
         throw malformed(`${WHO}: 入参必须是对象 —— 收到 ${input === null ? 'null' : Array.isArray(input) ? 'array' : `typeof=${typeof input}`}。`);
     }
-    const deny = ruleList(ownField(input, 'deny', ''), 'deny');
-    const ask = ruleList(ownField(input, 'ask', ''), 'ask');
+    const deny = ruleList(ownField(input, 'deny', ''), 'deny', true);
+    const ask = ruleList(ownField(input, 'ask', ''), 'ask', true);
     const allow = ruleList(ownField(input, 'allow', ''), 'allow');
-    const cliDeny = ruleList(ownField(input, 'cliDeny', ''), 'cliDeny');
+    const cliDeny = ruleList(ownField(input, 'cliDeny', ''), 'cliDeny', true);
     const ownedServers = [...new Set(ruleList(ownField(input, 'clientOwnedServers', ''), 'clientOwnedServers') ?? [])];
     const originsRaw = ownField(input, 'origins', '');
     let origins = {};
@@ -394,23 +412,21 @@ function readAssemblyInput(input, caps) {
         origins = { ...(od ? { deny: od } : {}), ...(oa ? { ask: oa } : {}), ...(ol ? { allow: ol } : {}) };
     }
     const gate = allowRulesGate(caps, ownField(input, 'settingsRead', ''));
-    const versionRaw = ownField(input, 'serverVersion', '');
-    const serverVersion = typeof versionRaw === 'string' ? versionRaw : undefined;
-    return { deny, ask, allow, cliDeny, ownedServers, origins, gate, serverVersion };
+    return { deny, ask, allow, cliDeny, ownedServers, origins, gate };
 }
-function judgeAssembly(read, caps) {
-    const { deny, ask, allow, cliDeny, ownedServers, origins, gate, serverVersion } = read;
+function judgeAssembly(read, caps, layered) {
+    const { deny, ask, allow, cliDeny, ownedServers, origins, gate } = read;
     const cliSlots = slotsOf(cliDeny, 'cliDeny');
-    const cli = cliDeny === undefined ? undefined : { slots: cliSlots, fates: judgeList(cliDeny, 'deny', 'grant', serverVersion) };
+    const cli = cliDeny === undefined ? undefined : { slots: cliSlots, fates: judgeList(cliDeny, 'deny', 'grant') };
     const denySlots = slotsOf(deny, 'deny');
     const askSlots = slotsOf(ask, 'ask');
     const allowSlots = slotsOf(allow, 'allow');
-    const denyJ = judgeBucket(denySlots, 'deny', origins.deny, cli, undefined, 'grant', undefined, [], serverVersion);
-    const askJ = judgeBucket(askSlots, 'ask', origins.ask, undefined, undefined, 'grant', undefined, [], serverVersion);
+    const denyJ = judgeBucket(denySlots, 'deny', origins.deny, cli, undefined, 'grant', undefined, [], layered?.deny);
+    const askJ = judgeBucket(askSlots, 'ask', origins.ask, undefined, undefined, 'grant', undefined, [], layered?.ask);
     const allowForm = allowWireForm(caps) === 'layer' ? 'layer' : 'grant';
     const settingsGate = gate === 'settings_read_not_clean' ? 'settings_read_not_clean' : undefined;
     let allowJ = gate === 'capability_off'
-        ? { sent: [], fates: allowSlots.map(() => kept('allow_capability_off')), winnerOf: new Map(), ownedFates: ownedServers.map(() => kept('allow_capability_off')) }
+        ? { sent: [], sentLayers: [], sentIds: [], fates: allowSlots.map(() => kept('allow_capability_off')), winnerOf: new Map(), ownedFates: ownedServers.map(() => kept('allow_capability_off')) }
         : judgeBucket(allowSlots, 'allow', origins.allow, undefined, settingsGate, allowForm, undefined, ownedServers.map(clientOwnedFate));
     if (gate !== 'capability_off' && allowForm === 'layer' && allowJ.sent.length > 0) {
         const voiders = allowListVoiders(allowJ.sent);
@@ -426,6 +442,17 @@ function judgeAssembly(read, caps) {
         buckets.ask = [...askJ.sent];
     if (allowJ.sent.length > 0)
         buckets.allow = [...allowJ.sent];
+    const entriesOf = (j) => j.sent.map((wire, i) => {
+        const layer = j.sentLayers[i];
+        return layer === undefined ? wire : Object.freeze({ rule: wire, layer });
+    });
+    const wireBuckets = {};
+    if (denyJ.sent.length > 0)
+        wireBuckets.deny = entriesOf(denyJ);
+    if (askJ.sent.length > 0)
+        wireBuckets.ask = entriesOf(askJ);
+    if (allowJ.sent.length > 0)
+        wireBuckets.allow = [...allowJ.sent];
     const keptRows = [];
     const rewritten = [];
     const ruleRows = [];
@@ -458,21 +485,22 @@ function judgeAssembly(read, caps) {
                 });
             }
         });
-        for (const wire of j.sent) {
-            const winner = j.winnerOf.get(wire);
+        j.sent.forEach((wire, i) => {
+            const winner = j.winnerOf.get(j.sentIds[i]);
             if (winner.at < 0)
-                continue;
+                return;
             if (winner.rule !== wire)
                 appendOwnElement(rewritten, { from: winner.rule, to: wire, bucket });
-        }
+        });
     }
-    return { buckets, report: { kept: keptRows, rewritten, ...(clientOwned.length > 0 ? { clientOwned } : {}) }, rows: ruleRows };
+    return { buckets, wireBuckets, report: { kept: keptRows, rewritten, ...(clientOwned.length > 0 ? { clientOwned } : {}) }, rows: ruleRows };
 }
 export function permissionsDeclaration(input, caps) {
     return declarationOf(assemble(input, caps));
 }
-export function projectPermissionsDeclaration(input, caps, projection) {
-    return declarationOf(assemble(input, caps, projection));
+export function projectPermissionsDeclaration(input, caps, projection, layered) {
+    const { wireBuckets } = assemble(input, caps, projection, layered);
+    return Object.keys(wireBuckets).length > 0 ? { permissions: wireBuckets } : {};
 }
 function declarationOf({ buckets }) {
     return Object.keys(buckets).length > 0 ? { permissions: buckets } : {};

package/dist/planReviewCardFacts.d.ts

@@ -0,0 +1,116 @@
+export type PlanBodyUnknownCause = 'not_observed' | 'gate_unidentified' | 'gate_moved' | 'unreadable' | 'ambiguous_call' | 'malformed_frame' | 'conflicting_claims' | 'not_presented' | 'not_carried';
+export type PlanReviewBody = {
+    readonly kind: 'shown';
+    readonly markdown: string;
+} | {
+    readonly kind: 'marked';
+    readonly literal: string;
+} | {
+    readonly kind: 'too_large';
+    readonly length: number;
+} | {
+    readonly kind: 'unknown';
+    readonly cause: PlanBodyUnknownCause;
+};
+export interface PlanReviewCardFacts {
+    readonly taskId: string;
+    readonly checkpointId?: string;
+    readonly body: PlanReviewBody;
+}
+export declare function planReviewBodyOf(text: string): Exclude<PlanReviewBody, {
+    kind: 'unknown';
+}>;
+export declare function mintPlanReviewCardFacts(taskId: string, checkpointId: string | undefined, body: PlanReviewBody): PlanReviewCardFacts;
+export declare function unknownBody(cause: PlanBodyUnknownCause): PlanReviewBody;
+export declare function planReviewCardFactsFrom(v: {} | null | undefined): PlanReviewCardFacts | undefined;
+export declare function samePlanReviewCardFacts(a: PlanReviewCardFacts, b: PlanReviewCardFacts): boolean;
+export declare function isPlanReviewPark(result: unknown): result is {
+    taskId: string;
+    sessionId?: string;
+};
+export declare function pausedCheckpointIdOf(carrier: {} | null | undefined): string | undefined;
+export type PlanClaim = {
+    readonly kind: 'text';
+    readonly text: string;
+} | {
+    readonly kind: 'cause';
+    readonly cause: PlanBodyUnknownCause;
+};
+interface PresentedCall {
+    readonly plan?: string;
+}
+interface ClaimWindow {
+    presented: PresentedCall[];
+    malformed: boolean;
+    ambiguous: boolean;
+    unreadable: boolean;
+}
+interface PlanReviewGateEntry {
+    readonly checkpointId: string;
+    readonly facts: PlanReviewCardFacts;
+    readonly claim: PlanClaim;
+    readonly highWater?: string;
+    readonly generation: number;
+}
+interface PlanReviewRunRecord {
+    readonly open: Set<string>;
+    readonly settled: Set<string>;
+    window: ClaimWindow;
+    sawPlanFrame: boolean;
+    claimAtMarker?: PlanClaim | undefined;
+    claimGate?: string | undefined;
+    dirty: boolean;
+    gate?: PlanReviewGateEntry;
+    generation: number;
+    cardIssued: boolean;
+}
+export declare function _resetPlanReviewRunsForTest(): void;
+export interface PlanReviewFactsTicket {
+    readonly sessionKey: string;
+    readonly taskId: string;
+    readonly generation: number;
+}
+export declare function beginPlanReviewFactsRead(sessionKey: string, taskId: string): PlanReviewFactsTicket;
+export declare function commitPlanReviewFacts(ticket: PlanReviewFactsTicket, facts: PlanReviewCardFacts, claim: PlanClaim, highWater?: string): PlanReviewCardFacts | undefined;
+export declare function samePlanClaim(a: PlanClaim, b: PlanClaim): boolean;
+export declare function registeredPlanReviewCardFacts(sessionKey: string, taskId: string, checkpointId: string): PlanReviewCardFacts | undefined;
+export interface PlanReviewCurrentGate {
+    readonly checkpointId: string;
+    readonly facts: PlanReviewCardFacts;
+    readonly generation: number;
+}
+export declare function currentPlanReviewGateOf(sessionKey: string, taskId: string): PlanReviewCurrentGate | undefined;
+export declare function planReviewRunGeneration(sessionKey: string, taskId: string): number;
+export declare function notePlanReviewCardIssued(sessionKey: string, taskId: string): boolean;
+export declare function planReviewGateHighWaterOf(sessionKey: string, taskId: string, checkpointId: string): string | undefined;
+export interface PlanBodyClaimLeg {
+    taskId?: string;
+    readonly buffer: Array<{
+        readonly frame: object;
+        readonly subFlow: boolean;
+    }>;
+    overflow: boolean;
+    unreadable: boolean;
+}
+export declare function openPlanBodyClaimLeg(): PlanBodyClaimLeg;
+export declare function stepPlanBodyClaim(leg: PlanBodyClaimLeg, frame: object, subFlow: boolean): void;
+export declare function planReviewParkFacts(leg: PlanBodyClaimLeg, result: {} | null | undefined): PlanReviewCardFacts | undefined;
+export interface PlanReviewFactsTaken {
+    readonly sessionKey: string;
+    readonly taskId: string;
+    readonly facts: PlanReviewCardFacts;
+    readonly generation: number;
+}
+export declare function planReviewFactsCurrent(taken: PlanReviewFactsTaken): boolean;
+export interface PlanGateRowRead {
+    readonly ok: boolean;
+    readonly atPlanGate: boolean;
+    readonly checkpointId?: string;
+}
+export declare function planGateRowReadOf(row: {} | null | undefined): PlanGateRowRead;
+export type PlanReviewLedgerFold = PlanReviewRunRecord;
+export declare function openPlanReviewLedgerFold(): PlanReviewLedgerFold;
+export declare function stepPlanReviewLedgerFold(fold: PlanReviewLedgerFold, frame: object, subFlow: boolean): PlanReviewLedgerFold;
+export declare function planReviewLedgerClaimOf(fold: PlanReviewLedgerFold): PlanClaim | undefined;
+export declare function isPlanReviewClaimFrame(frame: object): boolean;
+export {};