@sema-agent/client-core 0.95.0 → 0.96.0

package/dist/centerWiringCapability.js

@@ -88,9 +88,6 @@ const reader = createEngineCapReader({
     project: projectCenterWiringCapability,
     makeUnobserved: () => ({ kind: 'unobserved' }),
 });
-export function noteEngineCapsForCenterWiring(baseUrl, caps, opts) {
-    reader.note(baseUrl, caps, opts);
-}
 export function observedCenterWiring(baseUrl = engineWireTarget()?.baseUrl) {
     return reader.observed(baseUrl);
 }
@@ -194,6 +191,3 @@ export function centerWiringDoctorDetail(reading) {
         return unobserved;
     }
 }
-export function __resetCenterWiringReadingsForTests() {
-    reader.__resetForTests();
-}

package/dist/classifierVerdictWire.js

@@ -1,21 +1,7 @@
 import { unwrapSystemReminder } from './systemReminderTag.js';
+import { toolEndOutputText } from './toolResultContent.js';
 export const CLASSIFIER_DENY_SIGNATURE = 'auto-mode classifier blocked this call';
 const NOTICE_REASON_MAX = 80;
-function textFromWireOutput(output) {
-    if (typeof output === 'string')
-        return output;
-    const blocks = Array.isArray(output)
-        ? output
-        : output !== null && typeof output === 'object' && Array.isArray(output.content)
-            ? (output.content)
-            : undefined;
-    if (!blocks)
-        return undefined;
-    const texts = blocks
-        .map(b => (b !== null && typeof b === 'object' && typeof b.text === 'string' ? b.text : undefined))
-        .filter((t) => t !== undefined);
-    return texts.length > 0 ? texts.join('\n') : undefined;
-}
 const CLASSIFIER_DENY_FORMS = [
     'auto-mode classifier blocked the approved edit at an inherited ancestor layer',
     'auto-mode classifier blocked this call at an inherited ancestor layer',
@@ -24,7 +10,9 @@ const CLASSIFIER_DENY_FORMS = [
 export function classifierDenyFromToolEnd(ev) {
     if (!ev || ev.type !== 'tool_end' || ev.isError !== true)
         return undefined;
-    const raw = textFromWireOutput(ev.output);
+    if (Array.isArray(ev.output) && ev.output.length !== 1)
+        return undefined;
+    const raw = toolEndOutputText(ev.output);
     if (raw === undefined)
         return undefined;
     const message = unwrapSystemReminder(raw).trim();

package/dist/clientSlice.js

@@ -14,4 +14,4 @@ export const CLIENT_VERBS = [
     { verb: 'probeHealth', required: false, duty: '健康探测' },
 ];
 export const PROBE_HEALTH_DIVERGENCE = 'probeHealth: SDK 要求 status==="ok",壳侧 limitsWire:225 / detachWire:82 手拼只要 res.ok。' +
-    'B4 保旧行为(res.ok),差异候裁 —— 换成 SDK 语义会让"自报 degraded 但可用"的引擎少发 detach 头。';
+    'B4 保旧行为(res.ok),差异待定 —— 换成 SDK 语义会让"自报 degraded 但可用"的引擎少发 detach 头。';

package/dist/cloudConfigWireCaps.d.ts

@@ -4,7 +4,7 @@ import type { EnvLike } from './hostEnv.js';
 export type { McpServerSpec };
 type Rec = Record<string, unknown>;
 export type { EnvLike };
-export type CloudMcpDropReason = 'disabled' | 'missing-field' | 'unknown-transport' | 'capped';
+export type CloudMcpDropReason = 'disabled' | 'missing-field' | 'unknown-transport' | 'capped' | 'principal-and-assertion-header';
 export interface CloudMcpDroppedServer {
     name?: string;
     reason: CloudMcpDropReason;
@@ -17,10 +17,10 @@ export interface CloudMcpProjection {
 export declare function cloudMcpToSpecs(servers: unknown, env: EnvLike): CloudMcpProjection;
 export declare function cloudSkillsToSpecs(manifestSkills: unknown, resolveBody: (contentHash: string) => string | null): SkillSpec[];
 export interface CloudModelRefIssue {
-    readonly key: 'models' | 'default' | 'roles' | 'atModelAllowlist' | 'tierGroups' | 'activeTierGroup';
+    readonly key: 'models' | 'roles' | 'atMention' | 'tierGroups' | 'activeTierGroup';
     readonly at?: string;
     readonly target?: string;
-    readonly reason: 'dangling' | 'rejected' | 'unreadable' | 'unsupported' | 'duplicate';
+    readonly reason: 'dangling' | 'rejected' | 'unreadable' | 'unsupported' | 'duplicate' | 'shadowed';
     readonly outcome: 'dropped' | 'kept';
 }
 export interface CloudModelsDocOptions {

package/dist/cloudConfigWireCaps.js

@@ -62,6 +62,10 @@ export function cloudMcpToSpecs(servers, env) {
                 drop(name, 'missing-field');
                 continue;
             }
+            if (asStr(t.principalHeader) && asStr(t.assertionHeader)) {
+                drop(name, 'principal-and-assertion-header');
+                continue;
+            }
             const headers = {};
             for (const [headerName, ref] of Object.entries(asRec(t.headerRefs) ?? {})) {
                 const refName = asStr(ref);
@@ -166,8 +170,10 @@ function modelsDocOf(models, opts) {
     const refOf = (v) => (typeof v === 'string' && v !== '' ? { target: v } : {});
     const reasonOf = (v) => typeof v === 'string' && v !== '' ? (rawNames.has(v) ? 'rejected' : 'dangling') : 'unreadable';
     let written = stripped;
+    let catalogKept = false;
     if (acceptedFlags && stripped.length > 0) {
         const anyAccepted = acceptedFlags.some((f) => f);
+        catalogKept = !anyAccepted;
         stripped.forEach((e, i) => {
             if (!acceptedFlags[i])
                 issues.push({ key: 'models', target: e.name, reason: 'rejected', outcome: anyAccepted ? 'dropped' : 'kept' });
@@ -178,59 +184,80 @@ function modelsDocOf(models, opts) {
     const doc = { models: written };
     const policy = modelsPolicyOf(m);
     if (policy.unreadable) {
-        drop({ key: 'default', reason: 'unreadable' });
-        drop({ key: 'atModelAllowlist', at: 'models', reason: 'unreadable' });
+        drop({ key: 'roles', at: 'default', reason: 'unreadable' });
+        drop({ key: 'atMention', at: 'models', reason: 'unreadable' });
     }
     if (policy.defaultUnreadable)
-        drop({ key: 'default', reason: 'unreadable' });
+        drop({ key: 'roles', at: 'default', reason: 'unreadable' });
     const dm = policy.defaultModel;
-    if (accept && dm !== undefined) {
+    let defaultRole;
+    if (accept && dm !== undefined && dm.from === 'default') {
         if (names.has(dm.name))
-            doc.default = dm.name;
+            defaultRole = { model: dm.name };
         else
-            drop({ key: 'default', target: dm.name, reason: reasonOf(dm.name) });
+            drop({ key: 'roles', at: 'default', target: dm.name, reason: reasonOf(dm.name) });
     }
     const roles = asRec(m.roles);
-    if (roles) {
-        const kept = {};
-        for (const [role, t] of Object.entries(roles)) {
-            if (role === 'default' && accept && dm?.from === 'roles.default')
-                continue;
-            const tr = asRec(t);
-            const model = tr && Object.hasOwn(tr, 'model') ? tr.model : undefined;
-            if (typeof model === 'string' && !names.has(model)) {
-                drop({ key: 'roles', at: role, ...refOf(model), reason: reasonOf(model) });
-                continue;
+    const keptRoles = {};
+    for (const [role, t] of Object.entries(roles ?? {})) {
+        if (role === 'default' && defaultRole !== undefined) {
+            let same = false;
+            try {
+                same = JSON.stringify(t) === JSON.stringify(defaultRole);
             }
-            setOwn(kept, role, t);
+            catch {
+                same = false;
+            }
+            if (!same) {
+                const tr = asRec(t);
+                const model = tr && Object.hasOwn(tr, 'model') ? tr.model : undefined;
+                drop({ key: 'roles', at: 'default', ...refOf(model), reason: 'shadowed' });
+            }
+            continue;
+        }
+        const tr = asRec(t);
+        const model = tr && Object.hasOwn(tr, 'model') ? tr.model : undefined;
+        if (typeof model === 'string' && !names.has(model)) {
+            drop({ key: 'roles', at: role, ...refOf(model), reason: reasonOf(model) });
+            continue;
         }
-        doc.roles = kept;
+        setOwn(keptRoles, role, t);
     }
+    const rolesOut = {};
+    if (defaultRole !== undefined)
+        setOwn(rolesOut, 'default', defaultRole);
+    else if (Object.hasOwn(keptRoles, 'default'))
+        setOwn(rolesOut, 'default', keptRoles.default);
+    for (const [k, v] of Object.entries(keptRoles))
+        if (k !== 'default')
+            setOwn(rolesOut, k, v);
+    if (Object.keys(rolesOut).length > 0)
+        doc.roles = rolesOut;
     const am = policy.atMention;
     if (am?.kind === 'unreadable') {
-        drop({ key: 'atModelAllowlist', at: am.from, reason: 'unreadable' });
+        drop({ key: 'atMention', at: am.from, reason: 'unreadable' });
     }
     else if (am !== undefined) {
         for (let i = 0; i < am.unreadableEntries; i += 1)
-            drop({ key: 'atModelAllowlist', reason: 'unreadable' });
+            drop({ key: 'atMention', reason: 'unreadable' });
         const v = am.value;
-        if (v.mode === 'none') {
-            drop({ key: 'atModelAllowlist', at: 'atMention', reason: 'unsupported' });
-        }
-        else if (v.mode === 'only') {
+        if (v.mode === 'only') {
+            for (const n of v.models)
+                if (!names.has(n))
+                    drop({ key: 'atMention', target: n, reason: reasonOf(n) });
             const narrowed = SETTINGS_NARROW_AT_MENTION(v, names);
             if (narrowed.mode === 'only') {
-                for (const n of v.models)
-                    if (!names.has(n))
-                        drop({ key: 'atModelAllowlist', target: n, reason: reasonOf(n) });
-                doc.atModelAllowlist = [...narrowed.models];
+                doc.atMention = { mode: 'only', models: [...narrowed.models] };
             }
             else {
-                doc.atModelAllowlist = [...v.models];
-                for (const n of v.models)
-                    issues.push({ key: 'atModelAllowlist', target: n, reason: reasonOf(n), outcome: 'kept' });
+                doc.atMention = { mode: narrowed.mode };
+                if (narrowed.mode === 'none' && !catalogKept)
+                    drop({ key: 'atMention', at: 'atMention', reason: 'dangling' });
             }
         }
+        else if (v.mode === 'none') {
+            doc.atMention = { mode: 'none' };
+        }
     }
     let groupNames;
     const rawGroupNames = new Set((Array.isArray(m.tierGroups) ? m.tierGroups : []).map((g) => asStr(asRec(g)?.name)).filter((n) => !!n));
@@ -536,13 +563,15 @@ function droppedRefNotice(d) {
     switch (d.key) {
         case 'models':
             return { level: 'warn', text: `cloud config: ${t === undefined ? 'a model entry' : `model "${t}"`} ${ENTRY_REJECTED} — it was left out of the local catalog` };
-        case 'default':
-            return { level: 'warn', text: `cloud config: ${t === undefined ? 'the default model setting could not be read' : `the default model "${t}" ${notServed}`}, so it was left out — the local engine picks its default from roles and tiers instead` };
         case 'roles':
+            if (d.at === 'default' && d.reason === 'unreadable')
+                return { level: 'warn', text: 'cloud config: the default model setting could not be read, so it was left out — the local engine picks its default from roles and tiers instead' };
+            if (d.reason === 'shadowed')
+                return { level: 'warn', text: `cloud config: the "${d.at ?? ''}" role${t === undefined ? '' : ` ("${t}")`} is overridden by the default model setting served to you — only one default model can be set, so that role entry was left out` };
             return { level: 'warn', text: `cloud config: role "${d.at ?? ''}" ${t === undefined ? 'names no readable model' : `points at model "${t}", which ${notServed}`} — the role was left out and falls back along the engine's role chain` };
-        case 'atModelAllowlist':
-            if (d.reason === 'unsupported')
-                return { level: 'warn', text: 'cloud config: the @-mention setting served to you allows no model to be @-mentioned, which the local engine\'s settings format cannot express — it was left out, so @-mentions are not restricted on the local engine' };
+        case 'atMention':
+            if (d.at === 'atMention' && d.reason === 'dangling')
+                return { level: 'warn', text: 'cloud config: none of the models in the @-mention allowlist served to you can be used on the local engine, so @-mentions are turned off there' };
             if (d.at !== undefined)
                 return { level: 'warn', text: 'cloud config: the @-mention setting served to you could not be read by this client — it was left out, so @-mentions are not restricted on the local engine' };
             return { level: 'warn', text: `cloud config: ${t === undefined ? 'an unreadable @-mention allowlist entry' : `@-mention allowlist entry "${t}" ${notServed} and`} was left out` };
@@ -625,15 +654,6 @@ export function cloudEffectiveNotices(p) {
                 'the catalog is kept as sent, and a locally started engine rejects the cloud model settings: at startup it uses its own environment catalog instead, and on a later refresh it keeps the previous configuration',
         });
     }
-    const keptAllowlist = p.modelRefIssues.filter((d) => d.outcome === 'kept' && d.key === 'atModelAllowlist');
-    if (keptAllowlist.length > 0) {
-        const names = keptAllowlist.flatMap((d) => (d.target === undefined ? [] : [`"${d.target}"`]));
-        out.push({
-            level: 'warn',
-            text: `cloud config: no @-mention allowlist entry${names.length > 0 ? ` (${names.join(', ')})` : ''} names a usable model in the catalog served to you — ` +
-                'the list is kept as sent, because an empty list would let every model be mentioned; with it, a locally started engine rejects the cloud model settings — at startup it uses its own environment catalog instead, and on a later refresh it keeps the previous configuration',
-        });
-    }
     out.push(budgetNotice(p.budget));
     out.push(runtimeCapsNotice(p.runtimeCaps));
     return out;

package/dist/coreValuePorts.d.ts

@@ -91,17 +91,21 @@ export interface PerModelAuthView {
     apiKey?: string;
     headers?: Record<string, string>;
 }
+export type RuleGrammarView = 'command' | 'domain' | 'name' | 'path';
+export interface RuleToolNameVerdictView {
+    readonly kind: 'current' | 'retired' | 'unprefixed_namespace' | 'unmintable_segment' | (string & {});
+    readonly guidance?: string;
+    readonly currentName?: string;
+}
 export interface CoreValuePorts {
     resolveAutonomousLoopPrompt: (prompt: string, opts?: AutonomousLoopPromptOptionsView) => string | null;
     loosenReasons: (prior: SessionPermissionRules, next: SessionPermissionRules) => string[];
     combinePolicies: (...policies: CoreToolPolicyHandle[]) => CoreToolPolicyHandle;
     createAllowDenyPolicy: (opts: AllowDenyPolicyOptionsView) => CoreToolPolicyHandle;
     MCP_NAMESPACE: CoreProtocolNamespaceView;
-    RETIRED_TOOL_NAMES: ReadonlyMap<string, string>;
     protocolOf: (name: string) => CoreProtocolNamespaceView | undefined;
-    ruleToolGrammarOf: (toolName: string) => 'command' | 'path' | undefined;
+    ruleToolGrammarOf: (toolName: string) => RuleGrammarView | undefined;
     validatePermissionRules: (rules: PermissionRuleView[], opts?: ValidatePermissionRulesOptionsView) => PermissionRuleIssueView[];
-    DISCUSSION_WORKFLOW_NAME: string;
     mintNamespacePrefix(ns: CoreProtocolNamespaceView, peer: string): string;
     compileAllowList(entries: readonly string[], behavior: 'allow' | 'deny', roster?: ReadonlySet<string>): AllowListReadingView;
     routeKeyOf(url: string | undefined): string;
@@ -113,8 +117,9 @@ export interface CoreValuePorts {
     routePairingStatus(brain: {
         adjudicateRoute?(model: RouteModelView, perModelAuth?: PerModelAuthView): RouteAdjudicationView | undefined;
     }, model: RouteModelView, perModelAuth?: PerModelAuthView): RoutePairingStatusView;
+    judgeRuleToolName(name: string, roster: ReadonlySet<string>): RuleToolNameVerdictView;
 }
-export declare const CORE_VALUE_PORT_NAMES: readonly ["resolveAutonomousLoopPrompt", "loosenReasons", "combinePolicies", "createAllowDenyPolicy", "MCP_NAMESPACE", "RETIRED_TOOL_NAMES", "protocolOf", "ruleToolGrammarOf", "validatePermissionRules", "DISCUSSION_WORKFLOW_NAME", "mintNamespacePrefix", "compileAllowList", "routeKeyOf", "joinRequestUrl", "resolveRouteCredential", "adjudicateModelRoute", "routePairingStatus"];
+export declare const CORE_VALUE_PORT_NAMES: readonly ["resolveAutonomousLoopPrompt", "loosenReasons", "combinePolicies", "createAllowDenyPolicy", "MCP_NAMESPACE", "protocolOf", "ruleToolGrammarOf", "validatePermissionRules", "mintNamespacePrefix", "compileAllowList", "routeKeyOf", "joinRequestUrl", "resolveRouteCredential", "adjudicateModelRoute", "routePairingStatus", "judgeRuleToolName"];
 export type CoreValuePortName = (typeof CORE_VALUE_PORT_NAMES)[number];
 export declare function installCoreValuePorts(ports: Partial<CoreValuePorts> | null): () => void;
 export declare function hasCoreValuePorts(): boolean;
@@ -125,13 +130,12 @@ export declare function loosenReasons(prior: SessionPermissionRules, next: Sessi
 export declare function combinePolicies(...policies: CoreToolPolicyHandle[]): CoreToolPolicyHandle | undefined;
 export declare function createAllowDenyPolicy(opts: AllowDenyPolicyOptionsView): CoreToolPolicyHandle | undefined;
 export declare function mcpNamespace(): CoreProtocolNamespaceView | undefined;
-export declare function retiredToolNames(): ReadonlyMap<string, string> | undefined;
 export declare function protocolOf(name: string): CoreProtocolNamespaceView | undefined;
-export declare function ruleToolGrammarOf(toolName: string): 'command' | 'path' | undefined;
+export declare function ruleToolGrammarOf(toolName: string): RuleGrammarView | undefined;
 export declare function validatePermissionRules(rules: PermissionRuleView[], opts?: ValidatePermissionRulesOptionsView): PermissionRuleIssueView[] | undefined;
-export declare function discussionWorkflowName(): string | undefined;
 export declare function mintNamespacePrefix(ns: CoreProtocolNamespaceView, peer: string): string | undefined;
 export declare function compileAllowList(entries: readonly string[], behavior: 'allow' | 'deny', roster?: ReadonlySet<string>): AllowListReadingView | undefined;
+export declare function ruleToolNameJudgement(name: string, roster: ReadonlySet<string>): RuleToolNameVerdictView | undefined;
 export declare function routeKeyOf(url: string | undefined): string | undefined;
 export declare function joinRequestUrl(root: string | undefined, suffix: string): string | undefined;
 export declare function resolveRouteCredential(input: RouteCredentialInputView): RouteCredentialView | undefined;

package/dist/coreValuePorts.js

@@ -4,11 +4,9 @@ export const CORE_VALUE_PORT_NAMES = Object.freeze([
     'combinePolicies',
     'createAllowDenyPolicy',
     'MCP_NAMESPACE',
-    'RETIRED_TOOL_NAMES',
     'protocolOf',
     'ruleToolGrammarOf',
     'validatePermissionRules',
-    'DISCUSSION_WORKFLOW_NAME',
     'mintNamespacePrefix',
     'compileAllowList',
     'routeKeyOf',
@@ -16,6 +14,7 @@ export const CORE_VALUE_PORT_NAMES = Object.freeze([
     'resolveRouteCredential',
     'adjudicateModelRoute',
     'routePairingStatus',
+    'judgeRuleToolName',
 ]);
 let installed = null;
 export function installCoreValuePorts(ports) {
@@ -56,9 +55,6 @@ export function createAllowDenyPolicy(opts) {
 export function mcpNamespace() {
     return port('MCP_NAMESPACE');
 }
-export function retiredToolNames() {
-    return port('RETIRED_TOOL_NAMES');
-}
 export function protocolOf(name) {
     const fn = port('protocolOf');
     return fn === undefined ? undefined : fn(name);
@@ -71,9 +67,6 @@ export function validatePermissionRules(rules, opts) {
     const fn = port('validatePermissionRules');
     return fn === undefined ? undefined : fn(rules, opts);
 }
-export function discussionWorkflowName() {
-    return port('DISCUSSION_WORKFLOW_NAME');
-}
 export function mintNamespacePrefix(ns, peer) {
     const fn = port('mintNamespacePrefix');
     return fn === undefined ? undefined : fn(ns, peer);
@@ -82,6 +75,10 @@ export function compileAllowList(entries, behavior, roster) {
     const fn = port('compileAllowList');
     return fn === undefined ? undefined : fn(entries, behavior, roster);
 }
+export function ruleToolNameJudgement(name, roster) {
+    const fn = port('judgeRuleToolName');
+    return fn === undefined ? undefined : fn(name, roster);
+}
 export function routeKeyOf(url) {
     const fn = port('routeKeyOf');
     return fn === undefined ? undefined : fn(url);

package/dist/credentialProvenance.d.ts

@@ -0,0 +1,28 @@
+export declare const CREDENTIAL_ATTACH_WORDS: readonly ["local-sidecar", "service-token", "registry", "none"];
+export type CredentialAttachWord = (typeof CREDENTIAL_ATTACH_WORDS)[number];
+declare const TARGET_KIND_WORDS: readonly ["local-managed", "loopback-pin", "remote", "unresolved"];
+declare const TARGET_PROVENANCE_WORDS: readonly ["managed", "connect-pin", "manual", "none"];
+declare const CONSENT_WORDS: readonly ["granted", "absent", "n/a"];
+declare const SIDECAR_OWNERSHIP_WORDS: readonly ["verified", "mismatch"];
+export type CredentialTargetKind = (typeof TARGET_KIND_WORDS)[number];
+export type CredentialTargetProvenance = (typeof TARGET_PROVENANCE_WORDS)[number];
+export type CredentialConsent = (typeof CONSENT_WORDS)[number];
+export type CredentialSidecarOwnership = (typeof SIDECAR_OWNERSHIP_WORDS)[number];
+export interface CredentialFacts {
+    readonly kind: CredentialTargetKind;
+    readonly provenance?: CredentialTargetProvenance;
+    readonly sidecarOwnership?: CredentialSidecarOwnership;
+    readonly serviceTokenAtFirstWrite?: boolean;
+    readonly loggedIn?: boolean;
+    readonly consent?: CredentialConsent;
+}
+export type CredentialFactName = 'facts' | 'kind' | 'sidecarOwnership' | 'serviceTokenAtFirstWrite' | 'loggedIn' | 'provenance' | 'consent';
+export type CredentialProvenance = {
+    readonly kind: 'word';
+    readonly word: CredentialAttachWord;
+} | {
+    readonly kind: 'unreadable';
+    readonly reason: CredentialFactName;
+};
+export declare function credentialProvenance(facts: CredentialFacts): CredentialProvenance;
+export {};

package/dist/credentialProvenance.js

@@ -0,0 +1,76 @@
+export const CREDENTIAL_ATTACH_WORDS = Object.freeze(['local-sidecar', 'service-token', 'registry', 'none']);
+const TARGET_KIND_WORDS = ['local-managed', 'loopback-pin', 'remote', 'unresolved'];
+const TARGET_PROVENANCE_WORDS = ['managed', 'connect-pin', 'manual', 'none'];
+const CONSENT_WORDS = ['granted', 'absent', 'n/a'];
+const SIDECAR_OWNERSHIP_WORDS = ['verified', 'mismatch'];
+function said(word) {
+    const r = { kind: 'word', word };
+    return Object.freeze(r);
+}
+function unreadable(reason) {
+    const r = { kind: 'unreadable', reason };
+    return Object.freeze(r);
+}
+function ownData(holder, key) {
+    try {
+        if (typeof holder !== 'object' || holder === null)
+            return undefined;
+        const d = Object.getOwnPropertyDescriptor(holder, key);
+        return d !== undefined && Object.hasOwn(d, 'value') ? d.value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function ownBool(holder, key) {
+    const v = ownData(holder, key);
+    return typeof v === 'boolean' ? v : undefined;
+}
+function ownWord(holder, key, closed) {
+    const v = ownData(holder, key);
+    return typeof v === 'string' ? closed.find((w) => w === v) : undefined;
+}
+function decide(facts) {
+    if (typeof facts !== 'object' || facts === null || Array.isArray(facts))
+        return unreadable('facts');
+    const kind = ownWord(facts, 'kind', TARGET_KIND_WORDS);
+    if (kind === undefined)
+        return unreadable('kind');
+    if (kind === 'unresolved')
+        return said('none');
+    if (kind === 'local-managed') {
+        const owned = ownWord(facts, 'sidecarOwnership', SIDECAR_OWNERSHIP_WORDS);
+        if (owned === undefined)
+            return unreadable('sidecarOwnership');
+        return said(owned === 'verified' ? 'local-sidecar' : 'none');
+    }
+    const tokenAtFirstWrite = ownBool(facts, 'serviceTokenAtFirstWrite');
+    if (tokenAtFirstWrite === undefined)
+        return unreadable('serviceTokenAtFirstWrite');
+    if (tokenAtFirstWrite)
+        return said('service-token');
+    const loggedIn = ownBool(facts, 'loggedIn');
+    if (loggedIn === undefined)
+        return unreadable('loggedIn');
+    if (!loggedIn)
+        return said('none');
+    const provenance = ownWord(facts, 'provenance', TARGET_PROVENANCE_WORDS);
+    if (provenance === undefined)
+        return unreadable('provenance');
+    if (provenance !== 'connect-pin')
+        return said('none');
+    if (kind === 'remote')
+        return said('registry');
+    const consent = ownWord(facts, 'consent', CONSENT_WORDS);
+    if (consent === undefined || consent === 'n/a')
+        return unreadable('consent');
+    return said(consent === 'granted' ? 'registry' : 'none');
+}
+export function credentialProvenance(facts) {
+    try {
+        return decide(facts);
+    }
+    catch {
+        return unreadable('facts');
+    }
+}

package/dist/decideFailureNote.js

@@ -1,4 +1,4 @@
-import { corruptStoredRowContent, corruptStoredRowWhere } from './wireErrorTriage.js';
+import { corruptStoredRowContent, corruptStoredRowWhere, scenarioDenyFromError, scenarioNotAllowedContent } from './wireErrorTriage.js';
 import { checkpointUnsupportedVersionContent, checkpointUnsupportedVersionFromError, parkedResumeStartupContent, parkedResumeStartupFromError, resumePolicyBlockContent, resumePolicyBlockFromError, } from './resumeRefusalCopy.js';
 import { askGoneContent, askGoneFromError, decideParkMovedContent, decideParkMovedFromError } from './decideReceipt.js';
 import { settingsPermissionBucketRefusalContent, settingsPermissionBucketRefusalFromError } from './wireRefusalCopy.js';
@@ -9,12 +9,14 @@ export function decideFailureNote(err, decision) {
     const startup = parkedResumeStartupFromError(err, decision);
     const moved = decideParkMovedFromError(err);
     const bucket = settingsPermissionBucketRefusalFromError(err);
+    const scenario = scenarioDenyFromError(err);
     const unsupported = checkpointUnsupportedVersionFromError(err);
     const gone = askGoneFromError(err);
     const answerInvalid = decisionConflictOf(err) === 'answer_invalid';
     return ((where === undefined ? '' : ` — ${corruptStoredRowContent(where)}`) +
         (fold === null ? '' : ` — ${resumePolicyBlockContent(fold)}`) +
         (bucket === null ? '' : ` — ${settingsPermissionBucketRefusalContent(bucket)}`) +
+        (scenario === null ? '' : ` — ${scenarioNotAllowedContent(scenario, undefined, 'resumed_work')}`) +
         (startup === null ? '' : ` — ${parkedResumeStartupContent(startup)}`) +
         (moved === null ? '' : ` — ${decideParkMovedContent(moved)}`) +
         (unsupported === null ? '' : ` — ${checkpointUnsupportedVersionContent(unsupported)}`) +

package/dist/decideReceipt.js

@@ -2,7 +2,7 @@ import { gateOutcomeOf } from './gateOutcome.js';
 import { resumeReopenFromError } from './hitl/suspendedReopen.js';
 import { ASK_GONE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_PARK_FORKED, DECIDE_WORKFLOW_PARKS_UNREADABLE, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, isDecideParkMovedCode, } from './engineErrorCodes.js';
 import { effectiveWireErrorCode } from './wireErrorTriage.js';
-import { readErrorString, readErrorStrictStringList } from './wireFailureShape.js';
+import { readErrorString, readErrorStrictStringList, readThrownExtra } from './wireFailureShape.js';
 import { isCrashConvergedCause } from './hitl/crashConverged.js';
 import { askRowEndingCauseFor } from './hitl/approvalEndingCause.js';
 const STATUS_RESUMING = 'resuming';
@@ -143,14 +143,11 @@ function askGoneRawCause(e) {
     }
     if (typeof top === 'string')
         return top;
-    let extra;
-    try {
-        extra = e.extra;
-    }
-    catch {
-        extra = undefined;
-    }
-    if (typeof extra === 'object' && extra !== null && !Array.isArray(extra)) {
+    const reading = readThrownExtra(e);
+    if (reading.state === 'unreadable')
+        return undefined;
+    if (reading.state === 'object') {
+        const extra = reading.value;
         let hasCause = false;
         let word;
         try {
@@ -163,7 +160,7 @@ function askGoneRawCause(e) {
         if (hasCause)
             return word;
     }
-    return readErrorString(e, 'deniedReason');
+    return undefined;
 }
 export function askGoneFromError(e) {
     if (typeof e !== 'object' || e === null)

package/dist/declared/supportFloorDeclared.js

@@ -1,5 +1,5 @@
 export const DECLARED_SUPPORT_FLOOR = Object.freeze({
-    server: "7.115.0",
-    core: "7.40.1",
-    sdk: "19.0.0",
+    server: "7.125.0",
+    core: "7.48.0",
+    sdk: "20.0.0",
 });

package/dist/displayUntrusted.d.ts

@@ -8,9 +8,6 @@ export interface DisplayFace {
     readonly mark: DisplayMark;
     readonly keepBlanks?: boolean;
 }
-export declare const LEGACY_ESCAPE_FACE: DisplayFace;
-export declare const LEGACY_LABEL_FACE: DisplayFace;
-export declare const LEGACY_NAME_FACE: DisplayFace;
 export declare function applyDisplayFace(text: string, face: DisplayFace): string;
 export interface DisplayUntrustedOptions {
     readonly credentialUrls?: boolean;
@@ -33,10 +30,17 @@ export interface DisplayUntrustedMarked {
     readonly text: string;
     readonly marks: readonly DisplayMarkSpan[];
 }
+export declare const ESCAPE_FACE: DisplayFace;
+export declare const LABEL_FACE: DisplayFace;
+export declare const PEER_NAME_FACE: DisplayFace;
+export declare function capDisplay(text: string, max: number | undefined, mark: DisplayMark): string;
+export declare function paintAndCap(text: string, face: DisplayFace, max?: number): string;
 export declare function credentialWashPasses(text: string, opts?: DisplayUntrustedOptions | null): {
     passes: number;
     capped: boolean;
 };
 export declare function displayUntrusted(text: string, opts?: DisplayUntrustedOptions): string;
+export declare function queryCarriesCredential(query: string): boolean;
+export declare function displayConfiguredUrl(url: string, opts?: DisplayUntrustedOptions): string;
 export declare function quoteUntrustedForSentence(text: string, max: number): string | undefined;
 export declare function displayUntrustedMarks(text: string, opts?: DisplayUntrustedOptions): DisplayUntrustedMarked;