@sema-agent/client-core 0.97.0 → 0.98.0

package/dist/frameBinding.js

@@ -0,0 +1,23 @@
+const frameBindings = new WeakMap();
+export function registerFrameBinding(frame, binding) {
+    if (typeof frame !== 'object' || frame === null)
+        return;
+    if (binding.taskId === undefined && binding.sessionId === undefined)
+        return;
+    if (frameBindings.has(frame))
+        return;
+    frameBindings.set(frame, binding);
+}
+export function frameBindingOf(frame) {
+    if (typeof frame !== 'object' || frame === null)
+        return undefined;
+    return frameBindings.get(frame);
+}
+export function inheritFrameBinding(from, to) {
+    if (typeof from !== 'object' || from === null || typeof to !== 'object' || to === null || from === to)
+        return to;
+    const binding = frameBindings.get(from);
+    if (binding !== undefined && !frameBindings.has(to))
+        frameBindings.set(to, binding);
+    return to;
+}

package/dist/gateFailureCodes.d.ts

@@ -0,0 +1,2 @@
+export declare function isGateStandingErrorCode(code: string | null | undefined, retriable?: boolean): boolean;
+export declare function isCodeClassifiedGateFailure(code: string | null | undefined, retriable?: boolean): boolean;

package/dist/gateFailureCodes.js

@@ -0,0 +1,15 @@
+import { DECIDE_WORKFLOW_PARK_FORKED, DECIDE_WORKFLOW_PARKS_UNREADABLE, PARKED_RESUME_STARTUP_FAILED, RESUME_POLICY_FOLD_CODE, RESUME_REOPEN_CODES, RESUME_RETRY_LATER_CODES, isRefusedParkCode } from './engineErrorCodes.js';
+import { RESUME_REFUSAL_CODES } from './resumeRefusalCopy.js';
+export function isGateStandingErrorCode(code, retriable) {
+    return (code === RESUME_POLICY_FOLD_CODE ||
+        code === 'corrupt' ||
+        (isRefusedParkCode(code) && retriable === true) ||
+        (typeof code === 'string' && RESUME_REOPEN_CODES.includes(code) && retriable === true) ||
+        code === DECIDE_WORKFLOW_PARKS_UNREADABLE ||
+        code === DECIDE_WORKFLOW_PARK_FORKED);
+}
+export function isCodeClassifiedGateFailure(code, retriable) {
+    return (isGateStandingErrorCode(code, retriable) ||
+        code === PARKED_RESUME_STARTUP_FAILED ||
+        (typeof code === 'string' && (RESUME_RETRY_LATER_CODES.includes(code) || RESUME_REFUSAL_CODES.includes(code))));
+}

package/dist/gateOutcome.d.ts

@@ -32,7 +32,7 @@ export interface GateModeReleaseView {
     mandate?: string;
     reason?: string;
 }
-export declare const GATE_MODE_RELEASE_REASON_WORDS: readonly ["rule_unreadable", "target_unresolved"];
+export declare const GATE_MODE_RELEASE_REASON_WORDS: readonly ["target_unresolved"];
 export type GateModeReleaseReasonWord = (typeof CORE_MODE_RELEASE_REASONS)[number];
 export declare function isGateModeReleaseReasonWord(v: unknown): v is GateModeReleaseReasonWord;
 export declare function modeReleaseReasonSentence(reason: string | null | undefined): string | undefined;
@@ -58,10 +58,12 @@ export interface SettlementView {
     when?: number;
     note?: string;
 }
+export type GateRecordSeat = 'settlement' | 'cause' | 'classifier';
 export interface GateOutcomeView {
     disposition: GateDispositionView;
     settlement?: SettlementView;
     origin?: string;
+    unreadable?: readonly GateRecordSeat[];
 }
 export declare function gateOutcomeOf(frame: unknown): GateOutcomeView | undefined;
 export declare function isGateParkedToolEnd(frame: unknown): boolean;

package/dist/gateOutcome.js

@@ -10,7 +10,6 @@ export function isGateModeReleaseReasonWord(v) {
     return typeof v === 'string' && CORE_MODE_RELEASE_REASONS.includes(v);
 }
 const MODE_RELEASE_SENTENCE_BY_REASON = Object.freeze({
-    rule_unreadable: 'The permission mode let this call run without asking, even though it could not be checked against your saved permission rules.',
     target_unresolved: 'The permission mode let this call run without asking, even though it could not be determined where its write lands on disk, so whether it lands on a guarded location is unknown.',
 });
 const MODE_RELEASE_UNRECOGNISED_SENTENCE = 'The permission mode let this call run without asking, for a reason this client does not recognise.';
@@ -65,6 +64,9 @@ export function createReleaseDisclosureLedger() {
     });
 }
 export const SETTLEMENT_KIND_WORDS = CORE_SETTLEMENT_KINDS;
+function isGateRecordSeat(x) {
+    return x === 'settlement' || x === 'cause' || x === 'classifier';
+}
 function readWho(v) {
     if (typeof v !== 'object' || v === null || Array.isArray(v))
         return undefined;
@@ -151,6 +153,15 @@ function readClassifierRound(raw) {
     }
     return view;
 }
+function carriedUnreadableSeats(v) {
+    const out = new Set();
+    if (!Array.isArray(v))
+        return out;
+    for (const x of v)
+        if (isGateRecordSeat(x))
+            out.add(x);
+    return out;
+}
 function readGateRecord(frame) {
     if (typeof frame !== 'object' || frame === null || Array.isArray(frame))
         return undefined;
@@ -158,6 +169,7 @@ function readGateRecord(frame) {
     if (typeof g !== 'object' || g === null || Array.isArray(g))
         return undefined;
     const raw = g;
+    const carried = carriedUnreadableSeats(raw.unreadable);
     const d = raw.disposition;
     if (typeof d !== 'object' || d === null || Array.isArray(d))
         return undefined;
@@ -180,7 +192,7 @@ function readGateRecord(frame) {
         if (deniedBy === undefined)
             return undefined;
         const causeRaw = dr.cause;
-        causePresent = causeRaw !== undefined;
+        causePresent = causeRaw !== undefined || carried.has('cause');
         const cause = str(causeRaw);
         const mode = str(dr.mode);
         const askClass = str(dr.askClass);
@@ -201,15 +213,24 @@ function readGateRecord(frame) {
     const settlementRaw = raw.settlement;
     const settlement = readSettlement(settlementRaw);
     const origin = readAskOrigin(raw);
+    const settlementPresent = settlementRaw !== undefined || carried.has('settlement');
+    const classifierPresent = classifierRaw !== undefined || carried.has('classifier');
+    const missing = {
+        settlement: settlementPresent && settlement === undefined,
+        cause: causePresent && disposition.kind === 'denied' && disposition.cause === undefined,
+        classifier: classifierPresent && disposition.classifier === undefined,
+    };
+    const unreadable = Object.keys(missing).filter((seat) => missing[seat]);
     return {
         view: {
             disposition,
             ...(settlement !== undefined ? { settlement } : {}),
             ...(origin !== undefined ? { origin } : {}),
+            ...(unreadable.length > 0 ? { unreadable: Object.freeze(unreadable) } : {}),
         },
-        settlementPresent: settlementRaw !== undefined,
+        settlementPresent,
         causePresent,
-        classifierPresent: classifierRaw !== undefined,
+        classifierPresent,
     };
 }
 export function gateOutcomeOf(frame) {
@@ -257,8 +278,6 @@ export function ccToolDenialKindForToolEnd(frame) {
     const stamped = frame._sema_denial_kind;
     if (isCcToolDenialKind(stamped))
         return stamped;
-    if (frame._sema_denial_unclassified === true)
-        return undefined;
     const record = readGateRecord(frame);
     const outcome = record?.view;
     const kind = outcome?.settlement?.kind;

package/dist/gateVocabulary.d.ts

@@ -9,6 +9,11 @@ export declare const GATE_DENIED_BY_WORDS: readonly GateDeniedByWord[];
 export declare function isGateDeniedByWord(v: unknown): v is GateDeniedByWord;
 export declare function gateDeniedByDetail(deniedBy: unknown): string;
 export declare function askOriginDetail(origin: unknown): string;
+export declare function askOriginNoteOf(origin: string | undefined): string | undefined;
+export declare function ruleOffersAbsenceDetail(reason: string | undefined, opts?: {
+    readonly deploymentListSessionRow?: boolean;
+}): string | undefined;
+export declare function ruleOfferUncoveredDetail(reason: string | undefined): string;
 export declare function mandatedApprovalDetail(): string;
 export declare const APPROVAL_MANDATE_WORDS: readonly (typeof CORE_PERSISTED_RULE_MANDATES)[number][];
 export type ApprovalMandateWord = (typeof APPROVAL_MANDATE_WORDS)[number];

package/dist/gateVocabulary.js

@@ -1,4 +1,5 @@
 import { CORE_DENIED_BY_VALUES, CORE_PERSISTED_RULE_MANDATES } from './generated/engineFactTables.js';
+import { guardedRead, readOwnDataValue } from './ownKey.js';
 export const CC_TOOL_DENIAL_KINDS = Object.freeze([
     'user-rejected',
     'permission-rule',
@@ -48,6 +49,7 @@ export function gateDeniedByDetail(deniedBy) {
 }
 const ASK_ORIGIN_SENTENCES = Object.freeze({
     content_question: 'the tool itself asked you a question',
+    plan_review: 'the model paused its run for your verdict on the plan it proposed',
     ancestor_marked: 'an ancestor marked this call (an inherited approver-unavailable float, or a durable mandate; this client cannot tell which from the origin alone): it must reach the park with no synchronous decision-maker in between',
     org_unavailable: 'the organization policy was unavailable, so this call asks',
     org_rule: 'an organization rule asks about this call',
@@ -57,7 +59,7 @@ const ASK_ORIGIN_SENTENCES = Object.freeze({
     denial_limit_fallback: 'the auto-mode classifier hit its denial limit and handed this call back to you',
     shell_gate_tighten: 'the coarse shell check rates this command above the tier it lets through, so it asks',
     safety_tighten: 'the gate tightened on this call’s own facts (network egress, irreversibility, or a protected write; this client cannot tell which from the origin alone)',
-    policy: 'this deployment’s permission policy asks about this call',
+    policy: 'this deployment’s permission policy, or the permission mode’s default, asks about this call',
 });
 export function askOriginDetail(origin) {
     const known = typeof origin === 'string' && Object.hasOwn(ASK_ORIGIN_SENTENCES, origin)
@@ -66,7 +68,67 @@ export function askOriginDetail(origin) {
     if (known !== undefined)
         return known;
     const word = typeof origin === 'string' && origin.length > 0 ? origin : '(none)';
-    return `this call asks; its origin ${word} is a word newer than this client, so answer it as usual`;
+    return unknownAskOriginSentence(word);
+}
+function unknownAskOriginSentence(word) {
+    return `this call asks; its origin ${word === undefined ? '' : `${word} `}is a word newer than this client, so answer it as usual`;
+}
+const ASK_ORIGIN_QUIET = Object.freeze({
+    content_question: true,
+    plan_review: true,
+    ancestor_marked: false,
+    org_unavailable: false,
+    org_rule: false,
+    rule_store_unavailable: false,
+    hook: false,
+    ask_rule: true,
+    denial_limit_fallback: false,
+    shell_gate_tighten: false,
+    safety_tighten: false,
+    policy: true,
+});
+export function askOriginNoteOf(origin) {
+    if (typeof origin !== 'string' || origin === '')
+        return undefined;
+    if (Object.hasOwn(ASK_ORIGIN_QUIET, origin)) {
+        return ASK_ORIGIN_QUIET[origin] === true ? undefined : askOriginDetail(origin);
+    }
+    return unknownAskOriginSentence(undefined);
+}
+const NO_REMEMBER_HEAD = 'no "don\'t ask again" option here';
+const RULE_OFFERS_ABSENCE_LINES = Object.freeze({
+    mandated: { line: null },
+    allow_outranked: {
+        line: `${NO_REMEMBER_HEAD}: an allow rule already matches this call, but this question outranks it — another allow rule would be outranked the same way`,
+    },
+    ask_rule_matched: {
+        line: `${NO_REMEMBER_HEAD}: an ask rule matches this call and keeps asking — an allow rule changes nothing while it stands; to stop being asked, review your ask rules`,
+        deploymentList: `${NO_REMEMBER_HEAD}: this deployment asks about every call to this tool and your own rules cannot switch that off — the "in this session" option stops it asking again until the session ends`,
+    },
+    lane_cannot_speak: { line: `${NO_REMEMBER_HEAD}: this approval lane cannot persist rules` },
+});
+export function ruleOffersAbsenceDetail(reason, opts) {
+    if (typeof reason !== 'string' || reason === '')
+        return undefined;
+    if (Object.hasOwn(RULE_OFFERS_ABSENCE_LINES, reason)) {
+        const entry = RULE_OFFERS_ABSENCE_LINES[reason];
+        if (entry.line === null)
+            return undefined;
+        const onList = guardedRead(() => readOwnDataValue(opts, 'deploymentListSessionRow')) === true;
+        return onList && entry.deploymentList !== undefined ? entry.deploymentList : entry.line;
+    }
+    return `${NO_REMEMBER_HEAD} (the reason is one this build does not know yet)`;
+}
+const RULE_OFFER_UNCOVERED_LINES = Object.freeze({
+    redirection: 'always asks (shell redirection)',
+    no_rule_form: 'no coverable rule form',
+    cap_overflow: 'trimmed by the offer cap',
+});
+export function ruleOfferUncoveredDetail(reason) {
+    if (typeof reason === 'string' && Object.hasOwn(RULE_OFFER_UNCOVERED_LINES, reason)) {
+        return RULE_OFFER_UNCOVERED_LINES[reason];
+    }
+    return 'a reason this build does not know yet';
 }
 export function mandatedApprovalDetail() {
     return 'no saved allow rule and no remembered answer can retire this question; each call is settled on its own — by you here or by an automatic check the deployment runs — and an answer covers only that call';

package/dist/generated/engineAskFaceTables.js

@@ -7,6 +7,6 @@ export const CORE_SHELL_FACE_TOOL_NAMES = Object.freeze([
     "Monitor",
 ]);
 export const CORE_RELEASABLE_ASK_CLASSES_BY_FACE = Object.freeze({
-    "shell": Object.freeze(["transcript_write", "rule_unreadable", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
-    "other": Object.freeze(["transcript_write", "rule_unreadable", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
+    "shell": Object.freeze(["transcript_write", "target_unresolved", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
+    "other": Object.freeze(["transcript_write", "probe", "write_protection", "tool_marks_mcp", "tool_marks_a2a", "artifact_shared_read", "mode", "unstated", "ordinary"]),
 });

package/dist/generated/engineFactTables.d.ts

@@ -8,7 +8,7 @@ export declare const CORE_DENIED_BY_VALUES: readonly ["policy", "hook", "org", "
 export declare const CORE_PERMISSION_MODE_FOLD_REASONS: readonly string[];
 export declare const CORE_ENGINE_CARD_TYPES: readonly string[];
 export declare const CORE_TOOL_DECLARATION_CODES: readonly string[];
-export declare const CORE_MODE_RELEASE_REASONS: readonly ["rule_unreadable", "target_unresolved"];
+export declare const CORE_MODE_RELEASE_REASONS: readonly ["target_unresolved"];
 export declare const CORE_HOOK_TOOL_ALIASES: Readonly<Record<string, string>>;
 export declare const CORE_ASK_EVIDENCE_ABSENCE_VALUES: readonly ["not_wired", "not_adjudicated", "unavailable", "no_match", "not_reported"];
 export declare const CORE_SYSTEM_INJECTION_PRIORITIES: readonly ["now", "next", "later"];
@@ -21,9 +21,9 @@ export interface CoreModeArbitrationRow {
     readonly ruleMayClear: boolean;
     readonly hookAskFloor: boolean;
 }
-export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "governance_unavailable" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "target_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
+export declare const CORE_MODE_ARBITRATION: Readonly<Record<"content_question" | "hook" | "ancestor" | "dangerous_delete" | "unverifiable_delete" | "unverifiable_shell_text" | "transcript_write" | "org_rule" | "rule_unreadable" | "ask_rule" | "denial_limit_fallback" | "classifier_no_ruling" | "requires_user_interaction" | "operator_forced" | "shell_floor" | "target_unresolved" | "probe" | "write_protection" | "tool_marks_mcp" | "tool_marks_a2a" | "policy_rra" | "artifact_shared_read" | "mode" | "unstated" | "ordinary", CoreModeArbitrationRow>>;
 export declare const CORE_SKILL_GRANT_ORIGINS: readonly ["model", "user", "inherited"];
-export declare const CORE_ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "content_unsupported", "grammar", "tool_name", "near_miss"];
+export declare const CORE_ALLOW_ENTRY_INERT_REASONS: readonly ["wildcard_all", "namespace_wildcard", "content_unsupported", "grammar", "tool_name", "near_miss", "earlier_grammar"];
 export declare const CORE_ALLOW_RULE_MEMBERS: readonly ["hook", "deployment", "persisted", "skill", "request"];
 export declare const CORE_RULE_TOOL_NAME_VERDICTS: readonly ["current", "retired", "unprefixed_namespace", "unmintable_segment"];
 export declare const CORE_SETTLEMENT_KINDS: readonly ["human_allowed", "human_refused", "approval_window_expired", "denial_limit_window_expired", "park_sla_expired", "no_approver", "approver_unavailable", "approver_error", "approver_contract", "presentation_failed", "blanket_allow_refused", "policy_allowed", "policy_refused", "task_aborted"];
@@ -42,3 +42,6 @@ export declare const CORE_PROMPT_BLOCK_CAUSES: readonly ["block", "crashed", "ti
 export declare const CORE_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "auto", "bypassPermissions", "dontAsk"];
 export declare const CORE_APPROVAL_REACH: readonly ["none"];
 export declare const CORE_PERSISTED_RULE_MANDATES: readonly ["operator_always", "tool_marks", "probe_mandate", "probe_unanswered", "write_protection", "target_unresolved"];
+export declare const CORE_TASK_NOTIFICATION_TERMINAL_STATUSES: readonly ["completed", "failed", "killed", "cancelled"];
+export declare const CORE_RESUME_STARTUP_CAUSES: readonly ["environment", "session_gone", "tool_unavailable", "configuration", "decision_rejected"];
+export declare const CORE_BUILTIN_SUBAGENT_TYPES: readonly ["Explore", "Plan", "fork", "general-purpose"];

package/dist/generated/engineFactTables.js

@@ -112,7 +112,6 @@ export const CORE_TOOL_DECLARATION_CODES = Object.freeze([
     "config.reserved_tool_name",
 ]);
 export const CORE_MODE_RELEASE_REASONS = Object.freeze([
-    "rule_unreadable",
     "target_unresolved",
 ]);
 export const CORE_HOOK_TOOL_ALIASES = Object.freeze(Object.assign(Object.create(null), Object.fromEntries([
@@ -146,12 +145,11 @@ export const CORE_MODE_ARBITRATION = Object.freeze({
     "hook": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "ancestor": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "dangerous_delete": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
-    "unverifiable_delete": Object.freeze({ bypassImmune: true, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
+    "unverifiable_delete": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "unverifiable_shell_text": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "transcript_write": Object.freeze({ bypassImmune: false, classifierEligible: true, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "org_rule": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
-    "governance_unavailable": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
-    "rule_unreadable": Object.freeze({ bypassImmune: false, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
+    "rule_unreadable": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "ask_rule": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: true }),
     "denial_limit_fallback": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
     "classifier_no_ruling": Object.freeze({ bypassImmune: true, classifierEligible: false, sandboxAdmission: false, ruleMayClear: false, hookAskFloor: false }),
@@ -181,6 +179,7 @@ export const CORE_ALLOW_ENTRY_INERT_REASONS = Object.freeze([
     "grammar",
     "tool_name",
     "near_miss",
+    "earlier_grammar",
 ]);
 export const CORE_ALLOW_RULE_MEMBERS = Object.freeze([
     "hook",
@@ -281,3 +280,22 @@ export const CORE_PERSISTED_RULE_MANDATES = Object.freeze([
     "write_protection",
     "target_unresolved",
 ]);
+export const CORE_TASK_NOTIFICATION_TERMINAL_STATUSES = Object.freeze([
+    "completed",
+    "failed",
+    "killed",
+    "cancelled",
+]);
+export const CORE_RESUME_STARTUP_CAUSES = Object.freeze([
+    "environment",
+    "session_gone",
+    "tool_unavailable",
+    "configuration",
+    "decision_rejected",
+]);
+export const CORE_BUILTIN_SUBAGENT_TYPES = Object.freeze([
+    "Explore",
+    "Plan",
+    "fork",
+    "general-purpose",
+]);

package/dist/generated/engineNoticeTables.js

@@ -8,6 +8,7 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "config.read_face_deployment_clamped",
     "config.write_face_swapped",
     "config.write_face_deployment_clamped",
+    "config.read_deny_swapped",
     "config.tool_model_gate_removed",
     "config.tool_model_gate_unknown_class",
     "config.tool_model_gate_env_invalid",
@@ -85,10 +86,12 @@ export const CORE_ENGINE_NOTICE_CODES = Object.freeze([
     "skills.listing_truncated",
     "agents.listing_truncated",
     "tool_result.offload_put_failed",
+    "tool_result.media_refused",
     "instructions.source_changed",
     "session.records_skipped",
     "memory.layer_locked_legacy",
     "server.model_unreachable",
+    "permission.entry_mode_clamped",
 ]);
 export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "config.autocompact_window_clamped": "operator",
@@ -100,6 +103,7 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "config.read_face_deployment_clamped": "operator",
     "config.write_face_swapped": "operator",
     "config.write_face_deployment_clamped": "operator",
+    "config.read_deny_swapped": "operator",
     "config.tool_model_gate_removed": "operator",
     "config.tool_model_gate_unknown_class": "operator",
     "config.tool_model_gate_env_invalid": "operator",
@@ -177,10 +181,12 @@ export const CORE_NOTICE_AUDIENCE = Object.freeze({
     "skills.listing_truncated": "operator",
     "agents.listing_truncated": "operator",
     "tool_result.offload_put_failed": "operator",
+    "tool_result.media_refused": "operator",
     "instructions.source_changed": "user",
     "session.records_skipped": "user",
     "memory.layer_locked_legacy": "operator",
     "server.model_unreachable": "user",
+    "permission.entry_mode_clamped": "user",
 });
 export const CORE_MCP_INJECTION_DROP_REASONS = Object.freeze([
     "malformed_entry",
@@ -198,6 +204,7 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "config.read_face_deployment_clamped": "engine",
     "config.write_face_swapped": "engine",
     "config.write_face_deployment_clamped": "engine",
+    "config.read_deny_swapped": "engine",
     "config.tool_model_gate_removed": "engine",
     "config.tool_model_gate_unknown_class": "engine",
     "config.tool_model_gate_env_invalid": "engine",
@@ -275,10 +282,12 @@ export const CORE_NOTICE_MINTER = Object.freeze({
     "skills.listing_truncated": "engine",
     "agents.listing_truncated": "engine",
     "tool_result.offload_put_failed": "engine",
+    "tool_result.media_refused": "engine",
     "instructions.source_changed": "server",
     "session.records_skipped": "server",
     "memory.layer_locked_legacy": "server",
     "server.model_unreachable": "server",
+    "permission.entry_mode_clamped": "server",
 });
 export const CORE_USER_INPUT_UNDRAINED_CAUSES = Object.freeze([
     "leg_end",

package/dist/generated/toolNameTables.d.ts

@@ -1,2 +1,3 @@
 export declare const CORE_PROTOCOL_PREFIXES: readonly ["mcp__", "a2a__"];
 export declare const CORE_SKILL_TOOL_NAME: "Skill";
+export declare const CORE_BOUND_GRANT_ABSENCES: readonly ["not_bindable", "unreadable"];

package/dist/generated/toolNameTables.js

@@ -1,2 +1,3 @@
 export const CORE_PROTOCOL_PREFIXES = ["mcp__", "a2a__"];
 export const CORE_SKILL_TOOL_NAME = "Skill";
+export const CORE_BOUND_GRANT_ABSENCES = ["not_bindable", "unreadable"];

package/dist/hitl/allowRuleShadow.d.ts

@@ -11,10 +11,15 @@ export interface AllowRuleShadowedWireMember {
     readonly omitted?: number;
 }
 export interface ApprovalAllowRuleShadow {
-    readonly source: 'allow_rule_shadowed' | 'legacy_shadowed_rule';
+    readonly source: 'allow_rule_shadowed';
     readonly members: readonly ApprovalAllowRuleShadowMember[];
     readonly unreadable?: true;
 }
+export declare const RETIRED_SHADOW_EVIDENCE_LABEL: Readonly<{
+    readonly frame: "persistedRuleShadowed";
+    readonly row: "riskDescriptor.shadowedRule";
+}>;
+export declare function retiredAllowRuleShadowKeyPresent(carrier: object | null | undefined, leg: 'frame' | 'row'): boolean;
 export declare function readAllowRuleShadowFromWire(carrier: object | null | undefined, leg: 'frame' | 'row'): ApprovalAllowRuleShadow | undefined;
 export declare function readApprovalAllowRuleShadow(card: object | null | undefined): ApprovalAllowRuleShadow | undefined;
 export declare function approvalAllowRuleShadowed(card: object | null | undefined): boolean;

package/dist/hitl/allowRuleShadow.js

@@ -76,20 +76,27 @@ function readNewKeyValue(raw) {
         return unreadable();
     return Object.freeze({ source: 'allow_rule_shadowed', members: Object.freeze(members) });
 }
-function readLegacyValue(raw) {
-    if (typeof raw !== 'string' || raw.trim() === '')
-        return undefined;
-    return Object.freeze({
-        source: 'legacy_shadowed_rule',
-        members: Object.freeze([freezeMember({ member: 'persisted', known: true, entries: Object.freeze([raw]) })]),
-    });
-}
 function ownValue(v, key) {
     return Object.hasOwn(v, key) ? v[key] : undefined;
 }
 function keyValue(v, key) {
     return v[key];
 }
+const RETIRED_SHADOW_KEY = Object.freeze({ frame: 'persistedRuleShadowed', row: 'shadowedRule' });
+export const RETIRED_SHADOW_EVIDENCE_LABEL = Object.freeze({ frame: 'persistedRuleShadowed', row: 'riskDescriptor.shadowedRule' });
+export function retiredAllowRuleShadowKeyPresent(carrier, leg) {
+    try {
+        if (typeof carrier !== 'object' || carrier === null)
+            return false;
+        const host = leg === 'row' ? keyValue(carrier, 'riskDescriptor') : carrier;
+        if (typeof host !== 'object' || host === null)
+            return false;
+        return RETIRED_SHADOW_KEY[leg] in host;
+    }
+    catch {
+        return true;
+    }
+}
 function readMemberAt(arr, i) {
     const d = Object.getOwnPropertyDescriptor(arr, i);
     return d !== undefined && 'value' in d ? readMemberRecord(d.value) : freezeMember({ known: false, malformed: true });
@@ -105,10 +112,7 @@ export function readAllowRuleShadowFromWire(carrier, leg) {
         }
         if (host === undefined)
             return undefined;
-        const fresh = readNewKeyValue(keyValue(host, 'allowRuleShadowed'));
-        if (fresh !== undefined)
-            return fresh;
-        return readLegacyValue(keyValue(host, leg === 'row' ? 'shadowedRule' : 'persistedRuleShadowed'));
+        return readNewKeyValue(keyValue(host, 'allowRuleShadowed'));
     }
     catch {
         return unreadable();
@@ -119,7 +123,7 @@ function readStampedValue(raw) {
         return unreadable();
     const source = ownValue(raw, 'source');
     const members = ownValue(raw, 'members');
-    if ((source !== 'allow_rule_shadowed' && source !== 'legacy_shadowed_rule') || !Array.isArray(members))
+    if (source !== 'allow_rule_shadowed' || !Array.isArray(members))
         return unreadable();
     const length = members.length;
     if (typeof length !== 'number' || !Number.isSafeInteger(length))
@@ -159,7 +163,7 @@ const ENTRY_MAX = 4096;
 const MEMBER_MAX = 64;
 const ENTRIES_SHOWN = 5;
 const UNREADABLE_LINE = 'An allow rule matched this call but cannot clear it; which rule could not be read, so this one is confirmed individually.';
-function legacySingleEntry(shadow) {
+function singlePersistedEntry(shadow) {
     if (shadow.unreadable === true || shadow.members.length !== 1)
         return undefined;
     const m = shadow.members[0];
@@ -196,9 +200,9 @@ export function allowRuleShadowSentence(card) {
     try {
         if (shadow.unreadable === true || shadow.members.length === 0)
             return UNREADABLE_LINE;
-        const legacy = legacySingleEntry(shadow);
-        if (legacy !== undefined) {
-            return `Your saved permission rule ${legacy} still exists — it just cannot clear this particular call, so this one is confirmed individually.`;
+        const single = singlePersistedEntry(shadow);
+        if (single !== undefined) {
+            return `Your saved permission rule ${single} still exists — it just cannot clear this particular call, so this one is confirmed individually.`;
         }
         return `Allow rules matched this call but cannot clear it, so this one is confirmed individually — ${shadow.members.map(memberPhrase).join(' · ')}.`;
     }

package/dist/hitl/approvalCardReading.d.ts

@@ -0,0 +1,15 @@
+import type { ApprovalCardRequest } from './toolApprovalWire.js';
+export declare function readRequiresRealApproval(carrier: object | null | undefined): boolean;
+export interface ApprovalWindowKeys {
+    readonly expiresInMs?: number;
+    readonly expiresAtMs?: number;
+    readonly serverNowMs?: number;
+    readonly receivedAtMs?: number;
+}
+export interface ApprovalWindowReadOpts {
+    readonly windowIsCurrent?: boolean;
+    readonly receivedAtMs?: number;
+    readonly unknownShape?: boolean;
+}
+export declare function approvalWindowKeysOf(carrier: object | null | undefined, opts?: ApprovalWindowReadOpts | null): Readonly<ApprovalWindowKeys>;
+export declare function probeCauseRowsOf(card: Pick<ApprovalCardRequest, 'probeCause'> | null | undefined): readonly string[] | undefined;