@sema-agent/client-core 0.97.0 → 0.98.0

package/dist/controlRouter.js

@@ -1,5 +1,7 @@
 import { cancelConflictContent, cancelConflictFromError } from './wireRefusalCopy.js';
+import { PROTOCOL_ERROR_NAME, protocolErrorNameOf } from './wireFailureShape.js';
 import { steerPriorityMode } from './steerPriorityCapability.js';
+import { preemptReadingOfAck, preemptReadingOfError } from './preemptWire.js';
 export class ControlSafetyError extends Error {
     code;
     cause;
@@ -86,8 +88,11 @@ export class ControlRouter {
         if (this.taskId === null) {
             throw controlSafetyRefusal('not_found', 'no run in flight to cancel');
         }
+        return this.cancelRun(this.taskId, opts);
+    }
+    async cancelRun(taskId, opts) {
         try {
-            return await this.client.runs.cancel(this.taskId, opts?.signal !== undefined ? { signal: opts.signal } : undefined);
+            return await this.client.runs.cancel(taskId, opts?.signal !== undefined ? { signal: opts.signal } : undefined);
         }
         catch (e) {
             const conflict = cancelConflictFromError(e);
@@ -100,6 +105,53 @@ export class ControlRouter {
             throw e;
         }
     }
+    async preempt(opts) {
+        const taskId = this.taskId;
+        if (taskId === null)
+            return Object.freeze({ kind: 'no-run' });
+        let signal;
+        let fallback = 'cancel';
+        try {
+            const s = opts?.signal;
+            if (s !== undefined && s !== null)
+                signal = s;
+            const f = opts?.onUnavailable;
+            if (f !== undefined && f !== 'cancel')
+                fallback = 'report';
+        }
+        catch {
+            fallback = 'report';
+        }
+        let verb;
+        let slice;
+        try {
+            slice = this.client.assistant;
+            const v = slice?.preempt;
+            if (typeof v === 'function')
+                verb = v;
+        }
+        catch {
+            verb = undefined;
+        }
+        let reading;
+        if (verb === undefined) {
+            reading = { kind: 'lane-absent' };
+        }
+        else {
+            try {
+                reading = preemptReadingOfAck(taskId, await verb.call(slice, taskId, signal !== undefined ? { signal } : undefined));
+            }
+            catch (e) {
+                reading = preemptReadingOfError(e);
+            }
+        }
+        if (reading.kind !== 'lane-absent')
+            return Object.freeze(reading);
+        if (fallback === 'report')
+            return Object.freeze({ kind: 'unavailable' });
+        const ack = await this.cancelRun(taskId, signal !== undefined ? { signal } : undefined);
+        return Object.freeze({ kind: 'cancelled-instead', ack });
+    }
 }
 export function errCodes(e) {
     if (!e || typeof e !== 'object')
@@ -122,16 +174,16 @@ const STEERING_CODE_TO_SAFETY = new Map([
     ['steering.blocked_by_hook', 'blocked_by_hook'],
     ['steering.ledger_unavailable', 'ledger_unavailable'],
 ]);
-const STEERING_NAME_TO_SAFETY = new Map([
-    ['SteeringNotRunningError', 'not_running'],
-    ['SteeringInvalidContentError', 'invalid_content'],
-    ['SteeringAmbiguousTargetError', 'ambiguous_target'],
-    ['SteeringStillRunningError', 'still_running'],
-    ['SteeringLedgerUnavailableError', 'ledger_unavailable'],
-    ['SteeringQueueFullError', 'queue_full'],
-    ['SteeringDuplicateInputIdError', 'duplicate_input_id'],
-    ['SteeringError', 'steering_other'],
-]);
+const STEERING_NAME_TO_SAFETY = {
+    SteeringNotRunningError: 'not_running',
+    SteeringInvalidContentError: 'invalid_content',
+    SteeringAmbiguousTargetError: 'ambiguous_target',
+    SteeringStillRunningError: 'still_running',
+    SteeringLedgerUnavailableError: 'ledger_unavailable',
+    SteeringQueueFullError: 'queue_full',
+    SteeringDuplicateInputIdError: 'duplicate_input_id',
+    SteeringError: 'steering_other',
+};
 const STEERING_COPY = {
     not_running: {
         happened: 'that run is not accepting messages right now — it has just finished, is running on another server, or is not the active run of its session',
@@ -232,13 +284,12 @@ function steeringSafetyOf(e, verdict) {
     return refused !== undefined && refused.safety === verdict ? verdict : 'steering_other';
 }
 function steeringVerdict(e) {
-    const { code, name } = errCodes(e);
+    const { code } = errCodes(e);
     if (typeof code === 'string' && code.startsWith('steering.')) {
         return STEERING_CODE_TO_SAFETY.get(code) ?? 'steering_other';
     }
-    if (typeof name === 'string')
-        return STEERING_NAME_TO_SAFETY.get(name);
-    return undefined;
+    const protocolName = protocolErrorNameOf(e);
+    return protocolName !== undefined ? STEERING_NAME_TO_SAFETY[protocolName] : undefined;
 }
 export function steerRefusalAdviceOf(e) {
     try {
@@ -308,6 +359,6 @@ export function steerBodyOf(input, reading) {
     return Object.freeze({ ...base, priority });
 }
 function isNotFound(e) {
-    const { name, status } = errCodes(e);
-    return name === 'NotFoundError' || status === 404;
+    const { status } = errCodes(e);
+    return status === 404 || (typeof e === 'object' && e !== null && protocolErrorNameOf(e) === PROTOCOL_ERROR_NAME.NotFoundError);
 }

package/dist/coreValuePorts.d.ts

@@ -73,7 +73,7 @@ export interface RouteCredentialView {
 }
 export type RouteAdjudicationView = {
     ok: true;
-    posture: 'per-model' | 'paired' | 'unpinned' | 'keyless' | (string & {});
+    posture: 'per-model' | 'paired' | 'keyless' | (string & {});
 } | {
     ok: false;
     code: 'route.credential_mismatch' | 'route.credential_missing' | (string & {});
@@ -100,12 +100,12 @@ export interface RuleToolNameVerdictView {
 export interface CoreValuePorts {
     resolveAutonomousLoopPrompt: (prompt: string, opts?: AutonomousLoopPromptOptionsView) => string | null;
     loosenReasons: (prior: SessionPermissionRules, next: SessionPermissionRules) => string[];
-    combinePolicies: (...policies: CoreToolPolicyHandle[]) => CoreToolPolicyHandle;
+    combinePolicies(...policies: CoreToolPolicyHandle[]): CoreToolPolicyHandle;
     createAllowDenyPolicy: (opts: AllowDenyPolicyOptionsView) => CoreToolPolicyHandle;
     MCP_NAMESPACE: CoreProtocolNamespaceView;
     protocolOf: (name: string) => CoreProtocolNamespaceView | undefined;
     ruleToolGrammarOf: (toolName: string) => RuleGrammarView | undefined;
-    validatePermissionRules: (rules: PermissionRuleView[], opts?: ValidatePermissionRulesOptionsView) => PermissionRuleIssueView[];
+    validatePermissionRules(rules: PermissionRuleView[], opts?: ValidatePermissionRulesOptionsView): PermissionRuleIssueView[];
     mintNamespacePrefix(ns: CoreProtocolNamespaceView, peer: string): string;
     compileAllowList(entries: readonly string[], behavior: 'allow' | 'deny', roster?: ReadonlySet<string>): AllowListReadingView;
     routeKeyOf(url: string | undefined): string;

package/dist/decideReceipt.d.ts

@@ -1,6 +1,6 @@
 import { type GateOutcomeView } from './gateOutcome.js';
 import { type ResumeReopenDetail } from './hitl/suspendedReopen.js';
-import { type CrashConvergedRow } from './hitl/crashConverged.js';
+import { type CrashConvergedRowReading } from './hitl/crashConverged.js';
 import type { AskRowEndingCause } from '@sema-agent/sdk';
 export interface DecideReceiptView {
     status?: string;
@@ -35,7 +35,7 @@ export interface AskGoneDetail {
     code: 'gone.ask';
     state?: 'VOID' | 'DENIED';
     endingCause?: AskRowEndingCause;
-    holderGone?: CrashConvergedRow['cause'];
+    holderGone?: CrashConvergedRowReading['cause'];
 }
 export declare function askGoneFromError(e: unknown): AskGoneDetail | null;
 export declare function askGoneContent(detail: AskGoneDetail): string;

package/dist/decideReceipt.js

@@ -1,6 +1,7 @@
 import { gateOutcomeOf } from './gateOutcome.js';
+import { readOwnDataValue } from './ownKey.js';
 import { resumeReopenFromError } from './hitl/suspendedReopen.js';
-import { ASK_GONE, DECIDE_CLAIM_LOST, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_PARK_FORKED, DECIDE_WORKFLOW_PARKS_UNREADABLE, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, isDecideParkMovedCode, } from './engineErrorCodes.js';
+import { ASK_GONE, DECIDE_CLAIM_LOST, CONFLICT_NOT_RESUMABLE, GATE_NOT_TOOL_APPROVAL, DECIDE_GATE_MOVED, DECIDE_NOT_PARKED, DECIDE_WORKFLOW_HOST_UNKNOWN, DECIDE_WORKFLOW_LANE_CODES, DECIDE_WORKFLOW_PARK_FORKED, DECIDE_WORKFLOW_PARKS_UNREADABLE, DECIDE_WORKFLOW_REMEMBER_UNSUPPORTED, isDecideParkMovedCode, } from './engineErrorCodes.js';
 import { effectiveWireErrorCode } from './wireErrorTriage.js';
 import { readErrorString, readErrorStrictStringList, readThrownExtra } from './wireFailureShape.js';
 import { isCrashConvergedCause } from './hitl/crashConverged.js';
@@ -16,7 +17,7 @@ export function readDecideReceipt(result) {
     const status = Object.hasOwn(r, 'status') ? str(r.status) : undefined;
     const taskId = Object.hasOwn(r, 'taskId') ? str(r.taskId) : undefined;
     const sessionId = Object.hasOwn(r, 'sessionId') ? str(r.sessionId) : undefined;
-    const idempotent = Object.hasOwn(r, 'idempotent') && r.idempotent === true ? true : undefined;
+    const idempotent = readOwnDataValue(r, 'idempotent') === true ? true : undefined;
     const handoffTaskId = status === STATUS_RESUMING && taskId !== undefined ? taskId : undefined;
     const executionOutcome = Object.hasOwn(r, 'executionOutcome')
         ? gateOutcomeOf({ gate: r.executionOutcome })
@@ -117,6 +118,8 @@ const DECIDE_PARK_MOVED_WHAT = Object.freeze({
     [DECIDE_NOT_PARKED]: 'This approval was no longer waiting when the decision arrived (the agent was stopped, the approval was decided elsewhere, or the session it belongs to was deleted; this client cannot tell which)',
     [DECIDE_GATE_MOVED]: 'This approval moved while the decision was on its way (it was parked again, or settled elsewhere; this client cannot tell which)',
     [DECIDE_CLAIM_LOST]: 'Another decision on this approval got there first, or an earlier attempt is still holding it until the engine clears that hold on its own; this client cannot tell which',
+    [CONFLICT_NOT_RESUMABLE]: 'The run was no longer waiting to be resumed when the decision arrived (it had been resumed, decided, or expired before this decision; this client cannot tell which)',
+    [GATE_NOT_TOOL_APPROVAL]: 'The run is waiting at a different kind of gate than a tool approval, so this tool approval decision had nothing to act on',
 });
 export function decideParkMovedContent(detail) {
     let code;

package/dist/declared/supportFloorDeclared.js

@@ -1,5 +1,5 @@
 export const DECLARED_SUPPORT_FLOOR = Object.freeze({
-    server: "7.126.0",
-    core: "7.49.5",
-    sdk: "21.1.0",
+    server: "7.129.1",
+    core: "7.51.2",
+    sdk: "23.0.2",
 });

package/dist/deviceExecutorManagementCapability.d.ts

@@ -15,11 +15,7 @@ export type DeviceExecutorManagementReading = {
     wsPath?: string;
 };
 export declare function projectDeviceExecutorManagementCapability(caps: unknown): DeviceExecutorManagementReading | undefined;
-export declare function noteEngineCapsForDeviceExecutorManagement(baseUrl: string, caps: unknown, opts?: {
-    generation?: number;
-}): void;
 export declare function observedDeviceExecutorManagement(baseUrl?: string | undefined): DeviceExecutorManagementReading;
 export declare function deviceManagementVerbsAvailable(reading: DeviceExecutorManagementReading): 'yes' | 'no' | 'unknown';
 export declare function deviceLaneOpen(reading: DeviceExecutorManagementReading): 'yes' | 'no' | 'unknown';
 export declare function deviceExecutorManagementDoctorDetail(reading: DeviceExecutorManagementReading): string;
-export declare function __resetDeviceExecutorManagementReadingsForTests(): void;

package/dist/deviceExecutorManagementCapability.js

@@ -44,9 +44,6 @@ const reader = createEngineCapReader({
     name: 'deviceExecutor.management',
     project: projectDeviceExecutorManagementCapability,
 });
-export function noteEngineCapsForDeviceExecutorManagement(baseUrl, caps, opts) {
-    reader.note(baseUrl, caps, opts);
-}
 export function observedDeviceExecutorManagement(baseUrl = engineWireTarget()?.baseUrl) {
     return reader.observed(baseUrl);
 }
@@ -103,6 +100,3 @@ export function deviceExecutorManagementDoctorDetail(reading) {
         }
     }
 }
-export function __resetDeviceExecutorManagementReadingsForTests() {
-    reader.__resetForTests();
-}

package/dist/deviceRebind.d.ts

@@ -1,7 +1,10 @@
-import type { AgentClient } from '@sema-agent/sdk';
+import type { AgentClient, DeviceEnrollRequest } from '@sema-agent/sdk';
 export type DeviceListVerb = Pick<AgentClient['devices'], 'list'>;
 export type DeviceSessionBindingVerb = Pick<AgentClient['devices'], 'sessionBinding'>;
 export type DeviceRebindVerb = Pick<AgentClient['devices'], 'rebind'>;
+export type DeviceIssueEnrollTokenVerb = Pick<AgentClient['devices'], 'issueEnrollToken'>;
+export type DeviceEnrollVerb = Pick<AgentClient['devices'], 'enroll'>;
+export type DeviceRevokeVerb = Pick<AgentClient['devices'], 'revoke'>;
 export interface DeviceRosterRow {
     readonly deviceId: string;
     readonly name?: string;
@@ -86,3 +89,48 @@ export declare function reconcileRebindOutcome(before: DeviceBindingReading, toD
     readonly serverMayStillBeRunning: boolean;
 }): DeviceRebindReconcileVerdict;
 export declare function rebindProvesRequestNotApplied(outcome: DeviceRebindOutcome): boolean;
+export type DeviceRegistrationVerb = 'issue' | 'enroll' | 'revoke';
+export interface DeviceRateLimited {
+    readonly kind: 'rate-limited';
+    readonly retryAfterSec?: number;
+}
+export type DeviceEnrollTokenOutcome = {
+    readonly kind: 'ok';
+    readonly token: string;
+    readonly expiresAt?: string;
+    readonly ttlSec?: number;
+} | DeviceRateLimited | DeviceUnreadable | DeviceLaneAbsent | DeviceRefused | DeviceTransport | DeviceUnarmed;
+export type DeviceEnrollOutcome = {
+    readonly kind: 'ok';
+    readonly deviceId: string;
+} | {
+    readonly kind: 'enrollment-invalid';
+} | DeviceRateLimited | DeviceRebindUnconfirmed | DeviceLaneAbsent | DeviceRefused | DeviceUnarmed;
+export type DeviceRevokeOutcome = {
+    readonly kind: 'ok';
+    readonly deviceId: string;
+    readonly revokedAt?: string;
+} | {
+    readonly kind: 'not-found';
+} | DeviceRebindUnconfirmed | DeviceLaneAbsent | DeviceRefused | DeviceUnarmed;
+export declare function issueEnrollToken(devices: DeviceIssueEnrollTokenVerb | null | undefined, opts?: {
+    readonly signal?: AbortSignal | undefined;
+}): Promise<DeviceEnrollTokenOutcome>;
+export interface DeviceEnrollOptions {
+    readonly signal?: AbortSignal | undefined;
+    readonly acceptDeviceId?: ((deviceId: string) => boolean) | undefined;
+}
+export declare function enrollDevice(devices: DeviceEnrollVerb | null | undefined, req: DeviceEnrollRequest, opts?: DeviceEnrollOptions): Promise<DeviceEnrollOutcome>;
+export declare function revokeDevice(devices: DeviceRevokeVerb | null | undefined, deviceId: string, opts?: {
+    readonly reason?: string | undefined;
+    readonly signal?: AbortSignal | undefined;
+}): Promise<DeviceRevokeOutcome>;
+declare const IDENTITY_MISMATCH = "device.identity_mismatch";
+export interface DeviceIdentityMismatch {
+    readonly code: typeof IDENTITY_MISMATCH;
+    readonly boundDeviceId?: string;
+}
+export declare function deviceIdentityMismatchOf(err: {} | null | undefined): DeviceIdentityMismatch | null;
+export declare function deviceIdentityMismatchLine(detail: DeviceIdentityMismatch): string;
+export declare function deviceRegistrationOutcomeLine(verb: DeviceRegistrationVerb, outcome: DeviceEnrollTokenOutcome | DeviceEnrollOutcome | DeviceRevokeOutcome): string | undefined;
+export {};

package/dist/deviceRebind.js

@@ -1,5 +1,6 @@
 import { atMostOnceVerdictOf } from './atMostOnce.js';
 import { readOwnDataValue } from './ownKey.js';
+import { isDisplayableWireCode, readErrorString, readThrownSlot, wireFailureShapeOf } from './wireFailureShape.js';
 const LANE_ABSENT = 'capability.device_lane_required';
 const RUN_STORE_ABSENT = 'capability.run_store_required';
 const NOT_FOUND = 'not_found.device';
@@ -40,9 +41,13 @@ function isArraySafely(v) {
         return false;
     }
 }
-function refusedOf(status, code, e) {
-    const message = nonEmpty(slot(e, 'message'));
-    return { kind: 'refused', status, ...(code !== undefined ? { errorCode: code } : {}), ...(message !== undefined ? { message } : {}) };
+function scrubbed(redact, v) {
+    return v !== undefined && redact !== undefined && v.includes(redact) ? undefined : v;
+}
+function refusedOf(status, code, e, redact) {
+    const message = scrubbed(redact, nonEmpty(slot(e, 'message')));
+    const errorCode = scrubbed(redact, code);
+    return { kind: 'refused', status, ...(errorCode !== undefined ? { errorCode } : {}), ...(message !== undefined ? { message } : {}) };
 }
 function transportOf(v) {
     return { kind: 'transport', ...(v.name !== undefined ? { detail: v.name } : {}) };
@@ -240,3 +245,216 @@ export function rebindProvesRequestNotApplied(outcome) {
             return false;
     }
 }
+const RATE_LIMITED = 'limit.rate_exceeded';
+const ENROLLMENT_INVALID = 'device.enrollment_invalid';
+function rateLimitedOf(e) {
+    const sec = wireFailureShapeOf(e).retryAfterSec;
+    return { kind: 'rate-limited', ...(sec !== undefined ? { retryAfterSec: sec } : {}) };
+}
+function unconfirmedOf(v, redact) {
+    const name = scrubbed(redact, v.name);
+    return v.status !== undefined
+        ? { kind: 'unconfirmed', why: 'server-error', detail: String(v.status), mayStillBeRunning: true }
+        : { kind: 'unconfirmed', why: 'transport', ...(name !== undefined ? { detail: name } : {}), mayStillBeRunning: true };
+}
+const acceptedUnreadable = () => ({ kind: 'unconfirmed', why: 'accepted-unreadable', mayStillBeRunning: false });
+function localRefusal(message) {
+    return { kind: 'refused', status: 0, errorCode: 'request.field_invalid', message };
+}
+function issueFailureOf(e) {
+    const v = atMostOnceVerdictOf(e);
+    const common = commonOf(v.status, v.code);
+    if (common !== null)
+        return common.kind === 'not-found' ? refusedOf(404, NOT_FOUND, e) : common;
+    if (v.status === 429 && v.code === RATE_LIMITED)
+        return rateLimitedOf(e);
+    return v.status !== undefined ? refusedOf(v.status, v.code, e) : transportOf(v);
+}
+export async function issueEnrollToken(devices, opts) {
+    const verb = verbOf(devices, 'issueEnrollToken');
+    if (verb === undefined)
+        return { kind: 'unarmed' };
+    let body;
+    try {
+        body = await verb.call(devices, signalOpts(opts));
+    }
+    catch (e) {
+        return issueFailureOf(e);
+    }
+    const token = nonEmpty(own(body, 'token'));
+    if (token === undefined)
+        return { kind: 'unreadable', why: 'the enrollment token response carries no token — refusing to treat it as a token' };
+    const expiresAt = nonEmpty(own(body, 'expiresAt'));
+    const ttl = own(body, 'ttlSec');
+    const ttlSec = typeof ttl === 'number' && Number.isInteger(ttl) && ttl > 0 ? ttl : undefined;
+    return { kind: 'ok', token, ...(expiresAt !== undefined ? { expiresAt } : {}), ...(ttlSec !== undefined ? { ttlSec } : {}) };
+}
+function enrollFailureOf(e, token) {
+    const v = atMostOnceVerdictOf(e);
+    const common = commonOf(v.status, v.code);
+    if (common !== null)
+        return common.kind === 'not-found' ? refusedOf(404, NOT_FOUND, e, token) : common;
+    if (v.status === 403 && v.code === ENROLLMENT_INVALID)
+        return { kind: 'enrollment-invalid' };
+    if (v.status === 429 && v.code === RATE_LIMITED)
+        return rateLimitedOf(e);
+    if (v.status === 503 && v.code === SERVICE_TOKEN_REQUIRED)
+        return refusedOf(v.status, v.code, e, token);
+    if (v.delivery === 'rejected' && v.status !== undefined)
+        return refusedOf(v.status, v.code, e, token);
+    return unconfirmedOf(v, token);
+}
+export async function enrollDevice(devices, req, opts) {
+    const token = nonEmpty(own(req, 'token'));
+    const pubkey = nonEmpty(own(req, 'pubkey'));
+    const platformOs = nonEmpty(own(req, 'platformOs'));
+    const workspaceRoot = nonEmpty(own(req, 'workspaceRoot'));
+    if (token === undefined || pubkey === undefined || platformOs === undefined || workspaceRoot === undefined) {
+        return localRefusal('the enrollment request is missing a required detail (token, public key, platform or workspace root), so nothing was sent');
+    }
+    const platformArch = nonEmpty(own(req, 'platformArch'));
+    const displayName = nonEmpty(own(req, 'displayName'));
+    const verb = verbOf(devices, 'enroll');
+    if (verb === undefined)
+        return { kind: 'unarmed' };
+    const wire = {
+        token,
+        pubkey,
+        platformOs,
+        ...(platformArch !== undefined ? { platformArch } : {}),
+        ...(displayName !== undefined ? { displayName } : {}),
+        workspaceRoot,
+    };
+    let body;
+    try {
+        body = await verb.call(devices, wire, signalOpts(opts));
+    }
+    catch (e) {
+        return enrollFailureOf(e, token);
+    }
+    const deviceId = nonEmpty(own(body, 'deviceId'));
+    if (deviceId === undefined || scrubbed(token, deviceId) === undefined)
+        return acceptedUnreadable();
+    const accept = opts === undefined || opts === null ? undefined : own(opts, 'acceptDeviceId');
+    if (typeof accept === 'function') {
+        let verdict;
+        try {
+            verdict = accept(deviceId);
+        }
+        catch {
+            verdict = false;
+        }
+        if (verdict !== true)
+            return acceptedUnreadable();
+    }
+    return { kind: 'ok', deviceId };
+}
+function revokeFailureOf(e) {
+    const v = atMostOnceVerdictOf(e);
+    const common = commonOf(v.status, v.code);
+    if (common !== null)
+        return common;
+    if (v.status === 503 && v.code === SERVICE_TOKEN_REQUIRED)
+        return refusedOf(v.status, v.code, e);
+    if (v.delivery === 'rejected' && v.status !== undefined)
+        return refusedOf(v.status, v.code, e);
+    return unconfirmedOf(v);
+}
+export async function revokeDevice(devices, deviceId, opts) {
+    const id = nonEmpty(deviceId);
+    if (id === undefined)
+        return localRefusal('the device id is missing, so nothing was sent');
+    const verb = verbOf(devices, 'revoke');
+    if (verb === undefined)
+        return { kind: 'unarmed' };
+    const reason = nonEmpty(own(opts, 'reason'));
+    let body;
+    try {
+        body = await verb.call(devices, id, reason !== undefined ? { reason } : {}, signalOpts(opts));
+    }
+    catch (e) {
+        return revokeFailureOf(e);
+    }
+    if (own(body, 'deviceId') !== id || own(body, 'status') !== 'revoked')
+        return acceptedUnreadable();
+    const revokedAt = nonEmpty(own(body, 'revokedAt'));
+    return { kind: 'ok', deviceId: id, ...(revokedAt !== undefined ? { revokedAt } : {}) };
+}
+const IDENTITY_MISMATCH = 'device.identity_mismatch';
+const IDENTITY_MISMATCH_TEXT_PREFIX = `[${IDENTITY_MISMATCH}] `;
+export function deviceIdentityMismatchOf(err) {
+    if (err === null || err === undefined)
+        return null;
+    if (typeof err === 'string')
+        return err.startsWith(IDENTITY_MISMATCH_TEXT_PREFIX) ? { code: IDENTITY_MISMATCH } : null;
+    if (typeof err !== 'object' && typeof err !== 'function')
+        return null;
+    const code = readThrownSlot(err, 'errorCode', 'data');
+    const message = readThrownSlot(err, 'message');
+    if (code !== IDENTITY_MISMATCH && !(typeof message === 'string' && message.startsWith(IDENTITY_MISMATCH_TEXT_PREFIX)))
+        return null;
+    const bound = readErrorString(err, 'boundDeviceId');
+    return Object.freeze({ code: IDENTITY_MISMATCH, ...(bound !== undefined && bound !== '' ? { boundDeviceId: bound } : {}) });
+}
+export function deviceIdentityMismatchLine(detail) {
+    const bound = nonEmpty(own(detail, 'boundDeviceId'));
+    return [
+        'This session was rebound to a different device after that work was minted',
+        bound !== undefined && isDisplayableWireCode(bound) ? `It now runs on ${bound}` : 'The engine line above names the device it now runs on',
+        'The engine refuses to silently re-target it — the new device has a different workspace',
+        "Re-initiate the work on the currently bound device (the session's device binding shows which one that is)",
+    ].join(' · ');
+}
+export function deviceRegistrationOutcomeLine(verb, outcome) {
+    if (verb !== 'issue' && verb !== 'enroll' && verb !== 'revoke')
+        return undefined;
+    const kind = own(outcome, 'kind');
+    switch (kind) {
+        case 'rate-limited': {
+            const sec = own(outcome, 'retryAfterSec');
+            return typeof sec === 'number' && Number.isFinite(sec) && sec > 0
+                ? `Too many device requests were sent in a short time — wait ${sec} second${sec === 1 ? '' : 's'} and try again.`
+                : 'Too many device requests were sent in a short time — wait a moment and try again.';
+        }
+        case 'enrollment-invalid':
+            return 'Enrollment was refused. The token may have expired, may already have been used by another device, or may have been issued to a different account. Ask for a new enrollment token and try again.';
+        case 'not-found':
+            return 'No such device is visible to you — it may not exist, may belong to someone else, or may already be revoked; the engine deliberately does not say which.';
+        case 'lane-absent':
+            return own(outcome, 'runStoreOnly') === true
+                ? 'Device lane not enabled — this engine has the device lane but no run store.'
+                : 'Device lane not enabled on this engine.';
+        case 'refused': {
+            const status = own(outcome, 'status');
+            if (status === 0)
+                return 'The request is incomplete, so nothing was sent.';
+            const code = own(outcome, 'errorCode');
+            const shown = typeof code === 'string' && isDisplayableWireCode(code) ? ` ${code}` : '';
+            return `The engine refused this request (${typeof status === 'number' ? String(status) : 'no status'}${shown}).`;
+        }
+        case 'unconfirmed': {
+            const accepted = own(outcome, 'why') === 'accepted-unreadable';
+            if (verb === 'enroll') {
+                return accepted
+                    ? 'The engine accepted the enrollment but did not report the resulting device — it may be enrolled. Sending the same token and public key again is safe: it returns the same device.'
+                    : 'The enrollment request went out but no confirmation came back — the device may or may not be enrolled. Sending the same token and public key again is safe: it returns the same device.';
+            }
+            if (verb === 'revoke') {
+                return accepted
+                    ? 'The engine accepted the revocation but did not confirm it — the device may be revoked. Revoking again is safe: a second revocation succeeds without changing anything.'
+                    : 'The revocation request went out but no confirmation came back — the device may or may not be revoked. Revoking again is safe: a second revocation succeeds without changing anything.';
+            }
+            return accepted
+                ? 'The engine accepted the request but did not confirm it — it may or may not have taken effect.'
+                : 'The request went out but no confirmation came back — it may or may not have taken effect.';
+        }
+        case 'transport':
+            return 'The request did not reach the engine, or no answer came back — nothing was confirmed.';
+        case 'unreadable':
+            return 'The engine answered, but the answer could not be read.';
+        case 'unarmed':
+            return 'No device-management connection is set up here, so nothing was sent.';
+        default:
+            return undefined;
+    }
+}

package/dist/displayUntrusted.d.ts

@@ -1,5 +1,6 @@
 export declare const REDACTION_MARKER_PREFIX = "\u00ABredacted";
 export declare function looksLikeKnownSecret(s: string): boolean;
+export declare function isDiagnosticValueWord(value: string): boolean;
 export declare function washCredentials(text: string): string;
 export type DisplayMark = 'escape' | 'dot' | 'space';
 export interface DisplayFace {