@sema-agent/client-core 0.98.0 → 0.99.0

package/dist/generated/settingsSchemaHooksClassifier.js

@@ -0,0 +1,254 @@
+export const SETTINGS_CLASSIFY_HOOKS_CONFIG_CLOSURE = (HOOK_EVENTS) => {
+    const HOOK_GUARD_EVENTS = ["PreToolUse", "PermissionRequest"];
+    const HOOK_SHELLS = ["bash", "powershell"];
+    const HOOK_ENTRY_COMMON_FIELDS = { if: "string?", timeout: "seconds?", statusMessage: "string?", once: "boolean?" };
+    const HOOK_ENTRY_FIELDS = {
+        command: { command: "text", shell: "shell?", async: "boolean?", asyncRewake: "boolean?", ...HOOK_ENTRY_COMMON_FIELDS },
+        prompt: { prompt: "text", model: "string?", ...HOOK_ENTRY_COMMON_FIELDS },
+        agent: { prompt: "text", model: "string?", ...HOOK_ENTRY_COMMON_FIELDS },
+        http: { url: "text", headers: "stringRecord?", allowedEnvVars: "stringList?", ...HOOK_ENTRY_COMMON_FIELDS },
+        mcp_tool: { server: "string", tool: "string", input: "record?", ...HOOK_ENTRY_COMMON_FIELDS },
+    };
+    function hookIsRecord(value) {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            return false;
+        const proto = Object.getPrototypeOf(value);
+        return proto === Object.prototype || proto === null;
+    }
+    function hookGuardKeyOf(node) {
+        for (const key of Object.keys(node)) {
+            if (!HOOK_GUARD_EVENTS.includes(key))
+                continue;
+            const value = node[key];
+            if (value !== null && value !== undefined && !(Array.isArray(value) && value.length === 0))
+                return key;
+        }
+        return undefined;
+    }
+    function hookLooksLikeMatcher(value) {
+        if (!hookIsRecord(value))
+            return false;
+        const inner = Object.hasOwn(value, "hooks") ? value.hooks : undefined;
+        if (Array.isArray(inner))
+            return inner.length > 0;
+        return hookIsRecord(inner) && (Object.hasOwn(value, "matcher") || typeof inner.type === "string");
+    }
+    function hookGuardSignIn(root, rootPath, place) {
+        const frames = [];
+        const pending = [[root, -1, place]];
+        const seen = { matcherList: new Set(), matcher: new Set(), other: new Set() };
+        const pathTo = (frame, tail) => {
+            const segments = [...tail];
+            for (let f = frame; f >= 0; f = frames[f].parent)
+                segments.unshift(frames[f].key);
+            return [...rootPath, ...segments];
+        };
+        while (pending.length > 0) {
+            const [node, frame, at] = pending.pop();
+            if (node === null || typeof node !== "object" || seen[at].has(node))
+                continue;
+            seen[at].add(node);
+            if (Array.isArray(node)) {
+                for (let i = node.length - 1; i >= 0; i--) {
+                    frames.push({ key: i, parent: frame });
+                    pending.push([node[i], frames.length - 1, at === "matcherList" ? "matcher" : "other"]);
+                }
+                continue;
+            }
+            const guardKey = hookGuardKeyOf(node);
+            if (guardKey !== undefined)
+                return pathTo(frame, [guardKey]);
+            if (at !== "matcher" && hookLooksLikeMatcher(node))
+                return pathTo(frame, []);
+            const keys = Object.keys(node);
+            for (let i = keys.length - 1; i >= 0; i--) {
+                frames.push({ key: keys[i], parent: frame });
+                pending.push([node[keys[i]], frames.length - 1, "other"]);
+            }
+        }
+        return undefined;
+    }
+    function hookSignKeyOf(at, sign) {
+        const key = sign[at.length];
+        return key === undefined ? "hooks" : String(key);
+    }
+    function hookFieldFits(base, value) {
+        switch (base) {
+            case "text":
+                return typeof value === "string" && value.length > 0 && !value.includes("\0");
+            case "string":
+                return typeof value === "string";
+            case "shell":
+                return typeof value === "string" && HOOK_SHELLS.includes(value);
+            case "boolean":
+                return typeof value === "boolean";
+            case "seconds":
+                return typeof value === "number" && Number.isFinite(value) && value > 0;
+            case "stringRecord":
+                return hookIsRecord(value) && Object.values(value).every((v) => typeof v === "string");
+            case "stringList":
+                if (!Array.isArray(value))
+                    return false;
+                for (let i = 0; i < value.length; i++)
+                    if (typeof value[i] !== "string")
+                        return false;
+                return true;
+            case "record":
+                return hookIsRecord(value);
+            default: {
+                const unknownKind = base;
+                throw new Error(`hook entry field table: unknown field kind '${String(unknownKind)}'`);
+            }
+        }
+    }
+    function hookEntryRead(entry) {
+        if (!hookIsRecord(entry))
+            return {};
+        const type = Object.hasOwn(entry, "type") ? entry.type : undefined;
+        if (typeof type !== "string" || !Object.hasOwn(HOOK_ENTRY_FIELDS, type))
+            return { field: "type" };
+        const fields = HOOK_ENTRY_FIELDS[type];
+        const out = { type };
+        for (const field of Object.keys(fields)) {
+            const kind = fields[field];
+            const optional = kind.endsWith("?");
+            const value = Object.hasOwn(entry, field) ? entry[field] : undefined;
+            if (value === undefined) {
+                if (optional)
+                    continue;
+                return { field };
+            }
+            const base = (optional ? kind.slice(0, -1) : kind);
+            if (!hookFieldFits(base, value))
+                return { field };
+            out[field] = Array.isArray(value) ? value.slice() : hookIsRecord(value) ? Object.fromEntries(Object.entries(value)) : value;
+        }
+        return { entry: out };
+    }
+    function hookMatcherRead(matcher, at, guardEvent, reject, drop) {
+        if (!hookIsRecord(matcher)) {
+            if (guardEvent || hookGuardSignIn(matcher, at, "matcher") !== undefined)
+                reject("guard-matcher-invalid", at);
+            else
+                drop("matcher-invalid", at);
+            return undefined;
+        }
+        const entries = Object.hasOwn(matcher, "hooks") ? matcher.hooks : undefined;
+        const signField = hookGuardKeyOf(matcher) ??
+            Object.keys(matcher).find((key) => !(key === "hooks" && Array.isArray(entries)) && hookGuardSignIn(matcher[key], [...at, key], "other") !== undefined);
+        if (signField !== undefined) {
+            reject("guard-matcher-invalid", at, signField);
+            return undefined;
+        }
+        const entrySigns = [];
+        if (Array.isArray(entries))
+            for (let j = 0; j < entries.length; j++)
+                entrySigns.push(hookGuardSignIn(entries[j], [...at, "hooks", j], "other"));
+        const name = Object.hasOwn(matcher, "matcher") ? matcher.matcher : undefined;
+        const badField = name !== undefined && typeof name !== "string" ? "matcher" : !Array.isArray(entries) ? "hooks" : undefined;
+        if (badField !== undefined || !Array.isArray(entries)) {
+            if (guardEvent || entrySigns.some((sign) => sign !== undefined))
+                reject("guard-matcher-invalid", at, badField);
+            else
+                drop("matcher-invalid", at, badField);
+            return undefined;
+        }
+        const kept = [];
+        for (let j = 0; j < entries.length; j++) {
+            const where = [...at, "hooks", j];
+            const sign = entrySigns[j];
+            if (sign !== undefined) {
+                reject("guard-entry-invalid", where, hookIsRecord(entries[j]) ? hookSignKeyOf(where, sign) : undefined);
+                continue;
+            }
+            const read = hookEntryRead(entries[j]);
+            if (read.entry !== undefined)
+                kept.push(read.entry);
+            else if (guardEvent)
+                reject("guard-entry-invalid", where, read.field);
+            else
+                drop("entry-invalid", where, read.field);
+        }
+        return typeof name === "string" ? { matcher: name, hooks: kept } : { hooks: kept };
+    }
+    function hookBlockRead(hooks, reject, drop) {
+        if (!hookIsRecord(hooks)) {
+            if (Array.isArray(hooks) && hooks.some((x) => x !== null && typeof x === "object"))
+                reject("hooks-is-matcher", ["hooks"]);
+            else
+                drop("hooks-not-object", ["hooks"]);
+            return undefined;
+        }
+        if (hookLooksLikeMatcher(hooks) || typeof hooks.type === "string") {
+            reject("hooks-is-matcher", ["hooks"]);
+            return undefined;
+        }
+        const loaded = {};
+        for (const event of Object.keys(hooks)) {
+            const value = hooks[event];
+            const at = ["hooks", event];
+            if (!HOOK_EVENTS.includes(event)) {
+                if (hookGuardSignIn(value, at, Array.isArray(value) ? "matcherList" : "other") !== undefined)
+                    reject("guard-under-unknown-event", at);
+                else
+                    drop("unknown-event", at);
+                continue;
+            }
+            const guardEvent = HOOK_GUARD_EVENTS.includes(event);
+            if (!Array.isArray(value)) {
+                if ((guardEvent && value !== null) || hookGuardSignIn(value, at, "other") !== undefined)
+                    reject("guard-event-not-array", at);
+                else
+                    drop("event-not-array", at);
+                continue;
+            }
+            const matchers = [];
+            for (let i = 0; i < value.length; i++) {
+                const read = hookMatcherRead(value[i], [...at, i], guardEvent, reject, drop);
+                if (read !== undefined)
+                    matchers.push(read);
+            }
+            loaded[event] = matchers;
+        }
+        return loaded;
+    }
+    function classifyHooksConfig(settingsDoc) {
+        const rejections = [];
+        const dropped = [];
+        const reject = (code, path, field) => {
+            rejections.push(field === undefined ? { code, path } : { code, path, field });
+        };
+        const drop = (code, path, field) => {
+            dropped.push(field === undefined ? { code, path } : { code, path, field });
+        };
+        let hooks;
+        if (settingsDoc !== null && typeof settingsDoc === "object" && !Array.isArray(settingsDoc)) {
+            const doc = settingsDoc;
+            for (const key of Object.keys(doc)) {
+                const value = doc[key];
+                if (key === "hooks") {
+                    hooks = hookBlockRead(value, reject, drop);
+                    continue;
+                }
+                const sign = key === "matcher" && hookLooksLikeMatcher(doc)
+                    ? [key]
+                    : HOOK_GUARD_EVENTS.includes(key) && value !== null && value !== undefined && !(Array.isArray(value) && value.length === 0)
+                        ? [key]
+                        : hookGuardSignIn(value, [key], "other");
+                if (sign !== undefined)
+                    reject("guard-outside-hooks", sign);
+            }
+        }
+        else {
+            const sign = hookGuardSignIn(settingsDoc, [], "other");
+            if (sign !== undefined)
+                reject("guard-outside-hooks", sign);
+        }
+        if (rejections.length > 0)
+            return { outcome: "rejected", hooks: undefined, dropped: [], rejections };
+        if (dropped.length > 0)
+            return { outcome: "loaded-partial", hooks, dropped, rejections: [] };
+        return { outcome: "loaded", hooks, dropped: [], rejections: [] };
+    }
+    return classifyHooksConfig;
+};

package/dist/generated/settingsSchemaTables.d.ts

@@ -9,3 +9,4 @@ export declare const SETTINGS_BUDGET_STRING_KEYS: readonly ["mode", "budgetDurat
 export declare const SETTINGS_BUDGET_PER_MODEL_NUMBER_KEYS: readonly ["maxBudgetUsd", "tpmLimit", "rpmLimit"];
 export declare const SETTINGS_MODEL_API_WORDS: readonly ["openai-completions", "anthropic-messages"];
 export declare const SETTINGS_TOOL_NAME_MATCHER_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure"];
+export declare const SETTINGS_UI_LANGUAGE_VALUES: readonly ["en", "zh"];

package/dist/generated/settingsSchemaTables.js

@@ -41,3 +41,7 @@ export const SETTINGS_TOOL_NAME_MATCHER_EVENTS = Object.freeze([
     "PostToolUse",
     "PostToolUseFailure",
 ]);
+export const SETTINGS_UI_LANGUAGE_VALUES = Object.freeze([
+    "en",
+    "zh",
+]);

package/dist/generated/settingsSchemaTypes.d.ts

@@ -0,0 +1,105 @@
+export type ConfigPath = readonly (string | number)[];
+declare const HOOK_EVENTS: readonly ["PreToolUse", "PostToolUse", "PostToolUseFailure", "PostToolBatch", "Notification", "UserPromptSubmit", "UserPromptExpansion", "SessionStart", "SessionEnd", "Stop", "StopFailure", "SubagentStart", "SubagentStop", "PreCompact", "PostCompact", "PermissionRequest", "PermissionDenied", "Setup", "TeammateIdle", "TaskCreated", "TaskCompleted", "Elicitation", "ElicitationResult", "ConfigChange", "WorktreeCreate", "WorktreeRemove", "InstructionsLoaded", "CwdChanged", "FileChanged", "MessageDisplay", "DirectoryAdded", "PreModelSwitch", "PostModelSwitch"];
+type HookEventWord = (typeof HOOK_EVENTS)[number];
+declare const HOOK_ENTRY_TYPES: readonly ["command", "prompt", "agent", "http", "mcp_tool"];
+export type HookEntryType = (typeof HOOK_ENTRY_TYPES)[number];
+declare const HOOK_SHELLS: readonly ["bash", "powershell"];
+declare const HOOK_ENTRY_FIELDS: {
+    readonly command: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly command: "text";
+        readonly shell: "shell?";
+        readonly async: "boolean?";
+        readonly asyncRewake: "boolean?";
+    };
+    readonly prompt: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly prompt: "text";
+        readonly model: "string?";
+    };
+    readonly agent: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly prompt: "text";
+        readonly model: "string?";
+    };
+    readonly http: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly url: "text";
+        readonly headers: "stringRecord?";
+        readonly allowedEnvVars: "stringList?";
+    };
+    readonly mcp_tool: {
+        readonly if: "string?";
+        readonly timeout: "seconds?";
+        readonly statusMessage: "string?";
+        readonly once: "boolean?";
+        readonly server: "string";
+        readonly tool: "string";
+        readonly input: "record?";
+    };
+};
+type HookFieldBaseValue<B> = B extends "text" | "string" ? string : B extends "shell" ? (typeof HOOK_SHELLS)[number] : B extends "boolean" ? boolean : B extends "seconds" ? number : B extends "stringRecord" ? Record<string, string> : B extends "stringList" ? string[] : B extends "record" ? Record<string, unknown> : never;
+type HookFieldValue<K> = K extends `${infer B}?` ? HookFieldBaseValue<B> : HookFieldBaseValue<K>;
+type Flat<O> = {
+    [K in keyof O]: O[K];
+};
+type HookEntryOf<T extends HookEntryType, F = (typeof HOOK_ENTRY_FIELDS)[T]> = Flat<{
+    type: T;
+} & {
+    -readonly [K in keyof F as F[K] extends `${string}?` ? never : K]: HookFieldValue<F[K]>;
+} & {
+    -readonly [K in keyof F as F[K] extends `${string}?` ? K : never]?: HookFieldValue<F[K]>;
+}>;
+export type HookEntry = {
+    [T in HookEntryType]: HookEntryOf<T>;
+}[HookEntryType];
+export type HookMatcherEntry = {
+    matcher?: string;
+    hooks: HookEntry[];
+};
+export type HooksConfig = Partial<Record<HookEventWord, HookMatcherEntry[]>>;
+declare const HOOKS_CLASSIFICATION_OUTCOMES: readonly ["loaded", "loaded-partial", "rejected"];
+export type HooksClassificationOutcome = (typeof HOOKS_CLASSIFICATION_OUTCOMES)[number];
+declare const HOOKS_DROPPED_PIECE_CODES: readonly ["hooks-not-object", "unknown-event", "event-not-array", "matcher-invalid", "entry-invalid"];
+export type HooksDroppedPieceCode = (typeof HOOKS_DROPPED_PIECE_CODES)[number];
+declare const HOOKS_REJECTION_CODES: readonly ["guard-outside-hooks", "hooks-is-matcher", "guard-under-unknown-event", "guard-event-not-array", "guard-matcher-invalid", "guard-entry-invalid"];
+export type HooksRejectionCode = (typeof HOOKS_REJECTION_CODES)[number];
+export interface HooksDroppedPiece {
+    readonly code: HooksDroppedPieceCode;
+    readonly path: ConfigPath;
+    readonly field?: string;
+}
+export interface HooksRejection {
+    readonly code: HooksRejectionCode;
+    readonly path: ConfigPath;
+    readonly field?: string;
+}
+export type HooksClassification = {
+    readonly outcome: "loaded";
+    readonly hooks: HooksConfig | undefined;
+    readonly dropped: readonly [];
+    readonly rejections: readonly [];
+} | {
+    readonly outcome: "loaded-partial";
+    readonly hooks: HooksConfig | undefined;
+    readonly dropped: readonly HooksDroppedPiece[];
+    readonly rejections: readonly [];
+} | {
+    readonly outcome: "rejected";
+    readonly hooks: undefined;
+    readonly dropped: readonly [];
+    readonly rejections: readonly HooksRejection[];
+};
+export {};

package/dist/generated/settingsSchemaTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/hitl/allowRuleShadow.d.ts

@@ -1,3 +1,4 @@
+import type { UiLanguage } from '../env/uiLanguage.js';
 export interface ApprovalAllowRuleShadowMember {
     readonly member?: string;
     readonly known: boolean;
@@ -23,4 +24,4 @@ export declare function retiredAllowRuleShadowKeyPresent(carrier: object | null
 export declare function readAllowRuleShadowFromWire(carrier: object | null | undefined, leg: 'frame' | 'row'): ApprovalAllowRuleShadow | undefined;
 export declare function readApprovalAllowRuleShadow(card: object | null | undefined): ApprovalAllowRuleShadow | undefined;
 export declare function approvalAllowRuleShadowed(card: object | null | undefined): boolean;
-export declare function allowRuleShadowSentence(card: object | null | undefined): string | undefined;
+export declare function allowRuleShadowSentence(card: object | null | undefined, lang?: UiLanguage): string | undefined;

package/dist/hitl/allowRuleShadow.js

@@ -1,5 +1,6 @@
 import { CORE_ALLOW_RULE_MEMBERS } from '../generated/engineFactTables.js';
 import { quoteUntrustedForSentence } from '../displayUntrusted.js';
+import { msg, renderMessage } from '../i18n/translate.js';
 const KNOWN_MEMBERS = new Set(CORE_ALLOW_RULE_MEMBERS);
 function freezeMember(m) {
     return Object.freeze({ ...m });
@@ -162,7 +163,6 @@ export function approvalAllowRuleShadowed(card) {
 const ENTRY_MAX = 4096;
 const MEMBER_MAX = 64;
 const ENTRIES_SHOWN = 5;
-const UNREADABLE_LINE = 'An allow rule matched this call but cannot clear it; which rule could not be read, so this one is confirmed individually.';
 function singlePersistedEntry(shadow) {
     if (shadow.unreadable === true || shadow.members.length !== 1)
         return undefined;
@@ -173,12 +173,12 @@ function singlePersistedEntry(shadow) {
         return undefined;
     return quoteUntrustedForSentence(m.entries[0], ENTRY_MAX);
 }
-function memberPhrase(m) {
+function memberPhrase(m, lang) {
     const memberWord = m.member === undefined ? undefined : KNOWN_MEMBERS.has(m.member) ? m.member : quoteUntrustedForSentence(m.member, MEMBER_MAX);
-    const word = memberWord ?? 'an unrecognised source';
+    const word = memberWord ?? msg('approval.card.shadow.unrecognisedSource');
     const entries = m.entries ?? [];
     if (m.malformed === true && entries.length === 0)
-        return `${word} (could not be read)`;
+        return renderMessage(msg('approval.card.shadow.memberUnreadable', { word }), lang);
     const listed = entries
         .map((e) => quoteUntrustedForSentence(e, ENTRY_MAX))
         .filter((e) => e !== undefined)
@@ -188,25 +188,28 @@ function memberPhrase(m) {
     if (listed.length > 0)
         parts.push(listed.join(', '));
     if (notListed > 0)
-        parts.push(listed.length > 0 ? `and ${String(notListed)} more not listed` : `${String(notListed)} not listed`);
+        parts.push(renderMessage(listed.length > 0 ? msg('approval.card.shadow.moreNotListed', { count: notListed }) : msg('approval.card.shadow.notListed', { count: notListed }), lang));
     if (m.malformed === true)
-        parts.push('part of it could not be read');
-    return parts.length > 0 ? `${word}: ${parts.join('; ')}` : word;
+        parts.push(renderMessage(msg('approval.card.shadow.partUnreadable'), lang));
+    return parts.length > 0
+        ? renderMessage(msg('approval.card.shadow.memberWithParts', { word, parts: parts.join(renderMessage(msg('approval.card.shadow.partJoin'), lang)) }), lang)
+        : typeof word === 'string'
+            ? word
+            : renderMessage(word, lang);
 }
-export function allowRuleShadowSentence(card) {
+export function allowRuleShadowSentence(card, lang) {
     const shadow = readApprovalAllowRuleShadow(card);
     if (shadow === undefined)
         return undefined;
     try {
         if (shadow.unreadable === true || shadow.members.length === 0)
-            return UNREADABLE_LINE;
+            return renderMessage(msg('approval.card.shadow.unreadable'), lang);
         const single = singlePersistedEntry(shadow);
-        if (single !== undefined) {
-            return `Your saved permission rule ${single} still exists — it just cannot clear this particular call, so this one is confirmed individually.`;
-        }
-        return `Allow rules matched this call but cannot clear it, so this one is confirmed individually — ${shadow.members.map(memberPhrase).join(' · ')}.`;
+        if (single !== undefined)
+            return renderMessage(msg('approval.card.shadow.single', { entry: single }), lang);
+        return renderMessage(msg('approval.card.shadow.several', { members: shadow.members.map((m) => memberPhrase(m, lang)).join(' · ') }), lang);
     }
     catch {
-        return UNREADABLE_LINE;
+        return renderMessage(msg('approval.card.shadow.unreadable'), lang);
     }
 }

package/dist/hitl/approvalCardReasons.d.ts

@@ -1,3 +1,4 @@
+import type { UiLanguage } from '../env/uiLanguage.js';
 import { type DenialLimitFallback } from './toolApprovalWire.js';
 export declare const APPROVAL_CARD_REASON_SOURCES: readonly ["payload_unreadable", "prior_cards", "message", "mandated", "mandate", "origin", "denial_limit", "probe", "allow_rule_shadow", "classifier_no_ruling", "bound_grants", "more"];
 export type ApprovalCardReasonSource = (typeof APPROVAL_CARD_REASON_SOURCES)[number];
@@ -9,5 +10,5 @@ export interface ApprovalCardReasonsOptions {
     readonly maxLines?: number;
 }
 export declare const APPROVAL_CARD_REASONS_DEFAULT_MAX_LINES = 4;
-export declare function denialLimitFallbackDetail(v: DenialLimitFallback | null | undefined): string | undefined;
-export declare function approvalCardReasons(card: object | null | undefined, opts?: ApprovalCardReasonsOptions | null): readonly ApprovalCardReasonLine[];
+export declare function denialLimitFallbackDetail(v: DenialLimitFallback | null | undefined, lang?: UiLanguage): string | undefined;
+export declare function approvalCardReasons(card: object | null | undefined, opts?: ApprovalCardReasonsOptions | null, lang?: UiLanguage): readonly ApprovalCardReasonLine[];

package/dist/hitl/approvalCardReasons.js

@@ -1,4 +1,5 @@
 import { displayUntrusted } from '../displayUntrusted.js';
+import { msg, renderMessage } from '../i18n/translate.js';
 import { approvalMandateDetail, askOriginNoteOf } from '../gateVocabulary.js';
 import { readAskOrigin, readOwnDataValue, guardedRead } from '../ownKey.js';
 import { allowRuleShadowSentence } from './allowRuleShadow.js';
@@ -20,22 +21,20 @@ export const APPROVAL_CARD_REASON_SOURCES = Object.freeze([
 ]);
 export const APPROVAL_CARD_REASONS_DEFAULT_MAX_LINES = 4;
 const MESSAGE_DISPLAY_MAX = 300;
-const PAYLOAD_UNREADABLE_DETAIL = 'This client cannot read the format of this approval card, so only its basic facts are shown — decide from those, or deny it if you are not sure what it will do.';
-function moreDetail(n) {
-    return n === 1 ? '1 more reason for this card is not shown.' : `${String(n)} more reasons for this card are not shown.`;
+function payloadUnreadableDetail(lang) {
+    return renderMessage(msg('approval.card.payloadUnreadable'), lang);
 }
-export function denialLimitFallbackDetail(v) {
+function moreDetail(n, lang) {
+    return renderMessage(n === 1 ? msg('approval.card.more.one') : msg('approval.card.more.other', { count: n }), lang);
+}
+export function denialLimitFallbackDetail(v, lang) {
     const d = readDenialLimitFallback(v);
     if (d === undefined)
         return undefined;
-    const parts = [
-        'auto-deny limit reached — auto mode denied enough calls on its own that the engine now wants a real human decision',
-        `${String(d.consecutive)} consecutive / ${String(d.total)} total automatic denials so far`,
-        `the limit that tripped: ${displayUntrusted(d.limit, { max: 24 })}`,
-    ];
-    if (d.autoDenyAfterMs > 0)
-        parts.push(`the engine auto-denies it in ${String(Math.round(d.autoDenyAfterMs / 1000))}s if nobody answers`);
-    return parts.join('; ');
+    const limit = displayUntrusted(d.limit, { max: 24 });
+    return renderMessage(d.autoDenyAfterMs > 0
+        ? msg('approval.card.denialLimit.withAutoDeny', { consecutive: d.consecutive, total: d.total, limit, seconds: Math.round(d.autoDenyAfterMs / 1000) })
+        : msg('approval.card.denialLimit.plain', { consecutive: d.consecutive, total: d.total, limit }), lang);
 }
 function ownData(card, key) {
     return guardedRead(() => readOwnDataValue(card, key));
@@ -44,7 +43,7 @@ function readMaxLines(opts) {
     const raw = typeof opts === 'object' && opts !== null ? guardedRead(() => readOwnDataValue(opts, 'maxLines')) : undefined;
     return typeof raw === 'number' && Number.isSafeInteger(raw) && raw >= 1 ? raw : APPROVAL_CARD_REASONS_DEFAULT_MAX_LINES;
 }
-export function approvalCardReasons(card, opts) {
+export function approvalCardReasons(card, opts, lang) {
     if (typeof card !== 'object' || card === null)
         return Object.freeze([]);
     const raw = [];
@@ -65,21 +64,21 @@ export function approvalCardReasons(card, opts) {
     catch {
         denialLimitReadable = false;
     }
-    add('payload_unreadable', () => (ownData(card, 'cardPayloadUnreadable') === true ? PAYLOAD_UNREADABLE_DETAIL : undefined));
-    add('prior_cards', () => approvalPriorCardsDetail(card));
+    add('payload_unreadable', () => (ownData(card, 'cardPayloadUnreadable') === true ? payloadUnreadableDetail(lang) : undefined));
+    add('prior_cards', () => approvalPriorCardsDetail(card, lang));
     add('message', () => {
-        const msg = ownData(card, 'message');
-        if (typeof msg !== 'string' || msg.trim() === '')
+        const engineMessage = ownData(card, 'message');
+        if (typeof engineMessage !== 'string' || engineMessage.trim() === '')
             return undefined;
         const tool = ownData(card, 'toolName');
-        if (typeof tool === 'string' && msg.trim() === `approval required for "${tool}"`)
+        if (typeof tool === 'string' && engineMessage.trim() === `approval required for "${tool}"`)
             return undefined;
-        return displayUntrusted(msg, { max: MESSAGE_DISPLAY_MAX });
+        return displayUntrusted(engineMessage, { max: MESSAGE_DISPLAY_MAX });
     });
-    add('mandated', () => (approvalIsMandated(card) ? mandatedApprovalDetailOf(card) : undefined));
+    add('mandated', () => (approvalIsMandated(card) ? mandatedApprovalDetailOf(card, lang) : undefined));
     add('mandate', () => {
         const word = readApprovalMandate(card);
-        return word !== undefined ? approvalMandateDetail(word) : undefined;
+        return word !== undefined ? approvalMandateDetail(word, lang) : undefined;
     });
     add('origin', () => {
         const origin = readAskOrigin(card);
@@ -87,18 +86,18 @@ export function approvalCardReasons(card, opts) {
             return undefined;
         if (origin === 'denial_limit_fallback' && denialLimitReadable)
             return undefined;
-        return askOriginNoteOf(origin);
+        return askOriginNoteOf(origin, lang);
     });
-    add('denial_limit', () => denialLimitFallbackDetail(ownData(card, 'denialLimitFallback')));
-    add('probe', () => askProbeReasonDetail(card));
-    add('allow_rule_shadow', () => allowRuleShadowSentence(card));
+    add('denial_limit', () => denialLimitFallbackDetail(ownData(card, 'denialLimitFallback'), lang));
+    add('probe', () => askProbeReasonDetail(card, lang));
+    add('allow_rule_shadow', () => allowRuleShadowSentence(card, lang));
     add('classifier_no_ruling', () => {
         const word = readApprovalClassifierNoRuling(card);
-        return word !== undefined ? classifierNoRulingDetail(word) : undefined;
+        return word !== undefined ? classifierNoRulingDetail(word, lang) : undefined;
     });
     add('bound_grants', () => {
         const grants = readApprovalBoundGrants(card);
-        return grants !== undefined ? approvalBoundGrantsDetail(grants) : undefined;
+        return grants !== undefined ? approvalBoundGrantsDetail(grants, lang) : undefined;
     });
     const seen = new Set();
     const lines = [];
@@ -115,6 +114,6 @@ export function approvalCardReasons(card, opts) {
     if (lines.length <= max)
         return Object.freeze(lines);
     const kept = lines.slice(0, max - 1);
-    kept.push(Object.freeze({ source: 'more', text: moreDetail(lines.length - kept.length) }));
+    kept.push(Object.freeze({ source: 'more', text: moreDetail(lines.length - kept.length, lang) }));
     return Object.freeze(kept);
 }

package/dist/hitl/approvalHolds.d.ts

@@ -67,6 +67,8 @@ export type ApprovalCardClaim = {
 } | {
     readonly kind: 'joined';
     readonly outcome: ApprovalResolution;
+} | {
+    readonly kind: 'aborted';
 };
 export declare function claimApprovalCardFor(who: HoldIdentity, signal: AbortSignal | undefined): Promise<ApprovalCardClaim>;
 export interface ApprovalDecisionHoldTable {
@@ -85,6 +87,7 @@ export declare function settledApprovalOf(approvalId: string | undefined): Settl
 export declare function clearSettledApprovals(): void;
 export declare function anyApprovalSettled(): boolean;
 export declare function noteEngineClosedApproval(approvalId: string, parked: boolean): void;
+export declare function settleEngineClosedApproval(frame: object, parked: boolean): boolean;
 export declare function noteHolderSettledApproval(approvalId: string, how: 'answered' | 'interrupted', outcome: ApprovalResolution): void;
 export declare function settledLiveCardOutcome(approvalId: string): ApprovalResolution | undefined;
 export declare function liveCardHoldOf(key: string): LiveCardHold | undefined;