@sema-agent/core 7.52.0 → 7.54.0

package/dist/engine/session/repo-utils.d.ts

@@ -5,6 +5,11 @@ export declare function createSessionId(): string;
  *  `existing` = the row before the write (`undefined`: none). A new row gets a fresh random v4 token (no time, no host); an
  *  existing row keeps exactly what it had, including nothing (no token is minted for an occupant that predates the cell). */
 export declare function incarnationCell(existing: Pick<SessionMetadata, "incarnation"> | undefined): Pick<SessionMetadata, "incarnation">;
+/** The one decoding of a stored {@link SessionMetadata.incarnation} cell read back by a backend (header line, SQL column):
+ *  a non-empty string is the occupant token; a cell that is not there (`undefined`, or `null` = SQL NULL) is an unknown
+ *  occupant, silently; a cell that is there but is not a token (`""`, a non-string) is an unknown occupant too and `disclose`
+ *  is told once with the cell's shape (never its value). The cell never makes this throw; a throw from `disclose` propagates. */
+export declare function readIncarnationCell(raw: unknown, disclose: (detail: string) => void): string | undefined;
 /** A fork lands on a row OTHER than its source: onto its own id it would mint a new occupant over the source's transcript and erase the lineage that carries the source's records. */
 export declare function assertForkTarget(sourceId: string, targetId: string | undefined): void;
 /** A fork row's cells, minted from the SOURCE row as it stands at fork time: the lineage (`forkedFrom` + the occupant copied) and a fresh occupant of its own. */

package/dist/engine/session/repo-utils.js

@@ -10,6 +10,15 @@ export function incarnationCell(existing) {
         return { incarnation: randomUUID() };
     return existing.incarnation !== undefined ? { incarnation: existing.incarnation } : {};
 }
+export function readIncarnationCell(raw, disclose) {
+    if (typeof raw === "string" && raw !== "")
+        return raw;
+    if (raw === undefined || raw === null)
+        return undefined;
+    const shape = raw === "" ? "an empty string" : Array.isArray(raw) ? "a non-string value (array)" : `a non-string value (${typeof raw})`;
+    disclose(`the incarnation cell holds ${shape} — read as an unknown occupant`);
+    return undefined;
+}
 export function assertForkTarget(sourceId, targetId) {
     if (targetId === sourceId)
         throw new SessionError("invalid_fork_target", `cannot fork session ${sourceId} onto its own id — fork into a new id`);

package/dist/engine/session/storage-base.js

@@ -116,7 +116,7 @@ export class BaseSessionStorage {
             throw new SessionError("not_found", `Entry ${leafId} not found`);
         }
         while (current) {
-            path.unshift(current);
+            path.push(current);
             if (current.id === this.floorId) {
                 break;
             }
@@ -129,7 +129,7 @@ export class BaseSessionStorage {
             }
             current = parent;
         }
-        return path;
+        return path.reverse();
     }
     async getEntries() {
         return [...this.entries];

package/dist/index.d.ts

@@ -59,6 +59,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, type AutoProm
 export { runCascade, type CascadeRung, type CascadeConfig, type CascadeAttempt, type CascadeRunResult, type GateVerdict, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX, type MaterializedMcp, type McpServerStatus, type McpRefreshResult, type McpReconnectResult } from "./core/mcp.js";
+export { mcpStartupTimeoutMs } from "./core/mcp.js";
 export { McpConnectionPool } from "./core/mcp-connection-pool.js";
 export { probeMcpServers, type McpProbeResult } from "./core/mcp-probe.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classifyMcpFailure, type McpFailure, type McpFailureKind, type McpDelivered, type McpLivenessState, type McpServerLiveness } from "./core/mcp-failure.js";
@@ -112,14 +113,14 @@ export type { RemoteExecutionEnv, WorkspaceHandle, SnapshotId, SessionToken, San
 export { addWorktree, pruneWorktrees, WORKTREE_PARENT, type AddWorktreeOptions } from "./core/git-worktree-env.js";
 export { runExecGate } from "./core/exec-gate.js";
 export type { ExecStep, ExecStepResult, ExecGateResult, ExecGateOptions } from "./core/exec-gate.js";
-export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
+export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted, isMintableProbeReason } from "./core/untrusted-text.js";
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export type { InvariantKind, FunctionContract, Invariant, InvariantViolation, CheckResult, } from "./core/property-harness.js";
 export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, type BashReadonlyRootBoundary, type CompoundReadonlyVerdict, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, READ_DENY_HOME_WORD, readDenyPatternRun, readDenyHomesOf, compileWriteDeny, DENY_FACES, type DenyFace, type PathRuleDenyRow, type WriteDenyMatcher, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, READ_DENY_HOME_WORD, readDenyPatternRun, readDenyRowAnchor, readDenyHomesOf, compileWriteDeny, DENY_FACES, type DenyFace, type PathRuleDenyRow, type WriteDenyMatcher, type ReadDenyEntry, type ReadDenyMatcher, type NormalizedReadDenyEntry, type ReadDenyBuiltinTier, type ReadDenyBuiltinRow, type ReadDenyBuiltinConfig, } from "./tools/fs/index.js";
 export { deploymentFaceClampNotice, resolveContainmentFace, type ContainmentFace, type ContainmentFaceInputs, type ContainmentFaceKind, type ContainmentFaceLayer, } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, type WriteProtectedEntry, type WriteProtectedRow, type WriteProtectedKind, type WriteProtectedHit, type WriteProtectionMatcher, type WriteProtectionVerdict, type WriteProtectionViewAbsence, type WriteProtectionJudgeContext, type WriteProtectionCompileOptions, type WriteProtectionCheck, WRITE_PROTECTION_TARGET_VIEWS, type WriteProtectionTargetView, type WriteProtectionMount, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, type ToolResultProvenance, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, type ToolResultStore, type ToolResultSlice, type ToolResultDeletionReport, } from "./core/tool-result-store.js";
@@ -132,6 +133,7 @@ export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD,
 export { FileUsageWindowStore, type FileUsageWindowStoreOptions } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
 export { InMemoryFileHistoryStore, boundaryPublishVerdict } from "./core/file-history-store.js";
+export { FILE_HISTORY_ERROR_CODES } from "./core/file-history-store.js";
 export { captureFileBackupViaEnv, applyFileRestoreViaEnv } from "./core/file-history-store.js";
 export { modeProvenDifferent as fileHistoryModeProvenDifferent } from "./core/file-history-store.js";
 export { countRestoreLineDiff, FILE_HISTORY_DIFF_LINE_BUDGET } from "./core/file-history-store.js";
@@ -144,7 +146,8 @@ export { DEFAULT_FILE_HISTORY_BOUNDARY_KEEP, resolveFileHistoryRetention, fileHi
 export type { FileHistoryRetentionPolicy } from "./core/file-history-retention.js";
 export { FileStorageBackend, FileSessionRepo, FileCheckpointStore, FileMemoryStore, FileToolResultStore, FileSessionPolicyStore, FileFileHistoryStore, FileWorkflowJournalStore, MAX_JOURNAL_RESULT_BYTES, oversizeJournalResult, resolveDataRoot, sanitizeScope, sanitizePathComponent, createFileConsolidationLock, atomicWriteFile, writeThenLink, ensureDir, readJsonlRecords, AppendLog, FileStoreLockError, type FileStoreLockErrorCode, processFingerprint, isProcessLive, type ProcessFingerprint, type FileStorageBackendOptions, type FileStorageCorruptReadInfo, type FileFileHistoryStoreOptions, type FileSessionRepoOptions, type FileCheckpointStoreOptions, } from "./stores/file/index.js";
 export { CacheBreakDetector, type CacheBreakFinding, type ToolFingerprintInput } from "./core/cache-break-detector.js";
-export { maybeCompact, type MaybeCompactOptions, type CompactionWindowSafetyInfo } from "./core/auto-compaction.js";
+export { maybeCompact, type MaybeCompactOptions, type CompactionPassStart, type CompactionWindowSafetyInfo, type CompactionRestoreAsk } from "./core/auto-compaction.js";
+export type { MintedAttachmentFrame } from "./core/user-attachment.js";
 export type { CompactionEffect } from "./core/frame-settlement.js";
 export { brainToRuntime } from "./core/runtime.js";
 export { createSensitivePathPolicy, RECOMMENDED_SENSITIVE_PATTERNS } from "./core/sensitive-path-policy.js";
@@ -158,7 +161,7 @@ NOTIFICATION_INJECTION_OUTCOMES, // …and their value half + guard, so a host w
 isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, type UserInputLane, AGENT_MESSAGE_TAG, renderAgentMessageFrame, type SemaProvenance, HANDBACK_STATES, type HandbackState, COMPACTION_KINDS, type CompactionKind, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, type ToolFamily, type ToolMountTag, type ToolApprovalCard, type ToolPathAccess, type ToolPathBase, type ToolPathAbsence, type ToolPathTarget, type ToolCallPathTarget, type ToolRosterPathTarget, pathTargetSlotOnly, type ToolRuleFace, type ToolRenderHints, type ToolFaceDeclaration, type ToolCatalogEntry, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, type ToolCallLike, pathConfinableWriteToolNames, persistenceCapableToolNames, persistenceCandidateToolNames, rosterCanPersistMemory, type PersistenceProbeTool, type PersistenceFacts, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
-export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, type RosterSource, type ToolIdentity, toolIdentityOf, mintCapabilityId, diffToolRoster, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, type RosterBoundMembers, type RosterBoundCode, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export { type ToolCallFace } from "./core/tool-policy.js";
 export { effectivePathTargetOf, pathTargetBaseOf, type ToolPathBases, type PathTargetReading, type CallTargetReading, type CallTargetView } from "./core/effective-path-target.js";
 export { type BoundPathRule, type PathRuleSpec } from "./core/path-rule-binding.js";
@@ -168,8 +171,10 @@ export { SHELL_READ_FINDINGS, SHELL_READ_SEATS, SHELL_READ_DECISION, SHELL_READ_
 export { type ReadCandidate, type ShellReadPlan, type ShellReadSegment } from "./tools/fs/shell-read-plan.js";
 export { TOOL_CONFORMANCE_VECTORS, type ToolConformanceVector } from "./core/tool-conformance.js";
 export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS, type McpToolFace } from "./core/runner/tool-face-overlay.js";
+export { readToolFaces } from "./core/tool-face-reader.js";
 export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
 export { parkedToolIdentity } from "./core/tool-roster.js";
+export { approvalObjectOf, judgeApprovalObject, APPROVAL_STATION_MEMBERS, APPROVAL_TARGET_ROLES, type ApprovalObject, type ApprovalTargets, type ApprovalStation, type ApprovalMember, type ApprovalMismatch, type ApprovalDisposition, type LiveApprovalObject } from "./core/approval-object.js";
 export { type ToolCallIdentity } from "./core/fs-write-gate-policy.js";
 export { type RuleFaceView, catalogRuleFaceView } from "./core/permission-rules.js";
 export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
@@ -204,6 +209,7 @@ type ApprovalSeatOutcome, COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, cre
 export { type ReadRootGrantScreen } from "./core/read-root-grant-screen.js";
 export { type AskOrigin, ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, type PersistedRuleMandate, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, type PermissionMode, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, type AskClass, isAskClass, MODE_ARBITRATION, type ModeArbitrationRow, ASK_FACES, type AskFace, askFaceOf, releasableAskClassesFor, MODE_RELEASE_REASONS, type ModeReleaseReason, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, type AskClassification, type AskClassFacts, type ToolMarkSource, arbitrateByMode, type Arbitration, fileCommandOptionsSentence } from "./core/ask-origin.js";
+export { CROSS_BOUNDARY_TAINT_BITS, type CrossBoundaryTaintBit, CROSS_BOUNDARY_POSTURES, type CrossBoundaryPosture, BOUNDARY_LEGS, type BoundaryLeg, type BoundaryLegList, type BoundaryLegsDeclaration, type CrossBoundaryTree, type CrossBoundaryObligation, crossBoundaryObligation, CROSS_BOUNDARY_RECORD_TYPE, type CrossBoundaryRecordData, type CrossBoundaryRecordEntry, type CrossBoundaryRecordRead, readCrossBoundaryRecord, type BoundaryLegsFor, type BoundaryLegsGiven, type CrossBoundaryCall, type CrossBoundaryCheck, type CrossBoundaryExitRefusal, type CrossBoundaryTreeToken } from "./core/cross-boundary-taint.js";
 export { modePolicyOf, type ModePolicy, PERMISSION_MODE_FOLD_REASONS, type PermissionModeFoldReason, type PermissionModeReceipt, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export type { PermissionSeatInputs, PermissionSeatReading } from "./core/mode-policy.js";
 export type { SkillGateSeats, SkillGrantHit, SkillGrantLane, SkillGrantOrigin, SkillGrantRecord } from "./core/skill-grant.js";
@@ -243,17 +249,17 @@ export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRul
  * and nothing more. Removal is exported without ceremony, because narrowing on a user's behalf is
  * allowed and widening is not.
  */
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
-export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type AddResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleTightenAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, type ProgramRunReachOutcome, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, type PathRuleBase, type PathRuleBases, type RuleBehavior, type PersistedRuleVerdict, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, type UncoveredSegmentDetail, PERSISTED_RULE_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, UNCOVERED_SEGMENT_REASONS, EDITED_RULE_BREADTH_WARNING_CODES, RULE_ADD_ORIGINS, type EditedRuleBreadthWarning, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, type PersistedRule, type RuleTombstone, type RuleScope, type RuleDot, type RuleAdd, type RuleAddOrigin, type RuleOffer, type RuleOfferBatchMember, type SegmentRuleSuggestion, type SegmentCoverage, type RuleReject, type RuleRejectCode, type ParsedRule, type PersistedRuleTool, type PersistedRuleMatch, } from "./core/permission-rule-model.js";
+export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, type DurableRulePartition, type DurableRulePartitionProvider, type RuleWriteOutcome, type StoredRules, type RemoveResult, type AddResult, type PutResult, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, type RuleSyncState, type RuleSyncFrontier, type RuleSyncDrop, type RuleSyncLandingReport, type RuleOwner, RULE_OWNER_KINDS, type QuarantinedRuleAdd, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, type PermissionRuleWriter, type WritableDurableRulePartition, type RuleWriteDelta, type RuleAddDelta, type RuleTightenAddDelta, type RuleDeleteDelta, type RuleSyncJoinDelta, type RawRuleSyncState, type RedemptionAuthorization, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, type PermissionRuleSyncTransport, type PermissionRuleSyncResult, type RuleSyncRequestBody, type RuleSyncResponseBody, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, type PermissionRuleStore, type PermissionRuleStoreProvider, type PermissionRuleStoreConfig, type EffectivePermissionRules, type EffectivePermissionRule, type RemovedPermissionRule, type RuleSource, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, type SessionRulePartition, type SessionRuleAdd, type SessionRuleApplyResult, } from "./core/permission-rule-session.js";
-export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellRedirection, type ShellWrapperName, } from "./core/shell-lexer.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, type ShellCommandShape, type ShellSegment, type ShellWord, type ShellRedirection, type ShellWrapperName, } from "./core/shell-run-candidates.js";
 export { readOnlyShellVerdict, type ReadOnlyShellVerdict } from "./core/read-only-shell.js";
 export { READ_ONLY_FLAG_ARITIES, FLAG_VALUE_ACCEPTS, READ_ONLY_COMMAND_TABLE, READ_ONLY_BARE_PROGRAMS, READ_ONLY_GLOB_PROGRAMS, READ_ONLY_EXACT_FORMS, READ_ONLY_BARE_ONLY, FIND_ACTION_PRIMARIES, FIND_VALUE_PRIMARIES, FIND_NEWER_PRIMARY, READ_ONLY_ENV_NAMES, XARGS_READ_ONLY_TARGETS, type ReadOnlyFlagArity, type ReadOnlyCommandRow, } from "./core/read-only-shell-table.js";
-export { orgRuleVerdictFor, type OrgRuleVerdict, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
+export { orgRuleVerdictFor, sameOrgPolicyContent, type OrgRuleVerdict, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, type OrgPermissionRule, type OrgRuleSnapshot, type OrgRuleSnapshotProvider, type OrgRuleStatePersistence, type PersistedOrgRuleState, type OrgRulePartitionConfig, type OrgRuleResolution, type OrgRuleStatus, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES, type RuleSyncDropReason, type RuleQuarantineReason } from "./core/governance-codes.js";
-export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";
+export { prepareCardApproval, confirmRuleApproval, type ConfirmResult, type ConfirmRefusalReason, precheckEditedRuleText, type EditedRuleTextPrecheck, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, type RuleTicket, type RuleCandidate, type RuleApprovalKind, type RuleApprovalState, RULE_APPROVAL_KINDS, RULE_APPROVAL_STATES, IMPORTED_SETTINGS_LAYERS, RULE_APPROVAL_RECORD_SCHEMA, type RuleApprovalRecord, type RuleApprovalRecordStore, type RuleOffer2, type StaleRuleApprovalRecord, type RuleConsentDeps, type RedeemResult, type RedeemedBatchMember, type CcImportLayer, type ImportedSettingsLayer, type ImportPreview, } from "./core/permission-rule-consent.js";
 export { FileDurableRulePartitionProvider, ORG_STATE_FILE } from "./stores/file/permission-rule-store.js";
 export { adoptFilePermissionRuleStore, type AdoptFileRuleStoreResult } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, type AdoptionErrorCode, type AdoptionSource, type AdoptionReport, type AdoptionReceipt, type AdoptionLegReport, type AffectedDeploymentConfig, type RootAdoptionFile, } from "./stores/file/adoption/marker.js";
@@ -277,18 +283,19 @@ export { consolidateScope, advanceCursorAfterInline, type ConsolidateScopeDeps,
 export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, // the ONE arming reading (`memory.auto_consolidation.arming_has_one_resolver`) — the seat's absence is not "off"
 type MemoryConsolidationDriverDeps, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, type PromptBlock, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, type EnvironmentFacts, type PromptBlock, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { OVERLAY_SOURCE_ORDER, type ChainLink as PromptChainLink, type PromptOverlay, type SupersededOverlay } from "./prompt-assembly/overlay.js";
+export { PROMPT_BINDING_LIST_MAX, PROMPT_BINDING_MAX_CHARS } from "./prompt-assembly/overlay.js";
 export { BANDS as PROMPT_BANDS } from "./prompt-assembly/bands.js";
-export { OVERLAY_OPS, HOST_ROLES, HOST_FORMS, type OverlayOp as PromptOverlayOp, type OverlaySource as PromptOverlaySource, type HostRole as PromptHostRole, type HostForm as PromptHostForm, type VariantWhen as PromptVariantWhen } from "./prompt-assembly/catalog/schema.js";
+export { OVERLAY_OPS, HOST_ROLES, isHostRole, HOST_FORMS, type OverlayOp as PromptOverlayOp, type OverlaySource as PromptOverlaySource, type HostRole as PromptHostRole, type HostForm as PromptHostForm, type VariantWhen as PromptVariantWhen } from "./prompt-assembly/catalog/schema.js";
 export { SEMA_DEFAULT_CATALOG, catalogText } from "./prompt-assembly/catalog/index.js";
 export type { Attribution as PromptCatalogAttribution, BandId as PromptBandId, BandRow as PromptBandRow, CatalogMessage as PromptCatalogMessage, CatalogSection as PromptCatalogSection, FactConjunction as PromptFactConjunction, PromptCatalog, PromptFactName, PromptTrait, RendererId as PromptRendererId, SectionBody as PromptSectionBody, TraitCondition as PromptTraitCondition, Variant as PromptCatalogVariant, } from "./prompt-assembly/catalog/schema.js";
 export { attachToolContract, getToolContract, hasToolContract, computeShapeDigest, projectToolManifest, type ToolContractDescriptor, type ToolOrigin } from "./prompt-assembly/tool-catalog.js";
 export { normalizePromptEpoch, promptIdentityOf, PROMPT_EPOCH_ACTIVATIONS, PROMPT_EPOCH_CHANGES, type PromptEpochDescriptor, type PromptEpochActivation, type PromptEpochChange, type PromptIdentityLayers, type StoredPromptEpoch, } from "./prompt-assembly/epoch.js";
 export { ARTIFACT_LIMITS, buildPromptArtifact, computeArtifactDigest, requiresOf, unmetRequirements, verifyPromptArtifact, type ArtifactVerifyCode, type ArtifactVerifyResult, type PromptArtifact, type PromptArtifactEvidence, type PromptArtifactPayload, type PromptArtifactRequires, type PublishedPromptArtifact, } from "./prompt-assembly/artifact.js";
 export { buildTurnPromptSnapshot, loweringRecordFor, LOWERING_VERSION, PREFIX_INPUT_CLASSIFICATION, type CacheIdentityElements, type LoweringRecord, type PrefixInputClass, type RawPrefixInputs, type TurnPromptSnapshot, } from "./prompt-assembly/turn-snapshot.js";
-export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, type PromptArtifactSource, type PromptArtifactStore, type PromptSourceState, type PromptSourceStateStore, } from "./prompt-assembly/artifact-store.js";
+export { CenterPromptSource, FilePromptArtifactStore, FilePromptSourceStateStore, MemoryPromptArtifactStore, MemoryPromptSourceStateStore, type OnArtifactRefused, type PromptArtifactSource, type PromptArtifactStore, type PromptSourceState, type PromptSourceStateStore, type StoredArtifactRefusal, } from "./prompt-assembly/artifact-store.js";
 export { stripEngineMetadata } from "./internal/llm.js";
 export { EVENT_PROMPT_REGISTRY, eventDefaultOn, type CompiledEventPrompt, type EventDedupe, type EventDefaultPolicy } from "./prompt-assembly/event-registry.js";
 export { OUTPUT_STYLE_NAME_MAX } from "./core/output-style.js";
@@ -366,6 +373,11 @@ export { TEAM_ROLES, DIRECTION_RELATIONS, teamRoleOf, mayDirect, type TeamRole,
 export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS, PEER_LISTING_FRESH_WINDOW_MS, isFreshPeerRow, type ListAgentsToolOptions, type ListAgentsRow } from "./agents/list-agents-tool.js";
 export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
 export { PEER_SESSION_ID_UNGRAMMATICAL_CODE, PEER_RESUPPLY_CAP, type PeerLaneMountVerdict, type PeerInboundDisposition } from "./agents/peer-session-drain.js";
+export { ORG_DELIVERY_REFUSAL_CODES, isOrgDeliveryRefusalCode, mintCrossPrincipalRecord, isGateMintedRecord, PRINCIPAL_INBOX_TRIAGE_POLICIES, principalInboxTriagePolicy, principalInboxSideEffectKey, principalInboxConsumerOf, PRINCIPAL_INBOX_CONSUMER_INVALID_CODE, type PrincipalInboxConsumer, type OrgDeliveryGate, type OrgAuthenticatedSender, type CrossPrincipalBody, type OrgDeliveryOutcome, type OrgDeliveryRefusalCode, type PrincipalInboxTriagePolicy, } from "./agents/org-delivery-gate.js";
+export { PRINCIPAL_INBOX_HANDLE } from "./agents/cross-session-ref.js";
+export { CROSS_PRINCIPAL_MESSAGE_NOTICE } from "./agents/cross-session-envelope.js";
+export { principalInboundLayers } from "./agents/cross-session-judge.js";
+export { PRINCIPAL_INBOX_UNMINTED_CAUSE } from "./agents/peer-session-drain.js";
 export { renderCrossSessionMessageFrame, renderCrossSessionNoticeLine } from "./core/task-notification.js";
 export { PEER_HELD_QUEUE_CAP, PEER_IDLE_SUBSCRIPTION_TTL_MS, PEER_IDLE_SUBSCRIBER_TABLE_CAP, PEER_IDLE_OUTSTANDING_CAP, PEER_IDLE_PRIORS_KEPT, PEER_IDLE_FIRE_DEBOUNCE_MS, PEER_IDLE_HELD_BACKOFF_MS, PEER_IDLE_LABEL_MAX, CROSS_SESSION_DIALOG_EXPIRY_VALUES, CROSS_SESSION_DIALOG_EXPIRY_DEFAULT, resolveCrossSessionDialogExpiry, PEER_HELD_REVIEW_CAUSES, PEER_DELIVERY_RECEIPT_STATES, isPeerDeliveryReceiptState, PEER_DROP_REASONS, peerRecipientSuffix, renderCrossSessionDeliveryNotice, describePeerDropReasons, renderCrossSessionDroppedNotice, PEER_IDLE_NOTICE_KINDS, isPeerIdleNoticeKind, PEER_IDLE_UNAVAILABLE_CAUSES, peerIdleNoticeLabel, formatPeerNoticeClock, renderCrossSessionIdleNotice, describePeerIdleSubscription, type CrossSessionDialogExpiry, type ResolvedCrossSessionDialogExpiry, type PeerDeliveryReceiptState, type PeerDropReason, type PeerIdleNoticeKind, type PeerIdleNoticeFields, } from "./agents/peer-notices.js";
 export { createPeerHeldQueue, peerHeldQueueFor, peerHeldQueueIfAny, peerHeldQueueKey, realPeerClock, type PeerInboundHoldCause, type PeerHeldEntry, type PeerHeldSettlement, type PeerHeldSettleReason, type PeerHeldSettleOutcome, type PeerClock, type PeerHeldQueueSink, type PeerHeldQueueConfig, type PeerHeldQueue, } from "./agents/peer-held-queue.js";
@@ -378,17 +390,17 @@ export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_U
 export { createTaskServer, type TaskServerOptions, type TaskRequestBody, } from "./server/http.js";
 export { clearStaleToolResults, editBudget, type ContextEditOptions, } from "./core/context-edit.js";
 export { createOpenAIBrain, type OpenAIBrainConfig } from "./brain/openai.js";
-export { createAnthropicBrain, type AnthropicBrainConfig } from "./brain/anthropic.js";
+export { createAnthropicBrain, ANTHROPIC_DEFAULT_BASE_URL, type AnthropicBrainConfig } from "./brain/anthropic.js";
 export { createOpenResponsesBrain, type OpenResponsesBrainConfig } from "./brain/open-responses.js";
 export { FABLE_5_COMPAT, fable5Model } from "./brain/model-presets.js";
 export { createFailoverBrain } from "./brain/failover.js";
-export { createRoutingBrain, type RoutingBrainOptions } from "./brain/routing.js";
+export { createRoutingBrain, brainLaneOf, type RoutingBrainOptions } from "./brain/routing.js";
 export { repairTextToolCalls } from "./brain/tool-call-repair.js";
 export { createCircuitBreakerBrain, type CircuitBreakerOptions, type BreakerState, type BreakerSnapshot, type BreakerPhase, CIRCUIT_OPEN_MARKER, } from "./brain/circuit-breaker.js";
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, type DegradingBrainOptions, type DegradeReason, type DegradationInfo, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
-export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, __resetCredentialOriginBindings, type RoutePairingStatus, } from "./brain/route-adjudicator.js";
+export { adjudicateModelRoute, resolveRouteCredential, admitRouteRequest, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, __resetCredentialOriginBindings, type RoutePairingStatus, } from "./brain/route-adjudicator.js";
 export { ROUTE_CREDENTIAL_SOURCES, ROUTE_CARRIERS, ROUTE_CARRIER_BAGS, REQUEST_ROOT_ORIGINS, ROUTE_CREDENTIAL_PAIRING, requestRouteOf, routePairingRowOf, type RequestRoute, type RouteCarrier, type RouteCarrierBag, type RequestRootOrigin, type RouteCredentialPairingRow, } from "./brain/request-route.js";
 export type { RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, } from "./internal/llm.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS, type RouteAdjudicationVector } from "./brain/route-conformance.js";
@@ -405,5 +417,13 @@ export { RULE_OFFERS_ABSENCES, type RuleOffersAbsence } from "./core/ask-origin.
 export { BOUND_GRANT_ABSENCES, type BoundGrantAbsence } from "./core/skill-grant-binding.js";
 export { DISPOSABLE_PROMPT_SECTIONS, type DisposablePromptSection, type PromptSectionEntry, type PromptSectionAuthor, type McpInstructionsEntry } from "./core/prompt-section-seat.js";
 export type { McpRevocationLedger, McpMountIdentity } from "./core/mcp-server-spec.js";
-export { readMcpToolAxes } from "./core/mcp-server-spec.js";
-export type { McpToolAxesRead } from "./core/mcp-server-spec.js";
+export { readToolAxes, readMcpToolAxes } from "./core/mcp-server-spec.js";
+export type { ToolAxesRead, ToolAxesSurface } from "./core/mcp-server-spec.js";
+export { receiveDeclaration, DECLARATION_PATH_RULES } from "./core/mcp-server-spec.js";
+export type { DeclarationRead, DeclarationFault, DeclarationPathRule } from "./core/mcp-server-spec.js";
+export type { EngineStorageBackend } from "./core/engine-storage-backend.js";
+export { sessionStoreContract, type SessionStoreContractHooks } from "./core/store-contracts/session-store-contract.js";
+export { canonicalJsonStringify } from "./core/canonical-json.js";
+export { parkedApprovalCardOf, type ParkedApprovalCardReading } from "./core/pause-registry.js";
+export { admitSessionPlacement } from "./core/session-store.js";
+export { incarnationCell, forkRowCells, assertForkTarget, readIncarnationCell } from "./engine/session/repo-utils.js";

package/dist/index.js

@@ -45,6 +45,7 @@ export { decideAutoPromote, deriveTripwire, FROZEN_DENYLIST_FLOOR, } from "./cor
 export { runCascade, } from "./agents/cascade.js";
 export { pgQuery, mysqlQuery, sqliteQuery } from "./tools/sql-adapters.js";
 export { materializeMcpTools, MCP_PREFIX } from "./core/mcp.js";
+export { mcpStartupTimeoutMs } from "./core/mcp.js";
 export { McpConnectionPool } from "./core/mcp-connection-pool.js";
 export { probeMcpServers } from "./core/mcp-probe.js";
 export { MCP_FAILURE_KINDS, MCP_DELIVERY_VERDICTS, MCP_LIVENESS_STATES, classifyMcpFailure } from "./core/mcp-failure.js";
@@ -91,13 +92,13 @@ export { RemoteExecutionError, hasDestroy, isRemoteExecutionEnv, isSuspendable,
 export { withRetry } from "./core/with-retry.js";
 export { addWorktree, pruneWorktrees, WORKTREE_PARENT } from "./core/git-worktree-env.js";
 export { runExecGate } from "./core/exec-gate.js";
-export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted } from "./core/untrusted-text.js";
+export { sanitizeUntrustedText, delimitUntrusted, inlineUntrusted, isMintableProbeReason } from "./core/untrusted-text.js";
 export { mintReminderMark, isValidReminderMark, openSystemReminder, mintSystemReminder, reminderMarkDeclaration } from "./core/reminder-mint.js";
 export { deriveInvariants, checkInvariants } from "./core/property-harness.js";
 export { bashReversibilityProbe, BASH_READONLY_DEFAULT_ALLOW, parseLeadingCommandName, classifyCompoundReadonly, MAX_EDIT_BYTES } from "./tools/fs/index.js";
 export { classifyCompoundReadonlyDetailed, formatOutOfRootReadApprovalOption, } from "./tools/fs/index.js";
 export { resolveBashTimeoutCaps } from "./tools/fs/index.js";
-export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, READ_DENY_HOME_WORD, readDenyPatternRun, readDenyHomesOf, compileWriteDeny, DENY_FACES, } from "./tools/fs/index.js";
+export { READ_FACE_DEFAULT_DENY_ENTRIES, READ_FACE_BUILTIN_DENY_TABLE, READ_DENY_BUILTIN_TIERS, READ_DENY_DEFAULT_TIERS, resolveReadDenyBuiltins, compileReadDeny, READ_DENY_HOME_WORD, readDenyPatternRun, readDenyRowAnchor, readDenyHomesOf, compileWriteDeny, DENY_FACES, } from "./tools/fs/index.js";
 export { deploymentFaceClampNotice, resolveContainmentFace, } from "./tools/fs/index.js";
 export { WRITE_PROTECTED_DEFAULT_TABLE, resolveWriteProtectedTable, compileWriteProtection, WRITE_PROTECTION_TARGET_VIEWS, } from "./core/write-protect.js";
 export { InMemoryToolResultStore, OFFLOAD_TOOL_NAME, DEFAULT_TOOL_RESULT_THRESHOLD_CHARS, assertSafeToolResultRef, buildToolResultRef, toolResultContentSegment, MAX_MINTED_TOOL_RESULT_REF_CHARS, assertToolResultProvenanceMatch, normalizeToolResultProvenance, toolResultProvenanceOf, ToolResultRefConflictError, TOOL_RESULT_REF_CONFLICT_CODE, } from "./core/tool-result-store.js";
@@ -110,6 +111,7 @@ export { InMemoryUsageWindowStore, GLOBAL_USAGE_KEY, EMPTY_USAGE_WINDOW_RECORD,
 export { FileUsageWindowStore } from "./stores/file/usage-window-store.js";
 export { ENV_LIFETIME_SUSPEND_MARGIN_MS, USAGE_WINDOW_REAP_MARGIN_MS } from "./core/runner/prepare-task.js";
 export { InMemoryFileHistoryStore, boundaryPublishVerdict } from "./core/file-history-store.js";
+export { FILE_HISTORY_ERROR_CODES } from "./core/file-history-store.js";
 export { captureFileBackupViaEnv, applyFileRestoreViaEnv } from "./core/file-history-store.js";
 export { modeProvenDifferent as fileHistoryModeProvenDifferent } from "./core/file-history-store.js";
 export { countRestoreLineDiff, FILE_HISTORY_DIFF_LINE_BUDGET } from "./core/file-history-store.js";
@@ -129,7 +131,7 @@ export { DEFAULT_SUBAGENT_TOOL_NAME } from "./agents/subagent.js";
 export { renderTaskNotificationXml, RESUPPLIED_FRAME_PREAMBLE, taskNotificationDedupKey, isDelegatedAgentTerminal, isTerminalTaskNotification, TASK_NOTIFICATION_TERMINAL_STATUSES, SystemInjectionQueue, NOTIFICATION_INJECTION_OUTCOMES, isNotificationInjectionOutcome, SYSTEM_INJECTION_PRIORITIES, isSystemInjectionPriority, steerPriorityOf, injectionLaneOf, AGENT_MESSAGE_TAG, renderAgentMessageFrame, HANDBACK_STATES, COMPACTION_KINDS, handbackStateOf, terminalFrameFacets, } from "./core/task-notification.js";
 export { TOOL_FAMILIES, TOOL_MOUNT_TAGS, TOOL_APPROVAL_CARDS, TOOL_PATH_ACCESSES, TOOL_PATH_BASES, TOOL_PATH_ABSENCES, TOOL_WIRE_NAME_MAX_CHARS, TOOL_CONTRACT_MAX_CHARS, TOOL_CARD_ID_MAX_CHARS, TOOL_KEY_MAX_CHARS, TOOL_KEYS_MAX, RENDER_HINT_MAX_CHARS, RENDER_HINT_ACTIVITY_MAX_CHARS, RENDER_HINT_MAX_LIST, pathTargetSlotOnly, } from "./core/tool-face.js";
 export { describeToolCatalog, catalogEntriesNamed, catalogToolNames, catalogRuleFaceOf, pathTargetOf, pathTargetValue, protectivePathTargetOf, declaredPathTargetOf, BARE_REQUEST_CODE, isProtectedWrite, isDeclaredWrite, fileOpAccessOf, pathConfinableWriteToolNames, persistenceCapableToolNames, persistenceCandidateToolNames, rosterCanPersistMemory, pathTargetingToolNames, compactableToolNames, budgetExemptToolNames, handBandEffects, engineCardTypes, predictMountedToolNames, HANDS_BAND_TAGS, MOUNT_TAG_IN_HANDS_BAND, } from "./core/tool-registry.js";
-export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, judgeParkedToolIdentity, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
+export { ToolRosterEntry, ToolRoster, ToolRosterDelta, ToolRosterRenderHints, ROSTER_SOURCES, toolIdentityOf, mintCapabilityId, diffToolRoster, ruleFacesFromRoster, toolCallFaceOf, rosterToolName, ruleNamesOf, inputKeysOf, ruleFaceOfInstance, rosterMemberBoundProblem, ToolRosterDeltaSeat, } from "./core/tool-roster.js";
 export {} from "./core/tool-policy.js";
 export { effectivePathTargetOf, pathTargetBaseOf } from "./core/effective-path-target.js";
 export {} from "./core/path-rule-binding.js";
@@ -139,8 +141,10 @@ export { SHELL_READ_FINDINGS, SHELL_READ_SEATS, SHELL_READ_DECISION, SHELL_READ_
 export {} from "./tools/fs/shell-read-plan.js";
 export { TOOL_CONFORMANCE_VECTORS } from "./core/tool-conformance.js";
 export { applyMcpToolFaces, toolFaceProblem, APPROVAL_CARD_REQUIRED_KEYS } from "./core/runner/tool-face-overlay.js";
+export { readToolFaces } from "./core/tool-face-reader.js";
 export { createStructuredProjector } from "./core/runner/tool-output-projection.js";
 export { parkedToolIdentity } from "./core/tool-roster.js";
+export { approvalObjectOf, judgeApprovalObject, APPROVAL_STATION_MEMBERS, APPROVAL_TARGET_ROLES } from "./core/approval-object.js";
 export {} from "./core/fs-write-gate-policy.js";
 export { catalogRuleFaceView } from "./core/permission-rules.js";
 export { DURABLE_HISTORY_NAMES } from "./engine/compaction/utils.js";
@@ -167,6 +171,7 @@ export { createAllowDenyPolicy, createApprovalPolicy, COARSE_SHELL_TOOLS, create
 export {} from "./core/read-root-grant-screen.js";
 export { ASK_ORIGINS, isAskOrigin, ORIGIN_IMPLIES_REAL_APPROVAL, PERSISTED_RULE_MANDATES, isPersistedRuleMandate, screenAskClassMembers } from "./core/ask-origin.js";
 export { PERMISSION_MODES, isPermissionMode, PERMISSION_MODE_RANK, clampPermissionMode, ASK_CLASSES, isAskClass, MODE_ARBITRATION, ASK_FACES, askFaceOf, releasableAskClassesFor, MODE_RELEASE_REASONS, isModeReleaseReason, RRA_EXPLAINERS, classifyAsk, foldArbitrationRow, arbitrateByMode, fileCommandOptionsSentence } from "./core/ask-origin.js";
+export { CROSS_BOUNDARY_TAINT_BITS, CROSS_BOUNDARY_POSTURES, BOUNDARY_LEGS, crossBoundaryObligation, CROSS_BOUNDARY_RECORD_TYPE, readCrossBoundaryRecord } from "./core/cross-boundary-taint.js";
 export { modePolicyOf, PERMISSION_MODE_FOLD_REASONS, ACCEPT_EDITS_FILE_COMMANDS, modeAcceptsFileCommand } from "./core/mode-policy.js";
 export { SKILL_GRANT_ORIGINS } from "./core/skill-grant.js";
 export { ALLOW_ENTRY_INERT_REASONS, readRuleEntry, compileAllowList, renderListEntry } from "./core/allow-entry.js";
@@ -187,17 +192,17 @@ export { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./core/au
 export { AUTO_MODE_ARMING_RECIPE_VERSION, autoModeArmingRecipeOf, sanitizeAutoModeArmingRecipe, foldAutoModeArming, } from "./core/auto-mode-arming.js";
 export { rebuildAutoModeDecider, } from "./core/auto-mode-rebuild.js";
 export { createPermissionRulePolicy, validatePermissionRules, parsePermissionRule, wildcardMatch, isNamespacedCoveringRuleName, namespacedRuleNameCovers, } from "./core/permission-rules.js";
-export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
-export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
+export { RULE_BEHAVIORS, RULE_BEHAVIOR_PRECEDENCE, RULE_BEHAVIORS_BY_PRECEDENCE, isRuleBehavior, readRowBehavior, adjudicatePersistedRules, adjudicatePersistedPathRules, ruleReachesProgramRun, programRunReachOf, PROGRAM_RUN_REACHES, pathRuleReachOf, ruleBasesNeeded, PATH_RULE_BASES, PATH_RULE_BASE_LABEL, ruleToolGrammarOf, COMMAND_RULE_TOOL, READ_RULE_TOOL, parseRuleText, formatRuleText, ruleAdmitsCommand, findAdmittingRule, suggestRulesForCommand, scopeCoversCwd, pathWithinRoot, isRuleLive, renderUntrustedCommandText, stripFormatCharacters, UNCOVERED_SEGMENT_REASON_BASELINE, RULE_OFFERS_ABSENCE_BASELINE, PERSISTED_RULE_MATCHES, RULE_OFFER_BATCH_MEMBER_KINDS, UNCOVERED_SEGMENT_REASONS, EDITED_RULE_BREADTH_WARNING_CODES, RULE_ADD_ORIGINS, directoryRuleAdmits, BARE_INTERPRETER_NAMES, MAX_RULE_TEXT_CHARS, } from "./core/permission-rule-model.js";
+export { removePersistedRule, addPersistedRule, applyTombstones, sameScope, sameRuleIdentity, isValidConsentScope, isValidDurableScope, InMemoryDurableRulePartition, EMPTY_DURABLE_RULE_PARTITION, joinRuleStates, screenRuleSyncState, collectBelowFrontier, ruleSyncVector, joinFrontiers, dotAtOrBelowFrontier, sameRuleOwner, RULE_OWNER_KINDS, PERMISSION_RULE_WRITER, writerOf, foldDelta, addDotsOf, assertDeleteDeltaCarriesNoAdd, assertRedemptionNotQuarantined, assertWriteDeltaScopeDurable, } from "./core/permission-rule-store.js";
 export { syncPermissionRules, parseRuleSyncResponse, PERMISSION_RULE_SYNC_PATH, LOCAL_OWNER_UNSYNCABLE_CODE, } from "./core/permission-rule-sync.js";
 export { createPermissionRuleStoreProvider, effectivePermissionRules, effectiveOrThrow, ruleSourceOf, } from "./core/permission-rule-provider.js";
 export { InMemorySessionRulePartition, } from "./core/permission-rule-session.js";
-export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, } from "./core/shell-lexer.js";
+export { readShellCommand, isFullyReadable, MAX_SHELL_READ_CHARS, SHELL_WRAPPER_TABLE, } from "./core/shell-run-candidates.js";
 export { readOnlyShellVerdict } from "./core/read-only-shell.js";
 export { READ_ONLY_FLAG_ARITIES, FLAG_VALUE_ACCEPTS, READ_ONLY_COMMAND_TABLE, READ_ONLY_BARE_PROGRAMS, READ_ONLY_GLOB_PROGRAMS, READ_ONLY_EXACT_FORMS, READ_ONLY_BARE_ONLY, FIND_ACTION_PRIMARIES, FIND_VALUE_PRIMARIES, FIND_NEWER_PRIMARY, READ_ONLY_ENV_NAMES, XARGS_READ_ONLY_TARGETS, } from "./core/read-only-shell-table.js";
-export { orgRuleVerdictFor, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
+export { orgRuleVerdictFor, sameOrgPolicyContent, orgRuleShadows, unenforceableOrgRules, ORG_UNAVAILABLE_DECISION_REASON, ORG_RULE_DECISION_REASON, ORG_ADJUDICATION_TIMEOUT_MS, } from "./core/permission-rule-org.js";
 export { RULE_SYNC_DROP_CODES } from "./core/governance-codes.js";
-export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, } from "./core/permission-rule-consent.js";
+export { prepareCardApproval, confirmRuleApproval, precheckEditedRuleText, redeemRuleTicket, redeemRuleBatch, prepareCcImport, prepareStarterBatch, mintRuleTicket, STARTER_RULES, InMemoryRuleApprovalRecordStore, ruleOffersOfRecord, RULE_APPROVAL_KINDS, RULE_APPROVAL_STATES, IMPORTED_SETTINGS_LAYERS, RULE_APPROVAL_RECORD_SCHEMA, } from "./core/permission-rule-consent.js";
 export { FileDurableRulePartitionProvider, ORG_STATE_FILE } from "./stores/file/permission-rule-store.js";
 export { adoptFilePermissionRuleStore } from "./stores/file/permission-rule-adopt.js";
 export { AdoptionError, assertAdoptionBootGate, readRootAdoptionFile, writeRootAdoptionFile, ROOT_ADOPTION_FILE, } from "./stores/file/adoption/marker.js";
@@ -219,11 +224,12 @@ export { runMemoryConsolidation, CONSOLIDATION_SYSTEM_PROMPT, DEFAULT_CONSOLIDAT
 export { consolidateScope, advanceCursorAfterInline, } from "./core/consolidate-scope.js";
 export { resolveMemoryConsolidationDriver, autoRunOnRecommendationEffective, } from "./core/runner/memory-consolidation-driver.js";
 export { DEFAULT_COMPACTION_INSTRUCTIONS } from "./core/auto-compaction.js";
-export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, NO_PERSISTENT_MEMORY_NOTICE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, } from "./prompts/default.js";
+export { DEFAULT_SYSTEM_PROMPT, CODE_AGENT_PROMPT, SUBAGENT_PROMPT, CODE_SYSTEM_PROMPT, MEMORY_GUIDANCE, MEMORY_SAFETY, MEMORY_HYGIENE, OUTPUT_EFFICIENCY, CYBER_RISK, HARNESS_SECTION_ANCHOR, URL_SAFETY, SUMMARIZE_TOOL_RESULTS, EXECUTION_ENVIRONMENT, EXECUTION_ENVIRONMENT_OPEN_READS, executionEnvironmentBlockFor, buildEnvironmentContext, buildGitSnapshot, buildScratchpadSection, GIT_STATUS_MAX_CHARS, formatLocalDate, } from "./prompts/default.js";
 export { SUPERVISOR_PROMPT, ORCHESTRATION_GUIDANCE, ORCHESTRATION_AWARENESS, GOAL_COMPLETION_GUIDANCE } from "./prompts/supervisor.js";
 export { OVERLAY_SOURCE_ORDER } from "./prompt-assembly/overlay.js";
+export { PROMPT_BINDING_LIST_MAX, PROMPT_BINDING_MAX_CHARS } from "./prompt-assembly/overlay.js";
 export { BANDS as PROMPT_BANDS } from "./prompt-assembly/bands.js";
-export { OVERLAY_OPS, HOST_ROLES, HOST_FORMS } from "./prompt-assembly/catalog/schema.js";
+export { OVERLAY_OPS, HOST_ROLES, isHostRole, HOST_FORMS } from "./prompt-assembly/catalog/schema.js";
 export { SEMA_DEFAULT_CATALOG, catalogText } from "./prompt-assembly/catalog/index.js";
 export { attachToolContract, getToolContract, hasToolContract, computeShapeDigest, projectToolManifest } from "./prompt-assembly/tool-catalog.js";
 export { normalizePromptEpoch, promptIdentityOf, PROMPT_EPOCH_ACTIVATIONS, PROMPT_EPOCH_CHANGES, } from "./prompt-assembly/epoch.js";
@@ -300,6 +306,11 @@ export { TEAM_ROLES, DIRECTION_RELATIONS, teamRoleOf, mayDirect } from "./agents
 export { createListAgentsTool, LIST_AGENTS_TOOL_NAME, LIST_AGENTS_TOOL_ALIAS, LIST_AGENTS_MAX_RESULT_CHARS, PEER_LISTING_FRESH_WINDOW_MS, isFreshPeerRow } from "./agents/list-agents-tool.js";
 export { CROSS_SESSION_CLASSIFIER_RULE } from "./agents/cross-session-envelope.js";
 export { PEER_SESSION_ID_UNGRAMMATICAL_CODE, PEER_RESUPPLY_CAP } from "./agents/peer-session-drain.js";
+export { ORG_DELIVERY_REFUSAL_CODES, isOrgDeliveryRefusalCode, mintCrossPrincipalRecord, isGateMintedRecord, PRINCIPAL_INBOX_TRIAGE_POLICIES, principalInboxTriagePolicy, principalInboxSideEffectKey, principalInboxConsumerOf, PRINCIPAL_INBOX_CONSUMER_INVALID_CODE, } from "./agents/org-delivery-gate.js";
+export { PRINCIPAL_INBOX_HANDLE } from "./agents/cross-session-ref.js";
+export { CROSS_PRINCIPAL_MESSAGE_NOTICE } from "./agents/cross-session-envelope.js";
+export { principalInboundLayers } from "./agents/cross-session-judge.js";
+export { PRINCIPAL_INBOX_UNMINTED_CAUSE } from "./agents/peer-session-drain.js";
 export { renderCrossSessionMessageFrame, renderCrossSessionNoticeLine } from "./core/task-notification.js";
 export { PEER_HELD_QUEUE_CAP, PEER_IDLE_SUBSCRIPTION_TTL_MS, PEER_IDLE_SUBSCRIBER_TABLE_CAP, PEER_IDLE_OUTSTANDING_CAP, PEER_IDLE_PRIORS_KEPT, PEER_IDLE_FIRE_DEBOUNCE_MS, PEER_IDLE_HELD_BACKOFF_MS, PEER_IDLE_LABEL_MAX, CROSS_SESSION_DIALOG_EXPIRY_VALUES, CROSS_SESSION_DIALOG_EXPIRY_DEFAULT, resolveCrossSessionDialogExpiry, PEER_HELD_REVIEW_CAUSES, PEER_DELIVERY_RECEIPT_STATES, isPeerDeliveryReceiptState, PEER_DROP_REASONS, peerRecipientSuffix, renderCrossSessionDeliveryNotice, describePeerDropReasons, renderCrossSessionDroppedNotice, PEER_IDLE_NOTICE_KINDS, isPeerIdleNoticeKind, PEER_IDLE_UNAVAILABLE_CAUSES, peerIdleNoticeLabel, formatPeerNoticeClock, renderCrossSessionIdleNotice, describePeerIdleSubscription, } from "./agents/peer-notices.js";
 export { createPeerHeldQueue, peerHeldQueueFor, peerHeldQueueIfAny, peerHeldQueueKey, realPeerClock, } from "./agents/peer-held-queue.js";
@@ -312,17 +323,17 @@ export { builtinAgentDefinitions, BUILTIN_READONLY_DENY_TOOLS, EXPLORE_WHEN_TO_U
 export { createTaskServer, } from "./server/http.js";
 export { clearStaleToolResults, editBudget, } from "./core/context-edit.js";
 export { createOpenAIBrain } from "./brain/openai.js";
-export { createAnthropicBrain } from "./brain/anthropic.js";
+export { createAnthropicBrain, ANTHROPIC_DEFAULT_BASE_URL } from "./brain/anthropic.js";
 export { createOpenResponsesBrain } from "./brain/open-responses.js";
 export { FABLE_5_COMPAT, fable5Model } from "./brain/model-presets.js";
 export { createFailoverBrain } from "./brain/failover.js";
-export { createRoutingBrain } from "./brain/routing.js";
+export { createRoutingBrain, brainLaneOf } from "./brain/routing.js";
 export { repairTextToolCalls } from "./brain/tool-call-repair.js";
 export { createCircuitBreakerBrain, CIRCUIT_OPEN_MARKER, } from "./brain/circuit-breaker.js";
 export { createDegradingBrain, readDegradation, DEGRADED_DIAGNOSTIC_TYPE, } from "./brain/degrading.js";
 export { retryBackoffMs, parseRetryAfter } from "./brain/retry.js";
 export { WAITING_FIRST_TOKEN_AFTER_MS, WAITING_FIRST_TOKEN_EVERY_MS } from "./brain/stream-engine.js";
-export { adjudicateModelRoute, resolveRouteCredential, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, __resetCredentialOriginBindings, } from "./brain/route-adjudicator.js";
+export { adjudicateModelRoute, resolveRouteCredential, admitRouteRequest, routeRefusalText, routePairingStatus, routeKeyOf, displayUrlOf, resolveRequestRoot, resolveRequestRootOf, joinRequestUrl, hasAuthCarrier, __resetCredentialOriginBindings, } from "./brain/route-adjudicator.js";
 export { ROUTE_CREDENTIAL_SOURCES, ROUTE_CARRIERS, ROUTE_CARRIER_BAGS, REQUEST_ROOT_ORIGINS, ROUTE_CREDENTIAL_PAIRING, requestRouteOf, routePairingRowOf, } from "./brain/request-route.js";
 export { ROUTE_ADJUDICATION_CONFORMANCE_CORPUS } from "./brain/route-conformance.js";
 export {} from "./brain/timeout.js";
@@ -334,4 +345,10 @@ export { SHADOW_REASON, allowRuleShadowSentence, cardDisclosureOf } from "./core
 export { RULE_OFFERS_ABSENCES } from "./core/ask-origin.js";
 export { BOUND_GRANT_ABSENCES } from "./core/skill-grant-binding.js";
 export { DISPOSABLE_PROMPT_SECTIONS } from "./core/prompt-section-seat.js";
-export { readMcpToolAxes } from "./core/mcp-server-spec.js";
+export { readToolAxes, readMcpToolAxes } from "./core/mcp-server-spec.js";
+export { receiveDeclaration, DECLARATION_PATH_RULES } from "./core/mcp-server-spec.js";
+export { sessionStoreContract } from "./core/store-contracts/session-store-contract.js";
+export { canonicalJsonStringify } from "./core/canonical-json.js";
+export { parkedApprovalCardOf } from "./core/pause-registry.js";
+export { admitSessionPlacement } from "./core/session-store.js";
+export { incarnationCell, forkRowCells, assertForkTarget, readIncarnationCell } from "./engine/session/repo-utils.js";

package/dist/internal/harness.d.ts

@@ -23,6 +23,7 @@ export { BaseSessionStorage, leafIdAfterEntry } from "../engine/session/storage-
 export { InMemorySessionStorage } from "../engine/session/memory-storage.js";
 export { InMemorySessionRepo } from "../engine/session/memory-repo.js";
 export { uuidv7 } from "../engine/session/uuid.js";
+export { readToolCallArguments } from "../engine/loop/agent-loop.js";
 export { SessionError } from "../engine/harness/types.js";
 export type { AnnouncedListingSnapshot, AnnouncedListingSnapshotInput, AnnouncedMcpFailure } from "../engine/harness/types.js";
 export { normalizeGitAnnouncement } from "../engine/harness/types.js";

package/dist/internal/harness.js

@@ -11,6 +11,7 @@ export { BaseSessionStorage, leafIdAfterEntry } from "../engine/session/storage-
 export { InMemorySessionStorage } from "../engine/session/memory-storage.js";
 export { InMemorySessionRepo } from "../engine/session/memory-repo.js";
 export { uuidv7 } from "../engine/session/uuid.js";
+export { readToolCallArguments } from "../engine/loop/agent-loop.js";
 export { SessionError } from "../engine/harness/types.js";
 export { normalizeGitAnnouncement } from "../engine/harness/types.js";
 export { gitFrameContextVisible } from "../engine/session/session.js";

package/dist/internal/llm.d.ts

@@ -4,5 +4,5 @@
  * design/118 ①②: the layer is now first-party (`src/engine/llm/`, naturalized out of the vendored
  * llm-core); the facade stays so consumers never notice which side a symbol lives on.
  */
-export { createAssistantMessageEventStream, DATA_LABEL_UNSAFE, ensureToolTurnInvariants, isTextBlock, MODEL_OUTPUT_INVALID_CAUSES, quoteDataLabel, renderContentBlock, renderUserAttachmentView, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS, userAttachmentOf } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, DATA_LABEL_UNSAFE, ensureToolTurnInvariants, findToolByName, isTextBlock, MODEL_OUTPUT_INVALID_CAUSES, quoteDataLabel, renderContentBlock, renderUserAttachmentView, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS, userAttachmentOf } from "../engine/llm/index.js";
 export type { ActorAssertion, UserAttachmentKind, UserAttachmentObservation, UserAttachmentOutcome, UserAttachmentSupply, UserMessageAttachment, AnthropicMessagesCompat, OpenAICompletionsCompat, OpenAIResponsesCompat, AssistantMessage, AssistantMessageDiagnostic, AssistantMessageEvent, CompleteSimpleFn, Context, DocumentContent, ImageContent, Message, Model, ModelOutputInvalid, ModelOutputInvalidCause, OutputLimit, ResilienceOptions, RouteAdjudication, RouteCredential, RouteCredentialSource, RoutePairingConfig, RoutePairingPosture, RouteRefusalCode, RouteRefusalDetail, SimpleStreamOptions, StallTimeouts, StopReason, StreamFn, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage, StreamDrop, StreamDropCause, ToolTurnIncompleteCause, ToolTurnRepair, Usage, UserMessage, } from "../engine/llm/index.js";

package/dist/internal/llm.js

@@ -1 +1 @@
-export { createAssistantMessageEventStream, DATA_LABEL_UNSAFE, ensureToolTurnInvariants, isTextBlock, MODEL_OUTPUT_INVALID_CAUSES, quoteDataLabel, renderContentBlock, renderUserAttachmentView, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS, userAttachmentOf } from "../engine/llm/index.js";
+export { createAssistantMessageEventStream, DATA_LABEL_UNSAFE, ensureToolTurnInvariants, findToolByName, isTextBlock, MODEL_OUTPUT_INVALID_CAUSES, quoteDataLabel, renderContentBlock, renderUserAttachmentView, snapshotActorAssertion, stampStreamDrops, streamDropsOf, stripEngineMetadata, TOOL_TURN_INCOMPLETE_CAUSES, TOOL_TURN_REPAIR_DROPS, userAttachmentOf } from "../engine/llm/index.js";

package/dist/orchestration/goal.d.ts

@@ -13,7 +13,8 @@
  */
 import type { RunnerSelfSeat } from "../core/runner/contracts.js";
 import type { CheckpointToken } from "../core/checkpoint-store.js";
-import type { TaskResult, TaskSpec } from "../core/types.js";
+import type { GateKind, PAUSE_REGISTRY } from "../core/pause-registry.js";
+import type { PausedCause, TaskResult, TaskSpec } from "../core/types.js";
 /** Read-only snapshot a `doneCheck` sees after one iteration. */
 export interface GoalTurnState {
     /** This iteration's full {@link TaskResult}. */
@@ -73,6 +74,18 @@ export type GoalStatus = "achieved" | "max_iterations" | "budget" | "blocked" |
  * objective / raise `budgetTokens`), `"walltime"` = `totalTimeoutMs` elapsed (give it more time).
  */
 export type GoalBudgetCause = "tokens" | "walltime";
+/**
+ * The gates a pause can carry when the status word reads `suspended`: the pause registry's rows whose `taskStatus` column is `suspended` —
+ * the column {@link pauseFamily} projects the status word from. The type reads the same table the status word does, so a row added to the
+ * table moves both, and a gate that reaches the mint below with that word is always one of these. Of the four kinds, a run's own pause is
+ * `human`, `irreversible_ask` or `resource_limit`; `task_done` is the handle a deployment parks, which the engine mints in no run but which
+ * a custom runner seat may return as a paused terminal, and which the table reads `suspended` too. The review kinds are `needs_review`.
+ */
+type SuspendedGate = Extract<PausedCause["gate"], {
+    kind: {
+        [K in GateKind]: (typeof PAUSE_REGISTRY)[K]["taskStatus"] extends "suspended" ? K : never;
+    }[GateKind];
+}>;
 export interface GoalResult {
     readonly status: GoalStatus;
     /** Last iteration's result; absent on a preflight-terminate (a stop BEFORE iteration 1 ran). */
@@ -93,6 +106,15 @@ export interface GoalResult {
     /** #111 — present IFF `status === "budget"` (the KEY is absent otherwise, so presence alone reads
      *  as "stopped on a ceiling"). See {@link GoalBudgetCause}. */
     readonly budgetCause?: GoalBudgetCause;
+    /** Present IFF `status === "suspended"` — every suspended result carries it, no other carries the KEY: WHY the run is parked, as the
+     *  gate it parked at (the checkpoint's own gate, the same object as `result.terminal.gate`; its words are the closed sets of
+     *  {@link import("../core/checkpoint-store.js").CheckpointGate}, narrowed to the kinds whose status word is `suspended`: `human`,
+     *  `irreversible_ask`, `resource_limit` — and `task_done`, the handle a deployment parks, which a run of this engine never mints but a custom
+     *  runner seat may return). The cause is read from the gate alone, never from the caller's signal:
+     *  `{ kind: "resource_limit", reason: "usage_window" }` waits for quota (`resumeAfterMs`); `reason: "preempt"` is the host's own resumable
+     *  stop (`TaskSpec.preemptSignal`); `human` / `irreversible_ask` wait on an approval; another `resource_limit` reason waits on an
+     *  allowance. A caller's abort that ended the run is `status: "aborted"` (no checkpoint); a park that won the race with it is that park. */
+    readonly suspendGate?: SuspendedGate;
 }
 /** Reserved name of the goal-completion signal tool (injected by `runGoal` when there is no outputSchema). */
 export declare const DECLARE_DONE_TOOL_NAME = "DeclareDone";
@@ -104,3 +126,4 @@ export declare const DECLARE_DONE_TOOL_NAME = "DeclareDone";
  * cancel; a durable pause (suspended/needs_review) is a hard boundary that surfaces the checkpointToken.
  */
 export declare function runGoal(runner: RunnerSelfSeat, spec: GoalSpec): Promise<GoalResult>;
+export {};

package/dist/orchestration/goal.js

@@ -100,9 +100,10 @@ export async function runGoal(runner, spec) {
             verificationKind,
             accepted: false,
             cumulativeTokens,
-            checkpointToken: over?.checkpointToken,
+            checkpointToken: over?.paused?.token,
             errorCode: over?.errorCode,
             ...(status === "budget" && over?.budgetCause !== undefined ? { budgetCause: over.budgetCause } : {}),
+            ...(status === "suspended" && over?.paused !== undefined ? { suspendGate: over.paused.gate } : {}),
         };
         if (verificationKind === "mechanical" && status !== "suspended" && status !== "needs_review") {
             runner.emitTaskOutcome?.({
@@ -145,7 +146,7 @@ export async function runGoal(runner, spec) {
             spentCostMicroUsd += (result.stats.costMicroUsd ?? 0) + (result.stats.nested?.costMicroUsd ?? 0);
             spentTurns += (result.stats.turns ?? 0) + (result.stats.nested?.turns ?? 0);
             if (isDurablePause(result.terminal)) {
-                return mk(pauseFamily(result.terminal), iteration, { result, checkpointToken: result.terminal.token });
+                return mk(pauseFamily(result.terminal), iteration, { result, paused: result.terminal });
             }
             const midStop = classifyStop();
             if (midStop)

package/dist/orchestration/run-workflow-tool.d.ts

@@ -192,6 +192,9 @@ export interface RunWorkflowToolDeps {
      *  the ladder/gate placement. Absent ⇒ nothing extra travels (the rootSessionId chain is the
      *  placement root through prepare's mint middle segment). */
     placementRoot?: string;
+    /** The host run tree's cross-boundary token (`RunInternals.crossBoundaryTree`), riding deps for the same auto-mounted-ctx reason as
+     *  `rootSessionId` above; handed to the workflow run so every workflow-spawned agent joins the host tree's state. */
+    crossBoundaryTree?: import("../core/cross-boundary-taint.js").CrossBoundaryTreeToken;
     /** Process-local unified task registry. When present, RunWorkflow returns `task_id === runId` with a `w*` id. */
     taskRegistry?: TaskRegistry;
     /** design/115 P2 core slice: run-local task-notification sink for SDK event + live model XML injection.

package/dist/orchestration/run-workflow-tool.js

@@ -494,6 +494,7 @@ async function mountRunWorkflowTool(d) {
                     ...(d.originatingSessionId !== undefined ? { originatingSessionId: d.originatingSessionId } : {}),
                     ...((ctx.rootSessionId ?? d.rootSessionId ?? d.originatingSessionId) !== undefined ? { rootSessionId: ctx.rootSessionId ?? d.rootSessionId ?? d.originatingSessionId } : {}),
                     ...((ctx.placementRoot ?? d.placementRoot) !== undefined ? { placementRoot: ctx.placementRoot ?? d.placementRoot } : {}),
+                    ...((ctx.crossBoundaryTreeForChildren ?? d.crossBoundaryTree) !== undefined ? { crossBoundaryTree: ctx.crossBoundaryTreeForChildren ?? d.crossBoundaryTree } : {}),
                     ...(workflowTaskId !== undefined ? { runId: workflowTaskId } : {}),
                     journalStore: d.journalStore,
                     ...(resumeFromRunId !== undefined ? { resumeFromRunId } : {}),

package/dist/orchestration/workflow-governance.d.ts

@@ -92,7 +92,7 @@ export interface WorkflowAgentSpec extends ScriptClampSeats {
  * restricting value, an add-only row through the row's script and entry laws. A row marked inherited-only (its
  * restricting value switches off an operator-side record) is outside this set and is stripped like any other key.
  */
-export declare const WHITELIST_KEYS: readonly ("thinking" | "systemPrompt" | "objective" | "images" | "limits" | ScriptSeat | "modelName")[];
+export declare const WHITELIST_KEYS: readonly ("objective" | "images" | "thinking" | "systemPrompt" | "limits" | ScriptSeat | "modelName")[];
 /**
  * #505 ② — ACCEPTED ALIAS SPELLINGS on the spec: `alias → the {@link WHITELIST_KEYS} member it means`.
  *

package/dist/orchestration/workflow.d.ts

@@ -359,6 +359,9 @@ export interface RunWorkflowOptions {
      *  placed at the ladder/gate root. Absent ⇒ nothing extra travels (the rootSessionId chain is the
      *  placement root through prepare's mint middle segment). */
     placementRoot?: string;
+    /** The host run tree's cross-boundary token (`RunInternals.crossBoundaryTree`, threaded by the run-workflow tool): every
+     *  workflow-spawned agent joins the tree it names, so a bit a workflow agent sets is read by the host and its siblings. */
+    crossBoundaryTree?: import("../core/cross-boundary-taint.js").CrossBoundaryTreeToken;
     /** design/149 — the PROCESS-level child observer (same seam as
      *  {@link import("../core/types.js").RunnerDeps.onBackgroundChildEvent}). When set, every workflow
      *  agent emits spawn/tick/terminal {@link import("../core/types.js").BackgroundChildEvent} frames with a

package/dist/orchestration/workflow.js

@@ -120,7 +120,7 @@ export function applyWorkflowAgentType(spec, agentType, registry) {
     if (out.memoryPersistenceCapable === undefined && def.memoryPersistenceCapable !== undefined)
         out.memoryPersistenceCapable = def.memoryPersistenceCapable;
     if (def.allowTools !== undefined || def.denyTools !== undefined) {
-        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: deniedToolNamesOf(`workflow agentType "${def.name}"`, def.denyTools) } : {}), scope: "narrowing" });
+        const perType = createAllowDenyPolicy({ ...(def.allowTools ? { allow: def.allowTools } : {}), ...(def.denyTools ? { deny: deniedToolNamesOf(`workflow agentType "${def.name}"`, def.denyTools) } : {}) });
         out.toolPolicy = out.toolPolicy ? combinePolicies(out.toolPolicy, perType) : perType;
     }
     return out;
@@ -725,6 +725,7 @@ export function startWorkflow(runner, fn, opts = {}, internals) {
         ...(agentCeiling !== undefined ? { toolCeiling: agentCeiling } : {}),
         ...((opts.rootSessionId ?? opts.originatingSessionId) !== undefined ? { rootSessionId: opts.rootSessionId ?? opts.originatingSessionId } : {}),
         ...(opts.placementRoot !== undefined ? { placementRoot: opts.placementRoot } : {}),
+        ...(opts.crossBoundaryTree !== undefined ? { crossBoundaryTree: opts.crossBoundaryTree } : {}),
         ...(opts.originatingSessionId !== undefined ? { parentSessionId: opts.originatingSessionId } : {}),
     };
     const captureFloorSeatsNow = async () => {