@sema-agent/core 7.53.0 → 7.54.0

package/dist/core/auto-compaction.js

@@ -1,11 +1,13 @@
 import { CROSS_SESSION_MESSAGE_TAG } from "../agents/cross-session-envelope.js";
 import { DEFAULT_CHARS_PER_TOKEN, DEFAULT_CLAMP_TOLERANCE, DEFAULT_COMPACTION_SETTINGS, CompactionError, compact, computeFileLists, dryRunSummarizationClamp, estimateContextTokens, estimateTokens, formatFileOperations, formatPersistedOutputRefs, prepareCompaction, shouldCompact, uuidv7, } from "../internal/harness.js";
 import { fileArgPath } from "./tool-registry.js";
+import { userAttachmentOf } from "../internal/llm.js";
 import { contextEditFrontier, resolveTriggerWindow } from "./context-edit.js";
 import { selectCompactionEpoch } from "../prompt-assembly/epoch.js";
 import { brainToRuntime } from "./runtime.js";
 import { defuseFenceMarkers, sanitizeUntrustedText } from "./untrusted-text.js";
 import { createSafeNotifier, observeThenableRejection } from "./safe-notify.js";
+import { thrownText } from "./thrown-value.js";
 export const DEFAULT_COMPACTION_INSTRUCTIONS = "Preserve verbatim every code, identifier, name, number, file path, error message, credential " +
     "reference, and explicit user instruction or decision mentioned anywhere in the conversation. " +
     "When in doubt, keep the specific detail rather than generalizing it.";
@@ -18,10 +20,6 @@ export function sanitizeCompactionInstructions(text) {
         ? cps.slice(0, COMPACTION_INSTRUCTIONS_MAX_CHARS).join("")
         : defused;
 }
-const WORKING_FILE_BREAKOUT_TAGS = ["working-file", "summary"];
-function escapeWorkingFilePathAttr(path) {
-    return path.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/[\r\n]+/g, " ");
-}
 const COMPACTION_MANUAL_CANCEL_FLAG = "semaCompactionManualCancel";
 export function isCompactionManualCancel(err) {
     return (typeof err === "object" && err !== null && err[COMPACTION_MANUAL_CANCEL_FLAG] === true);
@@ -336,10 +334,15 @@ export async function maybeCompact(opts) {
         details = res.value.details;
     }
     const persistStartAt = summaryEndAt ?? Date.now();
-    let summaryWithAttachments = summary;
-    const attachedFiles = [];
-    const attachedComplete = [];
+    let restoreFrames = [];
     const att = opts.workingFileAttachments;
+    const undelivered = (label, reason) => {
+        try {
+            att?.undelivered?.(label, reason);
+        }
+        catch {
+        }
+    };
     const recentlyRead = att?.recentlyReadFiles?.() ?? [];
     const rawCandidateFiles = recentlyRead.length > 0 ? recentlyRead : (details?.modifiedFilesByRecency ?? details?.modifiedFiles);
     const maxFilesForSelection = Math.max(1, att?.maxFiles ?? 3);
@@ -352,6 +355,9 @@ export async function maybeCompact(opts) {
                 const dedupStub = att?.isDedupStubResult;
                 for (let i = firstKeptIdx; i < branch.length; i++) {
                     const entry = branch[i];
+                    const frame = entry?.type === "message" ? userAttachmentOf(entry.message) : undefined;
+                    if (frame?.observation !== undefined && (frame.outcome === "attached" || frame.outcome === "partial"))
+                        keptTailReadPathsRaw.add(frame.observation.key);
                     if (entry.type !== "message" || entry.message.role !== "assistant")
                         continue;
                     const msg = entry.message;
@@ -432,44 +438,13 @@ export async function maybeCompact(opts) {
         const maxFiles = maxFilesForSelection;
         const perFileCap = Math.max(200, att.maxCharsPerFile ?? 16_000);
         const windowShareChars = windowKnown ? Math.floor(window * 0.15) * cpt : Number.POSITIVE_INFINITY;
-        let remaining = Math.min(maxFiles * perFileCap, windowShareChars);
-        const blocks = [];
-        for (const path of candidateFiles.slice(0, maxFiles)) {
-            if (remaining <= 0)
-                break;
-            let content = null;
-            let withheldPattern;
-            try {
-                const r = await att.readFile(path);
-                if (typeof r === "string")
-                    content = r;
-                else if (r !== null && typeof r === "object")
-                    withheldPattern = r.withheld.pattern;
-            }
-            catch {
-                content = null;
-            }
-            if (withheldPattern !== undefined) {
-                blocks.push(`<working-file path="${escapeWorkingFilePathAttr(path)}" withheld="content withheld: matches the sensitive-path read deny list (pattern ${escapeWorkingFilePathAttr(withheldPattern)})"/>`);
-                continue;
-            }
-            if (content === null)
-                continue;
-            const cap = Math.min(perFileCap, remaining);
-            const wasClipped = content.length > cap;
-            const clipped = wasClipped
-                ? `${content.slice(0, cap)}\n[... ${content.length - cap} more characters truncated — read the file for the rest]`
-                : content;
-            remaining -= clipped.length;
-            blocks.push(`<working-file path="${escapeWorkingFilePathAttr(path)}">\n${sanitizeUntrustedText(clipped, WORKING_FILE_BREAKOUT_TAGS)}\n</working-file>`);
-            attachedFiles.push({ path, chars: Math.min(content.length, cap), truncated: wasClipped });
-            if (!wasClipped)
-                attachedComplete.push({ path, content });
-        }
-        if (blocks.length > 0) {
-            summaryWithAttachments +=
-                "\n\nCurrent on-disk contents of files touched in the summarized work (re-read at compaction time — trust these over any excerpts in the summary above):\n" +
-                    blocks.join("\n");
+        try {
+            restoreFrames = await att.restore({ candidates: candidateFiles, maxFiles, perFileChars: perFileCap, totalChars: Math.min(maxFiles * perFileCap, windowShareChars), charsPerToken: cpt, preserveKeys: excludedReadStatePreserveKeys });
+        }
+        catch (err) {
+            restoreFrames = [];
+            for (const path of candidateFiles.slice(0, maxFiles))
+                undelivered(path, `the restore failed: ${thrownText(err)}`);
         }
     }
     let preChars = 0;
@@ -484,7 +459,7 @@ export async function maybeCompact(opts) {
     if (opts.signal?.aborted === true) {
         throw Object.assign(new Error("compaction cancelled before commit — the abort signal fired during the summary call; nothing was persisted"), opts.manualCancelSignal?.aborted === true ? { [COMPACTION_MANUAL_CANCEL_FLAG]: true } : {});
     }
-    await opts.session.appendCompaction(summaryWithAttachments, firstKeptEntryId, summaryTokensBefore, {
+    await opts.session.appendCompaction(summary, firstKeptEntryId, summaryTokensBefore, {
         ...(details ?? {}),
         ...(restatedEpoch !== undefined ? { promptEpoch: restatedEpoch } : {}),
         ...(restatedListings !== undefined ? { announcedListings: restatedListings } : {}),
@@ -502,6 +477,26 @@ export async function maybeCompact(opts) {
         catch {
         }
     }
+    const delivered = [];
+    for (const f of restoreFrames) {
+        try {
+            await opts.session.appendMessage({ role: "user", content: [...f.seed.content], timestamp: Date.now(), provenance: "engine-note", attachment: f.seed.attachment });
+            delivered.push(f);
+        }
+        catch (err) {
+            for (const g of restoreFrames.slice(delivered.length))
+                undelivered(g.seed.attachment.label, `the transcript did not take the restore frame: ${thrownText(err)}`);
+            break;
+        }
+    }
+    try {
+        opts.onApplied?.(excludedReadStatePreserveKeys);
+        for (const f of delivered)
+            f.commit?.();
+    }
+    catch {
+    }
+    const attachedFiles = delivered.flatMap(({ seed: { attachment: a } }) => ((a.outcome === "attached" || a.outcome === "partial") && a.dataBlocks.end > a.dataBlocks.start ? [{ path: a.label, chars: a.chars, truncated: a.truncated }] : []));
     if (opts.gitRestate !== undefined) {
         try {
             await opts.gitRestate.land();
@@ -516,11 +511,6 @@ export async function maybeCompact(opts) {
         catch {
         }
     }
-    try {
-        opts.onApplied?.(attachedComplete, excludedReadStatePreserveKeys);
-    }
-    catch {
-    }
     if (ca !== undefined && restatedEpoch !== undefined) {
         try {
             ca.apply(restatedEpoch.identity);

package/dist/core/auto-mode-prompt.d.ts

@@ -47,14 +47,16 @@ export interface DerivedDenyRule {
  * The effective READ-deny table as the classifier's deny lines — one line per row, the row's reach in the
  * engine's own `Read(...)` path-rule grammar.
  *
- * A read-deny row is a run of path SEGMENTS matched anywhere in a path — the entry itself and everything under
+ * An UNANCHORED read-deny row is a run of path SEGMENTS matched anywhere in a path — the entry itself and everything under
  * it — and its `*` never crosses a `/` (read-deny.ts: `.ssh` refuses `~/.ssh/id_rsa` and `/srv/x/.ssh/config`
  * alike; a `**` segment matches exactly one segment). The rule grammar reaches the path a pattern names and
  * everything under it, so the line is `//**` + `/` + the row with every run of stars written `*` (one segment,
  * as in the row): `.ssh` ⇒ `Read(//**\/.ssh)`, `**\/secrets/**` ⇒ `Read(//**\/*\/secrets/*)`, `*` (every
  * path) ⇒ `Read(//**\/*)`. A row that names no segment at all (`""`, `/`) is not stated. A HOME-ANCHORED row
  * (`~/<run>`, read-deny.ts `READ_DENY_HOME_WORD`) is the rule grammar's home word with the same reach:
- * `~/.sema/settings.json` ⇒ `Read(~/.sema/settings.json)`.
+ * `~/.sema/settings.json` ⇒ `Read(~/.sema/settings.json)`; a ROOTED row (`/etc/shadow`, anchored at the filesystem
+ * root) is the rule grammar's absolute path: `Read(//etc/shadow)`. Which of the three a row is, is the one judge's
+ * answer (`readDenyRowAnchor`), asked here as everywhere a row is read.
  *
  * The text of a row can come from a task (a spawned task's author included) and it is spliced into a trusted
  * prompt, so a row is stated as a rule and nothing else: every character the grammar or the prompt must not

package/dist/core/auto-mode-prompt.js

@@ -1,7 +1,7 @@
 import { AUTO_MODE_DEFAULT_WINDOW_MAX_CHARS, AUTO_MODE_DEFAULT_WINDOW_MAX_ENTRIES, AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 import { AUTO_MODE_BASE_PROMPT, AUTO_MODE_PERMISSIONS_EXTERNAL } from "./auto-mode-prompt-assets.js";
 import { cutEnginePrefix, cutEngineSegments, flattenableUserText } from "./untrusted-text.js";
-import { readDenyPatternRun } from "../tools/fs/read-deny.js";
+import { readDenyPatternRun, readDenyRowAnchor } from "../tools/fs/read-deny.js";
 import { renderContentBlock, renderUserAttachmentView, userAttachmentOf } from "../internal/llm.js";
 export { AUTO_MODE_DEFAULTS_SENTINEL } from "./auto-mode-defaults.js";
 function mergeRuleSection(user, defaultsInner) {
@@ -36,12 +36,13 @@ export function readDenyClassifierRules(entries, rules = []) {
         out.push(line);
     };
     for (const { pattern, caseSensitive } of entries) {
-        const { homeAnchored, run } = readDenyPatternRun(pattern);
+        const { run } = readDenyPatternRun(pattern);
         const segments = run.split("/").filter((seg) => seg.length > 0);
         if (segments.length === 0)
             continue;
         const stated = statedPattern(segments.join("/"));
-        push({ rule: homeAnchored ? `Read(~/${stated})` : `Read(//**/${stated})`, ...(caseSensitive !== true && /[A-Za-z]/.test(stated) ? { anyCase: true } : {}) });
+        const anchor = readDenyRowAnchor(pattern);
+        push({ rule: anchor === "home" ? `Read(~/${stated})` : anchor === "root" ? `Read(//${stated})` : `Read(//**/${stated})`, ...(caseSensitive !== true && /[A-Za-z]/.test(stated) ? { anyCase: true } : {}) });
     }
     for (const { tool, pattern } of rules) {
         if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(tool) || pattern.length === 0)

package/dist/core/canonical-json.d.ts

@@ -1,3 +1,4 @@
+import { type ReceiptFault } from "./mods/kernel/receive.js";
 /**
  * design/80 D-1 §2 (slice 1a.2) — the engine-only **vetted canonical serializer** used to mint a stable,
  * opaque {@link boundInputHashOf | boundInputHash} over a pending tool call's arguments.
@@ -60,3 +61,71 @@ export declare const UNCANONICALIZABLE = "<uncanonicalizable>";
  * The hex digest is fixed-length and opaque — exactly what the operator sees / the D-G signer signs.
  */
 export declare function boundInputHashOf(value: unknown): string;
+/**
+ * The {@link boundInputHashOf} digest of `value` when an approval can be bound to it ({@link bindableValueOf}), else `undefined` —
+ * the digest a license is compared by, one only those bytes have. Over the bindable domain the canonical form is exact (no
+ * sentinel token stands for part of it), so the digest is the bytes; outside it there is none to give.
+ */
+export declare function exactBoundInputHashOf(value: unknown): string | undefined;
+/**
+ * Why a value is outside the bindable domain: its top is not the payload's shape, a refusal of the receipt it is read by, or one of
+ * JSON's own five — a number that is not finite, a hole in a list, a named member on a list, an `undefined` list element, one
+ * object met twice.
+ */
+export type BindingFault = ReceiptFault | {
+    readonly kind: "not-container" | "not-finite" | "hole" | "list-member" | "undefined-element" | "shared";
+    readonly path: readonly string[];
+};
+/**
+ * THE judge of the BINDABLE domain — the values an approval can be bound to, and so the only values with an exact digest: plain
+ * JSON data (records, dense lists, strings, finite numbers, booleans, `null`; a record member that is `undefined` is kept as it
+ * is, as absent from JSON) under a top of the payload's own shape (`top`: a call's arguments are a RECORD — the default, and the
+ * only shape an exact digest is taken of; a question's answers are a LIST), a tree (no object met twice), at most 256 levels of
+ * containers. Read by the engine's one receipt of a caller's value in {@link BINDING_RECEIPT} (nothing of the caller's runs: a
+ * getter, a hidden or symbol-keyed member, a Proxy, a function, a symbol, a bigint, a Map / Set / Date / binary or any other kind
+ * of object, a cycle, nesting past the levels — each refused), then JSON's own five on the receipt's frozen copy. Ok ⇒ that copy.
+ */
+export declare function bindableValueOf(value: unknown, top?: BindingTop): {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly fault: BindingFault;
+};
+/** The top a bound payload has: a call's arguments are a record, a question's answers a list. */
+export type BindingTop = "record" | "list";
+/** THE capture of a caller-supplied payload the engine persists and later compares (a durable decide's edit — a record —, a
+ *  question's answers — a list): the judge's receipt ({@link bindableValueOf}) kept in the form a durable store's JSON round trip
+ *  hands back ({@link jsonFormOf}). */
+export declare function capturedJsonOf(value: unknown, top?: BindingTop): {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly fault: BindingFault;
+};
+/** One clause naming a binding fault, its path rooted at `args` (`value` is what the judge was given: for a value that is not
+ *  data, its `typeof` is read at the fault's place). The text holds the value's own member names: contain it to show it. */
+export declare function describeBindingFault(value: unknown, fault: BindingFault): string;
+/**
+ * Recursion-depth ceiling. Makes {@link encode} TOTAL against the two ways a naive recursive walk throws:
+ * a CIRCULAR reference (infinite recursion → `Maximum call stack size`) and pathological DEEP nesting (a
+ * RangeError before the JS stack limit). At/below this depth a deterministic sentinel is emitted instead of
+ * recursing — so {@link boundInputHashOf} can never throw. This is load-bearing (MAJOR-4): digests are read after a remote
+ * VM is paused (the park's target mint compares one), where a throw would skip the unpause compensation and leak the VM.
+ * 256 is far below the engine's stack limit yet far deeper than any real tool-arg payload. It is also the bindable domain's
+ * bound ({@link BINDING_RECEIPT}), so no value with an exact digest meets the sentinel.
+ */
+export declare const MAX_DEPTH = 256;
+/** Canonical JSON (recursively sorted keys, no whitespace) — the erasure protocol's ONE comparison
+ *  and hash basis: `selectHash` complains bind to it, and evidence rows are written/compared in this
+ *  form so a re-serialized import (key order changed by a middle layer) still compares equal. The memory
+ *  export bundle's section hashes are sha256 over it, and a backend that hashes or compares the same
+ *  records calls this function — the bytes are the contract, so there is no second copy to keep in step.
+ *
+ *  Not {@link canonicalize}: that one emits a type-tagged, length-prefixed form that is not JSON and is
+ *  never compared across runtimes; this one emits JSON text for JSON-shaped input (an `undefined` member
+ *  omitted, an `undefined` / function / symbol array element as `null`, a scalar through `JSON.stringify`,
+ *  an object read by its own enumerable keys with no `toJSON` call). The two answer different questions
+ *  and their outputs are not interchangeable. */
+export declare function canonicalJsonStringify(value: unknown): string;

package/dist/core/canonical-json.js

@@ -1,4 +1,6 @@
 import { createHash } from "node:crypto";
+import { types } from "node:util";
+import { describeFault, receive } from "./mods/kernel/receive.js";
 export function canonicalize(value) {
     try {
         return encode(value);
@@ -11,7 +13,115 @@ export const UNCANONICALIZABLE = "<uncanonicalizable>";
 export function boundInputHashOf(value) {
     return createHash("sha256").update(canonicalize(value), "utf8").digest("hex");
 }
-const MAX_DEPTH = 256;
+export function exactBoundInputHashOf(value) {
+    const bound = bindableValueOf(value);
+    if (!bound.ok)
+        return undefined;
+    const form = canonicalize(bound.value);
+    return form === UNCANONICALIZABLE ? undefined : createHash("sha256").update(form, "utf8").digest("hex");
+}
+export function bindableValueOf(value, top = "record") {
+    const received = receive(value, BINDING_RECEIPT);
+    if (!received.ok)
+        return received;
+    const copy = received.value;
+    const topOk = top === "list" ? Array.isArray(copy) : typeof copy === "object" && copy !== null && !Array.isArray(copy);
+    if (!topOk)
+        return { ok: false, fault: { kind: "not-container", path: [] } };
+    const fault = jsonFaultIn(copy, [], new Set());
+    return fault === undefined ? { ok: true, value: received.value } : { ok: false, fault };
+}
+export function capturedJsonOf(value, top = "record") {
+    const bound = bindableValueOf(value, top);
+    return bound.ok ? { ok: true, value: jsonFormOf(bound.value) } : bound;
+}
+function jsonFormOf(value) {
+    if (Object.is(value, -0))
+        return 0;
+    if (typeof value !== "object" || value === null)
+        return value;
+    if (Array.isArray(value))
+        return value.map(jsonFormOf);
+    const out = {};
+    for (const [key, member] of Object.entries(value))
+        if (member !== undefined)
+            Object.defineProperty(out, key, { value: jsonFormOf(member), enumerable: true, writable: true, configurable: true });
+    return out;
+}
+function jsonFaultIn(v, path, met) {
+    if (typeof v === "number")
+        return Number.isFinite(v) ? undefined : { kind: "not-finite", path: [...path] };
+    if (typeof v !== "object" || v === null)
+        return undefined;
+    if (met.has(v))
+        return { kind: "shared", path: [...path] };
+    met.add(v);
+    const members = [];
+    if (Array.isArray(v)) {
+        for (let i = 0; i < v.length; i++) {
+            if (!Object.hasOwn(v, i))
+                return { kind: "hole", path: [...path, String(i)] };
+            if (v[i] === undefined)
+                return { kind: "undefined-element", path: [...path, String(i)] };
+            members.push([String(i), v[i]]);
+        }
+        const named = Object.keys(v).find((k) => !isIndexBelow(k, v.length));
+        if (named !== undefined)
+            return { kind: "list-member", path: [...path, named] };
+    }
+    else
+        for (const entry of Object.entries(v))
+            members.push(entry);
+    for (const [key, member] of members) {
+        path.push(key);
+        const fault = jsonFaultIn(member, path, met);
+        path.pop();
+        if (fault !== undefined)
+            return fault;
+    }
+    return undefined;
+}
+export function describeBindingFault(value, fault) {
+    const path = ["args", ...fault.path];
+    const at = ` at ${path.join(".")}`;
+    switch (fault.kind) {
+        case "not-container":
+            return `a value that is not a record${at}`;
+        case "not-finite":
+            return `a number that is not finite${at}`;
+        case "hole":
+            return `a hole in a list${at}`;
+        case "list-member":
+            return `a named member on a list${at}`;
+        case "undefined-element":
+            return `an undefined list element${at}`;
+        case "shared":
+            return `one object met twice${at} (a shared reference)`;
+        case "too-deep":
+            return `containers nested deeper than ${MAX_DEPTH} levels`;
+        case "not-data":
+            return `${kindOfValueAt(value, fault.path)}${at}`;
+        default:
+            return describeFault({ ...fault, path });
+    }
+}
+function kindOfValueAt(value, path) {
+    let at = value;
+    for (const key of path)
+        at = typeof at === "object" && at !== null ? at[key] : undefined;
+    if (typeof at === "function" || typeof at === "symbol" || typeof at === "bigint")
+        return `a ${typeof at}`;
+    return typeof at === "object" && at !== null ? "an object that is not a plain record or list" : "a value that is not data";
+}
+export const MAX_DEPTH = 256;
+const BINDING_RECEIPT = Object.freeze({ accessors: "refuse", depth: MAX_DEPTH, past: "refuse", others: "refuse", freeze: true, isProxy: (v) => types.isProxy(v) });
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+function segment(text) {
+    if (!LONE_SURROGATE.test(text))
+        return `${Buffer.byteLength(text, "utf8")}:${text}`;
+    const spelled = JSON.stringify(text);
+    return `S${Buffer.byteLength(spelled, "utf8")}:${spelled}`;
+}
 function encode(value, depth = 0) {
     if (value === null)
         return "N";
@@ -25,7 +135,7 @@ function encode(value, depth = 0) {
         case "bigint":
             return `i:${value.toString()}`;
         case "string":
-            return `s${Buffer.byteLength(value, "utf8")}:${value}`;
+            return `s${segment(value)}`;
         case "function":
             return "fn";
         case "symbol":
@@ -66,7 +176,7 @@ function encodeOwnKeys(source, depth, skipIndicesBelow = 0) {
         catch {
             encoded = "<unreadable-property>";
         }
-        out += `${Buffer.byteLength(k, "utf8")}:${k}=${encoded}`;
+        out += `${segment(k)}=${encoded}`;
     }
     return `${out}}`;
 }
@@ -91,7 +201,7 @@ function encodeBranded(value, depth) {
         try {
             const { buffer, byteOffset, byteLength, elements, family } = viewRange(value);
             const bytesToken = digestBytes(new Uint8Array(buffer, byteOffset, byteLength));
-            return `V:${family}:${brand}:${byteLength}:${bytesToken}${encodeOwnKeys(value, depth, elements)}`;
+            return `V:${family}:${segment(brand)}:${byteLength}:${bytesToken}${encodeOwnKeys(value, depth, elements)}`;
         }
         catch {
         }
@@ -128,16 +238,16 @@ function encodeBranded(value, depth) {
             case "RegExp": {
                 const source = String(regexpSourceGetter.call(value));
                 const flags = String(regexpFlagsGetter.call(value));
-                return `r${Buffer.byteLength(source, "utf8")}:${source}/${flags}${own}`;
+                return `r${segment(source)}/${flags}${own}`;
             }
             case "Error": {
                 const name = String(value.name);
                 const message = String(value.message);
-                return `E${Buffer.byteLength(name, "utf8")}:${name}:${Buffer.byteLength(message, "utf8")}:${message}${own}`;
+                return `E${segment(name)}:${segment(message)}${own}`;
             }
             case "URL": {
                 const href = String(urlHrefGetter.call(value));
-                return `L${Buffer.byteLength(href, "utf8")}:${href}${own}`;
+                return `L${segment(href)}${own}`;
             }
             case "Boolean":
             case "Number":
@@ -158,7 +268,7 @@ function encodeBranded(value, depth) {
     }
     catch {
     }
-    return `x${Buffer.byteLength(brand, "utf8")}:${brand}${own}`;
+    return `x${segment(brand)}${own}`;
 }
 function primordialGetter(proto, key) {
     const get = Object.getOwnPropertyDescriptor(proto, key)?.get;
@@ -236,3 +346,15 @@ function encodeNumber(n) {
         return "0";
     return String(n);
 }
+export function canonicalJsonStringify(value) {
+    if (Array.isArray(value))
+        return `[${value.map((v) => (v === undefined || typeof v === "function" || typeof v === "symbol" ? "null" : canonicalJsonStringify(v))).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const rec = value;
+        const keys = Object.keys(rec)
+            .filter((k) => rec[k] !== undefined)
+            .sort();
+        return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJsonStringify(rec[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}

package/dist/core/checkpoint-requirements.d.ts

@@ -6,7 +6,7 @@ import { type StoreFidelity, type Checkpoint, type CheckpointFeature, type Check
  * had carried beside the one its word now names, and the members added after the table, each a capability a reader
  * must have. Downstream reads them for display only (`CheckpointError.detail.requires`).
  */
-export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists"];
+export declare const REQUIREMENT_WORDS: readonly ["resource", "binding", "token", "orgAdmission", "f012", "realApproval", "face", "requirements_digest", "org_admission_inherited", "org_write_grant", "org_governed", "delegation_provenance", "skill_grants", "skill_card_binding", "hands_coordinates", "hands_home", "path_rule_anchors", "path_rule_installations", "permission_mode", "plan_mode_restore", "persisted_rule_mandate", "deployment_authored", "call_names", "write_face", "denial_limit_fallback", "leg_scope", "tool_ceiling", "tool_lists_judged", "own_tool_lists", "approval_targets", "cross_boundary"];
 export type RequirementWord = (typeof REQUIREMENT_WORDS)[number];
 /** Runtime twin of {@link RequirementWord}. */
 export declare function isRequirementWord(word: unknown): word is RequirementWord;
@@ -227,6 +227,9 @@ export declare const CHECKPOINT_STATE_REQUIREMENTS: {
     readonly ownToolLists: {
         readonly word: "own_tool_lists";
     };
+    readonly crossBoundaryRecorded: {
+        readonly word: "cross_boundary";
+    };
 };
 export declare const PENDING_ACTION_REQUIREMENTS: {
     readonly tool_approval: {
@@ -308,9 +311,6 @@ export declare const PENDING_ACTION_REQUIREMENTS: {
         readonly implementationRevision: {
             readonly digest: "decision-read";
         };
-        readonly rosterDigest: {
-            readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
-        };
         readonly family: {
             readonly digest: "decision-read";
         };
@@ -320,6 +320,9 @@ export declare const PENDING_ACTION_REQUIREMENTS: {
         readonly names: {
             readonly word: "call_names";
         };
+        readonly targets: {
+            readonly word: "approval_targets";
+        };
         readonly hasBidiControls: {
             readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
         };
@@ -582,6 +585,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
             readonly ownToolLists: {
                 readonly word: "own_tool_lists";
             };
+            readonly crossBoundaryRecorded: {
+                readonly word: "cross_boundary";
+            };
         };
     };
     readonly resourceLedger: {
@@ -808,9 +814,6 @@ export declare const CHECKPOINT_REQUIREMENTS: {
                 readonly implementationRevision: {
                     readonly digest: "decision-read";
                 };
-                readonly rosterDigest: {
-                    readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
-                };
                 readonly family: {
                     readonly digest: "decision-read";
                 };
@@ -820,6 +823,9 @@ export declare const CHECKPOINT_REQUIREMENTS: {
                 readonly names: {
                     readonly word: "call_names";
                 };
+                readonly targets: {
+                    readonly word: "approval_targets";
+                };
                 readonly hasBidiControls: {
                     readonly ignorable: "shown, never decided (card, listing, transcript or reported count): every read of the name renders, carries transcript or counts";
                 };

package/dist/core/checkpoint-requirements.js

@@ -31,6 +31,8 @@ export const REQUIREMENT_WORDS = Object.freeze([
     "tool_ceiling",
     "tool_lists_judged",
     "own_tool_lists",
+    "approval_targets",
+    "cross_boundary",
 ]);
 export function isRequirementWord(word) {
     return typeof word === "string" && REQUIREMENT_WORDS.includes(word);
@@ -92,6 +94,7 @@ export const CHECKPOINT_STATE_REQUIREMENTS = {
     toolCeiling: { word: "tool_ceiling" },
     toolListsJudged: { word: "tool_lists_judged" },
     ownToolLists: { word: "own_tool_lists" },
+    crossBoundaryRecorded: { word: "cross_boundary" },
 };
 export const PENDING_ACTION_REQUIREMENTS = {
     tool_approval: {
@@ -121,10 +124,10 @@ export const PENDING_ACTION_REQUIREMENTS = {
         contractId: DECISION_READ,
         shapeDigest: DECISION_READ,
         implementationRevision: DECISION_READ,
-        rosterDigest: SHOWN,
         family: DECISION_READ,
         pathTarget: DECISION_READ,
         names: { word: "call_names" },
+        targets: { word: "approval_targets" },
         hasBidiControls: SHOWN,
         batchToolCallIds: DECISION_READ,
         completedCallIds: SHOWN,