@sema-agent/core 7.54.1 → 7.56.0

package/dist/core/protocol-http-auth.js

@@ -1,4 +1,5 @@
-import { credentialHeaderValues, holdOwnCredentialValues } from "./secret-env.js";
+import { authSchemeCredentials, credentialHeaderValues, holdOwnCredentialValues } from "./secret-env.js";
+import { readMember } from "./thrown-value.js";
 import { inlineUntrusted } from "./untrusted-text.js";
 export function headerOwnershipCollision(t) {
     const owners = new Map();
@@ -30,12 +31,144 @@ export function underDeclaredHeaders(defaults, declared) {
     const owned = new Set(Object.keys(declared ?? {}).map((k) => k.toLowerCase()));
     return { ...Object.fromEntries(Object.entries(defaults).filter(([k]) => !owned.has(k.toLowerCase()))), ...declared };
 }
+const httpTrimmed = (value) => value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+export function declaredHeaderValues(transport, principal) {
+    const out = new Set();
+    try {
+        const headers = readMember(transport, "headers");
+        if (typeof headers === "object" && headers !== null) {
+            for (const value of Object.values(headers))
+                if (typeof value === "string")
+                    out.add(value);
+        }
+    }
+    catch {
+    }
+    const principalHeader = readMember(transport, "principalHeader");
+    if (typeof principalHeader === "string" && principalHeader !== "" && principal !== undefined)
+        out.add(principal);
+    out.delete("");
+    return [...out];
+}
+function percentEncoded(value) {
+    try {
+        return encodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+const formEncoded = (value) => new URLSearchParams([["v", value]]).toString().slice(2);
+function requestEchoSpellings(value) {
+    const sent = httpTrimmed(value);
+    const rest = authSchemeCredentials(sent);
+    const spellings = new Set();
+    for (const base of rest === undefined ? [value, sent] : [value, sent, rest]) {
+        const json = JSON.stringify(base).slice(1, -1);
+        const component = percentEncoded(base);
+        const form = formEncoded(base);
+        for (const spelling of [base, json, json.replace(/\//g, "\\/"), base.replace(/ /g, "+"), component, component.replace(/%20/g, "+"), form.replace(/\+/g, "%20"), form])
+            spellings.add(spelling);
+    }
+    return [...spellings];
+}
+const ECHO_MARKER = "[redacted]";
+const COOKIE_START = String.raw `(?<![\w-])(?<cookie>(?:[Ss][Ee][Tt]-)?[Cc][Oo][Oo][Kk][Ii][Ee])(?<quote>["']?)[ \t]*:`;
+function stringEnd(text, at) {
+    for (let i = at + 1; i < text.length; i++) {
+        if (text[i] === "\\")
+            i++;
+        else if (text[i] === text[at])
+            return i + 1;
+    }
+    return text.length;
+}
+function structuredEnd(text, at) {
+    const c = text[at];
+    if (c === '"' || c === "'")
+        return stringEnd(text, at);
+    if (c !== "[" && c !== "{") {
+        let i = at;
+        while (i < text.length && !",}]\r\n".includes(text[i]))
+            i++;
+        return i;
+    }
+    let depth = 0;
+    for (let i = at; i < text.length; i++) {
+        const d = text[i];
+        if (d === '"' || d === "'")
+            i = stringEnd(text, i) - 1;
+        else if (d === "[" || d === "{")
+            depth++;
+        else if ((d === "]" || d === "}") && --depth === 0)
+            return i + 1;
+    }
+    return text.length;
+}
+export function scrubRequestEcho(text, declared) {
+    const forms = new Set();
+    for (const value of declared)
+        for (const spelling of requestEchoSpellings(value))
+            forms.add(spelling);
+    forms.delete("");
+    const members = cookieMembers(text);
+    const removed = members.map(([, from, end]) => [from, end]);
+    for (const hit of valueHits(text, [...forms])) {
+        if (!members.some(([name, from]) => hit[0] >= name && hit[1] <= from))
+            removed.push(hit);
+    }
+    if (removed.length === 0)
+        return text;
+    removed.sort((a, b) => a[0] - b[0] || b[1] - a[1]);
+    let out = "";
+    let kept = 0;
+    for (const [start, end] of removed) {
+        if (start < kept) {
+            kept = Math.max(kept, end);
+            continue;
+        }
+        out += text.slice(kept, start) + ECHO_MARKER;
+        kept = end;
+    }
+    return out + text.slice(kept);
+}
+function cookieMembers(text) {
+    const members = [];
+    const pattern = new RegExp(COOKIE_START, "g");
+    for (let m = pattern.exec(text); m !== null; m = pattern.exec(text)) {
+        const structured = m.groups?.quote !== "";
+        let from = pattern.lastIndex;
+        while (from < text.length && (structured ? /\s/ : /[ \t]/).test(text[from]))
+            from++;
+        let end = from;
+        if (structured)
+            end = structuredEnd(text, from);
+        else
+            while (end < text.length && text[end] !== "\r" && text[end] !== "\n")
+                end++;
+        members.push([m.index, from, end]);
+        pattern.lastIndex = end;
+    }
+    return members;
+}
+function valueHits(text, forms) {
+    if (forms.length === 0 || text === "")
+        return [];
+    const alternatives = [...forms].sort((a, b) => b.length - a.length).map((f) => f.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+    const hits = [];
+    try {
+        const pattern = new RegExp(alternatives.join("|"), "gi");
+        for (let m = pattern.exec(text); m !== null; m = pattern.exec(text))
+            hits.push([m.index, pattern.lastIndex]);
+    }
+    catch {
+        return [[0, text.length]];
+    }
+    return hits;
+}
 export function carriesDeclaredHeaders(headers) {
     return headers !== undefined && Object.keys(headers).length > 0;
 }
-export function redirectPolicy(headers) {
-    return carriesDeclaredHeaders(headers) ? "manual" : "follow";
-}
 export function assertEndpointBound(protocol, peer, endpoint, declared, headers) {
     if (!carriesDeclaredHeaders(headers))
         return;

package/dist/core/protocol-naming.d.ts

@@ -1,13 +1,13 @@
 import type { ProtocolNamespace } from "./protocol-table.js";
 /** The provider's tool-name pattern is `^[a-zA-Z0-9_-]{1,64}$` — the limit applies to the ASSEMBLED name,
- *  not to its segments (design/116 W5-5, CC 2.1.187 parity `buildMcpToolName`). */
+ *  not to its segments (design/116 W5-5). */
 export declare const TOOL_NAME_MAX_CHARS = 64;
 /** Reserved for the tool segment when budgeting the peer segment: a peer kept at the full name budget
  *  overflows the assembled name on its own (prefix + 64 + separator = 71 > 64), which is how the tool
  *  segment used to be handed a NEGATIVE budget. A tool name shorter than this is not recognizable. */
 export declare const MINTED_TOOL_SEGMENT_MIN_CHARS = 16;
 /**
- * design/116 W5-5 (CC 2.1.187 parity) — normalize a peer/tool segment to the API tool-name charset by
+ * design/116 W5-5 — normalize a peer/tool segment to the API tool-name charset by
  * replacing every other character with `_`. CC does exactly this on BOTH segments when composing
  * `mcp__<server>__<tool>` (services/mcp/normalization.ts `normalizeNameForMCP` + mcpStringUtils.ts
  * `buildMcpToolName`), so a peer advertising a dotted/spaced/unicode name can't mint a name the provider

package/dist/core/read-only-shell-table.d.ts

@@ -1,6 +1,6 @@
 /**
  * The READ-ONLY shell tables — the closed data the read-only reader (`read-only-shell.ts`) judges a
- * command against, transcribed from upstream's own tables (CC 2.1.250) and kept as DATA so the parity
+ * command against, transcribed from upstream's own tables and kept as DATA so the parity
  * question is answered by diffing two tables, never by reading two programs:
  *  - {@link READ_ONLY_COMMAND_TABLE} — the flag-vetted commands: a command (one or more leading words,
  *    `git status`, `gh pr view`, `grep`) with the closed set of flags it may carry, each flag's value

package/dist/core/read-only-shell.d.ts

@@ -8,7 +8,7 @@ export type ReadOnlyShellVerdict = {
     readonly readOnly: false;
     readonly reason: string;
 };
-/** The reference implementation's question for a compound that changes directory and runs git (2.1.280, `cd-git-compound`). */
+/** The reference implementation's question for a compound that changes directory and runs git (`cd-git-compound`). */
 export declare const CD_GIT_COMPOUND_SENTENCE = "This command changes directory before running a version-control command, which can pick up untrusted hooks or repository configuration from the target directory. Approve only if you trust it.";
 /**
  * Does this line change directory and run git — a `cd` beside a `git` — other than by ONE plain `cd <path>` that lands

package/dist/core/retired-keys.d.ts

@@ -20,6 +20,14 @@ export declare function retiredKeyOf(bag: object, table: Readonly<Record<string,
  * `RunWorkflowToolDeps`, `TaskSpec`).
  */
 export declare function assertNoRetiredKeys(bag: object, table: Readonly<Record<string, string>>, owner: string): void;
+/** The refusal {@link assertNoRetiredKeys} throws for a hit — the one sentence and code, for a caller that has to read the bag
+ *  itself (to tell a refusal from a member that cannot be read) and must not read it a second time. */
+export declare function retiredKeyRefusal(hit: {
+    key: string;
+    replacement: string;
+}, owner: string): Error & {
+    code: string;
+};
 /** What replaced the `hooks` record, on a deps bag and on a `TaskSpec` alike: one seat name, one sentence, quoted by both
  *  tables (this one and `runner/retired-runner-deps.ts`). The record's callbacks never run, so a deny one carried would pass
  *  unseen — the key is refused by name instead. */
@@ -29,6 +37,14 @@ export declare const RETIRED_HOOKS_REPLACEMENT = "the callback seats are `mods`
  *  (`config.spec_retired_key`), never read as absence: a mode a caller believes it declared must not silently run
  *  as another. */
 export declare const RETIRED_TASK_SPEC_KEYS: Readonly<Record<string, string>>;
+/** The RETIRED `ToolSpec` members — a spec still carrying one is refused by name (`config.deps_retired_key`) where the
+ *  factory reads the spec, never dropped unseen: a description the author wrote for one prompt shape would silently
+ *  never be shown. */
+export declare const RETIRED_TOOL_SPEC_KEYS: Readonly<Record<string, string>>;
+/** The RETIRED {@link import("../engine/llm/types.js").Model} members — a model still carrying one is refused by name
+ *  (`config.deps_retired_key`) at the model door, never read as absence: text a deployment believes it appended would
+ *  silently not reach the model. */
+export declare const RETIRED_MODEL_KEYS: Readonly<Record<string, string>>;
 /** The RETIRED `ToolPolicy` members — a policy still carrying one is refused by name (`config.deps_retired_key`) wherever
  *  the engine reads a policy's members: the intake of the caller's policy (prepare, and a resume before its claim), the
  *  by-name member reader the wrap and the path-rule installation share, and `combinePolicies`. A member the policy no

package/dist/core/retired-keys.js

@@ -18,11 +18,13 @@ export function retiredKeyOf(bag, table) {
 }
 export function assertNoRetiredKeys(bag, table, owner) {
     const hit = retiredKeyOf(bag, table);
-    if (hit === undefined)
-        return;
+    if (hit !== undefined)
+        throw retiredKeyRefusal(hit, owner);
+}
+export function retiredKeyRefusal(hit, owner) {
     const e = new Error(`${owner}.${hit.key} is retired and is not read by this engine — ${hit.replacement}. Refused rather than ignored: a seat that is silently dropped reads to the deployment as wired.`);
     e.code = owner === "TaskSpec" ? "config.spec_retired_key" : "config.deps_retired_key";
-    throw e;
+    return e;
 }
 export const RETIRED_HOOKS_REPLACEMENT = 'the callback seats are `mods` registrations now — register the extension on `RunnerDeps.mods` (a deployment\'s) or `TaskSpec.mods` (a task\'s), hung on the `classic.*` events (`classic.PreToolUse`, `classic.PostToolUse`, `classic.PostToolBatch`, `classic.UserPromptSubmit`, `classic.Stop`, `classic.SubagentStop`, …); a callback that denied is a handler answering `{ action: "deny", message }`';
 export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
@@ -32,6 +34,13 @@ export const RETIRED_TASK_SPEC_KEYS = Object.freeze({
     "attachments.planModeReminder": "the read-only planning posture is stated whenever the leg's mode is `plan` (first turn, every 5 turns, and an exit frame when it ends) — drop the key",
     "skills[].manifest": "a skill's tools are its `allowedTools` / `disallowedTools` now — an allow-rule and a deny-rule source for the run the skill is activated in, never a fence; move `manifest.allowTools` to `allowedTools`. To fence tools write deny rules (or a delegated agent definition's `allowTools`); to fence write paths use session `allowDirs`",
     promptProvider: "a task changes prompt text through overlays: its role text is `systemPrompt` (it replaces the role base `promptRole` selects), its added block `appendSystemPrompt`, the minimal form `promptForm: \"minimal\"`; anything else is a `prompt.compose` registration on the task's own `mods` answering `{ overlays }` (an already-assembled prompt is refused, never passed through)",
+    promptProfile: 'the prompt\'s shape is the `lean_prompt` trait now — write `promptLean: false` for the long (classic) shape, `promptLean: true` (or nothing, on a model that declares `lean_prompt`) for the lean one',
+});
+export const RETIRED_TOOL_SPEC_KEYS = Object.freeze({
+    descriptionClassic: 'a description\'s other forms are `descriptionVariants` now — the long form is `{ id: "classic", traits: { noneOf: ["lean_prompt"] }, text }`, chosen at mount by the run\'s prompt traits',
+});
+export const RETIRED_MODEL_KEYS = Object.freeze({
+    promptGuidance: "a model selects prompt text by its traits now — declare them in `Model.promptTraits` (the reference's capability names, or a deployment's own `x-<namespace>-<name>`); text meant for one model is an overlay (a center artifact's `add` to the `behavior` band, or a `prompt.compose` registration) whose `when.traits.allOf` names that trait",
 });
 export const RETIRED_TOOL_POLICY_KEYS = Object.freeze({
     writeTargetGuard: "the guarded write targets are stated as rows now — `ToolPolicy.writeGuardRows`, an async provider of the one path table's `PathGuardRow`s the leg's ONE write judgment reads for every writer the policy cannot see as a call (the shell's file commands). A wrapper carries it through `wrapToolPolicy`, which reads every member a policy declares",
@@ -40,9 +49,12 @@ export const RETIRED_SHELL_READ_BOUNDARY_KEYS = Object.freeze({
     writeProtectionJudge: 'the station asks ONE write judgment, `ShellReadBoundary.writeTargetJudge`, over the write-protection table and the deployment\'s guarded write rows together — it answers `"protected"`, `"guarded"` or `undefined`, not a boolean',
     writeTargetGuard: 'the deployment\'s guarded write rows join the same one judgment, `ShellReadBoundary.writeTargetJudge` (`"guarded"` for a target a `ToolPolicy.writeGuardRows` row covers) — the boundary has no second write seat',
 });
+const GUARDS_ARE_ENGINE_FINDINGS = "state `requiresRealApproval: true` for a person's confirmation — the integrity guards are the engine's findings, carried on its attestation record (install the engine's guard policy for one)";
 export const RETIRED_DECISION_MEMBERS = Object.freeze({
     reason: 'rename it to "message" (the one text field a decision carries)',
-    guard: 'write `guards: ["<word>"]` instead (the same five words, as a list: one ask may stand on several integrity guards)',
+    guard: GUARDS_ARE_ENGINE_FINDINGS,
+    guards: GUARDS_ARE_ENGINE_FINDINGS,
+    foldedAskClasses: "the classes of the asks a policy fold collapsed ride the engine's attestation record that combinePolicies writes (a spread of its answer keeps the record); a policy does not state them",
 });
 export function assertNoRetiredToolPolicyKeys(policy) {
     if (policy === undefined || policy === null)

package/dist/core/rewrite-rejudge.d.ts

@@ -0,0 +1,60 @@
+import type { PreToolUseResult } from "./hooks.js";
+import type { PermissionResult } from "./tool-policy.js";
+import type { PreToolUseScreening } from "./runner/gate-exit.js";
+/** What a judge did with the bytes it was handed: kept them (`as_is`), or handed back another form. */
+export type RejudgeReading = {
+    readonly kind: "as_is";
+} | {
+    readonly kind: "rewritten";
+    readonly form: unknown;
+};
+/** Do `a` and `b` read as the same bytes for the call `req` — each as the tool reads it? */
+export declare function sameBytes(req: {
+    readonly face?: object | undefined;
+}, a: unknown, b: unknown): boolean;
+/** The one reading of a judge's answer about the bytes it was handed (`given`): its `updatedInput` is a rewrite only when it
+ *  reads as other bytes; the form is returned as the tool reads it. */
+export declare function readRejudge(req: {
+    readonly face?: object | undefined;
+}, given: unknown, answer: {
+    readonly updatedInput?: unknown;
+} | undefined): RejudgeReading;
+/** What the PreToolUse screening said on its one second look at bytes rewritten after it judged: its verdict on them
+ *  (`stands` — no opinion, an allow, an ask; never a rewrite), or a refusal — the hook's own deny, or the engine's
+ *  (the screening failed, or it handed back yet another form). */
+export type ScreeningRejudge = {
+    readonly kind: "stands";
+    readonly answer: PreToolUseResult | undefined;
+    readonly answeredBy?: string;
+} | {
+    readonly kind: "refused";
+    readonly reason: string;
+    readonly by: "hook" | "engine";
+};
+/** The screening's second look at rewritten `bytes` (the gate's fold after a policy rewrite; the approved-edit pass). */
+export declare function screenRewrite(screening: PreToolUseScreening, req: {
+    readonly face?: object | undefined;
+    readonly toolName: string;
+}, bytes: unknown, subject: string): Promise<ScreeningRejudge>;
+/**
+ * A person's edit the restriction chain accepts only in another form: that form, as the tool reads it. Machine-readable, so
+ * a surface can offer "approve this form" — approving it as it stands runs exactly these bytes (they are the chain's own
+ * answer, so re-judging them changes nothing). Present on the approval request of the question that puts the form to the person,
+ * on a durable resume's refusal (`detail.editRewritten`), and on a refusal's details where nobody is left to ask.
+ */
+export interface EditRewritten {
+    readonly acceptableForm: unknown;
+}
+/** The question that puts a person's edit back to them, over the pass's standing verdict on the form: an allow becomes
+ *  this question; an ask keeps its own words after the outlet sentence (and every member it carries). It goes to the
+ *  approver whose edit it answers; its classes are the pass's, read by the one ladder like any of its questions. */
+export declare function outletAsk(standing: Exclude<PermissionResult, {
+    action: "deny";
+}>, toolName: string, form: unknown): Extract<PermissionResult, {
+    action: "ask";
+}>;
+/** The one sentence of a person's edit that a judge accepts only rewritten; each lane adds its outlet (approve the form shown /
+ *  decide again with it / re-issue the call). */
+export declare function editRewrittenSentence(toolName: string): string;
+/** The one sentence of a rewrite a judge would rewrite again on its one second look. */
+export declare function rewriteChasedSentence(toolName: string): string;

package/dist/core/rewrite-rejudge.js

@@ -0,0 +1,36 @@
+import { canonicalize } from "./canonical-json.js";
+import { argsAsTheToolReads } from "./effective-path-target.js";
+export function sameBytes(req, a, b) {
+    return a === b || canonicalize(argsAsTheToolReads(req, a)) === canonicalize(argsAsTheToolReads(req, b));
+}
+export function readRejudge(req, given, answer) {
+    const rewrite = answer?.updatedInput;
+    return rewrite === undefined || sameBytes(req, given, rewrite) ? { kind: "as_is" } : { kind: "rewritten", form: argsAsTheToolReads(req, rewrite) };
+}
+export async function screenRewrite(screening, req, bytes, subject) {
+    const screened = await screening.screen(bytes, subject);
+    if (screened.kind === "refused")
+        return { kind: "refused", reason: screened.reason, by: "engine" };
+    const r = screened.answer;
+    if (r?.action === "deny")
+        return { kind: "refused", reason: screening.deniedReason(r), by: "hook" };
+    if (readRejudge(req, bytes, r).kind === "rewritten")
+        return { kind: "refused", reason: rewriteChasedSentence(req.toolName), by: "engine" };
+    if (r === undefined)
+        return { kind: "stands", answer: undefined, ...(screened.answeredBy !== undefined ? { answeredBy: screened.answeredBy } : {}) };
+    const { updatedInput: _sameBytes, ...answer } = r;
+    return { kind: "stands", answer, ...(screened.answeredBy !== undefined ? { answeredBy: screened.answeredBy } : {}) };
+}
+export function outletAsk(standing, toolName, form) {
+    const editRewritten = { acceptableForm: form };
+    const sentence = `${editRewrittenSentence(toolName)}, shown here — approve that form as it stands, or edit again`;
+    if (standing.action === "allow")
+        return { action: "ask", message: sentence, editRewritten };
+    return { ...standing, message: standing.message !== undefined ? `${sentence}\n${standing.message}` : sentence, editRewritten };
+}
+export function editRewrittenSentence(toolName) {
+    return `the edit to "${toolName}" was not run as written: the restriction chain accepts it only in a rewritten form (acceptableForm)`;
+}
+export function rewriteChasedSentence(toolName) {
+    return `the arguments of "${toolName}" were rewritten, and a judge that saw them before the rewrite asks for yet another form — denied fail-closed (a rewrite is judged once, never chased)`;
+}

package/dist/core/roles.d.ts

@@ -1,10 +1,16 @@
 import type { ThinkingLevel } from "../internal/harness-types.js";
 import type { Model } from "../internal/llm.js";
+import type { HostRole } from "../prompt-assembly/catalog/schema.js";
+import { type RoleBaseDeclaration } from "../prompt-assembly/role-base.js";
 import { type ModelRef, type ModelRole, type ModelRoles, type RoleSpec } from "./types.js";
 export type { ModelRole, RoleSpec, ModelRoles } from "./types.js";
 export { MODEL_ROLES } from "./types.js";
-/** Resolve a string ModelRef against the catalog (a Model object passes through). */
-export declare function resolveModel(ref: ModelRef, models?: Record<string, Model>): Model;
+/**
+ * Resolve a ModelRef against the catalog (a Model object passes through). A word the catalog does not hold, and a value that is no model
+ * reference, are refused by `config.unknown_role` with `detail { field: seat, reason }` — `seat` names where the caller wrote the word
+ * (`"model"` when the caller names none).
+ */
+export declare function resolveModel(ref: ModelRef, models?: Record<string, Model>, seat?: string): Model;
 /** 档位降档链(强→弱)。解析某档无绑定时沿链向后找第一个有绑定的档(fail-open 可用性优先;绑定缺口
  *  在部署 catalog 审计面可见)。`ultra` 预留:排在 `max` 前,今天不绑,未来加档零码改。 */
 export declare const DEFAULT_TIER_ORDER: readonly string[];
@@ -102,6 +108,16 @@ export declare const ROLE_TIER_DEFAULTS: Readonly<Partial<Record<ModelRole, stri
  * preset-only role does not disable the relative pick. One reader, the same parts {@link specParts} reads.
  */
 export declare function roleSpecNamesModel(spec: RoleSpec | undefined): boolean;
+/** Merge two role maps, field-aware per role (task `over` wins). Every key and every value of both maps is judged first: a value that is no binding
+ *  (`null`, a number, a boolean, a word the catalog does not hold) is refused at its own seat before the merge reads it (the merge would otherwise read a
+ *  number as a record, or let a task's bad value vanish into the base); a list or a function written at a role seat still reads as an empty record (#2223 ⑦). */
+/**
+ * One role map's door — every key a role word, every entry a binding whose parts are each in their domain (its role word
+ * included) and whose named model has a binding's shape. `field` names the map (`RunnerDeps.roles` / `TaskSpec.roles`).
+ * Every entry is judged, read or not: a resume's screen calls it before the claim, and the merge below calls it on both
+ * maps, so an entry no task of this leg selects still refuses loudly.
+ */
+export declare function screenRoleMap(roles: ModelRoles | undefined, field: "RunnerDeps.roles" | "TaskSpec.roles"): void;
 export interface ResolvedRole {
     model: Model;
     /**
@@ -119,9 +135,24 @@ export interface ResolvedRole {
     modelRef: ModelRef;
     /** The effective thinking level: explicit `spec.thinking` wins, else the role's default. */
     thinking?: ThinkingLevel;
-    /** The requested role's preset system prompt, if it set one (independent of model fallback). */
+    /** The requested role's role-base statement, if it made one (independent of model fallback): its word (the host role
+     *  and the catalog variant it selects) and its text (which replaces that base) — the second source of the role-base
+     *  decision, after the task's own (`src/prompt-assembly/role-base.ts`). */
+    promptRole?: HostRole;
     systemPrompt?: string;
 }
+/**
+ * The requested role's role-base statement as the task path reads it — the chain-head role over the merged maps, its
+ * word and its text whole (the role-base decision's second source, `src/prompt-assembly/role-base.ts`); `undefined` ⇒
+ * the preset names none. For a station that must write the preset onto a child's own seat before prepare (the
+ * workflow lane's persona frame) — it reads exactly what prepare will, and refuses what prepare would.
+ */
+export declare function presetRoleBaseOf(spec: {
+    modelRole?: ModelRole;
+    roles?: ModelRoles;
+}, deps: {
+    roles?: ModelRoles;
+}): RoleBaseDeclaration | undefined;
 /**
  * Resolve the model (and default thinking) for a task. Explicit `spec.model` wins; otherwise walk the
  * `modelRole`'s fallback chain over the merged roles (task overrides runner) and use the first role