@stratusagent/core 0.13.5 → 0.13.7

package/dist/channels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../src/channels.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,eAAe,EACf,QAAQ,EACR,eAAe,EACf,UAAU,EACV,OAAO,EACP,UAAU,EACX,MAAM,YAAY,CAAC;AAEpB;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,aAAa,EAAE,OAAO,CAAC;IACvB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAChD;;;OAGG;IACH,IAAI,CAAC,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;;;;OAIG;IACH,MAAM,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD;;;;OAIG;IACH,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;;GAKG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC7B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,QAAQ,EAAE,UAAU,CAAC;IACrB;;;;;;;;;;;;;;;;;;;OAmBG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,mFAAmF;QACnF,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;QAC3B;;;;;WAKG;QACH,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB;;;;;;;WAOG;QACH,OAAO,CAAC,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,UAAU,CAAA;SAAE,CAAC,CAAC;QAC5D,QAAQ,CAAC,EAAE,UAAU,CAAC;QACtB,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB;;;;;;;;;;;;WAYG;QACH,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB;;;;;;;;;;;WAWG;QACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC;QACjD;;;;;;;;WAQG;QACH,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;KACzB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,MAAM,IAAI,eAAe,EAAE,CAAC;IAC5B;;;;;;;OAOG;IACH,YAAY,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACrD;;;;;;;;OAQG;IACH,UAAU,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACvD;;;;;;;;;OASG;IACH,cAAc,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACxE;;;;;;;;;OASG;IACH,YAAY,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,CAAC,KAAK,EAAE;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,UAAU,CAAC;KACvB,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,eAAe,CAAC,KAAK,EAAE;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,cAAc,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;;WAIG;QACH,MAAM,CAAC,EAAE,SAAS,GAAG,eAAe,CAAC;KACtC,GAAG,OAAO,CAAC;IACZ;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,CAAC,CAAC,KAAK,EAAE;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;CACpD;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,2EAA2E;AAC3E,MAAM,WAAW,mBAAmB;IAClC,mDAAmD;IACnD,EAAE,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAChC,6DAA6D;IAC7D,IAAI,EAAE,OAAO,CAAC;IACd;;;;;OAKG;IACH,SAAS,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACnC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uEAAuE;IACvE,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnD,kEAAkE;IAClE,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,OAAO,GAAG,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,eAAe,CAAC;IACvB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,iEAAiE;IACjE,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACxE;;;;;;;;;;;;OAYG;IACH,iBAAiB,CAAC,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrF;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7E;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,CAAC,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3F;;;;;;;OAOG;IACH,UAAU,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACjD;;;;;;;;OAQG;IACH,mBAAmB,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;CACxG;AAED,MAAM,WAAW,sBAAsB;IACrC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,sBAAsB,KAAG,MAMjE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,6DAA6D;AAC7D,eAAO,MAAM,WAAW,GAAI,QAAQ,YAAY,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,OAClC,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,YAAY,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,OACM,CAAC;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,YAAY,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CACtE,CAAC"}

package/dist/channels.js

@@ -0,0 +1,31 @@
+/**
+ * The stable session id for one conversation: `channel:agent:team:conversation[:thread]`.
+ * Stable means resumable — any later message with the same parts lands in
+ * the same session, across daemon restarts included. Callers pass
+ * `thread_ts ?? ts` as the thread for channel messages (a top-level mention
+ * roots its own reply-thread conversation), no thread for a DM's top level,
+ * and the thread's root for a reply in a DM thread.
+ */
+export const channelSessionKey = (parts) => {
+    const segments = [parts.channel, parts.agentId, parts.team, parts.conversation];
+    if (parts.thread) {
+        segments.push(parts.thread);
+    }
+    return segments.join(':');
+};
+/** Whether `senderId` is on the policy's principals list. */
+export const isPrincipal = (policy, senderId) => (policy?.principals ?? []).includes(senderId);
+/**
+ * Whether a message from `senderId` may start a turn. No policy admits:
+ * there is nobody's list to refuse against, which is the answer from
+ * before admission existed.
+ */
+export const admitsSender = (policy, senderId) => policy === undefined || policy.admit !== 'principals' || isPrincipal(policy, senderId);
+/**
+ * The trust label a turn from `senderId` carries (`SENDER_TRUST_METADATA_KEY`
+ * in `@stratusagent/core`): `user` for a principal, `unknown` for anyone else.
+ * Evaluated per message, never per session: a group conversation keys one
+ * session for everyone in it.
+ */
+export const senderTrustFor = (policy, senderId) => isPrincipal(policy, senderId) ? 'user' : 'unknown';
+//# sourceMappingURL=channels.js.map

package/dist/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../src/channels.ts"],"names":[],"mappings":"AAmmBA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA6B,EAAU,EAAE;IACzE,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC,CAAC;AAiCF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAgC,EAAE,QAAgB,EAAW,EAAE,CACzF,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAgC,EAAE,QAAgB,EAAW,EAAE,CAC1F,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,IAAI,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEzF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAgC,EAAE,QAAgB,EAA2C,EAAE,CAC5H,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC"}

package/dist/executors.d.ts

@@ -0,0 +1,35 @@
+import { type ExecutionContext, type Executor, type JsonValue, type Session, type Tool, type ToolCall, type ToolResult, type TrustLevel } from './index.ts';
+export interface ExecutorResultCallRef {
+    id: string;
+    toolName: string;
+}
+export declare const normalizeExecutorError: (error: unknown) => string;
+/**
+ * A successful result, labelled. `trust` is what the executor resolved from
+ * the tool's producer channels (`createTrustMarking`); a caller building a
+ * result by hand with no idea where the content came from should say
+ * `unknown` rather than take the default, which is the label for a tool
+ * that declared nothing and marked nothing — its own work.
+ */
+export declare const successResult: (call: ToolCall | ExecutorResultCallRef, output: JsonValue, trust?: TrustLevel) => ToolResult;
+export declare const failureResult: (call: ToolCall | ExecutorResultCallRef, error: unknown, output?: JsonValue, trust?: TrustLevel) => ToolResult;
+export interface ExecutorDefinition {
+    execute(call: ToolCall, tool: Tool, session: Session, context?: ExecutionContext): Promise<ToolResult>;
+}
+export declare const defineExecutor: ({ execute }: ExecutorDefinition) => Executor;
+export interface DirectExecutorErrorContext {
+    call: ToolCall;
+    tool: Tool;
+    session: Session;
+    error: unknown;
+}
+export interface DirectExecutorOptions {
+    onError?: (context: DirectExecutorErrorContext) => ToolResult | Promise<ToolResult>;
+}
+export declare class DirectExecutor implements Executor {
+    private readonly onError?;
+    constructor(options?: DirectExecutorOptions);
+    execute(call: ToolCall, tool: Tool, session: Session, context?: ExecutionContext): Promise<ToolResult>;
+}
+export declare const createDirectExecutor: (options?: DirectExecutorOptions) => Executor;
+//# sourceMappingURL=executors.d.ts.map

package/dist/executors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executors.d.ts","sourceRoot":"","sources":["../src/executors.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,OAAO,EACZ,KAAK,IAAI,EACT,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB;AAOD,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,MACA,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,QAAQ,GAAG,qBAAqB,EACtC,QAAQ,SAAS,EACjB,QAAO,UAAoB,KAC1B,UASF,CAAC;AAEF,eAAO,MAAM,aAAa,GACxB,MAAM,QAAQ,GAAG,qBAAqB,EACtC,OAAO,OAAO,EACd,SAAQ,SAAgB,EACxB,QAAO,UAAoB,KAC1B,UAUF,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACxG;AAED,eAAO,MAAM,cAAc,GAAI,aAAa,kBAAkB,KAAG,QAE/D,CAAC;AAEH,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,0BAA0B,KAAK,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrF;AAED,qBAAa,cAAe,YAAW,QAAQ;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAmC;gBAEhD,OAAO,GAAE,qBAA0B;IAIzC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;CAmB7G;AAED,eAAO,MAAM,oBAAoB,GAAI,UAAS,qBAA0B,KAAG,QAC9C,CAAC"}

package/dist/executors.js

@@ -0,0 +1,64 @@
+import { createTrustMarking, leastTrusted, } from "./index.js";
+const toCallRef = (call) => ({
+    id: call.id,
+    toolName: call.toolName,
+});
+export const normalizeExecutorError = (error) => error instanceof Error ? error.message : String(error);
+/**
+ * A successful result, labelled. `trust` is what the executor resolved from
+ * the tool's producer channels (`createTrustMarking`); a caller building a
+ * result by hand with no idea where the content came from should say
+ * `unknown` rather than take the default, which is the label for a tool
+ * that declared nothing and marked nothing — its own work.
+ */
+export const successResult = (call, output, trust = 'agent') => {
+    const ref = toCallRef(call);
+    return {
+        callId: ref.id,
+        toolName: ref.toolName,
+        ok: true,
+        output,
+        trust,
+    };
+};
+export const failureResult = (call, error, output = null, trust = 'agent') => {
+    const ref = toCallRef(call);
+    return {
+        callId: ref.id,
+        toolName: ref.toolName,
+        ok: false,
+        output,
+        error: normalizeExecutorError(error),
+        trust,
+    };
+};
+export const defineExecutor = ({ execute }) => ({
+    execute,
+});
+export class DirectExecutor {
+    onError;
+    constructor(options = {}) {
+        this.onError = options.onError;
+    }
+    async execute(call, tool, session, context) {
+        const marking = createTrustMarking(tool, context);
+        try {
+            const output = await tool.execute(call.input, session, marking.context);
+            return successResult(call, output, marking.resolve());
+        }
+        catch (error) {
+            if (this.onError) {
+                // The tool's channels set the floor: a mapper may lower the label
+                // further (it knows what it wrapped) but never raise it — the error
+                // it is wrapping may quote a server, and `failureResult`'s default
+                // is `agent`, which a mapper reaching for the helper would
+                // otherwise hand an `external` tool's error text.
+                const mapped = await this.onError({ call, tool, session, error });
+                return { ...mapped, trust: leastTrusted(marking.resolve(), mapped.trust ?? 'agent') };
+            }
+            return failureResult(call, error, null, marking.resolve());
+        }
+    }
+}
+export const createDirectExecutor = (options = {}) => new DirectExecutor(options);
+//# sourceMappingURL=executors.js.map

package/dist/executors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executors.js","sourceRoot":"","sources":["../src/executors.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,YAAY,GASb,MAAM,YAAY,CAAC;AAOpB,MAAM,SAAS,GAAG,CAAC,IAAsC,EAAyB,EAAE,CAAC,CAAC;IACpF,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAU,EAAE,CAC/D,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAsC,EACtC,MAAiB,EACjB,QAAoB,OAAO,EACf,EAAE;IACd,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,EAAE;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,EAAE,EAAE,IAAI;QACR,MAAM;QACN,KAAK;KACN,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAsC,EACtC,KAAc,EACd,SAAoB,IAAI,EACxB,QAAoB,OAAO,EACf,EAAE;IACd,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,EAAE;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,EAAE,EAAE,KAAK;QACT,MAAM;QACN,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC;QACpC,KAAK;KACN,CAAC;AACJ,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,EAAE,OAAO,EAAsB,EAAY,EAAE,CAAC,CAAC;IAC5E,OAAO;CACR,CAAC,CAAC;AAaH,MAAM,OAAO,cAAc;IACR,OAAO,CAAoC;IAE5D,YAAY,UAAiC,EAAE;QAC7C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAc,EAAE,IAAU,EAAE,OAAgB,EAAE,OAA0B;QACpF,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACxE,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,kEAAkE;gBAClE,oEAAoE;gBACpE,mEAAmE;gBACnE,2DAA2D;gBAC3D,kDAAkD;gBAClD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClE,OAAO,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,KAAK,IAAI,OAAO,CAAC,EAAE,CAAC;YACxF,CAAC;YAED,OAAO,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAiC,EAAE,EAAY,EAAE,CACpF,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1590,6 +1590,21 @@ export interface UsageRecord extends TokenUsage {
     turnId: string;
     provider: string;
     model?: string;
+    /**
+     * Unique to this one provider call, assigned when the record is made and
+     * saved with it. What lets a consumer that meters spend outside the
+     * session (a usage ledger) count each call exactly once however many
+     * times it sees it: from the `session.usage` announcement, and again from
+     * the saved session after a crash that came between the save and the
+     * announcement. Absent on records saved before it existed.
+     */
+    id?: string;
+    /**
+     * When the call's usage was recorded, ISO 8601. A consumer that learns of
+     * a call late (reconciling a session after a crash) still files it under
+     * the day it was spent. Absent on records saved before it existed.
+     */
+    at?: string;
 }
 /**
  * `TokenUsage.inputTokens` for a vendor that reports its prompt count
@@ -1814,6 +1829,18 @@ export interface ProviderRequest {
      * turn that actually succeeded goes uncounted.
      */
     onUsage?: (usage: ProviderCallUsage) => void;
+    /**
+     * For a provider that makes another model call inside one `generate` on
+     * its own decision, the fallback wrapper's switch being the live example:
+     * await this before that call, naming the provider about to answer. The
+     * runner announces the usage reported so far, then asks the host's
+     * `ProviderCallGuard`s, so a budget the first call just spent is read
+     * before the next one starts. It resolves to allow the call and throws to
+     * refuse it; let the error propagate, because a refusal ends the turn.
+     *
+     * Not for a harness's own inner calls, which this interface never sees.
+     */
+    guardCall?: (provider: string) => Promise<void>;
     /**
      * For a provider that runs its own tool loop (the harness runtimes): ask,
      * when its inner budget runs out mid-work, whether to carry on with a
@@ -1851,8 +1878,46 @@ export interface ProviderResponse {
 }
 export interface ModelProvider {
     name: string;
+    /**
+     * For a provider that hands a session's calls to another provider while
+     * keeping its own `name` (the fallback wrapper, once a session has
+     * switched): the name of the provider that answers this session's next
+     * call. The `ProviderCallGuard`s are told it, so a rule about one model
+     * holds whichever wrapper it sits behind. Absent means `name`.
+     */
+    nameFor?(session: Session): string;
     generate(request: ProviderRequest): Promise<ProviderResponse>;
 }
+/** Who is about to spend a provider call: what a `ProviderCallGuard` is asked about. */
+export interface ProviderCallCheck {
+    agentId: string;
+    sessionId: string;
+    /**
+     * The provider about to answer, by name: the runner's provider, or the
+     * one it says answers this session (`ModelProvider.nameFor`). Under a
+     * configured fallback that is the primary until the session switches and
+     * the fallback after. A switch inside a call asks again before the
+     * fallback's call, naming the fallback (`ProviderRequest.guardCall`).
+     */
+    provider: string;
+}
+/**
+ * A host's say over each provider call before it is made: a token budget
+ * is the case it exists for. Resolving allows the call. Throwing refuses
+ * it and fails the turn: a `HostRefusalError` for a refusal made on purpose,
+ * whose message is a sentence for the person in the conversation, and any
+ * other error for a guard that could not decide, which refuses as well,
+ * because a budget that cannot be read is not a budget that said yes.
+ *
+ * Asked once per `ModelProvider.generate`, which is one model call for the
+ * kernel-loop adapters and one Stratus turn for a harness running its own
+ * inner loop, and again before any further call a provider makes inside one
+ * `generate` and asks about through `ProviderRequest.guardCall` (the
+ * fallback model's call after the primary fails). The usage of every
+ * earlier call has been announced (`session.usage`) before a guard is asked
+ * about the next one.
+ */
+export type ProviderCallGuard = (check: ProviderCallCheck) => Promise<void> | void;
 /**
  * What a scrubbed subprocess inherits by name when its operator granted
  * nothing else — the replacement-environment treatment `tool-shell`
@@ -1870,7 +1935,9 @@ export declare const DEFAULT_SUBPROCESS_PASS_ENV: readonly string[];
 /**
  * Ambient context for one tool execution. The abort signal is the turn's:
  * executors kill in-flight subprocesses on abort, and long-running tools
- * should observe it too.
+ * should observe it too. One that does not is left behind a short grace
+ * after the abort (`untilStoppedFor`), still running, with a result that
+ * says so.
  */
 export interface ExecutionContext {
     signal?: AbortSignal;
@@ -2626,6 +2693,36 @@ export type StratusEvent = {
     type: 'session.failed';
     sessionId: string;
     error: string;
+    /**
+     * True when the host stopped the turn on purpose (`HostRefusalError`):
+     * `error` is then a sentence meant for the person in the conversation,
+     * and a renderer shows it as it is rather than as a malfunction.
+     */
+    refused?: true;
+}
+/**
+ * Usage a provider call just reported, as it lands: the records added to
+ * the session since the last announcement, in the order they were
+ * recorded. A harness reporting inner calls through the sink is announced
+ * as each report arrives, while its `generate` is still running, so a
+ * daemon that dies mid-call has already told a ledger what was spent.
+ *
+ * Per call rather than once per turn because a turn can make many calls,
+ * and a host enforcing a budget has to know what the call before this one
+ * spent before it allows the next. `session.completed` arrives too late
+ * for that and is never sent for a turn that failed. Emitted for a failed
+ * attempt too, whenever it reported anything: the tokens of a call that
+ * threw were still spent. `agentId` rides along so a consumer
+ * attributing spend to an agent needs no store read.
+ *
+ * Counts and attribution only, the same records `session.completed`
+ * carries, ids included.
+ */
+ | {
+    type: 'session.usage';
+    sessionId: string;
+    agentId: string;
+    records: UsageRecord[];
 }
 /**
  * The session's trust label went down. `source` names what lowered it —
@@ -2768,11 +2865,11 @@ export interface ProviderContribution {
     streams?: boolean;
 }
 /**
- * The slice of a channel adapter the kernel holds: structurally
- * `@stratusagent/channels`' `ChannelAdapter`, kept structural here so core
- * carries no dependency on the channels package — the same reason the
- * gateway declares its own copy. `name` is the channel kind (`slack`,
- * `discord`); the gateway it is started with is the host's.
+ * The slice of a channel adapter the kernel holds: structurally the
+ * `ChannelAdapter` in `channels.ts`, declared on its own because it
+ * predates that contract moving into core (the gateway keeps a copy for
+ * the same reason). `name` is the channel kind (`slack`, `discord`); the
+ * gateway it is started with is the host's.
  */
 export interface ChannelAdapterLike {
     name: string;
@@ -2786,7 +2883,7 @@ export interface ChannelAdapterLike {
     }): Promise<{
         post(text: string): Promise<unknown>;
     }>;
-    /** See `@stratusagent/channels`' `ChannelAdapter.readConversation`. */
+    /** See `ChannelAdapter.readConversation`. */
     readConversation?(request: {
         agentId: string;
         conversation: string;
@@ -2794,6 +2891,7 @@ export interface ChannelAdapterLike {
         after?: string;
         before?: string;
         limit: number;
+        sessionId?: string;
     }): Promise<{
         messages: Array<{
             id: string;
@@ -2806,11 +2904,40 @@ export interface ChannelAdapterLike {
             files?: string[];
         }>;
         more: boolean;
+        bookmarks?: Array<{
+            title: string;
+            link: string;
+        }>;
+        bookmarksUnavailable?: string;
+        bookmarksOmitted?: number;
     }>;
-    /** See `@stratusagent/channels`' `ChannelAdapter.accountFor`. */
+    /** See `ChannelAdapter.createConversation`. */
+    createConversation?(request: {
+        agentId: string;
+        name: string;
+        private?: boolean;
+        topic?: string;
+        purpose?: string;
+        invite?: string[];
+    }): Promise<{
+        conversation: string;
+        name: string;
+        invited: string[];
+        notInvited: Array<{
+            who: string;
+            reason: string;
+        }>;
+        notSet: Array<{
+            field: 'topic' | 'purpose';
+            reason: string;
+        }>;
+    }>;
+    /** See `ChannelAdapter.accountFor`. */
     accountFor?(agentId: string): string | undefined;
-    /** See `@stratusagent/channels`' `ChannelAdapter.conversationKindFor`. */
+    /** See `ChannelAdapter.conversationKindFor`. */
     conversationKindFor?(agentId: string, conversation: string): Promise<'channel' | 'direct' | undefined>;
+    /** See `ChannelAdapter.sessionConversation`. */
+    sessionConversation?(agentId: string, sessionId: string): string | undefined;
 }
 /**
  * A channel contributed by a plugin: the adapter plus the agents it
@@ -3269,6 +3396,18 @@ export interface PluginContext {
      * `setup` naming it.
      */
     fleet?: FleetReader;
+    /**
+     * Registers a guard the host asks before every provider call. See
+     * {@link ProviderCallGuard}. A host passing it enforces what is
+     * registered for every agent it runs, sub-agents included. A host that
+     * omits it cannot enforce one, and a plugin that needs it (a budget) must
+     * fail its `setup` naming it: a limit nothing enforces must not report
+     * itself loaded.
+     */
+    providerCalls?: ProviderCallGuardHandle;
+}
+export interface ProviderCallGuardHandle {
+    register(guard: ProviderCallGuard): void;
 }
 export interface Plugin {
     name: string;
@@ -3616,12 +3755,23 @@ export declare const isLanguageTag: (value: unknown) => value is string;
  *
  * The accuracy rules are here for the same reason, each after an incident:
  * an agent with no Slack tool insisted it had no Slack connection, and
- * agents reported work as done that had only been drafted. The language
- * rule is here because the default persona is not: a custom soul replaces
- * it, and an agent wrote "favour" and "licence" into American website copy
- * because nothing shared said which English. A pasted British paragraph is
- * not a setting, so the rule says a task or a client's style guide decides
- * one deliverable and nothing is inferred from source text.
+ * agents reported work as done that had only been drafted. The
+ * look-before-you-ask pair is there because a conversation's session holds
+ * its own messages and a slice of memory, nothing more: when work moved to
+ * a new channel, the agent's session there asked the person what its own
+ * earlier thread and files already said. Pointers, not a brief at session
+ * open, because the thread and the file were both in reach and nothing said
+ * to look. What it finds is linked, or asked about before it is repeated,
+ * unless it can tell everyone in the room could already see it. The room
+ * context gives only this room's kind and size, and a read returns no
+ * membership, so the agent cannot check another conversation's audience; a
+ * link is checked by the channel itself, and a file cannot be linked, so it
+ * asks. The language rule is here because the default persona is not: a
+ * custom soul replaces it, and an agent wrote "favour" and "licence" into
+ * American website copy because nothing shared said which English. A pasted
+ * British paragraph is not a setting, so the rule says a task or a client's
+ * style guide decides one deliverable and nothing is inferred from source
+ * text.
  *
  * The last sentence lets the soul and the person override length, format,
  * and language, and deliberately nothing else: a style preference never
@@ -3924,6 +4074,29 @@ export interface ObserveInput {
  * shorten. A provider that never throws this behaves exactly as it did.
  */
 export declare class ContextOverflowError extends Error {
+    /** Recognized across copies of core: a provider package carries its own. */
+    static [Symbol.hasInstance](value: unknown): boolean;
+    constructor(message: string);
+}
+/**
+ * A turn the host stopped on purpose (a spent token budget) rather than
+ * one that broke.
+ *
+ * A kernel type because layers that know nothing of budgets have to treat
+ * it differently from every other failure. A fallback provider must not
+ * answer instead: the limit applies to the agent, not to one model, and a
+ * silent switch would spend what the limit exists to stop while hiding
+ * that it was reached. And a channel must not frame it as something going
+ * wrong: the message is a sentence written for the person reading it,
+ * naming what ran out and what changes it, and `session.failed` says so
+ * with `refused`.
+ *
+ * Thrown by a `ProviderCallGuard`, or subclassed by whoever refuses; the
+ * kernel only ever asks `instanceof`.
+ */
+export declare class HostRefusalError extends Error {
+    /** Recognized across copies of core: a plugin package refuses with its own. */
+    static [Symbol.hasInstance](value: unknown): boolean;
     constructor(message: string);
 }
 /**
@@ -3986,6 +4159,8 @@ export declare const raiseContextFloor: (session: Session) => boolean;
  * distinguishable from a genuine failure.
  */
 export declare class RunAbortedError extends Error {
+    /** Recognized across copies of core: a channel package aborts with its own. */
+    static [Symbol.hasInstance](value: unknown): boolean;
     constructor(message?: string);
 }
 /**
@@ -4065,6 +4240,13 @@ export interface AgentRunnerOptions {
      * runs, tests) keep the simpler non-streaming provider path.
      */
     streaming?: boolean;
+    /**
+     * Asked, in order, before every provider call; see `ProviderCallGuard`.
+     * Read on each call, so a host may add to the list after constructing
+     * the runner. A host that omits it puts no limit on model calls beyond
+     * `maxTurns`.
+     */
+    providerCallGuards?: readonly ProviderCallGuard[];
 }
 export declare const inputProblem: (schema: JsonObject | undefined, input: JsonValue, where?: string, depth?: number) => string | undefined;
 export declare const DEFAULT_MAX_TURNS = 40;
@@ -4178,6 +4360,18 @@ export declare class AgentRunner {
      * retried call to be counted once, twice, or not at all.
      */
     private recordUsage;
+    /**
+     * Emit `session.usage` for the records added to the session since
+     * `recordedBefore`.
+     *
+     * The loop drains these before the next provider call, which is the
+     * point: a host that meters spend from this event has seen every earlier
+     * call's tokens before a guard is asked to allow another one. Copies, so
+     * a subscriber cannot edit the session's accounting through the event.
+     */
+    private announceUsage;
+    /** Ask every guard about the call about to be made; the first refusal throws. */
+    private guardProviderCall;
     /**
      * The allowlist entries this session's agent is held to, or undefined for
      * no limit. Entries, not a name set: `fs.*` is an entry, and matching is
@@ -4265,4 +4459,6 @@ export declare class AgentRunner {
     private checkpointPendingApproval;
     private executeToolCall;
 }
+export { createDirectExecutor, defineExecutor, DirectExecutor, failureResult, normalizeExecutorError, successResult, type DirectExecutorErrorContext, type DirectExecutorOptions, type ExecutorDefinition, type ExecutorResultCallRef, } from './executors.ts';
+export { admitsSender, channelSessionKey, isPrincipal, senderTrustFor, type AdmitPolicy, type ChannelAdapter, type ChannelCredentialRequest, type ChannelSessionKeyParts, type ConversationBookmark, type ConversationCreateRequest, type ConversationCreateResult, type ConversationMessage, type ConversationReadRequest, type ConversationReadResult, type GatewayLike, type InboundMessage, type OutboundAddress, type OutboundConnection, type OutboundMessageRef, type SenderPolicy, type SessionRouting, } from './channels.ts';
 //# sourceMappingURL=index.d.ts.map