@theoremjs/studio 0.3.4-next.484.g20d8b9d → 0.3.4-next.522.g9e684cd

package/page/assets/{_virtual_studio-type-sources-DBS0HldZ.js → _virtual_studio-type-sources-DfyVGpe8.js}

@@ -4416,9 +4416,6 @@ interface HostMatcher {
 }
 /** Bumped whenever the compiled table's layout or meaning changes. */
 declare const PATTERN_COMPILER_VERSION = 3;
-/** The most patterns one detector takes, and the longest each may be once written as a regular expression. */
-declare const MAX_PATTERNS = 64;
-declare const MAX_PATTERN_LENGTH = 1024;
 /** The patterns as a compiled table records them. */
 declare function patternSources(patterns: readonly HostPattern[]): PatternSource[];
 /** What is wrong with one pattern, or \`undefined\` when it runs. */
@@ -4439,7 +4436,7 @@ declare function listsPatterns(detect: unknown): boolean;
 /** \`patterns\`, valid, ready to run. */
 declare function matchersOf(patterns: readonly HostPattern[]): readonly HostMatcher[];
 export type { AutomatonData, CompiledPatterns, HostMatcher, HostPattern, PatternSource };
-export { listsPatterns, MAX_PATTERN_LENGTH, MAX_PATTERNS, matchersOf, PATTERN_COMPILER_VERSION, patternListProblem, patternProblem, patternSources, patternsProblem, };
+export { listsPatterns, matchersOf, PATTERN_COMPILER_VERSION, patternListProblem, patternProblem, patternSources, patternsProblem, };
 `,"file:///node_modules/@theoremjs/agents/src/guardrails/detectors.d.ts":`/** labels-exempt-file: authoring labels, descriptions and profile-registration diagnostics for detectors — not runtime user or model copy (P2) */
 import { type Boundary } from './boundaries.js';
 import { type CompiledPatterns, type HostMatcher, type HostPattern } from './host-patterns.js';
@@ -4712,7 +4709,7 @@ export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGua
 export { hitFromSpan, projectGuardrailEvent, } from './src/guardrails/hits.js';
 export type { ClientLabelKey, LabelKey, LabelOverrides, LabelParams, } from './src/guardrails/labels.js';
 export { CLIENT_LABEL_KEYS, LABEL_KEYS, labelDefault, labelText, overrideLabels, resetLabels, } from './src/guardrails/labels.js';
-export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, CanaryGateResult, CanaryGateSession, CanaryStreamGate, DestinationGate, DestinationVerdict, Directive, DirectiveSignal, GivenUrls, GuardedToolText, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, InspectedToolArguments, LiveHeldOutput, LiveOutboundBatchResult, LiveOutboundGateSession, NameAllow, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, ProgressiveYieldGate, ProgressiveYieldGateOptions, ProgressiveYieldResult, Provenance, QuotaGuardrailSpec, ResolvedGuardrailPolicy, ScanText, SensitiveGroup, SensitiveSelection, SensitiveSwitches, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnDestinations, TurnTaint, UrlAllow, Verdict, } from './src/guardrails/mod.js';
+export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, CanaryGateResult, CanaryGateSession, CanaryStreamGate, DecisionDisclosureEnforcer, DecisionDisclosureVerdict, DecisionGuardrailsSpec, DestinationGate, DestinationVerdict, Directive, DirectiveSignal, GivenUrls, GuardedToolText, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, InspectedToolArguments, LiveHeldOutput, LiveOutboundBatchResult, LiveOutboundGateSession, NameAllow, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, ProgressiveYieldGate, ProgressiveYieldGateOptions, ProgressiveYieldResult, Provenance, QuotaGuardrailSpec, ResolvedGuardrailPolicy, ScanText, SensitiveGroup, SensitiveSelection, SensitiveSwitches, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnDestinations, TurnTaint, UrlAllow, Verdict, } from './src/guardrails/mod.js';
 export { ADVISORY_LEVELS, abortLiveOutboundTurn, addGivenDestinations, addHistoryDestinations, addRequestDestinations, addResultDestinations, BLOCKED_REPLY_ON_BLOCK, bindCanary, checkDestinationGate, checkTaintGate, composeToolText, createCanaryGateSession, createCanaryStreamGate, createLiveOutboundGateSession, createOutboundProgressiveGate, createProgressiveYieldGate, DESTINATION_GATES, DIRECTIVE_SIGNALS, directives, EGRESS_RULES, eventHasCanary, filterCanaryGatedEvents, finalizeLiveOutboundTurn, GUARDRAIL_STAGES, guardToolFailureText, guardToolResult, hitRules, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, mintCanary, OMIT_CANARY, processLiveOutboundBatch, recordTaint, redactCanary, resolveGuardrailPolicy, SEVERITIES, scanTextForCanaryLeak, scanTextOf, TAINT_GATES, TOOL_CLOSE, TOOL_ORIGINS, TRUST_LEVELS, textForScan, toolCallEvent, turnDestinations, wrapToolData, wrapUserData, } from './src/guardrails/mod.js';
 export type { DnsOverHttpsOptions, GuardedFetchOptions, ResolveHost, } from './src/guardrails/network.js';
 export { assertSafeUrl, dnsOverHttpsResolver, fetchGuarded, isLocalhostName, isPrivateOrLocalAddress, } from './src/guardrails/network.js';
@@ -4737,7 +4734,7 @@ export type { ProfileGraphEditor, ProfileGraphFacet, ProfileGraphFacetId, Profil
 export { PROFILE_GRAPH, profileGraphFacet, spineFacetsForProfileType, } from './src/kernel/profile-graph.js';
 export type { RuntimeAbilities } from './src/kernel/protocols/binding.js';
 export { checkBinding, commonModelSettingsSchema, decisionModelBindingSchema, keySlotSchema, keySlotsOf, modelBindingSchema, } from './src/kernel/protocols/binding.js';
-export { providerLimitsSchema, resolveProviderLimits } from './src/kernel/protocols/limits.js';
+export { providerLimitsSchema } from './src/kernel/protocols/limits.js';
 export type { CallSetup, ProtocolCall } from './src/kernel/protocols/runtime.js';
 export { callProtocol, plainWebSocket } from './src/kernel/protocols/runtime.js';
 export type { AttachmentFacts, AttachmentRules } from './src/kernel/registry/attachments.js';
@@ -4795,15 +4792,15 @@ export { bearer, createProviderRegistry, defineProvider, endpointUrlSchema, head
 export type { OpenWebSocket, ProviderHostOptions } from '../kernel/protocols/runtime.js';
 export type { CredentialContext, CredentialResolver, KeyCredential, KeyVault, } from '../kernel/registry/vault.js';
 export { embeddingModelLimits } from './embedding-limits.js';
-export { geminiEmbedding } from './gemini/embedding-protocol.js';
+export { geminiEmbeddings } from './gemini/embeddings-protocol.js';
 export { geminiInteractions } from './gemini/interactions-protocol.js';
 export { geminiLive } from './gemini/live-protocol.js';
 export { geminiProvider } from './gemini/provider.js';
-export { ollamaEmbedding } from './local/embedding-protocol.js';
+export { ollamaEmbeddings } from './local/embeddings-protocol.js';
 export { localProvider } from './local/provider.js';
 export { openAi } from './open-ai/protocol.js';
 export { openRouterDecisions } from './openrouter/decisions-protocol.js';
-export { openRouterEmbedding } from './openrouter/embedding-protocol.js';
+export { openRouterEmbeddings } from './openrouter/embeddings-protocol.js';
 export { openRouterImages } from './openrouter/images-protocol.js';
 export { openRouterOpenAi } from './openrouter/protocol.js';
 export { openRouterProvider } from './openrouter/provider.js';
@@ -5178,20 +5175,19 @@ export declare function extendProtocol<O, S, E = JsonObject>(base: Protocol<O, S
 /** Whether something \`writer\` wrote may go back to \`target\`: the writer is in its lineage. */
 export declare function carriesTo(writer: string, target: Pick<Protocol, 'lineage'>): boolean;
 `,"file:///node_modules/@theoremjs/agents/src/kernel/protocols/limits.d.ts":`import { z } from 'zod';
-/** The budgets every provider call runs under; a host may tighten or loosen each. */
+/** The budgets a provider call runs under. Each one left out is no limit: the provider's own applies. */
 export interface ProviderLimits {
-    operationTimeoutMs: number;
-    connectTimeoutMs: number;
-    liveStepTimeoutMs: number;
-    maxWireRecordBytes: number;
-    maxWireResponseBytes: number;
-    maxEventBytes: number;
-    maxStepBytes: number;
-    maxStepEvents: number;
-    maxPendingToolCalls: number;
+    operationTimeoutMs?: number;
+    connectTimeoutMs?: number;
+    liveStepTimeoutMs?: number;
+    maxWireRecordBytes?: number;
+    maxWireResponseBytes?: number;
+    maxEventBytes?: number;
+    maxStepBytes?: number;
+    maxStepEvents?: number;
+    maxPendingToolCalls?: number;
 }
 export declare const providerLimitsSchema: z.ZodType<ProviderLimits>;
-export declare function resolveProviderLimits(overrides?: Partial<ProviderLimits>): ProviderLimits;
 `,"file:///node_modules/@theoremjs/agents/src/kernel/types.d.ts":`import type { ProviderCheckpoint, ProviderContinuationPolicy } from './checkpoint.js';
 import type { JsonObject } from './json.js';
 import type { CacheMode, CacheTtl, CompactionMeter, CompactionOutcome, CompactionTiming, ContextSender, ContinueStopKind, FieldMeta, KeySlot, KeyVault, LiveActivityHandling, LiveEndSensitivity, LiveStartSensitivity, MediaInputKind, ProfileType, SpeechAudioFormat, StreamMode, SummaryMode, ThinkingLevel, ToolLoadTier, TurnStage, TurnStopKind } from './schema.js';
@@ -5652,8 +5648,10 @@ export interface DecisionRequest {
     state: Exclude<DecisionJson, null>;
     questions: Record<string, DecisionQuestion>;
     /**
-     * Images by reference. Write a reference as a string where its image belongs, in \`state\`, in a
-     * question's instructions, or in its criteria; the provider puts the image there.
+     * Images by reference. Write a reference in a string where its image belongs, in \`state\`, in a
+     * question's instructions, or in its criteria, as the whole string or inside it; the model reads
+     * the image in its place, once for each use. Keys are never read. Only the images some string
+     * references are sent, so pick references that cannot occur in your text by accident.
      */
     assets?: Record<string, DecisionAsset>;
     signal?: AbortSignal;
@@ -6857,6 +6855,8 @@ export interface CompactionFailure {
     stop?: TurnStopKind;
     /** The error it reported, when it reported one. */
     error?: ErrorKind;
+    /** Why it failed, for the builder only: \`forClient\` strips it for a visitor. */
+    errorInternal?: string;
     /** It completed without a summary. */
     empty?: true;
     /** Nothing in \`toCompact\` was left for it to read, so it did not run. */
@@ -7898,7 +7898,7 @@ export { applySpans, blobAt, mergeSpans, OMIT_CANARY, OMIT_INJECTION, OMIT_SENSI
 `,"file:///node_modules/@theoremjs/agents/src/guardrails/labels.d.ts":`/** Values that fill a label template's \`{param}\` placeholders. */
 export type LabelParams = Record<string, string | number>;
 /** Keys are stable API. */
-export declare const LABEL_KEYS: readonly ["provider.decision_failed", "provider.decision_unavailable", "provider.decision_model_missing", "provider.decision_ended", "provider.decision_images_off", "provider.decision_box_model", "provider.budget_exhausted", "provider.adapter_version", "provider.adapter_methods", "provider.adapter_schemas", "provider.fallback_slot", "provider.model_fallback_slot", "provider.host_model", "provider.turn_profile", "provider.model_binding_missing", "provider.session_closed", "provider.settled_call", "provider.session_unavailable", "provider.live_input", "provider.tool_cancel_missing", "provider.kernel_gate", "provider.event_invalid", "provider.response_identity", "provider.credential_resolution", "provider.credential_shape", "provider.stored_continuation", "provider.continuation_mismatch", "provider.continuation_contract", "provider.stateless_history", "provider.events_after_completion", "provider.duplicate_call", "provider.tool_cancel_live", "provider.complete_unavailable", "provider.parallel_tools", "provider.binding_identity", "provider.profile_type", "provider.event_type", "provider.feature", "provider.input_kind", "provider.output_kind", "provider.builtin", "provider.credential_missing", "provider.profile_configuration", "continue.instruction", "canary.bind_note", "user_data.note", "context.note", "taint.blocked", "taint.reason_steered", "taint.reason_tainted", "taint.destination_blocked", "taint.destination_confirm", "advisory.notice_elevated", "advisory.notice_high", "advisory.guidance", "attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "input.too_long", "attachments.limits_unconfigured", "quota.exhausted", "quota.busy", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "repair.default_guidance", "repair.items_guidance", "repair.prompt_header", "repair.prompt_intro", "repair.prompt_instructions", "repair.history_heading", "repair.section_previous_output", "repair.section_validator_rejection", "repair.section_repair_guidance", "repair.section_instructions", "compaction.request", "compaction.tool_call", "compaction.tool_result", "decision.box_image", "detect.blocked", "detect.call_blocked", "detect.output_blocked", "detect.shown_blocked", "detect.hint.ids", "detect.hint.financial", "detect.hint.network", "detect.hint.credentials", "detect.hint.injection", "detect.hint.tool_instructions", "detect.hint.canary_leak", "detect.hint.prompt_leak", "detect.hint.marker_leak", "detect.hint.ungiven_images", "detect.hint.ungiven_links", "detect.hint.tool_leak", "detect.hint.own", "egress.default_repair_guidance", "egress.refusal", "egress.refusal_cut", "egress.rejection", "egress.rejection_found", "egress.hint_unscannable", "egress.hint_provider_tool_leak", "thought.omitted_image", "thought.omitted_link", "thought.omitted_instructions", "session.abandon_gated", "session.tool_denied", "session.tool_aborted", "session.sign_in", "sign_in.link", "sign_in.pending", "sign_in.done", "sign_in.declined", "sign_in.expired", "sign_in.out_of_scope", "session.gate_expired", "session.provider_state_unowned", "session.conversation_unknown", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort", "tool.awaiting_user", "tool.completed_hidden", "tool.t2_loader_needs_snapshot", "tool.t2_loader_shape", "tool.t2_loader_output_invalid", "tool.execution_uncertain", "tool.input_invalid", "tool.input_invalid_after_mutate", "tool.output_invalid_after_mutate", "tool.handler_no_output", "tool.did_not_run", "tool.page_no_answer", "tool.page_timed_out", "tool.output_invalid", "tool.not_loaded_t2", "tool.wait_unknown", "tool.wait_cycle", "tool.not_visible", "tool.builtin_not_enabled", "tool.provider_native", "tool.not_registered", "tool.builtin_needs_snapshot", "tool.not_allowed", "tool.not_eligible", "tool.unsupported_type", "tool.agent_call_limit", "tool.agent_failed", "tool.activity_failed", "protocol.not_served", "protocol.profile_type", "protocol.options", "protocol.option_clash", "protocol.base_options", "protocol.id_clash", "protocol.ws_headers", "protocol.builtin_unwritten", "protocol.provider_missing", "protocol.connection", "protocol.part_schema", "protocol.part_invalid", "protocol.key_invalid", "protocol.no_key", "protocol.reply_shape", "protocol.endpoint_url", "protocol.endpoint_host", "protocol.http", "protocol.no_operation", "protocol.definition", "protocol.provider_id_clash", "protocol.history_needed"];
+export declare const LABEL_KEYS: readonly ["provider.decision_failed", "provider.decision_unavailable", "provider.decision_model_missing", "provider.decision_ended", "provider.decision_images_off", "provider.decision_box_model", "provider.budget_exhausted", "provider.adapter_version", "provider.adapter_methods", "provider.adapter_schemas", "provider.fallback_slot", "provider.model_fallback_slot", "provider.host_model", "provider.turn_profile", "provider.model_binding_missing", "provider.session_closed", "provider.settled_call", "provider.session_unavailable", "provider.live_input", "provider.tool_cancel_missing", "provider.kernel_gate", "provider.event_invalid", "provider.response_identity", "provider.credential_resolution", "provider.credential_shape", "provider.stored_continuation", "provider.continuation_mismatch", "provider.continuation_contract", "provider.stateless_history", "provider.events_after_completion", "provider.duplicate_call", "provider.tool_cancel_live", "provider.complete_unavailable", "provider.parallel_tools", "provider.binding_identity", "provider.profile_type", "provider.event_type", "provider.feature", "provider.input_kind", "provider.output_kind", "provider.builtin", "provider.credential_missing", "provider.profile_configuration", "continue.instruction", "canary.bind_note", "user_data.note", "context.note", "taint.blocked", "taint.reason_steered", "taint.reason_tainted", "taint.destination_blocked", "taint.destination_confirm", "advisory.notice_elevated", "advisory.notice_high", "advisory.guidance", "attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "quota.exhausted", "quota.busy", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "repair.default_guidance", "repair.items_guidance", "repair.prompt_header", "repair.prompt_intro", "repair.prompt_instructions", "repair.history_heading", "repair.section_previous_output", "repair.section_validator_rejection", "repair.section_repair_guidance", "repair.section_instructions", "structured.answer_tool", "structured.answer_missing", "compaction.request", "compaction.tool_call", "compaction.tool_result", "decision.box_image", "detect.blocked", "detect.call_blocked", "detect.output_blocked", "detect.shown_blocked", "detect.hint.ids", "detect.hint.financial", "detect.hint.network", "detect.hint.credentials", "detect.hint.injection", "detect.hint.tool_instructions", "detect.hint.canary_leak", "detect.hint.prompt_leak", "detect.hint.marker_leak", "detect.hint.ungiven_images", "detect.hint.ungiven_links", "detect.hint.tool_leak", "detect.hint.own", "egress.default_repair_guidance", "egress.refusal", "egress.refusal_cut", "egress.rejection", "egress.rejection_found", "egress.hint_unscannable", "egress.hint_provider_tool_leak", "thought.omitted_image", "thought.omitted_link", "thought.omitted_instructions", "session.abandon_gated", "session.tool_denied", "session.tool_aborted", "session.sign_in", "sign_in.link", "sign_in.pending", "sign_in.done", "sign_in.declined", "sign_in.expired", "sign_in.out_of_scope", "session.gate_expired", "session.provider_state_unowned", "session.conversation_unknown", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort", "tool.awaiting_user", "tool.completed_hidden", "tool.t2_loader_needs_snapshot", "tool.t2_loader_shape", "tool.t2_loader_output_invalid", "tool.execution_uncertain", "tool.input_invalid", "tool.input_invalid_after_mutate", "tool.output_invalid_after_mutate", "tool.handler_no_output", "tool.did_not_run", "tool.page_no_answer", "tool.page_timed_out", "tool.output_invalid", "tool.not_loaded_t2", "tool.wait_unknown", "tool.wait_cycle", "tool.not_visible", "tool.builtin_not_enabled", "tool.provider_native", "tool.not_registered", "tool.builtin_needs_snapshot", "tool.not_allowed", "tool.not_eligible", "tool.unsupported_type", "tool.agent_call_limit", "tool.agent_failed", "tool.activity_failed", "protocol.not_served", "protocol.profile_type", "protocol.options", "protocol.option_clash", "protocol.base_options", "protocol.id_clash", "protocol.ws_headers", "protocol.builtin_unwritten", "protocol.provider_missing", "protocol.connection", "protocol.part_schema", "protocol.part_invalid", "protocol.key_invalid", "protocol.no_key", "protocol.reply_shape", "protocol.endpoint_url", "protocol.endpoint_host", "protocol.http", "protocol.no_operation", "protocol.definition", "protocol.provider_id_clash", "protocol.history_needed"];
 /** One of {@linkcode LABEL_KEYS}. */
 export type LabelKey = (typeof LABEL_KEYS)[number];
 /**
@@ -7907,7 +7907,7 @@ export type LabelKey = (typeof LABEL_KEYS)[number];
  * puts into history. Only these overrides travel to the browser; the rest
  * (repair prompts, canary, taint, egress) stay on the host.
  */
-export declare const CLIENT_LABEL_KEYS: readonly ["attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "input.too_long", "attachments.limits_unconfigured", "detect.blocked", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "session.abandon_gated", "session.tool_denied", "session.sign_in", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "tool.awaiting_user", "tool.completed_hidden", "tool.execution_uncertain", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort"];
+export declare const CLIENT_LABEL_KEYS: readonly ["attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "detect.blocked", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "session.abandon_gated", "session.tool_denied", "session.sign_in", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "tool.awaiting_user", "tool.completed_hidden", "tool.execution_uncertain", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort"];
 /** One of {@linkcode CLIENT_LABEL_KEYS}. */
 export type ClientLabelKey = (typeof CLIENT_LABEL_KEYS)[number];
 /** Host-supplied replacement templates, \`{param}\` placeholders included. */
@@ -8715,6 +8715,7 @@ export { buildRecord, contentOf, inlineContent, TRACE_SCHEMA_URL };
 `,"file:///node_modules/@theoremjs/agents/src/kernel/protocols/binding.d.ts":`import { z } from 'zod';
 import { type JsonObject } from '../json.js';
 import { type KeySlot } from '../schema.js';
+import { type ProviderLimits } from './limits.js';
 import { type ModelProfileType, type Protocol } from './protocol.js';
 import type { RegisteredProvider } from './provider.js';
 /** A vault slot name. */
@@ -8745,9 +8746,10 @@ export interface ModelBinding extends z.infer<typeof commonModelSettingsSchema>
     keySlot?: string;
     fallbackKeySlot?: string;
     options?: JsonObject;
+    limits?: ProviderLimits;
 }
 /** A decision profile's model: no generation settings, and a time limit. */
-export interface DecisionModelBinding extends Pick<ModelBinding, 'protocol' | 'provider' | 'apiId' | 'keySlot' | 'fallbackKeySlot' | 'options'> {
+export interface DecisionModelBinding extends Pick<ModelBinding, 'protocol' | 'provider' | 'apiId' | 'keySlot' | 'fallbackKeySlot' | 'options' | 'limits'> {
     timeoutMs?: number;
 }
 export declare const modelBindingSchema: z.ZodType<ModelBinding>;
@@ -8942,12 +8944,25 @@ export interface ToolOutputHooks<TOut = unknown> {
 /** For a tool whose result names pictures by address; function tools return the bytes themselves as \`parts\`. */
 export interface ToolImageHooks<TOut = unknown> {
     /**
-     * The https addresses of pictures in \`output\` the model should see, at most \`MAX_TOOL_IMAGES\`
-     * of them. After the result passes the output guard, the kernel fetches each one through the
-     * profile's network policy, without the tool's credentials, and hands the model the image as a
-     * part; one it cannot fetch is an \`images_unfetched\` warning, never a failed call.
+     * The https addresses of pictures in \`output\` the model should see. After the result passes the
+     * output guard, the kernel fetches each one through the profile's network policy, without the
+     * tool's credentials, and hands the model the image as a part; one it cannot fetch is an
+     * \`images_unfetched\` warning, never a failed call.
      */
     images?: (output: TOut) => string[];
+    /** How many of those pictures the kernel fetches, how large, and how slowly. Left out, there is no limit. */
+    imageLimits?: ToolImageLimits;
+}
+/** Each limit left out is no limit. A picture past one is left out, not cut. */
+export interface ToolImageLimits {
+    /** The most pictures one call hands the model; the first ones named are kept. */
+    count?: number;
+    /** The largest picture fetched. */
+    bytes?: number;
+    /** The most one call hands the model in all. */
+    totalBytes?: number;
+    /** How long each picture may take. */
+    timeoutMs?: number;
 }
 export interface FunctionToolDef<TIn = unknown, TOut = unknown> extends ToolBase, ToolHostHooks<TIn>, ToolOutputHooks<TOut> {
     type: 'function';
@@ -9005,6 +9020,8 @@ export interface HttpToolDef<TIn = unknown, TOut = unknown> extends ToolBase, To
     };
     /** The service's own limit for one key; the kernel keeps this tool's requests within it. */
     limit?: HttpToolLimit;
+    /** The most of a response body the kernel reads; past it the call fails \`response_too_large\`. Left out, there is no limit. */
+    maxResponseBytes?: number;
     /**
      * How long the service may take to answer, its body read included. Past it the call
      * fails \`timeout\` and frees its place in the limit. Left out, a call waits as long as
@@ -9025,6 +9042,17 @@ export interface McpToolDef<TIn = unknown, TOut = unknown> extends ToolBase, Too
     mcpToolName: string;
     headers?: Record<string, string>;
     auth?: ToolAuthConfig;
+    /** The most of a response body the kernel reads; past it the call fails \`response_too_large\`. Left out, there is no limit. */
+    maxResponseBytes?: number;
+    /** How long and how many of this tool's server sessions the kernel keeps. Left out, there is no limit. */
+    session?: McpSessionLimits;
+}
+/** The sessions an MCP tool keeps: each field left out is no limit. */
+export interface McpSessionLimits {
+    /** How long a session may sit unused before the next call opens a new one, in milliseconds. */
+    idleMs?: number;
+    /** The most sessions the tool keeps open; past it the least recently used is dropped. */
+    max?: number;
 }
 /**
  * What an agent tool call carries: the text, and whatever else the called
@@ -9289,7 +9317,7 @@ import { type JsonObject } from '../json.js';
 import type { KeyVault } from '../registry/vault.js';
 import type { DecisionResult, KeySlot } from '../types.js';
 import { type DecisionModelBinding, type ModelBinding } from './binding.js';
-import { type ProviderLimits } from './limits.js';
+import type { ProviderLimits } from './limits.js';
 import type { DecisionCall, EmbeddingCall, EmbeddingResult, ModelProfileType, ProtocolOperations } from './protocol.js';
 import type { RegisteredProvider } from './provider.js';
 /** Opens a WebSocket with the headers and subprotocols a sign-in put on it. */
@@ -9304,7 +9332,8 @@ export type OpenWebSocket = (url: string, init: {
 export declare function plainWebSocket(provider: string): OpenWebSocket;
 /** What a host lends every provider call: its keys, its network, its clock, and its budgets. */
 export interface ProviderHostOptions {
-    limits?: Partial<ProviderLimits>;
+    /** Overrides the model's own \`limits\`, one field at a time. */
+    limits?: ProviderLimits;
     vault?: KeyVault;
     fetch?: typeof fetch;
     wait?: Wait;
@@ -9652,7 +9681,7 @@ declare function kindOfHttpStatus(status: number): ErrorKind;
 declare function errorCopyText(copy: ErrorCopies, labels?: LabelOverrides): string;
 /** Pass the profile's \`labels\`, or the profile's wording is skipped. */
 declare function publicError(err: unknown, labels?: LabelOverrides): string;
-/** Raw diagnostic for hosts, traces, and logs; never shown to end users. */
+/** Raw diagnostic for hosts, traces, and logs; never shown to end users. Each cause that says something new follows on its own line. */
 declare function describeError(err: unknown): string;
 type ProducedError = TurnEventOf<'error'> & {
     errorInternal: string;
@@ -9866,12 +9895,12 @@ export declare const openRouterOpenAi: Protocol<OpenRouterOptions>;
 `,"file:///node_modules/@theoremjs/agents/src/providers/openrouter/images-protocol.d.ts":`import { type Protocol } from '../../kernel/protocols/mod.js';
 /** OpenRouter's image generation: \`/images\`, or the chat path with its image tool when text is wanted too. */
 export declare const openRouterImages: Protocol<Record<string, never>>;
-`,"file:///node_modules/@theoremjs/agents/src/providers/openrouter/embedding-protocol.d.ts":`import { type Protocol } from '../../kernel/protocols/mod.js';
-/** What an \`openRouterEmbedding\` binding sets in \`options\`. */
-export interface OpenRouterEmbeddingOptions {
+`,"file:///node_modules/@theoremjs/agents/src/providers/openrouter/embeddings-protocol.d.ts":`import { type Protocol } from '../../kernel/protocols/mod.js';
+/** What an \`openRouterEmbeddings\` binding sets in \`options\`. */
+export interface OpenRouterEmbeddingsOptions {
     encodingFormat?: 'float' | 'base64';
 }
-export declare const openRouterEmbedding: Protocol<OpenRouterEmbeddingOptions>;
+export declare const openRouterEmbeddings: Protocol<OpenRouterEmbeddingsOptions>;
 `,"file:///node_modules/@theoremjs/agents/src/providers/openrouter/decisions-protocol.d.ts":`import { type Protocol } from '../../kernel/protocols/mod.js';
 /**
  * OpenRouter's decision API: questions about a state, answered in one call. It takes no options:
@@ -9888,13 +9917,13 @@ export interface LocalConnection {
 }
 /** A server on your machine or network that speaks OpenAI's chat API: Ollama, llama.cpp, vLLM, LM Studio. */
 export declare const localProvider: Provider<LocalConnection, string>;
-`,"file:///node_modules/@theoremjs/agents/src/providers/local/embedding-protocol.d.ts":`import { type Protocol } from '../../kernel/protocols/mod.js';
-/** What an \`ollamaEmbedding\` binding sets in \`options\`. */
-export interface OllamaEmbeddingOptions {
+`,"file:///node_modules/@theoremjs/agents/src/providers/local/embeddings-protocol.d.ts":`import { type Protocol } from '../../kernel/protocols/mod.js';
+/** What an \`ollamaEmbeddings\` binding sets in \`options\`. */
+export interface OllamaEmbeddingsOptions {
     truncate?: boolean;
     dimensions?: number;
 }
-export declare const ollamaEmbedding: Protocol<OllamaEmbeddingOptions>;
+export declare const ollamaEmbeddings: Protocol<OllamaEmbeddingsOptions>;
 `,"file:///node_modules/@theoremjs/agents/src/providers/gemini/provider.d.ts":`import { type Provider } from '../../kernel/protocols/provider.js';
 /** What registering \`geminiProvider\` takes as \`connection\`. */
 export interface GeminiConnection {
@@ -9913,14 +9942,14 @@ export interface GeminiInteractionsOptions {
 }
 /** Gemini's Interactions API: text, images, and speech, all at \`/interactions\`. */
 export declare const geminiInteractions: Protocol<GeminiInteractionsOptions>;
-`,"file:///node_modules/@theoremjs/agents/src/providers/gemini/embedding-protocol.d.ts":`import type { Protocol } from '../../kernel/protocols/protocol.js';
-/** What a \`geminiEmbedding\` binding sets in \`options\`. */
-export interface GeminiEmbeddingOptions {
+`,"file:///node_modules/@theoremjs/agents/src/providers/gemini/embeddings-protocol.d.ts":`import type { Protocol } from '../../kernel/protocols/protocol.js';
+/** What a \`geminiEmbeddings\` binding sets in \`options\`. */
+export interface GeminiEmbeddingsOptions {
     /** For \`gemini-embedding-001\`; Gemini Embedding 2 refuses it and reads the request's \`task\` from the text. */
     taskType?: 'RETRIEVAL_QUERY' | 'RETRIEVAL_DOCUMENT' | 'SEMANTIC_SIMILARITY' | 'CLASSIFICATION' | 'CLUSTERING' | 'QUESTION_ANSWERING' | 'FACT_VERIFICATION' | 'CODE_RETRIEVAL_QUERY';
     outputDimensionality?: 768 | 1536 | 3072;
 }
-export declare const geminiEmbedding: Protocol<GeminiEmbeddingOptions>;
+export declare const geminiEmbeddings: Protocol<GeminiEmbeddingsOptions>;
 `,"file:///node_modules/@theoremjs/agents/src/providers/embedding-limits.d.ts":`import type { ModelBinding } from '../kernel/protocols/binding.js';
 import type { EmbeddingModelLimits, Protocol } from '../kernel/protocols/protocol.js';
 /**
@@ -10639,14 +10668,19 @@ export { createToolRegistry };
  * Sessions for MCP servers that refuse a call without one. A session is a cache, not state: it
  * lives in memory on one tool registry, is never persisted, and losing it costs one reopen.
  */
+import type { McpSessionLimits } from './types.js';
 export type McpSession = {
     id: string;
     protocolVersion: string;
 };
+/** The tool a session is used for, and that tool's own \`session\` limits. */
+export interface McpSessionUse extends McpSessionLimits {
+    tool: string;
+}
 export interface McpSessionCache {
-    get(key: string): McpSession | undefined;
+    get(key: string, use: McpSessionUse): McpSession | undefined;
     /** Parallel callers for one key share a single \`open\`. */
-    open(key: string, open: () => Promise<McpSession>): Promise<McpSession>;
+    open(key: string, use: McpSessionUse, open: () => Promise<McpSession>): Promise<McpSession>;
     /** Only drops the session if it's still \`id\`, so a late expiry can't evict a newer one. */
     drop(key: string, id: string): void;
     clear(): void;
@@ -10797,8 +10831,6 @@ export declare function refusedCredentialOutcome(tool: {
     name: string;
     auth?: ToolAuthConfig;
 }, refusal: CredentialRefusal | undefined, carried: boolean, ctx: ToolContext, base: ToolCallBase): Generator<TurnEvent, ToolBodyOutcome | undefined>;
-/** The most of a tool's response body the kernel reads; past it the call fails instead of exhausting the host's memory. */
-export declare const MAX_TOOL_RESPONSE_BYTES: number;
 /** Every string in \`value\` with the credential replaced. */
 export declare function omitSecret(value: unknown, secret: string): unknown;
 /** A failure's message and details with the credential replaced. */
@@ -11549,6 +11581,8 @@ interface Detection {
     text?: string;
     /** Every match, each named for its detector. */
     hits: GuardrailHit[];
+    /** Why a host's \`find\` failed, for the builder only: it reaches \`guardrail.errorInternal\`. */
+    errorInternal?: string;
 }
 declare function stronger(left: DetectOutcome, right: DetectOutcome | 'ignore'): DetectOutcome;
 /**
@@ -11578,8 +11612,6 @@ declare const SCOPED: readonly ["canary_leak", "prompt_leak"];
 declare function isScoped(detector: Detector): detector is (typeof SCOPED)[number];
 /** The host's own detectors that read \`boundary\`. */
 declare function hostAt(boundary: Boundary, detect: ResolvedDetect): HostDetector[];
-/** Refuses a text the person or host sent that is over \`MAX_INBOUND_CHARS\`; \`where\` names it for the log. */
-declare function refuseOverlong(text: string, where: string): void;
 /** Reads \`text\` as it crosses \`boundary\` under the profile's resolved matrix. */
 declare function detectAt(text: string, boundary: Boundary, detect: ResolvedDetect, scope?: DetectScope): Detection;
 /** The detectors that read \`boundary\`: every one not set to \`ignore\`. */
@@ -11630,7 +11662,7 @@ declare function storedHostSpans(text: string, detect?: ResolvedDetect): RedactS
 interface BoundaryReader {
     /** The text to let through, or \`''\` once a match blocks: the caller reads \`found().action\`. */
     read(text: string): string;
-    found(): Pick<Detection, 'action' | 'hits'>;
+    found(): Pick<Detection, 'action' | 'hits' | 'errorInternal'>;
 }
 /** A reader for everything crossing \`boundary\` in one request. */
 declare function boundaryReader(boundary: Boundary, detect: ResolvedDetect): BoundaryReader;
@@ -11638,9 +11670,9 @@ declare function boundaryReader(boundary: Boundary, detect: ResolvedDetect): Bou
  * The guardrail event for what was found at a boundary, or \`undefined\` when nothing matched.
  * \`stage\` is the boundary's own unless the text was read as it streamed.
  */
-declare function detectEvent(boundary: Boundary, found: Pick<Detection, 'action' | 'hits'>, provenance?: Provenance, stage?: GuardrailStage): GuardrailEvent | undefined;
+declare function detectEvent(boundary: Boundary, found: Pick<Detection, 'action' | 'hits' | 'errorInternal'>, provenance?: Provenance, stage?: GuardrailStage): GuardrailEvent | undefined;
 export type { BoundaryReader, Detection, DetectOutcome, DetectScope, Release, StoredSides, StreamRead, Stretch, };
-export { boundaryReader, detectAt, detectEvent, detectorsAt, detectReads, detectRelease, hostAt, isScoped, leakScopeOf, redactDetectors, refuseOverlong, scopeOf, storedHostSpans, storedSpans, stronger, };
+export { boundaryReader, detectAt, detectEvent, detectorsAt, detectReads, detectRelease, hostAt, isScoped, leakScopeOf, redactDetectors, scopeOf, storedHostSpans, storedSpans, stronger, };
 `,"file:///node_modules/@theoremjs/agents/src/guardrails/egress.d.ts":`import type { ModelEvent } from '../kernel/types.js';
 import type { ResolvedDetect } from './detectors.js';
 import type { GuardrailContext, GuardrailHit } from './types.js';
@@ -11790,7 +11822,7 @@ import type { TraceSink } from '../../observability/trace-sink.js';
 import type { ProviderHostOptions } from '../protocols/runtime.js';
 import type { KernelRegistry } from '../registry/kernel-registry.js';
 import type { DecisionProfile, DecisionRequest, DecisionResult } from '../types.js';
-/** Where the provider takes decision requests, as its preset states. */
+/** Each decision failure code, and the error kind it reads as. */
 declare const DECISION_ERROR_KINDS: {
     readonly invalid_request: "request";
     readonly authentication: "auth";
@@ -11823,8 +11855,8 @@ export declare function validateDecisionRequest(request: Omit<DecisionRequest, '
     questions: unknown;
 }, profile: DecisionProfile): asserts request is DecisionRequest;
 /**
- * Exactly one decision request, traced however it ends. An ambiguous POST is never retried,
- * and a trace write failure never changes the decision's outcome.
+ * One decision, traced however it ends. A transient failure (408, 429, a 5xx gateway or a network
+ * error) is retried within five seconds; a trace write failure never changes the decision's outcome.
  */
 export declare function runDecisionInRegistry(registry: KernelRegistry, request: DecisionRequest, options: RunDecisionOptions): Promise<DecisionResult>;
 export {};
@@ -12163,7 +12195,7 @@ declare function sanitizeProjectId(id: string | undefined): string | undefined;
  */
 declare function sanitizeHistory(history: TurnHistoryMessage[], reader: BoundaryReader): TurnHistoryMessage[];
 /** The error a turn ends on when a detector set to \`block\` matched at \`boundary\`. */
-declare function requestRefused(boundary: Boundary): TheoremError;
+declare function requestRefused(boundary: Boundary, reason?: string): TheoremError;
 /** A turn request read at each boundary it crosses. */
 interface SanitizedTurnRequest {
     request: NormalizedTurnRequest;
@@ -12231,7 +12263,7 @@ export { errorCopiesSchema, errorKindSchema, guardrailEventSchema } from './even
 export { guardrailFromHits, guardrailFromVerdict, guardrailTurnEvent, projectGuardrailTurnEvent, } from './events.js';
 export { hitFromSpan, projectGuardrailEvent, } from './hits.js';
 export type { CompiledPatterns, HostPattern } from './host-patterns.js';
-export { listsPatterns, MAX_PATTERN_LENGTH, MAX_PATTERNS, patternListProblem, } from './host-patterns.js';
+export { listsPatterns, patternListProblem, } from './host-patterns.js';
 export { injectionSpans } from './injection.js';
 export type { ClientLabelKey, LabelKey, LabelOverrides, LabelParams } from './labels.js';
 export { CLIENT_LABEL_KEYS, LABEL_KEYS, labelCatalogRows, labelDefault, labelText, overrideLabels, resetLabels, validateLabelOverrides, } from './labels.js';
@@ -12256,7 +12288,7 @@ export type { Directive, DirectiveSignal } from './tool-directives.js';
 export { advisoryLevel, DIRECTIVE_SIGNALS, directives } from './tool-directives.js';
 export type { GuardedToolText, InspectedToolArguments } from './tool-result.js';
 export { checkTaintGate, composeToolText, guardToolFailureText, guardToolResult, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, recordTaint, TOOL_CLOSE, toolCallEvent, wrapToolData, } from './tool-result.js';
-export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, DestinationGate, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, Provenance, QuotaGuardrailSpec, ResolvedBlockedReply, ResolvedGuardrailPolicy, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './types.js';
+export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, DecisionDisclosureEnforcer, DecisionDisclosureVerdict, DecisionGuardrailsSpec, DestinationGate, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, Provenance, QuotaGuardrailSpec, ResolvedBlockedReply, ResolvedGuardrailPolicy, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './types.js';
 export { ADVISORY_LEVELS, BLOCKED_REPLY_ON_BLOCK, DESTINATION_GATES, GUARDRAIL_STAGES, SEVERITIES, TAINT_GATES, TOOL_ORIGINS, TRUST_LEVELS, } from './types.js';
 `,"file:///node_modules/@theoremjs/agents/src/guardrails/tool-result.d.ts":`import type { ToolBoundary } from './boundaries.js';
 import { type DetectScope } from './detect-at.js';
@@ -12430,8 +12462,8 @@ declare const CARD_CANDIDATE: RegExp;
 interface SensitivePattern {
     group: SensitiveGroup;
     pattern: RegExp;
-    /** Whether a match at \`at\` of \`text\` counts. */
-    hit?: (match: string, text: string, at: number) => boolean;
+    /** Whether a match at \`at\` of \`text\` counts; \`lower\` is \`text\` in lower case. */
+    hit?: (match: string, text: string, at: number, lower?: () => string) => boolean;
 }
 /** Every pattern, with its group. */
 declare const SENSITIVE_PATTERNS: readonly SensitivePattern[];