@warlock.js/ai 4.14.0 → 4.16.0

package/esm/contracts/index.d.mts

@@ -25,7 +25,7 @@ import { END, EndSentinel } from "./end.type.mjs";
 import { SupervisorReport, SupervisorResult, SupervisorTerminatedBy } from "./result/supervisor-result.type.mjs";
 import { StepSnapshot } from "./result/step-result.type.mjs";
 import { WorkflowReport, WorkflowResult } from "./result/workflow-result.type.mjs";
-import { ToolConfig, ToolContext, ToolMeta, ToolMode } from "./tool.contract.mjs";
+import { ToolActionResolver, ToolConfig, ToolContext, ToolMeta, ToolMode } from "./tool.contract.mjs";
 import { SupervisorInput } from "./supervisor/supervisor-input.type.mjs";
 import { SupervisorSnapshot, SupervisorSnapshotStatus } from "./supervisor/supervisor-snapshot.type.mjs";
 import { PgClientLike, RedisClientLike, SnapshotStore } from "./orchestrator/snapshot-store.contract.mjs";
@@ -67,14 +67,14 @@ import { GeneratedImage, ImageGenerationOptions, ImageGenerationResponse, ImageM
 import { MemoryItem, MemoryTier, RecalledMemory } from "./memory/memory-item.type.mjs";
 import { RecallOptions } from "./memory/recall-options.type.mjs";
 import { MemoryContract } from "./memory/memory.contract.mjs";
-import { MemoryConfig, SemanticMemoryConfig } from "./memory/memory-config.type.mjs";
+import { MemoryConfig, SemanticMemoryConfig, WorkingMemoryConfig } from "./memory/memory-config.type.mjs";
 import { CheckpointRecord, CheckpointStore } from "./orchestrator/checkpoint-store.contract.mjs";
 import { SessionLock } from "./orchestrator/session-lock.contract.mjs";
 import { OrchestratorCommands } from "./orchestrator/orchestrator-commands.type.mjs";
 import { OrchestratorEvent, OrchestratorEventHandler, OrchestratorEventHandlers, OrchestratorEventMap, OrchestratorEventName } from "./orchestrator/orchestrator-event.type.mjs";
 import { OrchestratorExecuteOptions, OrchestratorResumeOptions } from "./orchestrator/orchestrator-execute-options.type.mjs";
 import { OrchestratorAsToolOptions, OrchestratorContract, OrchestratorSessionScope, SessionContextOverrides } from "./orchestrator/orchestrator.contract.mjs";
-import { OrchestratorConfig, OrchestratorMemoryConfig, SummarizeCallback, SummarizeConfig } from "./orchestrator/orchestrator-config.type.mjs";
+import { OrchestratorConfig, OrchestratorMemoryConfig, OrchestratorMemoryScope, SummarizeCallback, SummarizeConfig } from "./orchestrator/orchestrator-config.type.mjs";
 import { SessionContract } from "./orchestrator/session.contract.mjs";
 import { PlannerCapability } from "./planner/planner-capability.type.mjs";
 import { PlannerPlan, PlannerStep } from "./planner/planner-plan.type.mjs";

package/esm/contracts/memory/index.d.mts

@@ -1,4 +1,4 @@
 import { MemoryItem, MemoryTier, RecalledMemory } from "./memory-item.type.mjs";
 import { RecallOptions } from "./recall-options.type.mjs";
 import { MemoryContract } from "./memory.contract.mjs";
-import { MemoryConfig, SemanticMemoryConfig } from "./memory-config.type.mjs";
+import { MemoryConfig, SemanticMemoryConfig, WorkingMemoryConfig } from "./memory-config.type.mjs";

package/esm/contracts/memory/memory-config.type.d.mts

@@ -3,6 +3,31 @@ import { MemoryTier } from "./memory-item.type.mjs";
 import { CacheDriver } from "@warlock.js/cache";
 
 //#region ../ai/src/contracts/memory/memory-config.type.d.ts
+/**
+ * Working-tier wiring for `memory(config)`.
+ *
+ * The working tier is a plain in-process buffer with no durability and
+ * no vector index — it lives for the lifetime of the `memory()` instance,
+ * which composite primitives (`ai.orchestrator({ memory })`) resolve once
+ * and reuse across every session. Its only knob is the size bound that
+ * keeps that lifetime from turning into unbounded process-memory growth.
+ */
+type WorkingMemoryConfig = {
+  /**
+   * Maximum number of entries the working buffer holds, across every
+   * `scope`. On overflow the oldest-written entry is evicted (FIFO —
+   * recall returns newest-first, so the evicted end is the one a bounded
+   * recall would never reach). Default `1000`.
+   *
+   * Must be an integer `>= 1`; there is no unbounded setting. Raise it
+   * deliberately for a long-running single-tenant process that recalls
+   * deep history from the working tier, and remember every entry is
+   * retained in process memory until evicted or `clear()`ed. Durable
+   * recall belongs in the semantic / episodic tiers, which delegate
+   * storage to a `CacheDriver`.
+   */
+  maxItems?: number;
+};
 /**
  * Semantic-tier wiring for `memory(config)`.
  *
@@ -111,9 +136,10 @@ type MemoryConfig = {
   /** Stable identifier — used in logs and as the working-tier scope key. */name?: string;
   /**
    * Enable the in-run working tier. Default `true`. Set `false` to build
-   * a semantic-only memory.
+   * a semantic-only memory, or pass a {@link WorkingMemoryConfig} to tune
+   * its size bound (`{ maxItems }`, default `1000`).
    */
-  working?: boolean;
+  working?: boolean | WorkingMemoryConfig;
   /**
    * Enable + wire the semantic recall tier. Omit for a working-only
    * memory.
@@ -146,5 +172,5 @@ type MemoryConfig = {
   threshold?: number;
 };
 //#endregion
-export { EpisodicMemoryConfig, MemoryConfig, ProceduralMemoryConfig, SemanticMemoryConfig };
+export { EpisodicMemoryConfig, MemoryConfig, ProceduralMemoryConfig, SemanticMemoryConfig, WorkingMemoryConfig };
 //# sourceMappingURL=memory-config.type.d.mts.map

package/esm/contracts/memory/memory-config.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/memory-config.type.ts"],"mappings":";;;;;;;AAmBA;;;;;;;;;;AAcW;AAWX;;KAzBY,oBAAA;EAgCS,qEA9BnB,QAAA,EAAU,gBAAA;EAyBA;;;;;EAnBV,KAAA,GAAQ,WAAW;EA8CnB;;AAAG;AAUL;;EAlDE,SAAA;AAAA;;;;;;;;AAqEmB;KA1DT,oBAAA;EAsEY,yEApEtB,QAAA,EAAU,gBAAA;EAgFC;;;;EA3EX,KAAA,GAAQ,WAAW;EA0FK;;;;;EApFxB,SAAA;EA0EW;;;;;EApEX,aAAA;EAwFA;;AAAS;;EAnFT,UAAA;;;;;EAKA,GAAA;AAAA;;;;;;;;KAUU,sBAAA;6EAEV,QAAA,EAAU,gBAAA;;;;;EAKV,KAAA,GAAQ,WAAW;;;;;;EAMnB,SAAA;;;;;;EAMA,mBAAA;AAAA;;;;;;;;;;KAYU,YAAA;4EAEV,IAAA;;;;;EAKA,OAAA;;;;;EAKA,QAAA,GAAW,oBAAA;;;;;EAKX,QAAA,GAAW,oBAAA;;;;;EAKX,UAAA,GAAa,sBAAA;;;;;EAKb,WAAA,GAAc,UAAA;;;;;EAKd,CAAA;;;;;EAKA,SAAA;AAAA"}
+{"version":3,"file":"memory-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/memory-config.type.ts"],"mappings":";;;;;;;AAaA;;;;AAcU;AAkBV;;KAhCY,mBAAA;EAwCS;;;;;;;AAMV;AAWX;;;;;EA3CE,QAAQ;AAAA;;;;;;;AAwEL;AAUL;;;;;;;;KAhEY,oBAAA;EAmFV,qEAjFA,QAAA,EAAU,gBAAA;EAiFS;AAYrB;;;;EAvFE,KAAA,GAAQ,WAAW;EAyGR;;;;;EAnGX,SAAA;AAAA;;;;;;;;;KAWU,oBAAA;EAuGV,yEArGA,QAAA,EAAU,gBAAA;EA0GD;AAAA;;;EArGT,KAAA,GAAQ,WAAW;;;;;;EAMnB,SAAA;;;;;;EAMA,aAAA;;;;;EAKA,UAAA;;;;;EAKA,GAAA;AAAA;;;;;;;;KAUU,sBAAA;6EAEV,QAAA,EAAU,gBAAA;;;;;EAKV,KAAA,GAAQ,WAAW;;;;;;EAMnB,SAAA;;;;;;EAMA,mBAAA;AAAA;;;;;;;;;;KAYU,YAAA;4EAEV,IAAA;;;;;;EAMA,OAAA,aAAoB,mBAAA;;;;;EAKpB,QAAA,GAAW,oBAAA;;;;;EAKX,QAAA,GAAW,oBAAA;;;;;EAKX,UAAA,GAAa,sBAAA;;;;;EAKb,WAAA,GAAc,UAAA;;;;;EAKd,CAAA;;;;;EAKA,SAAA;AAAA"}

package/esm/contracts/memory/memory-item.type.d.mts

@@ -35,11 +35,25 @@ type MemoryTier = "working" | "semantic" | "episodic" | "procedural";
  * `metadata` is an opaque bag round-tripped verbatim onto the recalled
  * memory — use it for source ids, timestamps, tags, or anything the
  * consumer wants back alongside the text.
+ *
+ * `scope` is the ISOLATION key (4.15.0). It is not metadata: every tier
+ * enforces an exact-equality match between an item's `scope` and the
+ * `scope` on the `recall()` call BEFORE hits are scored and merged, so
+ * an item written under one scope can never surface in another scope's
+ * recall. Omit it for the shared/global pool.
  */
 type MemoryItem = {
   /** Natural-language content. Embedded for semantic recall; surfaced verbatim on retrieval. */text: string; /** Destination tier. Defaults to the factory's `defaultTier` when omitted. */
   tier?: MemoryTier; /** Caller-owned identifier for overwrite / dedup. Derived from `text` when omitted. */
-  id?: string; /** Opaque metadata round-tripped onto the recalled memory unchanged. */
+  id?: string;
+  /**
+   * Isolation key — an opaque tenant / session / user boundary. Enforced
+   * by every tier as an exact-equality filter at recall time, and folded
+   * into the stored key so two scopes writing identical text never
+   * overwrite each other. Omit for the shared/global pool (which only an
+   * equally unscoped `recall()` can read).
+   */
+  scope?: string; /** Opaque metadata round-tripped onto the recalled memory unchanged. */
   metadata?: Record<string, unknown>;
 };
 /**

package/esm/contracts/memory/memory-item.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"memory-item.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/memory-item.type.ts"],"mappings":";;AAqBA;;;;AAAsB;AAiBtB;;;;;;;;;;;AAQmB;AAanB;;;KAtCY,UAAA;;;;;;;;;AAgDO;;;;;;;KA/BP,UAAA;gGAEV,IAAA;EAEA,IAAA,GAAO,UAAA;EAEP,EAAA;EAEA,QAAA,GAAW,MAAM;AAAA;;;;;;;;;;;KAaP,cAAA;wCAEV,EAAA;EAEA,IAAA;EAEA,IAAA,EAAM,UAAA;EAEN,KAAA;EAEA,QAAA,GAAW,MAAM;AAAA"}
+{"version":3,"file":"memory-item.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/memory-item.type.ts"],"mappings":";;AAqBA;;;;AAAsB;AAuBtB;;;;;;;;;;;;AAgBmB;AAanB;;KApDY,UAAA;;;;;;;;;;AA8DO;;;;;;;;;;;;KAvCP,UAAA;gGAEV,IAAA;EAEA,IAAA,GAAO,UAAA;EAEP,EAAA;;;;;;;;EAQA,KAAA;EAEA,QAAA,GAAW,MAAM;AAAA;;;;;;;;;;;KAaP,cAAA;wCAEV,EAAA;EAEA,IAAA;EAEA,IAAA,EAAM,UAAA;EAEN,KAAA;EAEA,QAAA,GAAW,MAAM;AAAA"}

package/esm/contracts/memory/memory.contract.d.mts

@@ -27,6 +27,15 @@ import { RecallOptions } from "./recall-options.type.mjs";
  * itself; surfacing the recalled text is the consumer's call so the
  * injection point stays explicit.
  *
+ * **Isolation (4.15.0).** Every item may carry a `scope` — an opaque
+ * tenant / session / user key — and every `recall()` may name one. The
+ * match is exact equality, enforced *inside* each tier before hits are
+ * scored and merged, so one scope's memories can never surface in
+ * another's recall. Unscoped items form a shared pool readable only by an
+ * equally unscoped `recall()`; there is no "read every scope" query.
+ * `ai.orchestrator({ memory })` sets this automatically from the turn's
+ * `sessionId` (see `OrchestratorMemoryConfig.scope`).
+ *
  * **Still deferred.** Decay / forgetting (TTL-based relevance falloff,
  * eviction policies) is not yet implemented; the four tiers above are the
  * full 4.3.0 surface. The `episodic` and `procedural` tiers were added in
@@ -62,14 +71,18 @@ interface MemoryContract {
    * appended to the in-run buffer.
    *
    * Re-remembering an item whose id (explicit or text-derived) already
-   * exists overwrites it in place rather than duplicating.
+   * exists overwrites it in place rather than duplicating — within the
+   * item's `scope`. Identical text under two different scopes stays two
+   * independent entries.
    */
   remember(items: MemoryItem | MemoryItem[]): Promise<void>;
   /**
    * Retrieve the memories most relevant to `query`, scored and ordered
    * by descending relevance. Queries every enabled tier by default;
    * `options.tier` narrows to one. `options.k` caps the result count,
-   * `options.threshold` raises the semantic-similarity floor.
+   * `options.threshold` raises the semantic-similarity floor, and
+   * `options.scope` restricts the eligible set to the memories written
+   * under that exact scope (omit it to read the unscoped pool only).
    *
    * Returns an empty array when nothing clears the threshold — never
    * throws on "no hits".

package/esm/contracts/memory/memory.contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"memory.contract.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/memory.contract.ts"],"mappings":";;;;;;AAqDA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BmC;;;;;;;;;;;;;;;;;;UA/BlB,cAAA;;WAEN,IAAA;;;;;;;;;;EAWT,QAAA,CAAS,KAAA,EAAO,UAAA,GAAa,UAAA,KAAe,OAAA;;;;;;;;;;EAW5C,MAAA,CAAO,KAAA,UAAe,OAAA,GAAU,aAAA,GAAgB,OAAA,CAAQ,cAAA;;;;;;EAOxD,KAAA,CAAM,IAAA,GAAO,UAAA,GAAa,OAAA;AAAA"}
+{"version":3,"file":"memory.contract.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/memory.contract.ts"],"mappings":";;;;;;AA8DA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCmC;;;;;;;;;;;;;;;;;;;;;;;;;;;UAnClB,cAAA;;WAEN,IAAA;;;;;;;;;;;;EAaT,QAAA,CAAS,KAAA,EAAO,UAAA,GAAa,UAAA,KAAe,OAAA;;;;;;;;;;;;EAa5C,MAAA,CAAO,KAAA,UAAe,OAAA,GAAU,aAAA,GAAgB,OAAA,CAAQ,cAAA;;;;;;EAOxD,KAAA,CAAM,IAAA,GAAO,UAAA,GAAa,OAAA;AAAA"}

package/esm/contracts/memory/recall-options.type.d.mts

@@ -27,6 +27,18 @@ type RecallOptions = {
    * which has no vector index.
    */
   threshold?: number;
+  /**
+   * Isolation key (4.15.0) — only memories remembered under the SAME
+   * `scope` are eligible. The match is exact equality, enforced inside
+   * every tier before hits are scored and merged, never bolted on by the
+   * caller afterward.
+   *
+   * Omitting `scope` does NOT mean "every scope": an unscoped recall
+   * reads only the unscoped (shared/global) pool. That is the fail-closed
+   * default — reading another tenant's memories always requires naming
+   * their scope explicitly.
+   */
+  scope?: string;
 };
 //#endregion
 export { RecallOptions };

package/esm/contracts/memory/recall-options.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"recall-options.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/recall-options.type.ts"],"mappings":";;;;;AASA;;;;;KAAY,aAAA;EAYH;;;AAME;;EAZT,CAAA;;;;;;EAMA,IAAA,GAAO,UAAU;;;;;;EAMjB,SAAA;AAAA"}
+{"version":3,"file":"recall-options.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/memory/recall-options.type.ts"],"mappings":";;;;;AASA;;;;;KAAY,aAAA;EAYH;;;;AAkBF;EAxBL,CAAA;;;;;;EAMA,IAAA,GAAO,UAAU;;;;;;EAMjB,SAAA;;;;;;;;;;;;EAYA,KAAA;AAAA"}

package/esm/contracts/orchestrator/index.d.mts

@@ -5,5 +5,5 @@ import { OrchestratorCommands } from "./orchestrator-commands.type.mjs";
 import { OrchestratorEvent, OrchestratorEventHandler, OrchestratorEventHandlers, OrchestratorEventMap, OrchestratorEventName } from "./orchestrator-event.type.mjs";
 import { OrchestratorExecuteOptions, OrchestratorResumeOptions } from "./orchestrator-execute-options.type.mjs";
 import { OrchestratorAsToolOptions, OrchestratorContract, OrchestratorSessionScope, SessionContextOverrides } from "./orchestrator.contract.mjs";
-import { OrchestratorConfig, OrchestratorMemoryConfig, SummarizeCallback, SummarizeConfig } from "./orchestrator-config.type.mjs";
+import { OrchestratorConfig, OrchestratorMemoryConfig, OrchestratorMemoryScope, SummarizeCallback, SummarizeConfig } from "./orchestrator-config.type.mjs";
 import { SessionContract } from "./session.contract.mjs";

package/esm/contracts/orchestrator/orchestrator-config.type.d.mts

@@ -49,6 +49,14 @@ type SummarizeConfig = {
  * coarse.
  */
 type SummarizeCallback = (history: Message[]) => Promise<CompactionResult> | CompactionResult;
+/**
+ * Isolation boundary for the orchestrator's memory recall / write-back
+ * (4.15.0). `"session"` (the default) confines a turn to the memories
+ * remembered under the same `sessionId`; `"shared"` opts every session of
+ * this orchestrator into one common pool; a function derives a custom key
+ * (a tenant id, a user id) from the executing session.
+ */
+type OrchestratorMemoryScope = "session" | "shared" | ((sessionId: string) => string);
 /**
  * Per-turn memory wiring for `OrchestratorConfig.memory` (memory core
  * M2). The `store` is the {@link MemoryContract} the orchestrator
@@ -65,9 +73,33 @@ type SummarizeCallback = (history: Message[]) => Promise<CompactionResult> | Com
  * `ctx.context[injectKey]` — memory never mutates the prompt itself, the
  * surfacing point stays explicit (the same contract `MemoryContract`
  * documents).
+ *
+ * **Isolation (4.15.0).** The store is resolved ONCE per orchestrator
+ * instance and reused by every session, so `scope` decides what a turn
+ * may read: it defaults to `"session"`, which confines both recall and
+ * write-back to the executing `sessionId`. Cross-session pooling is
+ * available but must be asked for (`scope: "shared"`).
  */
 type OrchestratorMemoryConfig = {
   /** The memory store recalled-from before dispatch and remembered-into after. */store: MemoryContract;
+  /**
+   * Isolation boundary applied to every recall and write-back
+   * (4.15.0 — security fix).
+   *
+   * - `"session"` (DEFAULT) — memories are keyed to the turn's
+   *   `sessionId`. One session can never recall another's remembered
+   *   turns, even though the store instance is shared by the whole
+   *   orchestrator.
+   * - `"shared"` — every session reads and writes ONE pool. This is the
+   *   pre-4.15.0 behavior and is only safe when every session of this
+   *   orchestrator is trusted to see every other session's memories
+   *   (e.g. a single-tenant assistant, or a curated knowledge base).
+   * - `(sessionId) => string` — derive the key yourself, e.g. map a
+   *   session to its tenant (`(id) => tenantOf(id)`) so a tenant's users
+   *   share memory but tenants stay isolated. The returned string is
+   *   opaque; equal strings share memories.
+   */
+  scope?: OrchestratorMemoryScope;
   /**
    * Pre-dispatch recall tuning. `k` caps the injected count (0 disables
    * recall — write-only memory); `threshold` raises the semantic
@@ -190,10 +222,15 @@ type OrchestratorConfig<TOutput, TState = TOutput, TIntents extends Record<strin
    * the existing behavior — orchestrators without memory are unchanged.
    * Accepts a bare {@link MemoryContract} (recall + remember with
    * defaults) or an {@link OrchestratorMemoryConfig} for finer control.
+   *
+   * Either form is SESSION-SCOPED by default (4.15.0): the store is
+   * shared by the whole orchestrator instance, but each turn only recalls
+   * what its own `sessionId` remembered. Opt into cross-session pooling
+   * explicitly with `{ store, scope: "shared" }`.
    */
   memory?: MemoryContract | OrchestratorMemoryConfig; /** Definition-level event handlers — tier 1 of the 3-tier model. */
   on?: OrchestratorEventHandlers;
 };
 //#endregion
-export { OrchestratorConfig, OrchestratorMemoryConfig, SummarizeCallback, SummarizeConfig };
+export { OrchestratorConfig, OrchestratorMemoryConfig, OrchestratorMemoryScope, SummarizeCallback, SummarizeConfig };
 //# sourceMappingURL=orchestrator-config.type.d.mts.map

package/esm/contracts/orchestrator/orchestrator-config.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/orchestrator/orchestrator-config.type.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA2BA;;;;;;KAAY,eAAA;EAeE,qEAbZ,UAAA,WAEA;EAAA,IAAA,WAEa;EAAb,UAAA,GAAa,aAAA;EAOC;;;;;EADd,SAAA,IACE,UAAA,EAAY,gBAAA,EACZ,GAAA;IAAO,SAAA;EAAA,MACJ,OAAA,eAEW;EAAhB,IAAA;IAAS,OAAA;EAAA;AAAA;;;;;;;KASC,iBAAA,IACV,OAAA,EAAS,OAAA,OACN,OAAA,CAAQ,gBAAA,IAAoB,gBAAA;;;;;AAAgB;AAmBjD;;;;;;;;;;;;KAAY,wBAAA;EAYR,gFAVF,KAAA,EAAO,cAAA;EAkBP;;;;;AAYS;EAvBT,MAAA;IACE,CAAA;IACA,SAAA;IACA,IAAA,GAAO,UAAA;EAAA;EAmDQ;;;;;;EA3CjB,QAAA;EAkEc;;;;;EA5Dd,YAAA,GAAe,UAAA;EA8DmB;;;;;EAxDlC,SAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BU,kBAAA,mBAED,OAAA,mBACQ,MAAA,SAAe,qBAAA,IAAyB,MAAA,SAEvD,qBAAA;EAcF,wEAVA,IAAA,UAYA;EAVA,OAAA;EAaA;;;;;;;EALA,OAAA,GAAU,iBAAA,EAO4C;EALtD,YAAA,GAAe,oBAAA,WAON;EAJT,OAAA,EAAS,QAAA,EAIqC;EAF9C,KAAA,IAAS,GAAA,EAAK,YAAA,CAAa,MAAA,MAAY,IAAA,GAAO,OAAA,CAAQ,IAAA,GAK/C;EAHP,MAAA,GAAS,aAAA,YAAyB,WAAA,CAAY,MAAA,GAG5C;EADF,QAAA,IACE,GAAA,EAAK,eAAA,CAAgB,MAAA,MAClB,cAAA,GAAiB,OAAA,CAAQ,cAAA,GAAR;EAEtB,KAAA,GAAQ,MAAA,EAAR;EAEA,MAAA,GAAS,gBAAA,CAAiB,OAAA,GAA1B;EAEA,YAAA,WAF0B;EAI1B,aAAA;EAAA;;;;;EAOA,OAAA;EAO8C;;;;;EAD9C,aAAA;IACE,MAAA,cAAoB,QAAA,EAAU,OAAA,OAAc,OAAA;IAC5C,MAAA,cAAoB,QAAA,EAAU,OAAA,OAAc,OAAA;EAAA,GAQ9C;EALA,SAAA,GAAY,eAAA,GAAkB,iBAAA,EAwB9B;EAtBA,aAAA,mBAwBA;EArBA,eAAA,GAAkB,eAAA;EA+BlB;;;;;;AAG8B;;;;;;;;;;;;EAf9B,WAAA,GAAc,WAAA;EAEd,aAAA,GAAgB,aAAA;;;;;;;;;;EAUhB,MAAA,GAAS,cAAA,GAAiB,wBAAA;EAG1B,EAAA,GAAK,yBAAA;AAAA"}
+{"version":3,"file":"orchestrator-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/orchestrator/orchestrator-config.type.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA2BA;;;;;;KAAY,eAAA;EAeE,qEAbZ,UAAA,WAEA;EAAA,IAAA,WAEa;EAAb,UAAA,GAAa,aAAA;EAOC;;;;;EADd,SAAA,IACE,UAAA,EAAY,gBAAA,EACZ,GAAA;IAAO,SAAA;EAAA,MACJ,OAAA,eAEW;EAAhB,IAAA;IAAS,OAAA;EAAA;AAAA;;;;;;;KASC,iBAAA,IACV,OAAA,EAAS,OAAA,OACN,OAAA,CAAQ,gBAAA,IAAoB,gBAAA;;;;;AAAgB;AASjD;;KAAY,uBAAA,4BAGN,SAAiB;;AAAA;AAyBvB;;;;;;;;;;;;;;;;;;;;;KAAY,wBAAA;EAkDD,gFAhDT,KAAA,EAAO,cAAA;EA4EG;;;;;;;;;;;;;;;;;EA1DV,KAAA,GAAQ,uBAAA;EAsF0B;;;;;;EA/ElC,MAAA;IACE,CAAA;IACA,SAAA;IACA,IAAA,GAAO,UAAA;EAAA;EAuGuB;;;;;;EA/FhC,QAAA;EA2IS;;;;;EArIT,YAAA,GAAe,UAAA;EAoCf;;;;;EA9BA,SAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;KA4BU,kBAAA,mBAED,OAAA,mBACQ,MAAA,SAAe,qBAAA,IAAyB,MAAA,SAEvD,qBAAA;EA6BF,wEAzBA,IAAA,UA2BA;EAzBA,OAAA;EAyB0B;;;;;;;EAjB1B,OAAA,GAAU,iBAAA,EAmCoC;EAjC9C,YAAA,GAAe,oBAAA,WAkCiB;EA/BhC,OAAA,EAAS,QAAA,EA+BqC;EA7B9C,KAAA,IAAS,GAAA,EAAK,YAAA,CAAa,MAAA,MAAY,IAAA,GAAO,OAAA,CAAQ,IAAA,GAgC1C;EA9BZ,MAAA,GAAS,aAAA,YAAyB,WAAA,CAAY,MAAA,GAgC9C;EA9BA,QAAA,IACE,GAAA,EAAK,eAAA,CAAgB,MAAA,MAClB,cAAA,GAAiB,OAAA,CAAQ,cAAA,GA+BZ;EA7BlB,KAAA,GAAQ,MAAA,EAgDM;EA9Cd,MAAA,GAAS,gBAAA,CAAiB,OAAA,GAgDV;EA9ChB,YAAA,WA6DS;EA3DT,aAAA;EA8DA;;;AAA8B;;EAvD9B,OAAA;;;;;;EAMA,aAAA;IACE,MAAA,cAAoB,QAAA,EAAU,OAAA,OAAc,OAAA;IAC5C,MAAA,cAAoB,QAAA,EAAU,OAAA,OAAc,OAAA;EAAA;EAG9C,SAAA,GAAY,eAAA,GAAkB,iBAAA;EAE9B,aAAA;EAGA,eAAA,GAAkB,eAAA;;;;;;;;;;;;;;;;;;;EAmBlB,WAAA,GAAc,WAAA;EAEd,aAAA,GAAgB,aAAA;;;;;;;;;;;;;;;EAehB,MAAA,GAAS,cAAA,GAAiB,wBAAA;EAG1B,EAAA,GAAK,yBAAA;AAAA"}

package/esm/contracts/orchestrator/orchestrator.contract.d.mts

@@ -1,4 +1,6 @@
+import { Message } from "../conversation-message.type.mjs";
 import { StreamContract } from "../stream/stream.contract.mjs";
+import { ToolContext } from "../tool.contract.mjs";
 import { ToolContract } from "../../tool/tool.mjs";
 import { SupervisorInput } from "../supervisor/supervisor-input.type.mjs";
 import { OrchestratorResult } from "../result/orchestrator-result.type.mjs";
@@ -14,11 +16,42 @@ import { StandardSchemaV1 } from "@standard-schema/spec";
  *
  * - `"fresh"` (default) — every tool invocation gets a brand-new
  *   `sessionId`; no continuity across calls. Safe default.
- * - `"shared"` — the wrapped orchestrator participates in the parent's
- *   session; the `sessionId` is supplied via the tool's `inputSchema`
- *   payload. Expert escape hatch for nested-conversation use cases.
+ * - `"shared"` — the wrapped orchestrator participates in an existing
+ *   session. The target `sessionId` comes from the DEVELOPER, via
+ *   `OrchestratorAsToolOptions.session` (a fixed id bound at
+ *   construction, or a resolver reading the out-of-band
+ *   {@link ToolContext}) — never from the model's tool-call arguments.
+ *   Expert escape hatch for nested-conversation use cases.
  */
 type OrchestratorSessionScope = "fresh" | "shared";
+/**
+ * Where a `sessionScope: "shared"` tool call gets its session from
+ * (4.15.0 — security fix).
+ *
+ * A `sessionId` is bearer-equivalent: whoever names one gets read/write
+ * access to that session's persisted state and history. It must
+ * therefore be bound OUTSIDE the model-visible `inputSchema` — either as
+ * a literal string fixed at `asTool()` construction, or as a resolver
+ * that reads the invocation's {@link ToolContext} (the same out-of-band
+ * channel `signal` and `artifacts` travel on, which an LLM cannot write
+ * to). Returning `history` lets the developer thread prior turns the
+ * same way.
+ *
+ * @example
+ * // Bound per request: the app puts the authenticated user's session on
+ * // the tool-call artifacts bag; the model never sees or picks it.
+ * const tool = support.asTool({
+ *   inputSchema: v.object({ message: v.string() }),
+ *   sessionScope: "shared",
+ *   session: (ctx) => String(ctx?.artifacts?.supportSessionId ?? ""),
+ * });
+ */
+type OrchestratorToolSession = string | ((ctx: ToolContext | undefined) => string | OrchestratorToolSessionBinding | undefined | Promise<string | OrchestratorToolSessionBinding | undefined>);
+/** Resolved session binding for a shared-scope tool call. */
+type OrchestratorToolSessionBinding = {
+  /** Session the nested orchestrator joins. Must be non-empty. */sessionId: string; /** Prior turns to seed the nested run with. Defaults to `[]`. */
+  history?: Message[];
+};
 /**
  * Context overrides for a specific session.
  *
@@ -46,6 +79,37 @@ type OrchestratorAsToolOptions<TToolInput = string> = {
   description?: string;
   inputSchema: StandardSchemaV1<TToolInput>; /** Session continuity for tool calls. Default `"fresh"`. */
   sessionScope?: OrchestratorSessionScope;
+  /**
+   * Which session a `sessionScope: "shared"` call joins — REQUIRED for
+   * that scope (4.15.0), and ignored for `"fresh"`.
+   *
+   * Bind it at construction (a literal id) or per call from the
+   * {@link ToolContext} (a resolver). Both channels are invisible to the
+   * model, which is the point: the previous release read `sessionId`
+   * straight off the validated tool payload, so a prompt-injected outer
+   * agent could name a VICTIM's session and have the nested orchestrator
+   * load, mutate, and echo back their conversation.
+   *
+   * Constructing a `"shared"` tool with neither this nor
+   * {@link unsafeAllowModelSessionId} throws.
+   */
+  session?: OrchestratorToolSession;
+  /**
+   * DANGEROUS opt-in: restore the pre-4.15.0 behavior of reading
+   * `sessionId` / `history` out of the model-generated tool payload.
+   *
+   * The value is a **bearer token for that session** — anything that can
+   * influence the calling model's output (an injected document, a web
+   * page it summarized, a poisoned tool result) can name any session id
+   * it can guess or has seen, and the nested orchestrator will load that
+   * session's state, run a turn against it, and return its content to
+   * the outer transcript.
+   *
+   * Only set this when the outer agent's context is fully trusted AND
+   * your `execute` path independently verifies the model-chosen
+   * `sessionId` belongs to the current caller. Prefer {@link session}.
+   */
+  unsafeAllowModelSessionId?: boolean;
 };
 /**
  * Runtime handle returned by `ai.orchestrator(config)` (design §15.3) —

package/esm/contracts/orchestrator/orchestrator.contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestrator.contract.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/orchestrator/orchestrator.contract.ts"],"mappings":";;;;;;;;;;;;AA0BA;;;;AAAoC;AAapC;;;KAbY,wBAAA;AAcE;AAWd;;;;;;;;;;AAXc,KADF,uBAAA;EAAA,CACT,GAAW;AAAA;;;;;AAgB2B;AAgCzC;;;KArCY,yBAAA;EACV,IAAA;EACA,WAAA;EACA,WAAA,EAAa,gBAAA,CAAiB,UAAA,GAkDA;EAhD9B,YAAA,GAAe,wBAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAgCA,oBAAA,6BAAiD,OAAA;EAwErD;EAAA,SAtEF,IAAA;EAsE0B;EAAA,SApE1B,SAAA;EAJ8C;EAAA,SAM9C,OAAA;EAJA;;;;;EAWT,OAAA,CACE,KAAA,EAAO,eAAA,EACP,OAAA,EAAS,0BAAA,CAA2B,MAAA,IACnC,OAAA,CAAQ,kBAAA,CAAmB,OAAA;EADnB;;;;;EAQX,MAAA,CACE,KAAA,EAAO,eAAA,EACP,OAAA,EAAS,0BAAA,CAA2B,MAAA,IACnC,cAAA,CAAe,kBAAA,CAAmB,OAAA,GAAU,iBAAA;EAH/C;;;;;EAUA,MAAA,CACE,SAAA,UACA,OAAA,GAAU,yBAAA,GACT,OAAA,CAAQ,kBAAA,CAAmB,OAAA;EAV3B;;;;;EAiBH,OAAA,iBAAwB,oBAAA,EACtB,IAAA,EAAM,CAAA,EACN,IAAA,EAAM,oBAAA,CAAqB,CAAA,YAC1B,OAAA,CAAQ,oBAAA,CAAqB,CAAA;EAXpB;;;;;EAkBZ,MAAA,sBACE,OAAA,EAAS,yBAAA,CAA0B,UAAA,IAClC,YAAA,CAAa,UAAA,EAAY,OAAA;EAZpB;;;;EAkBR,EAAA,WAAa,qBAAA,EACX,KAAA,EAAO,CAAA,EACP,OAAA,EAAS,wBAAA,CAAyB,CAAA;EAlBP;;;;EAyB7B,GAAA,WAAc,qBAAA,EACZ,KAAA,EAAO,CAAA,EACP,OAAA,EAAS,wBAAA,CAAyB,CAAA;AAAA"}
+{"version":3,"file":"orchestrator.contract.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/orchestrator/orchestrator.contract.ts"],"mappings":";;;;;;;;;;;;;;AA+BA;;;;AAAoC;AAwBpC;;;;;;KAxBY,wBAAA;;;;;;;;;AA8B2C;AAGvD;;;;;;;;AAImB;AAcnB;;;;KA3BY,uBAAA,cAEN,GAAA,EAAK,WAAA,0BAEH,8BAAA,eAEA,OAAA,UAAiB,8BAAA;AAiCzB;AAAA,KA9BY,8BAAA;EA8ByB,gEA5BnC,SAAA,UA+Ba;EA7Bb,OAAA,GAAU,OAAO;AAAA;;;;;;;;;;;;KAcP,uBAAA;EAAA,CACT,GAAW;AAAA;AA+Ca;AAgC3B;;;;;;;AAhC2B,KApCf,yBAAA;EACV,IAAA;EACA,WAAA;EACA,WAAA,EAAa,gBAAA,CAAiB,UAAA,GA0FQ;EAxFtC,YAAA,GAAe,wBAAA;EAyFsB;;;;;;;;;;;;;;EA1ErC,OAAA,GAAU,uBAAA;EAsG2B;;;;;;;;;;;;;;;EAtFrC,yBAAA;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAgCe,oBAAA,6BAAiD,OAAA;EA2ChE;EAAA,SAzCS,IAAA;EAyCe;EAAA,SAvCf,SAAA;EAwCP;EAAA,SAtCO,OAAA;EAuCoB;;;;;EAhC7B,OAAA,CACE,KAAA,EAAO,eAAA,EACP,OAAA,EAAS,0BAAA,CAA2B,MAAA,IACnC,OAAA,CAAQ,kBAAA,CAAmB,OAAA;EAqCvB;;;;;EA9BP,MAAA,CACE,KAAA,EAAO,eAAA,EACP,OAAA,EAAS,0BAAA,CAA2B,MAAA,IACnC,cAAA,CAAe,kBAAA,CAAmB,OAAA,GAAU,iBAAA;EA6BnB;;;;;EAtB5B,MAAA,CACE,SAAA,UACA,OAAA,GAAU,yBAAA,GACT,OAAA,CAAQ,kBAAA,CAAmB,OAAA;EA2BnB;;;;;EApBX,OAAA,iBAAwB,oBAAA,EACtB,IAAA,EAAM,CAAA,EACN,IAAA,EAAM,oBAAA,CAAqB,CAAA,YAC1B,OAAA,CAAQ,oBAAA,CAAqB,CAAA;EAyBvB;;;;;EAlBT,MAAA,sBACE,OAAA,EAAS,yBAAA,CAA0B,UAAA,IAClC,YAAA,CAAa,UAAA,EAAY,OAAA;EAiBU;;;;EAXtC,EAAA,WAAa,qBAAA,EACX,KAAA,EAAO,CAAA,EACP,OAAA,EAAS,wBAAA,CAAyB,CAAA;;;;;EAOpC,GAAA,WAAc,qBAAA,EACZ,KAAA,EAAO,CAAA,EACP,OAAA,EAAS,wBAAA,CAAyB,CAAA;AAAA"}

package/esm/contracts/supervisor/supervisor-config.type.d.mts

@@ -212,6 +212,29 @@ type SupervisorConfig<TOutput = unknown, TState = TOutput, TIntents extends Reco
    * with `MaxIterationsError` on `result.error`. Default: `10`.
    */
   maxIterations?: number;
+  /**
+   * Hard cap on fan-out WIDTH — how many intents a single dispatch
+   * decision may run in parallel. Default: `10`.
+   *
+   * Routing decisions arrive as `string[]` from an LLM `router`, a
+   * `route` callback, `evaluate.reassignTo`, or per-intent `next`
+   * directives. Duplicate names in that array are collapsed before
+   * dispatch (they were pure wasted spend — `indexByIntent` already
+   * kept only one result per intent); if the DEDUPED list is still
+   * longer than this cap, the decision is rejected with
+   * `SupervisorRoutingError` (`SUPERVISOR_INVALID_ROUTE`), the same
+   * way an unknown intent key is.
+   *
+   * Security note: the router's per-turn prompt embeds supervisor
+   * `state` and prior branch outputs, so a prompt injection carried
+   * in tool output can coax the router into emitting a very wide
+   * `next` array — one iteration then launches that many real
+   * agent/workflow runs (cost + compute amplification). This cap is
+   * the width bound that `maxIterations` (a depth bound) doesn't
+   * provide. Raise it deliberately when a supervisor legitimately
+   * fans out wide (e.g. `ai.fanOut(writer, 20)`).
+   */
+  maxFanOut?: number;
   /**
    * When set, turn 0 dispatches this intent directly and skips the
    * first router/route call. Must be a key in `intents`.

package/esm/contracts/supervisor/supervisor-config.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/supervisor/supervisor-config.type.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;AAqBA;;KAAY,sBAAA,iBAAuC,kBAAA,KACjD,OAAA,EAAS,kBAAA,CAAmB,CAAA;AAAA,KAGlB,uBAAA,GAA0B,OAAA,eACxB,kBAAA,GAAqB,sBAAA,CAAuB,CAAA;;;;;;;;;AAJ1B;AAGhC;;;;;;;;;;;;;;;AAC2D;AAyC3D;;;;;;;;;;;;;KAAY,gBAAA,6BAED,OAAA,mBACQ,MAAA,SAAe,qBAAA,IAAyB,MAAA,SAAe,qBAAA,gBAC3D,MAAA;EAiHJ,sEA9GT,IAAA;EA8GkC;;;;;;;;EApGlC,OAAA;EAiI6C;;;;;;;;EAvH7C,UAAA;EAuMM;;;;;;;;;;;EA1LN,WAAA,GAAc,gBAAA,CAAiB,eAAA;EAvC/B;;;;;EA8CA,YAAA,GAAe,oBAAA;EA5C0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmFzD,IAAA,YAAgB,oBAAA;EAmFhB;;;;;;;;;;;;;;;;;;;EA9DA,OAAA,GAAU,OAAA;EAiNQ;;;;;;;;EAvMlB,MAAA,GAAS,aAAA,YAAyB,WAAA,CAAY,MAAA;EA2PgB;;;;EArP9D,KAAA,IAAS,GAAA,EAAK,YAAA,CAAa,MAAA,MAAY,IAAA,GAAO,OAAA,CAAQ,IAAA;;;;;;;;;;;EAYtD,OAAA,EAAS,QAAA;;;;;;;;;;EAWT,QAAA,IAAY,GAAA,EAAK,eAAA,CAAgB,MAAA,MAAY,cAAA,GAAiB,OAAA,CAAQ,cAAA;;;;;;;;;;;;;;;;EAiBtE,KAAA,GAAQ,MAAA;;;;;EAMR,aAAA;;;;;EAMA,YAAA;;;;;;;;;;;EAYA,MAAA,GAAS,gBAAA,CAAiB,OAAA;;;;;;;;;;;;;EAc1B,aAAA,GAAgB,aAAA;;;;;;EAOhB,EAAA,GAAK,uBAAA;;;;;;;;;;;;;;;;;EAkBL,GAAA,GAAM,SAAA,CAAU,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwChB,UAAA,GAAa,gBAAA,CAAiB,MAAA;;;;;;;;;;;;;;;;;;;;;;EAsB9B,aAAA;IACE,MAAA;IACA,MAAA;IACA,GAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;EAyBF,eAAA,GAAkB,gBAAA,CAAiB,UAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BnC,UAAA,GAAa,eAAA;;;;;;;;;;;;;;;;;;;;;;;EAwBb,iBAAA,IAAqB,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,UAAA,KAAe,MAAA;;;;;;;;;;;;;;;;;;;EAoB9D,OAAA,GAAU,iBAAA;AAAA"}
+{"version":3,"file":"supervisor-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/supervisor/supervisor-config.type.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;AAqBA;;KAAY,sBAAA,iBAAuC,kBAAA,KACjD,OAAA,EAAS,kBAAA,CAAmB,CAAA;AAAA,KAGlB,uBAAA,GAA0B,OAAA,eACxB,kBAAA,GAAqB,sBAAA,CAAuB,CAAA;;;;;;;;;AAJ1B;AAGhC;;;;;;;;;;;;;;;AAC2D;AAyC3D;;;;;;;;;;;;;KAAY,gBAAA,6BAED,OAAA,mBACQ,MAAA,SAAe,qBAAA,IAAyB,MAAA,SAAe,qBAAA,gBAC3D,MAAA;EAiHJ,sEA9GT,IAAA;EA8GkC;;;;;;;;EApGlC,OAAA;EAiI6C;;;;;;;;EAvH7C,UAAA;EA+NM;;;;;;;;;;;EAlNN,WAAA,GAAc,gBAAA,CAAiB,eAAA;EAvC/B;;;;;EA8CA,YAAA,GAAe,oBAAA;EA5C0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmFzD,IAAA,YAAgB,oBAAA;EAmFhB;;;;;;;;;;;;;;;;;;;EA9DA,OAAA,GAAU,OAAA;EAyOV;;;;;;;;EA/NA,MAAA,GAAS,aAAA,YAAyB,WAAA,CAAY,MAAA;EAmRV;;;;EA7QpC,KAAA,IAAS,GAAA,EAAK,YAAA,CAAa,MAAA,MAAY,IAAA,GAAO,OAAA,CAAQ,IAAA;EAiS3B;;;;;;;;;;EArR3B,OAAA,EAAS,QAAA;;;;;;;;;;EAWT,QAAA,IAAY,GAAA,EAAK,eAAA,CAAgB,MAAA,MAAY,cAAA,GAAiB,OAAA,CAAQ,cAAA;;;;;;;;;;;;;;;;EAiBtE,KAAA,GAAQ,MAAA;;;;;EAMR,aAAA;;;;;;;;;;;;;;;;;;;;;;;EAwBA,SAAA;;;;;EAMA,YAAA;;;;;;;;;;;EAYA,MAAA,GAAS,gBAAA,CAAiB,OAAA;;;;;;;;;;;;;EAc1B,aAAA,GAAgB,aAAA;;;;;;EAOhB,EAAA,GAAK,uBAAA;;;;;;;;;;;;;;;;;EAkBL,GAAA,GAAM,SAAA,CAAU,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwChB,UAAA,GAAa,gBAAA,CAAiB,MAAA;;;;;;;;;;;;;;;;;;;;;;EAsB9B,aAAA;IACE,MAAA;IACA,MAAA;IACA,GAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;EAyBF,eAAA,GAAkB,gBAAA,CAAiB,UAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BnC,UAAA,GAAa,eAAA;;;;;;;;;;;;;;;;;;;;;;;EAwBb,iBAAA,IAAqB,KAAA,EAAO,MAAA,EAAQ,SAAA,EAAW,UAAA,KAAe,MAAA;;;;;;;;;;;;;;;;;;;EAoB9D,OAAA,GAAU,iBAAA;AAAA"}

package/esm/contracts/team/team-config.type.d.mts

@@ -3,6 +3,7 @@ import { FlowObserveOption } from "../../observe/resolve-observers.mjs";
 import { SnapshotStore } from "../orchestrator/snapshot-store.contract.mjs";
 import { WorkflowInstance } from "../workflow/workflow.contract.mjs";
 import { SystemPromptContract } from "../system-prompt.contract.mjs";
+import { IntentCallback } from "../supervisor/intent-entry.type.mjs";
 import { RouterEntry } from "../supervisor/router-entry.type.mjs";
 import { SupervisorConfig, SupervisorEventHandlers } from "../supervisor/supervisor-config.type.mjs";
 import { EvaluateContext, EvaluateResult } from "../supervisor/evaluate-context.type.mjs";
@@ -10,13 +11,15 @@ import { StandardSchemaV1 } from "@standard-schema/spec";
 
 //#region ../ai/src/contracts/team/team-config.type.d.ts
 /**
- * A role member — an agent or a workflow. The same shorthand the
- * supervisor accepts on each `intents` value, narrowed to the two
- * dispatchable unit shapes `team()` forwards verbatim. (Callback /
- * full-entry intent shapes still work when forwarded — this alias is
- * the documented, autocomplete-friendly subset for the common case.)
+ * A role member — an agent, a workflow, or an inline callback. Every
+ * `members` value is forwarded verbatim as a supervisor `intents`
+ * value, so the callback form dispatches exactly like a callback
+ * intent; it is listed here because the runtime has always accepted
+ * it. The richer `IntentEntry` / `IntentRunEntry` object forms are
+ * deliberately left out — `team()` names its roles by key, and the
+ * per-entry overrides belong to `supervisor()`.
  */
-type TeamMemberValue = AgentContract<unknown> | WorkflowInstance<unknown, unknown>;
+type TeamMemberValue = AgentContract<unknown> | WorkflowInstance<unknown, unknown> | IntentCallback;
 /**
  * The built-in quality-gate strategies. Each desugars to a concrete
  * {@link SupervisorConfig.evaluate} callback — no new loop or

package/esm/contracts/team/team-config.type.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"team-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/team/team-config.type.ts"],"mappings":";;;;;;;;;;;;;AAiBA;;;;AAEoB;KAFR,eAAA,GACR,aAAA,YACA,gBAAgB;;;;AAiBA;AASpB;;;;;;;;;;;KATY,QAAA;;;;;;;AAWgC;KAFhC,UAAA,YACV,GAAA,EAAK,eAAA,CAAgB,MAAA,MAClB,cAAA,GAAiB,OAAA,CAAQ,cAAA;;;;;;;;;;;;;;;;;;;;KAqBlB,UAAA,6BAED,OAAA,mBACQ,MAAA,SAAe,eAAA,IAAmB,MAAA,SAAe,eAAA;EA+CjD,yEA5CjB,IAAA,UA6D0B;EA1D1B,OAAA;EA6DQ;;;;;;;;EAnDR,OAAA,EACI,aAAA,YACA,WAAA,CAAY,MAAA;IACV,KAAA,EAAO,WAAA,CAAY,gBAAA,CAAiB,OAAA,EAAS,MAAA;EAAA;EAnBnB;;;;;;EA2BhC,OAAA,EAAS,QAAA;EATL;;;;;;EAiBJ,IAAA,EAAM,QAAA,GAAW,UAAA,CAAW,MAAA;EAR5B;;;;;;;EAiBA,KAAA;IACE,QAAA,SAAiB,QAAA;IACjB,KAAA,SAAc,QAAA;IACd,MAAA,SAAe,QAAA;EAAA;EAAA;;;;;;EASjB,OAAA,WAWA;EANA,IAAA,YAAgB,oBAAA,EAShB;EANA,MAAA,GAAS,gBAAA,CAAiB,OAAA,GASV;EANhB,KAAA,GAAQ,MAAA,EASH;EANL,aAAA,WAeU;EAZV,aAAA,GAAgB,aAAA,EAYW;EAT3B,EAAA,GAAK,uBAAA;;;;;;;;EASL,OAAA,GAAU,iBAAA;AAAA"}
+{"version":3,"file":"team-config.type.d.mts","names":[],"sources":["../../../../../../../../ai/src/contracts/team/team-config.type.ts"],"mappings":";;;;;;;;;;;;;;AAoBA;;;;;;;KAAY,eAAA,GACR,aAAA,YACA,gBAAA,qBACA,cAAA;;;;;AAAc;AAiBlB;;;;AAAoB;AASpB;;;;;KATY,QAAA;;;;;;;;KASA,UAAA,YACV,GAAA,EAAK,eAAA,CAAgB,MAAA,MAClB,cAAA,GAAiB,OAAA,CAAQ,cAAA;;;;;AAAc;AAqB5C;;;;;;;;;;;;;;KAAY,UAAA,6BAED,OAAA,mBACQ,MAAA,SAAe,eAAA,IAAmB,MAAA,SAAe,eAAA;EA2BzD,yEAxBT,IAAA,UAgC4B;EA7B5B,OAAA;EAuCmB;;;;;;;;EA7BnB,OAAA,EACI,aAAA,YACA,WAAA,CAAY,MAAA;IACV,KAAA,EAAO,WAAA,CAAY,gBAAA,CAAiB,OAAA,EAAS,MAAA;EAAA;EAkExB;;;;;;EA1D3B,OAAA,EAAS,QAAA;EA3B0C;;;;;;EAmCnD,IAAA,EAAM,QAAA,GAAW,UAAA,CAAW,MAAA;EAjBZ;;;;;;;EA0BhB,KAAA;IACE,QAAA,SAAiB,QAAA;IACjB,KAAA,SAAc,QAAA;IACd,MAAA,SAAe,QAAA;EAAA;EAHjB;;;;;;EAYA,OAAA;EAKA,IAAA,YAAgB,oBAAA,EAAA;EAGhB,MAAA,GAAS,gBAAA,CAAiB,OAAA,GAAjB;EAGT,KAAA,GAAQ,MAAA,EAAR;EAGA,aAAA;EAGA,aAAA,GAAgB,aAAA,EAAA;EAGhB,EAAA,GAAK,uBAAA;EAAA;;;;AASsB;;;EAA3B,OAAA,GAAU,iBAAA;AAAA"}

package/esm/contracts/tool.contract.d.mts

@@ -4,10 +4,18 @@ import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
  * Optional metadata attached to a tool for documentation and tooling.
  *
+ * Free-form: any key is accepted. `label` and `actionLabel` are named
+ * explicitly only so editors suggest them — both are optional, like
+ * every other key.
+ *
  * @example
  * const meta: ToolMeta = { category: "search", version: "1.0" };
  */
-type ToolMeta = Record<"label" | "actionLabel" | (string & {}), unknown>;
+type ToolMeta = {
+  /** Human-readable name for the tool in documentation and tooling UIs. */label?: unknown; /** Human-readable name for the action the tool performs. */
+  actionLabel?: unknown;
+  [key: string]: unknown;
+};
 /**
  * Discriminated mode controlling whether the tool's result feeds back
  * to the model.
@@ -43,6 +51,30 @@ type ToolMeta = Record<"label" | "actionLabel" | (string & {}), unknown>;
  * → terminate" rule only kicks in when EVERY tool call is silent.
  */
 type ToolMode = "feedback" | "silent";
+/**
+ * Callback form of {@link ToolConfig.action} — turns the model's
+ * arguments into a present-progressive UI string.
+ *
+ * Written as a method inside a wrapper object (then indexed back out)
+ * so TypeScript checks `input` **bivariantly** instead of
+ * contravariantly. That is deliberate, and it is what the runtime
+ * actually does: the dispatch boundary resolves the label from the
+ * model's *raw, pre-validation* arguments, so it hands the callback an
+ * `unknown` while the author declares the shape they expect. Under the
+ * default strict (contravariant) function check a
+ * `ToolContract<{ query: string }, …>` would not be assignable to
+ * `ToolContract<unknown, unknown>`, which is the type every
+ * heterogeneous tool list — `AgentConfig.tools`, supervisor tool
+ * registries — has to use.
+ *
+ * The bivariance is not free: `input` is whatever the model emitted,
+ * not a validated `TInput`. Resolution is wrapped in a try/catch at
+ * the boundary precisely because this callback can throw on malformed
+ * arguments; a throw costs the label, never the dispatch.
+ */
+type ToolActionResolver<TInput> = {
+  resolveAction(input: TInput): string;
+}["resolveAction"];
 /**
  * Per-call context threaded into a tool handler as the optional second
  * argument (Phase 5 / decisions §35).
@@ -130,7 +162,7 @@ interface ToolConfig<TInput = unknown, TOutput = unknown> {
    * Resolved at the framework boundary; consumers receive a
    * pre-resolved string in `ToolEventMeta.action`.
    */
-  action?: string | ((input: TInput) => string);
+  action?: string | ToolActionResolver<TInput>;
   /** Optional metadata for documentation or tooling */
   meta?: ToolMeta;
   /**
@@ -159,5 +191,5 @@ interface ToolConfig<TInput = unknown, TOutput = unknown> {
   execute(input: TInput, ctx?: ToolContext): Promise<TOutput>;
 }
 //#endregion
-export { ToolConfig, ToolContext, ToolMeta, ToolMode };
+export { ToolActionResolver, ToolConfig, ToolContext, ToolMeta, ToolMode };
 //# sourceMappingURL=tool.contract.d.mts.map

package/esm/contracts/tool.contract.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"tool.contract.d.mts","names":[],"sources":["../../../../../../../ai/src/contracts/tool.contract.ts"],"mappings":";;;;;AAQA;;;;KAAY,QAAA,GAAW,MAAM;AAoC7B;;;;AAAoB;AAmCpB;;;;;;;;;;;;;;;AASsB;AAiBtB;;;;;;;;;;;;;AA7DA,KAAY,QAAA;;;;;;;;;;;;;;;;;;;;;;;;AAqHgD;;;;;;;;;;KAlFhD,WAAA,cAAyB,MAAA;;;;;;;EAOnC,SAAA,EAAW,UAAA;EAEX,MAAA,GAAS,WAAA;AAAA;;;;;;;;;;;;;;;UAiBM,UAAA;;EAEf,IAAA;;EAEA,WAAA;;;;;;;;EAQA,OAAA;;;;;;;;;;;;;;;;;;EAkBA,MAAA,cAAoB,KAAA,EAAO,MAAA;;EAE3B,IAAA,GAAO,QAAA;;;;;;;EAOP,IAAA,GAAO,QAAA;;;;;;EAMP,KAAA,GAAQ,gBAAA,CAAiB,MAAA;;;;;;;;;;;EAWzB,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,GAAA,GAAM,WAAA,GAAc,OAAA,CAAQ,OAAA;AAAA"}
+{"version":3,"file":"tool.contract.d.mts","names":[],"sources":["../../../../../../../ai/src/contracts/tool.contract.ts"],"mappings":";;;;;AAYA;;;;;;;;KAAY,QAAA;EA0CA,yEAxCV,KAAA;EAEA,WAAA;EAAA,CACC,GAAA;AAAA;;;;;;;;;AA6D0B;AAoC7B;;;;;;;;;;;;;;;AASsB;AAiBtB;;;;;;;;;KAtFY,QAAA;;;;;;;;;;;;;;;;;;;;;;KAuBA,kBAAA;EACV,aAAA,CAAc,KAAA,EAAO,MAAM;AAAA;;;;;AAsH+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAlFhD,WAAA,cAAyB,MAAA;;;;;;;EAOnC,SAAA,EAAW,UAAA;EAEX,MAAA,GAAS,WAAA;AAAA;;;;;;;;;;;;;;;UAiBM,UAAA;;EAEf,IAAA;;EAEA,WAAA;;;;;;;;EAQA,OAAA;;;;;;;;;;;;;;;;;;EAkBA,MAAA,YAAkB,kBAAA,CAAmB,MAAA;;EAErC,IAAA,GAAO,QAAA;;;;;;;EAOP,IAAA,GAAO,QAAA;;;;;;EAMP,KAAA,GAAQ,gBAAA,CAAiB,MAAA;;;;;;;;;;;EAWzB,OAAA,CAAQ,KAAA,EAAO,MAAA,EAAQ,GAAA,GAAM,WAAA,GAAc,OAAA,CAAQ,OAAA;AAAA"}