@wildo-ai/external-connectors-models 1.1.2 → 1.1.3

package/dist/esm/protocols/a2a.external-connectors-models.schemas.js

@@ -1,73 +0,0 @@
-import { z } from "zod";
-import { ExternalProvider_Auth_Kind } from "../core/security.external-connectors-models.schemas.js";
-import { ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Status_BaseSchema } from "../core/commons.external-connectors-models.schemas.js";
-//===============================================================
-// A2A (Agent-to-Agent) Protocol
-// --------
-// Protocol for agent-to-agent communication enabling autonomous
-// collaboration between AI agents. Supports discovery, negotiation,
-// delegation, and coordination patterns with security and trust.
-//===============================================================
-export var A2A_CapabilityType;
-(function (A2A_CapabilityType) {
-    A2A_CapabilityType["TASK_EXECUTION"] = "task_execution";
-    A2A_CapabilityType["INFORMATION_RETRIEVAL"] = "information_retrieval";
-    A2A_CapabilityType["DECISION_MAKING"] = "decision_making";
-    A2A_CapabilityType["PLANNING"] = "planning";
-    A2A_CapabilityType["MONITORING"] = "monitoring";
-    A2A_CapabilityType["COORDINATION"] = "coordination";
-})(A2A_CapabilityType || (A2A_CapabilityType = {}));
-export const A2A_AgentRefSchema = z.object({
-    providerRef: z.string(),
-    agentRef: z.string(),
-});
-export const A2A_AgentCapabilitySchema = z.object({
-    type: z.enum(A2A_CapabilityType),
-    name: z.string(),
-    description: z.string(),
-    parameters: z.record(z.string(), z.unknown()).optional(),
-    cost: z.number().optional(),
-    estimatedDuration: z.number().optional(),
-    qualityMetrics: z.record(z.string(), z.number()).optional(),
-});
-export const A2A_Agent_AuthKind = [
-    ExternalProvider_Auth_Kind.NONE,
-    ExternalProvider_Auth_Kind.API_KEY,
-    ExternalProvider_Auth_Kind.BEARER,
-    ExternalProvider_Auth_Kind.BASIC,
-    ExternalProvider_Auth_Kind.OAUTH2,
-    ExternalProvider_Auth_Kind.MUTUAL_TLS
-];
-// ------------------------------------------------------------
-// OPERATIONS
-// ------------------------------------------------------------
-export var A2A_OperationKind;
-(function (A2A_OperationKind) {
-    A2A_OperationKind["MESSAGE"] = "message";
-    A2A_OperationKind["DELEGATION"] = "delegation";
-    A2A_OperationKind["NEGOTIATION"] = "negotiation";
-})(A2A_OperationKind || (A2A_OperationKind = {}));
-export var A2A_MessageKind;
-(function (A2A_MessageKind) {
-    A2A_MessageKind["REQUEST"] = "request";
-    A2A_MessageKind["RESPONSE"] = "response";
-    A2A_MessageKind["INFORMATION"] = "information";
-    A2A_MessageKind["COORDINATION"] = "coordination";
-    A2A_MessageKind["ERROR"] = "error";
-})(A2A_MessageKind || (A2A_MessageKind = {}));
-export var A2A_Delegation_Status;
-(function (A2A_Delegation_Status) {
-    A2A_Delegation_Status["PENDING"] = "pending";
-    A2A_Delegation_Status["ACCEPTED"] = "accepted";
-    A2A_Delegation_Status["REJECTED"] = "rejected";
-    A2A_Delegation_Status["IN_PROGRESS"] = "in_progress";
-    A2A_Delegation_Status["COMPLETED"] = "completed";
-    A2A_Delegation_Status["FAILED"] = "failed";
-})(A2A_Delegation_Status || (A2A_Delegation_Status = {}));
-//===============================================================
-// STATUS
-//===============================================================
-export const A2AProvider_StatusSchema = ExternalProvider_ExchangeProtocol_Status_BaseSchema.extend({
-    protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.A2A_CONNECTOR),
-});
-//# sourceMappingURL=a2a.external-connectors-models.schemas.js.map

package/dist/esm/protocols/a2a.external-connectors-models.schemas.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"a2a.external-connectors-models.schemas.js","sourceRoot":"","sources":["../../../../src/protocols/a2a.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,qDAAqD,CAAC;AACjG,OAAO,EAAwD,sCAAsC,EAAiG,mDAAmD,EAAE,MAAM,oDAAoD,CAAC;AAEtT,iEAAiE;AACjE,gCAAgC;AAChC,WAAW;AACX,gEAAgE;AAChE,oEAAoE;AACpE,iEAAiE;AACjE,iEAAiE;AAGjE,MAAM,CAAN,IAAY,kBAOX;AAPD,WAAY,kBAAkB;IAC5B,uDAAiC,CAAA;IACjC,qEAA+C,CAAA;IAC/C,yDAAmC,CAAA;IACnC,2CAAqB,CAAA;IACrB,+CAAyB,CAAA;IACzB,mDAA6B,CAAA;AAC/B,CAAC,EAPW,kBAAkB,KAAlB,kBAAkB,QAO7B;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,kBAAkB,GAA0C;IACvE,0BAA0B,CAAC,IAAI;IAC/B,0BAA0B,CAAC,OAAO;IAClC,0BAA0B,CAAC,MAAM;IACjC,0BAA0B,CAAC,KAAK;IAChC,0BAA0B,CAAC,MAAM;IACjC,0BAA0B,CAAC,UAAU;CACtC,CAAC;AAOF,+DAA+D;AAC/D,aAAa;AACb,+DAA+D;AAI/D,MAAM,CAAN,IAAY,iBAKX;AALD,WAAY,iBAAiB;IAC3B,wCAAmB,CAAA;IACnB,8CAAyB,CAAA;IACzB,gDAA2B,CAAA;AAE7B,CAAC,EALW,iBAAiB,KAAjB,iBAAiB,QAK5B;AACD,MAAM,CAAN,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,wCAAqB,CAAA;IACrB,8CAA2B,CAAA;IAC3B,gDAA6B,CAAA;IAC7B,kCAAe,CAAA;AACjB,CAAC,EANW,eAAe,KAAf,eAAe,QAM1B;AAID,MAAM,CAAN,IAAY,qBAOX;AAPD,WAAY,qBAAqB;IAC/B,4CAAmB,CAAA;IACnB,8CAAqB,CAAA;IACrB,8CAAqB,CAAA;IACrB,oDAA2B,CAAA;IAC3B,gDAAuB,CAAA;IACvB,0CAAiB,CAAA;AACnB,CAAC,EAPW,qBAAqB,KAArB,qBAAqB,QAOhC;AAGD,iEAAiE;AACjE,SAAS;AACT,iEAAiE;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,mDAAmD,CAAC,MAAM,CAAC;IACjG,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,aAAa,CAAC;CAC9E,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { ExternalProvider_Auth_Kind } from \"../core/security.external-connectors-models.schemas\";\nimport { ExternalProvider_ExchangeProtocol_Configuration_Base, ExternalProvider_ExchangeProtocol_Kind, ExternalProvider_ExchangeProtocol_Profile_Base, ExternalProvider_ExchangeProtocol_Status_Base, ExternalProvider_ExchangeProtocol_Status_BaseSchema } from \"../core/commons.external-connectors-models.schemas\";\n\n//===============================================================\n// A2A (Agent-to-Agent) Protocol\n// --------\n// Protocol for agent-to-agent communication enabling autonomous\n// collaboration between AI agents. Supports discovery, negotiation,\n// delegation, and coordination patterns with security and trust.\n//===============================================================\n\n\nexport enum A2A_CapabilityType {\n  TASK_EXECUTION = \"task_execution\",\n  INFORMATION_RETRIEVAL = \"information_retrieval\",\n  DECISION_MAKING = \"decision_making\",\n  PLANNING = \"planning\",\n  MONITORING = \"monitoring\",\n  COORDINATION = \"coordination\",\n}\n\nexport const A2A_AgentRefSchema = z.object({\n  providerRef: z.string(),\n  agentRef: z.string(),\n});\n\nexport const A2A_AgentCapabilitySchema = z.object({\n  type: z.enum(A2A_CapabilityType),\n  name: z.string(),\n  description: z.string(),\n  parameters: z.record(z.string(), z.unknown()).optional(),\n  cost: z.number().optional(),\n  estimatedDuration: z.number().optional(),\n  qualityMetrics: z.record(z.string(), z.number()).optional(),\n});\n\nexport type A2A_AgentRef = z.infer<typeof A2A_AgentRefSchema>;\nexport type A2A_AgentCapability = z.infer<typeof A2A_AgentCapabilitySchema>;\n\nexport const A2A_Agent_AuthKind: readonly ExternalProvider_Auth_Kind[] = [ \n  ExternalProvider_Auth_Kind.NONE, \n  ExternalProvider_Auth_Kind.API_KEY, \n  ExternalProvider_Auth_Kind.BEARER, \n  ExternalProvider_Auth_Kind.BASIC, \n  ExternalProvider_Auth_Kind.OAUTH2, \n  ExternalProvider_Auth_Kind.MUTUAL_TLS \n];\n\n\nexport type A2A_AgentProfile =  ExternalProvider_ExchangeProtocol_Profile_Base;\n\nexport type A2A_Configuration = ExternalProvider_ExchangeProtocol_Configuration_Base;\n\n// ------------------------------------------------------------\n// OPERATIONS\n// ------------------------------------------------------------\n\n\n\nexport enum A2A_OperationKind {\n  MESSAGE = \"message\",\n  DELEGATION = \"delegation\",\n  NEGOTIATION = \"negotiation\",\n \n}\nexport enum A2A_MessageKind {\n  REQUEST = \"request\",\n  RESPONSE = \"response\",\n  INFORMATION = \"information\",\n  COORDINATION = \"coordination\",\n  ERROR = \"error\",\n}\n\n\n\nexport enum A2A_Delegation_Status {\n  PENDING = \"pending\",\n  ACCEPTED = \"accepted\",\n  REJECTED = \"rejected\",\n  IN_PROGRESS = \"in_progress\",\n  COMPLETED = \"completed\",\n  FAILED = \"failed\",\n}\n\n\n//===============================================================\n// STATUS\n//===============================================================\n\nexport const A2AProvider_StatusSchema = ExternalProvider_ExchangeProtocol_Status_BaseSchema.extend({\n  protocolKind: z.literal(ExternalProvider_ExchangeProtocol_Kind.A2A_CONNECTOR),\n});\nexport type A2AProvider_Status = z.infer<typeof A2AProvider_StatusSchema>;\n"]}

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.d.ts

@@ -63,10 +63,19 @@ export declare enum AgentClientProtocol_WorkingDirectoryPolicy {
  * what lets an application say "no session started from this profile may ever
  * skip the permission gate" independently of what any individual run requests.
  *
- * Ordering is meaningful and increasing: PROMPT_ALWAYS < AUTO_ACCEPT_EDITS <
+ * Ordering is meaningful and increasing over all FIVE members: PROMPT_ALWAYS <
+ * AUTO_ACCEPT_READS < AUTO_ACCEPT_EDITS < AUTO_ACCEPT_READS_AND_EDITS <
  * UNRESTRICTED. Compare through {@link agentClientProtocolPermissionCeilingRank}
  * rather than by string, so the ordering has one definition.
+ *
+ * Read that order as a CLAMP — how much is pre-approved without a human — and never
+ * as containment. The ceilings are kind-SETS and are deliberately not nested:
+ * AUTO_ACCEPT_EDITS outranks AUTO_ACCEPT_READS and still refuses `fetch`, which is
+ * exactly why AUTO_ACCEPT_READS_AND_EDITS had to be added rather than being implied
+ * by the higher rank. Each member's own docstring states the set it admits, and the
+ * rank function carries the full argument for why containment is the wrong reading.
  */
+/** @wildo_source:part:start acp.permission-ceiling facet:layer:config facet:audience:app-developer */
 export declare enum AgentClientProtocol_PermissionCeiling {
     /**
      * Every permission request the agent raises must be answered by the client.
@@ -134,6 +143,7 @@ export declare enum AgentClientProtocol_PermissionCeiling {
     /** No permission gate. Reserve for a disposable or isolated workspace. */
     UNRESTRICTED = "unrestricted"
 }
+/** @wildo_source:part:end acp.permission-ceiling */
 /**
  * Increasing rank for {@link AgentClientProtocol_PermissionCeiling}; the single ordering definition.
  *
@@ -154,6 +164,95 @@ export declare enum AgentClientProtocol_PermissionCeiling {
  * the read direction should mean.
  */
 export declare function agentClientProtocolPermissionCeilingRank(ceiling: AgentClientProtocol_PermissionCeiling): number;
+/**
+ * Whether THIS agent raises `session/request_permission` before it mutates —
+ * the one property that decides whether Wildo's in-flight guards can fire at all.
+ *
+ * # Why a permission ceiling needs this to mean anything
+ *
+ * Both of Wildo's in-flight controls are enforced in the CLIENT's ANSWER to a
+ * permission request: {@link AgentClientProtocol_PermissionCeiling} decides the
+ * tool KIND, and the dispatch's location predicate decides the PATHS. Neither is
+ * a sandbox, an interposed filesystem, or a syscall filter — they are answers.
+ * So an agent that writes without asking is bound by neither, and the ceiling
+ * an application authored is a LABEL rather than a guarantee.
+ *
+ * That is not hypothetical and it is not a fault in the agents. MEASURED with
+ * `wildo acp probe`:
+ *
+ *   - Codex (`@agentclientprotocol/codex-acp`, 2026-09-06) raises nothing before
+ *     an in-workspace write in ANY of its three modes, including with an explicit
+ *     `approval_policy = "untrusted"`. Its safety model is a SANDBOX, so an
+ *     in-workspace write is safe by ITS construction and there is nothing to ask
+ *     about. A different architecture, not a defect.
+ *   - OpenCode (1.18.27, 2026-09-04/05) does the same under its DEFAULT
+ *     configuration, and escalates correctly when pointed at a permission
+ *     configuration file. So for that agent the answer is conditional on
+ *     something the HOST supplies.
+ *   - Claude's adapter (`@agentclientprotocol/claude-agent-acp` 0.73.0) raises,
+ *     and both guards fire.
+ *
+ * # Why it is DECLARED rather than inferred, and why it is required
+ *
+ * It cannot be inferred before a run: an agent that never asks and an agent that
+ * had nothing to ask about are indistinguishable from an empty decision list, and
+ * by the time the list is empty the workspace has already been mutated. The
+ * post-run change set remains the authoritative account of what a run touched —
+ * this declaration is what lets the framework say, BEFORE the run, whether that
+ * change set is the only account there will be.
+ *
+ * The provider declares it because the provider is the party that ran the probe.
+ * It is REQUIRED on the runtime contract for the same reason `modelDelivery` is:
+ * this lane has now shipped three safety-relevant fields that were authored,
+ * documented and read by nothing (`hostConfigurationInheritance`, the model
+ * channel, the provider's inherited environment). An author who cannot ship the
+ * gap is better than one who discovers it on a dispatched run.
+ *
+ * It is a CLAIM, never an alibi. The companion still judges each completed run
+ * from that run's OWN permission decisions and change set, so an agent whose
+ * behaviour changes between versions cannot keep a stale, reassuring declaration.
+ */
+/** @wildo_source:part:start acp.permission-escalation facet:layer:config facet:audience:app-developer */
+export declare enum AgentClientProtocol_PermissionEscalationBehaviour {
+    /**
+     * The agent escalates before mutating, so the ceiling and the mutation scope
+     * are both enforceable in flight. The only value under which a ceiling
+     * narrower than UNRESTRICTED means what it says.
+     */
+    RAISES_BEFORE_MUTATION = "raises_before_mutation",
+    /**
+     * The agent escalates ONLY when the host points it at a permission
+     * configuration it does not adopt by default.
+     *
+     * The configuration is therefore not hardening — it is the condition under
+     * which the agent may be dispatched with a gate at all, and the variable that
+     * carries the pointer is named on the contract so the dispatch can CHECK that
+     * a profile supplies it instead of trusting a docstring that says it must.
+     */
+    RAISES_ONLY_UNDER_HOST_CONFIGURATION = "raises_only_under_host_configuration",
+    /**
+     * The agent never escalates before mutating, under any configuration this
+     * framework can supply. Its own safety model is elsewhere (a sandbox), and
+     * Wildo's in-flight guards are inert for it by construction — the post-run
+     * change set is the only account of what it touched.
+     */
+    NEVER_RAISES = "never_raises"
+}
+/** @wildo_source:part:end acp.permission-escalation */
+/**
+ * Can Wildo's in-flight permission ceiling and mutation-scope predicate fire for
+ * this agent, as it will actually be started?
+ *
+ * The single definition of that question, so the dispatch's refusal, the run's
+ * recorded metadata and any operator-facing report cannot disagree about it.
+ *
+ * `escalationConfigurationSupplied` answers only the conditional member: it is
+ * whether the composed child environment will actually carry the pointer the
+ * contract names. Deliberately a parameter rather than something this function
+ * reads, because the environment is composed by the dispatch and a predicate
+ * that guessed at it would be a second, quieter answer.
+ */
+export declare function agentClientProtocolInFlightGuardsCanFire(behaviour: AgentClientProtocol_PermissionEscalationBehaviour, escalationConfigurationSupplied: boolean): boolean;
 /**
  * How much of the HOST MACHINE's agent configuration a session inherits.
  *
@@ -170,6 +269,7 @@ export declare function agentClientProtocolPermissionCeilingRank(ceiling: AgentC
  * application teaches the agent to use its framework. What it should not
  * silently absorb is whoever happens to be logged in.
  */
+/** @wildo_source:part:start acp.host-configuration-inheritance facet:layer:config facet:audience:app-developer */
 export declare enum AgentClientProtocol_HostConfigurationInheritance {
     /** No filesystem-sourced agent configuration. The prompt is the whole instruction. */
     ISOLATED = "isolated",
@@ -187,12 +287,14 @@ export declare enum AgentClientProtocol_HostConfigurationInheritance {
      */
     HOST_INHERITED = "host_inherited"
 }
+/** @wildo_source:part:end acp.host-configuration-inheritance */
 /**
  * One authored way to start an ACP agent.
  *
  * Mirrors the shape a provider's execution profiles have always had: the
  * spawnable command plus the policy that decides whether it may run at all.
  */
+/** @wildo_source:part:start acp.execution-profile facet:layer:config facet:audience:app-developer */
 export declare const AgentClientProtocol_ExecutionProfileSchema: z.ZodObject<{
     runnerHost: z.ZodDefault<z.ZodEnum<typeof AgentClientProtocol_RunnerHost>>;
     command: z.ZodOptional<z.ZodString>;
@@ -214,6 +316,7 @@ export declare const AgentClientProtocol_ExecutionProfileSchema: z.ZodObject<{
     sessionMetaExtensions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strict>;
 export type AgentClientProtocol_ExecutionProfile = z.infer<typeof AgentClientProtocol_ExecutionProfileSchema>;
+/** @wildo_source:part:end acp.execution-profile */
 /**
  * Transport capability metadata for an ACP-speaking provider.
  *
@@ -290,10 +393,10 @@ export declare const AgentClientProtocol_ProfileSchema: z.ZodObject<{
         extraAuthParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         extraTokenParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         tokenFormat: z.ZodDefault<z.ZodEnum<{
-            token: "token";
+            custom: "custom";
             bearer: "bearer";
+            token: "token";
             oauth: "oauth";
-            custom: "custom";
         }>>;
         customTokenPrefix: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodObject<{
@@ -548,6 +651,8 @@ export declare const AgentClientProtocol_ExecutionTransportMetadataSchema: z.Zod
     agentName: z.ZodOptional<z.ZodString>;
     agentVersion: z.ZodOptional<z.ZodString>;
     sessionModeId: z.ZodOptional<z.ZodString>;
+    permissionEscalation: z.ZodOptional<z.ZodEnum<typeof AgentClientProtocol_PermissionEscalationBehaviour>>;
+    inFlightPermissionGuardsCanFire: z.ZodOptional<z.ZodBoolean>;
     sessionId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type AgentClientProtocol_ExecutionTransportMetadata = z.infer<typeof AgentClientProtocol_ExecutionTransportMetadataSchema>;
@@ -579,6 +684,8 @@ export declare const CodingAgent_OperationContext_BaseSchema: z.ZodObject<{
         agentName: z.ZodOptional<z.ZodString>;
         agentVersion: z.ZodOptional<z.ZodString>;
         sessionModeId: z.ZodOptional<z.ZodString>;
+        permissionEscalation: z.ZodOptional<z.ZodEnum<typeof AgentClientProtocol_PermissionEscalationBehaviour>>;
+        inFlightPermissionGuardsCanFire: z.ZodOptional<z.ZodBoolean>;
         sessionId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>;

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACtC,8CAA8C,EAG/C,MAAM,oDAAoD,CAAC;AAoC5D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D,0EAA0E;IAC1E,YAAY,iBAAiB;CAC9B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AAED;;;;;;;;;;;;;;;GAeG;AACH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;kBA6KrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAE9G;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkC5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE7I,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAE/J,eAAO,MAAM,gCAAgC;;;;;;;;iBAa3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAa1F,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;IAC/C,6DAA6D;;;IAG7D;;;OAGG;;kBAEH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;IAC9C,iDAAiD;;IAEjD,gEAAgE;;IAEhE,6CAA6C;;IAE7C;;;;;OAKG;;IAEH,oEAAoE;;kBAEpE,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;iBAqB/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;QAvL1C,6DAA6D;;;QAG7D;;;WAGG;;;;QAgBH,iDAAiD;;QAEjD,gEAAgE;;QAEhE,6CAA6C;;QAE7C;;;;;WAKG;;QAEH,oEAAoE;;;iBAsNpE,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}
+{"version":3,"file":"agent-client-protocol.external-connectors-models.schemas.d.ts","sourceRoot":"","sources":["../../../../src/protocols/agent-client-protocol.external-connectors-models.schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAEL,yCAAyC,EAC1C,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EACL,uBAAuB,EACvB,oDAAoD,EAEpD,sCAAsC,EACtC,8CAA8C,EAG/C,MAAM,oDAAoD,CAAC;AAoC5D;;;;;;;;GAQG;AACH,oBAAY,8BAA8B;IACxC,kBAAkB,uBAAuB;CAC1C;AAED;;;;;;;;GAQG;AACH,oBAAY,4BAA4B;IACtC,oFAAoF;IACpF,IAAI,SAAS;IACb;;;;;OAKG;IACH,YAAY,iBAAiB;IAC7B,gFAAgF;IAChF,wBAAwB,6BAA6B;CACtD;AAED;;;;;;;GAOG;AACH,oBAAY,0CAA0C;IACpD,cAAc,mBAAmB;IACjC,uBAAuB,4BAA4B;CACpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,sGAAsG;AACtG,oBAAY,qCAAqC;IAC/C;;;;;;;;;;OAUG;IACH,aAAa,kBAAkB;IAC/B;;;;;;;;;;;;;;;OAeG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,sBAAsB;IACvC;;;;;;;;;;;;;;;;OAgBG;IACH,2BAA2B,gCAAgC;IAC3D,0EAA0E;IAC1E,YAAY,iBAAiB;CAC9B;AACD,oDAAoD;AAEpD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wCAAwC,CACtD,OAAO,EAAE,qCAAqC,GAC7C,MAAM,CAaR;AACD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,yGAAyG;AACzG,oBAAY,iDAAiD;IAC3D;;;;OAIG;IACH,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,oCAAoC,yCAAyC;IAC7E;;;;;OAKG;IACH,YAAY,iBAAiB;CAC9B;AACD,uDAAuD;AAEvD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,iDAAiD,EAC5D,+BAA+B,EAAE,OAAO,GACvC,OAAO,CAST;AAED;;;;;;;;;;;;;;;GAeG;AACH,kHAAkH;AAClH,oBAAY,gDAAgD;IAC1D,sFAAsF;IACtF,QAAQ,aAAa;IACrB;;;;OAIG;IACH,kBAAkB,uBAAuB;IACzC;;;;;OAKG;IACH,cAAc,mBAAmB;CAClC;AACD,gEAAgE;AAEhE;;;;;GAKG;AACH,qGAAqG;AACrG,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;kBA6KrD,CAAC;AACH,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAC9G,mDAAmD;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkC5C,CAAC;AACH,MAAM,MAAM,2BAA2B,GAAG,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAE7I,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAWlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,oDAAoD,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAE/J,eAAO,MAAM,gCAAgC;;;;;;;;iBAa3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAa1F,oBAAY,wBAAwB;IAClC,iFAAiF;IACjF,eAAe,yBAAyB;CACzC;AAED;;;;;;;;;GASG;AACH,oBAAY,sBAAsB;IAChC,4CAA4C;IAC5C,QAAQ,aAAa;IACrB,qDAAqD;IACrD,UAAU,eAAe;IACzB,6DAA6D;IAC7D,iBAAiB,sBAAsB;IACvC,mCAAmC;IACnC,OAAO,YAAY;IACnB,oEAAoE;IACpE,SAAS,cAAc;IACvB;;;;;;;;;OASG;IACH,YAAY,uBAAuB;CACpC;AAED;;;;;;;;;GASG;AACH,oBAAY,mCAAmC;IAC7C,+DAA+D;IAC/D,aAAa,kBAAkB;IAC/B;;;;;OAKG;IACH,UAAU,eAAe;IACzB;;;;OAIG;IACH,WAAW,gBAAgB;IAC3B;;;;;OAKG;IACH,sBAAsB,2BAA2B;CAClD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC;IAC/C,6DAA6D;;;IAG7D;;;OAGG;;kBAEH,CAAC;AACH,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;AAElG;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC;IAC9C,iDAAiD;;IAEjD,gEAAgE;;IAEhE,6CAA6C;;IAE7C;;;;;OAKG;;IAEH,oEAAoE;;kBAEpE,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;iBAwBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,eAAO,MAAM,oDAAoD;;;;;;;;;;;;iBA+C/D,CAAC;AACH,MAAM,MAAM,8CAA8C,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;AAElI,eAAO,MAAM,uCAAuC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlD,CAAC;AACH,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uCAAuC,CAAC,CAAC;AAExG,MAAM,MAAM,mCAAmC,GAAG,yCAAyC,GAAG;IAC5F,sBAAsB,EAAE,OAAO,uCAAuC,CAAC;IACvE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B,CAAC;AAMF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,8CAA8C;;;iBAGzD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8CAA8C,CAAC,CAAC;AAErH,eAAO,MAAM,8BAA8B;;;;iBA4BzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;QAjN1C,6DAA6D;;;QAG7D;;;WAGG;;;;QAgBH,iDAAiD;;QAEjD,gEAAgE;;QAEhE,6CAA6C;;QAE7C;;;;;WAKG;;QAEH,oEAAoE;;;iBAgPpE,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/esm/protocols/agent-client-protocol.external-connectors-models.schemas.js

@@ -99,10 +99,19 @@ export var AgentClientProtocol_WorkingDirectoryPolicy;
  * what lets an application say "no session started from this profile may ever
  * skip the permission gate" independently of what any individual run requests.
  *
- * Ordering is meaningful and increasing: PROMPT_ALWAYS < AUTO_ACCEPT_EDITS <
+ * Ordering is meaningful and increasing over all FIVE members: PROMPT_ALWAYS <
+ * AUTO_ACCEPT_READS < AUTO_ACCEPT_EDITS < AUTO_ACCEPT_READS_AND_EDITS <
  * UNRESTRICTED. Compare through {@link agentClientProtocolPermissionCeilingRank}
  * rather than by string, so the ordering has one definition.
+ *
+ * Read that order as a CLAMP — how much is pre-approved without a human — and never
+ * as containment. The ceilings are kind-SETS and are deliberately not nested:
+ * AUTO_ACCEPT_EDITS outranks AUTO_ACCEPT_READS and still refuses `fetch`, which is
+ * exactly why AUTO_ACCEPT_READS_AND_EDITS had to be added rather than being implied
+ * by the higher rank. Each member's own docstring states the set it admits, and the
+ * rank function carries the full argument for why containment is the wrong reading.
  */
+/** @wildo_source:part:start acp.permission-ceiling facet:layer:config facet:audience:app-developer */
 export var AgentClientProtocol_PermissionCeiling;
 (function (AgentClientProtocol_PermissionCeiling) {
     /**
@@ -171,6 +180,7 @@ export var AgentClientProtocol_PermissionCeiling;
     /** No permission gate. Reserve for a disposable or isolated workspace. */
     AgentClientProtocol_PermissionCeiling["UNRESTRICTED"] = "unrestricted";
 })(AgentClientProtocol_PermissionCeiling || (AgentClientProtocol_PermissionCeiling = {}));
+/** @wildo_source:part:end acp.permission-ceiling */
 /**
  * Increasing rank for {@link AgentClientProtocol_PermissionCeiling}; the single ordering definition.
  *
@@ -204,6 +214,105 @@ export function agentClientProtocolPermissionCeilingRank(ceiling) {
             return 4;
     }
 }
+/**
+ * Whether THIS agent raises `session/request_permission` before it mutates —
+ * the one property that decides whether Wildo's in-flight guards can fire at all.
+ *
+ * # Why a permission ceiling needs this to mean anything
+ *
+ * Both of Wildo's in-flight controls are enforced in the CLIENT's ANSWER to a
+ * permission request: {@link AgentClientProtocol_PermissionCeiling} decides the
+ * tool KIND, and the dispatch's location predicate decides the PATHS. Neither is
+ * a sandbox, an interposed filesystem, or a syscall filter — they are answers.
+ * So an agent that writes without asking is bound by neither, and the ceiling
+ * an application authored is a LABEL rather than a guarantee.
+ *
+ * That is not hypothetical and it is not a fault in the agents. MEASURED with
+ * `wildo acp probe`:
+ *
+ *   - Codex (`@agentclientprotocol/codex-acp`, 2026-09-06) raises nothing before
+ *     an in-workspace write in ANY of its three modes, including with an explicit
+ *     `approval_policy = "untrusted"`. Its safety model is a SANDBOX, so an
+ *     in-workspace write is safe by ITS construction and there is nothing to ask
+ *     about. A different architecture, not a defect.
+ *   - OpenCode (1.18.27, 2026-09-04/05) does the same under its DEFAULT
+ *     configuration, and escalates correctly when pointed at a permission
+ *     configuration file. So for that agent the answer is conditional on
+ *     something the HOST supplies.
+ *   - Claude's adapter (`@agentclientprotocol/claude-agent-acp` 0.73.0) raises,
+ *     and both guards fire.
+ *
+ * # Why it is DECLARED rather than inferred, and why it is required
+ *
+ * It cannot be inferred before a run: an agent that never asks and an agent that
+ * had nothing to ask about are indistinguishable from an empty decision list, and
+ * by the time the list is empty the workspace has already been mutated. The
+ * post-run change set remains the authoritative account of what a run touched —
+ * this declaration is what lets the framework say, BEFORE the run, whether that
+ * change set is the only account there will be.
+ *
+ * The provider declares it because the provider is the party that ran the probe.
+ * It is REQUIRED on the runtime contract for the same reason `modelDelivery` is:
+ * this lane has now shipped three safety-relevant fields that were authored,
+ * documented and read by nothing (`hostConfigurationInheritance`, the model
+ * channel, the provider's inherited environment). An author who cannot ship the
+ * gap is better than one who discovers it on a dispatched run.
+ *
+ * It is a CLAIM, never an alibi. The companion still judges each completed run
+ * from that run's OWN permission decisions and change set, so an agent whose
+ * behaviour changes between versions cannot keep a stale, reassuring declaration.
+ */
+/** @wildo_source:part:start acp.permission-escalation facet:layer:config facet:audience:app-developer */
+export var AgentClientProtocol_PermissionEscalationBehaviour;
+(function (AgentClientProtocol_PermissionEscalationBehaviour) {
+    /**
+     * The agent escalates before mutating, so the ceiling and the mutation scope
+     * are both enforceable in flight. The only value under which a ceiling
+     * narrower than UNRESTRICTED means what it says.
+     */
+    AgentClientProtocol_PermissionEscalationBehaviour["RAISES_BEFORE_MUTATION"] = "raises_before_mutation";
+    /**
+     * The agent escalates ONLY when the host points it at a permission
+     * configuration it does not adopt by default.
+     *
+     * The configuration is therefore not hardening — it is the condition under
+     * which the agent may be dispatched with a gate at all, and the variable that
+     * carries the pointer is named on the contract so the dispatch can CHECK that
+     * a profile supplies it instead of trusting a docstring that says it must.
+     */
+    AgentClientProtocol_PermissionEscalationBehaviour["RAISES_ONLY_UNDER_HOST_CONFIGURATION"] = "raises_only_under_host_configuration";
+    /**
+     * The agent never escalates before mutating, under any configuration this
+     * framework can supply. Its own safety model is elsewhere (a sandbox), and
+     * Wildo's in-flight guards are inert for it by construction — the post-run
+     * change set is the only account of what it touched.
+     */
+    AgentClientProtocol_PermissionEscalationBehaviour["NEVER_RAISES"] = "never_raises";
+})(AgentClientProtocol_PermissionEscalationBehaviour || (AgentClientProtocol_PermissionEscalationBehaviour = {}));
+/** @wildo_source:part:end acp.permission-escalation */
+/**
+ * Can Wildo's in-flight permission ceiling and mutation-scope predicate fire for
+ * this agent, as it will actually be started?
+ *
+ * The single definition of that question, so the dispatch's refusal, the run's
+ * recorded metadata and any operator-facing report cannot disagree about it.
+ *
+ * `escalationConfigurationSupplied` answers only the conditional member: it is
+ * whether the composed child environment will actually carry the pointer the
+ * contract names. Deliberately a parameter rather than something this function
+ * reads, because the environment is composed by the dispatch and a predicate
+ * that guessed at it would be a second, quieter answer.
+ */
+export function agentClientProtocolInFlightGuardsCanFire(behaviour, escalationConfigurationSupplied) {
+    switch (behaviour) {
+        case AgentClientProtocol_PermissionEscalationBehaviour.RAISES_BEFORE_MUTATION:
+            return true;
+        case AgentClientProtocol_PermissionEscalationBehaviour.RAISES_ONLY_UNDER_HOST_CONFIGURATION:
+            return escalationConfigurationSupplied;
+        case AgentClientProtocol_PermissionEscalationBehaviour.NEVER_RAISES:
+            return false;
+    }
+}
 /**
  * How much of the HOST MACHINE's agent configuration a session inherits.
  *
@@ -220,6 +329,7 @@ export function agentClientProtocolPermissionCeilingRank(ceiling) {
  * application teaches the agent to use its framework. What it should not
  * silently absorb is whoever happens to be logged in.
  */
+/** @wildo_source:part:start acp.host-configuration-inheritance facet:layer:config facet:audience:app-developer */
 export var AgentClientProtocol_HostConfigurationInheritance;
 (function (AgentClientProtocol_HostConfigurationInheritance) {
     /** No filesystem-sourced agent configuration. The prompt is the whole instruction. */
@@ -238,12 +348,14 @@ export var AgentClientProtocol_HostConfigurationInheritance;
      */
     AgentClientProtocol_HostConfigurationInheritance["HOST_INHERITED"] = "host_inherited";
 })(AgentClientProtocol_HostConfigurationInheritance || (AgentClientProtocol_HostConfigurationInheritance = {}));
+/** @wildo_source:part:end acp.host-configuration-inheritance */
 /**
  * One authored way to start an ACP agent.
  *
  * Mirrors the shape a provider's execution profiles have always had: the
  * spawnable command plus the policy that decides whether it may run at all.
  */
+/** @wildo_source:part:start acp.execution-profile facet:layer:config facet:audience:app-developer */
 export const AgentClientProtocol_ExecutionProfileSchema = z.object({
     runnerHost: z.enum(AgentClientProtocol_RunnerHost).default(AgentClientProtocol_RunnerHost.BACKEND_SUBPROCESS),
     /**
@@ -396,6 +508,7 @@ export const AgentClientProtocol_ExecutionProfileSchema = z.object({
         });
     }
 });
+/** @wildo_source:part:end acp.execution-profile */
 /**
  * Transport capability metadata for an ACP-speaking provider.
  *
@@ -663,6 +776,32 @@ export const AgentClientProtocol_ExecutionTransportMetadataSchema = z.object({
      * which of the agent's modes that became.
      */
     sessionModeId: z.string().optional(),
+    /**
+     * Whether the agent this run started DECLARES that it escalates before
+     * mutating, and whether Wildo's in-flight guards could therefore fire.
+     *
+     * Recorded on the run because the ceiling alone no longer explains the run:
+     * `permissionCeiling: PROMPT_ALWAYS` against an agent that never asks and
+     * against one that always asks describe two completely different runs, and
+     * nothing else in this metadata tells them apart. A later reader looking at a
+     * change set needs to know whether anything stood between the agent and it.
+     *
+     * Optional because the declaration is a provider fact and a run recorded
+     * before this field existed genuinely has no answer — absence must not read as
+     * `false`, which would assert an unbound run that may have been fully bound.
+     */
+    permissionEscalation: z.enum(AgentClientProtocol_PermissionEscalationBehaviour).optional(),
+    /**
+     * The resolved answer for THIS run, from
+     * {@link agentClientProtocolInFlightGuardsCanFire} — the declared behaviour
+     * combined with whether the composed environment actually supplied the
+     * configuration a conditionally-escalating agent needs.
+     *
+     * Kept beside the behaviour rather than derived by each reader, because the
+     * conditional member cannot be resolved from the behaviour alone and a reader
+     * that tried would answer `true` for an agent that was dispatched unconfigured.
+     */
+    inFlightPermissionGuardsCanFire: z.boolean().optional(),
     /** The ACP session, retained so a later turn can resume or fork it. */
     sessionId: z.string().optional(),
 });