@xenosystem/agent-interface-host 0.1.3

package/dist/coordination/messages.d.ts

@@ -0,0 +1,225 @@
+/**
+ * Agent-to-agent messages — the push half of coordination.
+ *
+ * `XENO_AGENT_COORDINATION_SPEC.md` §2.1: every message travels **run → host →
+ * run**. Runs never address each other directly, discover each other through the
+ * filesystem, or hold sockets for one another. That is a deliberate divergence
+ * from Claude Code's per-session Unix socket plus filesystem discovery — the
+ * right design for its constraints, and unusable for ours, because **we sandbox
+ * every run** and its own documentation states a container's filesystem cannot
+ * reach a session outside it. Copying it would make our isolation defeat our
+ * coordination.
+ *
+ * ## The safety model is structural, not advisory
+ *
+ * §4 requires every safety rule to be "enforced by the host, not by convention
+ * in a prompt". The strongest form of that is to make the unsafe thing
+ * **unrepresentable**, which §2.3 already does most of: a message carries
+ * *plain text and nothing else* — never conversation history, never files, never
+ * structured context, never tool results.
+ *
+ * So a message cannot carry an action, a tool call, a permission grant or a
+ * config change, because there is no field for one. `DeliveredMessage` is also a
+ * DISTINCT TYPE from a user turn, so code that consumes consent cannot be handed
+ * one by mistake:
+ *
+ * > "These rules make agent-to-agent messaging strictly weaker than a user
+ * > prompt, and that asymmetry is the entire safety argument. Any future
+ * > capability that lets a message do something a user prompt can do is a change
+ * > to this spec, not an enhancement."
+ *
+ * The temptation §2.3 names — *"we have a host, we could send the whole
+ * context"* — is the one to resist: forcing the sender to compress a finding
+ * into a sentence **is** the value, because a run that must summarise has done
+ * the reader's thinking for it.
+ */
+export type TurnSource = 'user' | 'agent-message';
+/** A message in flight. Text and addressing only — see §2.3. */
+export interface AgentMessage {
+    id: string;
+    fromRunId: string;
+    toRunId: string;
+    /** Plain text. There is deliberately no payload field to grow. */
+    text: string;
+    sentAt: number;
+    /**
+     * The message this one answers, when it was sent while handling another.
+     * Present so the host can bound a cycle (§8) without inspecting content.
+     */
+    causedBy?: string;
+}
+/**
+ * A message as the receiver sees it.
+ *
+ * `source` is `'agent-message'` and cannot be `'user'`. That single field is why
+ * gate 2 holds: consent-consuming code accepts `TurnSource extends 'user'`, so a
+ * delivered message is rejected by the type system before any runtime check.
+ */
+export interface DeliveredMessage {
+    readonly source: 'agent-message';
+    readonly message: AgentMessage;
+    readonly deliveredAt: number;
+}
+/** §6: three outcomes, and the sender learns which (gate 10). */
+export type InboundPolicy = 'accept' | 'hold' | 'refuse';
+/**
+ * The capabilities a run is executing with — its permission posture.
+ *
+ * Mirrors `AgentTurnExecutionOptions['capabilities']` and is deliberately NOT
+ * imported from the contract: this module has zero imports on purpose (see the
+ * header). `runPostureKeysMatchContract` in the test suite fails if the two ever
+ * drift, which is the check that keeps a hand-mirrored list honest — a
+ * capability added to the contract and not here would be silently ignored by
+ * the comparison below, i.e. it would widen what counts as "not upward".
+ */
+export declare const RUN_CAPABILITY_KEYS: readonly ["terminal", "browser", "fileRead", "fileWrite", "appLaunch", "webSearch"];
+export type RunCapability = (typeof RUN_CAPABILITY_KEYS)[number];
+/** Derived from the ONE array above, so the list and the type cannot disagree. */
+export type RunPosture = {
+    readonly [K in RunCapability]?: boolean;
+};
+/**
+ * §6: **a message never moves trust upward.**
+ *
+ * The spec's default is COMPARATIVE, not a per-run flag — "a run operating with
+ * elevated autonomy is a *sender* whose messages are held for a more constrained
+ * receiver". So the question is not "how much" autonomy either side has; it is
+ * whether the sender holds anything the receiver does not.
+ *
+ * The honest comparison over a capability SET is therefore SUBSET, never a
+ * score. A numeric trust level would have to rank `terminal` against
+ * `fileWrite`, and nothing in the spec licenses that ordering — inventing one
+ * would be this module asserting a policy the spec never states.
+ *
+ * Absent is not `false` by accident: an undeclared capability is one the run is
+ * not executing with, so `undefined` and `false` are the same answer to "may it
+ * do this", and only `true` on the sender's side can move trust.
+ */
+export declare function movesTrustUpward(sender: RunPosture, receiver: RunPosture): boolean;
+/**
+ * What a derivation resolves to when a posture is UNKNOWN.
+ *
+ * 🔴 Named, not silent, and deliberately `accept` — the same distinction
+ * `RunRecord.complete` exists to preserve: unknown must not masquerade as a
+ * measured answer. Holding instead would be the stricter choice, and it is the
+ * wrong one HERE: no run carried a posture before this change, so an unknown
+ * posture is the ordinary case during rollout, and defaulting it to `hold`
+ * would silently route every coordination message in the product to a human
+ * approval queue. The rule becomes real for a pair the moment both postures are
+ * known; until then this preserves shipped behaviour, visibly.
+ */
+export declare const UNKNOWN_POSTURE_POLICY: InboundPolicy;
+export type MessageOutcome = {
+    status: 'delivered';
+    messageId: string;
+    at: number;
+} | {
+    status: 'held';
+    messageId: string;
+    reason: string;
+} | {
+    status: 'refused';
+    messageId: string;
+    reason: string;
+} | {
+    status: 'expired';
+    messageId: string;
+    reason: string;
+};
+export interface MessageBusOptions {
+    now?: () => number;
+    /** §8 rate limit: messages one sender may emit per window. */
+    maxPerSenderPerWindow?: number;
+    windowMs?: number;
+    /** §8: cap on undelivered messages per run; oldest dropped past the cap. */
+    maxQueuedPerRun?: number;
+    /** §8: a separate cap on held messages. */
+    maxHeldPerRun?: number;
+    /** §8 loop detection: how deep a causal chain may run before it is refused. */
+    maxChainDepth?: number;
+    /**
+     * Resolves a run's permission posture — §6's derivation input.
+     *
+     * A PORT rather than a registry reference: the bus decides policy and must not
+     * also own where runs are recorded. Absent, or returning `undefined` for a run
+     * it has never heard of, is a legitimate answer and resolves to
+     * {@link UNKNOWN_POSTURE_POLICY}.
+     */
+    posture?: (runId: string) => RunPosture | undefined;
+}
+/**
+ * Answers whether a turn's text may satisfy consent.
+ *
+ * Exported so the rule lives in ONE place rather than being re-derived at each
+ * permission gate. §4.1: a message "cannot answer a pending permission prompt,
+ * approve a tool call, or satisfy an approval gate".
+ */
+export declare function canSatisfyConsent(source: TurnSource): boolean;
+/**
+ * Host-mediated message bus.
+ *
+ * Holds no sockets and performs no discovery: every operation is a host call, so
+ * two runs in separate sandboxes exchange messages by construction (gate 1) —
+ * the gate that fails for filesystem-discovery designs.
+ */
+export declare class MessageBus {
+    #private;
+    constructor(options?: MessageBusOptions);
+    setInboundPolicy(runId: string, policy: InboundPolicy): void;
+    /**
+     * Drops the explicit override, returning the run to §6's derived default.
+     *
+     * Without this, setting a policy is a ONE-WAY DOOR: a human who pins `accept`
+     * during an incident can never hand the decision back to the rule, and the
+     * safest posture becomes the one nobody dares leave. Clearing is not the same
+     * as setting `accept` — one restores the derivation, the other overrides it
+     * permanently in the permissive direction.
+     */
+    clearInboundPolicy(runId: string): void;
+    /**
+     * The explicit override for a run, or `undefined` when the derivation answers.
+     *
+     * A surface needs BOTH this and the effective policy: showing only the
+     * effective one leaves a person unable to tell a decision they made from a
+     * decision the rule made, and those are undone differently.
+     */
+    explicitPolicyFor(runId: string): InboundPolicy | undefined;
+    /**
+     * §6's derived default — used only when no explicit policy was set.
+     *
+     * Exposed so a surface can explain *why* a message was held without
+     * re-deriving the rule from the two postures itself, which is how a second,
+     * subtly different spelling of a safety rule gets written.
+     */
+    deriveInboundPolicy(fromRunId: string, toRunId: string): InboundPolicy;
+    /**
+     * Sends a message and returns its outcome.
+     *
+     * Returns rather than resolves-later on purpose: §6 requires the sender to
+     * learn "delivered, held, denied or expired" in EVERY case, so an agent is
+     * never left assuming a message landed. A fire-and-forget signature would make
+     * that impossible to honour at the type level.
+     */
+    send(input: {
+        fromRunId: string;
+        toRunId: string;
+        text: string;
+        causedBy?: string;
+    }): MessageOutcome;
+    /**
+     * Takes everything queued for a run.
+     *
+     * §6: delivery happens at a turn boundary or between tool calls — "a running
+     * tool is never interrupted mid-execution". The host calls this at those
+     * points; the bus does not push, so it cannot interrupt anything.
+     *
+     * Every message comes back tagged `source: 'agent-message'`, which is what
+     * keeps a delivered message from being mistaken for user input downstream.
+     */
+    drainFor(runId: string): DeliveredMessage[];
+    /** Messages withheld for human approval (§6 `hold`). */
+    heldFor(runId: string): AgentMessage[];
+    /** A human releases a held message; it then follows the normal queue path. */
+    releaseHeld(runId: string, messageId: string): MessageOutcome;
+}
+//# sourceMappingURL=messages.d.ts.map

package/dist/coordination/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/coordination/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAgBH,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,eAAe,CAAA;AAEjD,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,iEAAiE;AACjE,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,qFAOtB,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhE,kFAAkF;AAClF,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,EAAE,CAAC,IAAI,aAAa,CAAC,CAAC,EAAE,OAAO;CAAE,CAAA;AAEpE;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAElF;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAwB,CAAA;AAE7D,MAAM,MAAM,cAAc,GACtB;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE5D,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,8DAA8D;IAC9D,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAA;CACpD;AAUD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAE7D;AAED;;;;;;GAMG;AACH,qBAAa,UAAU;;gBAyBT,OAAO,GAAE,iBAAsB;IAY3C,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI;IAI5D;;;;;;;;OAQG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAIvC;;;;;;OAMG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAI3D;;;;;;OAMG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa;IAWtE;;;;;;;OAOG;IACH,IAAI,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,cAAc;IAyFpG;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,EAAE;IAO3C,wDAAwD;IACxD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,EAAE;IAItC,8EAA8E;IAC9E,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc;CAqB9D"}

package/dist/coordination/messages.js

@@ -0,0 +1,335 @@
+/**
+ * Agent-to-agent messages — the push half of coordination.
+ *
+ * `XENO_AGENT_COORDINATION_SPEC.md` §2.1: every message travels **run → host →
+ * run**. Runs never address each other directly, discover each other through the
+ * filesystem, or hold sockets for one another. That is a deliberate divergence
+ * from Claude Code's per-session Unix socket plus filesystem discovery — the
+ * right design for its constraints, and unusable for ours, because **we sandbox
+ * every run** and its own documentation states a container's filesystem cannot
+ * reach a session outside it. Copying it would make our isolation defeat our
+ * coordination.
+ *
+ * ## The safety model is structural, not advisory
+ *
+ * §4 requires every safety rule to be "enforced by the host, not by convention
+ * in a prompt". The strongest form of that is to make the unsafe thing
+ * **unrepresentable**, which §2.3 already does most of: a message carries
+ * *plain text and nothing else* — never conversation history, never files, never
+ * structured context, never tool results.
+ *
+ * So a message cannot carry an action, a tool call, a permission grant or a
+ * config change, because there is no field for one. `DeliveredMessage` is also a
+ * DISTINCT TYPE from a user turn, so code that consumes consent cannot be handed
+ * one by mistake:
+ *
+ * > "These rules make agent-to-agent messaging strictly weaker than a user
+ * > prompt, and that asymmetry is the entire safety argument. Any future
+ * > capability that lets a message do something a user prompt can do is a change
+ * > to this spec, not an enhancement."
+ *
+ * The temptation §2.3 names — *"we have a host, we could send the whole
+ * context"* — is the one to resist: forcing the sender to compress a finding
+ * into a sentence **is** the value, because a run that must summarise has done
+ * the reader's thinking for it.
+ */
+/** Where a turn's text came from. The discriminant the safety model rests on. */
+/**
+ * A short unique id, without a Node dependency.
+ *
+ * `packages/host`'s portable entry (`index.ts`) has ZERO `node:` imports by
+ * design — it is the half that must run outside a Node host — and coordination
+ * is provider-neutral rules, so it belongs there rather than behind `./node`.
+ * `crypto.randomUUID` is Web Crypto, available in Node 20+ (this package's
+ * floor) and every modern browser, so the portability costs nothing.
+ */
+function shortId(prefix) {
+    return `${prefix}_${globalThis.crypto.randomUUID().replaceAll('-', '').slice(0, 16)}`;
+}
+/**
+ * The capabilities a run is executing with — its permission posture.
+ *
+ * Mirrors `AgentTurnExecutionOptions['capabilities']` and is deliberately NOT
+ * imported from the contract: this module has zero imports on purpose (see the
+ * header). `runPostureKeysMatchContract` in the test suite fails if the two ever
+ * drift, which is the check that keeps a hand-mirrored list honest — a
+ * capability added to the contract and not here would be silently ignored by
+ * the comparison below, i.e. it would widen what counts as "not upward".
+ */
+export const RUN_CAPABILITY_KEYS = [
+    'terminal',
+    'browser',
+    'fileRead',
+    'fileWrite',
+    'appLaunch',
+    'webSearch',
+];
+/**
+ * §6: **a message never moves trust upward.**
+ *
+ * The spec's default is COMPARATIVE, not a per-run flag — "a run operating with
+ * elevated autonomy is a *sender* whose messages are held for a more constrained
+ * receiver". So the question is not "how much" autonomy either side has; it is
+ * whether the sender holds anything the receiver does not.
+ *
+ * The honest comparison over a capability SET is therefore SUBSET, never a
+ * score. A numeric trust level would have to rank `terminal` against
+ * `fileWrite`, and nothing in the spec licenses that ordering — inventing one
+ * would be this module asserting a policy the spec never states.
+ *
+ * Absent is not `false` by accident: an undeclared capability is one the run is
+ * not executing with, so `undefined` and `false` are the same answer to "may it
+ * do this", and only `true` on the sender's side can move trust.
+ */
+export function movesTrustUpward(sender, receiver) {
+    return RUN_CAPABILITY_KEYS.some((key) => sender[key] === true && receiver[key] !== true);
+}
+/**
+ * What a derivation resolves to when a posture is UNKNOWN.
+ *
+ * 🔴 Named, not silent, and deliberately `accept` — the same distinction
+ * `RunRecord.complete` exists to preserve: unknown must not masquerade as a
+ * measured answer. Holding instead would be the stricter choice, and it is the
+ * wrong one HERE: no run carried a posture before this change, so an unknown
+ * posture is the ordinary case during rollout, and defaulting it to `hold`
+ * would silently route every coordination message in the product to a human
+ * approval queue. The rule becomes real for a pair the moment both postures are
+ * known; until then this preserves shipped behaviour, visibly.
+ */
+export const UNKNOWN_POSTURE_POLICY = 'accept';
+const DEFAULTS = {
+    maxPerSenderPerWindow: 20,
+    windowMs: 60_000,
+    maxQueuedPerRun: 50,
+    maxHeldPerRun: 20,
+    maxChainDepth: 8,
+};
+/**
+ * Answers whether a turn's text may satisfy consent.
+ *
+ * Exported so the rule lives in ONE place rather than being re-derived at each
+ * permission gate. §4.1: a message "cannot answer a pending permission prompt,
+ * approve a tool call, or satisfy an approval gate".
+ */
+export function canSatisfyConsent(source) {
+    return source === 'user';
+}
+/**
+ * Host-mediated message bus.
+ *
+ * Holds no sockets and performs no discovery: every operation is a host call, so
+ * two runs in separate sandboxes exchange messages by construction (gate 1) —
+ * the gate that fails for filesystem-discovery designs.
+ */
+export class MessageBus {
+    #now;
+    #options;
+    #posture;
+    /**
+     * Per-run inbound policy — an EXPLICIT override only.
+     *
+     * §6 says defaults derive from permission posture, and until this map was
+     * given a derivation behind it that sentence was false: nothing ever called
+     * `setInboundPolicy`, so every run fell through to a hardcoded `accept` — the
+     * most permissive of the three — and "a message never moves trust upward" was
+     * enforced nowhere. An entry here now means somebody *decided*; absence means
+     * {@link deriveInboundPolicy} answers.
+     */
+    #policy = new Map();
+    #queues = new Map();
+    #held = new Map();
+    /** Send timestamps per sender, for the §8 rate limit. */
+    #sendLog = new Map();
+    /** Recent `from|to|text` fingerprints, for §8 deduplication. */
+    #recent = new Map();
+    /** messageId -> causal depth, so a cycle is bounded without reading content. */
+    #depth = new Map();
+    constructor(options = {}) {
+        this.#now = options.now ?? Date.now;
+        this.#options = {
+            maxPerSenderPerWindow: options.maxPerSenderPerWindow ?? DEFAULTS.maxPerSenderPerWindow,
+            windowMs: options.windowMs ?? DEFAULTS.windowMs,
+            maxQueuedPerRun: options.maxQueuedPerRun ?? DEFAULTS.maxQueuedPerRun,
+            maxHeldPerRun: options.maxHeldPerRun ?? DEFAULTS.maxHeldPerRun,
+            maxChainDepth: options.maxChainDepth ?? DEFAULTS.maxChainDepth,
+        };
+        this.#posture = options.posture;
+    }
+    setInboundPolicy(runId, policy) {
+        this.#policy.set(runId, policy);
+    }
+    /**
+     * Drops the explicit override, returning the run to §6's derived default.
+     *
+     * Without this, setting a policy is a ONE-WAY DOOR: a human who pins `accept`
+     * during an incident can never hand the decision back to the rule, and the
+     * safest posture becomes the one nobody dares leave. Clearing is not the same
+     * as setting `accept` — one restores the derivation, the other overrides it
+     * permanently in the permissive direction.
+     */
+    clearInboundPolicy(runId) {
+        this.#policy.delete(runId);
+    }
+    /**
+     * The explicit override for a run, or `undefined` when the derivation answers.
+     *
+     * A surface needs BOTH this and the effective policy: showing only the
+     * effective one leaves a person unable to tell a decision they made from a
+     * decision the rule made, and those are undone differently.
+     */
+    explicitPolicyFor(runId) {
+        return this.#policy.get(runId);
+    }
+    /**
+     * §6's derived default — used only when no explicit policy was set.
+     *
+     * Exposed so a surface can explain *why* a message was held without
+     * re-deriving the rule from the two postures itself, which is how a second,
+     * subtly different spelling of a safety rule gets written.
+     */
+    deriveInboundPolicy(fromRunId, toRunId) {
+        const resolve = this.#posture;
+        if (!resolve)
+            return UNKNOWN_POSTURE_POLICY;
+        const sender = resolve(fromRunId);
+        const receiver = resolve(toRunId);
+        // Either side unknown: the comparison cannot be made, and a comparison that
+        // cannot be made must not report the permissive answer as though it had been.
+        if (!sender || !receiver)
+            return UNKNOWN_POSTURE_POLICY;
+        return movesTrustUpward(sender, receiver) ? 'hold' : 'accept';
+    }
+    /**
+     * Sends a message and returns its outcome.
+     *
+     * Returns rather than resolves-later on purpose: §6 requires the sender to
+     * learn "delivered, held, denied or expired" in EVERY case, so an agent is
+     * never left assuming a message landed. A fire-and-forget signature would make
+     * that impossible to honour at the type level.
+     */
+    send(input) {
+        const at = this.#now();
+        const id = shortId('msg');
+        // §8 loop detection. Bounded by CAUSAL DEPTH rather than by inspecting text,
+        // because two runs can loop forever with different wording every time.
+        const depth = input.causedBy ? (this.#depth.get(input.causedBy) ?? 0) + 1 : 0;
+        if (depth > this.#options.maxChainDepth) {
+            return {
+                status: 'refused',
+                messageId: id,
+                reason: `message chain exceeded ${this.#options.maxChainDepth} hops; a cycle must terminate without human intervention`,
+            };
+        }
+        // §8 rate limit per sender.
+        const sent = (this.#sendLog.get(input.fromRunId) ?? []).filter((stamp) => at - stamp < this.#options.windowMs);
+        if (sent.length >= this.#options.maxPerSenderPerWindow) {
+            this.#sendLog.set(input.fromRunId, sent);
+            return {
+                status: 'refused',
+                messageId: id,
+                reason: `sender exceeded ${this.#options.maxPerSenderPerWindow} messages per ${this.#options.windowMs} ms`,
+            };
+        }
+        // §8 deduplication of identical messages within the window.
+        const fingerprint = `${input.fromRunId}|${input.toRunId}|${input.text}`;
+        const lastSeen = this.#recent.get(fingerprint);
+        if (lastSeen !== undefined && at - lastSeen < this.#options.windowMs) {
+            return { status: 'refused', messageId: id, reason: 'duplicate message within the dedup window' };
+        }
+        const message = {
+            id,
+            fromRunId: input.fromRunId,
+            toRunId: input.toRunId,
+            text: input.text,
+            sentAt: at,
+            // Only present when this message answers another. An always-present
+            // `causedBy: undefined` would put a key on every message that a reviewer
+            // has to think about, and §2.3's whole point is that there is nothing on a
+            // message to think about beyond its text.
+            ...(input.causedBy === undefined ? {} : { causedBy: input.causedBy }),
+        };
+        this.#depth.set(id, depth);
+        sent.push(at);
+        this.#sendLog.set(input.fromRunId, sent);
+        this.#recent.set(fingerprint, at);
+        // An explicit policy WINS: `setInboundPolicy` is somebody's decision, and a
+        // derivation must not overrule it in either direction. Only its absence
+        // reaches §6's default.
+        const explicit = this.#policy.get(input.toRunId);
+        const policy = explicit ?? this.deriveInboundPolicy(input.fromRunId, input.toRunId);
+        if (policy === 'refuse') {
+            return { status: 'refused', messageId: id, reason: 'receiver inbound policy refuses this sender' };
+        }
+        if (policy === 'hold') {
+            const held = this.#held.get(input.toRunId) ?? [];
+            if (held.length >= this.#options.maxHeldPerRun) {
+                return { status: 'refused', messageId: id, reason: 'receiver hold queue is full' };
+            }
+            held.push(message);
+            this.#held.set(input.toRunId, held);
+            // Distinct reasons because the two holds are different facts, and §6
+            // requires the SENDER to learn the outcome: "a human has not approved this
+            // yet" and "you hold capabilities the receiver does not" are answers a
+            // sending agent would act on differently.
+            return {
+                status: 'held',
+                messageId: id,
+                reason: explicit === undefined
+                    ? 'sender holds capabilities the receiver does not; a message never moves trust upward'
+                    : 'awaiting human approval',
+            };
+        }
+        const queue = this.#queues.get(input.toRunId) ?? [];
+        // §8: oldest dropped past the cap. Dropping the NEWEST would silently
+        // discard the most current information, which is the opposite of useful.
+        if (queue.length >= this.#options.maxQueuedPerRun)
+            queue.shift();
+        queue.push(message);
+        this.#queues.set(input.toRunId, queue);
+        return { status: 'delivered', messageId: id, at };
+    }
+    /**
+     * Takes everything queued for a run.
+     *
+     * §6: delivery happens at a turn boundary or between tool calls — "a running
+     * tool is never interrupted mid-execution". The host calls this at those
+     * points; the bus does not push, so it cannot interrupt anything.
+     *
+     * Every message comes back tagged `source: 'agent-message'`, which is what
+     * keeps a delivered message from being mistaken for user input downstream.
+     */
+    drainFor(runId) {
+        const queue = this.#queues.get(runId) ?? [];
+        this.#queues.set(runId, []);
+        const at = this.#now();
+        return queue.map((message) => ({ source: 'agent-message', message, deliveredAt: at }));
+    }
+    /** Messages withheld for human approval (§6 `hold`). */
+    heldFor(runId) {
+        return [...(this.#held.get(runId) ?? [])];
+    }
+    /** A human releases a held message; it then follows the normal queue path. */
+    releaseHeld(runId, messageId) {
+        const held = this.#held.get(runId) ?? [];
+        const index = held.findIndex((message) => message.id === messageId);
+        if (index === -1) {
+            return { status: 'expired', messageId, reason: 'held message is no longer available' };
+        }
+        const [message] = held.splice(index, 1);
+        // `splice` is typed as possibly-empty even though `index` came from a
+        // successful `findIndex`. Guarding rather than asserting: a non-null
+        // assertion here would be correct today and silently wrong the day the
+        // lookup above changes.
+        if (!message) {
+            return { status: 'expired', messageId, reason: 'held message is no longer available' };
+        }
+        this.#held.set(runId, held);
+        const queue = this.#queues.get(runId) ?? [];
+        if (queue.length >= this.#options.maxQueuedPerRun)
+            queue.shift();
+        queue.push(message);
+        this.#queues.set(runId, queue);
+        return { status: 'delivered', messageId, at: this.#now() };
+    }
+}
+//# sourceMappingURL=messages.js.map

package/dist/coordination/messages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.js","sourceRoot":"","sources":["../../src/coordination/messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,iFAAiF;AACjF;;;;;;;;GAQG;AACH,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,GAAG,MAAM,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;AACvF,CAAC;AAmCD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,UAAU;IACV,SAAS;IACT,UAAU;IACV,WAAW;IACX,WAAW;IACX,WAAW;CACH,CAAA;AAOV;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,QAAoB;IACvE,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAA;AAC1F,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAkB,QAAQ,CAAA;AA8B7D,MAAM,QAAQ,GAAG;IACf,qBAAqB,EAAE,EAAE;IACzB,QAAQ,EAAE,MAAM;IAChB,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,CAAC;CACR,CAAA;AAEV;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAkB;IAClD,OAAO,MAAM,KAAK,MAAM,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IACZ,IAAI,CAAc;IAClB,QAAQ,CAAsD;IAC9D,QAAQ,CAAyD;IAE1E;;;;;;;;;OASG;IACM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAA;IAC1C,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC3C,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAClD,yDAAyD;IAChD,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAA;IAC/C,gEAAgE;IACvD,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,gFAAgF;IACvE,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IAE3C,YAAY,UAA6B,EAAE;QACzC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QACnC,IAAI,CAAC,QAAQ,GAAG;YACd,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,IAAI,QAAQ,CAAC,qBAAqB;YACtF,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ;YAC/C,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe;YACpE,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;YAC9D,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,aAAa;SAC/D,CAAA;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAA;IACjC,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,MAAqB;QACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACjC,CAAC;IAED;;;;;;;;OAQG;IACH,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,iBAAiB,CAAC,KAAa;QAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAChC,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,SAAiB,EAAE,OAAe;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAA;QAC7B,IAAI,CAAC,OAAO;YAAE,OAAO,sBAAsB,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,4EAA4E;QAC5E,8EAA8E;QAC9E,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO,sBAAsB,CAAA;QACvD,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC/D,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,KAA8E;QACjF,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACtB,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAEzB,6EAA6E;QAC7E,uEAAuE;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7E,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YACxC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,0BAA0B,IAAI,CAAC,QAAQ,CAAC,aAAa,0DAA0D;aACxH,CAAA;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAC/C,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,CAAC;YACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YACxC,OAAO;gBACL,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,mBAAmB,IAAI,CAAC,QAAQ,CAAC,qBAAqB,iBAAiB,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK;aAC3G,CAAA;QACH,CAAC;QAED,4DAA4D;QAC5D,MAAM,WAAW,GAAG,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACrE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAA;QAClG,CAAC;QAED,MAAM,OAAO,GAAiB;YAC5B,EAAE;YACF,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,EAAE;YACV,oEAAoE;YACpE,yEAAyE;YACzE,2EAA2E;YAC3E,0CAA0C;YAC1C,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;SACtE,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACb,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QACxC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAEjC,4EAA4E;QAC5E,wEAAwE;QACxE,wBAAwB;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAChD,MAAM,MAAM,GAAG,QAAQ,IAAI,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;QACnF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAA;QACpG,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YAChD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;gBAC/C,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAA;YACpF,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAClB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YACnC,qEAAqE;YACrE,2EAA2E;YAC3E,uEAAuE;YACvE,0CAA0C;YAC1C,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,QAAQ,KAAK,SAAS;oBAC5B,CAAC,CAAC,qFAAqF;oBACvF,CAAC,CAAC,yBAAyB;aAC9B,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACnD,sEAAsE;QACtE,yEAAyE;QACzE,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACtC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,CAAA;IACnD,CAAC;IAED;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAa;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACtB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,eAAwB,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,wDAAwD;IACxD,OAAO,CAAC,KAAa;QACnB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3C,CAAC;IAED,8EAA8E;IAC9E,WAAW,CAAC,KAAa,EAAE,SAAiB;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,SAAS,CAAC,CAAA;QACnE,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAA;QACxF,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACvC,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAA;QACxF,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe;YAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QAChE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC9B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAA;IAC5D,CAAC;CACF"}

package/dist/coordination/permissionWaitRegistry.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A registry of outstanding human prompts that says when a RUN starts and stops
+ * waiting on one — ADE §7's `awaiting-approval`.
+ *
+ * 🔴 The rule lives HERE, not beside the prompts it watches, for two reasons.
+ *
+ * It is the same rule in every lane, and a per-lane copy is how a run blocked on
+ * a human came to report itself busy in one runtime and correctly in the other.
+ * And `packages/electron-host` is not one of this repo's test projects, so a
+ * version of this written there could not be proven at all — the occupancy
+ * arithmetic below is exactly the part worth proving.
+ *
+ * Occupancy is derived rather than announced: every wait registers an entry and
+ * every resolution removes one, so the FIRST entry for a run means it is
+ * blocked and the LAST removal means it is free. Instrumenting the call sites
+ * instead would mean editing each one, and missing the next one someone adds.
+ */
+export interface PermissionWaitEntry {
+    /** The run's turn. Entries without one are held but never reported on. */
+    requestId?: string | undefined;
+}
+export type PermissionWaitListener = (requestId: string, waiting: boolean) => void;
+export interface PermissionWaitRegistry<T extends PermissionWaitEntry> {
+    set(key: string, entry: T): void;
+    get(key: string): T | undefined;
+    delete(key: string): boolean;
+    entries(): IterableIterator<[string, T]>;
+    /** Returns an unsubscribe, so a finished turn stops hearing about later ones. */
+    onChange(listener: PermissionWaitListener): () => void;
+}
+export declare function createPermissionWaitRegistry<T extends PermissionWaitEntry>(): PermissionWaitRegistry<T>;
+//# sourceMappingURL=permissionWaitRegistry.d.ts.map

package/dist/coordination/permissionWaitRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionWaitRegistry.d.ts","sourceRoot":"","sources":["../../src/coordination/permissionWaitRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC/B;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,KAAK,IAAI,CAAA;AAElF,MAAM,WAAW,sBAAsB,CAAC,CAAC,SAAS,mBAAmB;IACnE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAA;IAChC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAA;IAC/B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IAC5B,OAAO,IAAI,gBAAgB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;IACxC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,GAAG,MAAM,IAAI,CAAA;CACvD;AAED,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,mBAAmB,KAAK,sBAAsB,CAAC,CAAC,CAAC,CAqDvG"}