@ziggs-ai/api-client 0.37.27 → 0.38.0

package/dist/http/ContextReadClient.js

@@ -57,28 +57,13 @@ export class ContextReadClient {
     operatorKey;
     agentId;
     baseUrl;
-    laneId;
-    /**
-     * @param operatorKey Agent-scoped or fleet operator key.
-     * @param agentId Required for fleet keys (sent as X-Agent-Id). Omit for agent-scoped keys.
-     * @param laneId the wake's lane, sent as X-Ziggs-Lane. The server fences a
-     *   read to the lane's parties; without it, reach falls back to a wider
-     *   test and a read can be authorised on a weaker basis than the caller
-     *   intended. Send it on every read made while acting on a wake.
-     */
-    constructor(operatorKey, agentId, baseUrl, laneId) {
+    /** Authority is supplied by withWorkExecution / withWorkExecutionId. */
+    constructor(operatorKey, agentId, baseUrl) {
         if (!operatorKey)
             throw new Error('ContextReadClient: operatorKey is required');
         this.operatorKey = operatorKey;
         this.agentId = agentId;
         this.baseUrl = baseUrl || getBackendUrl();
-        this.laneId = laneId;
-    }
-    /** The same reader acting on one wake's lane. */
-    withLane(laneId) {
-        if (!laneId || laneId === this.laneId)
-            return this;
-        return new ContextReadClient(this.operatorKey, this.agentId, this.baseUrl, laneId);
     }
     async read(type, query) {
         if (!query.via?.trim()) {
@@ -101,7 +86,7 @@ export class ContextReadClient {
         if (query.contextGrantId) {
             url.searchParams.set('contextGrantId', query.contextGrantId);
         }
-        const headers = buildOperatorHeaders(this.operatorKey, this.agentId, undefined, this.laneId);
+        const headers = buildOperatorHeaders(this.operatorKey, this.agentId, undefined);
         if (query.contextGrantId) {
             headers['X-Context-Grant-Id'] = query.contextGrantId;
         }
@@ -138,7 +123,7 @@ export class ContextReadClient {
         if (opts.contextGrantId) {
             url.searchParams.set('contextGrantId', opts.contextGrantId);
         }
-        const headers = buildOperatorHeaders(this.operatorKey, this.agentId, undefined, this.laneId);
+        const headers = buildOperatorHeaders(this.operatorKey, this.agentId, undefined);
         if (opts.contextGrantId) {
             headers['X-Context-Grant-Id'] = opts.contextGrantId;
         }

package/dist/http/ExecutionContextClient.d.ts

@@ -0,0 +1,3 @@
+import type { WorkExecutionContext } from '@ziggs-ai/contracts';
+/** Fail closed before resuming model state, including timers and recorded wakes. */
+export declare function validateWorkExecution(context: WorkExecutionContext, operatorKey: string, baseUrl?: string): Promise<void>;

package/dist/http/ExecutionContextClient.js

@@ -0,0 +1,17 @@
+import { getBackendUrl } from '../utils/urlUtils.js';
+import { buildOperatorHeaders, withWorkExecution } from './operatorHeaders.js';
+import { throwApiError } from '../shared/apiError.js';
+/** Fail closed before resuming model state, including timers and recorded wakes. */
+export async function validateWorkExecution(context, operatorKey, baseUrl = getBackendUrl()) {
+    await withWorkExecution(context, async () => {
+        const response = await fetch(`${baseUrl}/execution/context`, {
+            headers: buildOperatorHeaders(operatorKey, context.actorId),
+        });
+        const text = await response.text();
+        if (!response.ok)
+            throwApiError(response, text, 'Execution context is no longer valid');
+        const body = JSON.parse(text);
+        if (body.contextId !== context.contextId)
+            throw new Error('Execution preflight returned a different context');
+    });
+}

package/dist/http/GrantsClient.d.ts

@@ -56,16 +56,8 @@ export declare class GrantsClient {
     private readonly operatorKey;
     private readonly agentId?;
     private readonly baseUrl;
-    private readonly laneId?;
-    /**
-     * @param laneId the wake's lane (a chat id, or `agrn-<agreementId>`), sent as
-     *   X-Ziggs-Lane. The server reads off it who the agent is acting for, and
-     *   answers the spendable rails with only the grants this wake may spend —
-     *   so an agent serving several customers is never handed a list it has to
-     *   choose between. Without it the list is everything the agent holds, and
-     *   the grant it picks may then be refused with nothing saying why.
-     */
-    constructor(operatorKey: string, agentId?: string, baseUrl?: string, laneId?: string);
+    /** Authority is supplied by withWorkExecution / withWorkExecutionId. */
+    constructor(operatorKey: string, agentId?: string, baseUrl?: string);
     listGrants(query?: ListGrantsQuery): Promise<ListGrantsResult>;
     /**
      * Every grant matching `query`, following the cursor to completion. Use when a

package/dist/http/GrantsClient.js

@@ -12,22 +12,13 @@ export class GrantsClient {
     operatorKey;
     agentId;
     baseUrl;
-    laneId;
-    /**
-     * @param laneId the wake's lane (a chat id, or `agrn-<agreementId>`), sent as
-     *   X-Ziggs-Lane. The server reads off it who the agent is acting for, and
-     *   answers the spendable rails with only the grants this wake may spend —
-     *   so an agent serving several customers is never handed a list it has to
-     *   choose between. Without it the list is everything the agent holds, and
-     *   the grant it picks may then be refused with nothing saying why.
-     */
-    constructor(operatorKey, agentId, baseUrl, laneId) {
+    /** Authority is supplied by withWorkExecution / withWorkExecutionId. */
+    constructor(operatorKey, agentId, baseUrl) {
         if (!operatorKey)
             throw new Error('GrantsClient: operatorKey is required');
         this.operatorKey = operatorKey;
         this.agentId = agentId;
         this.baseUrl = baseUrl || getBackendUrl();
-        this.laneId = laneId;
     }
     async listGrants(query = {}) {
         const url = new URL(`${this.baseUrl}/grants`);
@@ -51,7 +42,7 @@ export class GrantsClient {
         if (query.limit != null)
             url.searchParams.set('limit', String(query.limit));
         const res = await fetch(url.toString(), {
-            headers: buildOperatorHeaders(this.operatorKey, this.agentId, undefined, this.laneId),
+            headers: buildOperatorHeaders(this.operatorKey, this.agentId, undefined),
         });
         const body = await res.text().catch(() => '');
         if (!res.ok) {

package/dist/http/InboxClient.d.ts

@@ -49,7 +49,7 @@ export declare class InboxClient {
      * refused.
      */
     ack(upTo: string, opts?: {
-        handledResourceIds?: string[];
+        handledDeliveryIds?: string[];
     }): Promise<InboxAckResult>;
     /** The person said to leave this proposal pending. Does not approve or reject. */
     park(agreementId: string): Promise<{
@@ -62,7 +62,7 @@ export declare class InboxClient {
      * A second host-conflict is a live competitor and is rethrown unchanged.
      */
     ackOrTakeHost(upTo: string, opts?: {
-        handledResourceIds?: string[];
+        handledDeliveryIds?: string[];
     }): Promise<InboxAckResult>;
     /**
      * Drop this process's inbox host lease so another client can take

package/dist/http/InboxClient.js

@@ -119,9 +119,7 @@ export class InboxClient {
             headers: this.headers(),
             body: JSON.stringify({
                 upTo,
-                ...(opts.handledResourceIds
-                    ? { handledResourceIds: opts.handledResourceIds }
-                    : {}),
+                ...(opts.handledDeliveryIds ? { handledDeliveryIds: opts.handledDeliveryIds } : {}),
             }),
         });
         const body = await res.text().catch(() => '');

package/dist/http/IntroductionsClient.d.ts

@@ -1,7 +1,13 @@
 import type { WriteSource } from '../capabilities/sources.js';
 /** What became of one hello. `expired` is derived by the server, not stored. */
 export type IntroductionStatus = 'open' | 'redeemed' | 'declined' | 'revoked' | 'expired';
-export type IntroductionOutcome = 'link_pending' | 'already_teammates' | 'already_linked';
+/**
+ * Where a redeem ended. `joined`: your agent is in the thing the token names
+ * (your own token, a teammate's, or someone you are already linked to).
+ * `claimed` / `bid` / `accepted`: the listing, request or proposal it names.
+ * `link_pending`: a link both people still approve.
+ */
+export type IntroductionOutcome = 'joined' | 'claimed' | 'bid' | 'accepted' | 'link_pending';
 export interface IntroductionFrom {
     orgId: string;
     agentId: string | null;
@@ -26,11 +32,25 @@ export interface IntroductionView {
     venue: string | null;
     venueRef: string | null;
     note: string | null;
+    /** What the token is about. The public view gives kind and title only. */
+    about?: {
+        kind: 'agreement' | 'task' | 'chat' | 'workspace';
+        id?: string;
+        title: string | null;
+        shape: 'listing' | 'request' | 'proposal' | null;
+    } | null;
+    /** How many people the token serves, and how many are left. */
+    redeems?: {
+        allowed: number;
+        left: number;
+    };
     agreementId: string | null;
     redeemedBy: {
         agentId: string | null;
         orgId: string | null;
     } | null;
+    /** Returned to a redeemer only: the room its agent is now in. */
+    chatId?: string | null;
     expiresAt: string;
     /** The public page the string points at. This is what you hand over. */
     url: string;

package/dist/http/PaymentsClient.d.ts

@@ -61,21 +61,8 @@ export declare class PaymentsClient {
     private readonly operatorKey;
     private readonly agentId?;
     private readonly baseUrl;
-    private readonly laneId?;
-    /**
-     * @param laneId the wake's lane (a chat id, or `agrn-<agreementId>`), sent as
-     *   X-Ziggs-Lane. It tells the backend which hire this wake is in, and the
-     *   backend reads off it WHO the spend is for. An agent that serves several
-     *   hirers holds all of their grants at once and the holder is the same agent
-     *   in every one, so without a lane, spend authority one customer gave is
-     *   spendable while the agent works for another. ConnectionsClient and
-     *   ArtifactsClient send the same header for the same reason.
-     *
-     *   Omitting it cannot widen anything — a stated lane can only cause a
-     *   refusal — but it does leave the spend unfenced, so a caller that knows
-     *   its lane should pass it.
-     */
-    constructor(operatorKey: string, agentId?: string, baseUrl?: string, laneId?: string);
+    /** Authority is supplied by withWorkExecution / withWorkExecutionId. */
+    constructor(operatorKey: string, agentId?: string, baseUrl?: string);
     balance(): Promise<WalletBalance>;
     resolve({ userId, agentId }?: {
         userId?: string;

package/dist/http/PaymentsClient.js

@@ -22,27 +22,13 @@ export class PaymentsClient {
     operatorKey;
     agentId;
     baseUrl;
-    laneId;
-    /**
-     * @param laneId the wake's lane (a chat id, or `agrn-<agreementId>`), sent as
-     *   X-Ziggs-Lane. It tells the backend which hire this wake is in, and the
-     *   backend reads off it WHO the spend is for. An agent that serves several
-     *   hirers holds all of their grants at once and the holder is the same agent
-     *   in every one, so without a lane, spend authority one customer gave is
-     *   spendable while the agent works for another. ConnectionsClient and
-     *   ArtifactsClient send the same header for the same reason.
-     *
-     *   Omitting it cannot widen anything — a stated lane can only cause a
-     *   refusal — but it does leave the spend unfenced, so a caller that knows
-     *   its lane should pass it.
-     */
-    constructor(operatorKey, agentId, baseUrl, laneId) {
+    /** Authority is supplied by withWorkExecution / withWorkExecutionId. */
+    constructor(operatorKey, agentId, baseUrl) {
         if (!operatorKey)
             throw new Error('PaymentsClient: operatorKey is required');
         this.operatorKey = operatorKey;
         this.agentId = agentId;
         this.baseUrl = baseUrl || getBackendUrl();
-        this.laneId = laneId;
     }
     async balance() {
         const w = (await this._get('/payments/wallet'));
@@ -87,7 +73,7 @@ export class PaymentsClient {
      * (retired GET /payments/grants), following the cursor to completion.
      */
     async listGrants() {
-        const grants = new GrantsClient(this.operatorKey, this.agentId, this.baseUrl, this.laneId);
+        const grants = new GrantsClient(this.operatorKey, this.agentId, this.baseUrl);
         return grants.listAllGrants({ scopeKind: 'wallet', health: 'active' });
     }
     async faucet({ amount, description = 'Faucet', idempotencyKey, } = {}) {
@@ -100,7 +86,7 @@ export class PaymentsClient {
     async _request(method, path, body) {
         const init = {
             method,
-            headers: buildOperatorHeaders(this.operatorKey, this.agentId, body !== undefined ? { 'content-type': 'application/json' } : {}, this.laneId),
+            headers: buildOperatorHeaders(this.operatorKey, this.agentId, body !== undefined ? { 'content-type': 'application/json' } : {}),
         };
         if (body !== undefined)
             init.body = JSON.stringify(body);

package/dist/http/SessionsClient.d.ts

@@ -0,0 +1,34 @@
+import type { Creds } from '../types.js';
+/** One awake window of an assistant. */
+export interface AssistantSessionRow {
+    sessionId: string;
+    name: string;
+    app: string;
+    startedAt: string;
+    lastSeenAt: string;
+    expiresAt: string;
+    workspaceIds: string[];
+    heldChatIds: string[];
+    awake: boolean;
+}
+/**
+ * List sibling windows and hold a chat in this one.
+ * Uses the same session headers as the inbox so "this window" is the
+ * X-Ziggs-Session the host already sends.
+ */
+export declare class SessionsClient {
+    private readonly creds;
+    constructor(creds: Creds);
+    private headers;
+    private url;
+    list(): Promise<AssistantSessionRow[]>;
+    /**
+     * Hold `chatId` in this window (omit sessionId; server resolves from
+     * X-Ziggs-Session), move it to `sessionId`, or pass null to release.
+     */
+    hold(chatId: string, sessionId?: string | null): Promise<{
+        success: true;
+        chatId: string;
+        sessionId: string | null;
+    }>;
+}

package/dist/http/SessionsClient.js

@@ -0,0 +1,72 @@
+import { getBackendUrl } from '../utils/urlUtils.js';
+import { pollSurfaceError } from '../shared/rateLimit.js';
+import { buildCredsHeaders } from './operatorHeaders.js';
+/**
+ * List sibling windows and hold a chat in this one.
+ * Uses the same session headers as the inbox so "this window" is the
+ * X-Ziggs-Session the host already sends.
+ */
+export class SessionsClient {
+    creds;
+    constructor(creds) {
+        this.creds = creds;
+        if (!creds.operatorKey)
+            throw new Error('SessionsClient: operatorKey is required');
+        if (!creds.agentId)
+            throw new Error('SessionsClient: agentId is required');
+    }
+    headers() {
+        const headers = buildCredsHeaders({
+            operatorKey: this.creds.operatorKey,
+            agentId: this.creds.agentId,
+            laneId: this.creds.laneId,
+        });
+        if (this.creds.clientSessionId)
+            headers['X-Ziggs-Session'] = this.creds.clientSessionId;
+        if (this.creds.workspaceIds)
+            headers['X-Ziggs-Workspaces'] = this.creds.workspaceIds;
+        if (this.creds.app)
+            headers['X-Ziggs-App'] = this.creds.app;
+        if (this.creds.sessionName)
+            headers['X-Ziggs-Session-Name'] = this.creds.sessionName;
+        if (this.creds.instanceId)
+            headers['X-Ziggs-Instance'] = this.creds.instanceId;
+        return headers;
+    }
+    url(path) {
+        return `${getBackendUrl()}/agents/${encodeURIComponent(this.creds.agentId)}${path}`;
+    }
+    async list() {
+        const res = await fetch(this.url('/sessions'), {
+            method: 'GET',
+            headers: this.headers(),
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok)
+            throw pollSurfaceError('SessionsClient.list', res, body);
+        const rows = body.sessions;
+        return Array.isArray(rows) ? rows : [];
+    }
+    /**
+     * Hold `chatId` in this window (omit sessionId; server resolves from
+     * X-Ziggs-Session), move it to `sessionId`, or pass null to release.
+     */
+    async hold(chatId, sessionId) {
+        if (!chatId?.trim())
+            throw new Error('SessionsClient.hold: chatId is required');
+        const body = {
+            chatId: chatId.trim(),
+        };
+        if (sessionId !== undefined)
+            body.sessionId = sessionId;
+        const res = await fetch(this.url('/sessions/hold'), {
+            method: 'POST',
+            headers: this.headers(),
+            body: JSON.stringify(body),
+        });
+        const parsed = await res.json().catch(() => ({}));
+        if (!res.ok)
+            throw pollSurfaceError('SessionsClient.hold', res, parsed);
+        return parsed;
+    }
+}

package/dist/http/TelemetryClient.js

@@ -1,6 +1,6 @@
 import { runtimeLog } from '../shared/runtimeLog.js';
 import { getBackendUrl } from '../utils/urlUtils.js';
-import { buildOperatorHeaders } from './operatorHeaders.js';
+import { buildOperatorHeaders, withoutExecution } from './operatorHeaders.js';
 export class TelemetryClient {
     operatorKey;
     agentId;
@@ -36,9 +36,9 @@ export class TelemetryClient {
         try {
             const res = await fetch(url, {
                 method: 'POST',
-                headers: buildOperatorHeaders(this.operatorKey, this.agentId, {
+                headers: withoutExecution(buildOperatorHeaders(this.operatorKey, this.agentId, {
                     'content-type': 'application/json',
-                }),
+                })),
                 body: JSON.stringify({ payload }),
             });
             if (!res.ok) {

package/dist/http/ToolPickClient.js

@@ -1,4 +1,4 @@
-import { buildCredsHeaders } from './operatorHeaders.js';
+import { buildCredsHeaders, withoutExecution } from './operatorHeaders.js';
 import { getBackendUrl } from '../utils/urlUtils.js';
 /** A listing is always the fallback, so waiting long for a pick buys nothing. */
 const TIMEOUT_MS = 6000;
@@ -15,7 +15,7 @@ export function backendToolPick(creds) {
         try {
             const res = await fetch(`${getBackendUrl()}/internal/tool-pick`, {
                 method: 'POST',
-                headers: buildCredsHeaders(creds),
+                headers: withoutExecution(buildCredsHeaders(creds)),
                 body: JSON.stringify({ need, options }),
                 signal: AbortSignal.timeout(TIMEOUT_MS),
             });

package/dist/http/index.d.ts

@@ -31,7 +31,9 @@ export type { MyOrg, OrgResolution } from './OrgsClient.js';
 export { AgentSearchClient } from './AgentSearchClient.js';
 export { TelemetryClient } from './TelemetryClient.js';
 export { InboxClient } from './InboxClient.js';
+export { SessionsClient } from './SessionsClient.js';
+export type { AssistantSessionRow } from './SessionsClient.js';
 export { planInboxAck, planPartialInboxAck, inboxAckAllowed, inboxAckHandledIds, } from '../inboxAck.js';
 export type { InboxAckDecision, InboxAckStep, InboxAckEnvelope, PlanInboxAckOptions, } from '../inboxAck.js';
-export { WAKE_LANE_HEADER, WAKE_AGREEMENT_HEADER, laneHeader, laneUnderAgreement, buildOperatorHeaders, buildCredsHeaders, } from './operatorHeaders.js';
+export { laneUnderAgreement, buildOperatorHeaders, buildCredsHeaders, } from './operatorHeaders.js';
 export { backendToolPick, type ToolPickOption, type ToolPickAnswer, type PickTool } from './ToolPickClient.js';

package/dist/http/index.js

@@ -21,9 +21,10 @@ export { fetchMyOrgs, resolveOrgSelector, fetchDelegateAccess, fetchHostedAgentA
 export { AgentSearchClient } from './AgentSearchClient.js';
 export { TelemetryClient } from './TelemetryClient.js';
 export { InboxClient } from './InboxClient.js';
+export { SessionsClient } from './SessionsClient.js';
 export { planInboxAck, planPartialInboxAck, inboxAckAllowed, inboxAckHandledIds, } from '../inboxAck.js';
 // The lane header, built in one place — see operatorHeaders.ts. Exported
 // because the MCP transports in agent-sdk and ziggs-mcp send it too, and a
 // copy of a header nobody notices missing goes stale unseen.
-export { WAKE_LANE_HEADER, WAKE_AGREEMENT_HEADER, laneHeader, laneUnderAgreement, buildOperatorHeaders, buildCredsHeaders, } from './operatorHeaders.js';
+export { laneUnderAgreement, buildOperatorHeaders, buildCredsHeaders, } from './operatorHeaders.js';
 export { backendToolPick } from './ToolPickClient.js';

package/dist/http/operatorHeaders.d.ts

@@ -1,4 +1,7 @@
+import type { WorkExecutionContext } from '@ziggs-ai/contracts';
 type AssistantHints = {
+    executionContext?: WorkExecutionContext;
+    executionContextId?: string;
     orgId?: string;
     resource?: string;
     clientSessionId?: string;
@@ -10,49 +13,24 @@ type AssistantHints = {
 /** Node-only, opt-in request context. Ordinary HTTP clients remain browser-safe. */
 export declare function withAssistantRequest<T>(hints: AssistantHints, run: () => T): Promise<Awaited<T>>;
 export declare function assistantRequestHeaders(): Record<string, string>;
-/**
- * Auth headers for operator-key HTTP clients.
- *
- * ONE place builds them, because the lane is the header a caller cannot be
- * trusted to remember. Omitting `X-Ziggs-Lane` never fails: the server fences
- * the wake to the agent's own org instead, so a door that forgets it answers
- * short lists and refuses grants the agent's customer gave it — silently, and
- * only for the agents that serve someone other than their owner. A header
- * whose absence is indistinguishable from a legitimate answer has to be built
- * in one place, not copied into each caller.
- */
-/** The header the backend's wake fence reads (`access/wake-fence.ts`). */
-export declare const WAKE_LANE_HEADER = "X-Ziggs-Lane";
-/**
- * The header naming the agreement a room wake works under. The backend takes
- * it only for an agreement the agent has mail under in that room, and reads
- * it off that mail when it is absent.
- */
-export declare const WAKE_AGREEMENT_HEADER = "X-Ziggs-Agreement";
-/**
- * A room lane that also names the agreement the wake works under:
- * `<chatId>@<agreementId>`. Every client already carries the lane to
- * {@link laneHeader}, so the agreement travels with it without a second
- * parameter on each of them. An `agrn-` lane already is its agreement.
- */
+/** A presentation routing key; it carries no authority. */
 export declare function laneUnderAgreement(laneId: string, agreementId?: string | null): string;
+export declare function buildOperatorHeaders(operatorKey: string, agentId?: string, extra?: Record<string, string>): Record<string, string>;
 /**
- * The lane headers, or nothing. `laneId` is a chat id, `agrn-<agreementId>`
- * for a task with no origin chat, or a chat id with the agreement the wake
- * works under (`<chatId>@<agreementId>`, see {@link laneUnderAgreement}).
- */
-export declare function laneHeader(laneId?: string): Record<string, string>;
-export declare function buildOperatorHeaders(operatorKey: string, agentId?: string, extra?: Record<string, string>, 
-/**
- * the lane this call belongs to, sent as `X-Ziggs-Lane`. The
- * backend narrows the wake's reach to the engagement's orgs; omitting it
- * narrows to the agent's own org, so it can never widen reach.
+ * The host's own calls (wake gate, telemetry, tool picker) are not work
+ * actions: they never carry the selected execution, so they neither need a
+ * route that supports one nor record anything into it.
  */
-laneId?: string): Record<string, string>;
+export declare function withoutExecution(headers: Record<string, string>): Record<string, string>;
 /** What a `Creds`-shaped client sends on a JSON call: auth, agent, lane. */
 export declare function buildCredsHeaders(creds: {
     operatorKey: string;
     agentId: string;
     laneId?: string;
+    executionContextId?: string;
 }): Record<string, string>;
+/** Async-local scope: parallel agreement positions never share request headers. */
+export declare function withWorkExecution<T>(executionContext: WorkExecutionContext | undefined, run: () => T): Promise<Awaited<T>>;
+export declare function currentWorkExecution(): WorkExecutionContext | undefined;
+export declare function withWorkExecutionId<T>(executionContextId: string | undefined, run: () => T): Promise<Awaited<T>>;
 export {};

package/dist/http/operatorHeaders.js

@@ -14,6 +14,7 @@ export async function withAssistantRequest(hints, run) {
 export function assistantRequestHeaders() {
     const hints = assistantRequest?.getStore();
     return {
+        ...((hints?.executionContextId ?? hints?.executionContext?.contextId) ? { 'X-Ziggs-Execution': (hints?.executionContextId ?? hints?.executionContext?.contextId) } : {}),
         ...(hints?.orgId ? { 'X-Workspace-Id': hints.orgId } : {}),
         ...(hints?.resource ? { 'X-Ziggs-Resource': hints.resource } : {}),
         ...(hints?.clientSessionId ? { 'X-Ziggs-Session': hints.clientSessionId } : {}),
@@ -23,73 +24,48 @@ export function assistantRequestHeaders() {
         ...(hints?.sessionName ? { 'X-Ziggs-Session-Name': hints.sessionName } : {}),
     };
 }
-/**
- * Auth headers for operator-key HTTP clients.
- *
- * ONE place builds them, because the lane is the header a caller cannot be
- * trusted to remember. Omitting `X-Ziggs-Lane` never fails: the server fences
- * the wake to the agent's own org instead, so a door that forgets it answers
- * short lists and refuses grants the agent's customer gave it — silently, and
- * only for the agents that serve someone other than their owner. A header
- * whose absence is indistinguishable from a legitimate answer has to be built
- * in one place, not copied into each caller.
- */
-/** The header the backend's wake fence reads (`access/wake-fence.ts`). */
-export const WAKE_LANE_HEADER = 'X-Ziggs-Lane';
-/**
- * The header naming the agreement a room wake works under. The backend takes
- * it only for an agreement the agent has mail under in that room, and reads
- * it off that mail when it is absent.
- */
-export const WAKE_AGREEMENT_HEADER = 'X-Ziggs-Agreement';
-/**
- * A room lane that also names the agreement the wake works under:
- * `<chatId>@<agreementId>`. Every client already carries the lane to
- * {@link laneHeader}, so the agreement travels with it without a second
- * parameter on each of them. An `agrn-` lane already is its agreement.
- */
+/** A presentation routing key; it carries no authority. */
 export function laneUnderAgreement(laneId, agreementId) {
     if (!agreementId || laneId.startsWith('agrn-') || laneId.includes('@'))
         return laneId;
     return `${laneId}@${agreementId}`;
 }
-/**
- * The lane headers, or nothing. `laneId` is a chat id, `agrn-<agreementId>`
- * for a task with no origin chat, or a chat id with the agreement the wake
- * works under (`<chatId>@<agreementId>`, see {@link laneUnderAgreement}).
- */
-export function laneHeader(laneId) {
-    if (!laneId)
-        return {};
-    const at = laneId.indexOf('@');
-    if (at <= 0)
-        return { [WAKE_LANE_HEADER]: laneId };
-    return {
-        [WAKE_LANE_HEADER]: laneId.slice(0, at),
-        [WAKE_AGREEMENT_HEADER]: laneId.slice(at + 1),
-    };
-}
-export function buildOperatorHeaders(operatorKey, agentId, extra, 
-/**
- * the lane this call belongs to, sent as `X-Ziggs-Lane`. The
- * backend narrows the wake's reach to the engagement's orgs; omitting it
- * narrows to the agent's own org, so it can never widen reach.
- */
-laneId) {
+export function buildOperatorHeaders(operatorKey, agentId, extra) {
     return {
         Authorization: `Bearer ${operatorKey}`,
         ...assistantRequestHeaders(),
         // `X-Agent-Id` is only sent when an agentId is present — agent-scoped keys
         // identify the agent themselves; fleet keys must pass one.
         ...(agentId ? { 'X-Agent-Id': agentId } : {}),
-        ...laneHeader(laneId),
         ...extra,
     };
 }
+/**
+ * The host's own calls (wake gate, telemetry, tool picker) are not work
+ * actions: they never carry the selected execution, so they neither need a
+ * route that supports one nor record anything into it.
+ */
+export function withoutExecution(headers) {
+    const out = { ...headers };
+    delete out['X-Ziggs-Execution'];
+    delete out['x-ziggs-execution'];
+    return out;
+}
 /** What a `Creds`-shaped client sends on a JSON call: auth, agent, lane. */
 export function buildCredsHeaders(creds) {
     return {
         'content-type': 'application/json',
-        ...buildOperatorHeaders(creds.operatorKey, creds.agentId, undefined, creds.laneId),
+        ...(creds.executionContextId ? { 'X-Ziggs-Execution': creds.executionContextId } : {}),
+        ...buildOperatorHeaders(creds.operatorKey, creds.agentId),
     };
 }
+/** Async-local scope: parallel agreement positions never share request headers. */
+export async function withWorkExecution(executionContext, run) {
+    return withAssistantRequest({ ...assistantRequest?.getStore(), executionContext, executionContextId: executionContext?.contextId }, run);
+}
+export function currentWorkExecution() {
+    return assistantRequest?.getStore()?.executionContext;
+}
+export async function withWorkExecutionId(executionContextId, run) {
+    return withAssistantRequest({ ...assistantRequest?.getStore(), executionContextId: executionContextId ?? assistantRequest?.getStore()?.executionContextId }, run);
+}