agentfootprint 10.3.0 → 10.4.0

package/dist/esm/hosting/pendingAsk.d.ts

@@ -0,0 +1,19 @@
+/**
+ * pendingAsk — what a paused run is waiting on, as data a door may hand back.
+ *
+ * ONE projection, used by every door that keeps a paused run for a later
+ * request (`standingAgent`, `streamHandler`): the question, never the state.
+ */
+import type { RunnerPauseOutcome } from '../core/pause.js';
+import type { PendingAsk } from './types.js';
+/**
+ * Project a paused run into the part that is safe to hand back: the question,
+ * never the state.
+ *
+ * Every field is read from what the run actually recorded — the tool name and
+ * question the dispatch loop stamps on `pauseData`, the typed `checkIn`, the
+ * middleware `ask`. A field the run did not record is simply absent. Nothing
+ * here infers, summarises or invents, which is why the raw `pauseData` rides
+ * along untouched: the tool's author chose those words.
+ */
+export declare function describePause(outcome: RunnerPauseOutcome, sessionId: string | undefined): PendingAsk;

package/dist/esm/hosting/pendingAsk.js

@@ -0,0 +1,38 @@
+/**
+ * pendingAsk — what a paused run is waiting on, as data a door may hand back.
+ *
+ * ONE projection, used by every door that keeps a paused run for a later
+ * request (`standingAgent`, `streamHandler`): the question, never the state.
+ */
+import { readAskComponent } from '../tools/askComponent.js';
+/**
+ * Project a paused run into the part that is safe to hand back: the question,
+ * never the state.
+ *
+ * Every field is read from what the run actually recorded — the tool name and
+ * question the dispatch loop stamps on `pauseData`, the typed `checkIn`, the
+ * middleware `ask`. A field the run did not record is simply absent. Nothing
+ * here infers, summarises or invents, which is why the raw `pauseData` rides
+ * along untouched: the tool's author chose those words.
+ */
+export function describePause(outcome, sessionId) {
+    const data = outcome.pauseData;
+    const tool = typeof data?.toolName === 'string' ? data.toolName : undefined;
+    const question = typeof data?.question === 'string' ? data.question : undefined;
+    // The typed half of the question (9.24.0), lifted from whichever pause kind
+    // carried it — a plain ask keeps it at the top of `pauseData`, a check-in on
+    // the typed request, a middleware ask on the question. `readAskComponent` is
+    // the one reader of those homes; this projection is where a screen looks.
+    const component = readAskComponent(outcome.pauseData);
+    return {
+        ...(sessionId !== undefined && { sessionId }),
+        ...(tool !== undefined && { tool }),
+        ...(question !== undefined && { question }),
+        ...(outcome.checkIn !== undefined && { checkIn: outcome.checkIn }),
+        ...(outcome.ask !== undefined && { ask: outcome.ask }),
+        ...(outcome.awaitingInput !== undefined && { awaitingInput: outcome.awaitingInput }),
+        ...(component !== undefined && { component }),
+        pauseData: outcome.pauseData,
+    };
+}
+//# sourceMappingURL=pendingAsk.js.map

package/dist/esm/hosting/pendingAsk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pendingAsk.js","sourceRoot":"","sources":["../../../src/hosting/pendingAsk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAI5D;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA2B,EAC3B,SAA6B;IAE7B,MAAM,IAAI,GAAG,OAAO,CAAC,SAAmE,CAAC;IACzF,MAAM,IAAI,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAChF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO;QACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAClE,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACtD,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;QACpF,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC"}

package/dist/esm/hosting/protocolAdapter.d.ts

@@ -0,0 +1,229 @@
+/**
+ * protocolAdapter — the port a wire protocol implements to speak for a run.
+ *
+ * OUR side of the port is the run's typed event stream, exactly as the record
+ * serves it (every listener's view: the placeholder wherever a redaction policy
+ * selected a value), and how the run settled. A protocol adapter turns that
+ * into its own events; a framing strategy (`stream.ts` · `SseFraming`) turns
+ * each of those into bytes. AG-UI (`agentfootprint/ag-ui`) is one adapter; a
+ * future protocol is one more, with no change to the runner, the event stream
+ * or the framing seam.
+ *
+ * An adapter reads the SERVED stream only. That is the whole redaction story
+ * for every protocol at once: what a policy hides never reaches an adapter, so
+ * no adapter can put it on a wire.
+ *
+ * A host that serves a protocol over a request (`streamHandler`) asks one more
+ * thing of it — {@link ProtocolAdapter}: read a request as UNTRUSTED input, and
+ * plan the turn from it and from what the SERVER holds for the conversation.
+ * The request decides nothing the server owns: who is calling, which thread is
+ * theirs, what was said before, what a paused run is waiting on.
+ */
+import type { AgentfootprintEvent } from '../events/registry.js';
+import type { MemoryIdentity } from '../memory/identity/types.js';
+import type { Tool } from '../tools/tools.js';
+import type { SseFraming } from './stream.js';
+import type { PendingAsk } from './types.js';
+/** How a run ended, as an adapter is told — once, after its last event. */
+export type RunSettlement = 
+/** `run()` resolved with an answer. */
+{
+    readonly kind: 'finished';
+}
+/**
+ * `run()` resolved with a pause (its `pause.request` came first). `awaiting`
+ * says on whom: a PERSON's answer (the default — an approval, a question), or
+ * the CALLER's — a tool whose work the caller does (an AG-UI frontend tool),
+ * whose result arrives with the caller's next request. Read by whoever ran
+ * the run from the pause it got back, never from a served value.
+ */
+ | {
+    readonly kind: 'paused';
+    readonly awaiting?: 'person' | 'caller';
+}
+/** The run was stopped by whoever was running it, and did not fail. */
+ | {
+    readonly kind: 'cancelled';
+}
+/**
+ * `run()` rejected. Deliberately carries NOTHING of the rejection: the
+ * thrown value is the caller's own, never served — its message, stack or a
+ * provider's response body may hold anything — so an adapter is never
+ * handed it. It states the failure in the words of the record's served
+ * `error.fatal` event when the run filed one, else in fixed words of its own.
+ */
+ | {
+    readonly kind: 'failed';
+};
+/**
+ * One run's translation into a protocol's events. Opened per run, fed every
+ * served event of that run in order, then settled exactly once; whatever it
+ * must remember between events (open messages, ids it minted) lives in it.
+ */
+export interface RunTranslation<TEvent> {
+    /** The protocol events one served event of the run means — zero, one or several. */
+    event(event: AgentfootprintEvent): readonly TEvent[];
+    /** The closing events. After this, `event` returns nothing. */
+    settle(settlement: RunSettlement): readonly TEvent[];
+    /**
+     * What the protocol needs to continue this run in a later request once it
+     * pauses — the ids it hands the caller for the answer. Plain JSON, kept with
+     * the paused run.
+     *
+     * Asked BEFORE settling `'paused'` (with the same `awaiting`), it is the
+     * record that settlement will hand out — so a host stores the pause first
+     * and tells the caller only once it is kept (and settles `'failed'` when it
+     * could not be). Asked after, it is what the pause handed out; after any
+     * other settlement, `undefined`. Optional: a protocol with nothing to
+     * remember omits it.
+     */
+    suspension?(awaiting?: 'person' | 'caller'): unknown;
+}
+/** One request as the host read it — UNTRUSTED: a body anyone could have sent. */
+export interface ProtocolRequestFacts {
+    /** The request's JSON body, parsed. */
+    readonly body: unknown;
+    /** Header names lower-cased. */
+    readonly headers: Readonly<Record<string, string>>;
+}
+/**
+ * The app's port: WHO is calling, and which of their conversations a request
+ * continues.
+ *
+ * A request NAMES a conversation (AG-UI's `threadId`); naming one proves
+ * nothing — anyone can send any id. So the host never keys anything by the
+ * named id: it hands it, with the request's headers, to this port, which
+ * authenticates the caller the app's own way (a session cookie, a bearer
+ * token through `verifyRequestIdentity`) and answers with the key the server
+ * keeps that conversation under — or refuses (throw a `WireRequestRefusal`,
+ * or an `IdentityNotVerifiedError`, and the caller gets its status). Two
+ * callers naming the same id must get two keys, or one refusal.
+ */
+export interface ThreadBinder {
+    bind(claim: {
+        /** The conversation the request names — format-checked caller data, never authority. */
+        readonly conversation: string;
+        /** The request's headers, names lower-cased — where a credential travels. */
+        readonly headers: Readonly<Record<string, string>>;
+    }): ThreadBinding | Promise<ThreadBinding>;
+}
+/** A conversation bound to the caller the app authenticated. */
+export interface ThreadBinding {
+    /**
+     * The server-side key of the conversation — the session its stored turns,
+     * its paused run and the agent's memory are kept under. Never the named id
+     * alone: compose it from the authenticated caller.
+     */
+    readonly sessionId: string;
+    /**
+     * Who the run is for — the run's `identity` (memory namespaces on it, a
+     * credential provider scopes its vault on it, a stored conversation records
+     * its `principal` as the owner). From the app's authentication, never from
+     * a request body.
+     */
+    readonly identity?: MemoryIdentity;
+}
+/** What the SERVER holds for the bound conversation — nothing a request carried. */
+export interface HeldConversation {
+    /** A stored conversation the turn continues (an Agent's). */
+    readonly continues: boolean;
+    /** The run waiting on an answer, when one is: what it asked, and what the protocol recorded. */
+    readonly awaiting?: {
+        readonly pending: PendingAsk;
+        /** The protocol's own record of the pause (`RunTranslation.suspension`) — absent when another wire stored it. */
+        readonly suspension?: unknown;
+    };
+}
+/** What a request asks of its conversation: a new message, or the answer a paused run waits on. */
+export type ProtocolTurn = {
+    readonly kind: 'message';
+    readonly message: string;
+} | {
+    readonly kind: 'answer';
+    readonly answer: unknown;
+};
+/** What the host knows when a protocol plans a turn. */
+export interface PlanFacts {
+    /** The request's headers, names lower-cased. */
+    readonly headers: Readonly<Record<string, string>>;
+    /** The bound conversation — absent when the host binds none. */
+    readonly thread?: ThreadBinding;
+    /**
+     * The host keeps the conversation: it binds threads, so a run has a session
+     * the agent's memory or the session store keeps. Without it, every request is
+     * a conversation of one message.
+     */
+    readonly keepsConversation: boolean;
+    /** The host keeps a paused run until the next request (threads AND a session store). */
+    readonly keepsPauses: boolean;
+}
+/** One request's plan: the turn, and what this request's runner is built with. */
+export interface ProtocolPlan {
+    readonly turn: ProtocolTurn;
+    /** Tools the CALLER runs this request (AG-UI frontend tools) — see {@link StreamRunContext.tools}. */
+    readonly tools?: readonly Tool[];
+    /** Request values the app's own validators accepted, by name. */
+    readonly accepted?: Readonly<Record<string, unknown>>;
+}
+/**
+ * What one request's runner is built with — handed to the host's runner
+ * factory (`streamHandler({ agent })`), which builds a FRESH runner for every
+ * request.
+ */
+export interface StreamRunContext {
+    /**
+     * The tools this request lets the CALLER run: AG-UI frontend tools the app
+     * allow-listed and the page declared. Add them to the agent's own tools
+     * (`.tools([...yours, ...run.tools])`). Each runs nothing on the server: a
+     * call pauses the run, the page runs it, and its result arrives with the
+     * page's next request. A name a server tool already has is refused when the
+     * agent is built — a frontend tool never shadows a server tool.
+     */
+    readonly tools: readonly Tool[];
+    /** Request values the app's own validators accepted, by name (AG-UI: `state`, `context`). */
+    readonly accepted: Readonly<Record<string, unknown>>;
+    /** The conversation this request was bound to — absent when the host binds none. */
+    readonly thread?: ThreadBinding;
+}
+/**
+ * A wire protocol a host serves runs in — `streamHandler({ agent, adapter })`.
+ * AG-UI (`agUi()` from `agentfootprint/ag-ui`) is one; a future protocol is one
+ * more adapter, with nothing in the host to change.
+ *
+ * Every method that reads the request treats it as UNTRUSTED: shapes are
+ * checked field by field and refused by the field's NAME (a
+ * `WireRequestRefusal`, whose status and code reach the caller), never by
+ * echoing what was sent.
+ */
+export interface ProtocolAdapter<TRequest, TEvent> {
+    /** Names the protocol — in refusals, and on a paused run's wire record. */
+    readonly name: string;
+    /** Read a request's body. Nothing here trusts it, and nothing the server holds is read. */
+    readRequest(facts: ProtocolRequestFacts): TRequest;
+    /** The conversation the request NAMES — handed to the host's {@link ThreadBinder}, never used as a key. */
+    conversation(request: TRequest): string;
+    /**
+     * Plan the turn from the request and what the server holds for its bound
+     * conversation. Refuse what cannot be served — an answer to nothing, a new
+     * message while a run waits on an answer, anything the protocol carries that
+     * the app did not accept.
+     */
+    plan(request: TRequest, held: HeldConversation, facts: PlanFacts): ProtocolPlan;
+    /**
+     * Does a pause wait on the CALLER — a tool this protocol let the caller run?
+     * Read from the pause's own data (the host's, never served); absent means
+     * every pause waits on a person.
+     */
+    awaitsCaller?(pauseData: unknown): boolean;
+    /**
+     * One translation per run. `resumed` is this protocol's own record of the
+     * pause the run continues ({@link HeldConversation.awaiting}), when the turn
+     * answers one.
+     */
+    open(request: TRequest, resumed?: unknown): RunTranslation<TEvent>;
+    /**
+     * How its events are written — built once per host, so a framing that loads
+     * an optional peer refuses when the host is built, not mid-request.
+     */
+    framing(): SseFraming<TEvent>;
+}

package/dist/esm/hosting/protocolAdapter.js

@@ -0,0 +1,23 @@
+/**
+ * protocolAdapter — the port a wire protocol implements to speak for a run.
+ *
+ * OUR side of the port is the run's typed event stream, exactly as the record
+ * serves it (every listener's view: the placeholder wherever a redaction policy
+ * selected a value), and how the run settled. A protocol adapter turns that
+ * into its own events; a framing strategy (`stream.ts` · `SseFraming`) turns
+ * each of those into bytes. AG-UI (`agentfootprint/ag-ui`) is one adapter; a
+ * future protocol is one more, with no change to the runner, the event stream
+ * or the framing seam.
+ *
+ * An adapter reads the SERVED stream only. That is the whole redaction story
+ * for every protocol at once: what a policy hides never reaches an adapter, so
+ * no adapter can put it on a wire.
+ *
+ * A host that serves a protocol over a request (`streamHandler`) asks one more
+ * thing of it — {@link ProtocolAdapter}: read a request as UNTRUSTED input, and
+ * plan the turn from it and from what the SERVER holds for the conversation.
+ * The request decides nothing the server owns: who is calling, which thread is
+ * theirs, what was said before, what a paused run is waiting on.
+ */
+export {};
+//# sourceMappingURL=protocolAdapter.js.map

package/dist/esm/hosting/protocolAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocolAdapter.js","sourceRoot":"","sources":["../../../src/hosting/protocolAdapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG"}

package/dist/esm/hosting/refusalStatus.d.ts

@@ -0,0 +1,30 @@
+/**
+ * refusalStatus — the HTTP status every hosting refusal answers with, by its
+ * code. ONE table, read by every door that speaks HTTP (`httpHost` and the
+ * adapters built on it, `streamHandler`), so the same refusal never answers
+ * with two statuses at two doors.
+ */
+/**
+ * Status codes mapped by refusal code. Anything else is a 500.
+ *
+ * Not one of them is a 5xx: none of them is the agent breaking. A closed host is
+ * shutting down (503); four are conflicts with the state the session is already
+ * in (409) — a run already going, a question already outstanding, a decision
+ * with nothing to decide, a pause this reply cannot describe. A 500 would tell
+ * every dashboard that ever sees it something untrue.
+ *
+ * `ERR_DECISION_REQUIRED` is the one 400 (8.13.0): the session is in a perfectly
+ * consistent state and it is the REQUEST that is wrong — it answered a consent
+ * gate with a value instead of a decision. Nothing ran and the pause is still
+ * there, so the same caller can send the right shape and continue.
+ *
+ * The artifact rows (9.23.0) follow the same reading. The two 400s are
+ * requests the same caller can fix (a malformed wire op; an op with no
+ * session). `ERR_ARTIFACT_NOT_FOUND` is 404 — the honest HTTP word for "no
+ * data at this name", and deliberately ONE status for missing, expired and
+ * another-session's alike, so the wire teaches a caller nothing about scopes
+ * it does not own. The two 501s are deployments that cannot do this at all —
+ * an agent without a store, a wire without the body shape — which no retry
+ * and no different request will change.
+ */
+export declare const REFUSAL_STATUS: Readonly<Record<string, number>>;

package/dist/esm/hosting/refusalStatus.js

@@ -0,0 +1,81 @@
+/**
+ * refusalStatus — the HTTP status every hosting refusal answers with, by its
+ * code. ONE table, read by every door that speaks HTTP (`httpHost` and the
+ * adapters built on it, `streamHandler`), so the same refusal never answers
+ * with two statuses at two doors.
+ */
+/**
+ * Status codes mapped by refusal code. Anything else is a 500.
+ *
+ * Not one of them is a 5xx: none of them is the agent breaking. A closed host is
+ * shutting down (503); four are conflicts with the state the session is already
+ * in (409) — a run already going, a question already outstanding, a decision
+ * with nothing to decide, a pause this reply cannot describe. A 500 would tell
+ * every dashboard that ever sees it something untrue.
+ *
+ * `ERR_DECISION_REQUIRED` is the one 400 (8.13.0): the session is in a perfectly
+ * consistent state and it is the REQUEST that is wrong — it answered a consent
+ * gate with a value instead of a decision. Nothing ran and the pause is still
+ * there, so the same caller can send the right shape and continue.
+ *
+ * The artifact rows (9.23.0) follow the same reading. The two 400s are
+ * requests the same caller can fix (a malformed wire op; an op with no
+ * session). `ERR_ARTIFACT_NOT_FOUND` is 404 — the honest HTTP word for "no
+ * data at this name", and deliberately ONE status for missing, expired and
+ * another-session's alike, so the wire teaches a caller nothing about scopes
+ * it does not own. The two 501s are deployments that cannot do this at all —
+ * an agent without a store, a wire without the body shape — which no retry
+ * and no different request will change.
+ */
+export const REFUSAL_STATUS = Object.freeze({
+    ERR_HOST_CLOSED: 503,
+    ERR_CONCURRENT_RUN: 409,
+    ERR_PAUSE_NOT_CARRIED: 409,
+    ERR_AWAITING_DECISION: 409,
+    ERR_NO_PENDING_ASK: 409,
+    ERR_DECISION_REQUIRED: 400,
+    ERR_INPUT_REQUEST_INVALID: 400,
+    ERR_INVALID_WIRE_OP: 400,
+    ERR_ARTIFACT_SESSION_REQUIRED: 400,
+    ERR_ARTIFACT_NOT_FOUND: 404,
+    ERR_NO_ARTIFACT_STORE: 501,
+    ERR_ARTIFACT_NOT_CARRIED: 501,
+    // explain-answer — a recording over the host's `answerAccounts` ceiling. 413:
+    // the request is fine and the record exists; it is too large to explain HERE.
+    ERR_RECORDING_TOO_LARGE_FOR_ACCOUNT: 413,
+    // One session over its in-flight artifact-op bound — back off and retry.
+    ERR_ARTIFACT_OPS_BUSY: 429,
+    // 9.26.0 — the badge, the bouncer and the history desk.
+    //   401: this caller was not identified (a token that did not verify, or one
+    //        that was never presented at a door that insists).
+    //   503: the VERIFIER could not answer — an outage on this side, and telling
+    //        every client to re-authenticate against an unreachable provider is
+    //        the wrong instruction at the worst moment.
+    //   429: admission said no. The one status a client is expected to back off
+    //        on, which is exactly what a spend bound wants it to do.
+    //   404: a transcript this caller may not have — one answer for missing,
+    //        foreign and owner-less alike.
+    //   501: the door was never given what the op needs (no verifier, no owner
+    //        index, no wire body shape) — a gap in THIS deployment, not a bad
+    //        request the caller could fix by sending something else.
+    ERR_IDENTITY_NOT_VERIFIED: 401,
+    ERR_IDENTITY_VERIFIER_UNAVAILABLE: 503,
+    ERR_ADMISSION_REFUSED: 429,
+    ERR_SESSION_NOT_FOUND: 404,
+    ERR_SESSION_OP_NEEDS_IDENTITY: 501,
+    ERR_SESSION_INDEX_UNAVAILABLE: 501,
+    ERR_SESSIONS_NOT_CARRIED: 501,
+    ERR_REQUEST_TOO_LARGE: 413,
+    // The door guard — each refusal also carries its own `status`, which is what
+    // this host answers with; listed here too so a handler that fails a reply
+    // with one of them gets the same status and never a 500.
+    //   415: a request that changes something did not say it was JSON.
+    //   403: a browser page from an origin this door does not allow.
+    //   421: a Host this door was not configured to answer for (RFC 9110 §15.5.20).
+    //   400: a session id over the ceiling or with a control character in it.
+    ERR_UNSUPPORTED_MEDIA_TYPE: 415,
+    ERR_ORIGIN_NOT_ALLOWED: 403,
+    ERR_HOST_NOT_ALLOWED: 421,
+    ERR_INVALID_SESSION_ID: 400,
+});
+//# sourceMappingURL=refusalStatus.js.map

package/dist/esm/hosting/refusalStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusalStatus.js","sourceRoot":"","sources":["../../../src/hosting/refusalStatus.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC5E,eAAe,EAAE,GAAG;IACpB,kBAAkB,EAAE,GAAG;IACvB,qBAAqB,EAAE,GAAG;IAC1B,qBAAqB,EAAE,GAAG;IAC1B,kBAAkB,EAAE,GAAG;IACvB,qBAAqB,EAAE,GAAG;IAC1B,yBAAyB,EAAE,GAAG;IAC9B,mBAAmB,EAAE,GAAG;IACxB,6BAA6B,EAAE,GAAG;IAClC,sBAAsB,EAAE,GAAG;IAC3B,qBAAqB,EAAE,GAAG;IAC1B,wBAAwB,EAAE,GAAG;IAC7B,8EAA8E;IAC9E,8EAA8E;IAC9E,mCAAmC,EAAE,GAAG;IACxC,yEAAyE;IACzE,qBAAqB,EAAE,GAAG;IAC1B,wDAAwD;IACxD,6EAA6E;IAC7E,2DAA2D;IAC3D,6EAA6E;IAC7E,4EAA4E;IAC5E,oDAAoD;IACpD,4EAA4E;IAC5E,iEAAiE;IACjE,yEAAyE;IACzE,uCAAuC;IACvC,2EAA2E;IAC3E,0EAA0E;IAC1E,iEAAiE;IACjE,yBAAyB,EAAE,GAAG;IAC9B,iCAAiC,EAAE,GAAG;IACtC,qBAAqB,EAAE,GAAG;IAC1B,qBAAqB,EAAE,GAAG;IAC1B,6BAA6B,EAAE,GAAG;IAClC,6BAA6B,EAAE,GAAG;IAClC,wBAAwB,EAAE,GAAG;IAC7B,qBAAqB,EAAE,GAAG;IAC1B,6EAA6E;IAC7E,0EAA0E;IAC1E,yDAAyD;IACzD,mEAAmE;IACnE,iEAAiE;IACjE,gFAAgF;IAChF,0EAA0E;IAC1E,0BAA0B,EAAE,GAAG;IAC/B,sBAAsB,EAAE,GAAG;IAC3B,oBAAoB,EAAE,GAAG;IACzB,sBAAsB,EAAE,GAAG;CAC5B,CAAC,CAAC"}

package/dist/esm/hosting/standingAgent.js

@@ -99,8 +99,7 @@
  */
 import { isDevMode } from 'footprintjs';
 import { bindArtifacts, } from '../artifacts/capability.js';
-import { readAskComponent } from '../core/askComponent.js';
-import { applyInputResponse, readAwaitingInput } from '../core/inputRequest.js';
+import { applyInputResponse, readAwaitingInput } from '../tools/inputRequest.js';
 import { isPaused, pauseDemandsDecision } from '../core/pause.js';
 import { ANSWER_ACCOUNT_OP, artifactOpWireName, NOT_A_REF, } from './artifactWire.js';
 import { answerAccounts } from './answerAccounts.js';
@@ -108,6 +107,7 @@ import { isArtifactRef } from '../artifacts/naming.js';
 import { RECORDING_ARTIFACT_KIND } from '../artifacts/recordingArtifact.js';
 import { refuseUnknownWireOp } from './wireOps.js';
 import { durableWriter } from './durability.js';
+import { describePause } from './pendingAsk.js';
 import { envelopeOwner, envelopeTranscript, readEnvelope, readPausedRun, toEnvelope, toPausedEnvelope, } from './envelope.js';
 import { AdmissionRefusedError, ArtifactNotCarriedError, ArtifactOpsBusyError, ArtifactNotFoundError, ArtifactSessionRequiredError, AwaitingDecisionError, ConcurrentRunError, HostClosedError, IdentityNotVerifiedError, RequestArtifactsRevokedError, InvalidWireOpError, NoArtifactStoreError, NoPendingAskError, PauseNotCarriedError, RecordingTooLargeForAccountError, SessionIndexUnavailableError, SessionNotFoundError, SessionOpNeedsIdentityError, SessionsNotCarriedError, UnreadableEnvelopeError, VerifierUnavailableError, } from './errors.js';
 import { checkSessionId } from './doorGuard.js';
@@ -2001,36 +2001,6 @@ function emitArtifactFact(agent, fact, attribution) {
             return;
     }
 }
-/**
- * Project a paused run into the part that is safe to hand back: the question,
- * never the state.
- *
- * Every field is read from what the run actually recorded — the tool name and
- * question the dispatch loop stamps on `pauseData`, the typed `checkIn`, the
- * middleware `ask`. A field the run did not record is simply absent. Nothing
- * here infers, summarises or invents, which is why the raw `pauseData` rides
- * along untouched: the tool's author chose those words.
- */
-function describePause(outcome, sessionId) {
-    const data = outcome.pauseData;
-    const tool = typeof data?.toolName === 'string' ? data.toolName : undefined;
-    const question = typeof data?.question === 'string' ? data.question : undefined;
-    // The typed half of the question (9.24.0), lifted from whichever pause kind
-    // carried it — a plain ask keeps it at the top of `pauseData`, a check-in on
-    // the typed request, a middleware ask on the question. `readAskComponent` is
-    // the one reader of those homes; this projection is where a screen looks.
-    const component = readAskComponent(outcome.pauseData);
-    return {
-        ...(sessionId !== undefined && { sessionId }),
-        ...(tool !== undefined && { tool }),
-        ...(question !== undefined && { question }),
-        ...(outcome.checkIn !== undefined && { checkIn: outcome.checkIn }),
-        ...(outcome.ask !== undefined && { ask: outcome.ask }),
-        ...(outcome.awaitingInput !== undefined && { awaitingInput: outcome.awaitingInput }),
-        ...(component !== undefined && { component }),
-        pauseData: outcome.pauseData,
-    };
-}
 /**
  * Transport headers as the verifier reads them: string values only. A header
  * that arrived as an array (repeated) is dropped — except `authorization`,