agentfootprint 13.0.0 → 14.0.0

package/dist/esm/core/agent/stages/toolCalls/access/callState.js

@@ -0,0 +1,75 @@
+/** Initialize the original result, fill and execution cells at one synchronous call boundary. */
+export function prepareCallState(tc, findingsRefusal, resolutions, inputs, args) {
+    const outcome = {
+        result: findingsRefusal,
+        error: findingsRefusal === undefined ? undefined : true,
+        /** The typed effects channel (9.19.0) — set only when the tool
+         *  returned a recognized result envelope; everything else keeps
+         *  today's path byte for byte. */
+        toolEnvelope: undefined,
+        toolStatus: findingsRefusal === undefined ? undefined : 'invalid',
+    };
+    // Permission gate — when a checker is configured, evaluate BEFORE
+    // executing the tool. Emits `permission.check` with the decision.
+    //
+    // v2.12 — three terminal results:
+    //   • 'allow' / 'gate_open' → tool executes normally
+    //   • 'deny'                → synthetic tool_result lands; LLM continues
+    //   • 'halt'                → synthetic tool_result lands; run terminates
+    //                             via scope.$break + Agent.run throws
+    //                             PolicyHaltError at the API boundary
+    //
+    // Strict ordering on halt: synthetic tool_result → halt event →
+    // commit (newHistory written to scope) → $break. This guarantees
+    // the audit trail is complete before the run terminates, so
+    // `agent.resumeOnError(checkpoint)` sees consistent state.
+    //
+    // The checker receives the in-flight sequence (derived from
+    // scope.history), full conversation history, current iteration,
+    // identity, and abort signal — enough surface to build sequence-
+    // aware policies (forbidden chains, idempotency limits, cost
+    // guards) without maintaining parallel state.
+    // Args as they will actually be used. The middleware chain below may
+    // replace this; everything downstream (validation, the check-in
+    // evidence a human approves, credentials, execute, the read_skill
+    // gate) reads `callArgs`, never `tc.args`, so there is exactly one
+    // answer to "what did this call really run with". Seeded from the
+    // PEELED `args` (9.101.0), which is `tc.args` itself when unarmed.
+    // ── THE INPUTS LAYER'S ENTRY FOR THIS CALL (honesty layer 2) ──────
+    // Applied AFTER `tool_start` (which keeps the model's proposal) and
+    // BEFORE the permission check, so policy judges the call that will
+    // really run. A fill is a FRESH object — never an edit of `tc.args`,
+    // which is the assistant message's own object when `.findings()` is
+    // off. No entry (every unarmed agent) → `args` itself, by reference.
+    const resolution = resolutions?.get(tc.id);
+    const runArgs = inputs !== undefined ? inputs.withFills(args, resolution) : args;
+    const callArguments = {
+        callArgs: runArgs,
+        /** The arguments AFTER the before-tool chain and BEFORE a `wants`
+         *  resolution swaps refs for artifact data — what `changedArgKeys` is
+         *  judged on. Same reference as `args` unless a link rewrote (or the
+         *  inputs layer filled a value — then every filled key is named). */
+        chainedArgs: runArgs,
+    };
+    const execution = {
+        denied: findingsRefusal !== undefined,
+        /** True once `tool.execute` has been entered — see `afterMoment`. */
+        executed: false,
+        /** The declared argument's value handed to `execute`, read just before it ran. */
+        submittedProgram: undefined,
+        /** `execute` was entered and threw — a settlement the script row reads. */
+        executeThrew: false,
+        /** The code-run facts a code-runner tool left for this call (`takeCodeRun`). */
+        ranCode: undefined,
+        /** The tool's own `resultCeiling` (not the column contract) refused the result. */
+        withheldOverCeiling: false,
+        negativeDispatch: undefined,
+        /** The tool's own `resultCeiling` refused this call's result (9.20.0)
+         *  — the call ran, but it must not complete a procedure step: the
+         *  refusal's own instruction is to call again. */
+        ceilingRefused: false,
+        haltContext: undefined,
+    };
+    return { outcome, resolution, runArgs, callArguments, execution };
+}
+//# sourceMappingURL=callState.js.map

package/dist/esm/core/agent/stages/toolCalls/access/callState.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callState.js","sourceRoot":"","sources":["../../../../../../../src/core/agent/stages/toolCalls/access/callState.ts"],"names":[],"mappings":"AAQA,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAC9B,EAAgB,EAChB,eAAkD,EAClD,WAAqE,EACrE,MAAkC,EAClC,IAA4B;IAE5B,MAAM,OAAO,GAAmB;QAC9B,MAAM,EAAE,eAAe;QACvB,KAAK,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACvD;;0CAEkC;QAClC,YAAY,EAAE,SAAS;QACvB,UAAU,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC;IACF,kEAAkE;IAClE,kEAAkE;IAClE,EAAE;IACF,kCAAkC;IAClC,qDAAqD;IACrD,yEAAyE;IACzE,0EAA0E;IAC1E,kEAAkE;IAClE,kEAAkE;IAClE,EAAE;IACF,gEAAgE;IAChE,iEAAiE;IACjE,4DAA4D;IAC5D,2DAA2D;IAC3D,EAAE;IACF,4DAA4D;IAC5D,gEAAgE;IAChE,iEAAiE;IACjE,6DAA6D;IAC7D,8CAA8C;IAC9C,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,qEAAqE;IACrE,MAAM,UAAU,GAAG,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAa,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3F,MAAM,aAAa,GAAkB;QACnC,QAAQ,EAAE,OAAO;QACjB;;;6EAGqE;QACrE,WAAW,EAAE,OAAO;KACrB,CAAC;IACF,MAAM,SAAS,GAAkB;QAC/B,MAAM,EAAE,eAAe,KAAK,SAAS;QACrC,qEAAqE;QACrE,QAAQ,EAAE,KAAK;QACf,kFAAkF;QAClF,gBAAgB,EAAE,SAAS;QAC3B,2EAA2E;QAC3E,YAAY,EAAE,KAAK;QACnB,gFAAgF;QAChF,OAAO,EAAE,SAAS;QAClB,mFAAmF;QACnF,mBAAmB,EAAE,KAAK;QAC1B,gBAAgB,EAAE,SAAS;QAC3B;;0DAEkD;QAClD,cAAc,EAAE,KAAK;QACrB,WAAW,EAAE,SAAS;KACvB,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC"}

package/dist/esm/core/agent/stages/toolCalls/access/capabilityQuestion.d.ts

@@ -0,0 +1,28 @@
+import type { CallArguments, CallExecution, CallResultCell } from '../contracts/callCells.js';
+import type { buildCallStart } from '../execution/callStart.js';
+import type { ToolCallsHandlerDeps } from '../contracts/handlerDeps.js';
+import type { TypedScope } from 'footprintjs';
+import type { AgentState } from '../../../types.js';
+import type { PermissionCapability } from '../../../../../provider-contract/types.js';
+import type { DispatchCall } from '../contracts/batchCall.js';
+type CallStartFacts = ReturnType<ReturnType<typeof buildCallStart>['beginDispatchCall']>;
+interface CapabilityQuestionBindings {
+    readonly permissionChecker: ToolCallsHandlerDeps['permissionChecker'];
+    readonly viewOf: CallStartFacts['viewOf'];
+    readonly historyForCallbacks: CallStartFacts['historyForCallbacks'];
+    readonly iteration: number;
+    readonly runIdentity: {
+        tenant?: string;
+        principal?: string;
+        conversationId: string;
+    } | undefined;
+    readonly env: ReturnType<TypedScope<AgentState>['$getEnv']>;
+    readonly emitSecurity: CallStartFacts['emitSecurity'];
+    readonly tc: DispatchCall;
+    readonly callArguments: CallArguments;
+    readonly execution: CallExecution;
+    readonly outcome: CallResultCell;
+}
+/** Bind the existing per-call capability question to its original live cells. */
+export declare function buildCapabilityQuestion(bindings: CapabilityQuestionBindings): (capability: PermissionCapability, target: string, genericHaltText: string) => Promise<void>;
+export {};

package/dist/esm/core/agent/stages/toolCalls/access/capabilityQuestion.js

@@ -0,0 +1,77 @@
+import { checkerContextOf } from './bindings.js';
+import { warnFrozenWrite } from '../../../../../lib/frozenCopy.js';
+/** Bind the existing per-call capability question to its original live cells. */
+export function buildCapabilityQuestion(bindings) {
+    /**
+     * Ask the checker about ONE capability beyond `'tool_call'`, and apply
+     * the verdict exactly as the gate above applies its own (9.11.0).
+     *
+     * Called only when BOTH sides declared the capability, so a checker
+     * that never opted in is never asked and never has to answer a
+     * question it was not written for. `sequence` is deliberately absent —
+     * the port says it is empty for non-`tool_call` capabilities, and the
+     * in-flight tool sequence is not evidence about a capability.
+     */
+    const askCapability = async (capability, target, genericHaltText) => {
+        if (!bindings.permissionChecker)
+            return;
+        try {
+            const decision = await bindings.permissionChecker.check({
+                capability,
+                actor: 'agent',
+                target,
+                context: checkerContextOf(bindings.viewOf(bindings.callArguments.callArgs)),
+                history: bindings.historyForCallbacks(),
+                iteration: bindings.iteration,
+                ...(bindings.runIdentity && { identity: bindings.runIdentity }),
+                ...(bindings.env.signal && { signal: bindings.env.signal }),
+            });
+            bindings.emitSecurity('agentfootprint.permission.check', {
+                capability,
+                actor: 'agent',
+                target,
+                result: decision.result,
+                ...(decision.policyRuleId !== undefined && { policyRuleId: decision.policyRuleId }),
+                ...(decision.rationale !== undefined && { rationale: decision.rationale }),
+                ...(decision.reason !== undefined && { reason: decision.reason }),
+            });
+            if (decision.result === 'deny') {
+                bindings.execution.denied = true;
+                bindings.outcome.result =
+                    decision.tellLLM ?? `[permission denied: ${decision.rationale ?? 'policy'}]`;
+            }
+            else if (decision.result === 'halt') {
+                bindings.execution.denied = true;
+                // Same reasoning as the tool_call halt: `reason` is a telemetry
+                // tag and teaching the model the rule space is not a service.
+                const tellLLM = decision.tellLLM ?? genericHaltText;
+                bindings.outcome.result = tellLLM;
+                bindings.execution.haltContext = {
+                    reason: decision.reason ?? decision.rationale ?? 'policy-halt',
+                    tellLLM,
+                    ...(bindings.permissionChecker.name && { checkerId: bindings.permissionChecker.name }),
+                };
+            }
+        }
+        catch (permErr) {
+            warnFrozenWrite('permission checker', permErr, 'the call was denied');
+            // Fail closed, and say so terminally — the 9.4.0 lesson applies
+            // whole: an operator's outage text reads as weather to a model.
+            bindings.execution.denied = true;
+            const msg = permErr instanceof Error ? permErr.message : String(permErr);
+            bindings.emitSecurity('agentfootprint.permission.check', {
+                capability,
+                actor: 'agent',
+                target,
+                result: 'deny',
+                rationale: `permission-checker threw: ${msg}`,
+            });
+            bindings.outcome.result =
+                `[permission denied: Tool '${bindings.tc.name}' could not be authorized. This will not ` +
+                    `change during this run — do not call it again. Continue without it, or say ` +
+                    `what you are unable to do.]`;
+        }
+    };
+    return askCapability;
+}
+//# sourceMappingURL=capabilityQuestion.js.map

package/dist/esm/core/agent/stages/toolCalls/access/capabilityQuestion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilityQuestion.js","sourceRoot":"","sources":["../../../../../../../src/core/agent/stages/toolCalls/access/capabilityQuestion.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAmBnE,iFAAiF;AACjF,MAAM,UAAU,uBAAuB,CAAC,QAAoC;IAC1E;;;;;;;;;OASG;IACH,MAAM,aAAa,GAAG,KAAK,EACzB,UAAgC,EAChC,MAAc,EACd,eAAuB,EACR,EAAE;QACjB,IAAI,CAAC,QAAQ,CAAC,iBAAiB;YAAE,OAAO;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC;gBACtD,UAAU;gBACV,KAAK,EAAE,OAAO;gBACd,MAAM;gBACN,OAAO,EAAE,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC3E,OAAO,EAAE,QAAQ,CAAC,mBAAmB,EAAE;gBACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC/D,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;aAC5D,CAAC,CAAC;YACH,QAAQ,CAAC,YAAY,CAAC,iCAAiC,EAAE;gBACvD,UAAU;gBACV,KAAK,EAAE,OAAO;gBACd,MAAM;gBACN,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACnF,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC1E,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC/B,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;gBACjC,QAAQ,CAAC,OAAO,CAAC,MAAM;oBACrB,QAAQ,CAAC,OAAO,IAAI,uBAAuB,QAAQ,CAAC,SAAS,IAAI,QAAQ,GAAG,CAAC;YACjF,CAAC;iBAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;gBACjC,gEAAgE;gBAChE,8DAA8D;gBAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC;gBACpD,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;gBAClC,QAAQ,CAAC,SAAS,CAAC,WAAW,GAAG;oBAC/B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,IAAI,aAAa;oBAC9D,OAAO;oBACP,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;iBACvF,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YACjB,eAAe,CAAC,oBAAoB,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;YACtE,gEAAgE;YAChE,gEAAgE;YAChE,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC;YACjC,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzE,QAAQ,CAAC,YAAY,CAAC,iCAAiC,EAAE;gBACvD,UAAU;gBACV,KAAK,EAAE,OAAO;gBACd,MAAM;gBACN,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,6BAA6B,GAAG,EAAE;aAC9C,CAAC,CAAC;YACH,QAAQ,CAAC,OAAO,CAAC,MAAM;gBACrB,6BAA6B,QAAQ,CAAC,EAAE,CAAC,IAAI,2CAA2C;oBACxF,6EAA6E;oBAC7E,6BAA6B,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IACF,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/esm/core/agent/stages/toolCalls/access/checkInAdmission.d.ts

@@ -0,0 +1,44 @@
+import type { buildCallStart } from '../execution/callStart.js';
+import type { buildDispatchContext } from '../batch/dispatchContext.js';
+import type { buildToolSettlementOperations } from '../batch/settlementOperations.js';
+import type { CallArguments, CallConsentGate, CallResultCell } from '../contracts/callCells.js';
+import type { InputsDispatch } from '../contracts/inputsDispatch.js';
+import type { buildToolArtifactsOperations } from '../execution/artifactsOperations.js';
+import type { buildToolScriptsOperations } from '../evidence/scriptsOperations.js';
+import type { TypedScope } from 'footprintjs';
+import type { AgentState } from '../../../types.js';
+import type { ToolCallsHandlerDeps } from '../contracts/handlerDeps.js';
+import { type CheckInRequest } from '../../../../checkin.js';
+import { type DecisionLedger } from '../../../../consentRequest.js';
+import type { DispatchCall } from '../contracts/batchCall.js';
+type CallStartFacts = ReturnType<ReturnType<typeof buildCallStart>['beginDispatchCall']>;
+type DispatchContext = ReturnType<ReturnType<typeof buildDispatchContext>['prepareDispatchContext']>;
+interface AdmitCheckInCallFrame {
+    readonly historyForCheckIn: ReturnType<typeof buildToolSettlementOperations>['historyForCheckIn'];
+    readonly historyForCallbacks: CallStartFacts['historyForCallbacks'];
+    readonly tool: NonNullable<CallStartFacts['tool']>;
+    readonly viewOf: CallStartFacts['viewOf'];
+    readonly callArguments: CallArguments;
+    readonly iteration: number;
+    readonly tc: DispatchCall;
+    readonly askedLayer: InputsDispatch | undefined;
+    readonly resolved: CallStartFacts['resolved'];
+    readonly decisionLedger: DecisionLedger;
+    readonly consentGate: CallConsentGate;
+    readonly outcome: CallResultCell;
+    readonly resolution: ReturnType<ReturnType<InputsDispatch['resolutionsFor']>['get']>;
+    readonly assertComponentDeliverable: ReturnType<typeof buildToolArtifactsOperations>['assertComponentDeliverable'];
+    readonly env: DispatchContext['env'];
+    readonly newHistory: DispatchContext['newHistory'];
+    readonly startMs: CallStartFacts['startMs'];
+    readonly fileScript: ReturnType<typeof buildToolScriptsOperations>['fileScript'];
+    readonly proposedProgram: CallStartFacts['proposedProgram'];
+    readonly programOfCall: ReturnType<typeof buildToolScriptsOperations>['programOfCall'];
+}
+/** Existing checkInAdmission body; the owning handler retains its admission guard and native pause return. */
+export declare function admitCheckInCall(scope: TypedScope<AgentState>, deps: Pick<ToolCallsHandlerDeps, 'checkIn'>, frame: AdmitCheckInCallFrame): Promise<{
+    toolCallId: string;
+    toolName: string;
+    checkIn: CheckInRequest;
+} | undefined>;
+export {};

package/dist/esm/core/agent/stages/toolCalls/access/checkInAdmission.js

@@ -0,0 +1,140 @@
+import { shouldCheckIn } from '../../../../checkin.js';
+import { mintConsentRequest, } from '../../../../consentRequest.js';
+import { unboundCallRefusal } from './bindings.js';
+import { warnFrozenWrite } from '../../../../../lib/frozenCopy.js';
+import { typedEmit } from '../../../../../recorders/core/typedEmit.js';
+import { shownArgsOf } from '../../../../toolShownArgs.js';
+import { markPrivateCheckIn, requirePrivateQuestionSupport, } from '../../../arguments/privateAnswers.js';
+/** Existing checkInAdmission body; the owning handler retains its admission guard and native pause return. */
+export async function admitCheckInCall(scope, deps, frame) {
+    // Computed ONLY for a checkIn-declaring tool → zero cost otherwise.
+    // Shape shared with the ask-resume gate; see `historyForCheckIn`.
+    const historyForEvidence = frame.historyForCheckIn(scope, frame.historyForCallbacks());
+    const trips = shouldCheckIn(frame.tool.checkIn, frame.viewOf(frame.callArguments.callArgs) ?? frame.callArguments.callArgs, {
+        iteration: frame.iteration,
+        toolCallId: frame.tc.id,
+        history: historyForEvidence,
+    });
+    if (trips && frame.askedLayer === undefined)
+        requirePrivateQuestionSupport(scope, [frame.tool]);
+    // The request the person would be asked (`core/consentRequest.ts`):
+    // an id their decision must quote, bound to a detached copy of this
+    // exact call — minted only for a call that is about to pause.
+    const bound = trips && frame.askedLayer === undefined
+        ? mintConsentRequest({
+            gate: 'checkIn',
+            tool: frame.tc.name,
+            toolCallId: frame.tc.id,
+            party: frame.resolved.party,
+            args: frame.callArguments.callArgs,
+        }, frame.decisionLedger)
+        : undefined;
+    // What the person is shown — and the evidence assembler and every
+    // `checkin.request` listener handed: the call's shared frozen copy
+    // (equal to `bound.args`, which was copied from the same arguments).
+    // The paused state keeps `bound.args`, the copy the request is bound
+    // to, so nothing that sees the question can change the call the
+    // answer runs.
+    const shown = bound === undefined ? undefined : frame.viewOf(shownArgsOf(frame.tool, bound.args));
+    if (!trips) {
+        // Predicate said no — fall through to the normal credential+execute
+        // path below (this `if` block is the ONLY thing the gate adds).
+    }
+    else if (frame.askedLayer !== undefined) {
+        // One human question per resume (honesty layer 2, step 4): this
+        // batch already paused to ask the person for argument values, and
+        // the re-run that carries the answer has no second pause to give.
+        // The gate's question is not asked and the tool does not run.
+        frame.consentGate.checkInRefused = true;
+        frame.outcome.error = true;
+        // The person's answers the call carried are kept for its next
+        // proposal, where the check-in pauses as it always does.
+        frame.outcome.result =
+            frame.askedLayer.secondPauseRefusal(frame.tc.name, 'check-in') +
+                frame.askedLayer.keptNote(scope, frame.tc.name, frame.resolution, frame.tool, frame.callArguments.callArgs);
+    }
+    else if (bound === undefined || shown === undefined) {
+        // A call no approval could be bound to is refused, never asked.
+        frame.consentGate.checkInRefused = true;
+        frame.outcome.error = true;
+        frame.outcome.result = unboundCallRefusal(frame.tc.name, 'checkIn');
+    }
+    else {
+        markPrivateCheckIn(scope, frame.tool, bound.args);
+        // The tool's declared decision component (9.24.0), judged BEFORE
+        // the evidence pack is assembled — a gate that cannot be honored
+        // as declared refuses before any work, and a dangling propsRef is
+        // refused at this source rather than discovered by the screen.
+        const gateComponent = frame.tool.checkInComponent !== undefined
+            ? await frame.assertComponentDeliverable(scope, frame.tc.name, frame.tool.checkInComponent, `tool '${frame.tc.name}' checkInComponent`)
+            : undefined;
+        const intent = scope.llmLatestContent ? String(scope.llmLatestContent) : undefined;
+        let evidence;
+        try {
+            evidence = await deps.checkIn.assembler({
+                tool: { name: frame.tc.name, description: frame.tool.schema.description },
+                args: shown,
+                ...(intent !== undefined && { intent }),
+                iteration: frame.iteration,
+                history: historyForEvidence,
+                scorer: deps.checkIn.scorer,
+                ...(frame.env.signal && { signal: frame.env.signal }),
+            });
+        }
+        catch (err) {
+            // An assembler that wrote into its frozen arguments fails the
+            // check-in as any throw does — said once, in dev mode.
+            warnFrozenWrite('check-in evidence assembler', err, 'the check-in failed');
+            throw err;
+        }
+        const request = {
+            id: bound.request.id,
+            tool: frame.tc.name,
+            args: shown,
+            ...(intent !== undefined && { intent }),
+            evidence,
+            ...(gateComponent !== undefined && { component: gateComponent }),
+        };
+        typedEmit(scope, 'agentfootprint.checkin.request', {
+            toolName: frame.tc.name,
+            toolCallId: frame.tc.id,
+            iteration: frame.iteration,
+            request: request,
+        });
+        // Commit partial state so resume() finds history intact (mirror the
+        // pauseHere path). The bound copy of the args rides the checkpoint,
+        // so an APPROVED tool executes exactly what was asked.
+        scope.history = frame.newHistory;
+        scope.pausedToolCallId = frame.tc.id;
+        scope.pausedToolName = frame.tc.name;
+        scope.pausedToolStartMs = frame.startMs;
+        scope.pausedCheckIn = true;
+        scope.pausedCheckInArgs = bound.args;
+        scope.pausedRequest = bound.request;
+        // Same carrier as the middleware-ask pause (9.92.0).
+        if (frame.resolved.party !== undefined)
+            scope.pausedToolParty = frame.resolved.party;
+        // Which surface will collect the decision — read back on resume
+        // so `checkin.decision` says which component ANSWERED. Written
+        // only when one exists (byte-identical otherwise).
+        if (gateComponent !== undefined)
+            scope.pausedComponentId = gateComponent.componentId;
+        // Open until a person decides: `submitted`, without the text.
+        frame.fileScript(scope, {
+            tool: frame.tool,
+            toolName: frame.tc.name,
+            toolCallId: frame.tc.id,
+            iteration: frame.iteration,
+            proposed: frame.proposedProgram,
+            submitted: frame.programOfCall(frame.tool, bound.args),
+            settlement: 'not-entered',
+            paused: true,
+        });
+        // Returning a defined value triggers the footprintjs pause; the
+        // returned object becomes the checkpoint's pauseData. detectPause
+        // surfaces `pauseData.checkIn` as `outcome.checkIn`.
+        return { toolCallId: frame.tc.id, toolName: frame.tc.name, checkIn: request };
+    }
+    return undefined;
+}
+//# sourceMappingURL=checkInAdmission.js.map

package/dist/esm/core/agent/stages/toolCalls/access/checkInAdmission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkInAdmission.js","sourceRoot":"","sources":["../../../../../../../src/core/agent/stages/toolCalls/access/checkInAdmission.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAuB,MAAM,wBAAwB,CAAC;AAC5E,OAAO,EACL,kBAAkB,GAGnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,4CAA4C,CAAC;AAEvE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,6BAA6B,GAC9B,MAAM,sCAAsC,CAAC;AAgC9C,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA6B,EAC7B,IAA2C,EAC3C,KAA4B;IAE5B,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,kBAAkB,GAAG,KAAK,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,aAAa,CACzB,KAAK,CAAC,IAAI,CAAC,OAAQ,EACnB,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,EAC1E;QACE,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;QACvB,OAAO,EAAE,kBAAkB;KAC5B,CACF,CAAC;IACF,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,6BAA6B,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChG,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,KAAK,GACT,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QACrC,CAAC,CAAC,kBAAkB,CAChB;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACnB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;YAC3B,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,QAAQ;SACf,EACrB,KAAK,CAAC,cAAc,CACrB;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,kEAAkE;IAClE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,gEAAgE;IAChE,eAAe;IACf,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,oEAAoE;QACpE,gEAAgE;IAClE,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC1C,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,8DAA8D;QAC9D,KAAK,CAAC,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QAC3B,8DAA8D;QAC9D,yDAAyD;QACzD,KAAK,CAAC,OAAO,CAAC,MAAM;YAClB,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;gBAC9D,KAAK,CAAC,UAAU,CAAC,QAAQ,CACvB,KAAK,EACL,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,aAAa,CAAC,QAAQ,CAC7B,CAAC;IACN,CAAC;SAAM,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,gEAAgE;QAChE,KAAK,CAAC,WAAW,CAAC,cAAc,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtE,CAAC;SAAM,CAAC;QACN,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,aAAa,GACjB,KAAK,CAAC,IAAI,CAAC,gBAAgB,KAAK,SAAS;YACvC,CAAC,CAAC,MAAM,KAAK,CAAC,0BAA0B,CACpC,KAAK,EACL,KAAK,CAAC,EAAE,CAAC,IAAI,EACb,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAC3B,SAAS,KAAK,CAAC,EAAE,CAAC,IAAI,oBAAoB,CAC3C;YACH,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnF,IAAI,QAAoC,CAAC;QACzC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAQ,CAAC,SAAS,CAAC;gBACvC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;gBACzE,IAAI,EAAE,KAAK;gBACX,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,kBAAkB;gBAC3B,MAAM,EAAE,IAAI,CAAC,OAAQ,CAAC,MAAM;gBAC5B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,8DAA8D;YAC9D,uDAAuD;YACvD,eAAe,CAAC,6BAA6B,EAAE,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAC3E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAmB;YAC9B,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE;YACpB,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACnB,IAAI,EAAE,KAAK;YACX,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;YACvC,QAAQ;YACR,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC;SACjE,CAAC;QACF,SAAS,CAAC,KAAK,EAAE,gCAAgC,EAAE;YACjD,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAuD;SACjE,CAAC,CAAC;QACH,oEAAoE;QACpE,oEAAoE;QACpE,uDAAuD;QACvD,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC;QACjC,KAAK,CAAC,gBAAgB,GAAG,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC;QACxC,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;QAC3B,KAAK,CAAC,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC;QACrC,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,OAAO,CAAC;QACpC,qDAAqD;QACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrF,gEAAgE;QAChE,+DAA+D;QAC/D,mDAAmD;QACnD,IAAI,aAAa,KAAK,SAAS;YAAE,KAAK,CAAC,iBAAiB,GAAG,aAAa,CAAC,WAAW,CAAC;QACrF,8DAA8D;QAC9D,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI;YACvB,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;YACvB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,eAAe;YAC/B,SAAS,EAAE,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;YACtD,UAAU,EAAE,aAAa;YACzB,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,gEAAgE;QAChE,kEAAkE;QAClE,qDAAqD;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/esm/core/agent/stages/toolCalls/access/heldAnswer.d.ts

@@ -0,0 +1,8 @@
+import type { ToolMiddleware } from '../../../middleware/types.js';
+import { type DecisionLedger } from '../../../../consentRequest.js';
+import type { TypedScope } from 'footprintjs';
+import type { AgentState } from '../../../types.js';
+import type { ConsentGateKind } from '../../../../pause.js';
+import type { CheckInDecision } from '../../../../checkin.js';
+/** Bind a resumed consent decision using the current middleware view. */
+export declare function buildHeldAnswer(readMiddleware: () => readonly ToolMiddleware[] | undefined, decisionLedger: DecisionLedger): (scope: TypedScope<AgentState>, input: unknown, gate: ConsentGateKind) => CheckInDecision;

package/dist/esm/core/agent/stages/toolCalls/access/heldAnswer.js

@@ -0,0 +1,35 @@
+import { heldDecision, gatedCallOf } from '../../../../consentRequest.js';
+/** Bind a resumed consent decision using the current middleware view. */
+export function buildHeldAnswer(readMiddleware, decisionLedger) {
+    /**
+     * The decision a consent-gate resume carries, held to the request this run
+     * paused on and to the exact call it was bound to (`core/consentRequest.ts`)
+     * — or a `ResumeDecisionError` / `DecisionRequiredError`, thrown before
+     * anything about the call runs. Pure: the decision is spent by the branch
+     * that USES it (`spendDecision`), so a resume stopped before that (a refused
+     * findings reference) leaves it unspent.
+     *
+     * THE door every resume of a consent gate passes through: an agent's own
+     * `resume()` asks the same pure question first, but a composition resumes a
+     * nested agent's chart directly, and only this handler sees every decision
+     * that is used. So this is where a request is held and spent, once.
+     */
+    const heldAnswer = (scope, input, gate) => {
+        const read = (key) => scope.$getValue(key);
+        const toolName = read('pausedToolName');
+        const middleware = gate === 'ask' ? read('pausedAskMiddleware') : undefined;
+        return heldDecision(input, {
+            kind: gate,
+            ...(typeof toolName === 'string' && { toolName }),
+            ...(typeof middleware === 'string' && { middleware }),
+        }, read('pausedRequest'), gatedCallOf(read, gate), 
+        // An ask's approval holds only for the rules it was asked under — this
+        // agent's chain, by link name.
+        (readMiddleware() ?? []).map((link) => link.name), 
+        // …and a request minted under a ledger that can prove is spent only
+        // there: never silently in this agent's ledger if it is another one.
+        decisionLedger);
+    };
+    return heldAnswer;
+}
+//# sourceMappingURL=heldAnswer.js.map

package/dist/esm/core/agent/stages/toolCalls/access/heldAnswer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heldAnswer.js","sourceRoot":"","sources":["../../../../../../../src/core/agent/stages/toolCalls/access/heldAnswer.ts"],"names":[],"mappings":"AACA,OAAO,EAAuB,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAM/F,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAC7B,cAA2D,EAC3D,cAA8B;IAE9B;;;;;;;;;;;;OAYG;IACH,MAAM,UAAU,GAAG,CACjB,KAA6B,EAC7B,KAAc,EACd,IAAqB,EACJ,EAAE;QACnB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,OAAO,YAAY,CACjB,KAAK,EACL;YACE,IAAI,EAAE,IAAI;YACV,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,EAAE,QAAQ,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,EAAE,UAAU,EAAE,CAAC;SACtD,EACD,IAAI,CAAC,eAAe,CAAC,EACrB,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,uEAAuE;QACvE,+BAA+B;QAC/B,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QACjD,oEAAoE;QACpE,qEAAqE;QACrE,cAAc,CACf,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/esm/core/agent/stages/toolCalls/access/middlewareAdmission.d.ts

@@ -0,0 +1,50 @@
+import type { buildCallStart } from '../execution/callStart.js';
+import type { buildDispatchContext } from '../batch/dispatchContext.js';
+import type { CallArguments, CallExecution, CallResultCell } from '../contracts/callCells.js';
+import type { InputsDispatch } from '../contracts/inputsDispatch.js';
+import type { buildToolArtifactsOperations } from '../execution/artifactsOperations.js';
+import type { buildToolScriptsOperations } from '../evidence/scriptsOperations.js';
+import type { TypedScope } from 'footprintjs';
+import type { AgentState } from '../../../types.js';
+import type { ToolCallsHandlerDeps } from '../contracts/handlerDeps.js';
+import { type DecisionLedger } from '../../../../consentRequest.js';
+import type { DispatchCall } from '../contracts/batchCall.js';
+type CallStartFacts = ReturnType<ReturnType<typeof buildCallStart>['beginDispatchCall']>;
+type DispatchContext = ReturnType<ReturnType<typeof buildDispatchContext>['prepareDispatchContext']>;
+interface AdmitMiddlewareCallFrame {
+    readonly tc: DispatchCall;
+    readonly tool: CallStartFacts['tool'];
+    readonly iteration: number;
+    readonly callArguments: CallArguments;
+    readonly historyForCallbacks: CallStartFacts['historyForCallbacks'];
+    readonly runIdentity: DispatchContext['runIdentity'];
+    readonly env: DispatchContext['env'];
+    readonly oneQuestionAsked: boolean;
+    readonly resolved: CallStartFacts['resolved'];
+    readonly decisionLedger: DecisionLedger;
+    readonly inputs: InputsDispatch | undefined;
+    readonly invalidateViews: CallStartFacts['invalidateViews'];
+    readonly execution: CallExecution;
+    readonly outcome: CallResultCell;
+    readonly askedLayer: InputsDispatch | undefined;
+    readonly resolution: ReturnType<ReturnType<InputsDispatch['resolutionsFor']>['get']>;
+    readonly assertComponentDeliverable: ReturnType<typeof buildToolArtifactsOperations>['assertComponentDeliverable'];
+    readonly newHistory: DispatchContext['newHistory'];
+    readonly startMs: CallStartFacts['startMs'];
+    readonly fileScript: ReturnType<typeof buildToolScriptsOperations>['fileScript'];
+    readonly proposedProgram: CallStartFacts['proposedProgram'];
+    readonly programOfCall: ReturnType<typeof buildToolScriptsOperations>['programOfCall'];
+}
+/** Existing middlewareAdmission body; the owning handler retains its admission guard and native pause return. */
+export declare function admitMiddlewareCall(scope: TypedScope<AgentState>, deps: Pick<ToolCallsHandlerDeps, 'toolMiddleware'>, frame: AdmitMiddlewareCallFrame): Promise<{
+    toolCallId: string;
+    toolName: string;
+    ask: {
+        middleware: string;
+        id: string;
+        question: string;
+        detail?: unknown;
+        component?: import("../../../../../index.js").AskComponent | undefined;
+    };
+} | undefined>;
+export {};

package/dist/esm/core/agent/stages/toolCalls/access/middlewareAdmission.js

@@ -0,0 +1,137 @@
+import { runToolChain } from '../../../../../tools/runChain.js';
+import { mintConsentRequest, } from '../../../../consentRequest.js';
+import { unboundAskRows, unboundCallRefusal } from './bindings.js';
+import { recordDecisions } from '../../../middleware/ledger.js';
+/** Existing middlewareAdmission body; the owning handler retains its admission guard and native pause return. */
+export async function admitMiddlewareCall(scope, deps, frame) {
+    const chain = await runToolChain(deps.toolMiddleware, {
+        toolName: frame.tc.name,
+        // Provenance from the tool that is about to run, so a policy can
+        // scope to the server that served it. Absent for our own tools.
+        ...(frame.tool?.source !== undefined && { toolSource: frame.tool.source }),
+        toolCallId: frame.tc.id,
+        iteration: frame.iteration,
+        args: frame.callArguments.callArgs,
+        history: frame.historyForCallbacks(),
+        ...(frame.runIdentity && { identity: frame.runIdentity }),
+        ...(frame.env.signal && { signal: frame.env.signal }),
+        // One human question per resume: this batch already asked the
+        // person for argument values, so a link that also wants a person
+        // gets the chain's named refusal and the tool does not run.
+        ...(frame.oneQuestionAsked && { askPolicy: 'refuse' }),
+    });
+    // The rules the asked call still has to pass once the person
+    // answers: the asking link and every link after it, by name.
+    const askChain = chain.kind === 'ask'
+        ? deps.toolMiddleware.slice(chain.index).map((link) => link.name)
+        : undefined;
+    // The request the person would be asked (`core/consentRequest.ts`):
+    // an id their decision must quote, bound to a detached copy of this
+    // exact call — the args AS TRANSFORMED SO FAR, where the chain
+    // resumes and the rules from there on. Minted only for a call that
+    // is about to pause.
+    const bound = chain.kind === 'ask'
+        ? mintConsentRequest({
+            gate: 'ask',
+            tool: frame.tc.name,
+            toolCallId: frame.tc.id,
+            party: frame.resolved.party,
+            args: chain.args,
+            middleware: chain.middleware,
+            askIndex: chain.index,
+            chain: askChain,
+        }, frame.decisionLedger)
+        : undefined;
+    // An ask no approval could be bound to asked nobody, and its row
+    // says so (`unboundAskRows`).
+    const chainRows = chain.kind === 'ask' && bound === undefined
+        ? unboundAskRows(chain.decisions, chain.middleware, chain.payload.question)
+        : chain.decisions;
+    // Under the inputs layer, a rewrite of a RULED tool's arguments is
+    // filed with the NAMES of the keys it changed (honesty layer 2) —
+    // the answer's standing reads a rewritten ruled argument with no
+    // declared origin as assumed. Every other row: as it always was.
+    recordDecisions(scope, frame.inputs !== undefined ? frame.inputs.decisionsToRecord(frame.tool, chainRows) : chainRows);
+    frame.callArguments.callArgs = chain.args;
+    frame.callArguments.chainedArgs = chain.args;
+    // The links were handed the live arguments (a link rewrites by what
+    // it hands back, and may have edited them in place): the shared
+    // frozen copy is made again from what the chain handed back.
+    frame.invalidateViews();
+    if (chain.kind === 'deny') {
+        frame.execution.denied = true;
+        // A link that ASKED, refused by the one-question law: the person's
+        // answers this call carried are kept for its next proposal.
+        frame.outcome.result =
+            chain.refusedAsk === true && frame.askedLayer !== undefined
+                ? chain.reason +
+                    frame.askedLayer.keptNote(scope, frame.tc.name, frame.resolution, frame.tool, frame.callArguments.callArgs)
+                : chain.reason;
+    }
+    else if (chain.kind === 'ask' && bound === undefined) {
+        // A call no approval could be bound to is refused, never asked.
+        frame.execution.denied = true;
+        frame.outcome.error = true;
+        frame.outcome.result = unboundCallRefusal(frame.tc.name, 'ask');
+    }
+    else if (chain.kind === 'ask' && bound !== undefined) {
+        // The typed half of the question (9.24.0), judged BEFORE anything
+        // is committed: a component the screen could not render must
+        // refuse here, at the source, not pause and be discovered. The
+        // `ask()` constructor already checked the shape; a hand-built
+        // outcome literal bypasses it, so the shape is re-asserted at
+        // this boundary (cheap, idempotent) along with the propsRef
+        // resolution only a raise site can judge. Asks without a
+        // component skip all of it.
+        const askComponent = chain.payload.component !== undefined
+            ? await frame.assertComponentDeliverable(scope, frame.tc.name, chain.payload.component, `ask middleware '${chain.middleware}'`)
+            : undefined;
+        // Commit partial state so resume() finds history intact (the
+        // pauseHere / check-in path does the same). The TRANSFORMED args
+        // ride the checkpoint — the bound copy: a person approves what the
+        // chain produced, not what the model originally proposed.
+        scope.history = frame.newHistory;
+        scope.pausedToolCallId = frame.tc.id;
+        scope.pausedToolName = frame.tc.name;
+        scope.pausedToolStartMs = frame.startMs;
+        scope.pausedAsk = true;
+        scope.pausedAskArgs = bound.args;
+        scope.pausedAskIndex = chain.index;
+        scope.pausedAskMiddleware = chain.middleware;
+        scope.pausedAskChain = askChain;
+        scope.pausedRequest = bound.request;
+        // The party this call was resolved against (9.92.0) — so a resume
+        // in a FRESH instance dispatches to the same party, never to the
+        // build-time map's first holder. Pause-path-only.
+        if (frame.resolved.party !== undefined)
+            scope.pausedToolParty = frame.resolved.party;
+        // Which surface will collect the decision — carried so the
+        // resume-side ledger rows can say which component ANSWERED.
+        // Written only when one exists: a component-less ask's
+        // checkpoint stays byte-identical.
+        if (askComponent !== undefined)
+            scope.pausedComponentId = askComponent.componentId;
+        // The call is open, waiting on a person: its script row says
+        // `submitted`, without the text — the settled row carries it.
+        frame.fileScript(scope, {
+            tool: frame.tool,
+            toolName: frame.tc.name,
+            toolCallId: frame.tc.id,
+            iteration: frame.iteration,
+            proposed: frame.proposedProgram,
+            submitted: frame.programOfCall(frame.tool, bound.args),
+            settlement: 'not-entered',
+            paused: true,
+        });
+        // A defined return value triggers the footprintjs pause; this
+        // object becomes the checkpoint's pauseData, and detectPause
+        // surfaces `pauseData.ask` as `outcome.ask`.
+        return {
+            toolCallId: frame.tc.id,
+            toolName: frame.tc.name,
+            ask: { ...chain.payload, middleware: chain.middleware, id: bound.request.id },
+        };
+    }
+    return undefined;
+}
+//# sourceMappingURL=middlewareAdmission.js.map