comisai 1.0.45 → 1.0.46

package/node_modules/@comis/core/dist/event-bus/events-trajectory.d.ts

@@ -3,11 +3,8 @@
  * (`prompt:*`, `session:*`, `memory:injected`, `tool:timeout`) consumed by the
  * trajectory event-bus bridge.
  *
- * Extracted from `events-agent.ts` (which crossed the file-size cap) into its
- * own domain interface, composed into `EventMap` (events.ts) exactly like the
- * other domain groups (AgentEvents / ChannelEvents / TerminalEvents / …). No
- * behavior change — the event names + payload shapes are byte-identical to
- * their prior declarations in `AgentEvents`.
+ * A standalone domain interface, composed into `EventMap` (events.ts) exactly
+ * like the other domain groups (AgentEvents / ChannelEvents / TerminalEvents / …).
  *
  * Subscribed via @comis/observability/trajectory/event-bus-bridge.ts. Each is
  * emitted at a single canonical site and consumed via the EventBus rather than
@@ -75,19 +72,19 @@ export interface TrajectoryEvents {
     };
     /**
      * Per-session health rollup emitted once at agent-end. Emit site:
-     * packages/agent/src/executor/executor-post-execution.ts (D5/F2).
+     * packages/agent/src/executor/executor-post-execution.ts.
      *
      * `topErrorKinds` (keys ⊂ the closed `ErrorKind` union, capped at 3) and
      * `source` (provenance enum, mirroring the session-index SSOT) are carried
      * onto the event so they land in the persisted `obs_diagnostics` row and the
-     * fleet aggregate (`aggregateSessionsInWindow`, Phase 159 A1/A2) can read them
+     * fleet aggregate (`aggregateSessionsInWindow`) can read them
      * without opening per-session `_session-metadata.json` files. Production emits
      * the constant `source: "runtime"`; tests inject `"test"` / `"bench"`.
      *
      * `endReason` is the SAME mapped `SessionMetadata.sessionEnd.endReason` the
      * chokepoint derives ONCE via `END_REASON_MAP` (executor-post-execution.ts) and
      * co-persists onto `sessionEnd`. Carrying it here threads the NAMED degradation
-     * cause (e.g. `context_exhausted` / `output_starved`, the Glass Box degradation
+     * cause (e.g. `context_exhausted` / `output_starved`, the named degradation
      * detectors) into the persisted row so `obs.fleet.health` can aggregate
      * `degradedByCause` from the rows alone — never opening per-session metadata. It
      * is a closed-set label (the endReason union), never free text.
@@ -117,7 +114,7 @@ export interface TrajectoryEvents {
      *
      * Emit site: `packages/agent/src/executor/prompt-assembly.ts`, after the
      * hybrid split. `charsInjected`/`hitCount` count RETRIEVED memory only
-     * (inline + retrieved sections); the §7.3 temporal-guidance block is fixed
+     * (inline + retrieved sections); the temporal-guidance block is fixed
      * guidance text and is deliberately NOT tallied here.
      */
     "memory:injected": {

package/node_modules/@comis/core/dist/event-bus/events-trajectory.js

@@ -4,11 +4,8 @@
  * (`prompt:*`, `session:*`, `memory:injected`, `tool:timeout`) consumed by the
  * trajectory event-bus bridge.
  *
- * Extracted from `events-agent.ts` (which crossed the file-size cap) into its
- * own domain interface, composed into `EventMap` (events.ts) exactly like the
- * other domain groups (AgentEvents / ChannelEvents / TerminalEvents / …). No
- * behavior change — the event names + payload shapes are byte-identical to
- * their prior declarations in `AgentEvents`.
+ * A standalone domain interface, composed into `EventMap` (events.ts) exactly
+ * like the other domain groups (AgentEvents / ChannelEvents / TerminalEvents / …).
  *
  * Subscribed via @comis/observability/trajectory/event-bus-bridge.ts. Each is
  * emitted at a single canonical site and consumed via the EventBus rather than

package/node_modules/@comis/core/dist/event-bus/events.d.ts

@@ -15,16 +15,16 @@ import type { MediaGenerationEvents, MediaVisionEvents, MediaVideoGenerationEven
  * - MessagingEvents: message, session, compaction, context, response, command
  * - AgentEvents: skill, tool, audit, security, memory, observability (token/latency/spend)
  * - ModelEvents: model-failover (model:*) + provider-health (provider:*) lifecycle
- * - OrchestrationEvents: multi-agent graph lifecycle (graph:*, subagent:budget_exceeded — BUDGET-03)
- * - LearningEvents: verified-learning write-back/telemetry (memory:skill_used — ATTR-02)
+ * - OrchestrationEvents: multi-agent graph lifecycle (graph:*, subagent:budget_exceeded)
+ * - LearningEvents: verified-learning write-back/telemetry (memory:skill_used)
  * - TrajectoryEvents: trajectory-bridge lifecycle (prompt:submitted, session:started/ended/summary, memory:injected, tool:timeout)
  * - ChannelEvents: channel, queue, streaming, typing, autoreply, sendpolicy, debounce, priority, retry, ack
  * - InfraEvents: config, plugin, hook, browser, auth, device, diagnostic, media, scheduler, system, metrics
  * - TerminalEvents: interactive terminal-driver session lifecycle (session_state, spawn_failed)
- * - MediaGenerationEvents: image-generation lifecycle (image:requested/generated/delivered/failed — OBS-04)
- * - MediaVisionEvents: vision-analysis lifecycle (media.vision:requested/completed/failed — VIS-04)
- * - MediaVideoGenerationEvents: video-generation lifecycle (video:requested/submitted/generated/delivered/failed — OBS-04, Phase 192)
- * - MediaSttEvents / MediaTtsEvents: voice STT/TTS lifecycle (media.stt / media.tts requested/completed/failed — OBS-02/03, Phase 196)
+ * - MediaGenerationEvents: image-generation lifecycle (image:requested/generated/delivered/failed)
+ * - MediaVisionEvents: vision-analysis lifecycle (media.vision:requested/completed/failed)
+ * - MediaVideoGenerationEvents: video-generation lifecycle (video:requested/submitted/generated/delivered/failed)
+ * - MediaSttEvents / MediaTtsEvents: voice STT/TTS lifecycle (media.stt / media.tts requested/completed/failed)
  */
 export interface EventMap extends MessagingEvents, AgentEvents, ModelEvents, OrchestrationEvents, LearningEvents, TrajectoryEvents, ChannelEvents, InfraEvents, TerminalEvents, MediaGenerationEvents, MediaVisionEvents, MediaVideoGenerationEvents, MediaSttEvents, MediaTtsEvents {
 }

package/node_modules/@comis/core/dist/exports/activity.js

@@ -20,7 +20,7 @@ selectStrategy, chatProjection, acpProjection, coalesce, CHAT_COALESCE_RULES,
 // `themeForName(<default-agent theme>)` and bakes the resolved marker set
 // into `ActivityEvent.defaultLabel`.
 themeForName, } from "../activity/index.js";
-// ChatType narrowing (§4.6). Surfaced here so the
+// ChatType narrowing. Surfaced here so the
 // orchestrator composition can build `TurnActivityContext.chatType`
 // from a `NormalizedMessage.chatType` via the canonical `narrowChatType` instead
 // of re-hand-rolling the 5→3 fold. Only the `narrowChatType` value is re-exported:

package/node_modules/@comis/core/dist/exports/config.d.ts

@@ -1,2 +1,2 @@
-export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, VideoGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, OutputRetentionConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, PROVIDER_TIMEOUT_MS_DEFAULT, OperationModelEntrySchema, OperationModelsSchema, substituteEnvVars, warnSuspiciousEnvValues, findUnresolvedEnvRefs, formatMissingEnvRefError, loadConfigFile, preReadStorageMode, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, ToolingConfigSchema, DEFAULT_CLUSTER_CONFIG, DEFAULT_BUILTIN_ASSIGNMENTS, checkApprovalsConfig, BrokerBindingConfigSchema, OrchestrationConfigSchema, OrchestrationAuthoringConfigSchema, AutonomyConfigSchema, AutonomyMessageConfigSchema, AUTONOMY_PROFILES, STANDARD_FLOOR_CAPABILITIES, resolveAutonomy, resolveEffectiveMode, DurabilityConfigSchema, degradeAutonomy, } from "../config/index.js";
+export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, resolveCronWakeGateEnabled, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, VideoGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, OutputRetentionConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, PROVIDER_TIMEOUT_MS_DEFAULT, OperationModelEntrySchema, OperationModelsSchema, substituteEnvVars, warnSuspiciousEnvValues, findUnresolvedEnvRefs, formatMissingEnvRefError, loadConfigFile, preReadStorageMode, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, ToolingConfigSchema, DEFAULT_CLUSTER_CONFIG, DEFAULT_BUILTIN_ASSIGNMENTS, checkApprovalsConfig, BrokerBindingConfigSchema, OrchestrationConfigSchema, OrchestrationAuthoringConfigSchema, AutonomyConfigSchema, AutonomyMessageConfigSchema, AUTONOMY_PROFILES, STANDARD_FLOOR_CAPABILITIES, resolveAutonomy, resolveEffectiveMode, DurabilityConfigSchema, permitsMcpTool, degradeAutonomy, } from "../config/index.js";
 export type { AppConfig, AgentConfig, BudgetConfig, CircuitBreakerConfig, DmScopeConfig, ElevatedReplyConfig, ModelRoutes, PruningConfig, HeartbeatConfig, HeartbeatTarget, PerAgentConfig, PerAgentCronConfig, PerAgentHeartbeatConfig, PerAgentSchedulerConfig, RagConfig, ResetPolicyOverride, RoutingBinding, RoutingConfig, SessionResetPolicyConfig, TracingConfig, ChannelConfig, ChannelEntry, ChannelHealthCheckConfig, AckReactionConfig, MemoryConfig, CompactionConfig, RetentionConfig, SecurityConfig, PermissionConfig, ActionConfirmationConfig, AgentToAgentConfig, CredentialStorageMode, SkillsConfig, TerminalAllowEntry, TerminalDriverConfig, DaemonConfig, LoggingConfig, TracingDefaults, ConfigWebhook, SchedulerConfig, GatewayConfig, GatewayTlsConfig, GatewayToken, GatewayRateLimit, IntegrationsConfig, BraveSearchConfig, McpServerEntry, McpConfig, TranscriptionConfig, TtsConfig, TtsAutoMode, ElevenLabsVoiceSettings, TtsOutputFormat, ImageAnalysisConfig, VisionScopeRule, VisionConfig, LinkUnderstandingConfig, MediaConfig, FileExtractionConfig, AutoReplyRule, AutoReplyConfig, MonitoringConfig, DiskMonitorConfig, ResourceMonitorConfig, SystemdMonitorConfig, SecurityUpdateMonitorConfig, GitMonitorConfig, PluginsConfig, PluginEntry, QueueConfig, PerChannelQueueConfig, QueueMode, OverflowPolicy, OverflowConfig, DebounceBufferConfig, FollowupConfig, StreamingConfig, PerChannelStreamingConfig, TypingMode, ChunkMode, DeliveryMirrorConfig, DeliveryQueueConfig, DeliveryTimingConfig, DeliveryTimingMode, CoalescerConfig, AutoReplyEngineConfig, GroupActivationMode, SendPolicyConfig, SendPolicyRule, SendAction, EnvelopeConfig, RetryConfig, WebhooksConfig, WebhookMappingConfig, AgentSecretsConfig, ConfigError, ConfigErrorCode, FieldMetadata, PartialValidationResult, ConfigGitManager, GitCommitMetadata, HistoryEntry, GitManagerDeps, ExecGitFn, EnvValueWarning, UnresolvedEnvRef, LifecycleReactionsConfig, LifecycleReactionsTimingConfig, SenderTrustDisplayConfig, DocumentationConfig, DocumentationLink, ImageGenerationConfig, VideoGenerationConfig, NotificationConfig, VerbosityConfig, VerbosityLevel, VerbosityOverride, ContextEngineConfig, BackgroundTasksConfig, OutputRetentionConfig, RetentionClass, MemoryReviewConfig, ProviderEntry, ProvidersConfig, UserModel, ModelCost, OperationModelEntry, OperationModels, ModelOperationType, ToolingConfig, BrokerBindingConfig, StorageModePreRead, OrchestrationConfig, OrchestrationAuthoringConfig, SpendConfig, AutonomyConfig, AutonomyMessageConfig, AutonomyProfileName, AutonomyMode, ResolvedAutonomy, ResolvedCapability, AutonomyDownshift, AutonomyPreflightResult, } from "../config/index.js";

package/node_modules/@comis/core/dist/exports/config.js

@@ -1,24 +1,27 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/core exports — Config (layered configuration with Zod validation)
-export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, VideoGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, OutputRetentionConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, PROVIDER_TIMEOUT_MS_DEFAULT, OperationModelEntrySchema, OperationModelsSchema, substituteEnvVars, warnSuspiciousEnvValues, findUnresolvedEnvRefs, formatMissingEnvRefError, loadConfigFile, preReadStorageMode, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, 
+export { AppConfigSchema, AgentConfigSchema, AgentsMapSchema, BudgetConfigSchema, CircuitBreakerConfigSchema, DmScopeConfigSchema, ElevatedReplyConfigSchema, ModelRoutesSchema, HeartbeatConfigSchema, HeartbeatTargetSchema, PerAgentConfigSchema, PerAgentCronConfigSchema, PerAgentHeartbeatConfigSchema, PerAgentSchedulerConfigSchema, PruningConfigSchema, RagConfigSchema, ResetPolicyOverrideSchema, RoutingBindingSchema, RoutingConfigSchema, SessionResetPolicySchema, TracingConfigSchema, ChannelConfigSchema, ChannelEntrySchema, ChannelHealthCheckSchema, MemoryConfigSchema, CompactionConfigSchema, RetentionConfigSchema, SecurityConfigSchema, PermissionConfigSchema, ActionConfirmationConfigSchema, AgentToAgentConfigSchema, SkillsConfigSchema, DaemonConfigSchema, LoggingConfigSchema, TracingDefaultsSchema, ConfigWebhookSchema, SchedulerConfigSchema, resolveCronWakeGateEnabled, GatewayConfigSchema, GatewayTlsConfigSchema, GatewayTokenSchema, GatewayRateLimitSchema, IntegrationsConfigSchema, BraveSearchConfigSchema, McpServerEntrySchema, McpConfigSchema, TranscriptionConfigSchema, TtsConfigSchema, TtsAutoModeSchema, ElevenLabsVoiceSettingsSchema, TtsOutputFormatSchema, ImageAnalysisConfigSchema, VisionScopeRuleSchema, VisionConfigSchema, LinkUnderstandingConfigSchema, MediaConfigSchema, DOCUMENT_MIME_WHITELIST, FileExtractionConfigSchema, AutoReplyRuleSchema, AutoReplyConfigSchema, MonitoringConfigSchema, PluginsConfigSchema, PluginEntrySchema, QueueConfigSchema, QueueModeSchema, OverflowPolicySchema, PerChannelQueueConfigSchema, OverflowConfigSchema, DebounceBufferConfigSchema, FollowupConfigSchema, StreamingConfigSchema, PerChannelStreamingConfigSchema, TypingModeSchema, ChunkModeSchema, DeliveryMirrorConfigSchema, DeliveryQueueConfigSchema, DeliveryTimingConfigSchema, DeliveryTimingModeSchema, CoalescerConfigSchema, AutoReplyEngineConfigSchema, GroupActivationModeSchema, SendPolicyConfigSchema, SendPolicyRuleSchema, SendActionSchema, EnvelopeConfigSchema, RetryConfigSchema, WebhooksConfigSchema, WebhookMappingConfigSchema, WebhookMappingMatchSchema, AgentSecretsConfigSchema, DocumentationConfigSchema, DocumentationLinkSchema, ImageGenerationConfigSchema, VideoGenerationConfigSchema, NotificationConfigSchema, VerbosityConfigSchema, VerbosityLevelSchema, VerbosityOverrideSchema, ContextEngineConfigSchema, BackgroundTasksConfigSchema, OutputRetentionConfigSchema, MemoryReviewConfigSchema, ProviderEntrySchema, ProvidersConfigSchema, UserModelSchema, ModelCostSchema, PROVIDER_TIMEOUT_MS_DEFAULT, OperationModelEntrySchema, OperationModelsSchema, substituteEnvVars, warnSuspiciousEnvValues, findUnresolvedEnvRefs, formatMissingEnvRefError, loadConfigFile, preReadStorageMode, validateConfig, deepMerge, mergeLayered, loadLayered, IMMUTABLE_CONFIG_PREFIXES, MUTABLE_CONFIG_OVERRIDES, isImmutableConfigPath, matchesOverridePattern, getMutableOverridesForSection, MANAGED_SECTIONS, getManagedSectionRedirect, formatRedirectHint, getConfigSchema, getConfigSections, getFieldMetadata, validatePartial, createConfigGitManager, 
 // Tooling subtree (capability layer)
 ToolingConfigSchema, DEFAULT_CLUSTER_CONFIG, DEFAULT_BUILTIN_ASSIGNMENTS, checkApprovalsConfig, 
 // Broker binding config schema
 BrokerBindingConfigSchema, 
-// Orchestration authoring gate (Phase 174 / v2.27 P2) — top-level, default-OFF.
-// Public so downstream packages (Plans 02-05) read the gate from @comis/core.
+// Orchestration authoring gate — top-level, default-OFF.
+// Public so downstream packages read the gate from @comis/core.
 OrchestrationConfigSchema, OrchestrationAuthoringConfigSchema, 
-// Agent autonomy named-profile resolver (Phase 210 / v8 §3.8). Public so the
-// daemon (Plan 04 cap injection, Plan 06 boot logging) + the PROFILE-02
+// Agent autonomy named-profile resolver. Public so the
+// daemon (cap injection, boot logging) + the autonomy
 // arch-test read the resolver + the resolved cap/guard table from @comis/core.
 AutonomyConfigSchema, AutonomyMessageConfigSchema, AUTONOMY_PROFILES, STANDARD_FLOOR_CAPABILITIES, resolveAutonomy, 
-// Phase 217: the EVICT-02 fail-closed mode resolver — the Wave-2 dispatch
+// The fail-closed mode resolver — the dispatch
 // chokepoint runs the run's effective mode through this (absent/forged/unknown →
 // "default"). A VALUE export (runtime function), so the daemon can import it.
 resolveEffectiveMode, 
-// Phase 216: the autonomy.durability sub-block schema — the daemon reads it for
+// The autonomy.durability sub-block schema — the daemon reads it for
 // the boot-time durability resolution (setupDurableResume gate + thresholds).
 DurabilityConfigSchema, 
-// Honest legible degrade (Phase 210 / PROFILE-03) — consumed by the daemon
-// boot log + the preflight doctor (Plan 06).
+// The pure inbound-MCP-allowlist resolver — the daemon-side `case "mcp"`
+// executor's layer-2 deny-by-absence gate (resolved per-agent from autonomy.mcp).
+permitsMcpTool, 
+// Honest legible degrade — consumed by the daemon
+// boot log + the preflight doctor.
 degradeAutonomy, } from "../config/index.js";

package/node_modules/@comis/core/dist/exports/delivery.js

@@ -7,7 +7,8 @@
 //
 // The Markdown IR pipeline that underlies formatForChannel and chunkForDelivery
 // (markdown-ir, ir-renderer, ir-chunker, markdown-tables, sanitize-for-plain-text,
-// table-converter, telegram-file-ref-guard) lives alongside as a Rule 3 fix.
+// table-converter, telegram-file-ref-guard) lives alongside, keeping the
+// `core → channels` dependency one-way.
 // Those internals are intentionally NOT exported from this aggregator: the
 // public surface is limited to the names below plus the telegram-file-ref-guard
 // symbols the daemon needs at bootstrap.

package/node_modules/@comis/core/dist/exports/domain.js

@@ -37,7 +37,7 @@ ToolSchemaProfileSchema, ToolCallArgumentsEncodingSchema, ModelCompatConfigSchem
 ProviderFamilySchema, TranscriptToolCallIdModeSchema, ProviderCapabilitiesSchema, 
 // Sub-agent tool governance
 SUB_AGENT_TOOL_DENYLIST, SUB_AGENT_TOOL_PROFILES, SUB_AGENT_TOOL_GROUPS, RequiredToolsUnreachableError, toolReachableGroups, computeReachableToolNames, 
-// RPC typed-refusal classification (single source of truth — OBS-RPC-REFUSAL-CLASS)
+// RPC typed-refusal classification (single source of truth)
 classifyTypedRpcError, 
 // MemoryExportEnvelope
 MemoryExportEnvelopeSchema, MemoryExportEntrySchema, parseMemoryExportEnvelope, } from "../domain/index.js";

package/node_modules/@comis/core/dist/exports/media.js

@@ -2,73 +2,58 @@
 // Media (image-generation resolution) helper re-exports for the @comis/core barrel.
 // Only the cross-package-consumed symbols are surfaced: the daemon pi-image
 // shim imports `resolveImageProvider`/`IMAGE_ERR_TO_LOG`/`ImageErrorKind`, and
-// the daemon image-handlers (IN-02, Phase 185) import `isValidImageModel` /
-// `listImageModels` to validate an agent-supplied `model` arg + build the
-// reject hint (the in-repo consumer that satisfies the public-export-consumers
-// gate). `IMAGE_CAPABILITY` and the `ImageProviderSelection`/
-// `ImageGenSelectionConfig` types are consumed only inside `@comis/core/media`
-// (relative imports) today, so they stay off the public barrel until a
-// cross-package consumer exists. A later phase re-exports them here if needed.
+// the daemon image-handlers import `isValidImageModel` / `listImageModels` to
+// validate an agent-supplied `model` arg + build the reject hint (the in-repo
+// consumer that satisfies the public-export-consumers gate). `IMAGE_CAPABILITY`
+// and the `ImageProviderSelection`/`ImageGenSelectionConfig` types are consumed
+// only inside `@comis/core/media` (relative imports) today, so they stay off
+// the public barrel until a cross-package consumer exists.
 export { IMAGE_ERR_TO_LOG, resolveImageProvider } from "../media/index.js";
-// IN-02 (Phase 185): only the two validators are surfaced — they are consumed
-// cross-package by the daemon image-handlers. The backing `IMAGE_MODELS_BY_PROVIDER`
-// const stays off the public barrel (no cross-package consumer; the validators
-// encapsulate it — same policy as `IMAGE_CAPABILITY` above). It is importable
+// Only the two validators are surfaced — they are consumed cross-package by the
+// daemon image-handlers. The backing `IMAGE_MODELS_BY_PROVIDER` const stays off
+// the public barrel (no cross-package consumer; the validators encapsulate it —
+// same policy as `IMAGE_CAPABILITY` above). It is importable
 // intra-`@comis/core/media` via a relative path for the unit test.
 export { isValidImageModel, listImageModels } from "../media/index.js";
-// VIS-02/03 (Phase 187): the pure vision-path resolver is consumed CROSS-PACKAGE
-// by the daemon media-handlers ladder (the two seams call `resolveVisionPath` and
-// switch on the returned `path`). Surfaced here on the public barrel so the
-// daemon imports it from `@comis/core` (mirrors `resolveImageProvider` above;
-// 187-01 added it to ../media/index.js but only the intra-core media barrel
-// re-exported it — this is the missing cross-package surface the handler needs).
+// The pure vision-path resolver is consumed CROSS-PACKAGE by the daemon
+// media-handlers ladder (the two seams call `resolveVisionPath` and switch on
+// the returned `path`). Surfaced here on the public barrel so the daemon
+// imports it from `@comis/core` (mirrors `resolveImageProvider` above; the
+// intra-core media barrel alone is not a cross-package surface).
 // The `VisionPathSelection`/`VisionPathInput` types stay OFF the public barrel
 // (the handler consumes the return STRUCTURALLY, no named type import) — the same
 // policy as `ImageProviderSelection`, which stays intra-`@comis/core/media`.
 export { resolveVisionPath } from "../media/index.js";
-// Video generation (v2.24 Phase 188) — the video twins of the image media
-// symbols above, surfaced on the public barrel so Plan 03 (the @comis/skills FAL
-// adapter) and Plan 04 (the @comis/daemon video handler + selector) can import
-// them. Plan 04 consumes `resolveVideoProvider` / `VIDEO_ERR_TO_LOG` /
-// `VideoErrorKind` / `VideoGenError` / `estimateVideoCostUsd` / `isBlockedObjectKey`;
-// Plan 03 consumes `VideoGenError` (+ the port types from exports/ports.ts).
-// Those plans land in LATER waves, so until then these are documented
-// planned-orphans tracked in test/support/public-api-policy.ts (the
-// SessionStorePort / ContextStorePort ahead-of-consumer precedent — NOT a
-// shrink-only architecture-allowlist entry). `VIDEO_CAPABILITY` and the
+// Video generation — the video twins of the image media symbols above, surfaced
+// on the public barrel for the @comis/skills FAL adapter and the @comis/daemon
+// video handler + selector. The daemon consumes `resolveVideoProvider` /
+// `VIDEO_ERR_TO_LOG` / `VideoErrorKind` / `VideoGenError` / `estimateVideoCostUsd`
+// / `isBlockedObjectKey`; the skills adapter consumes `VideoGenError` (+ the
+// port types from exports/ports.ts). `VIDEO_CAPABILITY` and the
 // `VideoProviderSelection` / `VideoGenSelectionConfig` types stay OFF the public
 // barrel (intra-`@comis/core/media` only — the same policy as `IMAGE_CAPABILITY`
-// / `ImageProviderSelection`); a later phase re-exports them here if a
+// / `ImageProviderSelection`); they get re-exported here only if a
 // cross-package consumer ever needs them.
 export { VIDEO_ERR_TO_LOG, VideoGenError, resolveVideoProvider, isBlockedObjectKey, estimateVideoCostUsd, VIDEO_PRICING, } from "../media/index.js";
-// CAP-02 per-model capability matrix accessors (v2.24 Phase 191). Surfaced on
-// the public @comis/core barrel — the SINGLE public surface (there is no
-// ./media subpath) — so Plan 02 (the @comis/daemon video-handlers IN-02
-// validator: listVideoModelCaps + supportedModes + snapDuration) and Plan 03
-// (the @comis/skills video-generate tool's IN-03 dynamic description:
-// listVideoModelCaps) can import them from @comis/core. Those consumers land in
-// LATER waves (this is Plan 01, Wave 1), so until then the accessors + the two
-// types are documented ahead-of-consumer planned-orphans tracked in
-// test/support/public-api-policy.ts (the Phase-188 video-foundation /
-// SessionStorePort precedent — over-listing a soon-consumed symbol, NOT a
-// shrink-only architecture-allowlist entry). Each SHRINKS out when its real
-// cross-package consumer lands (Plan 02 Task 4 / Plan 03 Task 4 re-confirm the
-// public-export-consumers gate fully green). The raw VIDEO_MODELS const stays
+// Per-model capability matrix accessors. Surfaced on the public @comis/core
+// barrel — the SINGLE public surface (there is no ./media subpath) — so the
+// @comis/daemon video-handlers validator (listVideoModelCaps + supportedModes +
+// snapDuration) and the @comis/skills video-generate tool's dynamic description
+// (listVideoModelCaps) can import them from @comis/core. The VideoModelCaps /
+// VideoDurations types are consumed structurally (inferred off the accessors'
+// return types, no named import), so they are tracked in
+// test/support/public-api-policy.ts. The raw VIDEO_MODELS const stays
 // OFF the public barrel (intra-`@comis/core/media` only — the IMAGE_CAPABILITY
 // / IMAGE_MODELS_BY_PROVIDER policy: the accessors encapsulate it).
 export { listVideoModelCaps, supportedModes, snapDuration } from "../media/index.js";
-// Keyless voice (v2.25 Phase 193) — the daemon setup-audio-provider.ts (Plan 03,
-// Wave 2) consumes resolveTranscriptionProvider / resolveTtsProvider /
-// VOICE_KEYLESS / MAIN_PROVIDER_AUDIO / STT_ERR_TO_LOG / SttErrorKind
-// cross-package (the predicate-injection wiring + the honest-unavailable
-// branch). Surfaced on the public @comis/core barrel (the single public surface
-// — there is no ./media subpath) so the daemon imports them from @comis/core,
-// mirroring resolveImageProvider / resolveVideoProvider above. Until Wave 2
-// lands that consumer these are documented ahead-of-consumer planned-orphans
-// tracked in test/support/public-api-policy.ts (the video-foundation /
-// PollDeadline precedent at :30-43 — over-listing a soon-consumed symbol, NOT a
-// shrink-only architecture-allowlist entry); each SHRINKS out when Plan 03's
-// consumer lands. The SttSelection / TtsSelection / *SelectionConfig TYPES stay
-// OFF the public barrel (consumed structurally by the daemon, the same policy as
-// ImageProviderSelection / VideoProviderSelection above).
+// Keyless voice — the daemon setup-audio-provider.ts consumes
+// resolveTranscriptionProvider / resolveTtsProvider / VOICE_KEYLESS /
+// MAIN_PROVIDER_AUDIO / STT_ERR_TO_LOG / SttErrorKind cross-package (the
+// predicate-injection wiring + the honest-unavailable branch). Surfaced on the
+// public @comis/core barrel (the single public surface — there is no ./media
+// subpath) so the daemon imports them from @comis/core, mirroring
+// resolveImageProvider / resolveVideoProvider above. The SttSelection /
+// TtsSelection / *SelectionConfig TYPES stay OFF the public barrel (consumed
+// structurally by the daemon, the same policy as ImageProviderSelection /
+// VideoProviderSelection above).
 export { VOICE_KEYLESS, MAIN_PROVIDER_AUDIO, STT_ERR_TO_LOG, resolveTranscriptionProvider, resolveTtsProvider, } from "../media/index.js";

package/node_modules/@comis/core/dist/exports/model.js

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
-// Model catalog re-exports for the @comis/core barrel (relocated from @comis/agent).
+// Model catalog re-exports for the @comis/core barrel.
 export { createModelCatalog, resolveModelPricing, resolvePricingState, ZERO_COST, } from "../model/model-catalog.js";
-// RESOLVE-01: provider↔model chimera detector (observability-excellence). Only the
+// Provider↔model chimera detector. Only the
 // consumed entry point is on the public barrel; `resolveModelFamily`/`ModelFamily` stay
 // module-local (used internally + via the module's own test) until a consumer needs them.
 export { isProviderModelChimera } from "../model/model-family.js";

package/node_modules/@comis/core/dist/exports/oauth.d.ts

@@ -1,8 +1,7 @@
 /**
  * OAuth helper re-exports for the @comis/core barrel.
  *
- * CLI consumers import these names from @comis/core (no longer from
- * @comis/agent; the agent-side re-exports have been removed).
+ * CLI consumers import these names from @comis/core.
  *
  * @module
  */

package/node_modules/@comis/core/dist/exports/oauth.js

@@ -2,8 +2,7 @@
 /**
  * OAuth helper re-exports for the @comis/core barrel.
  *
- * CLI consumers import these names from @comis/core (no longer from
- * @comis/agent; the agent-side re-exports have been removed).
+ * CLI consumers import these names from @comis/core.
  *
  * @module
  */

package/node_modules/@comis/core/dist/exports/ports.js

@@ -1,21 +1,20 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/core exports — Port interfaces (hexagonal architecture boundaries)
-// Runtime values that previously lived under core/src/ports/ now live in
-// non-ports/ home modules. The public surface stays byte-identical — only
-// the re-export targets shifted.
+// Runtime values live in non-ports home modules (`core/src/ports/*.ts` is
+// type-only); this barrel re-exports them onto the public surface.
 export { ChannelCapabilitySchema } from "../domain/channel-capability.js";
 export { createNoOpDeliveryQueue } from "../delivery/no-op-delivery-queue.js";
 export { createNoOpDeliveryMirror } from "../delivery/no-op-delivery-mirror.js";
 export { createNoOpCapabilityPort } from "../tool-capability/no-op-tool-capability.js";
 export { validateProfileId, PROFILE_ID_RE } from "../security/profile-id.js";
-// LCD parts <-> pi-ai Message codec (v2.12, Phase 127). Runtime VALUES (not
-// types) — the pure round-trip functions the memory adapter (Plan 04) and
-// Phase 128 ingest consume. The port + DTO TYPES are in the export-type block
-// above; these two functions are the value seam.
+// LCD parts <-> pi-ai Message codec. Runtime VALUES (not types) — the pure
+// round-trip functions the memory adapter and context ingest consume. The port
+// + DTO TYPES are in the export-type block above; these two functions are the
+// value seam.
 export { messageToParts, partsToMessage } from "../context-store/index.js";
-// Reflection delta-ops (v2.31 Phase 223). Runtime VALUES (not types) — the pure
-// `applyDeltaOps` (byte-stable section refresh, REFLECT-04) + `renderStructuredBody`
-// (AST → markdown) the agent reflection job (Plan 04) consumes. They live in the
-// non-ports home module (`core/src/ports/*.ts` is type-only); the DeltaOp /
-// DocSection / StructuredBody TYPES are in the export-type block above.
+// Reflection delta-ops. Runtime VALUES (not types) — the pure `applyDeltaOps`
+// (byte-stable section refresh) + `renderStructuredBody` (AST → markdown) the
+// agent reflection job consumes. They live in the non-ports home module
+// (`core/src/ports/*.ts` is type-only); the DeltaOp / DocSection /
+// StructuredBody TYPES are in the export-type block above.
 export { applyDeltaOps, renderStructuredBody } from "../reflection/delta-ops.js";

package/node_modules/@comis/core/dist/exports/runtime.js

@@ -13,7 +13,7 @@ export { createFileLock } from "../runtime/file-lock.js";
 // Only helpers with actual consumers are exported; the rest stay internal to
 // the runtime/ root (public-export-consumers gate forbids dead exports).
 export { systemNowMs, systemNowDate, systemDateFrom, systemSleep, systemSetTimeout, systemClearTimeout, systemSetInterval, systemClearInterval, systemGetEnv, systemEnvSnapshot, systemScheduleTimeout, } from "../runtime/system-time.js";
-// Shared bounded-poll helper (DIVERGENCE 5). Authored in @comis/core/runtime so
-// BOTH the @comis/skills FAL adapter's inline execute() AND Phase 189's daemon
-// background poller import it without a package-boundary violation.
+// Shared bounded-poll helper. Authored in @comis/core/runtime so BOTH the
+// @comis/skills FAL adapter's inline execute() AND the daemon's background
+// poller import it without a package-boundary violation.
 export { createPollDeadline, pollUntilDone } from "../runtime/poll-deadline.js";

package/node_modules/@comis/core/dist/exports/security.js

@@ -1,29 +1,29 @@
 // SPDX-License-Identifier: Apache-2.0
 // @comis/core exports — Security utilities
 export { safePath, PathTraversalError } from "../security/index.js";
-// JAIL-03 bind-mount validator (Phase 211) — consumed by 211-05 (bwrap-provider).
+// Bind-mount validator — consumed by the bwrap sandbox provider.
 export { validateBindMount } from "../security/index.js";
 // Master-key file helpers (daemon-free `secrets init` body)
 export { writeMasterKeyIfAbsent, generateMasterKey } from "../security/index.js";
 export { createSecretManager, createSecretManagerWithMutableHandle, envSubset } from "../security/index.js";
 export { classifyAction, requiresConfirmation } from "../security/index.js";
 export { AuditEventSchema, createAuditEvent, AUDIT_KINDS, kindIsSecuritySignal } from "../security/index.js";
-// Agent orchestration capabilities (Phase 210) + the Phase 211 mint-attenuation
-// trust boundary (attenuateCaps — consumed by the 211-06 broker lease mint).
+// Agent orchestration capabilities + the mint-attenuation trust boundary
+// (attenuateCaps — consumed by the broker lease mint).
 export { AGENT_CAPABILITIES, checkCapability, requireCapability, CapabilityDeniedError, attenuateCaps } from "../security/index.js";
-// HANDLER_CAPABILITY_MAP — the single auditable method→capability source-of-truth (CAP-04)
+// HANDLER_CAPABILITY_MAP — the single auditable method→capability source-of-truth
 export { HANDLER_CAPABILITY_MAP } from "../security/index.js";
-// SELF_SCOPED_AGENT_READS — the tight cap-socket audience exception (CLI-01/02),
-// surfaced on the @comis/core barrel for the @comis/infra lease audience (Plan 02).
+// SELF_SCOPED_AGENT_READS — the tight cap-socket audience exception, surfaced
+// on the @comis/core barrel for the @comis/infra lease audience.
 export { SELF_SCOPED_AGENT_READS } from "../security/index.js";
-// CLI_SUBCOMMAND_MAP — the comis-agent subcommand→{tool|method} 1:1 table
-// (CLI-01, v8 §7), surfaced on the @comis/core barrel for the @comis/skills
-// comis-agent-cli dispatch (Plan 04) and the Plan 05 same-gate arch-test.
+// CLI_SUBCOMMAND_MAP — the comis-agent subcommand→{tool|method} 1:1 table,
+// surfaced on the @comis/core barrel for the @comis/skills comis-agent-cli
+// dispatch and the same-gate arch-test.
 export { CLI_SUBCOMMAND_MAP } from "../security/index.js";
-// TOOL_CAPABILITY_MAP / TOOL_ROUTE_MAP + ResultRef — the Phase 212 tool.invoke
-// surface single-source + the minimal result-handle, surfaced on the @comis/core
-// barrel for the daemon gate (Plan 02), the lease audience (Plan 02) and the
-// comis_tools SDK codegen (Plan 03).
+// TOOL_CAPABILITY_MAP / TOOL_ROUTE_MAP + ResultRef — the tool.invoke surface
+// single-source + the minimal result-handle, surfaced on the @comis/core
+// barrel for the daemon gate, the lease audience and the comis_tools SDK
+// codegen.
 export { TOOL_CAPABILITY_MAP, TOOL_ROUTE_MAP } from "../security/index.js";
 export { RESULT_REF_THRESHOLDS, DEFAULT_INLINE_THRESHOLD_BYTES, PER_FILE_CAP_BYTES, PER_RUN_AGGREGATE_CAP_BYTES, getResultRefThreshold, shouldMaterialize, isExpired, selectEvictions, checkPerFileCap, computeExpiresAt, } from "../security/index.js";
 export { sanitizeLogString, redactErrorMessage } from "../security/index.js";
@@ -47,9 +47,9 @@ export { createAuditAggregator } from "../security/index.js";
 export { validateInput } from "../security/index.js";
 export { createInputSecurityGuard } from "../security/index.js";
 export { validateMemoryWrite } from "../security/index.js";
-// Learned-doc static scan (v2.31 Reflection) — surfaced on the public @comis/core
-// barrel so the agent reflection job (223-04) and the daemon reflect path (223-05)
-// consume it directly (the static scan is ALL the validation an advisory doc gets).
+// Learned-doc static scan — surfaced on the public @comis/core barrel so the
+// agent reflection job and the daemon reflect path consume it directly (the
+// static scan is ALL the validation an advisory doc gets).
 export { validateLearnedDocBody, MAX_DOC_NAME_LENGTH } from "../security/index.js";
 export { createInjectionRateLimiter } from "../security/index.js";
 export { resolveSecretRef, resolveConfigSecretRefs } from "../security/index.js";

package/node_modules/@comis/core/dist/exports/text.js

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
-// @comis/core exports — pure text utilities:
-//   Phase 179 — Script classification + token-factor
-//   Phase 180 — search normalization (FTS-02) + trigram query routing (FTS-01)
-//   Phase 182 — grapheme-safe truncation boundary (SAFE-01) + multilingual name heuristic (EMB-01)
+// @comis/core exports — pure text utilities: script classification +
+// token-factor, search normalization + trigram query routing, grapheme-safe
+// truncation boundary + multilingual name heuristic.
 export { SCRIPT_CLASSES, classifyCodepoint, scriptShares, dominantScript } from "../text/script-classes.js";
 export { classifyGenerationQuality } from "../text/generation-quality.js";
 export { scriptTokenFactor } from "../text/token-factor.js";

package/node_modules/@comis/core/dist/hooks/hook-runner.d.ts

@@ -24,10 +24,10 @@ export interface HookRunner {
 /**
  * Options for creating a hook runner.
  *
- * The `hook:executed` observability event was removed (zero non-test
- * subscribers). The `eventBus` option remains for the live `audit:event`
- * emission via `emitAuditEvent` which fires when modifying hooks alter
- * agent prompts or delivery payloads.
+ * The `eventBus` option exists solely for the `audit:event` emission via
+ * `emitAuditEvent`, which fires when modifying hooks alter agent prompts or
+ * delivery payloads. There is deliberately no per-execution hook event —
+ * hook execution itself has no production subscribers to notify.
  */
 export interface HookRunnerOptions {
     /** Catch and log hook handler errors instead of propagating (default: true). */

package/node_modules/@comis/core/dist/hooks/plugin-registry.d.ts

@@ -23,10 +23,10 @@ export interface PluginRegistry {
 /**
  * Options for creating a plugin registry.
  *
- * The `eventBus` parameter was removed because the only two events emitted
- * (`plugin:registered`, `plugin:deactivated`) had zero non-test subscribers.
- * Tests that inspect plugin lifecycle now poll PluginRegistry state directly
- * via the surviving accessor surface.
+ * Deliberately carries no `eventBus`: plugin registration/deactivation emits
+ * no observability events (there are no production subscribers for them).
+ * Tests that inspect plugin lifecycle poll PluginRegistry state directly via
+ * the accessor surface.
  */
 export interface PluginRegistryOptions {
 }

package/node_modules/@comis/core/dist/index.d.ts

@@ -17,4 +17,6 @@ export * from "./exports/text.js";
 export * from "./api-contracts/index.js";
 export * from "./ports/durable-run.js";
 export * from "./ports/outward-send-ledger.js";
+export * from "./ports/msteams-conversation-store.js";
+export * from "./domain/msteams-conversation-reference.js";
 export * from "./domain/durable-run.js";

package/node_modules/@comis/core/dist/index.js

@@ -20,9 +20,11 @@ export * from "./exports/workspace.js";
 export * from "./exports/media.js";
 export * from "./exports/text.js";
 export * from "./api-contracts/index.js";
-// Phase 216 durability-resume engine — the durable-run + outward-send-ledger
-// ports and the DurableRunRecord domain type. Re-exported here so Wave 2/3
-// packages (@comis/memory adapters, @comis/daemon wiring) can import them.
+// Durability-resume engine — the durable-run + outward-send-ledger ports and
+// the DurableRunRecord domain type. Re-exported here so downstream packages
+// (@comis/memory adapters, @comis/daemon wiring) can import them.
 export * from "./ports/durable-run.js";
 export * from "./ports/outward-send-ledger.js";
+export * from "./ports/msteams-conversation-store.js";
+export * from "./domain/msteams-conversation-reference.js";
 export * from "./domain/durable-run.js";

package/node_modules/@comis/core/dist/logging/dedup-logger.d.ts

@@ -4,8 +4,8 @@
  * `withDedup` wraps a {@link ComisLogger} so repeated messages keyed by the
  * same dedup key fire the underlying logger ONCE. The key is
  * `fingerprint(`${level}:${k}`)`, where `k` is the caller-supplied `dedupKey`
- * object field if present, else the message string (D10/D4 — the shared
- * `fingerprint` is the key). The first occurrence passes through unchanged;
+ * object field if present, else the message string (the shared
+ * `fingerprint` digest is the key). The first occurrence passes through unchanged;
  * repeats are suppressed and their count tracked (a collapsed signal, never a
  * silently dropped one).
  *
@@ -17,11 +17,10 @@
  * (`architecture-graph.test.ts` locks `agent ↛ infra`). This is the same
  * decision the project already made for `fingerprint`.
  *
- * TTL: `opts.ttlMs` defaults to `undefined` = process-lifetime, matching the
- * unbounded hand-rolled Sets this replaces (behavior-preserving). A
+ * TTL: `opts.ttlMs` defaults to `undefined` = process-lifetime dedup. A
  * security-relevant repeated WARN is therefore collapsed-with-count within the
- * process but its FIRST occurrence always fires — it is never suppressed beyond
- * process lifetime (security-threat-model directive 3). When a TTL IS supplied,
+ * process but its FIRST occurrence always fires — a security signal is
+ * collapsed, never fully suppressed. When a TTL IS supplied,
  * a key whose first emission is older than `ttlMs` is treated as a fresh entry
  * and re-emitted.
  *
@@ -32,13 +31,13 @@ import type { ComisLogger } from "./log-fields.js";
 export interface WithDedupOptions {
     /**
      * Re-emit window in milliseconds. `undefined` (default) = process-lifetime
-     * dedup (matches the unbounded Sets this replaces). When set, a repeat is
+     * dedup. When set, a repeat is
      * re-emitted once `ttlMs` has elapsed since the key's first emission.
      */
     ttlMs?: number;
     /**
      * Reserved hard-cap on the number of tracked keys (future eviction hook).
-     * Accepted but currently a no-op — parity with the unbounded Sets; do not
+     * Accepted but currently a no-op — do not
      * rely on it for eviction until a test pins the behavior.
      */
     max?: number;

package/node_modules/@comis/core/dist/logging/fingerprint.js

@@ -1,13 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Shared stable digest util: a 12-hex sha256 prefix of a string (D4).
+ * Shared stable digest util: a 12-hex sha256 prefix of a string.
  *
  * Canonical (and ONLY) home is @comis/core — import it directly from here
  * everywhere, including @comis/agent (which is forbidden from depending on
  * @comis/infra). It is NOT re-exported by @comis/infra; do not write
- * `import { fingerprint } from "@comis/infra"`. (Phase 155's withDedup, in
- * @comis/infra, will consume it from @comis/core like every other caller;
- * re-export from infra only if a future consumer genuinely needs it.)
+ * `import { fingerprint } from "@comis/infra"`. (withDedup, in this same
+ * directory, consumes it like every other caller; re-export from infra
+ * only if a future consumer genuinely needs it.)
  * NON-security digest (a dedup/correlation key — collision-resistance is not
  * required; never hash a secret that has not already been redacted/bounded
  * upstream).