eve 0.83.2 → 0.84.0

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # eve
 
+## 0.84.0
+
+### Minor Changes
+
+- 4a4951e: Tools and connections now share the `Approval` policy contract; `approvalKey` and `ApprovalContext.approvedTools` are removed. `once()` remembers the latest approval or denial per resolved tool for the session; custom policies must return its decision unchanged to reuse or record consent.
+- 4a4951e: Session commands now return `Delivery` receipts with independent `stream()` and `result()` reads; the eve HTTP message route accepts `idempotencyKey` for retries within a session's recent-key window. Session creation returns `{ session, delivery }` when a message is supplied and `{ session }` otherwise; import shared contracts from `eve/sessions`.
+- 4a4951e: Public APIs now use eve-owned contracts for history, decisions, channel integrations, and sandboxes; legacy aliases and internal helpers are no longer exported. `decide` takes `signal` instead of `abortSignal` and returns only `answers` and `usage`; update other imports using the [v27 upgrade guide](https://eve.dev/docs/concepts/upgrade-to-v27-events).
+- 4a4951e: Define dynamic capabilities with `defineDynamic(ctx => value)` instead of lifecycle maps, and use ordinary functions and schemas instead of `defineDurableCallback` and `defineDurableSchema`. Cache external JSON observations with `ctx.memo(key, fn)`.
+- 4a4951e: Extension distributions now record the eve version they were built with and a distribution generation instead of per-capability epochs. Extensions built with the old epoch-based manifest must be rebuilt with this release and republished; eve rejects old manifests with rebuild guidance before loading extension code.
+- 4a4951e: Recalled memory is supplied to the model outside durable conversation history, and dynamic user instructions are added only when their content changes. Memory no longer supports compaction recall or `visibility`, and compaction fails if memory capture fails.
+- 4a4951e: Sends, channels, and schedules now accept eve-owned `MessageContent`; images use file parts, and Chat SDK's `messageToUserContent` is renamed to `messageContentOf`. File parts sent through `ctx.agent().send()` must contain HTTP(S) URLs, not inline bytes or base64.
+- 4a4951e: `SessionStore` replaces `EveAgentStore`, and clients and frontend bindings use `baseUrl` instead of `host`. Frontend bindings expose `view`, `messages`, and `agents` directly with native tool and interaction parts; use `followWhile(view)` instead of `followIdle`, and `activeTurn(view)` rather than busy status for Stop controls.
+- 4a4951e: `followAgents: true` now observes child sessions recursively, including workflow-created children, with predicate selection, bounded traversal, and per-session positions and progress. `SessionStore.observe()` supports headless capture; child readers require source-positioned opening events to verify each hop through its parent.
+- 69346ff: Remote agents no longer serve callers on eve 0.66 through 0.68 (remote agent protocol 1), and callers no longer accept remote agents on those releases. Calls in either direction now fail at start with `REMOTE_AGENT_PROTOCOL_MISMATCH`; upgrade both deployments to the same eve release. The `/eve/v1/task-input/:token` route is gone. It accepted unauthenticated answers that settled approvals and added turn input as the session's current user.
+- 4a4951e: Replace `eve remote invoke` and its resumable JSON workflow with `eve remote connect --print <prompt>` for one-shot requests that print the final assistant text and exit. Interactive `eve remote connect` is unchanged; use `eve/client` for scripted multi-turn sessions and input responses.
+- 8efe110: eve's default sandbox image is now tagged by its Dockerfile contents instead of the eve version, so upgrading eve reuses existing sandbox templates unless the image itself changed. Expect one template rebuild on the first upgrade to this release.
+  
+  The default sandbox image no longer includes pnpm or pip, which makes it smaller. Install them in your sandbox `prepare` callback when your agent needs them: run `npm install -g pnpm` for pnpm, and use a Python virtual environment for pip.
+- 4a4951e: The eve HTTP channel now rejects unknown top-level fields on session creation, message, and control requests with HTTP 400 and a list of accepted fields. Correct unsupported options and misspellings instead of relying on them being ignored.
+- 4a4951e: Channel delivery hooks now receive typed `ChannelDelivery` payloads and return replacements; use `channel.state` for state changes. `kindHint` is removed; use path-derived `channel:<name>` identities, `audience()` visibility classification, and the renamed CORS options described in the [v27 upgrade guide](https://eve.dev/docs/concepts/upgrade-to-v27-events).
+- 4a4951e: Slack's `renderers.taskCard` now receives `TaskCard` instead of `TaskCardView`; use `callState` and `callLabel` from `eve/events` for call rendering. Teams channel state replaces `pendingAuthActivityId` with `pendingAuthActivityIds`.
+- 4a4951e: Evals now use v27 facts and interaction projections, with call matchers such as `turn.waitForToolCall()` and renamed helpers such as `calledAgent()` and `awaitingInput()`. The `remoteUrl` field and matcher are removed; use the [v27 upgrade guide](https://eve.dev/docs/concepts/upgrade-to-v27-events) to migrate legacy assertions.
+- 4a4951e: Hooks and channel handlers now receive v27 facts with coordinates in `event.scope` and session state in `ctx.view`. Update channel handlers to `(event, ctx)` with `ctx.channel`, and migrate instrumentation providers to `InstrumentationEvent<K>` and the new lifecycle names.
+- 4a4951e: Approvals, questions, sign-ins, and budget prompts now share the `Interaction` model, with answers shaped as `{ interactionId, optionId?, text? }` and approval choices `approve` / `deny`. Turns pause only for human input, and cancelling an agent task retires it.
+- 4a4951e: Remote agents now use protocol 3 and can still relay approvals, questions, and sign-ins from protocol-2 children. Upgrade callers before their remote agents, or both together: protocol-3 children cannot relay human-input requests to older callers.
+- 4a4951e: Session streams now use v27 facts, line-based cursors, and immutable `SessionView` snapshots queried through `eve/events`. Checkpoints require version 18; keep older sessions on their original deployments and follow the [v27 upgrade guide](https://eve.dev/docs/concepts/upgrade-to-v27-events) before updating event consumers or restoring persisted history.
+
+### Patch Changes
+
+- 4a4951e: Deliver concurrent messages to the same `ctx.agent()` session in send order, preventing out-of-order delivery from leaving calls waiting indefinitely for a reply.
+- 4a4951e: Parent session streams now record accepted child deliveries as `child.sent`; use `agentCallActivity(state, callId)` from `eve/client` to inspect per-call child activity, including shared turns.
+- 4a4951e: An unhandled hook error now fails the running turn instead of only being logged. Cancellation requested with `ctx.cancel()` takes effect only if the handler returns successfully.
+- caa9172: The bundled `eve dev` self-modification subagent is now offered only to the local developer: sessions authenticated by `localDev()` or by the linked project's Vercel development token. Chat users and principals from authored authenticators, including HTTP Basic operators, no longer get the editor and must edit files directly; there is no local authorization override, and callers forwarded by a same-machine tunnel can still get the editor if the channel uses `localDev()`.
+- 4a4951e: Remote child sessions no longer fail solely because the parent has already consumed their result or stopped waiting for it, such as after a lost acknowledgement.
+- 4a4951e: Remote session stream proxies now reject unexpected content types and prevent upstream responses from being served as executable content. Error responses with unexpected content types are replaced with generic JSON while preserving the error status.
+- e7453f1: Session callbacks now reach only public addresses. The eve channel rejects callback URLs with a non-HTTP scheme or a loopback host, and callback delivery refuses to connect when a callback hostname resolves to a loopback, private, link-local, or reserved address. Loopback callbacks still work on local development servers (`eve dev` and `vercel dev`).
+- 4a4951e: Built-in channels keep sign-in links and codes out of shared messages; when private delivery is unavailable, they show a credential-free status instead.
+- 4a4951e: Interrupted durable steps recover from recorded outcomes without automatically replaying observed tool calls. Exhausted step retries fail the turn without closing the session, but external effects with unrecorded outcomes still require application-level idempotency.
+- 4a4951e: v27 deployments can read v26 session history through the v27 client and stream APIs. Convert previously saved legacy events with `convertLegacyEvents` from `eve/internal/legacy-events`, a temporary migration aid.
+- 4a4951e: `eve dev` now validates session event lines before writing them and rejects lines larger than 8 MiB. Set `EVE_CHECK_SESSION_EVENTS=0` to disable validation or `=1` to enable it outside development.
+
+## 0.83.3
+
+### Patch Changes
+
+- 3e96a14: An optimistic message no longer stays in the `submitted` state when its turn is cancelled or fails before the agent reads it. `EveAgentStore` now marks that message `failed`, so it keeps its own text, and later messages reconcile against their own submissions. A steered message the cancelled turn never read now also lets its `send()` settle. Thanks @brettcrane for reporting this in #3102.
+- 8077f2d: With `otel({ traceChannelRequests: true })`, the `agent.channel.request` span now ends when the response body finishes, fails, or is cancelled, not when the route handler returns. Session stream requests no longer log `You can only call end() on a span once.` for `workflow.stream.read.connect`, and request spans now cover the full streaming time. Thanks @ahcarpenter for reporting this and proposing the fix in #4256.
+- 54adf15: `chatSdkChannel` now reports failed final reply delivery with an error-id notice and a note to the model, avoids reposting streamed replies, and skips unchanged final edits after state restoration. Thanks @diegojohnsonl for reporting this in #4801.
+- 4280d51: A hook that cancels the turn at `compaction.completed` no longer drops the compaction's summary call from the session's usage. `session.waiting` and session limits now count it.
+- 181caed: Compaction no longer re-runs on every step when the current user message is most of the context window. After a compaction, eve keeps at most 20,000 tokens of the latest conversation word for word next to the summary, with tool results shortened to 2,000 characters; a current message larger than that keeps its start and end, and the cut-out middle is summarized. A compaction that cannot bring the history under the threshold now fails the session, without retrying the step, with an error that says to start a new session or send a smaller message.
+- cea4eb0: Declare `next` as an optional peer dependency, so `eve/next` types resolve the app's own `next` in pnpm workspaces that install more than one `next` version. Thanks @laugharn for reporting this in #5341.
+- 80db4b3: A session started before eve 0.57 now imports on its next message instead of failing with `IncompatibleStateLayoutError` for `eve.mode`. The import drops the framework context keys that those builds saved and the current build no longer defines. Thanks @sunlanchang for reporting this in #5213.
+- 200d2d8: `localDev()` now refuses requests that a browser sends for another website: a non-loopback request host or `Origin`. A web page open in the developer's browser can no longer start sessions or run the agent's tools on an `eve dev` server, including through DNS rebinding. Frontends served from any loopback host and port still authenticate.
+- 243a4a4: `localDev()` now refuses callers on other machines. Before, an `eve dev` server started with `--host 0.0.0.0` gave every LAN caller the `local-dev` principal, so they could run the agent and its local editing tools, which write to the project's `agent/` source. Callers on the same machine are unchanged, including the developer's own clients when `--host` names a LAN address.
+- da515dc: OpenAPI `operations.allow` and `operations.block` now match an operation's `operationId` as written in the spec, as well as its generated tool name. Before, an `operationId` with characters such as `.` or `/` never matched, because eve compared the filter only against the sanitized tool name, so a blocked operation stayed callable.
+- 9a55d23: OpenAPI connection tools no longer reject valid deeply nested input, such as a Notion page title. eve now keeps the spec's referenced schemas under `$defs` instead of copying them inline up to a depth limit, so validation applies at every depth and shared schemas no longer grow exponentially. Thanks @lildesert for reporting this with a minimal reproduction in #3267.
+- b8b36a8: Preserve the original session output stream’s public encryption metadata during deployment handoffs, avoiding repeated run metadata and encryption-key lookups before later turns.
+- 7cf27bb: Text a root session's model writes before `eve__task_wait` in the same step now posts as a reply. Before, Slack showed it only as the thread status, and Telegram, Teams, and other channels dropped it.
+- f3e3140: Fixed a denial-of-service issue in `webFetch` with `format: "text"`: HTML text extraction now runs in linear time, so malformed pages, such as ones with unclosed `<script>` tags or stray `<` characters, can no longer block the event loop. Content after an unclosed `<script>`, `<style>`, `<noscript>`, or `<!--` is now dropped, as browsers do. Thanks @not2face for the report.
+- de1b9aa: Workspace packages bundled from TypeScript source can now import their own files with `?raw` and other relative asset imports. Before, `eve build` failed with "resolves outside package root" when an agent imported such a package. `?raw` now also works for `.json` files and files without an extension, such as a `Dockerfile`.
+
 ## 0.83.2
 
 ### Patch Changes

package/README.md

@@ -69,11 +69,7 @@ Every authored directory has a typed helper. Import each from the matching subpa
 | `defineSchedule(...)`                                           | `eve/schedules`                       | `schedules/<name>.ts` (or `schedules/<name>.md`) |
 | `defineEval(...)`, `defineEvalConfig(...)`                      | `eve/evals`                           | `evals/<name>.eval.ts`, `evals/evals.config.ts`  |
 
-Runtime accessors live on the subpath that owns the concern:
-
-- `getSession()` — current session, turn, auth, parent lineage (`eve/context`)
-- `getSandbox()` — live sandbox handle for the current agent (`eve/sandbox`)
-- `getContext(key)`, `requireContext(key)`, `hasContext(key)`, `setContext(key)`, `ensureContext(key, factory)` — unified context helpers (`eve/context`)
+Tools, hooks, and other eve-invoked callbacks reach the runtime through `ctx`: `ctx.session` for the current session, turn, auth, and parent lineage, and `ctx.getSandbox()` for the agent's sandbox. Durable state is `defineState` (`eve/context`).
 
 The complete API reference, including types and lower-level runtime primitives, is in the [TypeScript API Reference](https://eve.dev/docs/reference/typescript-api).
 

package/dist/src/_virtual/_rolldown/runtime.js

@@ -1 +1 @@
-import"node:module";export{};
+import"node:module";var __defProp=Object.defineProperty,__getOwnPropDesc=Object.getOwnPropertyDescriptor,__getOwnPropNames=Object.getOwnPropertyNames,__hasOwnProp=Object.prototype.hasOwnProperty,__exportAll=(e,t)=>{let n={};for(var r in e)__defProp(n,r,{get:e[r],enumerable:!0});return t||__defProp(n,Symbol.toStringTag,{value:`Module`}),n},__copyProps=(e,t,n,r)=>{if(t&&typeof t==`object`||typeof t==`function`)for(var i=__getOwnPropNames(t),a=0,o=i.length,s;a<o;a++)s=i[a],!__hasOwnProp.call(e,s)&&s!==n&&__defProp(e,s,{get:(e=>t[e]).bind(null,s),enumerable:!(r=__getOwnPropDesc(t,s))||r.enumerable});return e},__reExport=(e,t,n)=>(__copyProps(e,t,`default`),n&&__copyProps(n,t,`default`));export{__exportAll,__reExport};

package/dist/src/acp/adapter.d.ts

@@ -1,10 +1,13 @@
+import type { SessionStreamEvent } from "#protocol/session-event.js";
 import { type AgentContext, type InitializeRequest, type InitializeResponse, type NewSessionRequest, type NewSessionResponse, type PromptRequest, type PromptResponse } from "#compiled/@agentclientprotocol/sdk/index.js";
 import type { ClientOptions, SendTurnInput } from "#client/types.js";
-import type { HandleMessageStreamEvent } from "#protocol/message.js";
-import type { InputResponse } from "#shared/input.js";
+import type { Answer } from "#shared/input.js";
+interface AdapterDelivery {
+    stream(): AsyncIterable<SessionStreamEvent>;
+}
 interface AdapterClientSession {
-    send(message: SendTurnInput["message"]): Promise<AsyncIterable<HandleMessageStreamEvent>>;
-    respond(inputResponses: readonly InputResponse[]): Promise<AsyncIterable<HandleMessageStreamEvent>>;
+    send(message: SendTurnInput["message"]): Promise<AdapterDelivery>;
+    respond(answers: readonly Answer[]): Promise<AdapterDelivery>;
     cancel(options?: {
         turnId?: string;
     }): Promise<unknown>;
@@ -13,7 +16,7 @@ interface AdapterClientSession {
 interface AdapterClient {
     readonly sessions: {
         create(input: SendTurnInput): Promise<{
-            readonly response: AsyncIterable<HandleMessageStreamEvent>;
+            readonly delivery: AdapterDelivery;
             readonly session: AdapterClientSession;
         }>;
     };

package/dist/src/acp/adapter.js

@@ -1 +1 @@
-import{randomUUID}from"node:crypto";import{realpath}from"node:fs/promises";import{PROTOCOL_VERSION,RequestError,methods}from"#compiled/@agentclientprotocol/sdk/index.js";import{Client,ClientError}from"#client/index.js";import{callStatus,foldSession,initialSessionProjection}from"#protocol/session-projection.js";import{actionLabel,visibleActions}from"#shared/action-label.js";const ANSWER_FIELD=`answer`,ERROR_CODE_EVE=-32002,ACP_TOOL_STATUS={running:`in_progress`,"awaiting-input":`pending`,completed:`completed`,failed:`failed`,rejected:`failed`,cancelled:`failed`,interrupted:`failed`};var EveAcpAdapter=class{#e;#t;#n;#r=!1;#i=new Map;constructor(e){this.#t=e.eveVersion,this.#n=e.workspaceRoot,this.#e=e.client??new Client({auth:e.auth,headers:e.headers,host:e.serverUrl,redirect:`manual`})}initialize(e){return this.#r=e.clientCapabilities?.elicitation?.form!==void 0,{protocolVersion:PROTOCOL_VERSION,agentCapabilities:{loadSession:!1,promptCapabilities:{},sessionCapabilities:{close:{}}},agentInfo:{name:`eve`,title:`eve`,version:this.#t},authMethods:[]}}async newSession(e){if(e.mcpServers.length>0)throw unsupported(`Client-provided MCP servers are not supported by eve ACP mode.`);if((e.additionalDirectories?.length??0)>0)throw unsupported(`Additional workspace directories are not supported by eve ACP mode.`);if(this.#n!==void 0){let t=await normalizedRealpath(e.cwd,`session/new.cwd`),n=await normalizedRealpath(this.#n,`the eve application root`);if(t!==n)throw RequestError.invalidParams({cwd:e.cwd,workspaceRoot:n},`ACP cwd must be the eve application root`)}let t=randomUUID();return this.#i.set(t,{projection:initialSessionProjection(),tools:new Map}),{sessionId:t}}async prompt(e,t,n){let r=this.#s(e.sessionId);if(r.active!==void 0)throw new RequestError(-32001,`ACP session ${e.sessionId} already has an active prompt.`);let i=promptContent(e);r.tools.clear();let a=Promise.withResolvers(),o={cancelRequested:!1,protocolCancelled:!1,outboundController:new AbortController,settled:a.promise,resolveSettled:a.resolve};r.active=o;let onProtocolCancel=()=>{o.protocolCancelled=!0,this.#o(r).catch(()=>void 0)};n.aborted?onProtocolCancel():n.addEventListener(`abort`,onProtocolCancel,{once:!0});try{if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});let a={message:i};for(;;){let i;if(r.client===void 0){if(a.message===void 0)throw Error(`ACP session has not started.`);let e=await this.#e.sessions.create({...a,message:a.message});r.client=e.session,i=e.response}else i=a.inputResponses===void 0?await r.client.send(a.message):await r.client.respond(a.inputResponses);(o.cancelRequested||o.protocolCancelled)&&await this.#o(r);let s=[],c=!1,l,u;for await(let n of i){let i=`data`in n?n.data:void 0,a=i!==void 0&&`turnId`in i?i.turnId:void 0;typeof a==`string`&&(o.turnId=a),n.type===`input.requested`&&s.push(...n.data.requests),n.type===`authorization.required`&&(u=unsupported(`Connection authorization cannot be completed through eve ACP mode.`)),n.type===`turn.cancelled`&&(c=!0),(n.type===`turn.failed`||n.type===`session.failed`)&&(l=n),await this.#c(e.sessionId,r,n,t)}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(c||o.cancelRequested)return{stopReason:`cancelled`};if(l!==void 0)throw await this.#l(e.sessionId,r,t),eveFailure(l);if(u!==void 0)throw u;if(s.length===0)return{stopReason:`end_turn`};let d;try{d=await Promise.all(s.map(i=>this.#d(e.sessionId,r,i,t,n)))}catch(t){if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};throw t}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};a={inputResponses:d}}}catch(e){throw acpRequestError(e)}finally{n.removeEventListener(`abort`,onProtocolCancel),r.tools.clear(),o.resolveSettled(),r.active===o&&(r.active=void 0)}}async cancel(e){let t=this.#i.get(e);t!==void 0&&t.active!==void 0&&(t.active.cancelRequested=!0,await this.#o(t))}async closeSession(e){let t=this.#s(e);this.#i.delete(e),await this.#a(t)}async close(){let e=[...this.#i.values()];this.#i.clear(),await Promise.allSettled(e.map(e=>this.#a(e)))}async#a(e){let t;if(e.active!==void 0){let n=e.active;n.cancelRequested=!0;try{await this.#o(e)}catch(e){t=e}await n.settled}try{await e.client?.reset()}catch(e){throw t===void 0?e:AggregateError([t,e],`Could not cancel or reset the eve session`)}if(t!==void 0)throw t}async#o(e){e.active?.outboundController.abort(),e.client!==void 0&&await e.client.cancel(e.active?.turnId===void 0?void 0:{turnId:e.active.turnId})}#s(e){let t=this.#i.get(e);if(t===void 0)throw RequestError.invalidParams({sessionId:e},`Unknown or closed ACP session`);return t}async#c(e,t,n,r){let i=t.projection;if(t.projection=foldSession(i,n),await this.#u(e,t,n,r),n.type===`actions.requested`)return;let a=new Set,{calls:o,tasks:s,turns:c}=t.projection;if(o!==i.calls||s!==i.tasks||c!==i.turns)for(let s of Object.keys(o)){if(!t.tools.has(s))continue;let o=callStatus(t.projection,s);o!==void 0&&o!==callStatus(i,s)&&(a.add(s),await notifyUpdate(r,e,{sessionUpdate:`tool_call_update`,toolCallId:s,status:ACP_TOOL_STATUS[o],...callOutput(n,s),...resultTitle(n,s)}))}let l=n.type===`action.result`?n.data.result.callId:n.type===`task.settled`?n.data.callId:void 0;if(l===void 0||a.has(l)||!t.tools.has(l))return;let u=callOutput(n,l),d=callStatus(t.projection,l);`content`in u&&d!==void 0&&await notifyUpdate(r,e,{sessionUpdate:`tool_call_update`,toolCallId:l,status:ACP_TOOL_STATUS[d],...u,...resultTitle(n,l)})}async#l(e,t,n){for(let r of t.tools.keys())callStatus(t.projection,r)===`running`&&await notifyUpdate(n,e,{sessionUpdate:`tool_call_update`,toolCallId:r,status:ACP_TOOL_STATUS.failed})}async#u(e,t,n,r){switch(n.type){case`message.appended`:await notifyUpdate(r,e,{sessionUpdate:`agent_message_chunk`,content:{type:`text`,text:n.data.messageDelta},messageId:`${n.data.turnId}:message:${n.data.stepIndex}`});return;case`reasoning.appended`:await notifyUpdate(r,e,{sessionUpdate:`agent_thought_chunk`,content:{type:`text`,text:n.data.reasoningDelta},messageId:`${n.data.turnId}:thought:${n.data.stepIndex}`});return;case`actions.requested`:for(let i of visibleActions(n.data.actions)){let a=toolCallForAction(i,n.data.presentation);t.tools.set(i.callId,a),await notifyUpdate(r,e,{sessionUpdate:`tool_call`,...a})}return;default:return}}async#d(e,t,n,r,i){let a=AbortSignal.any([i,t.active.outboundController.signal]);if(n.display===`confirmation`){let i=`${n.requestId}:approve`,o=`${n.requestId}:deny`,s=t.tools.get(n.action.callId)??toolCallForAction(n.action),c=await r.request(methods.client.session.requestPermission,{sessionId:e,toolCall:s,options:[{kind:`allow_once`,name:`Approve`,optionId:i},{kind:`reject_once`,name:`Deny`,optionId:o}]},{cancellationSignal:a});if(c.outcome.outcome===`cancelled`)return this.#f(t),{requestId:n.requestId};if(c.outcome.optionId===i)return{requestId:n.requestId,optionId:`approve`};if(c.outcome.optionId===o)return{requestId:n.requestId,optionId:`deny`};throw RequestError.invalidParams({optionId:c.outcome.optionId},`Unknown ACP permission option`)}if(!this.#r)throw unsupported(`The ACP client does not support form elicitation required by this eve question.`);let o=elicitationProperty(n),s=await r.request(methods.client.elicitation.create,{mode:`form`,sessionId:e,message:n.prompt,requestedSchema:{type:`object`,properties:{[ANSWER_FIELD]:o},required:[ANSWER_FIELD]}},{cancellationSignal:a});if(s.action!==`accept`)return this.#f(t),{requestId:n.requestId};let c=s.content?.[ANSWER_FIELD];if(typeof c!=`string`)throw RequestError.invalidParams(s.content,`ACP elicitation response must contain a string answer`);if(n.display===`select`){if(!n.options?.some(e=>e.id===c))throw RequestError.invalidParams({answer:c},`Unknown eve question option`);return{requestId:n.requestId,optionId:c}}return{requestId:n.requestId,text:c}}#f(e){let t=e.active;t.cancelRequested=!0,t.outboundController.abort()}};async function normalizedRealpath(e,t){try{return await realpath(e)}catch(n){throw RequestError.invalidParams({path:e},`Could not resolve ${t}: ${errorMessage(n)}`)}}function promptContent(e){let t=e.prompt.map(e=>{if(e.type!==`text`)throw unsupported(`ACP prompt content type ${JSON.stringify(e.type)} is not supported.`);return{type:`text`,text:e.text}});if(t.every(e=>e.text.length===0))throw RequestError.invalidParams(e.prompt,`ACP prompt must contain at least one non-empty text block`);return t}function toolCallForAction(e,t){return{toolCallId:e.callId,title:actionLabel(e,t),kind:`other`,status:`pending`,rawInput:e.input}}function elicitationProperty(e){if(e.display===`select`&&e.allowFreeform!==!0&&e.options?.length)return{type:`string`,title:e.prompt,oneOf:e.options.map(e=>({const:e.id,title:e.label,description:e.description}))};if(e.display===`text`&&e.allowFreeform!==!1)return{type:`string`,title:e.prompt,minLength:1};throw unsupported(`This eve question shape cannot be represented by ACP form elicitation.`)}async function notifyUpdate(e,t,n){await e.notify(methods.client.session.update,{sessionId:t,update:n})}function stringifyOutput(e){return typeof e==`string`?e:JSON.stringify(e,null,2)}function unsupported(e){return new RequestError(-32003,e)}function eveFailure(e){return new RequestError(ERROR_CODE_EVE,e.data.message,{code:e.data.code,details:e.data.details})}function acpRequestError(e){return e instanceof RequestError?e:e instanceof ClientError?new RequestError(ERROR_CODE_EVE,e.message,{httpStatus:e.status}):new RequestError(ERROR_CODE_EVE,errorMessage(e))}function errorMessage(e){return e instanceof Error?e.message:String(e)}function resultTitle(e,t){let n=e.type===`action.result`?e.data.presentation?.[t]?.label:void 0;return n===void 0?{}:{title:n}}function callOutput(e,t){let n=e.type===`action.result`&&e.data.result.callId===t?e.data.result.output:e.type===`task.settled`&&e.data.callId===t?e.data.output===void 0?e.data.error?.message:e.data.output:void 0;return n===void 0?{}:{content:[{type:`content`,content:{type:`text`,text:stringifyOutput(n)}}],rawOutput:n}}export{EveAcpAdapter};
+import{randomUUID}from"node:crypto";import{realpath}from"node:fs/promises";import{PROTOCOL_VERSION,RequestError,methods}from"#compiled/@agentclientprotocol/sdk/index.js";import{Client,ClientError}from"#client/index.js";import{isFactType}from"#protocol/session-events/catalog.js";import{emptySessionView,foldReceivedEvent}from"#protocol/session-projection/fold.js";import{interaction}from"#protocol/session-projection/reader.js";import{callLabel,callOutputSource,callState}from"#protocol/session-projection/selectors.js";import{actionLabel}from"#shared/action-label.js";import{failureOf}from"#client/session-utils.js";const ANSWER_FIELD=`answer`,ERROR_CODE_EVE=-32002;function acpStatus(e,t){switch(callState(e,t)){case void 0:return;case`requested`:case`approval`:return`pending`;case`running`:case`blocked`:return`in_progress`;case`completed`:return`completed`;default:return`failed`}}var EveAcpAdapter=class{#e;#t;#n;#r=!1;#i=new Map;constructor(e){this.#t=e.eveVersion,this.#n=e.workspaceRoot,this.#e=e.client??new Client({auth:e.auth,headers:e.headers,baseUrl:e.serverUrl,redirect:`manual`})}initialize(e){return this.#r=e.clientCapabilities?.elicitation?.form!==void 0,{protocolVersion:PROTOCOL_VERSION,agentCapabilities:{loadSession:!1,promptCapabilities:{},sessionCapabilities:{close:{}}},agentInfo:{name:`eve`,title:`eve`,version:this.#t},authMethods:[]}}async newSession(e){if(e.mcpServers.length>0)throw unsupported(`Client-provided MCP servers are not supported by eve ACP mode.`);if((e.additionalDirectories?.length??0)>0)throw unsupported(`Additional workspace directories are not supported by eve ACP mode.`);if(this.#n!==void 0){let t=await normalizedRealpath(e.cwd,`session/new.cwd`),n=await normalizedRealpath(this.#n,`the eve application root`);if(t!==n)throw RequestError.invalidParams({cwd:e.cwd,workspaceRoot:n},`ACP cwd must be the eve application root`)}let t=randomUUID();return this.#i.set(t,{view:emptySessionView(),tools:new Map,parts:new Map}),{sessionId:t}}async prompt(e,t,n){let r=this.#s(e.sessionId);if(r.active!==void 0)throw new RequestError(-32001,`ACP session ${e.sessionId} already has an active prompt.`);let i=promptContent(e);r.tools.clear(),r.parts.clear();let a=Promise.withResolvers(),o={cancelRequested:!1,protocolCancelled:!1,outboundController:new AbortController,settled:a.promise,resolveSettled:a.resolve};r.active=o;let onProtocolCancel=()=>{o.protocolCancelled=!0,this.#o(r).catch(()=>void 0)};n.aborted?onProtocolCancel():n.addEventListener(`abort`,onProtocolCancel,{once:!0});try{if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});let a={message:i};for(;;){let i;if(r.client===void 0){if(a.message===void 0)throw Error(`ACP session has not started.`);let e=await this.#e.sessions.create({...a,message:a.message});r.client=e.session,i=e.delivery}else i=a.answers===void 0?await r.client.send(a.message):await r.client.respond(a.answers);(o.cancelRequested||o.protocolCancelled)&&await this.#o(r);let s=[],c=!1,l,u;for await(let n of i.stream()){let i=`data`in n?n.data:void 0,a=i!==void 0&&`turnId`in i?i.turnId:void 0;if(typeof a==`string`&&(o.turnId=a),n.type===`interaction.opened`&&n.data.request.kind===`sign-in`&&(u=unsupported(`Connection authorization cannot be completed through eve ACP mode.`)),n.type===`turn.settled`&&n.data.outcome===`cancelled`&&(c=!0),l=failureOf(n)??l,await this.#c(e.sessionId,r,n,t),n.type===`interaction.opened`){let e=interaction(r.view,n.data.interactionId);e!==void 0&&e.request.kind!==`sign-in`&&s.push(e)}}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested||c&&l===void 0)return{stopReason:`cancelled`};if(l!==void 0)throw await this.#l(e.sessionId,r,t),eveFailure(l);if(u!==void 0)throw u;if(s.length===0)return{stopReason:`end_turn`};let d;try{d=await Promise.all(s.map(i=>this.#d(e.sessionId,r,i,t,n)))}catch(t){if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};throw t}if(o.protocolCancelled)throw RequestError.requestCancelled({sessionId:e.sessionId});if(o.cancelRequested)return{stopReason:`cancelled`};a={answers:d}}}catch(e){throw acpRequestError(e)}finally{n.removeEventListener(`abort`,onProtocolCancel),r.tools.clear(),o.resolveSettled(),r.active===o&&(r.active=void 0)}}async cancel(e){let t=this.#i.get(e);t!==void 0&&t.active!==void 0&&(t.active.cancelRequested=!0,await this.#o(t))}async closeSession(e){let t=this.#s(e);this.#i.delete(e),await this.#a(t)}async close(){let e=[...this.#i.values()];this.#i.clear(),await Promise.allSettled(e.map(e=>this.#a(e)))}async#a(e){let t;if(e.active!==void 0){let n=e.active;n.cancelRequested=!0;try{await this.#o(e)}catch(e){t=e}await n.settled}try{await e.client?.reset()}catch(e){throw t===void 0?e:AggregateError([t,e],`Could not cancel or reset the eve session`)}if(t!==void 0)throw t}async#o(e){e.active?.outboundController.abort(),e.client!==void 0&&await e.client.cancel(e.active?.turnId===void 0?void 0:{turnId:e.active.turnId})}#s(e){let t=this.#i.get(e);if(t===void 0)throw RequestError.invalidParams({sessionId:e},`Unknown or closed ACP session`);return t}async#c(e,t,n,r){if(!isFactType(n.type)){await this.#u(e,t,n,r);return}if(foldReceivedEvent(t.view,n),await this.#u(e,t,n,r),n.type===`call.requested`)return;let i=n.type===`call.settled`?n.data.callId:void 0;for(let[a,o]of t.tools){let s=acpStatus(t.view,a);if(s===void 0)continue;let c=callOutput(n,a,t.view);(s!==o.status||a===i&&`content`in c)&&(t.tools.set(a,{...o,status:s}),await notifyUpdate(r,e,{sessionUpdate:`tool_call_update`,toolCallId:a,status:s,...c,...resultTitle(n,a)}))}}async#l(e,t,n){for(let r of t.tools.keys())acpStatus(t.view,r)===`in_progress`&&await notifyUpdate(n,e,{sessionUpdate:`tool_call_update`,toolCallId:r,status:`failed`})}async#u(e,t,n,r){switch(n.type){case`content.delta`:{let{partId:i,kind:a,delta:o}=n.data;a===`text`?t.parts.set(i,`text`):a===`reasoning`&&t.parts.set(i,`reasoning`);let s=t.parts.get(i);if(s===void 0||o===void 0)return;await notifyUpdate(r,e,{sessionUpdate:s===`text`?`agent_message_chunk`:`agent_thought_chunk`,content:{type:`text`,text:o},messageId:i});return}case`content.completed`:{let{partId:i,kind:a,value:o}=n.data;if(t.parts.has(i)||typeof o!=`string`||a!==`text`&&a!==`reasoning`)return;t.parts.set(i,a===`text`?`text`:`reasoning`),await notifyUpdate(r,e,{sessionUpdate:a===`text`?`agent_message_chunk`:`agent_thought_chunk`,content:{type:`text`,text:o},messageId:i});return}case`call.requested`:{let{callId:i,capability:a,input:o}=n.data,s=t.view.calls[i];if(a.kind===`control`||s===void 0)return;let c={toolCallId:i,title:callLabel(s),kind:`other`,status:`pending`,rawInput:o};t.tools.set(i,c),await notifyUpdate(r,e,{sessionUpdate:`tool_call`,...c});return}default:return}}async#d(e,t,n,r,i){let a=AbortSignal.any([i,t.active.outboundController.signal]);if(n.request.display===`confirmation`){let i=`${n.interactionId}:approve`,o=`${n.interactionId}:deny`,s=(n.call===void 0?void 0:t.tools.get(n.call.callId))??toolCallForAsked(n),c=await r.request(methods.client.session.requestPermission,{sessionId:e,toolCall:s,options:[{kind:`allow_once`,name:`Approve`,optionId:i},{kind:`reject_once`,name:`Deny`,optionId:o}]},{cancellationSignal:a});if(c.outcome.outcome===`cancelled`)return this.#f(t),{interactionId:n.interactionId};if(c.outcome.optionId===i)return{interactionId:n.interactionId,optionId:`approve`};if(c.outcome.optionId===o)return{interactionId:n.interactionId,optionId:`deny`};throw RequestError.invalidParams({optionId:c.outcome.optionId},`Unknown ACP permission option`)}if(!this.#r)throw unsupported(`The ACP client does not support form elicitation required by this eve question.`);let o=elicitationProperty(n),s=await r.request(methods.client.elicitation.create,{mode:`form`,sessionId:e,message:n.request.prompt,requestedSchema:{type:`object`,properties:{[ANSWER_FIELD]:o},required:[ANSWER_FIELD]}},{cancellationSignal:a});if(s.action!==`accept`)return this.#f(t),{interactionId:n.interactionId};let c=s.content?.[ANSWER_FIELD];if(typeof c!=`string`)throw RequestError.invalidParams(s.content,`ACP elicitation response must contain a string answer`);if(n.request.display===`select`){if(!n.request.options?.some(e=>e.id===c))throw RequestError.invalidParams({answer:c},`Unknown eve question option`);return{interactionId:n.interactionId,optionId:c}}return{interactionId:n.interactionId,text:c}}#f(e){let t=e.active;t.cancelRequested=!0,t.outboundController.abort()}};async function normalizedRealpath(e,t){try{return await realpath(e)}catch(n){throw RequestError.invalidParams({path:e},`Could not resolve ${t}: ${errorMessage(n)}`)}}function promptContent(e){let t=e.prompt.map(e=>{if(e.type!==`text`)throw unsupported(`ACP prompt content type ${JSON.stringify(e.type)} is not supported.`);return{type:`text`,text:e.text}});if(t.every(e=>e.text.length===0))throw RequestError.invalidParams(e.prompt,`ACP prompt must contain at least one non-empty text block`);return t}function toolCallForAsked(e){let t=e.call?.name??e.request.kind;return{toolCallId:e.call?.callId??e.interactionId,title:actionLabel({callId:e.call?.callId??``,input:{},kind:`tool-call`,toolName:t},void 0),kind:`other`,status:`pending`,rawInput:e.call?.input??{}}}function elicitationProperty(e){if(e.request.display===`select`&&e.request.allowFreeform!==!0&&e.request.options?.length)return{type:`string`,title:e.request.prompt,oneOf:e.request.options.map(e=>({const:e.id,title:e.label,description:e.description}))};if(e.request.display===`text`&&e.request.allowFreeform!==!1)return{type:`string`,title:e.request.prompt,minLength:1};throw unsupported(`This eve question shape cannot be represented by ACP form elicitation.`)}async function notifyUpdate(e,t,n){await e.notify(methods.client.session.update,{sessionId:t,update:n})}function stringifyOutput(e){return typeof e==`string`?e:JSON.stringify(e,null,2)}function unsupported(e){return new RequestError(-32003,e)}function eveFailure(e){return new RequestError(ERROR_CODE_EVE,e.message,{code:e.code,id:e.id,hint:e.hint})}function acpRequestError(e){return e instanceof RequestError?e:e instanceof ClientError?new RequestError(ERROR_CODE_EVE,e.message,{httpStatus:e.status}):new RequestError(ERROR_CODE_EVE,errorMessage(e))}function errorMessage(e){return e instanceof Error?e.message:String(e)}function resultTitle(e,t){let n=e.type===`call.settled`&&e.data.callId===t?e.data.label:void 0;return n===void 0?{}:{title:n}}function callOutput(e,t,n){if(e.type!==`call.settled`||e.data.callId!==t)return{};let r=e.data.outputOf,i=r===void 0?void 0:callOutputSource(n,r.callId)?.output,a=e.data.output===void 0?i===void 0?e.data.error?.message:i:e.data.output;return a===void 0?{}:{content:[{type:`content`,content:{type:`text`,text:stringifyOutput(a)}}],rawOutput:a}}export{EveAcpAdapter};

package/dist/src/ai/decide.d.ts

@@ -1,7 +1,3 @@
-import { experimental_decide as decideWithAiSdk, type Experimental_DecisionModel as DecisionModel, type Experimental_DecisionQuestion as DecisionQuestion } from "ai";
-export declare const DEFAULT_DECISION_MODEL = "typesafe-ai/jev";
-/** Decide typed questions about the state you pass to it using eve's model authentication. */
-export declare function decide<const Questions extends Record<string, DecisionQuestion>>({ model, ...options }: Omit<Parameters<typeof decideWithAiSdk<Questions>>[0], "model"> & {
-    /** Decision model instance or ID. Defaults to TypeSafe Jev. */
-    model?: DecisionModel;
-}): Promise<import("ai").Experimental_DecisionResult<Questions>>;
+import type { DecisionOptions, DecisionQuestion, DecisionResult } from "#ai/decision-types.js";
+/** Decide typed questions about shared state using eve's model authentication. */
+export declare function decide<const Questions extends Readonly<Record<string, DecisionQuestion>>>(options: DecisionOptions<Questions>): Promise<DecisionResult<Questions>>;

package/dist/src/ai/decide.js

@@ -1 +1 @@
-import{experimental_decide}from"ai";import{ensureAiSdkWarningLogger}from"#instrumentation/ai-sdk-warnings.js";import{localGatewayDecisionModel}from"#internal/model-auth/transport.js";const DEFAULT_DECISION_MODEL=`typesafe-ai/jev`;function decide({model:e=DEFAULT_DECISION_MODEL,...t}){return ensureAiSdkWarningLogger(),experimental_decide({...t,model:typeof e==`string`&&Reflect.get(globalThis,`AI_SDK_DEFAULT_PROVIDER`)==null?localGatewayDecisionModel(e)??e:e})}export{DEFAULT_DECISION_MODEL,decide};
+import{decideWithMetadata}from"#ai/decision-adapter.js";async function decide(e){let t=await decideWithMetadata(e);return{answers:t.answers,usage:{inputTokens:t.usage.inputTokens,outputTokens:t.usage.outputTokens,totalTokens:t.usage.totalTokens}}}export{decide};

package/dist/src/ai/decision-adapter.d.ts

@@ -0,0 +1,7 @@
+import { experimental_decide as decideWithAiSdk } from "ai";
+import type { DecisionOptions, DecisionQuestion } from "#ai/decision-types.js";
+export declare const DEFAULT_DECISION_MODEL = "typesafe-ai/jev";
+/** Internal eval diagnostics retain SDK metadata without promising it to applications. */
+export declare function decideWithMetadata<const Questions extends Readonly<Record<string, DecisionQuestion>>>({ model, state, questions, maxRetries, signal, providerOptions, }: DecisionOptions<Questions> & {
+    readonly providerOptions?: Parameters<typeof decideWithAiSdk>[0]["providerOptions"];
+}): Promise<import("ai").Experimental_DecisionResult<Questions>>;

package/dist/src/ai/decision-adapter.js

@@ -0,0 +1 @@
+import{experimental_decide}from"ai";import{ensureAiSdkWarningLogger}from"#instrumentation/ai-sdk-warnings.js";import{localGatewayDecisionModel}from"#internal/model-auth/transport.js";const DEFAULT_DECISION_MODEL=`typesafe-ai/jev`;function decideWithMetadata({model:e=DEFAULT_DECISION_MODEL,state:t,questions:n,maxRetries:r,signal:i,providerOptions:a}){if(ensureAiSdkWarningLogger(),typeof e!=`string`&&typeof Reflect.get(e,`doDecide`)!=`function`&&typeof Reflect.get(e,`doEvaluate`)!=`function`)throw TypeError(`decide requires a provider decision model implementation, not just its identity.`);return experimental_decide({model:typeof e==`string`&&Reflect.get(globalThis,`AI_SDK_DEFAULT_PROVIDER`)==null?localGatewayDecisionModel(e)??e:e,state:t,questions:n,maxRetries:r,abortSignal:i,providerOptions:a})}export{DEFAULT_DECISION_MODEL,decideWithMetadata};

package/dist/src/ai/decision-types.d.ts

@@ -0,0 +1,86 @@
+import type { HistoryMessage } from "#shared/history-message.js";
+import type { JsonObject, JsonValue } from "#shared/json.js";
+/** A model ID or an installed provider's decision model instance.
+ * The installed AI SDK validates the model specification at runtime.
+ * An identity object without a decision implementation is not a model.
+ */
+export type DecisionModel = string | ({
+    readonly provider: string;
+    readonly modelId: string;
+    readonly specificationVersion: string;
+} & ({
+    readonly doDecide: (...args: never[]) => unknown;
+} | {
+    readonly doEvaluate: (...args: never[]) => unknown;
+}));
+/** Text, an object, or ordered multimodal parts shared by every question. */
+export type DecisionState = string | JsonObject | readonly DecisionStatePart[];
+type UserContent = Extract<HistoryMessage, {
+    role: "user";
+}>["content"];
+/** One text, file, or JSON part of shared decision state. */
+export type DecisionStatePart = Extract<Exclude<UserContent, string>[number], {
+    type: "text" | "file";
+}> | {
+    readonly type: "json";
+    readonly value: JsonValue;
+};
+/** Text or JSON used to describe a question or rubric entry. */
+export type DecisionInput = string | JsonObject | readonly JsonValue[];
+/** One independently answered choice, ordered score, or probability question. */
+export type DecisionQuestion = {
+    readonly type: "choice";
+    readonly instructions: DecisionInput;
+    readonly criteria: Readonly<Record<string, DecisionInput | null>>;
+} | {
+    readonly type: "score";
+    readonly instructions: DecisionInput;
+    readonly criteria: readonly (DecisionInput | null)[];
+} | {
+    readonly type: "boolean";
+    readonly instructions: DecisionInput;
+    readonly criteria?: {
+        readonly true?: DecisionInput | null;
+        readonly false?: DecisionInput | null;
+    };
+};
+/** Answer inferred from the authored question and its choice keys. */
+export type DecisionAnswer<Q extends DecisionQuestion> = Q extends {
+    type: "choice";
+    criteria: infer Criteria;
+} ? {
+    readonly type: "choice";
+    readonly choice: Extract<keyof Criteria, string>;
+    readonly probabilities?: Readonly<Record<Extract<keyof Criteria, string>, number>>;
+} : Q extends {
+    type: "score";
+} ? {
+    readonly type: "score";
+    readonly score: number;
+    readonly probabilities?: Readonly<Record<string, number>>;
+} : {
+    readonly type: "boolean";
+    readonly probability: number;
+};
+/** Typed answers and normalized token usage; provider metadata stays internal. */
+export interface DecisionResult<Questions extends Readonly<Record<string, DecisionQuestion>>> {
+    readonly answers: {
+        readonly [Id in keyof Questions]: DecisionAnswer<Questions[Id]>;
+    };
+    readonly usage: {
+        readonly inputTokens: number | undefined;
+        readonly outputTokens: number | undefined;
+        readonly totalTokens: number | undefined;
+    };
+}
+/** Stable options accepted by eve's standalone decision API. */
+export interface DecisionOptions<Questions extends Readonly<Record<string, DecisionQuestion>>> {
+    /** Defaults to TypeSafe Jev, using eve's normal model authentication. */
+    readonly model?: DecisionModel;
+    readonly state: DecisionState;
+    readonly questions: Questions;
+    /** Maximum retries for transient provider failures. Defaults to 2. */
+    readonly maxRetries?: number;
+    readonly signal?: AbortSignal;
+}
+export {};

package/dist/src/approval/definition.d.ts

@@ -3,7 +3,7 @@ import type { SessionParent, SessionTurn } from "#context/keys.js";
 import type { ToolAuthOptions, ToolAuthProvider } from "#tools/auth.js";
 import type { SessionContext } from "#context/session-context.js";
 import type { TokenResult } from "#shared/connection-types.js";
-type ApprovalToolInput<TInput> = TInput extends object ? Readonly<TInput> : TInput;
+export type ApprovalToolInput<TInput> = TInput extends object ? Readonly<TInput> : TInput;
 /** Context passed to an approval prompt callback. */
 export interface ApprovalPromptContext<TInput = Record<string, unknown>> {
     /** Id of the tool call awaiting approval. */
@@ -24,7 +24,6 @@ export type ApprovalPrompt<TInput = Record<string, unknown>> = (context: Approva
 export interface ApprovalContext<TInput = Record<string, unknown>> extends SessionContext {
     /** Cancels policy work when the active model generation is cancelled. */
     readonly abortSignal: AbortSignal;
-    readonly approvedTools: ReadonlySet<string>;
     readonly callId: string;
     /**
      * Behavior hints the connection's server declared for this tool, such as
@@ -72,7 +71,7 @@ export type ApprovalPolicy<TInput = Record<string, unknown>> = (ctx: ApprovalCon
 /** Stable tool request passed to a response authorizer. */
 export interface ApprovalRequest<TInput = Record<string, unknown>> {
     readonly callId: string;
-    readonly requestId: string;
+    readonly interactionId: string;
     /**
      * Who requested the tool call: the auth of the caller whose turn made it,
      * captured when the approval was requested. It stays the same while the
@@ -97,7 +96,7 @@ export interface ApprovalResponseAuth {
 }
 /** Submitted response passed to an approval response policy. */
 export interface ApprovalResponse {
-    readonly decision: "approve" | "cancel";
+    readonly decision: "approve" | "deny";
     /**
      * Who submitted the response: the authenticated principal, including its
      * `principalId`, `principalType`, `authenticator`, and `attributes`.
@@ -125,18 +124,12 @@ export type ApprovalResponseDecision = {
 export type ApprovalResponsePolicy<TInput = Record<string, unknown>> = (ctx: ApprovalResponseContext<TInput>) => ApprovalResponseDecision | Promise<ApprovalResponseDecision>;
 /** Approval definition with request- and response-time policy. */
 export interface ApprovalConfiguration<TInput = Record<string, unknown>> {
+    /** Optional human-readable prompt shown when this call requires approval. */
+    readonly prompt?: ApprovalPrompt<TInput>;
     readonly request: ApprovalPolicy<TInput>;
     readonly response?: ApprovalResponsePolicy<TInput>;
 }
 /** Shared approval definition used by authored tools and connections. */
 export type Approval<TInput = Record<string, unknown>> = ApprovalPolicy<TInput> | ApprovalConfiguration<TInput>;
-/** Approval configuration for a tool, including its optional presentation prompt. */
-export interface ToolApprovalConfiguration<TInput = Record<string, unknown>> extends ApprovalConfiguration<TInput> {
-    /** Optional human-readable prompt shown when this tool requires approval. */
-    readonly prompt?: ApprovalPrompt<TInput>;
-}
-/** Approval definition used by authored tools. */
-export type ToolApproval<TInput = Record<string, unknown>> = ApprovalPolicy<TInput> | ToolApprovalConfiguration<TInput>;
 /** Returns the request-time policy from either approval authoring shape. */
 export declare function resolveApprovalPolicy<TInput>(approval: Approval<TInput>): ApprovalPolicy<TInput>;
-export {};

package/dist/src/approval/evaluation.d.ts

@@ -0,0 +1,48 @@
+import type { ApprovalContext, ApprovalPolicy, ApprovalStatus } from "#approval/definition.js";
+import { type ApprovalDecision } from "#approval/status.js";
+import type { JsonValue } from "#shared/json.js";
+/** A person's decision on a request that asked to be remembered, kept under the request's key. */
+export interface RememberedApproval {
+    readonly outcome: "accepted" | "declined";
+    /** The interaction whose settlement recorded the decision. */
+    readonly interactionId: string;
+    readonly state?: JsonValue;
+}
+/** Where a request's settlement is remembered, with the state the policy attached. */
+export interface RememberRequest {
+    readonly key: string;
+    readonly state?: JsonValue;
+}
+/** What policies can read: remembered decisions, and the keys open requests will record under. */
+export interface ApprovalMemory {
+    readonly remembered: Readonly<Record<string, RememberedApproval>>;
+    readonly pending: readonly string[];
+}
+/**
+ * The harness's evaluation of one call's approval policy, private to eve's own policies. Keys are
+ * scoped to the tool the harness resolved: a policy can't read or record another tool's decisions,
+ * whatever key it names or however it renames its context.
+ */
+export interface ApprovalEvaluation {
+    readonly recheck: boolean;
+    readonly read: (key: string) => {
+        readonly entry?: RememberedApproval;
+        readonly pending: boolean;
+    };
+    /** Asks a person; their decision is remembered under `remember.key` when it settles. */
+    readonly ask: (remember: RememberRequest) => ApprovalStatus;
+}
+export declare function approvalEvaluation(context: ApprovalContext): ApprovalEvaluation | undefined;
+/** Runs `policy` for one call. A person who already approved the call isn't asked again. */
+export declare function evaluateApproval(policy: ApprovalPolicy, context: ApprovalContext, input?: {
+    readonly memory?: ApprovalMemory;
+    readonly recheck?: boolean;
+}): Promise<ApprovalDecision>;
+/** Remembers a person's decision under the key its request named, replacing an earlier one. */
+export declare function rememberDecision(remembered: Readonly<Record<string, RememberedApproval>>, request: {
+    readonly interactionId: string;
+    readonly remember?: RememberRequest;
+}, outcome: RememberedApproval["outcome"]): Readonly<Record<string, RememberedApproval>>;
+export declare function inheritApprovalContext<T extends ApprovalContext>(source: ApprovalContext, context: T): T;
+/** Whether `context` is the re-check of an approved call just before it runs. */
+export declare function isApprovalRecheck(context: ApprovalContext): boolean;

package/dist/src/approval/evaluation.js

@@ -0,0 +1 @@
+import{approvalDecision}from"#approval/status.js";const NO_MEMORY={pending:[],remembered:{}},evaluationKey=Symbol.for(`eve.approval-evaluation`);function approvalEvaluation(e){return e[evaluationKey]}async function evaluateApproval(e,t,n={}){let{memory:r=NO_MEMORY,recheck:i=!1}=n,a=new WeakMap,scoped=e=>JSON.stringify([t.toolName,e]),o=Object.freeze({ask:e=>{let t=Object.freeze({type:`user-approval`});return a.set(t,{...e,key:scoped(e.key)}),t},read:e=>({entry:r.remembered[scoped(e)],pending:r.pending.includes(scoped(e))}),recheck:i}),s=await e({...t,[evaluationKey]:o}),c=approvalDecision(s);if(c.awaitsPerson!==!0)return c;if(i)return{denied:!1};let l=typeof s==`object`&&s?a.get(s):void 0;return l===void 0?c:{...c,remember:l}}function rememberDecision(e,t,n){let{remember:r}=t;return r===void 0?e:{...e,[r.key]:{interactionId:t.interactionId,outcome:n,...r.state!==void 0&&{state:r.state}}}}function inheritApprovalContext(e,t){let n=approvalEvaluation(e);return n===void 0||approvalEvaluation(t)===n?t:{...t,[evaluationKey]:n}}function isApprovalRecheck(e){return approvalEvaluation(e)?.recheck===!0}export{approvalEvaluation,evaluateApproval,inheritApprovalContext,isApprovalRecheck,rememberDecision};

package/dist/src/approval/status.d.ts

@@ -0,0 +1,14 @@
+import type { ApprovalStatus } from "#approval/definition.js";
+import type { ClearedBy } from "#protocol/session-events/families/call.js";
+import type { RememberRequest } from "#approval/evaluation.js";
+export type NormalizedApprovalStatus = Exclude<ApprovalStatus, boolean>;
+/** Normalize legacy predicates and reject malformed JavaScript policy returns before execution. */
+export declare function normalizeApprovalStatus(value: unknown): NormalizedApprovalStatus;
+export interface ApprovalDecision {
+    readonly remember?: RememberRequest;
+    readonly clearedBy?: ClearedBy;
+    readonly denied: boolean;
+    readonly awaitsPerson?: true;
+    readonly reason?: string;
+}
+export declare function approvalDecision(value: unknown): ApprovalDecision;

package/dist/src/approval/status.js

@@ -0,0 +1 @@
+function normalizeApprovalStatus(e){if(e===void 0)return;if(e===!1)return`not-applicable`;if(e===!0)return`user-approval`;let t=typeof e==`object`&&e?Reflect.get(e,`type`):e;if(t!==`not-applicable`&&t!==`approved`&&t!==`denied`&&t!==`user-approval`)throw Error(`An approval policy must return an approval status, a boolean, or undefined.`);if(typeof e!=`object`||!e)return t;let n=Reflect.get(e,`reason`);if(n!==void 0&&(typeof n!=`string`||t!==`approved`&&t!==`denied`))throw Error(`Only approved and denied approval statuses accept a string reason.`);return t===`approved`||t===`denied`?n===void 0?{type:t}:{type:t,reason:n}:{type:t}}function approvalDecision(e){let t=normalizeApprovalStatus(e),n=typeof t==`object`?t.type:t,r=typeof t==`object`?t.reason:void 0;return n===`user-approval`?{denied:!1,awaitsPerson:!0}:n===`denied`?{denied:!0,reason:r}:n===`approved`?{denied:!1,clearedBy:{policy:`approval`}}:{denied:!1}}export{approvalDecision,normalizeApprovalStatus};

package/dist/src/channel/adapter-context.d.ts

@@ -4,8 +4,6 @@ import type { ChannelAdapter, ChannelAdapterContext } from "#channel/adapter.js"
  * Builds the {@link ChannelAdapterContext} the runtime hands to an
  * adapter's `deliver` hook, event handlers, and attachment resolver.
  *
- * Populates `session` with a live {@link SessionHandle} backed by the
- * supplied accessor so handlers can read identity / auth and call
- * `session.continuation.alias(...)` to add an address for the parked session.
+ * Session metadata and channel continuation routing resolve live from the supplied accessor.
  */
 export declare function buildAdapterContext<TCtx extends ChannelAdapterContext<any> = ChannelAdapterContext>(adapter: ChannelAdapter<TCtx>, accessor: ContextAccessor): TCtx;

package/dist/src/channel/adapter-context.js

@@ -1 +1 @@
-import{buildSessionHandle}from"#channel/session.js";function buildAdapterContext(e,t){let n={ctx:t,state:e.state??{},session:buildSessionHandle(t)};return e.createAdapterContext?e.createAdapterContext(n):n}export{buildAdapterContext};
+import{buildChannelContext}from"#channel/session.js";function buildAdapterContext(e,t){let n=buildChannelContext(t),r={ctx:t,state:e.state??{},session:n.session,get continuation(){return n.continuation}};return e.createAdapterContext?e.createAdapterContext(r):r}export{buildAdapterContext};

package/dist/src/channel/adapter.d.ts

@@ -1,8 +1,11 @@
+import type { SessionEvent } from "#protocol/session-event.js";
 import type { ContextAccessor } from "#context/key.js";
 import type { StepInput } from "#harness/types.js";
-import type { UnstampedMessageStreamEvent } from "#protocol/message.js";
-import type { SessionHandle } from "#channel/session.js";
+import type { FactPosition, Scope } from "#protocol/session-events/envelope.js";
+import type { ChannelContext } from "#shared/channel-context.js";
+import type { SessionView } from "#protocol/session-projection/tables.js";
 import type { DeliverPayload } from "#channel/types.js";
+import type { ChannelDelivery } from "#shared/channel-delivery.js";
 import type { UploadPolicy } from "#public/channels/upload-policy.js";
 import type { FetchFileContext, FetchFileResult, FetchFileFunction } from "#shared/channel-definition.js";
 import type { ChannelAudienceProjector } from "#channel/audience.js";
@@ -15,12 +18,10 @@ import type { ChannelAudienceProjector } from "#channel/audience.js";
  * `ctx` provides read/write access to durable context keys (the same
  * {@link ContextAccessor} that tools and providers use).
  *
- * `session` is a live handle to the current session — id, auth,
- * optional channel continuation address, including an imperative `alias()`
- * for channels that need to add an alias for the session mid-turn (e.g. Slack's
- * auto-anchor on first post).
+ * `session` supplies live identity/auth; `continuation` owns channel routing (such as
+ * Slack's auto-anchor on first post). Neither grants session command authority.
  */
-export interface ChannelAdapterContext<TState = Record<string, unknown>> {
+export interface ChannelAdapterContext<TState = Record<string, unknown>> extends ChannelContext {
     /**
      * Mutable adapter state. Auto-serialized at step boundaries via
      * JSON snapshot. The adapter reads and writes this directly.
@@ -31,12 +32,14 @@ export interface ChannelAdapterContext<TState = Record<string, unknown>> {
      * to read during the turn.
      */
     readonly ctx: ContextAccessor;
-    /**
-     * Live handle to the current session.
-     */
-    readonly session: SessionHandle;
     /** @internal Independent source of a relayed child input batch. */
     readonly inputSource?: string;
+    /** Where the event a handler observes sits on the stream: its line, and its index there. */
+    readonly position?: FactPosition;
+    /** The event's owners: its turn, task, model run, or context change. */
+    readonly scope?: Scope;
+    /** The immutable snapshot of the event's line, supplied by its publisher. */
+    readonly view?: SessionView;
 }
 /**
  * Extracts the state type from a {@link ChannelAdapterContext} generic.
@@ -45,27 +48,28 @@ export interface ChannelAdapterContext<TState = Record<string, unknown>> {
  */
 type StateOf<TCtx> = TCtx extends ChannelAdapterContext<infer S> ? S : Record<string, unknown>;
 /**
- * Extracts the `data` field type from a stream event by its `type` discriminant.
- * Events that carry no `data` field (e.g. `session.completed`) resolve to `undefined`.
+ * A single outbound event handler. Receives the written event and the adapter context. Void
+ * return: side effects only.
  */
-type EventData<T extends UnstampedMessageStreamEvent["type"]> = Extract<UnstampedMessageStreamEvent, {
+type EventHandler<T extends SessionEvent["type"], TCtx extends ChannelAdapterContext<any> = ChannelAdapterContext> = (event: Extract<SessionEvent, {
     type: T;
-}> extends {
-    data: infer D;
-} ? D : undefined;
-/**
- * A single outbound event handler. Receives the event's `data` (not the full
- * envelope) and the adapter context. Void return — side effects only.
- */
-type EventHandler<T extends UnstampedMessageStreamEvent["type"], TCtx extends ChannelAdapterContext<any> = ChannelAdapterContext> = (data: EventData<T>, ctx: TCtx) => void | Promise<void>;
+}>, ctx: TCtx) => void | Promise<void>;
 /**
  * Map of outbound event handlers keyed by event type. The adapter declares
  * handlers for the event types it cares about. For undeclared types, the
  * framework's default handlers run.
  */
 export type ChannelEventHandlers<TCtx extends ChannelAdapterContext<any> = ChannelAdapterContext> = {
-    [K in UnstampedMessageStreamEvent["type"]]?: EventHandler<K, TCtx>;
+    [K in SessionEvent["type"]]?: EventHandler<K, TCtx>;
+} & {
+    /** Runs once per committed line, after the line's event handlers. */
+    committed?: (line: CommittedLine, ctx: TCtx) => void | Promise<void>;
 };
+/** A line the session committed: the facts its channel heard, in order, and its position. */
+export interface CommittedLine {
+    readonly facts: readonly SessionEvent[];
+    readonly position: number;
+}
 /**
  * Enriched return shape from a channel's {@link ChannelAdapter.fetchFile}
  * function. Return a bare {@link Buffer} when only bytes are known, or
@@ -150,11 +154,11 @@ export type ChannelAdapter<TCtx extends ChannelAdapterContext<any> = ChannelAdap
  * Produces the default {@link StepInput} when no custom adapter `deliver`
  * hook is defined.
  *
- * Passes through both `message` and `inputResponses` from the delivery
+ * Passes through both `message` and `answers` from the delivery
  * payload so tool-approval responses (and other HITL replies) reach the
  * harness even when the channel has no bespoke deliver logic.
  */
-export declare function defaultDeliverResult(payload: DeliverPayload): StepInput | undefined;
+export declare function defaultDeliverResult(payload: Pick<ChannelDelivery, "message" | "answers" | "context" | "outputSchema">): StepInput | undefined;
 /**
  * Returns the durable kind for an adapter.
  */
@@ -166,4 +170,8 @@ export declare function getAdapterKind(adapter: ChannelAdapter): string;
  * Throwing handlers are logged and swallowed so a downstream delivery
  * failure does not corrupt the event stream write path.
  */
-export declare function callAdapterEventHandler(adapter: ChannelAdapter, event: UnstampedMessageStreamEvent, ctx: ChannelAdapterContext): Promise<UnstampedMessageStreamEvent>;
+/**
+ * Runs the channel adapter's handler for one written event. Handlers observe; they never shape
+ * what is written, because the write already happened.
+ */
+export declare function callAdapterEventHandler(adapter: ChannelAdapter, event: SessionEvent | CommittedLine, ctx: ChannelAdapterContext): Promise<void>;

package/dist/src/channel/adapter.js

@@ -1 +1 @@
-import{attachClientContext,readClientContext}from"#internal/client-context.js";import{attachInputText,readInputText}from"#internal/input-text.js";import{createLogger}from"#internal/logging.js";const log=createLogger(`channel.adapter`);function defaultDeliverResult(e){if(e.message!==void 0)return attachClientContext(attachInputText({inputResponses:e.inputResponses,message:e.message,context:e.context,outputSchema:e.outputSchema},readInputText(e)),readClientContext(e));if(e.inputResponses!==void 0&&e.inputResponses.length>0)return attachClientContext({inputResponses:e.inputResponses,context:e.context,outputSchema:e.outputSchema},readClientContext(e));if(e.context!==void 0&&e.context.length>0||(readClientContext(e)?.length??0)>0)return attachClientContext({context:e.context,outputSchema:e.outputSchema},readClientContext(e));if(e.outputSchema!==void 0)return{outputSchema:e.outputSchema}}function getAdapterKind(e){return e.kind}async function callAdapterEventHandler(e,t,n){let r=withWaitingContinuationToken(t,n),i=e[t.type];if(i!==void 0)try{await i(`data`in r?r.data:void 0,n)}catch(n){log.error(`adapter event handler threw — event swallowed`,{adapterKind:getAdapterKind(e),eventType:t.type,error:n})}return withWaitingContinuationToken(r,n)}function withWaitingContinuationToken(e,t){return e.type===`session.waiting`?{...e,data:{...e.data,continuationToken:t.session.continuation?.token??t.session.id}}:e}export{callAdapterEventHandler,defaultDeliverResult,getAdapterKind};
+import{attachClientContext,readClientContext}from"#internal/client-context.js";import{attachInputText,readInputText}from"#internal/input-text.js";import{createLogger}from"#internal/logging.js";const log=createLogger(`channel.adapter`);function defaultDeliverResult(e){if(e.message!==void 0)return attachClientContext(attachInputText({answers:e.answers,message:e.message,context:e.context,outputSchema:e.outputSchema},readInputText(e)),readClientContext(e));if(e.answers!==void 0&&e.answers.length>0)return attachClientContext({answers:e.answers,context:e.context,outputSchema:e.outputSchema},readClientContext(e));if(e.context!==void 0&&e.context.length>0||(readClientContext(e)?.length??0)>0)return attachClientContext({context:e.context,outputSchema:e.outputSchema},readClientContext(e));if(e.outputSchema!==void 0)return{outputSchema:e.outputSchema}}function getAdapterKind(e){return e.kind}async function callAdapterEventHandler(e,t,n){let r=`facts`in t?`committed`:t.type,i=e[r];if(i!==void 0)try{await i(t,n)}catch(t){log.error(`adapter event handler threw — event swallowed`,{adapterKind:getAdapterKind(e),eventType:r,error:t})}}export{callAdapterEventHandler,defaultDeliverResult,getAdapterKind};

package/dist/src/channel/audience.d.ts

@@ -10,7 +10,4 @@ type ChannelAudienceSource = {
 };
 export type ChannelAudienceProjector = (input: AudienceContext<Record<string, unknown> | undefined>) => ChannelAudience;
 export declare function resolveAudience(adapter: ChannelAudienceSource, input: AudienceContext<Record<string, unknown> | undefined>): ChannelAudience;
-export declare function createMetadataAudienceProjector(source: {
-    readonly kind: string;
-}, metadata: (state: Record<string, unknown> | undefined) => unknown): ChannelAudienceProjector;
 export {};

package/dist/src/channel/audience.js

@@ -1 +1 @@
-import{normalizeChannelAudience}from"#shared/channel-audience.js";import{isThenable}from"#shared/guards.js";const deprecatedAudienceChannels=new Set;function warnDeprecatedMetadataAudience(e){deprecatedAudienceChannels.has(e)||(deprecatedAudienceChannels.add(e),console.warn(`channel ${e} uses deprecated metadata audience; move it to the audience() hook`))}function resolveAudience(e,t){return normalize(e,t)}function createMetadataAudienceProjector(e,t){return n=>resolveAudience({kind:e.kind,state:n.state,instrumentation:{metadata:t}},n)}function normalize(e,t){let n=e.instrumentation,r=n?.audience;if(r===void 0){let t=n?.metadata;if(t===void 0)return`unknown`;let r;try{r=t(e.state)}catch{return console.warn(`ignoring deprecated channel audience metadata for channel ${e.kind}`),`unknown`}if(isThenable(r))return console.warn(`ignoring deprecated channel audience metadata for channel ${e.kind}`),Promise.resolve(r).catch(()=>void 0),`unknown`;if(typeof r!=`object`||!r)return`unknown`;let i=r.audience;return i===void 0?`unknown`:(warnDeprecatedMetadataAudience(e.kind),normalizeChannelAudience(i))}try{let e=r(t);return isThenable(e)?(console.warn(`ignoring channel audience classifier because it returned a Promise`),Promise.resolve(e).catch(()=>void 0),`unknown`):normalizeChannelAudience(e)}catch{return console.warn(`ignoring channel audience classifier after failure`),`unknown`}}export{createMetadataAudienceProjector,resolveAudience};
+import{normalizeChannelAudience}from"#shared/channel-audience.js";import{isThenable}from"#shared/guards.js";function resolveAudience(e,t){return normalize(e,t)}function normalize(e,t){let n=e.instrumentation?.audience;if(n===void 0)return`unknown`;try{let e=n(t);return isThenable(e)?(console.warn(`ignoring channel audience classifier because it returned a Promise`),Promise.resolve(e).catch(()=>void 0),`unknown`):normalizeChannelAudience(e)}catch{return console.warn(`ignoring channel audience classifier after failure`),`unknown`}}export{resolveAudience};