jsfe 1.7.2 → 1.7.3

package/dist/forms/contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/forms/contracts.js"],"names":[],"mappings":"AAaA;;;IAGC;AACD;;;;;EAGC;AACD,qGAAqG;AACrG;;QAmCC;AAeD;;;QAEC;AACD;;;;;;;QAMC;AACD;;;QAGC;AACD;;;;;;;QA8BC;AAED,mHAAmH;AACnH,kDAgBC;AAED,+GAA+G;AAC/G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsEC"}
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../src/forms/contracts.js"],"names":[],"mappings":"AAcA;;;IAGC;AACD;;;;;EAGC;AACD,qGAAqG;AACrG;;QAqCC;AAgBD;;;QAEC;AACD;;;;;;;QAMC;AACD;;;QAGC;AACD;;;;;;;QA8BC;AAED,mHAAmH;AACnH,kDAgBC;AAED,+GAA+G;AAC/G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwEC"}

package/dist/forms/contracts.js

@@ -1,4 +1,5 @@
 /** Build-time contracts for conversational flows. Transport operations remain registered tools. */
+import { INPUT_PROPOSALS_REQUIREMENT, hasInputProposals, proposalRuntimeSteps } from './proposal-runtime.js';
 import { ACTION_TOOLS } from './action-tools.js';
 import { normalizeHostRequirements } from '../host/capabilities.js';
 import { validateActionProjection, actionProjectionExpression } from './action-projection.js';
@@ -66,7 +67,9 @@ export function linkFormSchemas(flows, { externalFlows = [] } = {}) {
                 parameters.push(input.schema ? { name: input.name, type: 'object', jsonSchema: objectSchema(input.schema.inputs), description: input.description || input.label || input.name }
                     : { name: input.name, type: 'string', ...(input.profile.kind === 'choice' && !input.profile.accept_other ? { enum: input.profile.choices.map(c => c.key) } : {}), description: input.description || input.label || input.name });
             }
-        return { ...flow, parameters, variables: { ...flow.variables, inputs: { ...flow.variables.inputs, value: inputs } } };
+        const linked = { ...flow, parameters, variables: { ...flow.variables, inputs: { ...flow.variables.inputs, value: inputs } } };
+        // Descendant schemas are linked after declaration; propagate their runtime requirement to the root entry.
+        return flow.variables?.contract ? declared(linked, flow.variables.contract.value) : { ...linked, steps: proposalRuntimeSteps(flow.id, linked.steps, hasInputProposals(inputs) ? [INPUT_PROPOSALS_REQUIREMENT] : []) };
     });
 }
 function declared(flow, contract) {
@@ -79,12 +82,13 @@ function declared(flow, contract) {
         ...(step.type === 'FLOW' && step.callType === 'replace' ? { initializeDefaults: step.initializeDefaults ?? true } : {}),
         ...(step.branches ? { branches: Object.fromEntries(Object.entries(step.branches).map(([key, branch]) => [key, replacementDefaults(branch)])) } : {}),
         ...(step.onFail ? { onFail: replacementDefaults(step.onFail) } : {}) });
+    const requirements = [...normalizeHostRequirements(contract.requires, flow.id), ...(hasInputProposals(flow.variables?.inputs?.value) ? [INPUT_PROPOSALS_REQUIREMENT] : [])];
     const metadata = { version: 1, ...contract, parametersFrom: 'parameters' };
-    if (contract.requires !== undefined)
+    if (requirements.length || contract.requires !== undefined)
         Object.defineProperty(metadata, 'requires', {
-            value: normalizeHostRequirements(contract.requires, flow.id), enumerable: true, writable: false, configurable: false,
+            value: normalizeHostRequirements(requirements, flow.id), enumerable: true, writable: false, configurable: false,
         });
-    return { ...flow, steps: flow.steps.map(replacementDefaults), variables: { ...flow.variables, contract: value(metadata) } };
+    return { ...flow, steps: proposalRuntimeSteps(flow.id, flow.steps.map(replacementDefaults), requirements), variables: { ...flow.variables, contract: value(metadata) } };
 }
 export function defineWorker({ contract, ...flow }) {
     return declared({ scope: 'isolated', version: '1.0.0', ...flow }, contract);
@@ -187,10 +191,16 @@ export function validateFlowContracts(flows, tools = [], { externalFlows = [], r
                 for (const name of deps)
                     if (!name.startsWith('cargo.') && !name.startsWith('form.') && !fieldNames.has(name))
                         fail(flow.id, `unknown dependency ${name}`);
+                for (const name of [...Object.keys(spec.proposal?.when || {}), ...(spec.proposal?.unless || [])])
+                    if (!name.startsWith('cargo.') && !name.startsWith('form.') && !fieldNames.has(name))
+                        fail(flow.id, `unknown proposal condition ${name}`);
                 graph.set(spec.name, deps);
                 for (const key of ['form', 'validator', 'prepare', 'refresh', 'after', 'answer_precheck', 'answer_validator', 'on_exhausted'])
                     if (spec[key] && !ids.has(spec[key]))
                         fail(flow.id, `unknown ${key} worker ${spec[key]}`);
+                for (const reference of [spec.proposal?.prepare, spec.proposal?.on_declined, ...(spec.proposal?.interrupts || []).map(event => event.flow)])
+                    if (reference && !ids.has(reference))
+                        fail(flow.id, `unknown proposal worker ${reference}`);
             }
             const visited = new Set(), active = new Set();
             const visit = name => { if (active.has(name))

package/dist/forms/flows.d.ts

@@ -417,8 +417,8 @@ export const FLOWS: ({
         };
     })[];
 } | {
+    steps: any;
     variables: any;
-    steps: any[];
     prompt?: undefined;
     prompt_es?: undefined;
     primary?: boolean | undefined;
@@ -432,6 +432,7 @@ export const FLOWS: ({
     };
     parameters: any[];
 } | {
+    steps: any;
     variables: any;
     id: string;
     name: string;
@@ -442,136 +443,8 @@ export const FLOWS: ({
         type: string;
         description: string;
     }[];
-    steps: ({
-        id: any;
-        type: string;
-        variable: any;
-        value: any;
-    } | {
-        parameters?: any;
-        initializeDefaults?: boolean | undefined;
-        id: any;
-        type: string;
-        value: any;
-        callType: string;
-    } | {
-        id: any;
-        type: string;
-        branches: {
-            [x: string]: any;
-            default: {
-                id: any;
-                type: string;
-                variable: any;
-                value: any;
-            };
-        };
-    } | {
-        id: string;
-        type: string;
-        branches: {
-            'condition: rf_next_form': {
-                parameters?: any;
-                initializeDefaults?: boolean | undefined;
-                id: any;
-                type: string;
-                value: any;
-                callType: string;
-            };
-            default: {
-                parameters?: any;
-                initializeDefaults?: boolean | undefined;
-                id: any;
-                type: string;
-                value: any;
-                callType: string;
-            };
-        };
-    })[];
-} | {
-    variables: any;
-    id: string;
-    name: string;
-    version: string;
-    scope: string;
-    description: string;
-    parameters: {
-        name: string;
-        type: string;
-        description: string;
-    }[];
-    steps: ({
-        id: any;
-        type: string;
-        variable: any;
-        value: any;
-    } | {
-        parameters?: any;
-        initializeDefaults?: boolean | undefined;
-        id: any;
-        type: string;
-        value: any;
-        callType: string;
-    } | {
-        id: any;
-        type: string;
-        branches: {
-            [x: string]: any;
-            default: {
-                id: any;
-                type: string;
-                variable: any;
-                value: any;
-            };
-        };
-    } | {
-        id: string;
-        type: string;
-        branches: {
-            'condition: pm_keys.length > 0': {
-                parameters?: any;
-                initializeDefaults?: boolean | undefined;
-                id: any;
-                type: string;
-                value: any;
-                callType: string;
-            };
-            'condition: pm_flow': {
-                parameters?: any;
-                initializeDefaults?: boolean | undefined;
-                id: any;
-                type: string;
-                value: any;
-                callType: string;
-            };
-            "condition: pm_key === 'done'": {
-                id: string;
-                type: string;
-                value: string;
-                value_es: string;
-                outcome: string;
-            };
-            "condition: /[a-z\u00E1\u00E9\u00ED\u00F3\u00FA\u00FC\u00F1]/i.test(String(cargo.choiceText || ''))": {
-                id: string;
-                type: string;
-            };
-            "condition: retry !== '1'": {
-                parameters?: any;
-                initializeDefaults?: boolean | undefined;
-                id: any;
-                type: string;
-                value: any;
-                callType: string;
-            };
-            default: {
-                id: string;
-                type: string;
-                value: string;
-                value_es: string;
-            };
-        };
-    })[];
 } | {
+    steps: any;
     variables: any;
     id: string;
     name: string;
@@ -582,30 +455,5 @@ export const FLOWS: ({
         name: string;
         type: string;
     }[];
-    steps: ({
-        id: any;
-        type: string;
-        variable: any;
-        value: any;
-    } | {
-        parameters?: any;
-        initializeDefaults?: boolean | undefined;
-        id: any;
-        type: string;
-        value: any;
-        callType: string;
-    } | {
-        id: any;
-        type: string;
-        branches: {
-            [x: string]: any;
-            default: {
-                id: any;
-                type: string;
-                variable: any;
-                value: any;
-            };
-        };
-    })[];
 })[];
 //# sourceMappingURL=flows.d.ts.map

package/dist/forms/flows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../src/forms/flows.js"],"names":[],"mappings":"AAyFA;;;;;;GAMG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4DC;AACD;;;GAGG;AACH;;;;;;EAGC;AAoTD,wHAAwH;AACxH,wEAaC;AACD,4FAA4F;AAC5F;;;EAYC;AACD,sGAAsG;AACtG;;;EAOC;AAtdM,6CAAuG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsoB9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAOG"}
+{"version":3,"file":"flows.d.ts","sourceRoot":"","sources":["../../src/forms/flows.js"],"names":[],"mappings":"AA0FA;;;;;;GAMG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6DC;AACD;;;GAGG;AACH;;;;;;EAGC;AA8VD,wHAAwH;AACxH,wEAaC;AACD,4FAA4F;AAC5F;;;EAYC;AACD,sGAAsG;AACtG;;;EAOC;AAjgBM,6CAAuG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkrB9G;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAOG"}

package/dist/forms/flows.js

@@ -16,6 +16,7 @@
  * state that survives DISPATCH and reboot, so a caller who leaves a form resumes it. Results of finished forms:
  * cargo.formResults[<form id>].
  */
+import { INPUT_PROPOSALS_REQUIREMENT, hasInputProposals, proposalRuntimeSteps } from './proposal-runtime.js';
 import { resolveFormInputs, validateFormIncompleteOutcome, validateFormExhaustion } from '../helpers/form-state.js';
 // ── step helpers ────────────────────────────────────────────────────────────────────────────────────────────────
 const SET = (id, variable, value) => ({ id, type: 'SET', variable, value });
@@ -114,6 +115,7 @@ export function formFlow({ id, name, version, description, inputs, after = [], e
         id, name, version, description, scope, metadata: { formProtocol: 2 }, parameters: [...parameters, { name: 'form_instance', type: 'string', internal: true, description: 'Internal instance to resume' }], ...(primary ? { primary: true } : {}), ...(prompt ? { prompt, prompt_es } : {}),
         variables: vars({ form_on_exhausted: on_exhausted, form_incomplete_outcome: incompleteFrom ? null : incomplete_outcome, form_instance: '', form_internal_resume: false, form_resume_owner: '', form_arguments: {}, form_exhaustion: null, form_values: {}, form_validation: '', initial_readings: [], inputs: resolveFormInputs(inputs, FIELD_PRESETS), parent_form: '', result_input: '', questions: [], provides: null, exit_context: '', exit_context_es: '', form_confirm_q: '', form_confirm_q_es: '', form_confirmation: confirm || {}, form_should_confirm: false, ...extraVars }),
         steps: [
+            ...proposalRuntimeSteps(id, [], hasInputProposals(inputs) ? [INPUT_PROPOSALS_REQUIREMENT] : []),
             SET(`${id}_resume_kind`, 'form_internal_resume', '!!form_instance'),
             SET(`${id}_open`, 'form_instance', `openFormInstance(cargo, ${JSON.stringify(id)}, inputs, { parent: parent_form || null, input: result_input || '', context:!!parent_form && !result_input, resume: form_instance || (!parent_form ? (cargo.formTasks || {})[${JSON.stringify(id)}] || '' : ''), providers: provides, questions: questions, incomplete_outcome: ${incompleteExpression}, on_exhausted: form_on_exhausted })`),
             SIDE(`${id}_task`, `(!parent_form ? (cargo.formTasks = cargo.formTasks || {}, cargo.formTasks[${JSON.stringify(id)}] = form_instance) : true, true)`),
@@ -131,7 +133,7 @@ export function formFlow({ id, name, version, description, inputs, after = [], e
                 WHEN(`${id}_parent_resume`, "rf_status === 'parent_changed'", FLOW(`${id}_parent_reenter`, 'resume-form', 'reboot', { form: '{{form_resume_owner}}' })),
             ] : []),
             ...(close_on_stop ? [WHEN(`${id}_close_stopped`, "rf_status === 'stopped'", SIDE(`${id}_stop_close`, '(closeFormInstance(cargo, form_instance, false), true)'))] : []),
-            WHEN(`${id}_left`, "rf_status !== 'complete'", END(`${id}_left_end`)),
+            WHEN(`${id}_left`, "rf_status !== 'complete' || !cargo.forms[form_instance]", END(`${id}_left_end`)),
             ...(validator ? [
                 SET(`${id}_values`, 'form_values', 'cargo.forms[form_instance].values'),
                 SIDE(`${id}_validation_reset`, '(cargo.formCheck = null, true)'),
@@ -166,7 +168,7 @@ const runForm = {
     id: 'run-form', name: 'RunForm', version: '1.0.0',
     description: "Worker (shared scope, called by a form flow): the FORM loop. Merges the form's activation parameters into cargo.forms[rf_form] once, then each pass finds the first missing input whose `when` holds, collects it (collect-input) or runs its sub-form, and replaces itself until nothing is missing. Sets rf_status: 'complete' | 'stopped' (a path in rf_stop was set) | 'unwound'. Reads the form's `inputs`, `parent_form`, `result_input`, `questions`, `provides`, `exit_context(_es)`.",
     parameters: [{ name: 'rf_resume_parent', type: 'boolean', description: 'Yield a context collector when its owning form accepts a change' }, { name: 'rf_form', type: 'string', description: 'The form id (the calling form flow id)' }, { name: 'rf_resume', type: 'string', description: "'true' on the loop's own replays" }, { name: 'rf_stop', type: 'string', description: 'A cargo path (or list) that ends the form when set' }],
-    variables: vars({ rf_stop: '', rf_resume: '', rf_resume_parent: false, rf_status: '', rf_next: '', rf_next_form: '', rf_questions: [], rf_provides: null, rf_max: 0, rf_pending: [], rf_deferred: [] }),
+    variables: vars({ rf_stop: '', rf_resume: '', rf_resume_parent: false, rf_status: '', rf_next: '', rf_next_form: '', rf_questions: [], rf_provides: null, rf_max: 0, rf_pending: [], rf_deferred: [], rf_proposal: null, rf_proposal_readings: [] }),
     steps: [
         SIDE('rf_pass_count', '(cargo.forms[rf_form] ? (cargo.forms[rf_form].replays = Number(cargo.forms[rf_form].replays || 0) + 1) : true, true)'),
         SET('rf_pass', 'rf_status', "formInstanceApplies(cargo, rf_form) ? '' : (closeFormInstance(cargo, rf_form, false), 'unwound')"),
@@ -182,6 +184,12 @@ const runForm = {
         SET('rf_pending', 'rf_pending', 'pendingFormReadings(cargo, rf_form)'),
         WHEN('rf_pending_accept', 'rf_pending.length > 0', FLOW('rf_pending_batch', 'collect-input-accept', 'call', { hits: '{{rf_pending}}' })),
         WHEN('rf_pending_repeat', 'rf_pending.length > 0', FLOW('rf_pending_again', 'run-form', 'replace', { rf_form: '{{rf_form}}', rf_resume: 'true', rf_stop: '{{rf_stop}}' })),
+        SET('rf_proposal_readings', 'rf_proposal_readings', 'formProposalReadings(cargo,rf_form)'),
+        WHEN('rf_proposal_revalidate', 'rf_proposal_readings.length > 0', FLOW('rf_proposal_batch', 'collect-input-accept', 'call', { hits: '{{rf_proposal_readings}}' })),
+        WHEN('rf_proposal_owner_closed', '!cargo.forms[rf_form]', END('rf_proposal_closed_end')),
+        SET('rf_proposal', 'rf_proposal', 'nextFormProposal(cargo,rf_form)'),
+        WHEN('rf_proposal_ask', 'rf_proposal', FLOW('rf_proposal_confirm', 'confirm-input-proposal', 'call', { parent_form: '{{rf_form}}', input: '{{rf_proposal.input}}' })),
+        WHEN('rf_proposal_repeat', 'rf_proposal || rf_proposal_readings.length > 0', FLOW('rf_proposal_again', 'run-form', 'replace', { rf_form: '{{rf_form}}', rf_resume: 'true', rf_stop: '{{rf_stop}}', rf_resume_parent: '{{rf_resume_parent}}' })),
         SET('rf_find', 'rf_next', 'nextFormInput(cargo.forms[rf_form], cargo)'),
         WHEN('rf_blocked', "rf_next === '__blocked__'", incompleteDispatch('rf_blocked_end', 'rf_form', "'form_dependencies_blocked'")),
         SET('rf_find_form', 'rf_next_form', "rf_next ? ((cargo.forms[rf_form].specs || []).filter(function (i) { return i.name === rf_next; })[0] || {}).form || '' : ''"),
@@ -275,14 +283,15 @@ const prepareInput = {
 const validateBatch = {
     id: 'validate-input-batch', name: 'ValidateInputBatch', version: '2.0.0', scope: 'isolated',
     description: 'Worker: validate dependency-ordered candidates; return accepted, rejected and pending readings before a single commit.',
-    parameters: ['hits', 'accepted', 'rejected', 'pending'].map(name => ({ name, type: 'array' })),
-    variables: vars({ accepted: [], rejected: [], pending: [], vb_h: null, vb_rest: [], vb_values: {}, vb_known: false, vb_ready: false, vb_relevant: false, vb_outcome: '' }),
+    parameters: ['hits', 'accepted', 'rejected', 'pending', 'ignored'].map(name => ({ name, type: 'array' })),
+    variables: vars({ accepted: [], rejected: [], pending: [], ignored: [], vb_h: null, vb_rest: [], vb_values: {}, vb_known: false, vb_ready: false, vb_relevant: false, vb_outcome: '', vb_candidate: null, vb_proposal_values: {}, vb_proposal: null, vb_proposal_ok: true }),
     steps: [
         SET('vb_init_accepted', 'accepted', 'Array.isArray(accepted) ? accepted : []'),
         SET('vb_init_rejected', 'rejected', 'Array.isArray(rejected) ? rejected : []'),
         SET('vb_init_pending', 'pending', 'Array.isArray(pending) ? pending : []'),
+        SET('vb_init_ignored', 'ignored', 'Array.isArray(ignored) ? ignored : []'),
         SET('vb_first', 'vb_h', 'hits.length ? hits[0] : null'),
-        WHEN('vb_done', '!vb_h', SIDE('vb_result', '(cargo.inputBatch = { accepted: accepted, rejected: rejected, pending: pending }, true)')),
+        WHEN('vb_done', '!vb_h', SIDE('vb_result', '(cargo.inputBatch = { accepted: accepted, rejected: rejected, pending: pending, ignored: ignored }, true)')),
         WHEN('vb_end', '!vb_h', END('vb_end_done')),
         SET('vb_rest', 'vb_rest', 'hits.slice(1)'),
         SET('vb_relevant', 'vb_relevant', 'formReadingRelevant(cargo, vb_h, accepted)'),
@@ -294,8 +303,15 @@ const validateBatch = {
         SIDE('vb_reset', "(cargo.inputCheck = vb_h.invalid ? { ok: false } : (vb_h.validator && !vb_known ? null : { ok: true, value: vb_h.value }), true)"),
         WHEN('vb_validator', 'vb_ready === true && vb_h.validator && !vb_known && !vb_h.invalid', FLOW('vb_validate', '{{vb_h.validator}}', 'call', { form: '{{vb_h.form}}', input: '{{vb_h.name}}', value: '{{vb_h.value}}', values: '{{vb_values}}', reading: '{{vb_h}}' })),
         WHEN('vb_refused', 'vb_h.refused === true', SIDE('vb_withhold_refusal', "(cargo.inputCheck=Object.assign({},cargo.inputCheck || {},{ok:false}),true)")),
-        SIDE('vb_take', "(vb_relevant !== true ? true : vb_ready !== true ? pending.push(Object.assign({}, vb_h, {outcome:'pending'})) : cargo.inputCheck && cargo.inputCheck.ok === true ? accepted.push(Object.assign({}, vb_h, { ok: true, value: cargo.inputCheck.value !== undefined && cargo.inputCheck.value !== null ? cargo.inputCheck.value : vb_h.value, outcome: vb_outcome })) : rejected.push(Object.assign({}, vb_h, { outcome: 'rejected', message: cargo.inputCheck && cargo.inputCheck.message, message_es: cargo.inputCheck && cargo.inputCheck.message_es })), true)"),
-        FLOW('vb_next', 'validate-input-batch', 'replace', { hits: '{{vb_rest}}', accepted: '{{accepted}}', rejected: '{{rejected}}', pending: '{{pending}}' }),
+        SET('vb_candidate', 'vb_candidate', "Object.assign({},vb_h,{ok:!!(cargo.inputCheck && cargo.inputCheck.ok === true),value:cargo.inputCheck && cargo.inputCheck.value !== undefined && cargo.inputCheck.value !== null ? cargo.inputCheck.value : vb_h.value,message:cargo.inputCheck && cargo.inputCheck.message,message_es:cargo.inputCheck && cargo.inputCheck.message_es})"),
+        SET('vb_proposal_policy', 'vb_proposal', 'vb_relevant === true && vb_ready === true && vb_candidate.ok && !vb_known ? formProposalPolicy(cargo,vb_candidate,cargo.inputCheck,accepted) : null'),
+        SET('vb_proposal_values', 'vb_proposal_values', 'proposedFormValues(cargo,vb_h.form,accepted.concat([vb_candidate]))'),
+        SIDE('vb_proposal_reset', '(cargo.proposalCheck=undefined,true)'),
+        WHEN('vb_proposal_prepare', 'vb_proposal && vb_proposal.prepare', FLOW('vb_proposal_formatter', '{{vb_proposal.prepare}}', 'call', { form: '{{vb_candidate.form}}', input: '{{vb_candidate.name}}', value: '{{vb_candidate.value}}', values: '{{vb_proposal_values}}', reading: '{{vb_candidate}}' })),
+        SET('vb_proposal_gate', 'vb_proposal_ok', 'vb_relevant !== true || vb_ready !== true || !vb_candidate.ok || vb_known ? true : stageFormProposal(cargo,vb_candidate,formProposalDescriptor(vb_proposal,vb_proposal && vb_proposal.prepare ? cargo.proposalCheck : undefined))'),
+        { ...SET('vb_proposal_gate_valid', 'noop', "typeof vb_proposal_ok === 'boolean'"), requireTrue: true },
+        SIDE('vb_take', "(vb_relevant !== true ? ignored.push(vb_h) : vb_ready !== true ? pending.push(Object.assign({}, vb_h, {outcome:'pending'})) : vb_candidate.ok === true ? (vb_proposal_ok === true ? accepted.push(Object.assign({}, vb_candidate, { outcome: vb_outcome })) : null) : rejected.push(Object.assign({}, vb_candidate, { outcome: 'rejected' })), true)"),
+        FLOW('vb_next', 'validate-input-batch', 'replace', { hits: '{{vb_rest}}', accepted: '{{accepted}}', rejected: '{{rejected}}', pending: '{{pending}}', ignored: '{{ignored}}' }),
     ],
 };
 const accept = {
@@ -311,7 +327,9 @@ const accept = {
         SET('ca_order', 'ca_ordered', 'orderFormReadings(cargo, hits)'),
         FLOW('ca_validate', 'validate-input-batch', 'call', { hits: '{{ca_ordered}}' }),
         SIDE('ca_settle', '(cargo.inputBatch = settleFormActivations(cargo.inputBatch, cargo), true)'),
+        { ...SIDE('ca_proposal_validation', '(settleFormProposalValidation(cargo,cargo.inputBatch),true)'), requireTrue: true },
         SIDE('ca_rejections', 'rejectFormReadings(cargo, cargo.inputBatch.rejected)'),
+        { ...SIDE('ca_proposal_commit', 'commitFormProposals(cargo,cargo.inputBatch.accepted)'), requireTrue: true },
         SIDE('ca_commit', 'acceptFormReadings(cargo, cargo.inputBatch.accepted, cargo.inputBatch.pending)'),
         SIDE('ca_pending', 'queueFormReadings(cargo, cargo.inputBatch.pending)'),
         SET('ca_results', 'ca_results', 'cargo.inputBatch.accepted.concat(cargo.inputBatch.rejected, cargo.inputBatch.pending)'),
@@ -372,7 +390,7 @@ const confirmForm = {
     id: 'confirm-form', name: 'ConfirmForm', version: '1.0.0', scope: 'isolated',
     description: "Worker: ask a form's confirmation (exact YES / NO; keys 1 and 2). A correction instead ('no, make it $40') is read against the form chain and stored, and the result is 'changed' so the form runs again; an unclear short answer is asked again, a long unrelated one is DISPATCHed. Result: cargo.formConfirm[form] = 'yes' | 'no' | 'changed'. Params: form, question(_es), exit_context(_es).",
     parameters: ['form', 'question', 'question_es', 'exit_context', 'exit_context_es', 'words', 'interrupts', 'no_keys', 'clarifications'].map((n) => ({ name: n, type: ['words', 'interrupts', 'no_keys', 'clarifications'].includes(n) ? 'array' : 'string', description: n })),
-    variables: vars({ cf_presets: FIELD_PRESETS, cf_chain: [], cf_m: null, cf_result: '', cf_prompt: '', cf_prompt_es: '', cf_words: 0, cf_tries: 0, words: [], clarifications: [], no_keys: ['2'], interrupts: [], cf_choices: [], cf_event: '', cf_amount: false, cf_questions: [], cf_provides: null, cf_skip_gate: '' }),
+    variables: vars({ cf_presets: FIELD_PRESETS, cf_chain: [], cf_m: null, cf_current: null, cf_result: '', cf_prompt: '', cf_prompt_es: '', cf_words: 0, cf_tries: 0, words: [], clarifications: [], no_keys: ['2'], interrupts: [], cf_choices: [], cf_event: '', cf_amount: false, cf_questions: [], cf_provides: null, cf_skip_gate: '' }),
     steps: [
         SIDE('cf_reset', "(cargo.formConfirm = cargo.formConfirm || {}, cargo.formConfirm[form] = '', true)"),
         SET('cf_choices', 'cf_choices', "[{key:'yes',words:['1'].concat(Array.isArray(words)?words:[]),exact:true},{key:'no',words:Array.isArray(no_keys)?no_keys:['2']}].concat((Array.isArray(interrupts)?interrupts:[]).map(function(event){return {key:'event:'+event.key,words:event.words,exact:event.exact!==false};}))"),
@@ -389,7 +407,8 @@ const confirmForm = {
         SET('cf_question_catalog', 'cf_questions', 'cargo.forms[form].questions || []'),
         SET('cf_provider_catalog', 'cf_provides', 'cargo.forms[form].providers'),
         SET('cf_gate_policy', 'cf_skip_gate', "!cf_provides || !cf_provides.gate || [].concat(cf_provides.gate.verified || []).every(function(p){return !!formPath({cargo:cargo},p);}) ? 'true' : ''"),
-        SET('cf_match', 'cf_m', "cargo.choice === 'yes' || cargo.choice === 'no' && pickChoice(cargo.choiceText, [{key:'no',words:Array.isArray(no_keys)?no_keys:['2'],exact:true}], false) === 'no' ? { hits: [], ambiguous: [], questions:[] } : readFormAnswer(cargo.choiceText, cf_chain, { form: form, name: '' }, '',cf_questions)"),
+        SET('cf_current', 'cf_current', "cargo.forms[form].proposalPrompt ? {form:cargo.forms[form].parent,name:cargo.forms[form].proposalPrompt.input} : {form:form,name:''}"),
+        SET('cf_match', 'cf_m', "cargo.choice === 'yes' || cargo.choice === 'no' && pickChoice(cargo.choiceText, [{key:'no',words:Array.isArray(no_keys)?no_keys:['2'],exact:true}], false) === 'no' ? { hits: [], ambiguous: [], questions:[] } : readFormAnswer(cargo.choiceText, cf_chain, cf_current, '',cf_questions)"),
         SET('cf_enrich', 'cf_m', "(function(m){m.hits=m.hits.map(function(h){return Object.assign({},h,{silent:true});});return m;})(enrichFormMatches(cf_m, cf_chain, form))"),
         SET('cf_count_words', 'cf_words', "String(cargo.choiceText || '').split(/\\s+/).filter(function (w) { return /[a-záéíóúüñ]/i.test(w); }).length"),
         WHEN('cf_question_fields', 'cf_m.questions.length > 0 && cf_m.hits.length > 0', FLOW('cf_question_accept', 'collect-input-accept', 'call', { hits: '{{cf_m.hits}}' })),
@@ -412,6 +431,29 @@ const confirmForm = {
         SIDE('cf_store', "(cargo.formConfirm[form] = cf_result === 'unclear' || cf_result === 'clarification' ? 'changed' : cf_result, true)"),
     ],
 };
+// ── proposed input: owned confirmation before canonical acceptance or callbacks ────────────────────────────
+const confirmInputProposal = formFlow({ id: 'confirm-input-proposal', name: 'ConfirmInputProposal', version: '1.0.0', description: 'Confirm an owned validated input candidate; retain it on yield and authorize only normal input acceptance.',
+    parameters: [{ name: 'input', type: 'string', description: 'Owning input awaiting proposal confirmation' }], extraVars: { input: '', proposal: null, proposal_readings: [] }, inputs: [],
+    before: [
+        SET('proposal_refresh_readings', 'proposal_readings', 'formProposalReadings(cargo,parent_form,input,false)'),
+        WHEN('proposal_refresh', 'proposal_readings.length > 0', FLOW('proposal_refresh_batch', 'collect-input-accept', 'call', { hits: '{{proposal_readings}}' })),
+        SET('proposal_current', 'proposal', 'cargo.forms[parent_form] && cargo.forms[parent_form].inputProposals && cargo.forms[parent_form].inputProposals[input] || null'),
+        WHEN('proposal_missing', "!proposal || !['pending','confirmed'].includes(proposal.status) || proposal.committed", FLOW('proposal_missing_close', 'form-done', 'replace', { form: '{{form_instance}}' })),
+        { ...SIDE('proposal_bind', '(bindFormProposal(cargo,parent_form,input,form_instance),true)'), requireTrue: true },
+        SET('proposal_confirmation', 'form_confirmation', 'Object.assign({},proposal.descriptor)'),
+    ],
+    confirm: { question: '{{proposal.descriptor.question}}', question_es: '{{proposal.descriptor.question_es || proposal.descriptor.question}}' },
+    after: [{ ...SIDE('proposal_confirmed', "decideFormProposal(cargo,parent_form,input,form_instance,'confirmed')"), requireTrue: true }],
+    declined: [NOOP('proposal_declined_marker')],
+});
+const proposalDeclined = { id: 'confirm-input-proposal-declined', name: 'ConfirmInputProposalDeclined', version: '1.0.0', scope: 'isolated', description: 'Reject an owned input proposal without accepting its candidate or handing incomplete data to its parent.', parameters: [{ name: 'form_instance', type: 'string' }], variables: vars({ owner: '', input: '', proposal: null }), steps: [
+        SET('proposal_decline_owner', 'owner', 'cargo.forms[form_instance].parent'),
+        SET('proposal_decline_input', 'input', 'cargo.forms[form_instance].proposalPrompt.input'),
+        SET('proposal_decline_record', 'proposal', 'cargo.forms[owner].inputProposals[input]'),
+        { ...SIDE('proposal_decline_decision', "decideFormProposal(cargo,owner,input,form_instance,'declined')"), requireTrue: true },
+        SIDE('proposal_decline_close', '(closeFormInstance(cargo,form_instance,false),true)'),
+        WHEN('proposal_decline_callback', 'proposal.descriptor.on_declined', FLOW('proposal_decline_invoke', '{{proposal.descriptor.on_declined}}', 'call', { form: '{{owner}}', input: '{{input}}', value: '{{proposal.value}}', reading: '{{proposal.reading}}' })),
+    ] };
 // ── form-done: the result goes to the parent (or cargo.formResults); the form is cleared ─────────────────────────────
 const formDone = {
     id: 'form-done', name: 'FormDone', version: '1.0.0', scope: 'isolated',
@@ -667,8 +709,9 @@ const resumeForm = { id: 'resume-form', name: 'ResumeForm', version: '1.0.0', sc
         SET('resume_definition', 'target', 'cargo.forms[form].definition'), SET('resume_parent', 'parent', "cargo.forms[form].parent || ''"), SET('resume_slot', 'slot', "cargo.forms[form].result_input || ''"),
         FLOW('resume_owned_form', '{{target}}', 'replace', { form_instance: '{{form}}', parent_form: '{{parent}}', result_input: '{{slot}}' })
     ] };
-const LIBRARY_FLOWS = [resumeForm, performAction, sendTextAction, prepareInput, runForm, collectInput, validateBatch, accept, acceptedEffects, disambiguate, confirmForm, formDone, providerMenu, ...validators, ...fieldCollectors, ...subForms, provideData, provideQueuedData, loadSource, answerFacts];
+const LIBRARY_FLOWS = [confirmInputProposal, proposalDeclined, resumeForm, performAction, sendTextAction, prepareInput, runForm, collectInput, validateBatch, accept, acceptedEffects, disambiguate, confirmForm, formDone, providerMenu, ...validators, ...fieldCollectors, ...subForms, provideData, provideQueuedData, loadSource, answerFacts];
 const LIBRARY_CONTRACTS = {
+    'confirm-input-proposal': { role: 'collector', requires: [INPUT_PROPOSALS_REQUIREMENT] }, 'confirm-input-proposal-declined': { role: 'worker', requires: [INPUT_PROPOSALS_REQUIREMENT] },
     'resume-form': { role: 'worker' },
     'perform-action': { role: 'worker', tools: ['jsfe:action-claim', 'jsfe:action-complete'], result: { path: 'cargo.actionResult', type: 'object' } },
     'send-text-action': { role: 'worker', result: { path: 'cargo.actionOutcome', type: 'object' } },
@@ -693,6 +736,6 @@ export const FLOWS = LIBRARY_FLOWS.map(flow => {
         throw new Error('Shared worker needs an explicit contract: ' + flow.id);
     if ((declaration.role === 'collector') !== (flow.metadata?.formProtocol === 2))
         throw new Error('Shared collector contract mismatch: ' + flow.id);
-    return { ...flow, variables: { ...flow.variables, contract: { type: 'object', value: { version: 1, summary: flow.description,
+    return { ...flow, steps: proposalRuntimeSteps(flow.id, flow.steps, declaration.requires), variables: { ...flow.variables, contract: { type: 'object', value: { version: 1, summary: flow.description,
                     parametersFrom: 'parameters', ...declaration, ...(declaration.role === 'collector' ? { form: { inputs: 'inputs' } } : {}) } } } };
 });

package/dist/forms/proposal-runtime.d.ts

@@ -0,0 +1,5 @@
+export function proposalRuntimeSteps(id: any, steps: any, requirements?: any[]): any;
+/** Versioned engine support; declaring proposal consent must never become a no-op on older runtimes. */
+export const INPUT_PROPOSALS_REQUIREMENT: "jsfe:input-proposals:v1";
+export function hasInputProposals(inputs: any): any;
+//# sourceMappingURL=proposal-runtime.d.ts.map

package/dist/forms/proposal-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-runtime.d.ts","sourceRoot":"","sources":["../../src/forms/proposal-runtime.js"],"names":[],"mappings":"AAEA,qFAIC;AAND,wGAAwG;AACxG,0CAA2C,yBAAyB,CAAC;AAM9D,oDAA4K"}

package/dist/forms/proposal-runtime.js

@@ -0,0 +1,9 @@
+/** Versioned engine support; declaring proposal consent must never become a no-op on older runtimes. */
+export const INPUT_PROPOSALS_REQUIREMENT = 'jsfe:input-proposals:v1';
+export function proposalRuntimeSteps(id, steps, requirements = []) {
+    if (!requirements.includes(INPUT_PROPOSALS_REQUIREMENT))
+        return steps;
+    const guard = { id: id + '_proposal_protocol', type: 'SET', variable: 'noop', value: 'formProposalProtocol() === 1', requireTrue: true };
+    return steps[0]?.type === 'SET' && steps[0]?.value === guard.value && steps[0]?.requireTrue === true ? steps : [guard, ...steps];
+}
+export const hasInputProposals = inputs => (inputs || []).some(input => input.proposal !== undefined || hasInputProposals(input.any_of) || hasInputProposals(input.schema?.inputs));

package/dist/helpers/form-proposals.d.ts

@@ -0,0 +1,17 @@
+/** Static policy selectors use this batch's proposed values; a validator's explicit descriptor independently applies. */
+export function formProposalPolicy(cargo: any, reading: any, check: any, accepted?: any[]): any;
+/** A null descriptor admits ordinary input, but cannot silently waive the same retained candidate's consent. */
+export function stageFormProposal(cargo: any, reading: any, descriptor: any): any;
+/** Only actionable records enter the confirmation worker; dependency-deferred records await the normal batch. */
+export function nextFormProposal(cargo: any, owner: any): any;
+/** Owner replay issues approval only for confirmed records; named child refresh never invents approval. */
+export function formProposalReadings(cargo: any, owner: any, input?: string, approve?: boolean): any[];
+/** Bind only a real context child; ordinary child slots and unrelated owners cannot collect consent. */
+export function bindFormProposal(cargo: any, owner: any, input: any, childId: any): any;
+/** Exact YES must have passed the ordinary confirm-form revision check; NO never admits the candidate. */
+export function decideFormProposal(cargo: any, owner: any, input: any, childId: any, decision: any): boolean;
+/** Validate the entire final batch before consuming any proof; invoke immediately before acceptFormReadings. */
+export function commitFormProposals(cargo: any, accepted?: any[]): boolean;
+/** Failed validation withdraws the candidate; unmet prerequisites wait for the normal dependency replay. */
+export function settleFormProposalValidation(cargo: any, batch?: {}): {};
+//# sourceMappingURL=form-proposals.d.ts.map

package/dist/helpers/form-proposals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-proposals.d.ts","sourceRoot":"","sources":["../../src/helpers/form-proposals.js"],"names":[],"mappings":"AAgEA,yHAAyH;AACzH,gGASC;AACD,gHAAgH;AAChH,kFAkCC;AACD,iHAAiH;AACjH,8DAOC;AACD,2GAA2G;AAC3G,uGAYC;AACD,wGAAwG;AACxG,wFAMC;AACD,0GAA0G;AAC1G,6GASC;AACD,gHAAgH;AAChH,2EAmBC;AACD,4GAA4G;AAC5G,yEAIC"}

package/dist/helpers/form-proposals.js

@@ -0,0 +1,292 @@
+/** Owned input proposals. Candidates and their consent remain separate from canonical values and action proposals. */
+import { formInputApplies, formValuesEqual, hasFormValue } from './form-state.js';
+import { formSignature, actionConfirmationValid } from './form-actions.js';
+import { validateFormProposalPolicy, validateFormProposalDescriptor, validateProposalData } from './proposal-contract.js';
+const own = (value, key) => Object.prototype.hasOwnProperty.call(value || {}, key);
+const statuses = new Set(['pending', 'confirmed', 'declined', 'superseded']);
+const fail = message => { throw new Error('FORM input proposal ' + message); };
+const text = value => typeof value === 'string' && !!value.trim();
+function data(value) {
+    const seen = new Set();
+    const inspect = item => {
+        if (!item || typeof item !== 'object')
+            return;
+        if (seen.has(item))
+            fail('requires acyclic JSON data');
+        seen.add(item);
+        if (Object.getOwnPropertySymbols(item).length)
+            fail('requires JSON data without symbols');
+        for (const [key, property] of Object.entries(Object.getOwnPropertyDescriptors(item))) {
+            if (Array.isArray(item) && key === 'length')
+                continue;
+            if (Array.isArray(item) && (!/^(0|[1-9]\d*)$/.test(key) || Number(key) >= item.length))
+                fail('requires JSON arrays without extra properties');
+            if (property.get || property.set || !property.enumerable)
+                fail('requires enumerable JSON data properties');
+            inspect(property.value);
+        }
+        seen.delete(item);
+    };
+    inspect(value);
+    validateProposalData(value);
+    return structuredClone(value);
+}
+function inputOwner(cargo, id, name) {
+    const state = cargo?.forms?.[id], spec = state?.specs?.flatMap(input => input.any_of || [input]).find(input => input.name === name);
+    if (!state || state.id !== id || !spec || ['__proto__', 'prototype', 'constructor'].includes(name))
+        fail('requires a live owning input');
+    if (!Number.isSafeInteger(state.revision) || state.revision < 0 || !text(state.definition) || !text(state.task))
+        fail('has invalid owner identity or revision');
+    return { state, spec };
+}
+function candidate(cargo, reading) {
+    if (!reading || reading.ok !== true || !hasFormValue(reading.value))
+        fail('requires a validated nonempty candidate');
+    const owner = inputOwner(cargo, reading.form, reading.name);
+    data(reading.value);
+    return owner;
+}
+const identity = state => ({ id: state.id, definition: state.definition, task: state.task });
+const signature = (owner, input, value, revision, descriptor) => formSignature({ owner, input, value, revision, binding: descriptor.binding ?? null, descriptor });
+const token = (value, record) => !!value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).every(key => ['id', 'signature'].includes(key)) && value.id === record?.id && value.signature === record?.signature;
+const sourceReading = reading => Object.fromEntries(['raw', 'utterance', 'origin', 'current', 'asked'].filter(key => reading[key] !== undefined).map(key => [key, data(reading[key])]));
+function recordFor(cargo, state, name) {
+    const record = state.inputProposals?.[name];
+    if (!record)
+        return null;
+    if (!text(record.id) || record.form !== state.id || record.input !== name || !statuses.has(record.status) || typeof record.committed !== 'boolean' || !Number.isSafeInteger(record.owner_revision) || record.owner_revision < 0 || !Number.isSafeInteger(record.revision) || record.revision < 1 || typeof record.child !== 'string' || !hasFormValue(record.value) || !record.reading || typeof record.reading !== 'object' || Array.isArray(record.reading))
+        fail('has invalid retained state');
+    data(record.value);
+    data(record.reading);
+    const descriptor = validateFormProposalDescriptor(record.descriptor);
+    if (!formValuesEqual(record.owner, identity(state)) || !formValuesEqual(record.binding, descriptor.binding ?? null) || record.signature !== signature(record.owner, name, record.value, record.owner_revision, descriptor))
+        fail('retained identity or binding changed');
+    return record;
+}
+const active = record => !!record && !record.committed && ['pending', 'confirmed'].includes(record.status);
+function contextChild(cargo, state, id) {
+    const child = cargo.forms?.[id];
+    return child && child.id === id && child.context_only === true && child.parent === state.id && child.task === state.task && state.contexts?.[child.definition] === id ? child : null;
+}
+function withdraw(cargo, state, record) {
+    const child = contextChild(cargo, state, record.child);
+    if (child && child.proposalPrompt?.id === record.id && child.proposalPrompt?.signature === record.signature && child.proposalPrompt?.input === record.input) {
+        child.confirmation = null;
+        delete child.proposalPrompt;
+    }
+    delete record.approval;
+}
+const current = (state, record) => record.owner_revision === state.revision && record.signature === signature(identity(state), record.input, record.value, state.revision, record.descriptor);
+function proofValid(cargo, state, record) {
+    if (!record || record.status !== 'confirmed' || record.committed || record.deferred || !current(state, record) || !record.approval)
+        return false;
+    const proof = record.approval;
+    if (proof.id !== record.id || proof.signature !== record.signature || proof.child !== record.child || !Number.isSafeInteger(proof.revision) || proof.confirmation?.revision !== proof.revision)
+        return false;
+    const child = cargo.forms?.[record.child];
+    return !child || !!contextChild(cargo, state, record.child) && child.proposalPrompt?.id === record.id && child.proposalPrompt?.signature === record.signature && child.revision === proof.revision && formValuesEqual(child.confirmation, proof.confirmation) && actionConfirmationValid(cargo, child.id, { signature: child.proposal?.signature || null });
+}
+function approved(cargo, state, record, reading) {
+    return token(reading.proposalResume, record) && token(reading.proposalApproval, record) && formValuesEqual(reading.value, record.value) && proofValid(cargo, state, record);
+}
+/** Static policy selectors use this batch's proposed values; a validator's explicit descriptor independently applies. */
+export function formProposalPolicy(cargo, reading, check, accepted = []) {
+    const { state, spec } = inputOwner(cargo, reading.form, reading.name);
+    const declared = spec.proposal === undefined ? null : validateFormProposalPolicy(spec.proposal);
+    const dynamic = check && own(check, 'proposal') && check.proposal !== undefined ? validateFormProposalDescriptor(check.proposal) : null;
+    if (check?.ok === false)
+        return null;
+    const record = recordFor(cargo, state, reading.name), values = { ...state.values, ...Object.fromEntries(accepted.filter(hit => hit.form === state.id && hit.ok === true).map(hit => [hit.name, hit.value])), [reading.name]: reading.value };
+    const origin = reading.origin || 'answer';
+    const matches = declared && formInputApplies(declared, values, cargo, state) && (!declared.origins || declared.origins.includes(origin) || active(record));
+    return matches || dynamic ? { ...(matches ? declared : {}), ...(dynamic || {}) } : null;
+}
+/** A null descriptor admits ordinary input, but cannot silently waive the same retained candidate's consent. */
+export function stageFormProposal(cargo, reading, descriptor) {
+    const { state } = candidate(cargo, reading), decision = descriptor === null ? null : validateFormProposalDescriptor(descriptor);
+    let old = recordFor(cargo, state, reading.name);
+    const resumed = own(reading, 'proposalResume');
+    if (resumed && !token(reading.proposalResume, old))
+        return false;
+    if (old?.committed && resumed)
+        return false;
+    if (decision === null) {
+        if (!old || old.status === 'superseded' || old.committed)
+            return !own(reading, 'proposalApproval');
+        if (old.status === 'declined') {
+            if (!resumed && !own(reading, 'proposalApproval')) {
+                withdraw(cargo, state, old);
+                old.status = 'superseded';
+                return true;
+            }
+            return false;
+        }
+        if (formValuesEqual(old.value, reading.value)) {
+            if (approved(cargo, state, old, reading))
+                return true;
+            withdraw(cargo, state, old);
+            old.status = 'superseded';
+            return false;
+        }
+        if (resumed)
+            return false;
+        withdraw(cargo, state, old);
+        old.status = 'superseded';
+        return !own(reading, 'proposalApproval');
+    }
+    const binding = data(decision.binding ?? null), value = data(reading.value), nextSignature = signature(identity(state), reading.name, value, state.revision, decision);
+    const same = old && !old.committed && ['pending', 'confirmed', 'declined'].includes(old.status) && formValuesEqual(old.value, value) && formValuesEqual(old.binding, binding);
+    if (same && old.status === 'declined' && resumed)
+        return false;
+    if (!same || old.status === 'declined') {
+        if (old) {
+            withdraw(cargo, state, old);
+            old.status = 'superseded';
+        }
+        const sequence = state.inputProposalSequence ?? 0;
+        if (!Number.isSafeInteger(sequence) || sequence < 0 || !Number.isSafeInteger(sequence + 1))
+            fail('has an invalid proposal sequence');
+        state.inputProposalSequence = sequence + 1;
+        old = { id: `${state.id}:proposal:${state.inputProposalSequence}`, form: state.id, input: reading.name, owner: identity(state), value, reading: sourceReading(reading), descriptor: decision, binding, signature: nextSignature, owner_revision: state.revision, revision: 1, status: 'pending', committed: false, deferred: false, child: '' };
+        state.inputProposals ||= {};
+        state.inputProposals[reading.name] = old;
+    }
+    else if (old.signature !== nextSignature) {
+        withdraw(cargo, state, old);
+        Object.assign(old, { value, descriptor: decision, binding, signature: nextSignature, owner_revision: state.revision, revision: old.revision + 1, status: 'pending' });
+    }
+    old.deferred = false;
+    return approved(cargo, state, old, reading);
+}
+/** Only actionable records enter the confirmation worker; dependency-deferred records await the normal batch. */
+export function nextFormProposal(cargo, owner) {
+    const state = cargo.forms?.[owner];
+    if (!state)
+        return null;
+    for (const spec of state.specs.flatMap(input => input.any_of || [input])) {
+        const record = recordFor(cargo, state, spec.name);
+        if (active(record) && !record.deferred && formInputApplies(spec, { ...state.values, [spec.name]: record.value }, cargo, state))
+            return record;
+    }
+    return null;
+}
+/** Owner replay issues approval only for confirmed records; named child refresh never invents approval. */
+export function formProposalReadings(cargo, owner, input = '', approve = true) {
+    const state = cargo.forms?.[owner];
+    if (!state)
+        return [];
+    const names = input ? [input] : Object.keys(state.inputProposals || {}), out = [];
+    for (const name of names) {
+        const { spec } = inputOwner(cargo, owner, name), record = recordFor(cargo, state, name);
+        if (!record || record.committed || record.status === 'superseded' || record.deferred || approve && record.status !== 'confirmed' || !input && record.status === 'declined')
+            continue;
+        const hit = { ...spec, ...data(record.reading), form: owner, name, value: data(record.value), revalidate: true, proposalResume: { id: record.id, signature: record.signature } };
+        delete hit.proposalApproval;
+        if (approve && proofValid(cargo, state, record))
+            hit.proposalApproval = { id: record.id, signature: record.signature };
+        out.push(hit);
+    }
+    return out;
+}
+/** Bind only a real context child; ordinary child slots and unrelated owners cannot collect consent. */
+export function bindFormProposal(cargo, owner, input, childId) {
+    const { state } = inputOwner(cargo, owner, input), record = recordFor(cargo, state, input), child = contextChild(cargo, state, childId);
+    if (!active(record) || record.deferred || !current(state, record) || !child)
+        fail('cannot bind a stale proposal or foreign confirmation child');
+    if (record.child && record.child !== childId)
+        withdraw(cargo, state, record);
+    if (child.proposalPrompt?.id !== record.id || child.proposalPrompt?.signature !== record.signature)
+        child.confirmation = null;
+    record.child = childId;
+    child.proposalPrompt = { id: record.id, signature: record.signature, input };
+    return record;
+}
+/** Exact YES must have passed the ordinary confirm-form revision check; NO never admits the candidate. */
+export function decideFormProposal(cargo, owner, input, childId, decision) {
+    if (!['confirmed', 'declined'].includes(decision))
+        fail('has an invalid decision');
+    const { state } = inputOwner(cargo, owner, input), record = recordFor(cargo, state, input), child = contextChild(cargo, state, childId);
+    if (!active(record) || record.deferred || !current(state, record) || !child || record.child !== childId || child.proposalPrompt?.id !== record.id || child.proposalPrompt?.signature !== record.signature || child.proposalPrompt?.input !== input)
+        return false;
+    if (decision === 'confirmed' && !actionConfirmationValid(cargo, childId, { signature: child.proposal?.signature || null }))
+        return false;
+    record.status = decision;
+    if (decision === 'confirmed')
+        record.approval = { id: record.id, signature: record.signature, child: childId, revision: child.revision, confirmation: data(child.confirmation) };
+    else {
+        withdraw(cargo, state, record);
+        child.confirmation = null;
+    }
+    return true;
+}
+/** Validate the entire final batch before consuming any proof; invoke immediately before acceptFormReadings. */
+export function commitFormProposals(cargo, accepted = []) {
+    const changes = [], readings = [];
+    for (const hit of accepted) {
+        const { state } = candidate(cargo, hit);
+        readings.push({ state, hit });
+        const record = recordFor(cargo, state, hit.name);
+        if (!record) {
+            if (own(hit, 'proposalResume') || own(hit, 'proposalApproval'))
+                fail('approval has no live record');
+            continue;
+        }
+        const tagged = own(hit, 'proposalResume') || own(hit, 'proposalApproval');
+        if (tagged) {
+            if (!approved(cargo, state, record, hit))
+                fail('requires current unconsumed approval before commitment');
+            if (changes.some(change => change.record === record))
+                fail('approval cannot be consumed twice in one batch');
+            changes.push({ state, record, commit: true });
+        }
+        else if (!record.committed && record.status !== 'superseded' && formValuesEqual(record.value, hit.value))
+            fail('cannot commit a retained candidate without approval');
+        else if (!formValuesEqual(record.value, hit.value) && record.status !== 'superseded')
+            changes.push({ state, record, commit: false });
+    }
+    // Canonical exclusive selection also replaces uncommitted peer candidates, even if this input has no proposal.
+    // Plan every withdrawal after validation, so an invalid later reading cannot partially consume consent.
+    for (const { state, hit } of readings)
+        for (const group of state.specs.filter(spec => spec.exclusive === true && spec.any_of?.some(member => member.name === hit.name))) {
+            const peers = group.any_of.filter(member => member.name !== hit.name);
+            if (readings.some(other => other.state.id === state.id && peers.some(peer => peer.name === other.hit.name)))
+                fail('exclusive alternatives require clarification before commitment');
+            for (const peer of peers) {
+                const record = recordFor(cargo, state, peer.name);
+                if (active(record) && !changes.some(change => change.record === record))
+                    changes.push({ state, record, commit: false });
+            }
+        }
+    for (const { state, record, commit } of changes) {
+        if (commit) {
+            record.committed = true;
+            record.deferred = false;
+        }
+        else
+            record.status = 'superseded';
+        withdraw(cargo, state, record);
+    }
+    return true;
+}
+/** Failed validation withdraws the candidate; unmet prerequisites wait for the normal dependency replay. */
+export function settleFormProposalValidation(cargo, batch = {}) {
+    for (const hit of [...(batch.rejected || []), ...(batch.ignored || [])]) {
+        const state = cargo.forms?.[hit.form];
+        if (!state)
+            continue;
+        const record = recordFor(cargo, state, hit.name);
+        if (active(record)) {
+            withdraw(cargo, state, record);
+            record.status = 'superseded';
+        }
+    }
+    for (const hit of batch.pending || []) {
+        const state = cargo.forms?.[hit.form];
+        if (!state)
+            continue;
+        const record = recordFor(cargo, state, hit.name);
+        if (active(record))
+            record.deferred = true;
+    }
+    return batch;
+}

package/dist/helpers/form-state.d.ts

@@ -12,6 +12,7 @@ export function enrichFormMatches(matches: any, chain: any, form: any, names?: a
 export function expandFormActivations(cargo: any, hits?: any[]): any[];
 /** No partial activation: validation failure suppresses inferred changes; pending prerequisites retain the complete group. */
 export function settleFormActivations(batch?: {}, cargo?: null): {
+    ignored: any[];
     accepted: any[];
     rejected: any[];
     pending: any[];

package/dist/helpers/form-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"form-state.d.ts","sourceRoot":"","sources":["../../src/helpers/form-state.js"],"names":[],"mappings":"AAMA,qDAKC;AAED,oDAEC;AAED,qFAAqF;AACrF,oEAuBC;AAuCD,2FAEC;AACD,8FAcC;AACD,2DAOC;AACD,uEAuCC;AAED,kGAAkG;AAClG,2GAOC;AACD,0HAA0H;AAC1H,uEAwBC;AACD,8HAA8H;AAC9H;;;;EAWC;AACD,uGAAuG;AACvG;;;;;;;;;;QA8BC;AAED,0FAA0F;AAC1F;;;SAIC;AACD,gGAAgG;AAChG;;;;;;;;;;;EAQC;AAED,sGAAsG;AACtG,2DAIC;AACD;;;GAGG;AACH;;;;;;;SAkBC;AAED,2FAA2F;AAC3F,oGAIC;AACD,gFA4BC;AAED,2GAA2G;AAC3G;;;EASC;AACD,mEAoBC;AACD,mEAGC;AACD,sEAUC;AACD,+EAEC;AACD,qFASC;AACD,oGAoCC;AACD;;;SAKC;AACD,qEAGC;AACD,gEAgBC;AACD,2DAQC;AACD,oGAUC;AAED,uEAAuE;AACvE,wHA+BC;AAED,uHAAuH;AACvH,6EAaC;AACD,mHAAmH;AACnH,iGA4CC;AACD,8DAQC;AACD,8EAeC;AAnjBM,8CAAmE"}
+{"version":3,"file":"form-state.d.ts","sourceRoot":"","sources":["../../src/helpers/form-state.js"],"names":[],"mappings":"AAOA,qDAKC;AAED,oDAEC;AAED,qFAAqF;AACrF,oEA2BC;AAuCD,2FAEC;AACD,8FAcC;AACD,2DAOC;AACD,uEAuCC;AAED,kGAAkG;AAClG,2GAOC;AACD,0HAA0H;AAC1H,uEAwBC;AACD,8HAA8H;AAC9H;;;;;EAWC;AACD,uGAAuG;AACvG;;;;;;;;;;QA8BC;AAED,0FAA0F;AAC1F;;;SAIC;AACD,gGAAgG;AAChG;;;;;;;;;;;EAQC;AAED,sGAAsG;AACtG,2DAIC;AACD;;;GAGG;AACH;;;;;;;SAkBC;AAED,2FAA2F;AAC3F,oGAIC;AACD,gFA4BC;AAED,2GAA2G;AAC3G;;;EASC;AACD,mEAoBC;AACD,mEAGC;AACD,sEAUC;AACD,+EAEC;AACD,qFASC;AACD,oGAoCC;AACD;;;SAKC;AACD,qEAGC;AACD,gEAgBC;AACD,2DAQC;AACD,oGAUC;AAED,uEAAuE;AACvE,wHA+BC;AAED,uHAAuH;AACvH,6EAaC;AACD,mHAAmH;AACnH,iGA4CC;AACD,8DAQC;AACD,8EAeC;AAvjBM,8CAAmE"}

package/dist/helpers/form-state.js

@@ -1,3 +1,4 @@
+import { validateFormProposalPolicy } from './proposal-contract.js';
 /** Shared FORM semantics. Pure readers plus explicit mutations of the supplied session container; no host I/O. */
 import { readInputProfile } from './match-inputs.js';
 import { validateMoneyOptions } from './money.js';
@@ -35,6 +36,11 @@ export function resolveFormInputs(inputs, presets = {}) {
             validateMoneyOptions(input.profile.money);
         }
         validateFormExhaustion(input.on_exhausted);
+        if (input.proposal !== undefined) {
+            if (!input.profile || input.form || input.any_of || input.bind)
+                throw new Error('FORM proposal requires a readable leaf input; declare it on each group member or inside the subform');
+            validateFormProposalPolicy(input.proposal);
+        }
         if (input.max_misses !== undefined && (!Number.isInteger(input.max_misses) || input.max_misses < 1))
             throw new Error('FORM max_misses must be a positive integer');
         if (input.max_attempts !== undefined && (!Number.isInteger(input.max_attempts) || input.max_attempts < 1))
@@ -264,7 +270,7 @@ export function settleFormActivations(batch = {}, cargo = null) {
             for (const [name, hit] of Object.entries(state.pending || {}))
                 if (discarded.has(hit.activation_group))
                     delete state.pending[name];
-    return { accepted: accepted.filter(h => !held.has(h.activation_group) && !discarded.has(h.activation_group)),
+    return { ignored: [...(batch.ignored || [])], accepted: accepted.filter(h => !held.has(h.activation_group) && !discarded.has(h.activation_group)),
         rejected: rejected.map(h => h.activation_inferred ? { ...h, ...h.activation_entry, activation_inferred: false } : h), pending: pending.concat(accepted.filter(h => held.has(h.activation_group))).filter(h => !discarded.has(h.activation_group)).map(h => held.has(h.activation_group) ? { ...h, ok: undefined, outcome: 'pending', silent: true } : h) };
 }
 /** Explicit ownership: unrelated tasks and sibling inputs never share an instance by definition id. */

package/dist/helpers/index.d.ts

@@ -1,4 +1,16 @@
 export namespace STANDARD_FUNCTIONS {
+    export { formProposalPolicy };
+    export { stageFormProposal };
+    export { nextFormProposal };
+    export { formProposalReadings };
+    export { bindFormProposal };
+    export { decideFormProposal };
+    export { commitFormProposals };
+    export { settleFormProposalValidation };
+    export { formProposalProtocol };
+    export { validateFormProposalPolicy };
+    export { validateFormProposalDescriptor };
+    export { formProposalDescriptor };
     export { clearFormMisses };
     export { missFormInput };
     export { formInputPrompt };
@@ -93,6 +105,18 @@ export namespace STANDARD_FUNCTIONS {
     export { urlToSpeech };
     export { textWithUrlToSpeech };
 }
+import { formProposalPolicy } from './form-proposals.js';
+import { stageFormProposal } from './form-proposals.js';
+import { nextFormProposal } from './form-proposals.js';
+import { formProposalReadings } from './form-proposals.js';
+import { bindFormProposal } from './form-proposals.js';
+import { decideFormProposal } from './form-proposals.js';
+import { commitFormProposals } from './form-proposals.js';
+import { settleFormProposalValidation } from './form-proposals.js';
+import { formProposalProtocol } from './proposal-contract.js';
+import { validateFormProposalPolicy } from './proposal-contract.js';
+import { validateFormProposalDescriptor } from './proposal-contract.js';
+import { formProposalDescriptor } from './proposal-contract.js';
 import { clearFormMisses } from './form-conversation.js';
 import { missFormInput } from './form-conversation.js';
 import { formInputPrompt } from './form-conversation.js';
@@ -191,5 +215,5 @@ import { validatePhone } from './validators.js';
 import { validateEmail } from './validators.js';
 import { urlToSpeech } from './url-speech.js';
 import { textWithUrlToSpeech } from './url-speech.js';
-export { clearFormMisses, missFormInput, formInputPrompt, consumeFormFeedback, formConversationOutcome, readMoneyAmount, isMoneyAmount, moneyIntentAllows, validateMoneyOptions, takeChoiceOffer, matchesChoice, ANSWER_WORDS, CONFIRM_WORDS, isAnswer, isAgentRequest, isOtherRequest, isSpelledFragment, isAmountAnswer, amountInAnswer, pickChoice, readEmail, readPhone, readInternationalPhone, readIdentifier, last4, maskEmail, callerTextNumber, textDestination, callerIsInternational, normalizeAndFindCapture, anythingElse, goodbye, sayName, dateToWords, amountToSpeech, validateCardNumber, validateExpiration, consumeActionReceipt, authorizeFormActionRetry, formSignature, selectFormAction, confirmFormRevision, prepareFormAction, actionConfirmationValid, beginFormAction, finishFormAction, actionGateVerified, sourceNeedsLoad, beginSourceRefresh, completeSourceRefresh, pickProviderQuestion, matchInputs, readFormAnswer, readInputProfile, resolveFormInputs, formInputApplies, formInputFilled, nextFormInput, formInputChain, openFormInstance, validateFormIncompleteOutcome, formIncompleteOutcome, validateFormExhaustion, exhaustFormInput, formInitialReadings, orderFormReadings, proposedFormValues, applyFormValidation, formReadingDependencies, exclusiveFormReadings, enrichFormMatches, expandFormActivations, settleFormActivations, rememberFormArguments, resetFormInputs, hasFormValue, formPath, formValuesEqual, formReadingReady, formReadingRelevant, formPreparation, queueFormReadings, pendingFormReadings, formWorkLimit, rejectFormReadings, invalidateFormInputs, acceptFormReadings, formInstanceApplies, closeFormInstance, checkOtp, maskDestination, validateOTP, OTP_EXPIRY_MS, validateDigits, validatePhone, validateEmail, urlToSpeech, textWithUrlToSpeech };
+export { formProposalPolicy, stageFormProposal, nextFormProposal, formProposalReadings, bindFormProposal, decideFormProposal, commitFormProposals, settleFormProposalValidation, formProposalProtocol, validateFormProposalPolicy, validateFormProposalDescriptor, formProposalDescriptor, clearFormMisses, missFormInput, formInputPrompt, consumeFormFeedback, formConversationOutcome, readMoneyAmount, isMoneyAmount, moneyIntentAllows, validateMoneyOptions, takeChoiceOffer, matchesChoice, ANSWER_WORDS, CONFIRM_WORDS, isAnswer, isAgentRequest, isOtherRequest, isSpelledFragment, isAmountAnswer, amountInAnswer, pickChoice, readEmail, readPhone, readInternationalPhone, readIdentifier, last4, maskEmail, callerTextNumber, textDestination, callerIsInternational, normalizeAndFindCapture, anythingElse, goodbye, sayName, dateToWords, amountToSpeech, validateCardNumber, validateExpiration, consumeActionReceipt, authorizeFormActionRetry, formSignature, selectFormAction, confirmFormRevision, prepareFormAction, actionConfirmationValid, beginFormAction, finishFormAction, actionGateVerified, sourceNeedsLoad, beginSourceRefresh, completeSourceRefresh, pickProviderQuestion, matchInputs, readFormAnswer, readInputProfile, resolveFormInputs, formInputApplies, formInputFilled, nextFormInput, formInputChain, openFormInstance, validateFormIncompleteOutcome, formIncompleteOutcome, validateFormExhaustion, exhaustFormInput, formInitialReadings, orderFormReadings, proposedFormValues, applyFormValidation, formReadingDependencies, exclusiveFormReadings, enrichFormMatches, expandFormActivations, settleFormActivations, rememberFormArguments, resetFormInputs, hasFormValue, formPath, formValuesEqual, formReadingReady, formReadingRelevant, formPreparation, queueFormReadings, pendingFormReadings, formWorkLimit, rejectFormReadings, invalidateFormInputs, acceptFormReadings, formInstanceApplies, closeFormInstance, checkOtp, maskDestination, validateOTP, OTP_EXPIRY_MS, validateDigits, validatePhone, validateEmail, urlToSpeech, textWithUrlToSpeech };
 //# sourceMappingURL=index.d.ts.map

package/dist/helpers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAAwG,wBAAwB;8BAAxB,wBAAwB;gCAAxB,wBAAwB;oCAAxB,wBAAwB;wCAAxB,wBAAwB;gCAmB7C,YAAY;8BAAZ,YAAY;kCAAZ,YAAY;qCAAZ,YAAY;gCAlB/D,mBAAmB;8BAiBrB,qBAAqB;6BAEkG,aAAa;8BAAb,aAAa;yBAAb,aAAa;+BAAb,aAAa;+BAAb,aAAa;kCAAb,aAAa;+BAAb,aAAa;+BAAb,aAAa;2BAAb,aAAa;0BACT,cAAc;0BAAd,cAAc;uCAAd,cAAc;+BAAd,cAAc;sBAAd,cAAc;0BAAd,cAAc;iCAAd,cAAc;gCAAd,cAAc;sCAAd,cAAc;wCAC/H,cAAc;6BACP,cAAc;wBAAd,cAAc;wBAAd,cAAc;4BACjC,iBAAiB;+BACd,uBAAuB;mCACC,kBAAkB;mCAAlB,kBAAkB;qCAxB+I,mBAAmB;yCAAnB,mBAAmB;8BAAnB,mBAAmB;iCAAnB,mBAAmB;oCAAnB,mBAAmB;kCAAnB,mBAAmB;wCAAnB,mBAAmB;gCAAnB,mBAAmB;iCAAnB,mBAAmB;mCAAnB,mBAAmB;gCAe1I,mBAAmB;mCAAnB,mBAAmB;sCAAnB,mBAAmB;qCAAnB,mBAAmB;4BAUtD,mBAAmB;+BAAnB,mBAAmB;iCAAnB,mBAAmB;kCAC6mB,iBAAiB;iCAAjB,iBAAiB;gCAAjB,iBAAiB;8BAAjB,iBAAiB;+BAAjB,iBAAiB;iCAAjB,iBAAiB;8CAAjB,iBAAiB;sCAAjB,iBAAiB;uCAAjB,iBAAiB;iCAAjB,iBAAiB;oCAAjB,iBAAiB;kCAAjB,iBAAiB;mCAAjB,iBAAiB;oCAAjB,iBAAiB;wCAAjB,iBAAiB;sCAAjB,iBAAiB;kCAAjB,iBAAiB;sCAAjB,iBAAiB;sCAAjB,iBAAiB;sCAAjB,iBAAiB;gCAAjB,iBAAiB;6BAAjB,iBAAiB;yBAAjB,iBAAiB;gCAAjB,iBAAiB;iCAAjB,iBAAiB;oCAAjB,iBAAiB;gCAAjB,iBAAiB;kCAAjB,iBAAiB;oCAAjB,iBAAiB;8BAAjB,iBAAiB;mCAAjB,iBAAiB;qCAAjB,iBAAiB;mCAAjB,iBAAiB;oCAAjB,iBAAiB;kCAAjB,iBAAiB;yBACzoB,gBAAgB;gCAAhB,gBAAgB;4BAAhB,gBAAgB;8BAAhB,gBAAgB;+BACzB,iBAAiB;8BAAjB,iBAAiB;8BAAjB,iBAAiB;4BAC7B,iBAAiB;oCAAjB,iBAAiB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/helpers/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mCAA8K,qBAAqB;kCAArB,qBAAqB;iCAArB,qBAAqB;qCAArB,qBAAqB;iCAArB,qBAAqB;mCAArB,qBAAqB;oCAArB,qBAAqB;6CAArB,qBAAqB;qCAC/E,wBAAwB;2CAAxB,wBAAwB;+CAAxB,wBAAwB;uCAAxB,wBAAwB;gCACpC,wBAAwB;8BAAxB,wBAAwB;gCAAxB,wBAAwB;oCAAxB,wBAAwB;wCAAxB,wBAAwB;gCAmB7C,YAAY;8BAAZ,YAAY;kCAAZ,YAAY;qCAAZ,YAAY;gCAlB/D,mBAAmB;8BAiBrB,qBAAqB;6BAEkG,aAAa;8BAAb,aAAa;yBAAb,aAAa;+BAAb,aAAa;+BAAb,aAAa;kCAAb,aAAa;+BAAb,aAAa;+BAAb,aAAa;2BAAb,aAAa;0BACT,cAAc;0BAAd,cAAc;uCAAd,cAAc;+BAAd,cAAc;sBAAd,cAAc;0BAAd,cAAc;iCAAd,cAAc;gCAAd,cAAc;sCAAd,cAAc;wCAC/H,cAAc;6BACP,cAAc;wBAAd,cAAc;wBAAd,cAAc;4BACjC,iBAAiB;+BACd,uBAAuB;mCACC,kBAAkB;mCAAlB,kBAAkB;qCAxB+I,mBAAmB;yCAAnB,mBAAmB;8BAAnB,mBAAmB;iCAAnB,mBAAmB;oCAAnB,mBAAmB;kCAAnB,mBAAmB;wCAAnB,mBAAmB;gCAAnB,mBAAmB;iCAAnB,mBAAmB;mCAAnB,mBAAmB;gCAe1I,mBAAmB;mCAAnB,mBAAmB;sCAAnB,mBAAmB;qCAAnB,mBAAmB;4BAUtD,mBAAmB;+BAAnB,mBAAmB;iCAAnB,mBAAmB;kCAC6mB,iBAAiB;iCAAjB,iBAAiB;gCAAjB,iBAAiB;8BAAjB,iBAAiB;+BAAjB,iBAAiB;iCAAjB,iBAAiB;8CAAjB,iBAAiB;sCAAjB,iBAAiB;uCAAjB,iBAAiB;iCAAjB,iBAAiB;oCAAjB,iBAAiB;kCAAjB,iBAAiB;mCAAjB,iBAAiB;oCAAjB,iBAAiB;wCAAjB,iBAAiB;sCAAjB,iBAAiB;kCAAjB,iBAAiB;sCAAjB,iBAAiB;sCAAjB,iBAAiB;sCAAjB,iBAAiB;gCAAjB,iBAAiB;6BAAjB,iBAAiB;yBAAjB,iBAAiB;gCAAjB,iBAAiB;iCAAjB,iBAAiB;oCAAjB,iBAAiB;gCAAjB,iBAAiB;kCAAjB,iBAAiB;oCAAjB,iBAAiB;8BAAjB,iBAAiB;mCAAjB,iBAAiB;qCAAjB,iBAAiB;mCAAjB,iBAAiB;oCAAjB,iBAAiB;kCAAjB,iBAAiB;yBACzoB,gBAAgB;gCAAhB,gBAAgB;4BAAhB,gBAAgB;8BAAhB,gBAAgB;+BACzB,iBAAiB;8BAAjB,iBAAiB;8BAAjB,iBAAiB;4BAC7B,iBAAiB;oCAAjB,iBAAiB"}

package/dist/helpers/index.js

@@ -1,3 +1,5 @@
+import { formProposalPolicy, stageFormProposal, nextFormProposal, formProposalReadings, bindFormProposal, decideFormProposal, commitFormProposals, settleFormProposalValidation } from './form-proposals.js';
+import { formProposalProtocol, validateFormProposalPolicy, validateFormProposalDescriptor, formProposalDescriptor } from './proposal-contract.js';
 import { clearFormMisses, missFormInput, formInputPrompt, consumeFormFeedback, formConversationOutcome } from './form-conversation.js';
 import { takeChoiceOffer } from './choice-offer.js';
 import { consumeActionReceipt, authorizeFormActionRetry, formSignature, selectFormAction, confirmFormRevision, prepareFormAction, actionConfirmationValid, beginFormAction, finishFormAction, actionGateVerified } from './form-actions.js';
@@ -30,9 +32,10 @@ import { resolveFormInputs, formInputApplies, formInputFilled, nextFormInput, fo
 import { checkOtp, maskDestination, validateOTP, OTP_EXPIRY_MS } from './otp-check.js';
 import { validateDigits, validatePhone, validateEmail } from './validators.js';
 import { urlToSpeech, textWithUrlToSpeech } from './url-speech.js';
-export { clearFormMisses, missFormInput, formInputPrompt, consumeFormFeedback, formConversationOutcome, readMoneyAmount, isMoneyAmount, moneyIntentAllows, validateMoneyOptions, takeChoiceOffer, matchesChoice, ANSWER_WORDS, CONFIRM_WORDS, isAnswer, isAgentRequest, isOtherRequest, isSpelledFragment, isAmountAnswer, amountInAnswer, pickChoice, readEmail, readPhone, readInternationalPhone, readIdentifier, last4, maskEmail, callerTextNumber, textDestination, callerIsInternational, normalizeAndFindCapture, anythingElse, goodbye, sayName, dateToWords, amountToSpeech, validateCardNumber, validateExpiration, consumeActionReceipt, authorizeFormActionRetry, formSignature, selectFormAction, confirmFormRevision, prepareFormAction, actionConfirmationValid, beginFormAction, finishFormAction, actionGateVerified, sourceNeedsLoad, beginSourceRefresh, completeSourceRefresh, pickProviderQuestion, matchInputs, readFormAnswer, readInputProfile, resolveFormInputs, formInputApplies, formInputFilled, nextFormInput, formInputChain, openFormInstance, validateFormIncompleteOutcome, formIncompleteOutcome, validateFormExhaustion, exhaustFormInput, formInitialReadings, orderFormReadings, proposedFormValues, applyFormValidation, formReadingDependencies, exclusiveFormReadings, enrichFormMatches, expandFormActivations, settleFormActivations, rememberFormArguments, resetFormInputs, hasFormValue, formPath, formValuesEqual, formReadingReady, formReadingRelevant, formPreparation, queueFormReadings, pendingFormReadings, formWorkLimit, rejectFormReadings, invalidateFormInputs, acceptFormReadings, formInstanceApplies, closeFormInstance, checkOtp, maskDestination, validateOTP, OTP_EXPIRY_MS, validateDigits, validatePhone, validateEmail, urlToSpeech, textWithUrlToSpeech, };
+export { formProposalPolicy, stageFormProposal, nextFormProposal, formProposalReadings, bindFormProposal, decideFormProposal, commitFormProposals, settleFormProposalValidation, formProposalProtocol, validateFormProposalPolicy, validateFormProposalDescriptor, formProposalDescriptor, clearFormMisses, missFormInput, formInputPrompt, consumeFormFeedback, formConversationOutcome, readMoneyAmount, isMoneyAmount, moneyIntentAllows, validateMoneyOptions, takeChoiceOffer, matchesChoice, ANSWER_WORDS, CONFIRM_WORDS, isAnswer, isAgentRequest, isOtherRequest, isSpelledFragment, isAmountAnswer, amountInAnswer, pickChoice, readEmail, readPhone, readInternationalPhone, readIdentifier, last4, maskEmail, callerTextNumber, textDestination, callerIsInternational, normalizeAndFindCapture, anythingElse, goodbye, sayName, dateToWords, amountToSpeech, validateCardNumber, validateExpiration, consumeActionReceipt, authorizeFormActionRetry, formSignature, selectFormAction, confirmFormRevision, prepareFormAction, actionConfirmationValid, beginFormAction, finishFormAction, actionGateVerified, sourceNeedsLoad, beginSourceRefresh, completeSourceRefresh, pickProviderQuestion, matchInputs, readFormAnswer, readInputProfile, resolveFormInputs, formInputApplies, formInputFilled, nextFormInput, formInputChain, openFormInstance, validateFormIncompleteOutcome, formIncompleteOutcome, validateFormExhaustion, exhaustFormInput, formInitialReadings, orderFormReadings, proposedFormValues, applyFormValidation, formReadingDependencies, exclusiveFormReadings, enrichFormMatches, expandFormActivations, settleFormActivations, rememberFormArguments, resetFormInputs, hasFormValue, formPath, formValuesEqual, formReadingReady, formReadingRelevant, formPreparation, queueFormReadings, pendingFormReadings, formWorkLimit, rejectFormReadings, invalidateFormInputs, acceptFormReadings, formInstanceApplies, closeFormInstance, checkOtp, maskDestination, validateOTP, OTP_EXPIRY_MS, validateDigits, validatePhone, validateEmail, urlToSpeech, textWithUrlToSpeech, };
 /** The functions flows call by name, ready to spread into a host's approved functions. */
 export const STANDARD_FUNCTIONS = {
+    formProposalPolicy, stageFormProposal, nextFormProposal, formProposalReadings, bindFormProposal, decideFormProposal, commitFormProposals, settleFormProposalValidation, formProposalProtocol, validateFormProposalPolicy, validateFormProposalDescriptor, formProposalDescriptor,
     clearFormMisses, missFormInput, formInputPrompt, consumeFormFeedback, formConversationOutcome,
     readMoneyAmount, isMoneyAmount, moneyIntentAllows, validateMoneyOptions, takeChoiceOffer, matchesChoice, isAnswer, isAgentRequest, isOtherRequest, isSpelledFragment, isAmountAnswer, amountInAnswer, pickChoice,
     readEmail, readPhone, readInternationalPhone, readIdentifier, last4, maskEmail, callerTextNumber, textDestination, callerIsInternational,

package/dist/helpers/match-inputs.js

@@ -232,7 +232,7 @@ export function readFormAnswer(answer, candidates, current, choiceKey, questions
     let consumed = false;
     const remaining = parts.map(part => {
         const text = part.trim();
-        if (!/^[¿\s]*(?:how\b|what\b|when\b|where\b|which\b|why\b|who\b|cu[aá]nt[oa]s?\b|qu[eé]\b|cu[aá]ndo\b|d[oó]nde\b|c[oó]mo\b|(?:can|could) you (?:tell|show)\b|(?:i (?:want|would like) to know|tell me|show me|quiero saber|quisiera saber|me gustar[ií]a saber|d[ií]game|dime|mu[eé]strame)\b)/i.test(text))
+        if (!/^[¿\s]*(?:how\b|what\b|when\b|where\b|which\b|why\b|who\b|cu[aá]nt[oa]s?\b|cu[aá]l(?:es)?\b|qu[eé](?=$|[^\p{L}\p{N}_])|cu[aá]ndo\b|d[oó]nde\b|c[oó]mo\b|(?:can|could) you (?:tell|show)\b|(?:i (?:want|would like) to know|tell me|show me|quiero saber|quisiera saber|me gustar[ií]a saber|d[ií]game|dime|mu[eé]strame)\b)/iu.test(text))
             return part;
         const key = pickProviderQuestion(text, questions);
         if (!key || key.startsWith('__'))

package/dist/helpers/proposal-contract.d.ts

@@ -0,0 +1,7 @@
+export function validateProposalData(value: any, seen?: Set<any>): any;
+export function validateFormProposalPolicy(value: any): any;
+export function validateFormProposalDescriptor(value: any): any;
+/** Keep policy selectors out of the runtime decision descriptor; null is an explicit opt-out. */
+export function formProposalDescriptor(policy: any, prepared?: undefined): any;
+export function formProposalProtocol(): number;
+//# sourceMappingURL=proposal-contract.d.ts.map

package/dist/helpers/proposal-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal-contract.d.ts","sourceRoot":"","sources":["../../src/helpers/proposal-contract.js"],"names":[],"mappings":"AAMA,uEAcC;AAUD,4DAWC;AACD,gEAIC;AACD,iGAAiG;AACjG,+EASC;AAzDM,+CAAoC"}

package/dist/helpers/proposal-contract.js

@@ -0,0 +1,95 @@
+export const formProposalProtocol = () => 1;
+/** Data-only authoring and runtime contract for input proposal confirmation. */
+const safeName = value => typeof value === 'string' && /^[A-Za-z0-9][\w.:-]*$/.test(value);
+const plain = value => !!value && typeof value === 'object' && !Array.isArray(value) && [Object.prototype, null].includes(Object.getPrototypeOf(value));
+const string = value => typeof value === 'string' && !!value.trim();
+const fail = message => { throw new Error('FORM proposal ' + message); };
+export function validateProposalData(value, seen = new Set()) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean' || typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (!value || typeof value !== 'object' || seen.has(value) || !Array.isArray(value) && !plain(value))
+        fail('binding must be finite, acyclic JSON data');
+    seen.add(value);
+    const array = Array.isArray(value), keys = Reflect.ownKeys(value);
+    for (const key of keys) {
+        const property = Object.getOwnPropertyDescriptor(value, key);
+        if (typeof key !== 'string' || !Object.hasOwn(property, 'value') || !property.enumerable && !(array && key === 'length'))
+            fail('must contain only enumerable JSON data properties');
+        if (array && key === 'length')
+            continue;
+        if (['__proto__', 'prototype', 'constructor'].includes(key) || array && !/^(0|[1-9]\d*)$/.test(key))
+            fail('binding contains an unsafe key');
+        validateProposalData(property.value, seen);
+    }
+    if (array && keys.length !== value.length + 1)
+        fail('binding cannot contain array holes');
+    seen.delete(value);
+    return value;
+}
+const confirmationKeys = ['question', 'question_es', 'binding', 'words', 'interrupts', 'no_keys', 'clarifications', 'on_declined'];
+function confirmation(value, required) {
+    if (required && !string(value.question))
+        fail('needs a nonempty question');
+    for (const key of ['question', 'question_es'])
+        if (value[key] !== undefined && !string(value[key]))
+            fail(key + ' must be nonempty text');
+    if (value.on_declined !== undefined && !safeName(value.on_declined))
+        fail('on_declined needs a static worker id');
+    for (const key of ['words', 'no_keys', 'clarifications'])
+        if (value[key] !== undefined && (!Array.isArray(value[key]) || !value[key].every(string)))
+            fail(key + ' must be an array of nonempty words');
+    if (value.interrupts !== undefined) {
+        if (!Array.isArray(value.interrupts))
+            fail('interrupts must be an array');
+        const keys = new Set();
+        for (const event of value.interrupts) {
+            if (!plain(event) || Object.keys(event).some(k => !['key', 'words', 'flow', 'exact'].includes(k)) || !safeName(event.key) || keys.has(event.key) || !safeName(event.flow) || !Array.isArray(event.words) || !event.words.length || !event.words.every(string) || event.exact !== undefined && typeof event.exact !== 'boolean')
+                fail('invalid interrupt declaration');
+            keys.add(event.key);
+        }
+    }
+    if (value.binding !== undefined)
+        validateProposalData(value.binding);
+}
+export function validateFormProposalPolicy(value) {
+    validateProposalData(value);
+    if (!plain(value) || Object.keys(value).some(key => !['prepare', 'origins', 'when', 'unless', ...confirmationKeys].includes(key)))
+        fail('invalid input policy');
+    if (value.prepare !== undefined && !safeName(value.prepare))
+        fail('prepare needs a static worker id');
+    if (!value.prepare && !string(value.question))
+        fail('policy needs a prepare worker or question');
+    if (value.origins !== undefined && (!Array.isArray(value.origins) || !value.origins.length || new Set(value.origins).size !== value.origins.length || !value.origins.every(origin => ['activation', 'answer'].includes(origin))))
+        fail('invalid origins');
+    const path = key => typeof key === 'string' && key.split('.').every(part => /^[A-Za-z_$][\w$-]*$/.test(part) && !['__proto__', 'prototype', 'constructor'].includes(part));
+    const scalar = item => item === null || typeof item === 'string' || typeof item === 'boolean' || typeof item === 'number' && Number.isFinite(item);
+    if (value.when !== undefined && (!plain(value.when) || Object.entries(value.when).some(([key, wanted]) => !path(key) || !(Array.isArray(wanted) ? wanted.length && wanted.every(scalar) : scalar(wanted)))))
+        fail('when must map safe paths to scalar conditions or nonempty scalar arrays');
+    if (value.unless !== undefined && (!Array.isArray(value.unless) || !value.unless.every(path)))
+        fail('unless must be an array of safe paths');
+    confirmation(value, false);
+    return structuredClone(value);
+}
+export function validateFormProposalDescriptor(value) {
+    validateProposalData(value);
+    if (!plain(value) || Object.keys(value).some(key => !confirmationKeys.includes(key)))
+        fail('invalid decision descriptor');
+    confirmation(value, true);
+    return structuredClone(value);
+}
+/** Keep policy selectors out of the runtime decision descriptor; null is an explicit opt-out. */
+export function formProposalDescriptor(policy, prepared = undefined) {
+    if (!policy)
+        return null;
+    validateFormProposalPolicy(policy);
+    if (policy.prepare && prepared === undefined)
+        fail('prepare must explicitly return a descriptor or null');
+    if (prepared === null)
+        return null;
+    if (prepared !== undefined)
+        validateProposalData(prepared);
+    if (prepared !== undefined && (!prepared || typeof prepared !== 'object' || Array.isArray(prepared)))
+        fail('prepare must return a descriptor or null');
+    const base = Object.fromEntries(confirmationKeys.filter(key => policy[key] !== undefined).map(key => [key, policy[key]]));
+    return validateFormProposalDescriptor({ ...base, ...prepared });
+}

package/dist/host/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/host/capabilities.js"],"names":[],"mappings":"AAWA,8FAA8F;AAC9F,0FASC;AAED,2FAA2F;AAC3F,iFAKC;AAED,gHAAgH;AAChH,mFA0BC;AA1DD,kGAAkG;AAClG;IACG,uDAMC;IAHE,aAA2C;IAC3C,YAA0B;IAC1B,gBAAkC;CAEvC"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/host/capabilities.js"],"names":[],"mappings":"AAYA,8FAA8F;AAC9F,0FASC;AAED,2FAA2F;AAC3F,iFAKC;AAED,gHAAgH;AAChH,mFA6BC;AA7DD,kGAAkG;AAClG;IACG,uDAMC;IAHE,aAA2C;IAC3C,YAA0B;IAC1B,gBAAkC;CAEvC"}

package/dist/host/capabilities.js

@@ -1,3 +1,4 @@
+import { INPUT_PROPOSALS_REQUIREMENT } from '../forms/proposal-runtime.js';
 /** Declarative flow admission. No engine imports, I/O, or implicit host capability activation. */
 export class JSFEHostCapabilityError extends Error {
     constructor(flowId, capability, reason) {
@@ -40,6 +41,11 @@ export function assertFlowHostCapabilities(flows, capabilities = {}) {
     for (const flow of flows) {
         const requirements = normalizeHostRequirements(flow?.variables?.contract?.value?.requires, flow?.id);
         for (const capability of requirements) {
+            // Intrinsic runtime support, not a host option or an implicit host permission.
+            if (capability === INPUT_PROPOSALS_REQUIREMENT)
+                continue;
+            if (capability.startsWith('jsfe:'))
+                throw new JSFEHostCapabilityError(flow?.id, capability, 'unsupported intrinsic runtime contract');
             if (!capabilities || typeof capabilities !== 'object' || Array.isArray(capabilities)) {
                 throw new JSFEHostCapabilityError(flow?.id, capability, 'explicit host capabilities must be an object');
             }

package/dist/runtime-identity.js

@@ -1 +1 @@
-export const JSFE_RUNTIME_FINGERPRINT = "sha256:8bda7ef27c22853a43dfc6734c548115e2b5855e6bb56eeb48eddc5acdf6a820";
+export const JSFE_RUNTIME_FINGERPRINT = "sha256:258637780da663b142f69744745b18173dfadebefac54d7b71fa5717ff12823d";

package/docs/development-release.md

@@ -29,3 +29,9 @@ Publishing the package, deploying the host or uploading tenant/system flow sets
 Native contextual misses default to one localized re-ask then DISPATCH of the second current utterance. Validation attempts and declared exhaustion callbacks are independent. Dynamic question refresh, explicit localized retries, nested/out-of-order input, provider detours and recognized clarification questions require behavioral assertions. A required draft yields pending; a failed service stays unresolved; a completed optional follow-up stays completed; unknown effects remain held. The host must consume explicit recovery rather than infer restartability from `unresolved`. Unannotated legacy JSON retains its historical path.
 
 Acceptance must include real engine-produced states through the actual host outcome and consume-once guidance adapter, not only helper snapshots. Verify English/Spanish and voice/text, “imposible” never confirms, exact price-reference utterance handoff, same root/accepted values on resume, fresh consent after correction, validator-specific limits, completed receipts, unknown-action holds, matched dispatch suppression and next-turn clearing. Run full engine and tenant matrices and clean consumer installs; Shopify behavior is outside this release and its source/artifact bytes must remain unchanged.
+
+## 1.7.3 input-proposal confirmation
+
+The shared proposal contract is opt-in through input declarations or validator descriptors. It retains candidates before canonical acceptance, uses an owned exact-confirmation context and revalidates proof before commit. No host or website changes are part of this implementation. The contract is included in JSFE 1.7.3. Publishing and pinning the package do not activate regenerated flow definitions or deploy a host.
+
+`contract.requires:['jsfe:input-proposals:v1']` describes intrinsic runtime support, not host configuration. Current JSFE admits that version directly; unknown `jsfe:*` contracts fail closed. Static and linked child declarations derive the requirement and strict entry guard; dynamic proposal workers declare it explicitly. Older runtimes must reject the matched definitions before tenant behavior. Release/pin the accepted runtime before activating regenerated shared and tenant sets. Both consumers must pin the same exact published runtime before the matched shared and tenant flow definitions are activated.

package/docs/forms.md

@@ -51,6 +51,29 @@ The common collector passes `form_context:{form,current,names,questions}` to `as
 
 Private provider questions during collection preserve the owner and pending verification. Repeated questions join the pending provider request instead of stacking another authentication flow. Independent field clauses are accepted before a provider suspends for verification. Questions cannot become invalid OTP attempts or arbitrary text answers.
 
+## Input proposal confirmation (unpublished candidate)
+
+Use `input.proposal` when an inferred or ambiguous **field value** needs the caller's approval before acceptance. This is independent of a performer's final action confirmation: accepting a payment option never authorizes a charge. Declare it on readable leaf inputs, including members of an `any_of` group; group, bound-value and subform declarations reject this attribute instead of silently ignoring it. Ordinary inputs without this declaration retain their existing path.
+
+```js
+{
+  name:'reason', profile:{kind:'choice',choices:[/* canonical choices */]},
+  proposal:{prepare:'describe-reason',origins:['activation'],when:{reason:['lost','stolen']}}
+}
+```
+
+An optional pure `prepare` worker receives `{form,input,value,values,reading}`. `value` is validator-normalized; `values` includes validated peers and this candidate. It writes `cargo.proposalCheck={question,question_es,binding?,on_declined?,words?,no_keys?,clarifications?,interrupts?}`, or explicitly `null` when no proposal is required. A static policy may supply the question directly. An ordinary validator can independently return `cargo.inputCheck={ok:true,value,proposal:{question,question_es,binding,...}}`. Missing or malformed descriptors fail closed. Declare dynamic proposal workers with `contract.requires:['jsfe:input-proposals:v1']`; static policies and linked descendant schemas derive that requirement automatically.
+
+Formatters must be pure apart from their output slot: no authentication, business updates or external effects. Bind the semantic subject and facts that make the question true (account, option, plan, prior receipt). Avoid volatile unrelated history. `origins` restricts initial triggering to `activation` or `answer`; corrections to a pending proposal still require a fresh applicable decision. `when`/`unless` use normal form conditions against candidate values.
+
+JSFE owns `owner.inputProposals[input]`, separate from canonical `values` and the existing **action** `proposal`. Candidates survive contextual yield and bare reentry. An owned `confirm-input-proposal` context uses ordinary exact confirmation and treats the proposed field as current for corrections. Independent inputs commit normally. Accepting a member of an exclusive `any_of` group withdraws pending or confirmed proposals for its peer members. YES is provisional proof bound to owner identity, revision, candidate, prompt and business binding; ordinary validation reruns before canonical acceptance and post-commit callbacks. A changed candidate, policy, subject or binding revokes old proof. Rejected/inapplicable candidates are withdrawn; unmet prerequisites defer them. Approval is consumed once. Do not set proposal state or approval tokens in tenant expressions.
+
+NO never commits the candidate or hands an incomplete value to a parent. It closes the confirmation context and optionally calls `on_declined` with `{form,input,value,reading}` once; this worker chooses the business alternative and may close its owner. Yield retains the proposal and has no decline effect. Do not add separate yes/no collector children, cargo permission flags or ad hoc stack restoration.
+
+The versioned intrinsic requirement is supported by JSFE itself, with no host feature switch. Unknown `jsfe:*` versions reject admission even if a caller supplies a matching boolean. Compiled proposal entries also include a strict `formProposalProtocol() === 1` guard, so an older direct engine cannot silently skip consent. Deploy matched runtime, shared workers and tenant declarations; these candidate artifacts must not be activated with published 1.7.2.
+
+Test actual EN/ES voice/text conversations: activation, unreadable-answer yield, no-argument root reentry, explicit NO, mixed YES plus correction, provider detours, independent fields, nested/foreign owners, stale bindings and consumed proof. Assert canonical values, callbacks, authentication and effects, then run the complete engine and tenant acceptance matrices against installed package bytes.
+
 ## Providers
 
 Declare a `provides` catalog: subject, gate (`flow`, verified paths), source (`flow`, result path, subject/freshness policy), facts and fact sets. Each fact has a key, phrasings, source path or dedicated worker, rendering rules and explicit missing-data text. A private catalog requires an explicit gate. Derive `asked` and mid-form question choices with the builder; do not maintain another list.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jsfe",
-  "version": "1.7.2",
+  "version": "1.7.3",
   "description": "TypeScript workflow engine for conversational/automation apps: multi-flow orchestration, interrupt/resume, stack-based control, robust errors, and flexible tool/REST integration.",
   "license": "MIT",
   "author": "Ron Pinkas",