@addai/node 0.30.13 → 0.30.15

package/dist/entitybox-execution-lease.d.ts

@@ -0,0 +1,81 @@
+import { EntityboxFileInputs } from './entitybox-file-inputs';
+import type { EntityboxRecoveryHost } from './entitybox-recovery-store';
+import type { RuntimeEvent } from './types';
+import { type EntityboxMcpScope } from './entitybox-mcp-contract';
+type Rpc = <T>(name: string, args: Record<string, unknown>) => Promise<T>;
+type Reason = 'completed' | 'canceled' | 'failed' | 'lease_lost';
+export interface EntityboxExecutionIdentity {
+    requestId: string;
+    attemptId: string;
+    scope: EntityboxMcpScope;
+}
+export interface EntityboxProviderSelection {
+    kind: 'anthropic_api_key';
+    vaultItemId: string;
+    model: string;
+}
+export declare class EntityboxExecutionError extends Error {
+}
+/** Runtime-only authority. Neither pairing nor the lease nonce is exported to
+ * the model/container. The SQL contract grants 15 seconds from execution of a
+ * fresh RPC. Our monotonic deadline starts BEFORE that RPC and reserves 2s.
+ * Claim is never automatically retried: its idempotent response cannot be used
+ * as a fresh 15-second grant. Container challenges always require a renewal. */
+export declare class EntityboxExecutionLease {
+    private readonly token;
+    private readonly rpc;
+    readonly identity: Readonly<EntityboxExecutionIdentity>;
+    readonly signal: AbortSignal;
+    private readonly abort;
+    private readonly nonce;
+    private deadline;
+    private timer?;
+    private epoch?;
+    private renewing;
+    private challengeQueue;
+    private queuedChallenges;
+    private acknowledged;
+    private claimed;
+    private provider?;
+    private inventorySealed;
+    private constructor();
+    static claim(requestId: string, scope: EntityboxMcpScope, token: () => string, rpc: Rpc): Promise<EntityboxExecutionLease>;
+    private call;
+    private receipt;
+    private arm;
+    assertActive(): void;
+    /** A watchdog issues its own challenge BEFORE this method calls the server.
+     * It accepts the response only within its original challenge deadline, so a
+     * buffered/delayed grant can never restart or prolong an expired container. */
+    /** Independent model/application guards each require a fresh renewal. Their
+     * original challenge clocks still bound queued replies; no grant is shared. */
+    authorizeQueuedChallenge(): Promise<void>;
+    authorizeChallenge(): Promise<void>;
+    /** Events remain host-authenticated and server-checked. The model never
+     * receives the lease nonce. Queued output may drain after local process
+     * stop, but not after server expiry, cancellation or stop acknowledgement. */
+    appendEvent(event: RuntimeEvent): Promise<boolean>;
+    /** Metadata only: the native server rechecks the immutable request, current
+     * provider binding and active lease. This never renews the execution lease
+     * or returns a secret. A changed selection fences this attempt. */
+    providerSelection(): Promise<Readonly<EntityboxProviderSelection>>;
+    /** The nonce/pairing remain private to this host closure. Downloads happen
+     * only while the independent execution watchdog is renewing the lease. */
+    fileInputs(gatewayUrl: string, transport?: typeof fetch): EntityboxFileInputs;
+    /** Public immutable resource identity only. Registration happens before a
+     * guarded application resumes or a newly created executor starts. These RPCs
+     * never renew authority, and their receipts are checked against this lease. */
+    registerResource(kind: 'application' | 'display' | 'execution', binding: Record<string, unknown>): Promise<void>;
+    registerRecoveryHost(host: EntityboxRecoveryHost): Promise<void>;
+    sealInventory(hasExecution: boolean): Promise<void>;
+    assertInventorySealed(): void;
+    /** Atomic native event/status commit preserves cancellation and prevents
+     * duplicate terminal events after a lost response. Requires physical proof. */
+    finishRequest(outcome: Reason, completion?: RuntimeEvent): Promise<string>;
+    fence(): void;
+    /** The trusted owner must verify ALL execution resources first. A model exit,
+     * timeout or user stop is never accepted as proof. Failed acknowledgement is
+     * retryable on this same object/attempt; no new claim or replay is created. */
+    acknowledgeStopped(reason: Reason, verifyStopped: () => Promise<void>): Promise<void>;
+}
+export {};

package/dist/entitybox-execution-lease.js

@@ -0,0 +1,332 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityboxExecutionLease = exports.EntityboxExecutionError = void 0;
+const crypto_1 = require("crypto");
+const entitybox_file_inputs_1 = require("./entitybox-file-inputs");
+const perf_hooks_1 = require("perf_hooks");
+const entitybox_mcp_contract_1 = require("./entitybox-mcp-contract");
+class EntityboxExecutionError extends Error {
+}
+exports.EntityboxExecutionError = EntityboxExecutionError;
+/** Runtime-only authority. Neither pairing nor the lease nonce is exported to
+ * the model/container. The SQL contract grants 15 seconds from execution of a
+ * fresh RPC. Our monotonic deadline starts BEFORE that RPC and reserves 2s.
+ * Claim is never automatically retried: its idempotent response cannot be used
+ * as a fresh 15-second grant. Container challenges always require a renewal. */
+class EntityboxExecutionLease {
+    token;
+    rpc;
+    identity;
+    signal;
+    abort = new AbortController();
+    nonce = (0, crypto_1.randomUUID)();
+    deadline = 0;
+    timer;
+    epoch;
+    renewing = false;
+    challengeQueue = Promise.resolve();
+    queuedChallenges = 0;
+    acknowledged = false;
+    claimed = false;
+    provider;
+    inventorySealed = false;
+    constructor(requestId, scope, token, rpc) {
+        this.token = token;
+        this.rpc = rpc;
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(requestId))
+            throw new EntityboxExecutionError('Invalid computer request');
+        this.identity = Object.freeze({ requestId: requestId.toLowerCase(), attemptId: (0, crypto_1.randomUUID)(), scope: (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(scope) });
+        this.signal = this.abort.signal;
+    }
+    static async claim(requestId, scope, token, rpc) {
+        const lease = new EntityboxExecutionLease(requestId, scope, token, rpc);
+        const started = perf_hooks_1.performance.now();
+        try {
+            const value = await lease.call('claim', { p_request_id: lease.identity.requestId });
+            const receipt = lease.receipt(value);
+            if (receipt.phase !== 'running')
+                throw new Error();
+            lease.epoch = receipt.epoch;
+            lease.claimed = true;
+            lease.arm(started);
+            return lease;
+        }
+        catch {
+            lease.fence();
+            // A lost/malformed reply may still have committed. No executor was
+            // started, but do not guess at a receipt or retry with another attempt.
+            throw new EntityboxExecutionError('Computer execution could not obtain a verified lease');
+        }
+    }
+    async call(name, extra = {}) {
+        let timer;
+        try {
+            return await Promise.race([
+                this.rpc('entitybox_native_execution_' + name, {
+                    p_token: this.token(), p_attempt_id: this.identity.attemptId, p_lease_token: this.nonce, ...extra,
+                }),
+                new Promise((_, reject) => { timer = setTimeout(() => reject(new EntityboxExecutionError('Execution RPC deadline ended')), 4500); }),
+            ]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    receipt(value) {
+        const r = value;
+        const scope = (0, entitybox_mcp_contract_1.parseEntityboxMcpScope)(r?.scope);
+        if (!r || r.attemptId !== this.identity.attemptId || r.requestId !== this.identity.requestId
+            || r.runId !== this.identity.scope.runId || !Number.isSafeInteger(r.epoch) || r.epoch < 1
+            || (this.epoch !== undefined && r.epoch !== this.epoch)
+            || !['running', 'stop_requested', 'stopped'].includes(r.phase)
+            || typeof r.leaseExpiresAt !== 'string' || !Number.isFinite(Date.parse(r.leaseExpiresAt))
+            || scope.runId !== this.identity.scope.runId || scope.desktopId !== this.identity.scope.desktopId || scope.runtimeId !== this.identity.scope.runtimeId)
+            throw new Error();
+        return r;
+    }
+    arm(started) {
+        const deadline = started + 13_000;
+        if (this.signal.aborted || perf_hooks_1.performance.now() >= deadline) {
+            this.fence();
+            throw new Error();
+        }
+        this.deadline = deadline;
+        clearTimeout(this.timer);
+        this.timer = setTimeout(() => this.fence(), Math.max(1, deadline - perf_hooks_1.performance.now()));
+    }
+    assertActive() {
+        if (!this.claimed || this.signal.aborted || perf_hooks_1.performance.now() >= this.deadline) {
+            this.fence();
+            throw new EntityboxExecutionError('Computer execution lease ended');
+        }
+    }
+    /** A watchdog issues its own challenge BEFORE this method calls the server.
+     * It accepts the response only within its original challenge deadline, so a
+     * buffered/delayed grant can never restart or prolong an expired container. */
+    /** Independent model/application guards each require a fresh renewal. Their
+     * original challenge clocks still bound queued replies; no grant is shared. */
+    authorizeQueuedChallenge() {
+        if (this.queuedChallenges >= 4) {
+            this.fence();
+            return Promise.reject(new EntityboxExecutionError('Execution challenge queue exceeded'));
+        }
+        this.queuedChallenges++;
+        const work = this.challengeQueue.then(() => { this.assertActive(); return this.authorizeChallenge(); });
+        this.challengeQueue = work.catch(() => { }).finally(() => { this.queuedChallenges--; });
+        return work;
+    }
+    async authorizeChallenge() {
+        this.assertActive();
+        if (this.renewing) {
+            this.fence();
+            throw new EntityboxExecutionError('Overlapping execution renewal');
+        }
+        this.renewing = true;
+        const started = perf_hooks_1.performance.now();
+        try {
+            const r = this.receipt(await this.call('renew'));
+            this.assertActive();
+            if (r.phase !== 'running')
+                throw new Error();
+            this.arm(started);
+        }
+        catch {
+            this.fence();
+            throw new EntityboxExecutionError('Computer execution renewal ended');
+        }
+        finally {
+            this.renewing = false;
+        }
+    }
+    /** Events remain host-authenticated and server-checked. The model never
+     * receives the lease nonce. Queued output may drain after local process
+     * stop, but not after server expiry, cancellation or stop acknowledgement. */
+    async appendEvent(event) {
+        if (!this.claimed || this.acknowledged || event.type === 'turn_complete')
+            throw new EntityboxExecutionError('Execution event unavailable');
+        const result = await this.call('event', { p_event: event });
+        if (typeof result !== 'boolean')
+            throw new EntityboxExecutionError('Execution event was not confirmed');
+        return result;
+    }
+    /** Metadata only: the native server rechecks the immutable request, current
+     * provider binding and active lease. This never renews the execution lease
+     * or returns a secret. A changed selection fences this attempt. */
+    async providerSelection() {
+        this.assertActive();
+        try {
+            const value = await this.call('provider');
+            const receipt = this.receipt(value), selection = value.provider;
+            this.assertActive();
+            if (receipt.phase !== 'running' || !selection || selection.kind !== 'anthropic_api_key'
+                || typeof selection.vaultItemId !== 'string' || !/^[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}$/.test(selection.vaultItemId)
+                || typeof selection.model !== 'string' || selection.model.length > 120 || !/^claude-[a-zA-Z0-9_.:-]+$/.test(selection.model)
+                || Object.keys(selection).sort().join(',') !== 'kind,model,vaultItemId'
+                || (this.provider && (this.provider.vaultItemId !== selection.vaultItemId || this.provider.model !== selection.model)))
+                throw new Error();
+            this.provider = Object.freeze({ ...selection });
+            return this.provider;
+        }
+        catch {
+            this.fence();
+            throw new EntityboxExecutionError('The computer provider selection could not be verified');
+        }
+    }
+    /** The nonce/pairing remain private to this host closure. Downloads happen
+     * only while the independent execution watchdog is renewing the lease. */
+    fileInputs(gatewayUrl, transport = fetch) {
+        const url = (0, entitybox_file_inputs_1.entityboxFileGatewayUrl)(gatewayUrl);
+        return new entitybox_file_inputs_1.EntityboxFileInputs({ requestId: this.identity.requestId, signal: this.signal, requireFiles: true,
+            manifest: async (signal) => {
+                this.assertActive();
+                if (signal.aborted)
+                    throw new Error();
+                const result = await this.rpc('entitybox_file_manifest', { p_token: this.token(), p_request_id: this.identity.requestId, p_attempt_id: this.identity.attemptId, p_lease_token: this.nonce });
+                this.assertActive();
+                if (signal.aborted)
+                    throw new Error();
+                return result;
+            },
+            download: async (fileId, signal) => {
+                this.assertActive();
+                if (signal.aborted)
+                    throw new Error();
+                const response = await transport(url, { method: 'POST', redirect: 'error', credentials: 'omit', signal,
+                    headers: { authorization: 'Bearer ' + this.token(), 'content-type': 'application/json' },
+                    body: JSON.stringify({ requestId: this.identity.requestId, fileId, attemptId: this.identity.attemptId, leaseToken: this.nonce }) });
+                try {
+                    this.assertActive();
+                    if (signal.aborted)
+                        throw new Error();
+                    return response;
+                }
+                catch {
+                    void response.body?.cancel().catch(() => { });
+                    throw new Error();
+                }
+            },
+        });
+    }
+    /** Public immutable resource identity only. Registration happens before a
+     * guarded application resumes or a newly created executor starts. These RPCs
+     * never renew authority, and their receipts are checked against this lease. */
+    async registerResource(kind, binding) {
+        this.assertActive();
+        try {
+            const copy = JSON.parse(JSON.stringify(binding)), canonical = (value) => JSON.stringify(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)));
+            if (!['application', 'display', 'execution'].includes(kind) || !copy || typeof copy !== 'object' || Array.isArray(copy) || Buffer.byteLength(JSON.stringify(copy)) > 2048 || !Object.values(copy).every(v => typeof v === 'string'))
+                throw new Error();
+            const value = await this.call('register', { p_kind: kind, p_binding: copy });
+            const receipt = this.receipt(value);
+            this.assertActive();
+            if (receipt.phase !== 'running' || value.resource?.kind !== kind || !value.resource.binding || canonical(value.resource.binding) !== canonical(copy))
+                throw new Error();
+        }
+        catch {
+            this.fence();
+            throw new EntityboxExecutionError('Execution resource registration was not confirmed');
+        }
+    }
+    async registerRecoveryHost(host) {
+        this.assertActive();
+        try {
+            const { parseEntityboxRecoveryHost, entityboxCanonical } = await Promise.resolve().then(() => __importStar(require('./entitybox-recovery-store')));
+            this.assertActive();
+            const copy = parseEntityboxRecoveryHost(host), value = await this.call('host', { p_host: copy });
+            const receipt = this.receipt(value);
+            this.assertActive();
+            if (receipt.phase !== 'running' || entityboxCanonical(value.host) !== entityboxCanonical(copy))
+                throw new Error();
+        }
+        catch {
+            this.fence();
+            throw new EntityboxExecutionError('Execution recovery host was not confirmed');
+        }
+    }
+    async sealInventory(hasExecution) {
+        this.assertActive();
+        try {
+            if (typeof hasExecution !== 'boolean')
+                throw new Error();
+            const value = await this.call('seal', { p_has_execution: hasExecution });
+            const receipt = this.receipt(value);
+            this.assertActive();
+            if (receipt.phase !== 'running' || value.inventory?.sealed !== true || value.inventory.hasExecution !== hasExecution)
+                throw new Error();
+            this.inventorySealed = true;
+        }
+        catch {
+            this.fence();
+            throw new EntityboxExecutionError('Execution inventory was not confirmed');
+        }
+    }
+    assertInventorySealed() { this.assertActive(); if (!this.inventorySealed)
+        throw new EntityboxExecutionError('Execution inventory is incomplete'); }
+    /** Atomic native event/status commit preserves cancellation and prevents
+     * duplicate terminal events after a lost response. Requires physical proof. */
+    async finishRequest(outcome, completion) {
+        if (!this.acknowledged)
+            throw new EntityboxExecutionError('Execution stop has not been confirmed');
+        const value = await this.call('finish', { p_outcome: outcome, p_completion: completion ?? null });
+        if (value?.requestId !== this.identity.requestId || !['completed', 'failed', 'canceled', 'dead_letter', 'deleted'].includes(value?.status ?? ''))
+            throw new EntityboxExecutionError('Execution final status was not confirmed');
+        return value.status;
+    }
+    fence() {
+        clearTimeout(this.timer);
+        if (!this.signal.aborted)
+            this.abort.abort(new EntityboxExecutionError('Computer execution fenced'));
+    }
+    /** The trusted owner must verify ALL execution resources first. A model exit,
+     * timeout or user stop is never accepted as proof. Failed acknowledgement is
+     * retryable on this same object/attempt; no new claim or replay is created. */
+    async acknowledgeStopped(reason, verifyStopped) {
+        this.fence();
+        if (this.acknowledged)
+            return;
+        try {
+            await verifyStopped();
+            const r = this.receipt(await this.call('stopped', { p_reason: reason }));
+            if (r.phase !== 'stopped')
+                throw new Error();
+            this.acknowledged = true;
+        }
+        catch {
+            throw new EntityboxExecutionError('Computer stop could not be confirmed');
+        }
+    }
+}
+exports.EntityboxExecutionLease = EntityboxExecutionLease;

package/dist/entitybox-file-inputs.d.ts

@@ -0,0 +1,51 @@
+export interface EntityboxInputFile {
+    id: string;
+    name: string;
+    type: string;
+    size: number;
+    sha256: string;
+}
+export interface EntityboxFileAuthority {
+    requestId: string;
+    signal: AbortSignal;
+    requireFiles?: boolean;
+    manifest: (signal: AbortSignal) => Promise<unknown>;
+    download: (fileId: string, signal: AbortSignal) => Promise<Response>;
+}
+export type EntityboxFileBlock = {
+    type: 'text';
+    text: string;
+} | {
+    type: 'image' | 'document';
+    source: {
+        type: 'base64';
+        media_type: string;
+        data: string;
+    };
+};
+type Block = EntityboxFileBlock;
+export declare const ENTITYBOX_FILE_TOTAL_BYTES: number;
+export declare const ENTITYBOX_IMAGE_BYTES: number;
+export declare const ENTITYBOX_PROVIDER_BYTES: number;
+export declare class EntityboxFileInputError extends Error {
+    constructor();
+}
+/** Only a trusted host setting may name the gateway. Models, files and queued
+ * prompts never choose a URL. Redirects and ambient credentials are disabled. */
+export declare function entityboxFileGatewayUrl(value: string): string;
+export declare function entityboxFileManifest(value: unknown, requestId: string): readonly Readonly<EntityboxInputFile>[];
+/** Task-scoped original bytes. No URLs, credentials, binary IPC, host paths or
+ * durable cache reach the isolated executor. Authorization is repeated for
+ * every inference, including count_tokens and retries, and after all downloads.
+ * The random anchor binds files to this task's user message, not warm-up calls
+ * or tool results. The model gets ordinary image/document content blocks. */
+export declare class EntityboxFileInputs {
+    private readonly authority;
+    private readonly anchor;
+    private expectedManifest?;
+    constructor(authority: EntityboxFileAuthority);
+    prompt(text: string): string;
+    blocks(signal: AbortSignal): Promise<readonly Block[]>;
+    attach(body: Record<string, unknown>, signal: AbortSignal): Promise<boolean>;
+}
+export {};

package/dist/entitybox-file-inputs.js

@@ -0,0 +1,182 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityboxFileInputs = exports.EntityboxFileInputError = exports.ENTITYBOX_PROVIDER_BYTES = exports.ENTITYBOX_IMAGE_BYTES = exports.ENTITYBOX_FILE_TOTAL_BYTES = void 0;
+exports.entityboxFileGatewayUrl = entityboxFileGatewayUrl;
+exports.entityboxFileManifest = entityboxFileManifest;
+const crypto_1 = require("crypto");
+const entitybox_operation_1 = require("./entitybox-operation");
+const uuid = /^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}$/;
+const formats = new Set(['image/png', 'image/jpeg', 'image/webp', 'image/gif', 'application/pdf']);
+// Deliberately below the provider's 32 MB request and 10 MB encoded-image
+// limits. Reserve room for the CLI's system prompt, history and tools.
+exports.ENTITYBOX_FILE_TOTAL_BYTES = 18 * 1024 * 1024;
+exports.ENTITYBOX_IMAGE_BYTES = 7 * 1024 * 1024;
+exports.ENTITYBOX_PROVIDER_BYTES = 30 * 1024 * 1024;
+class EntityboxFileInputError extends Error {
+    constructor() { super('An attachment is unavailable or cannot be processed. Reattach a smaller PNG, JPEG, WebP, GIF or unlocked PDF and try again.'); }
+}
+exports.EntityboxFileInputError = EntityboxFileInputError;
+const fail = () => new EntityboxFileInputError();
+const exact = (v, keys) => Object.keys(v).sort().join(',') === keys.sort().join(',');
+/** Only a trusted host setting may name the gateway. Models, files and queued
+ * prompts never choose a URL. Redirects and ambient credentials are disabled. */
+function entityboxFileGatewayUrl(value) {
+    try {
+        const u = new URL(value);
+        if (u.protocol !== 'https:' || u.username || u.password || u.hash || u.search || u.port || u.href !== value || u.pathname === '/' || u.hostname === 'localhost')
+            throw fail();
+        return u.href;
+    }
+    catch {
+        throw fail();
+    }
+}
+function entityboxFileManifest(value, requestId) {
+    const m = value;
+    if (!m || !exact(m, ['version', 'requestId', 'files']) || m.version !== 1 || m.requestId !== requestId || !uuid.test(requestId) || !Array.isArray(m.files) || m.files.length > 6)
+        throw fail();
+    const ids = new Set();
+    let size = 0;
+    const files = m.files.map((raw) => {
+        const f = raw;
+        if (!f || !exact(f, ['id', 'name', 'type', 'size', 'sha256']) || typeof f.id !== 'string' || !uuid.test(f.id) || ids.has(f.id)
+            || typeof f.name !== 'string' || !f.name.trim() || f.name.length > 180 || /[\u0000-\u001f\u007f]/.test(f.name)
+            || !formats.has(f.type) || !Number.isSafeInteger(f.size) || f.size < 1 || f.size > exports.ENTITYBOX_FILE_TOTAL_BYTES
+            || f.type !== 'application/pdf' && f.size > exports.ENTITYBOX_IMAGE_BYTES || typeof f.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(f.sha256))
+            throw fail();
+        size += f.size;
+        if (size > exports.ENTITYBOX_FILE_TOTAL_BYTES)
+            throw fail();
+        ids.add(f.id);
+        return Object.freeze({ id: f.id, name: f.name, type: f.type, size: f.size, sha256: f.sha256 });
+    });
+    return Object.freeze(files);
+}
+/** This is a format-signature check, not a decoder. The provider performs
+ * image/PDF decoding; malformed or encrypted documents must remain errors. */
+function signature(bytes, type) {
+    if (type === 'image/png')
+        return bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]));
+    if (type === 'image/jpeg')
+        return bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
+    if (type === 'image/gif')
+        return ['GIF87a', 'GIF89a'].includes(bytes.subarray(0, 6).toString('ascii'));
+    if (type === 'image/webp')
+        return bytes.subarray(0, 4).toString('ascii') === 'RIFF' && bytes.subarray(8, 12).toString('ascii') === 'WEBP';
+    return bytes.subarray(0, 5).toString('ascii') === '%PDF-';
+}
+async function readFile(response, file, signal) {
+    let reader;
+    const stop = () => { void reader?.cancel().catch(() => { }); };
+    try {
+        const length = response.headers.get('content-length');
+        if (signal.aborted || response.status !== 200 || response.redirected || !response.body
+            || response.headers.get('content-type')?.split(';')[0] !== file.type
+            || response.headers.get('x-entitybox-sha256') !== file.sha256
+            || length !== null && (!/^\d+$/.test(length) || Number(length) !== file.size))
+            throw fail();
+        reader = response.body.getReader();
+        signal.addEventListener('abort', stop, { once: true });
+        const chunks = [];
+        let size = 0;
+        while (true) {
+            const item = await reader.read();
+            if (signal.aborted)
+                throw fail();
+            if (item.done)
+                break;
+            size += item.value.byteLength;
+            if (size > file.size)
+                throw fail();
+            chunks.push(Buffer.from(item.value));
+        }
+        const bytes = Buffer.concat(chunks);
+        if (size !== file.size || (0, crypto_1.createHash)('sha256').update(bytes).digest('hex') !== file.sha256 || !signature(bytes, file.type))
+            throw fail();
+        return bytes;
+    }
+    finally {
+        signal.removeEventListener('abort', stop);
+        if (reader) {
+            await reader.cancel().catch(() => { });
+            reader.releaseLock();
+        }
+        else
+            await response.body?.cancel().catch(() => { });
+    }
+}
+/** Task-scoped original bytes. No URLs, credentials, binary IPC, host paths or
+ * durable cache reach the isolated executor. Authorization is repeated for
+ * every inference, including count_tokens and retries, and after all downloads.
+ * The random anchor binds files to this task's user message, not warm-up calls
+ * or tool results. The model gets ordinary image/document content blocks. */
+class EntityboxFileInputs {
+    authority;
+    anchor = `[EntityBox task files ${(0, crypto_1.randomUUID)()}]`;
+    expectedManifest;
+    constructor(authority) {
+        this.authority = authority;
+        if (!uuid.test(authority.requestId))
+            throw fail();
+    }
+    prompt(text) { return text + '\n\n' + this.anchor; }
+    async blocks(signal) {
+        try {
+            return await (0, entitybox_operation_1.entityboxOperation)([this.authority.signal, signal], 90000, async (active) => {
+                const files = entityboxFileManifest(await this.authority.manifest(active), this.authority.requestId);
+                if (this.authority.requireFiles && !files.length)
+                    throw fail();
+                const bound = JSON.stringify(files);
+                if (this.expectedManifest !== undefined && this.expectedManifest !== bound)
+                    throw fail();
+                this.expectedManifest = bound;
+                const blocks = [];
+                for (const file of files) {
+                    const bytes = await (0, entitybox_operation_1.entityboxOperation)([active], 30000, async (current) => {
+                        const response = await this.authority.download(file.id, current);
+                        return readFile(response, file, current);
+                    });
+                    blocks.push({ type: 'text', text: `Attached file: ${JSON.stringify(file.name)}` }, { type: file.type === 'application/pdf' ? 'document' : 'image', source: { type: 'base64', media_type: file.type, data: bytes.toString('base64') } });
+                }
+                const current = entityboxFileManifest(await this.authority.manifest(active), this.authority.requestId);
+                if (JSON.stringify(files) !== JSON.stringify(current) || active.aborted)
+                    throw fail();
+                return blocks;
+            });
+        }
+        catch {
+            throw fail();
+        }
+    }
+    async attach(body, signal) {
+        if (!Array.isArray(body.messages))
+            throw fail();
+        let target;
+        let occurrences = 0;
+        for (const message of body.messages) {
+            if (!message || message.role !== 'user')
+                continue;
+            const content = typeof message.content === 'string' ? [{ type: 'text', text: message.content }] : message.content;
+            if (!Array.isArray(content))
+                continue;
+            for (const block of content) {
+                if (block?.type !== 'text' || typeof block.text !== 'string')
+                    continue;
+                const count = block.text.split(this.anchor).length - 1;
+                if (count) {
+                    occurrences += count;
+                    target = { message, content };
+                }
+            }
+        }
+        if (!occurrences)
+            return false;
+        if (occurrences !== 1 || !target)
+            throw fail();
+        const blocks = await this.blocks(signal);
+        const text = target.content.map(b => b.type === 'text' && typeof b.text === 'string' ? { ...b, text: b.text.replace(this.anchor, '').trimEnd() } : b);
+        target.message.content = [...blocks, ...text];
+        return blocks.length > 0;
+    }
+}
+exports.EntityboxFileInputs = EntityboxFileInputs;