@anuma/sdk 6.24.0 → 6.25.0

package/dist/expo/index.cjs

@@ -19459,6 +19459,7 @@ function createDurableAutoExtractor(options) {
   }
   async function extractBatch(messages, conversationId, ids, jobScope, jobFolderId) {
     let watchdog;
+    const model = options.modelForScope?.(jobScope) ?? options.extract.model;
     try {
       return await Promise.race([
         new Promise((resolve, reject) => {
@@ -19471,6 +19472,8 @@ function createDurableAutoExtractor(options) {
                 canWrite: async () => !disposed && await storage.conversationsCollection.query(import_watermelondb12.Q.where("conversation_id", conversationId), import_watermelondb12.Q.where("is_deleted", false)).fetchCount() > 0 && await storage.messagesCollection.query(import_watermelondb12.Q.where("conversation_id", conversationId), import_watermelondb12.Q.where("id", import_watermelondb12.Q.oneOf(ids))).fetchCount() === ids.length && (!vault.canWrite || await vault.canWrite()) && !disposed
               }
             },
+            // The model follows the job's scope, not the mode alive at drain time.
+            extract: { ...options.extract, ...model !== void 0 && { model } },
             // Never publish a private queued observation after a mode flip.
             scope: jobScope,
             folderId: jobFolderId,

package/dist/expo/index.d.mts

@@ -9459,6 +9459,16 @@ interface DurableAutoExtractorOptions extends Omit<CreateAutoExtractorOptions, "
      * as `"private"` — the direction that cannot publish.
      */
     scope?: string | (() => string);
+    /**
+     * Extraction model for a batch, chosen from the scope that batch will be
+     * retained under. A queued job keeps its scope across a privacy-mode flip but
+     * `extract.model` is whatever this instance was built with, so without this a
+     * turn queued in private mode is drained by a public-mode extractor on that
+     * extractor's model. Returning `undefined` keeps `extract.model`. A resolver
+     * that throws fails the batch, which stays queued for retry: guessing a model
+     * is exactly the mistake this exists to prevent.
+     */
+    modelForScope?: (scope: string) => string | undefined;
     /** Coalesce arrivals after durably recording them. Defaults to 20 seconds. */
     debounceMs?: number;
     /** Retry delay for a failed batch. Defaults to 30 seconds; max three attempts

package/dist/expo/index.d.ts

@@ -9459,6 +9459,16 @@ interface DurableAutoExtractorOptions extends Omit<CreateAutoExtractorOptions, "
      * as `"private"` — the direction that cannot publish.
      */
     scope?: string | (() => string);
+    /**
+     * Extraction model for a batch, chosen from the scope that batch will be
+     * retained under. A queued job keeps its scope across a privacy-mode flip but
+     * `extract.model` is whatever this instance was built with, so without this a
+     * turn queued in private mode is drained by a public-mode extractor on that
+     * extractor's model. Returning `undefined` keeps `extract.model`. A resolver
+     * that throws fails the batch, which stays queued for retry: guessing a model
+     * is exactly the mistake this exists to prevent.
+     */
+    modelForScope?: (scope: string) => string | undefined;
     /** Coalesce arrivals after durably recording them. Defaults to 20 seconds. */
     debounceMs?: number;
     /** Retry delay for a failed batch. Defaults to 30 seconds; max three attempts

package/dist/expo/index.mjs

@@ -9529,6 +9529,7 @@ function createDurableAutoExtractor(options) {
   }
   async function extractBatch(messages, conversationId, ids, jobScope, jobFolderId) {
     let watchdog;
+    const model = options.modelForScope?.(jobScope) ?? options.extract.model;
     try {
       return await Promise.race([
         new Promise((resolve, reject) => {
@@ -9541,6 +9542,8 @@ function createDurableAutoExtractor(options) {
                 canWrite: async () => !disposed && await storage.conversationsCollection.query(Q4.where("conversation_id", conversationId), Q4.where("is_deleted", false)).fetchCount() > 0 && await storage.messagesCollection.query(Q4.where("conversation_id", conversationId), Q4.where("id", Q4.oneOf(ids))).fetchCount() === ids.length && (!vault.canWrite || await vault.canWrite()) && !disposed
               }
             },
+            // The model follows the job's scope, not the mode alive at drain time.
+            extract: { ...options.extract, ...model !== void 0 && { model } },
             // Never publish a private queued observation after a mode flip.
             scope: jobScope,
             folderId: jobFolderId,

package/dist/react/index.cjs

@@ -20763,6 +20763,7 @@ function createDurableAutoExtractor(options) {
   }
   async function extractBatch(messages, conversationId, ids, jobScope, jobFolderId) {
     let watchdog;
+    const model = options.modelForScope?.(jobScope) ?? options.extract.model;
     try {
       return await Promise.race([
         new Promise((resolve, reject) => {
@@ -20775,6 +20776,8 @@ function createDurableAutoExtractor(options) {
                 canWrite: async () => !disposed && await storage.conversationsCollection.query(import_watermelondb13.Q.where("conversation_id", conversationId), import_watermelondb13.Q.where("is_deleted", false)).fetchCount() > 0 && await storage.messagesCollection.query(import_watermelondb13.Q.where("conversation_id", conversationId), import_watermelondb13.Q.where("id", import_watermelondb13.Q.oneOf(ids))).fetchCount() === ids.length && (!vault.canWrite || await vault.canWrite()) && !disposed
               }
             },
+            // The model follows the job's scope, not the mode alive at drain time.
+            extract: { ...options.extract, ...model !== void 0 && { model } },
             // Never publish a private queued observation after a mode flip.
             scope: jobScope,
             folderId: jobFolderId,

package/dist/react/index.d.mts

@@ -10694,6 +10694,16 @@ interface DurableAutoExtractorOptions extends Omit<CreateAutoExtractorOptions, "
      * as `"private"` — the direction that cannot publish.
      */
     scope?: string | (() => string);
+    /**
+     * Extraction model for a batch, chosen from the scope that batch will be
+     * retained under. A queued job keeps its scope across a privacy-mode flip but
+     * `extract.model` is whatever this instance was built with, so without this a
+     * turn queued in private mode is drained by a public-mode extractor on that
+     * extractor's model. Returning `undefined` keeps `extract.model`. A resolver
+     * that throws fails the batch, which stays queued for retry: guessing a model
+     * is exactly the mistake this exists to prevent.
+     */
+    modelForScope?: (scope: string) => string | undefined;
     /** Coalesce arrivals after durably recording them. Defaults to 20 seconds. */
     debounceMs?: number;
     /** Retry delay for a failed batch. Defaults to 30 seconds; max three attempts

package/dist/react/index.d.ts

@@ -10694,6 +10694,16 @@ interface DurableAutoExtractorOptions extends Omit<CreateAutoExtractorOptions, "
      * as `"private"` — the direction that cannot publish.
      */
     scope?: string | (() => string);
+    /**
+     * Extraction model for a batch, chosen from the scope that batch will be
+     * retained under. A queued job keeps its scope across a privacy-mode flip but
+     * `extract.model` is whatever this instance was built with, so without this a
+     * turn queued in private mode is drained by a public-mode extractor on that
+     * extractor's model. Returning `undefined` keeps `extract.model`. A resolver
+     * that throws fails the batch, which stays queued for retry: guessing a model
+     * is exactly the mistake this exists to prevent.
+     */
+    modelForScope?: (scope: string) => string | undefined;
     /** Coalesce arrivals after durably recording them. Defaults to 20 seconds. */
     debounceMs?: number;
     /** Retry delay for a failed batch. Defaults to 30 seconds; max three attempts

package/dist/react/index.mjs

@@ -10347,6 +10347,7 @@ function createDurableAutoExtractor(options) {
   }
   async function extractBatch(messages, conversationId, ids, jobScope, jobFolderId) {
     let watchdog;
+    const model = options.modelForScope?.(jobScope) ?? options.extract.model;
     try {
       return await Promise.race([
         new Promise((resolve, reject) => {
@@ -10359,6 +10360,8 @@ function createDurableAutoExtractor(options) {
                 canWrite: async () => !disposed && await storage.conversationsCollection.query(Q5.where("conversation_id", conversationId), Q5.where("is_deleted", false)).fetchCount() > 0 && await storage.messagesCollection.query(Q5.where("conversation_id", conversationId), Q5.where("id", Q5.oneOf(ids))).fetchCount() === ids.length && (!vault.canWrite || await vault.canWrite()) && !disposed
               }
             },
+            // The model follows the job's scope, not the mode alive at drain time.
+            extract: { ...options.extract, ...model !== void 0 && { model } },
             // Never publish a private queued observation after a mode flip.
             scope: jobScope,
             folderId: jobFolderId,

package/dist/server/index.cjs

@@ -32401,6 +32401,7 @@ function createDurableAutoExtractor(options) {
   }
   async function extractBatch(messages, conversationId, ids, jobScope, jobFolderId) {
     let watchdog;
+    const model = options.modelForScope?.(jobScope) ?? options.extract.model;
     try {
       return await Promise.race([
         new Promise((resolve, reject) => {
@@ -32413,6 +32414,8 @@ function createDurableAutoExtractor(options) {
                 canWrite: async () => !disposed && await storage.conversationsCollection.query(import_watermelondb24.Q.where("conversation_id", conversationId), import_watermelondb24.Q.where("is_deleted", false)).fetchCount() > 0 && await storage.messagesCollection.query(import_watermelondb24.Q.where("conversation_id", conversationId), import_watermelondb24.Q.where("id", import_watermelondb24.Q.oneOf(ids))).fetchCount() === ids.length && (!vault.canWrite || await vault.canWrite()) && !disposed
               }
             },
+            // The model follows the job's scope, not the mode alive at drain time.
+            extract: { ...options.extract, ...model !== void 0 && { model } },
             // Never publish a private queued observation after a mode flip.
             scope: jobScope,
             folderId: jobFolderId,

package/dist/server/index.d.mts

@@ -10031,6 +10031,16 @@ interface DurableAutoExtractorOptions extends Omit<CreateAutoExtractorOptions, "
      * as `"private"` — the direction that cannot publish.
      */
     scope?: string | (() => string);
+    /**
+     * Extraction model for a batch, chosen from the scope that batch will be
+     * retained under. A queued job keeps its scope across a privacy-mode flip but
+     * `extract.model` is whatever this instance was built with, so without this a
+     * turn queued in private mode is drained by a public-mode extractor on that
+     * extractor's model. Returning `undefined` keeps `extract.model`. A resolver
+     * that throws fails the batch, which stays queued for retry: guessing a model
+     * is exactly the mistake this exists to prevent.
+     */
+    modelForScope?: (scope: string) => string | undefined;
     /** Coalesce arrivals after durably recording them. Defaults to 20 seconds. */
     debounceMs?: number;
     /** Retry delay for a failed batch. Defaults to 30 seconds; max three attempts

package/dist/server/index.d.ts

@@ -10031,6 +10031,16 @@ interface DurableAutoExtractorOptions extends Omit<CreateAutoExtractorOptions, "
      * as `"private"` — the direction that cannot publish.
      */
     scope?: string | (() => string);
+    /**
+     * Extraction model for a batch, chosen from the scope that batch will be
+     * retained under. A queued job keeps its scope across a privacy-mode flip but
+     * `extract.model` is whatever this instance was built with, so without this a
+     * turn queued in private mode is drained by a public-mode extractor on that
+     * extractor's model. Returning `undefined` keeps `extract.model`. A resolver
+     * that throws fails the batch, which stays queued for retry: guessing a model
+     * is exactly the mistake this exists to prevent.
+     */
+    modelForScope?: (scope: string) => string | undefined;
     /** Coalesce arrivals after durably recording them. Defaults to 20 seconds. */
     debounceMs?: number;
     /** Retry delay for a failed batch. Defaults to 30 seconds; max three attempts

package/dist/server/index.mjs

@@ -8412,6 +8412,7 @@ function createDurableAutoExtractor(options) {
   }
   async function extractBatch(messages, conversationId, ids, jobScope, jobFolderId) {
     let watchdog;
+    const model = options.modelForScope?.(jobScope) ?? options.extract.model;
     try {
       return await Promise.race([
         new Promise((resolve, reject) => {
@@ -8424,6 +8425,8 @@ function createDurableAutoExtractor(options) {
                 canWrite: async () => !disposed && await storage.conversationsCollection.query(import_watermelondb20.Q.where("conversation_id", conversationId), import_watermelondb20.Q.where("is_deleted", false)).fetchCount() > 0 && await storage.messagesCollection.query(import_watermelondb20.Q.where("conversation_id", conversationId), import_watermelondb20.Q.where("id", import_watermelondb20.Q.oneOf(ids))).fetchCount() === ids.length && (!vault.canWrite || await vault.canWrite()) && !disposed
               }
             },
+            // The model follows the job's scope, not the mode alive at drain time.
+            extract: { ...options.extract, ...model !== void 0 && { model } },
             // Never publish a private queued observation after a mode flip.
             scope: jobScope,
             folderId: jobFolderId,

package/dist/tools/index.cjs

@@ -33,6 +33,7 @@ __export(index_exports, {
   APP_PREVIEW_BASELINE_CSS: () => APP_PREVIEW_BASELINE_CSS,
   AUDIT_DESIGN_SCHEMA: () => AUDIT_DESIGN_SCHEMA,
   AgentresError: () => AgentresError,
+  AgentresPathError: () => AgentresPathError,
   AnumaJsxError: () => AnumaJsxError,
   CONNECTOR_ERROR_MARKER: () => CONNECTOR_ERROR_MARKER,
   CREATE_DOCUMENT_SCHEMA: () => CREATE_DOCUMENT_SCHEMA,
@@ -83,6 +84,7 @@ __export(index_exports, {
   createChartTool: () => createChartTool,
   createChatTools: () => createChatTools,
   createChoiceTool: () => createChoiceTool,
+  createConfirmTool: () => createConfirmTool,
   createConnectorOfferTool: () => createConnectorOfferTool,
   createConnectorTokenGetter: () => createConnectorTokenGetter,
   createDisplayTool: () => createDisplayTool,
@@ -833,6 +835,76 @@ function createChoiceTool(options) {
   });
 }
 
+// src/tools/confirm.ts
+function createConfirmTool(options) {
+  return createInteractiveTool(options, {
+    name: "prompt_user_confirm",
+    description: "Ask the user to approve a specific action before it happens. Use before anything that spends money or is hard to undo, such as booking a restaurant table or placing an order. List every parameter of the action, with the exact values you are about to use \u2014 the user approves what this card shows, and nothing else. Returns whether they confirmed. Do not use for ordinary yes/no questions; use prompt_user_choice for those.",
+    parameters: {
+      type: "object",
+      properties: {
+        title: {
+          type: "string",
+          description: "Short heading naming the action, e.g. 'Confirm your reservation'"
+        },
+        description: {
+          type: "string",
+          description: "Optional extra context, e.g. the cancellation policy"
+        },
+        action: {
+          type: "string",
+          description: "Machine-readable id of the action being confirmed, matching the tool that will carry it out, e.g. 'book_restaurant'"
+        },
+        parameters: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              name: {
+                type: "string",
+                description: "Argument name of the acting tool, e.g. 'party_size'"
+              },
+              label: {
+                type: "string",
+                description: "Display label shown to the user, e.g. 'Party size'"
+              },
+              value: {
+                type: "string",
+                description: "The exact value you will use, as a string. Not a paraphrase \u2014 this is what the user is agreeing to."
+              }
+            },
+            required: ["name", "label", "value"]
+          },
+          description: "Every parameter of the action, with the exact values. The user sees these and nothing else."
+        }
+      },
+      required: ["title", "action", "parameters"]
+    },
+    interactionType: "confirm",
+    validate: (args) => {
+      const { title, action, parameters } = args;
+      if (typeof title !== "string" || !title) return false;
+      if (typeof action !== "string" || !action) return false;
+      if (!Array.isArray(parameters) || parameters.length === 0) return false;
+      return parameters.every((parameter) => {
+        return typeof parameter?.name === "string" && !!parameter.name && typeof parameter.label === "string" && !!parameter.label && typeof parameter.value === "string";
+      });
+    },
+    mapResult: (result, args) => {
+      if (typeof result.confirmed !== "boolean") return { cancelled: true };
+      return {
+        confirmed: result.confirmed,
+        // From the arguments rather than from the card's reply. The card was
+        // handed these to render, so echoing them back would only create a
+        // second copy that could disagree with what was on screen.
+        action: args.action,
+        parameters: args.parameters,
+        answeredAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  });
+}
+
 // src/tools/form.ts
 var VALID_FIELD_TYPES = [
   "text",
@@ -2571,6 +2643,12 @@ var SiwxUnsupportedError = class extends Error {
     this.name = "SiwxUnsupportedError";
   }
 };
+var AgentresPathError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AgentresPathError";
+  }
+};
 var SiwxChallengeError = class extends Error {
   constructor(message, options) {
     super(message);
@@ -2648,6 +2726,7 @@ var PAYMENT_REQUIRED_HEADER = "PAYMENT-REQUIRED";
 var SIWX_HEADER = "SIGN-IN-WITH-X";
 var SIWX_EXTENSION = "sign-in-with-x";
 var SOLANA_NAMESPACE = "solana:";
+var ED25519_SIGNATURE_BYTES = 64;
 function parseChallenge(paymentRequiredHeader, expectedOrigin) {
   const decoded = decodeHeader(paymentRequiredHeader);
   const extensions = asRecord(decoded.extensions);
@@ -2719,6 +2798,11 @@ Resources:
 ${resources}`;
 }
 function buildPayload(challenge, address, signature) {
+  if (signature.length !== ED25519_SIGNATURE_BYTES) {
+    throw new SiwxChallengeError(
+      `expected a ${ED25519_SIGNATURE_BYTES}-byte ed25519 signature, got ${signature.length} bytes`
+    );
+  }
   const payload = {
     domain: challenge.domain,
     address,
@@ -2821,7 +2905,7 @@ function createAgentresClient(options) {
   const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
   const { address, signMessage } = options;
   async function withSiwx(request) {
-    const url = `${baseUrl}${request.path}`;
+    const url = resolveUrl(baseUrl, request.path);
     const init = requestInit(request);
     const challenged = await fetchImpl(url, init);
     if (challenged.status !== 402) {
@@ -2876,6 +2960,21 @@ function createAgentresClient(options) {
     }
   };
 }
+function resolveUrl(baseUrl, path) {
+  if (!path.startsWith("/") || path.startsWith("//")) {
+    throw new AgentresPathError(
+      `"${path}" is not a path on ${baseUrl} \u2014 it must start with a single "/"`
+    );
+  }
+  const base = new URL(baseUrl);
+  const resolved = new URL(path, base);
+  if (resolved.origin !== base.origin) {
+    throw new AgentresPathError(
+      `"${path}" resolves to ${resolved.origin} but this client talks to ${base.origin} \u2014 refusing to send it`
+    );
+  }
+  return resolved.toString();
+}
 function requestInit(request) {
   const headers = { Accept: "application/json" };
   if (request.body === void 0) {
@@ -2889,7 +2988,16 @@ async function readBody(response) {
   if (!response.ok) {
     throw parseAgentresError(response.status, body);
   }
-  return JSON.parse(body);
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new AgentresError(
+      response.status,
+      "INVALID_JSON",
+      `agentres answered ${response.status} with a body that is not JSON`,
+      response.status >= 500
+    );
+  }
 }
 
 // src/lib/connectors/client.ts
@@ -14019,6 +14127,7 @@ function createDocumentTools({
   APP_PREVIEW_BASELINE_CSS,
   AUDIT_DESIGN_SCHEMA,
   AgentresError,
+  AgentresPathError,
   AnumaJsxError,
   CONNECTOR_ERROR_MARKER,
   CREATE_DOCUMENT_SCHEMA,
@@ -14069,6 +14178,7 @@ function createDocumentTools({
   createChartTool,
   createChatTools,
   createChoiceTool,
+  createConfirmTool,
   createConnectorOfferTool,
   createConnectorTokenGetter,
   createDisplayTool,

package/dist/tools/index.d.mts

@@ -366,6 +366,99 @@ type ChoiceOption = {
  */
 declare function createChoiceTool(options: CreateUIToolsOptions): ToolConfig;
 
+/**
+ * Confirmation interaction tool factory.
+ *
+ * Creates a client-side tool that shows the user exactly what is about to
+ * happen and blocks until they answer. Built for actions that are expensive to
+ * undo — spending money, holding a table against someone's card — where the
+ * model's own belief that the user agreed is not good enough.
+ *
+ * ## What the result is for
+ *
+ * The portal gates the action on this tool's result: it refuses the acting tool
+ * unless a completed confirmation for the same thing is already in the turn. A
+ * bare `{ confirmed: true }` would not survive that, because the model writes
+ * the acting tool's arguments and could equally write a boolean that says the
+ * user agreed. So the result carries **the parameters themselves**, and the
+ * portal compares them against the acting tool's arguments field by field.
+ *
+ * The chain that makes it verifiable:
+ *
+ * 1. The model writes `action` and `parameters` as tool arguments.
+ * 2. The card renders those same values — not a paraphrase of them.
+ * 3. The user answers the card, and the SDK (not the model) builds the result.
+ * 4. The portal compares the result's `parameters` to the acting tool's
+ *    arguments, and refuses on any mismatch.
+ *
+ * A model that wants to book something other than what the user saw has to get
+ * step 4 past a field-by-field comparison, which is why the values are plain
+ * strings: two renderings of the same number must not read as a disagreement.
+ *
+ * ## The three outcomes
+ *
+ * | Outcome | Result |
+ * |---|---|
+ * | The user confirmed | `{ confirmed: true, action, parameters, answeredAt }` |
+ * | The user declined | `{ confirmed: false, action, parameters, answeredAt }` |
+ * | Timed out, cleared, never shown, or a malformed reply | `{ cancelled: true }` |
+ *
+ * A decline is an ordinary answer, not a failure — the model should say so and
+ * move on. Only the third row means nobody answered, and it is the shape every
+ * interactive tool in this module already produces for that case. A reply
+ * whose `confirmed` is not a boolean is not an answer either, so it lands there
+ * too rather than being reported as the user saying no.
+ *
+ * **The card must resolve the interaction for a decline, with
+ * `{ confirmed: false }` — not cancel it.** Cancelling rejects the underlying
+ * promise, which is indistinguishable from a timeout by the time it reaches
+ * here, and a decline would then be reported as nobody having answered.
+ */
+
+/** One field of the action being confirmed, as the card shows it. */
+type ConfirmParameter = {
+    /** Machine-readable key, matched against the acting tool's argument name. */
+    name: string;
+    /** Display label for the field, e.g. "Party size". */
+    label: string;
+    /** The exact value being confirmed. A string, so comparison is unambiguous. */
+    value: string;
+};
+/**
+ * What the tool returns: the user's answer, or `{ cancelled: true }` when
+ * nobody answered.
+ */
+type ConfirmToolResult = {
+    /** True when the user agreed, false when they declined. */
+    confirmed: boolean;
+    /** The action that was confirmed, e.g. `book_restaurant`. */
+    action: string;
+    /** The parameters the card showed, verbatim — what the portal verifies. */
+    parameters: ConfirmParameter[];
+    /** ISO-8601 timestamp of the answer, for a server-side freshness window. */
+    answeredAt: string;
+} | {
+    /** Timed out, cleared, never shown, or the card replied without a decision. */
+    cancelled: true;
+};
+/**
+ * Create a prompt_user_confirm tool that asks the user to approve an action.
+ *
+ * When the LLM calls this tool, it shows a summary card of exactly what is
+ * about to happen. Execution blocks until the user confirms or declines.
+ *
+ * @example
+ * ```typescript
+ * import { createConfirmTool } from "@anuma/sdk/tools";
+ *
+ * const confirmTool = createConfirmTool({
+ *   getContext: () => uiInteraction,
+ *   getLastMessageId: () => lastMsgId,
+ * });
+ * ```
+ */
+declare function createConfirmTool(options: CreateUIToolsOptions): ToolConfig;
+
 /**
  * Form interaction tool factory.
  *
@@ -830,6 +923,8 @@ declare function createAgentresClient(options: AgentresClientOptions): AgentresC
  *
  * The SIWX errors are separate because they are ours, not the provider's: they
  * mean the challenge never became a usable proof, so no request was authorized.
+ * {@link AgentresPathError} is ours too, and earlier still — it means the call
+ * was refused before it was ever made.
  *
  * @module lib/connectors/agentres/errors
  */
@@ -863,6 +958,16 @@ declare class AgentresError extends Error {
 declare class SiwxUnsupportedError extends Error {
     constructor(message: string);
 }
+/**
+ * The request path would have sent the call somewhere other than agentres.
+ *
+ * Thrown before the first fetch, because the first fetch is already the damage:
+ * it carries the caller's headers to whatever host the path resolved to, and
+ * the 402 that comes back is the challenge we are about to sign.
+ */
+declare class AgentresPathError extends Error {
+    constructor(message: string);
+}
 /** The challenge could not be read, or is missing something the proof needs. */
 declare class SiwxChallengeError extends Error {
     /** The underlying decode failure, when there was one. */
@@ -3015,4 +3120,4 @@ declare const DEFAULT_MAX_DOCUMENT_CONVERSATIONS = 1000;
  */
 declare function createDocumentTools({ getConversationId, storage, logError, displayDocument, maxConversations, }: CreateDocumentToolsOptions): ToolConfig[];
 
-export { ADD_SLIDE_SCHEMA, APP_BUILDER_PROMPT, APP_COMPLETE_CONNECT_ACK_TYPE, APP_COMPLETE_CONNECT_TYPE, APP_COMPLETE_DEFAULT_TIMEOUT_MS, APP_COMPLETE_IFRAME_SHIM_SCRIPT, APP_COMPLETE_REQUEST_TYPE, APP_COMPLETE_RESPONSE_TYPE, APP_COMPLETE_STUB_SCRIPT, APP_FILE_TOOL_NAMES, APP_PREVIEW_BASELINE_CSS, AUDIT_DESIGN_SCHEMA, type AgentresAccount, type AgentresClient, type AgentresClientOptions, AgentresError, type AgentresErrorCode, type AgentresLinkStatus, type AgentresLinkStep, type AnchorMatch, type AnumaChild, AnumaJsxError, type AnumaNode, type AppCompleteBridge, type AppCompleteBridgeOptions, type AppFileRecord, type AppFileStorage, type AttrValue, type AuditIssue, type AuditIssueType, type AuditResult, type AuditSeverity, type AuditTokens, type BuildSlideSystemPromptOptions, CONNECTOR_ERROR_MARKER, CREATE_DOCUMENT_SCHEMA, CREATE_FILE_SCHEMA, CRITIQUE_DESIGN_SCHEMA, type CalendarEvent, type ChartDataPoint, type ChoiceOption, type ConnectorErrorCode, type ConnectorMintError, type ConnectorMintResult, type ConnectorTokenGetterOpts, type ConnectorTokenSource, type CreateAppGenerationToolsOptions, type CreateDocumentToolsOptions, type CreateEventArgs, type CreateFileArgs, type CreateSlideToolsOptions, type CreateUIToolsOptions, type CreateWeatherToolOptions, DEFAULT_DESIGN_CRITIQUE_RUBRIC, DEFAULT_DOCUMENT_ID, DEFAULT_MAX_CONVERSATIONS, DEFAULT_MAX_DOCUMENT_CONVERSATIONS, DELETE_FILE_SCHEMA, DOCUMENT_BUILDER_PROMPT, DOCUMENT_TOOL_NAMES, type DisplayChartResult, type DisplayConnectorResult, type DisplayPhoneCallOfferResult, type DisplayToolConfig, type DisplayToolMigrations, type DisplayWeatherResult, type DocAttrValue, type DocChild, DocDslError, type DocNode, type DriveFile, type DropboxRequestAccess, type DropboxTokenGetter, type ExportAppOptions, FONT_LIBRARY, FONT_PRESETS, type FileChangeEvent, type FileSnippet, type FontCategory, type FontPreset, type FontSpec, type ForecastDay, type FormField, type FormFieldOption, type FormFieldType, type GetFileContentArgs, type GmailGetMessageArgs, type GmailMessageDetail, type GmailMessageSummary, type GmailRequestAccess, type GmailSearchArgs, type GmailSendMessageArgs, type GmailTokenGetter, type InteractiveToolConfig, type KnownTag, LAYOUT_MODES, LIST_FILES_SCHEMA, type LayoutMode, type LegacyDeckJson, type ListEventsArgs, type ListRecentFilesArgs, MapFileStorage, type NotionCreatePagesArgs, type NotionFetchArgs, type NotionMovePagesArgs, type NotionSearchArgs, type NotionUpdatePageArgs, PATCH_DOCUMENT_SCHEMA, PATCH_FILE_SCHEMA, PATCH_SLIDES_SCHEMA, PLAN_DECK_SCHEMA, type PatchFailure, type PatchFailureReason, type PdfTag, READ_DOCUMENT_SCHEMA, READ_FILE_SCHEMA, READ_SLIDES_SCHEMA, RUNTIME_ERROR_OVERLAY_SCRIPT, SLIDES_FILE_PATH, SLIDE_CANVAS_HEIGHT, SLIDE_CANVAS_WIDTH, type SearchFilesArgs, SiwxChallengeError, SiwxUnsupportedError, type SlackGetChannelHistoryArgs, type SlackGetThreadRepliesArgs, type SlackListChannelsArgs, type SlackListDmsArgs, type SlackListUsersArgs, type SlackPostMessageArgs, type SlackProxyCaller, type SlackSearchMessagesArgs, type SlideToolSet, type SolanaSignMessageFn, THEME_ATTRS, type ThemeAttr, type ToolConfig, type ToolExecutionErrorType, type ToolExecutionResult, type UIInteractionContext, type UpdateEventArgs, type UpdateFileArgs, VERIFY_APP_SCHEMA, type VerifyAppResult, type XGetMeArgs, type XGetMyPostsArgs, type XProxyCaller, applyPatches, auditDesign, buildAppFileManifest, buildAppSystemPrompt, buildConnectorErrorResult, buildDocumentSystemPrompt, buildFontsUrl, buildSlideSystemPrompt, callNotionMCPTool, connectorMintErrorToToolResult, convertLegacyDeckJson, createAgentresClient, createAppCompleteBridge, createAppGenerationTools, createChartTool, createChatTools, createChoiceTool, createConnectorOfferTool, createConnectorTokenGetter, createDisplayTool, createDocumentTools, createDriveTools, createDropboxTools, createFormTool, createGitHubTools, createGmailTools, createGoogleCalendarCreateEventTool, createGoogleCalendarTool, createGoogleCalendarUpdateEventTool, createGoogleDriveCreateFileTool, createGoogleDriveGetContentTool, createGoogleDriveListRecentTool, createGoogleDriveSearchTool, createGoogleDriveUpdateFileTool, createInteractiveTool, createNotionCreateCommentTool, createNotionCreateDatabaseTool, createNotionCreatePagesTool, createNotionDuplicatePageTool, createNotionFetchTool, createNotionGetCommentsTool, createNotionGetTeamsTool, createNotionGetUsersTool, createNotionMovePagesTool, createNotionSearchTool, createNotionTools, createNotionUpdateDataSourceTool, createNotionUpdatePageTool, createPhoneCallOfferTool, createSlackTools, createSlideTools, createWeatherTool, createXTools, documentPath, exportAppToHtml, findById, findParentOfId, getFontByName, getId, getMCPEndpoints, getNumberAttr, getStringAttr, insertAfterId, insertChild, installAppCompleteIframeShim, isAnumaTag, isHtmlTag, isKnownFont, isLegacyDeckJson, isPdfTag, migrateDisplayResult, normalizePath, parseDocumentDsl, parseJsx, pdfStyleKeys, pdfTags, removeById, replaceById, serializeJsx, truncateContent, updateAttrs, walk };
+export { ADD_SLIDE_SCHEMA, APP_BUILDER_PROMPT, APP_COMPLETE_CONNECT_ACK_TYPE, APP_COMPLETE_CONNECT_TYPE, APP_COMPLETE_DEFAULT_TIMEOUT_MS, APP_COMPLETE_IFRAME_SHIM_SCRIPT, APP_COMPLETE_REQUEST_TYPE, APP_COMPLETE_RESPONSE_TYPE, APP_COMPLETE_STUB_SCRIPT, APP_FILE_TOOL_NAMES, APP_PREVIEW_BASELINE_CSS, AUDIT_DESIGN_SCHEMA, type AgentresAccount, type AgentresClient, type AgentresClientOptions, AgentresError, type AgentresErrorCode, type AgentresLinkStatus, type AgentresLinkStep, AgentresPathError, type AnchorMatch, type AnumaChild, AnumaJsxError, type AnumaNode, type AppCompleteBridge, type AppCompleteBridgeOptions, type AppFileRecord, type AppFileStorage, type AttrValue, type AuditIssue, type AuditIssueType, type AuditResult, type AuditSeverity, type AuditTokens, type BuildSlideSystemPromptOptions, CONNECTOR_ERROR_MARKER, CREATE_DOCUMENT_SCHEMA, CREATE_FILE_SCHEMA, CRITIQUE_DESIGN_SCHEMA, type CalendarEvent, type ChartDataPoint, type ChoiceOption, type ConfirmParameter, type ConfirmToolResult, type ConnectorErrorCode, type ConnectorMintError, type ConnectorMintResult, type ConnectorTokenGetterOpts, type ConnectorTokenSource, type CreateAppGenerationToolsOptions, type CreateDocumentToolsOptions, type CreateEventArgs, type CreateFileArgs, type CreateSlideToolsOptions, type CreateUIToolsOptions, type CreateWeatherToolOptions, DEFAULT_DESIGN_CRITIQUE_RUBRIC, DEFAULT_DOCUMENT_ID, DEFAULT_MAX_CONVERSATIONS, DEFAULT_MAX_DOCUMENT_CONVERSATIONS, DELETE_FILE_SCHEMA, DOCUMENT_BUILDER_PROMPT, DOCUMENT_TOOL_NAMES, type DisplayChartResult, type DisplayConnectorResult, type DisplayPhoneCallOfferResult, type DisplayToolConfig, type DisplayToolMigrations, type DisplayWeatherResult, type DocAttrValue, type DocChild, DocDslError, type DocNode, type DriveFile, type DropboxRequestAccess, type DropboxTokenGetter, type ExportAppOptions, FONT_LIBRARY, FONT_PRESETS, type FileChangeEvent, type FileSnippet, type FontCategory, type FontPreset, type FontSpec, type ForecastDay, type FormField, type FormFieldOption, type FormFieldType, type GetFileContentArgs, type GmailGetMessageArgs, type GmailMessageDetail, type GmailMessageSummary, type GmailRequestAccess, type GmailSearchArgs, type GmailSendMessageArgs, type GmailTokenGetter, type InteractiveToolConfig, type KnownTag, LAYOUT_MODES, LIST_FILES_SCHEMA, type LayoutMode, type LegacyDeckJson, type ListEventsArgs, type ListRecentFilesArgs, MapFileStorage, type NotionCreatePagesArgs, type NotionFetchArgs, type NotionMovePagesArgs, type NotionSearchArgs, type NotionUpdatePageArgs, PATCH_DOCUMENT_SCHEMA, PATCH_FILE_SCHEMA, PATCH_SLIDES_SCHEMA, PLAN_DECK_SCHEMA, type PatchFailure, type PatchFailureReason, type PdfTag, READ_DOCUMENT_SCHEMA, READ_FILE_SCHEMA, READ_SLIDES_SCHEMA, RUNTIME_ERROR_OVERLAY_SCRIPT, SLIDES_FILE_PATH, SLIDE_CANVAS_HEIGHT, SLIDE_CANVAS_WIDTH, type SearchFilesArgs, SiwxChallengeError, SiwxUnsupportedError, type SlackGetChannelHistoryArgs, type SlackGetThreadRepliesArgs, type SlackListChannelsArgs, type SlackListDmsArgs, type SlackListUsersArgs, type SlackPostMessageArgs, type SlackProxyCaller, type SlackSearchMessagesArgs, type SlideToolSet, type SolanaSignMessageFn, THEME_ATTRS, type ThemeAttr, type ToolConfig, type ToolExecutionErrorType, type ToolExecutionResult, type UIInteractionContext, type UpdateEventArgs, type UpdateFileArgs, VERIFY_APP_SCHEMA, type VerifyAppResult, type XGetMeArgs, type XGetMyPostsArgs, type XProxyCaller, applyPatches, auditDesign, buildAppFileManifest, buildAppSystemPrompt, buildConnectorErrorResult, buildDocumentSystemPrompt, buildFontsUrl, buildSlideSystemPrompt, callNotionMCPTool, connectorMintErrorToToolResult, convertLegacyDeckJson, createAgentresClient, createAppCompleteBridge, createAppGenerationTools, createChartTool, createChatTools, createChoiceTool, createConfirmTool, createConnectorOfferTool, createConnectorTokenGetter, createDisplayTool, createDocumentTools, createDriveTools, createDropboxTools, createFormTool, createGitHubTools, createGmailTools, createGoogleCalendarCreateEventTool, createGoogleCalendarTool, createGoogleCalendarUpdateEventTool, createGoogleDriveCreateFileTool, createGoogleDriveGetContentTool, createGoogleDriveListRecentTool, createGoogleDriveSearchTool, createGoogleDriveUpdateFileTool, createInteractiveTool, createNotionCreateCommentTool, createNotionCreateDatabaseTool, createNotionCreatePagesTool, createNotionDuplicatePageTool, createNotionFetchTool, createNotionGetCommentsTool, createNotionGetTeamsTool, createNotionGetUsersTool, createNotionMovePagesTool, createNotionSearchTool, createNotionTools, createNotionUpdateDataSourceTool, createNotionUpdatePageTool, createPhoneCallOfferTool, createSlackTools, createSlideTools, createWeatherTool, createXTools, documentPath, exportAppToHtml, findById, findParentOfId, getFontByName, getId, getMCPEndpoints, getNumberAttr, getStringAttr, insertAfterId, insertChild, installAppCompleteIframeShim, isAnumaTag, isHtmlTag, isKnownFont, isLegacyDeckJson, isPdfTag, migrateDisplayResult, normalizePath, parseDocumentDsl, parseJsx, pdfStyleKeys, pdfTags, removeById, replaceById, serializeJsx, truncateContent, updateAttrs, walk };

package/dist/tools/index.d.ts

@@ -366,6 +366,99 @@ type ChoiceOption = {
  */
 declare function createChoiceTool(options: CreateUIToolsOptions): ToolConfig;
 
+/**
+ * Confirmation interaction tool factory.
+ *
+ * Creates a client-side tool that shows the user exactly what is about to
+ * happen and blocks until they answer. Built for actions that are expensive to
+ * undo — spending money, holding a table against someone's card — where the
+ * model's own belief that the user agreed is not good enough.
+ *
+ * ## What the result is for
+ *
+ * The portal gates the action on this tool's result: it refuses the acting tool
+ * unless a completed confirmation for the same thing is already in the turn. A
+ * bare `{ confirmed: true }` would not survive that, because the model writes
+ * the acting tool's arguments and could equally write a boolean that says the
+ * user agreed. So the result carries **the parameters themselves**, and the
+ * portal compares them against the acting tool's arguments field by field.
+ *
+ * The chain that makes it verifiable:
+ *
+ * 1. The model writes `action` and `parameters` as tool arguments.
+ * 2. The card renders those same values — not a paraphrase of them.
+ * 3. The user answers the card, and the SDK (not the model) builds the result.
+ * 4. The portal compares the result's `parameters` to the acting tool's
+ *    arguments, and refuses on any mismatch.
+ *
+ * A model that wants to book something other than what the user saw has to get
+ * step 4 past a field-by-field comparison, which is why the values are plain
+ * strings: two renderings of the same number must not read as a disagreement.
+ *
+ * ## The three outcomes
+ *
+ * | Outcome | Result |
+ * |---|---|
+ * | The user confirmed | `{ confirmed: true, action, parameters, answeredAt }` |
+ * | The user declined | `{ confirmed: false, action, parameters, answeredAt }` |
+ * | Timed out, cleared, never shown, or a malformed reply | `{ cancelled: true }` |
+ *
+ * A decline is an ordinary answer, not a failure — the model should say so and
+ * move on. Only the third row means nobody answered, and it is the shape every
+ * interactive tool in this module already produces for that case. A reply
+ * whose `confirmed` is not a boolean is not an answer either, so it lands there
+ * too rather than being reported as the user saying no.
+ *
+ * **The card must resolve the interaction for a decline, with
+ * `{ confirmed: false }` — not cancel it.** Cancelling rejects the underlying
+ * promise, which is indistinguishable from a timeout by the time it reaches
+ * here, and a decline would then be reported as nobody having answered.
+ */
+
+/** One field of the action being confirmed, as the card shows it. */
+type ConfirmParameter = {
+    /** Machine-readable key, matched against the acting tool's argument name. */
+    name: string;
+    /** Display label for the field, e.g. "Party size". */
+    label: string;
+    /** The exact value being confirmed. A string, so comparison is unambiguous. */
+    value: string;
+};
+/**
+ * What the tool returns: the user's answer, or `{ cancelled: true }` when
+ * nobody answered.
+ */
+type ConfirmToolResult = {
+    /** True when the user agreed, false when they declined. */
+    confirmed: boolean;
+    /** The action that was confirmed, e.g. `book_restaurant`. */
+    action: string;
+    /** The parameters the card showed, verbatim — what the portal verifies. */
+    parameters: ConfirmParameter[];
+    /** ISO-8601 timestamp of the answer, for a server-side freshness window. */
+    answeredAt: string;
+} | {
+    /** Timed out, cleared, never shown, or the card replied without a decision. */
+    cancelled: true;
+};
+/**
+ * Create a prompt_user_confirm tool that asks the user to approve an action.
+ *
+ * When the LLM calls this tool, it shows a summary card of exactly what is
+ * about to happen. Execution blocks until the user confirms or declines.
+ *
+ * @example
+ * ```typescript
+ * import { createConfirmTool } from "@anuma/sdk/tools";
+ *
+ * const confirmTool = createConfirmTool({
+ *   getContext: () => uiInteraction,
+ *   getLastMessageId: () => lastMsgId,
+ * });
+ * ```
+ */
+declare function createConfirmTool(options: CreateUIToolsOptions): ToolConfig;
+
 /**
  * Form interaction tool factory.
  *
@@ -830,6 +923,8 @@ declare function createAgentresClient(options: AgentresClientOptions): AgentresC
  *
  * The SIWX errors are separate because they are ours, not the provider's: they
  * mean the challenge never became a usable proof, so no request was authorized.
+ * {@link AgentresPathError} is ours too, and earlier still — it means the call
+ * was refused before it was ever made.
  *
  * @module lib/connectors/agentres/errors
  */
@@ -863,6 +958,16 @@ declare class AgentresError extends Error {
 declare class SiwxUnsupportedError extends Error {
     constructor(message: string);
 }
+/**
+ * The request path would have sent the call somewhere other than agentres.
+ *
+ * Thrown before the first fetch, because the first fetch is already the damage:
+ * it carries the caller's headers to whatever host the path resolved to, and
+ * the 402 that comes back is the challenge we are about to sign.
+ */
+declare class AgentresPathError extends Error {
+    constructor(message: string);
+}
 /** The challenge could not be read, or is missing something the proof needs. */
 declare class SiwxChallengeError extends Error {
     /** The underlying decode failure, when there was one. */
@@ -3015,4 +3120,4 @@ declare const DEFAULT_MAX_DOCUMENT_CONVERSATIONS = 1000;
  */
 declare function createDocumentTools({ getConversationId, storage, logError, displayDocument, maxConversations, }: CreateDocumentToolsOptions): ToolConfig[];
 
-export { ADD_SLIDE_SCHEMA, APP_BUILDER_PROMPT, APP_COMPLETE_CONNECT_ACK_TYPE, APP_COMPLETE_CONNECT_TYPE, APP_COMPLETE_DEFAULT_TIMEOUT_MS, APP_COMPLETE_IFRAME_SHIM_SCRIPT, APP_COMPLETE_REQUEST_TYPE, APP_COMPLETE_RESPONSE_TYPE, APP_COMPLETE_STUB_SCRIPT, APP_FILE_TOOL_NAMES, APP_PREVIEW_BASELINE_CSS, AUDIT_DESIGN_SCHEMA, type AgentresAccount, type AgentresClient, type AgentresClientOptions, AgentresError, type AgentresErrorCode, type AgentresLinkStatus, type AgentresLinkStep, type AnchorMatch, type AnumaChild, AnumaJsxError, type AnumaNode, type AppCompleteBridge, type AppCompleteBridgeOptions, type AppFileRecord, type AppFileStorage, type AttrValue, type AuditIssue, type AuditIssueType, type AuditResult, type AuditSeverity, type AuditTokens, type BuildSlideSystemPromptOptions, CONNECTOR_ERROR_MARKER, CREATE_DOCUMENT_SCHEMA, CREATE_FILE_SCHEMA, CRITIQUE_DESIGN_SCHEMA, type CalendarEvent, type ChartDataPoint, type ChoiceOption, type ConnectorErrorCode, type ConnectorMintError, type ConnectorMintResult, type ConnectorTokenGetterOpts, type ConnectorTokenSource, type CreateAppGenerationToolsOptions, type CreateDocumentToolsOptions, type CreateEventArgs, type CreateFileArgs, type CreateSlideToolsOptions, type CreateUIToolsOptions, type CreateWeatherToolOptions, DEFAULT_DESIGN_CRITIQUE_RUBRIC, DEFAULT_DOCUMENT_ID, DEFAULT_MAX_CONVERSATIONS, DEFAULT_MAX_DOCUMENT_CONVERSATIONS, DELETE_FILE_SCHEMA, DOCUMENT_BUILDER_PROMPT, DOCUMENT_TOOL_NAMES, type DisplayChartResult, type DisplayConnectorResult, type DisplayPhoneCallOfferResult, type DisplayToolConfig, type DisplayToolMigrations, type DisplayWeatherResult, type DocAttrValue, type DocChild, DocDslError, type DocNode, type DriveFile, type DropboxRequestAccess, type DropboxTokenGetter, type ExportAppOptions, FONT_LIBRARY, FONT_PRESETS, type FileChangeEvent, type FileSnippet, type FontCategory, type FontPreset, type FontSpec, type ForecastDay, type FormField, type FormFieldOption, type FormFieldType, type GetFileContentArgs, type GmailGetMessageArgs, type GmailMessageDetail, type GmailMessageSummary, type GmailRequestAccess, type GmailSearchArgs, type GmailSendMessageArgs, type GmailTokenGetter, type InteractiveToolConfig, type KnownTag, LAYOUT_MODES, LIST_FILES_SCHEMA, type LayoutMode, type LegacyDeckJson, type ListEventsArgs, type ListRecentFilesArgs, MapFileStorage, type NotionCreatePagesArgs, type NotionFetchArgs, type NotionMovePagesArgs, type NotionSearchArgs, type NotionUpdatePageArgs, PATCH_DOCUMENT_SCHEMA, PATCH_FILE_SCHEMA, PATCH_SLIDES_SCHEMA, PLAN_DECK_SCHEMA, type PatchFailure, type PatchFailureReason, type PdfTag, READ_DOCUMENT_SCHEMA, READ_FILE_SCHEMA, READ_SLIDES_SCHEMA, RUNTIME_ERROR_OVERLAY_SCRIPT, SLIDES_FILE_PATH, SLIDE_CANVAS_HEIGHT, SLIDE_CANVAS_WIDTH, type SearchFilesArgs, SiwxChallengeError, SiwxUnsupportedError, type SlackGetChannelHistoryArgs, type SlackGetThreadRepliesArgs, type SlackListChannelsArgs, type SlackListDmsArgs, type SlackListUsersArgs, type SlackPostMessageArgs, type SlackProxyCaller, type SlackSearchMessagesArgs, type SlideToolSet, type SolanaSignMessageFn, THEME_ATTRS, type ThemeAttr, type ToolConfig, type ToolExecutionErrorType, type ToolExecutionResult, type UIInteractionContext, type UpdateEventArgs, type UpdateFileArgs, VERIFY_APP_SCHEMA, type VerifyAppResult, type XGetMeArgs, type XGetMyPostsArgs, type XProxyCaller, applyPatches, auditDesign, buildAppFileManifest, buildAppSystemPrompt, buildConnectorErrorResult, buildDocumentSystemPrompt, buildFontsUrl, buildSlideSystemPrompt, callNotionMCPTool, connectorMintErrorToToolResult, convertLegacyDeckJson, createAgentresClient, createAppCompleteBridge, createAppGenerationTools, createChartTool, createChatTools, createChoiceTool, createConnectorOfferTool, createConnectorTokenGetter, createDisplayTool, createDocumentTools, createDriveTools, createDropboxTools, createFormTool, createGitHubTools, createGmailTools, createGoogleCalendarCreateEventTool, createGoogleCalendarTool, createGoogleCalendarUpdateEventTool, createGoogleDriveCreateFileTool, createGoogleDriveGetContentTool, createGoogleDriveListRecentTool, createGoogleDriveSearchTool, createGoogleDriveUpdateFileTool, createInteractiveTool, createNotionCreateCommentTool, createNotionCreateDatabaseTool, createNotionCreatePagesTool, createNotionDuplicatePageTool, createNotionFetchTool, createNotionGetCommentsTool, createNotionGetTeamsTool, createNotionGetUsersTool, createNotionMovePagesTool, createNotionSearchTool, createNotionTools, createNotionUpdateDataSourceTool, createNotionUpdatePageTool, createPhoneCallOfferTool, createSlackTools, createSlideTools, createWeatherTool, createXTools, documentPath, exportAppToHtml, findById, findParentOfId, getFontByName, getId, getMCPEndpoints, getNumberAttr, getStringAttr, insertAfterId, insertChild, installAppCompleteIframeShim, isAnumaTag, isHtmlTag, isKnownFont, isLegacyDeckJson, isPdfTag, migrateDisplayResult, normalizePath, parseDocumentDsl, parseJsx, pdfStyleKeys, pdfTags, removeById, replaceById, serializeJsx, truncateContent, updateAttrs, walk };
+export { ADD_SLIDE_SCHEMA, APP_BUILDER_PROMPT, APP_COMPLETE_CONNECT_ACK_TYPE, APP_COMPLETE_CONNECT_TYPE, APP_COMPLETE_DEFAULT_TIMEOUT_MS, APP_COMPLETE_IFRAME_SHIM_SCRIPT, APP_COMPLETE_REQUEST_TYPE, APP_COMPLETE_RESPONSE_TYPE, APP_COMPLETE_STUB_SCRIPT, APP_FILE_TOOL_NAMES, APP_PREVIEW_BASELINE_CSS, AUDIT_DESIGN_SCHEMA, type AgentresAccount, type AgentresClient, type AgentresClientOptions, AgentresError, type AgentresErrorCode, type AgentresLinkStatus, type AgentresLinkStep, AgentresPathError, type AnchorMatch, type AnumaChild, AnumaJsxError, type AnumaNode, type AppCompleteBridge, type AppCompleteBridgeOptions, type AppFileRecord, type AppFileStorage, type AttrValue, type AuditIssue, type AuditIssueType, type AuditResult, type AuditSeverity, type AuditTokens, type BuildSlideSystemPromptOptions, CONNECTOR_ERROR_MARKER, CREATE_DOCUMENT_SCHEMA, CREATE_FILE_SCHEMA, CRITIQUE_DESIGN_SCHEMA, type CalendarEvent, type ChartDataPoint, type ChoiceOption, type ConfirmParameter, type ConfirmToolResult, type ConnectorErrorCode, type ConnectorMintError, type ConnectorMintResult, type ConnectorTokenGetterOpts, type ConnectorTokenSource, type CreateAppGenerationToolsOptions, type CreateDocumentToolsOptions, type CreateEventArgs, type CreateFileArgs, type CreateSlideToolsOptions, type CreateUIToolsOptions, type CreateWeatherToolOptions, DEFAULT_DESIGN_CRITIQUE_RUBRIC, DEFAULT_DOCUMENT_ID, DEFAULT_MAX_CONVERSATIONS, DEFAULT_MAX_DOCUMENT_CONVERSATIONS, DELETE_FILE_SCHEMA, DOCUMENT_BUILDER_PROMPT, DOCUMENT_TOOL_NAMES, type DisplayChartResult, type DisplayConnectorResult, type DisplayPhoneCallOfferResult, type DisplayToolConfig, type DisplayToolMigrations, type DisplayWeatherResult, type DocAttrValue, type DocChild, DocDslError, type DocNode, type DriveFile, type DropboxRequestAccess, type DropboxTokenGetter, type ExportAppOptions, FONT_LIBRARY, FONT_PRESETS, type FileChangeEvent, type FileSnippet, type FontCategory, type FontPreset, type FontSpec, type ForecastDay, type FormField, type FormFieldOption, type FormFieldType, type GetFileContentArgs, type GmailGetMessageArgs, type GmailMessageDetail, type GmailMessageSummary, type GmailRequestAccess, type GmailSearchArgs, type GmailSendMessageArgs, type GmailTokenGetter, type InteractiveToolConfig, type KnownTag, LAYOUT_MODES, LIST_FILES_SCHEMA, type LayoutMode, type LegacyDeckJson, type ListEventsArgs, type ListRecentFilesArgs, MapFileStorage, type NotionCreatePagesArgs, type NotionFetchArgs, type NotionMovePagesArgs, type NotionSearchArgs, type NotionUpdatePageArgs, PATCH_DOCUMENT_SCHEMA, PATCH_FILE_SCHEMA, PATCH_SLIDES_SCHEMA, PLAN_DECK_SCHEMA, type PatchFailure, type PatchFailureReason, type PdfTag, READ_DOCUMENT_SCHEMA, READ_FILE_SCHEMA, READ_SLIDES_SCHEMA, RUNTIME_ERROR_OVERLAY_SCRIPT, SLIDES_FILE_PATH, SLIDE_CANVAS_HEIGHT, SLIDE_CANVAS_WIDTH, type SearchFilesArgs, SiwxChallengeError, SiwxUnsupportedError, type SlackGetChannelHistoryArgs, type SlackGetThreadRepliesArgs, type SlackListChannelsArgs, type SlackListDmsArgs, type SlackListUsersArgs, type SlackPostMessageArgs, type SlackProxyCaller, type SlackSearchMessagesArgs, type SlideToolSet, type SolanaSignMessageFn, THEME_ATTRS, type ThemeAttr, type ToolConfig, type ToolExecutionErrorType, type ToolExecutionResult, type UIInteractionContext, type UpdateEventArgs, type UpdateFileArgs, VERIFY_APP_SCHEMA, type VerifyAppResult, type XGetMeArgs, type XGetMyPostsArgs, type XProxyCaller, applyPatches, auditDesign, buildAppFileManifest, buildAppSystemPrompt, buildConnectorErrorResult, buildDocumentSystemPrompt, buildFontsUrl, buildSlideSystemPrompt, callNotionMCPTool, connectorMintErrorToToolResult, convertLegacyDeckJson, createAgentresClient, createAppCompleteBridge, createAppGenerationTools, createChartTool, createChatTools, createChoiceTool, createConfirmTool, createConnectorOfferTool, createConnectorTokenGetter, createDisplayTool, createDocumentTools, createDriveTools, createDropboxTools, createFormTool, createGitHubTools, createGmailTools, createGoogleCalendarCreateEventTool, createGoogleCalendarTool, createGoogleCalendarUpdateEventTool, createGoogleDriveCreateFileTool, createGoogleDriveGetContentTool, createGoogleDriveListRecentTool, createGoogleDriveSearchTool, createGoogleDriveUpdateFileTool, createInteractiveTool, createNotionCreateCommentTool, createNotionCreateDatabaseTool, createNotionCreatePagesTool, createNotionDuplicatePageTool, createNotionFetchTool, createNotionGetCommentsTool, createNotionGetTeamsTool, createNotionGetUsersTool, createNotionMovePagesTool, createNotionSearchTool, createNotionTools, createNotionUpdateDataSourceTool, createNotionUpdatePageTool, createPhoneCallOfferTool, createSlackTools, createSlideTools, createWeatherTool, createXTools, documentPath, exportAppToHtml, findById, findParentOfId, getFontByName, getId, getMCPEndpoints, getNumberAttr, getStringAttr, insertAfterId, insertChild, installAppCompleteIframeShim, isAnumaTag, isHtmlTag, isKnownFont, isLegacyDeckJson, isPdfTag, migrateDisplayResult, normalizePath, parseDocumentDsl, parseJsx, pdfStyleKeys, pdfTags, removeById, replaceById, serializeJsx, truncateContent, updateAttrs, walk };

package/dist/tools/index.mjs

@@ -680,6 +680,76 @@ function createChoiceTool(options) {
   });
 }
 
+// src/tools/confirm.ts
+function createConfirmTool(options) {
+  return createInteractiveTool(options, {
+    name: "prompt_user_confirm",
+    description: "Ask the user to approve a specific action before it happens. Use before anything that spends money or is hard to undo, such as booking a restaurant table or placing an order. List every parameter of the action, with the exact values you are about to use \u2014 the user approves what this card shows, and nothing else. Returns whether they confirmed. Do not use for ordinary yes/no questions; use prompt_user_choice for those.",
+    parameters: {
+      type: "object",
+      properties: {
+        title: {
+          type: "string",
+          description: "Short heading naming the action, e.g. 'Confirm your reservation'"
+        },
+        description: {
+          type: "string",
+          description: "Optional extra context, e.g. the cancellation policy"
+        },
+        action: {
+          type: "string",
+          description: "Machine-readable id of the action being confirmed, matching the tool that will carry it out, e.g. 'book_restaurant'"
+        },
+        parameters: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              name: {
+                type: "string",
+                description: "Argument name of the acting tool, e.g. 'party_size'"
+              },
+              label: {
+                type: "string",
+                description: "Display label shown to the user, e.g. 'Party size'"
+              },
+              value: {
+                type: "string",
+                description: "The exact value you will use, as a string. Not a paraphrase \u2014 this is what the user is agreeing to."
+              }
+            },
+            required: ["name", "label", "value"]
+          },
+          description: "Every parameter of the action, with the exact values. The user sees these and nothing else."
+        }
+      },
+      required: ["title", "action", "parameters"]
+    },
+    interactionType: "confirm",
+    validate: (args) => {
+      const { title, action, parameters } = args;
+      if (typeof title !== "string" || !title) return false;
+      if (typeof action !== "string" || !action) return false;
+      if (!Array.isArray(parameters) || parameters.length === 0) return false;
+      return parameters.every((parameter) => {
+        return typeof parameter?.name === "string" && !!parameter.name && typeof parameter.label === "string" && !!parameter.label && typeof parameter.value === "string";
+      });
+    },
+    mapResult: (result, args) => {
+      if (typeof result.confirmed !== "boolean") return { cancelled: true };
+      return {
+        confirmed: result.confirmed,
+        // From the arguments rather than from the card's reply. The card was
+        // handed these to render, so echoing them back would only create a
+        // second copy that could disagree with what was on screen.
+        action: args.action,
+        parameters: args.parameters,
+        answeredAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  });
+}
+
 // src/tools/form.ts
 var VALID_FIELD_TYPES = [
   "text",
@@ -2418,6 +2488,12 @@ var SiwxUnsupportedError = class extends Error {
     this.name = "SiwxUnsupportedError";
   }
 };
+var AgentresPathError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AgentresPathError";
+  }
+};
 var SiwxChallengeError = class extends Error {
   constructor(message, options) {
     super(message);
@@ -2495,6 +2571,7 @@ var PAYMENT_REQUIRED_HEADER = "PAYMENT-REQUIRED";
 var SIWX_HEADER = "SIGN-IN-WITH-X";
 var SIWX_EXTENSION = "sign-in-with-x";
 var SOLANA_NAMESPACE = "solana:";
+var ED25519_SIGNATURE_BYTES = 64;
 function parseChallenge(paymentRequiredHeader, expectedOrigin) {
   const decoded = decodeHeader(paymentRequiredHeader);
   const extensions = asRecord(decoded.extensions);
@@ -2566,6 +2643,11 @@ Resources:
 ${resources}`;
 }
 function buildPayload(challenge, address, signature) {
+  if (signature.length !== ED25519_SIGNATURE_BYTES) {
+    throw new SiwxChallengeError(
+      `expected a ${ED25519_SIGNATURE_BYTES}-byte ed25519 signature, got ${signature.length} bytes`
+    );
+  }
   const payload = {
     domain: challenge.domain,
     address,
@@ -2668,7 +2750,7 @@ function createAgentresClient(options) {
   const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
   const { address, signMessage } = options;
   async function withSiwx(request) {
-    const url = `${baseUrl}${request.path}`;
+    const url = resolveUrl(baseUrl, request.path);
     const init = requestInit(request);
     const challenged = await fetchImpl(url, init);
     if (challenged.status !== 402) {
@@ -2723,6 +2805,21 @@ function createAgentresClient(options) {
     }
   };
 }
+function resolveUrl(baseUrl, path) {
+  if (!path.startsWith("/") || path.startsWith("//")) {
+    throw new AgentresPathError(
+      `"${path}" is not a path on ${baseUrl} \u2014 it must start with a single "/"`
+    );
+  }
+  const base = new URL(baseUrl);
+  const resolved = new URL(path, base);
+  if (resolved.origin !== base.origin) {
+    throw new AgentresPathError(
+      `"${path}" resolves to ${resolved.origin} but this client talks to ${base.origin} \u2014 refusing to send it`
+    );
+  }
+  return resolved.toString();
+}
 function requestInit(request) {
   const headers = { Accept: "application/json" };
   if (request.body === void 0) {
@@ -2736,7 +2833,16 @@ async function readBody(response) {
   if (!response.ok) {
     throw parseAgentresError(response.status, body);
   }
-  return JSON.parse(body);
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new AgentresError(
+      response.status,
+      "INVALID_JSON",
+      `agentres answered ${response.status} with a body that is not JSON`,
+      response.status >= 500
+    );
+  }
 }
 
 // src/lib/connectors/client.ts
@@ -13865,6 +13971,7 @@ export {
   APP_PREVIEW_BASELINE_CSS,
   AUDIT_DESIGN_SCHEMA,
   AgentresError,
+  AgentresPathError,
   AnumaJsxError,
   CONNECTOR_ERROR_MARKER,
   CREATE_DOCUMENT_SCHEMA,
@@ -13915,6 +14022,7 @@ export {
   createChartTool,
   createChatTools,
   createChoiceTool,
+  createConfirmTool,
   createConnectorOfferTool,
   createConnectorTokenGetter,
   createDisplayTool,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anuma/sdk",
-  "version": "6.24.0",
+  "version": "6.25.0",
   "description": "",
   "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",