@anuma/sdk 6.24.1 → 6.25.1

package/dist/tools/index.mjs

@@ -680,6 +680,76 @@ function createChoiceTool(options) {
   });
 }
 
+// src/tools/confirm.ts
+function createConfirmTool(options) {
+  return createInteractiveTool(options, {
+    name: "prompt_user_confirm",
+    description: "Ask the user to approve a specific action before it happens. Use before anything that spends money or is hard to undo, such as booking a restaurant table or placing an order. List every parameter of the action, with the exact values you are about to use \u2014 the user approves what this card shows, and nothing else. Returns whether they confirmed. Do not use for ordinary yes/no questions; use prompt_user_choice for those.",
+    parameters: {
+      type: "object",
+      properties: {
+        title: {
+          type: "string",
+          description: "Short heading naming the action, e.g. 'Confirm your reservation'"
+        },
+        description: {
+          type: "string",
+          description: "Optional extra context, e.g. the cancellation policy"
+        },
+        action: {
+          type: "string",
+          description: "Machine-readable id of the action being confirmed, matching the tool that will carry it out, e.g. 'book_restaurant'"
+        },
+        parameters: {
+          type: "array",
+          items: {
+            type: "object",
+            properties: {
+              name: {
+                type: "string",
+                description: "Argument name of the acting tool, e.g. 'party_size'"
+              },
+              label: {
+                type: "string",
+                description: "Display label shown to the user, e.g. 'Party size'"
+              },
+              value: {
+                type: "string",
+                description: "The exact value you will use, as a string. Not a paraphrase \u2014 this is what the user is agreeing to."
+              }
+            },
+            required: ["name", "label", "value"]
+          },
+          description: "Every parameter of the action, with the exact values. The user sees these and nothing else."
+        }
+      },
+      required: ["title", "action", "parameters"]
+    },
+    interactionType: "confirm",
+    validate: (args) => {
+      const { title, action, parameters } = args;
+      if (typeof title !== "string" || !title) return false;
+      if (typeof action !== "string" || !action) return false;
+      if (!Array.isArray(parameters) || parameters.length === 0) return false;
+      return parameters.every((parameter) => {
+        return typeof parameter?.name === "string" && !!parameter.name && typeof parameter.label === "string" && !!parameter.label && typeof parameter.value === "string";
+      });
+    },
+    mapResult: (result, args) => {
+      if (typeof result.confirmed !== "boolean") return { cancelled: true };
+      return {
+        confirmed: result.confirmed,
+        // From the arguments rather than from the card's reply. The card was
+        // handed these to render, so echoing them back would only create a
+        // second copy that could disagree with what was on screen.
+        action: args.action,
+        parameters: args.parameters,
+        answeredAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+    }
+  });
+}
+
 // src/tools/form.ts
 var VALID_FIELD_TYPES = [
   "text",
@@ -2418,6 +2488,12 @@ var SiwxUnsupportedError = class extends Error {
     this.name = "SiwxUnsupportedError";
   }
 };
+var AgentresPathError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AgentresPathError";
+  }
+};
 var SiwxChallengeError = class extends Error {
   constructor(message, options) {
     super(message);
@@ -2495,6 +2571,7 @@ var PAYMENT_REQUIRED_HEADER = "PAYMENT-REQUIRED";
 var SIWX_HEADER = "SIGN-IN-WITH-X";
 var SIWX_EXTENSION = "sign-in-with-x";
 var SOLANA_NAMESPACE = "solana:";
+var ED25519_SIGNATURE_BYTES = 64;
 function parseChallenge(paymentRequiredHeader, expectedOrigin) {
   const decoded = decodeHeader(paymentRequiredHeader);
   const extensions = asRecord(decoded.extensions);
@@ -2566,6 +2643,11 @@ Resources:
 ${resources}`;
 }
 function buildPayload(challenge, address, signature) {
+  if (signature.length !== ED25519_SIGNATURE_BYTES) {
+    throw new SiwxChallengeError(
+      `expected a ${ED25519_SIGNATURE_BYTES}-byte ed25519 signature, got ${signature.length} bytes`
+    );
+  }
   const payload = {
     domain: challenge.domain,
     address,
@@ -2668,7 +2750,7 @@ function createAgentresClient(options) {
   const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
   const { address, signMessage } = options;
   async function withSiwx(request) {
-    const url = `${baseUrl}${request.path}`;
+    const url = resolveUrl(baseUrl, request.path);
     const init = requestInit(request);
     const challenged = await fetchImpl(url, init);
     if (challenged.status !== 402) {
@@ -2723,6 +2805,21 @@ function createAgentresClient(options) {
     }
   };
 }
+function resolveUrl(baseUrl, path) {
+  if (!path.startsWith("/") || path.startsWith("//")) {
+    throw new AgentresPathError(
+      `"${path}" is not a path on ${baseUrl} \u2014 it must start with a single "/"`
+    );
+  }
+  const base = new URL(baseUrl);
+  const resolved = new URL(path, base);
+  if (resolved.origin !== base.origin) {
+    throw new AgentresPathError(
+      `"${path}" resolves to ${resolved.origin} but this client talks to ${base.origin} \u2014 refusing to send it`
+    );
+  }
+  return resolved.toString();
+}
 function requestInit(request) {
   const headers = { Accept: "application/json" };
   if (request.body === void 0) {
@@ -2736,7 +2833,16 @@ async function readBody(response) {
   if (!response.ok) {
     throw parseAgentresError(response.status, body);
   }
-  return JSON.parse(body);
+  try {
+    return JSON.parse(body);
+  } catch {
+    throw new AgentresError(
+      response.status,
+      "INVALID_JSON",
+      `agentres answered ${response.status} with a body that is not JSON`,
+      response.status >= 500
+    );
+  }
 }
 
 // src/lib/connectors/client.ts
@@ -13865,6 +13971,7 @@ export {
   APP_PREVIEW_BASELINE_CSS,
   AUDIT_DESIGN_SCHEMA,
   AgentresError,
+  AgentresPathError,
   AnumaJsxError,
   CONNECTOR_ERROR_MARKER,
   CREATE_DOCUMENT_SCHEMA,
@@ -13915,6 +14022,7 @@ export {
   createChartTool,
   createChatTools,
   createChoiceTool,
+  createConfirmTool,
   createConnectorOfferTool,
   createConnectorTokenGetter,
   createDisplayTool,

package/dist/tools/selection/index.cjs

@@ -922,11 +922,54 @@ var DEFAULT_API_EMBEDDING_MODEL = "qwen/qwen3-embedding-8b";
 
 // src/lib/memoryEngine/generate.ts
 var EMBED_MAX_ATTEMPTS = 4;
-async function withEmbeddingRetry(call) {
+var DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_EMBEDDING_TOKEN_TIMEOUT_MS = 1e4;
+async function withDeadline(run, ms, what, parent) {
+  if (!(ms > 0) || !Number.isFinite(ms)) return Promise.resolve().then(() => run(parent));
+  const controller = new AbortController();
+  const onParentAbort = () => controller.abort(parent?.reason);
+  let timer;
+  try {
+    if (parent?.aborted) onParentAbort();
+    else parent?.addEventListener("abort", onParentAbort, { once: true });
+    const work = Promise.resolve().then(() => run(controller.signal));
+    work.catch(() => {
+    });
+    const deadline = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        const err = new Error(`${what} timed out after ${ms}ms`);
+        err.name = "TimeoutError";
+        controller.abort(err);
+        reject(err);
+      }, ms);
+    });
+    return await Promise.race([work, deadline]);
+  } finally {
+    clearTimeout(timer);
+    parent?.removeEventListener("abort", onParentAbort);
+  }
+}
+async function resolveAuthHeaders(options, parent) {
+  const { getToken, apiKey } = options;
+  if (apiKey) return { "X-API-Key": apiKey };
+  if (!getToken) throw new Error("Either apiKey or getToken must be provided");
+  const token = await withDeadline(
+    () => getToken(),
+    options.tokenTimeoutMs ?? DEFAULT_EMBEDDING_TOKEN_TIMEOUT_MS,
+    "embedding auth token read",
+    parent
+  );
+  if (!token) {
+    throw new Error("No token available for embedding generation");
+  }
+  return { Authorization: `Bearer ${token}` };
+}
+async function withEmbeddingRetry(call, stop) {
   let last;
   let lastThrown;
   let threw = false;
   for (let attempt = 1; attempt <= EMBED_MAX_ATTEMPTS; attempt++) {
+    if (stop?.aborted) throw stop.reason;
     try {
       threw = false;
       last = await call();
@@ -961,34 +1004,36 @@ function embeddingErrorFrom(response) {
   return new EmbeddingHttpError(message, response.response?.status);
 }
 async function generateEmbedding(text, options) {
-  const { baseUrl = BASE_URL, getToken, apiKey, model, cache } = options;
+  const total = options.totalTimeoutMs;
+  if (total === void 0) return embedOne(text, options, void 0);
+  return withDeadline((signal) => embedOne(text, options, signal), total, "embedding");
+}
+async function embedOne(text, options, outer) {
+  const { baseUrl = BASE_URL, model, cache } = options;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS;
   if (cache) {
     const cached = cache.get(text);
     if (cached) return Array.from(cached);
   }
-  let headers;
-  if (apiKey) {
-    headers = { "X-API-Key": apiKey };
-  } else if (getToken) {
-    const token = await getToken();
-    if (!token) {
-      throw new Error("No token available for embedding generation");
-    }
-    headers = { Authorization: `Bearer ${token}` };
-  } else {
-    throw new Error("Either apiKey or getToken must be provided");
-  }
+  const headers = await resolveAuthHeaders(options, outer);
   const response = await withEmbeddingRetry(
-    () => postApiV1Embeddings({
-      baseUrl,
-      body: {
-        // Mask PII from the request body only — the cache above still keys on
-        // the original `text`, so callers keep their original values.
-        input: options.maskInput ? options.maskInput(text) : text,
-        model: model ?? DEFAULT_API_EMBEDDING_MODEL
-      },
-      headers
-    })
+    () => withDeadline(
+      (signal) => postApiV1Embeddings({
+        baseUrl,
+        body: {
+          // Mask PII from the request body only — the cache above still keys on
+          // the original `text`, so callers keep their original values.
+          input: options.maskInput ? options.maskInput(text) : text,
+          model: model ?? DEFAULT_API_EMBEDDING_MODEL
+        },
+        headers,
+        ...signal && { signal }
+      }),
+      timeoutMs,
+      "embedding request",
+      outer
+    ),
+    outer
   );
   if (response.error) {
     throw embeddingErrorFrom(response);
@@ -1011,14 +1056,19 @@ async function generateEmbedding(text, options) {
 }
 var DEFAULT_EMBEDDING_BATCH_SIZE = 100;
 var DEFAULT_EMBEDDING_BATCH_CONCURRENCY = 3;
-async function generateEmbeddingsBatch(texts, headers, baseUrl, model, onUsage, maskInput) {
+async function generateEmbeddingsBatch(texts, headers, baseUrl, model, onUsage, maskInput, timeoutMs) {
   const response = await withEmbeddingRetry(
-    () => postApiV1Embeddings({
-      baseUrl,
-      // Mask PII from the request body only; cache/order still key on originals.
-      body: { input: maskInput ? texts.map(maskInput) : texts, model },
-      headers
-    })
+    () => withDeadline(
+      (signal) => postApiV1Embeddings({
+        baseUrl,
+        // Mask PII from the request body only; cache/order still key on originals.
+        body: { input: maskInput ? texts.map(maskInput) : texts, model },
+        headers,
+        ...signal && { signal }
+      }),
+      timeoutMs,
+      "embedding batch request"
+    )
   );
   if (response.error) {
     throw embeddingErrorFrom(response);
@@ -1036,7 +1086,8 @@ async function generateEmbeddingsBatch(texts, headers, baseUrl, model, onUsage,
 }
 async function generateEmbeddings(texts, options) {
   if (texts.length === 0) return [];
-  const { baseUrl = BASE_URL, getToken, apiKey, model, batchSize, cache } = options;
+  const { baseUrl = BASE_URL, model, batchSize, cache } = options;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS;
   const chunkSize = batchSize ?? DEFAULT_EMBEDDING_BATCH_SIZE;
   const results = new Array(texts.length).fill(null);
   const uncachedIndices = [];
@@ -1055,18 +1106,7 @@ async function generateEmbeddings(texts, options) {
   if (uncachedTexts.length === 0) {
     return results;
   }
-  let headers;
-  if (apiKey) {
-    headers = { "X-API-Key": apiKey };
-  } else if (getToken) {
-    const token = await getToken();
-    if (!token) {
-      throw new Error("No token available for embedding generation");
-    }
-    headers = { Authorization: `Bearer ${token}` };
-  } else {
-    throw new Error("Either apiKey or getToken must be provided");
-  }
+  const headers = await resolveAuthHeaders(options);
   const embeddingModel = model ?? DEFAULT_API_EMBEDDING_MODEL;
   let newEmbeddings;
   if (uncachedTexts.length <= chunkSize) {
@@ -1076,7 +1116,8 @@ async function generateEmbeddings(texts, options) {
       baseUrl,
       embeddingModel,
       options.onUsage,
-      options.maskInput
+      options.maskInput,
+      timeoutMs
     );
   } else {
     const chunks = [];
@@ -1094,7 +1135,8 @@ async function generateEmbeddings(texts, options) {
           baseUrl,
           embeddingModel,
           options.onUsage,
-          options.maskInput
+          options.maskInput,
+          timeoutMs
         );
       }
     };

package/dist/tools/selection/index.mjs

@@ -801,11 +801,54 @@ var DEFAULT_API_EMBEDDING_MODEL = "qwen/qwen3-embedding-8b";
 
 // src/lib/memoryEngine/generate.ts
 var EMBED_MAX_ATTEMPTS = 4;
-async function withEmbeddingRetry(call) {
+var DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_EMBEDDING_TOKEN_TIMEOUT_MS = 1e4;
+async function withDeadline(run, ms, what, parent) {
+  if (!(ms > 0) || !Number.isFinite(ms)) return Promise.resolve().then(() => run(parent));
+  const controller = new AbortController();
+  const onParentAbort = () => controller.abort(parent?.reason);
+  let timer;
+  try {
+    if (parent?.aborted) onParentAbort();
+    else parent?.addEventListener("abort", onParentAbort, { once: true });
+    const work = Promise.resolve().then(() => run(controller.signal));
+    work.catch(() => {
+    });
+    const deadline = new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        const err = new Error(`${what} timed out after ${ms}ms`);
+        err.name = "TimeoutError";
+        controller.abort(err);
+        reject(err);
+      }, ms);
+    });
+    return await Promise.race([work, deadline]);
+  } finally {
+    clearTimeout(timer);
+    parent?.removeEventListener("abort", onParentAbort);
+  }
+}
+async function resolveAuthHeaders(options, parent) {
+  const { getToken, apiKey } = options;
+  if (apiKey) return { "X-API-Key": apiKey };
+  if (!getToken) throw new Error("Either apiKey or getToken must be provided");
+  const token = await withDeadline(
+    () => getToken(),
+    options.tokenTimeoutMs ?? DEFAULT_EMBEDDING_TOKEN_TIMEOUT_MS,
+    "embedding auth token read",
+    parent
+  );
+  if (!token) {
+    throw new Error("No token available for embedding generation");
+  }
+  return { Authorization: `Bearer ${token}` };
+}
+async function withEmbeddingRetry(call, stop) {
   let last;
   let lastThrown;
   let threw = false;
   for (let attempt = 1; attempt <= EMBED_MAX_ATTEMPTS; attempt++) {
+    if (stop?.aborted) throw stop.reason;
     try {
       threw = false;
       last = await call();
@@ -840,34 +883,36 @@ function embeddingErrorFrom(response) {
   return new EmbeddingHttpError(message, response.response?.status);
 }
 async function generateEmbedding(text, options) {
-  const { baseUrl = BASE_URL, getToken, apiKey, model, cache } = options;
+  const total = options.totalTimeoutMs;
+  if (total === void 0) return embedOne(text, options, void 0);
+  return withDeadline((signal) => embedOne(text, options, signal), total, "embedding");
+}
+async function embedOne(text, options, outer) {
+  const { baseUrl = BASE_URL, model, cache } = options;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS;
   if (cache) {
     const cached = cache.get(text);
     if (cached) return Array.from(cached);
   }
-  let headers;
-  if (apiKey) {
-    headers = { "X-API-Key": apiKey };
-  } else if (getToken) {
-    const token = await getToken();
-    if (!token) {
-      throw new Error("No token available for embedding generation");
-    }
-    headers = { Authorization: `Bearer ${token}` };
-  } else {
-    throw new Error("Either apiKey or getToken must be provided");
-  }
+  const headers = await resolveAuthHeaders(options, outer);
   const response = await withEmbeddingRetry(
-    () => postApiV1Embeddings({
-      baseUrl,
-      body: {
-        // Mask PII from the request body only — the cache above still keys on
-        // the original `text`, so callers keep their original values.
-        input: options.maskInput ? options.maskInput(text) : text,
-        model: model ?? DEFAULT_API_EMBEDDING_MODEL
-      },
-      headers
-    })
+    () => withDeadline(
+      (signal) => postApiV1Embeddings({
+        baseUrl,
+        body: {
+          // Mask PII from the request body only — the cache above still keys on
+          // the original `text`, so callers keep their original values.
+          input: options.maskInput ? options.maskInput(text) : text,
+          model: model ?? DEFAULT_API_EMBEDDING_MODEL
+        },
+        headers,
+        ...signal && { signal }
+      }),
+      timeoutMs,
+      "embedding request",
+      outer
+    ),
+    outer
   );
   if (response.error) {
     throw embeddingErrorFrom(response);
@@ -890,14 +935,19 @@ async function generateEmbedding(text, options) {
 }
 var DEFAULT_EMBEDDING_BATCH_SIZE = 100;
 var DEFAULT_EMBEDDING_BATCH_CONCURRENCY = 3;
-async function generateEmbeddingsBatch(texts, headers, baseUrl, model, onUsage, maskInput) {
+async function generateEmbeddingsBatch(texts, headers, baseUrl, model, onUsage, maskInput, timeoutMs) {
   const response = await withEmbeddingRetry(
-    () => postApiV1Embeddings({
-      baseUrl,
-      // Mask PII from the request body only; cache/order still key on originals.
-      body: { input: maskInput ? texts.map(maskInput) : texts, model },
-      headers
-    })
+    () => withDeadline(
+      (signal) => postApiV1Embeddings({
+        baseUrl,
+        // Mask PII from the request body only; cache/order still key on originals.
+        body: { input: maskInput ? texts.map(maskInput) : texts, model },
+        headers,
+        ...signal && { signal }
+      }),
+      timeoutMs,
+      "embedding batch request"
+    )
   );
   if (response.error) {
     throw embeddingErrorFrom(response);
@@ -915,7 +965,8 @@ async function generateEmbeddingsBatch(texts, headers, baseUrl, model, onUsage,
 }
 async function generateEmbeddings(texts, options) {
   if (texts.length === 0) return [];
-  const { baseUrl = BASE_URL, getToken, apiKey, model, batchSize, cache } = options;
+  const { baseUrl = BASE_URL, model, batchSize, cache } = options;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_EMBEDDING_REQUEST_TIMEOUT_MS;
   const chunkSize = batchSize ?? DEFAULT_EMBEDDING_BATCH_SIZE;
   const results = new Array(texts.length).fill(null);
   const uncachedIndices = [];
@@ -934,18 +985,7 @@ async function generateEmbeddings(texts, options) {
   if (uncachedTexts.length === 0) {
     return results;
   }
-  let headers;
-  if (apiKey) {
-    headers = { "X-API-Key": apiKey };
-  } else if (getToken) {
-    const token = await getToken();
-    if (!token) {
-      throw new Error("No token available for embedding generation");
-    }
-    headers = { Authorization: `Bearer ${token}` };
-  } else {
-    throw new Error("Either apiKey or getToken must be provided");
-  }
+  const headers = await resolveAuthHeaders(options);
   const embeddingModel = model ?? DEFAULT_API_EMBEDDING_MODEL;
   let newEmbeddings;
   if (uncachedTexts.length <= chunkSize) {
@@ -955,7 +995,8 @@ async function generateEmbeddings(texts, options) {
       baseUrl,
       embeddingModel,
       options.onUsage,
-      options.maskInput
+      options.maskInput,
+      timeoutMs
     );
   } else {
     const chunks = [];
@@ -973,7 +1014,8 @@ async function generateEmbeddings(texts, options) {
           baseUrl,
           embeddingModel,
           options.onUsage,
-          options.maskInput
+          options.maskInput,
+          timeoutMs
         );
       }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anuma/sdk",
-  "version": "6.24.1",
+  "version": "6.25.1",
   "description": "",
   "main": "./dist/index.cjs",
   "module": "./dist/index.mjs",