@assemblyline-agents/runtime 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenEve contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,19 @@
+# @assemblyline-agents/runtime
+
+The Assembly Line runtime: the durable engine that executes compiled agents.
+
+It orchestrates agent runs and turns, channel ingress and delivery, connections (MCP clients, OpenAPI clients, connection auth and stores), builtin tools and tool execution, checkpoints, scheduling, concurrency control, attachments, sandbox integration, and telemetry. Its usage subsystem records idempotent provider receipts, keeps unavailable values explicit instead of estimating them, exposes arbitrary-period aggregates, and reconciles provider control totals. Accounting is behavior-neutral: observation failures are warned but never gate a model request or response. State, blob, and sandbox behavior are pluggable through adapter interfaces implemented by packages such as `@assemblyline-agents/postgres`, `@assemblyline-agents/s3`, and `@assemblyline-agents/docker`. Hosts like `@assemblyline-agents/node` embed this runtime to serve agents.
+
+## Install
+
+```sh
+npm install @assemblyline-agents/runtime
+```
+
+## Part of Assembly Line
+
+This package is part of [Assembly Line](https://github.com/jasonbadeaux/openeve), a vendor-neutral, filesystem-first framework for durable AI agents. See the developer documentation in [docs/developers/](https://github.com/jasonbadeaux/openeve/tree/main/docs/developers) for setup, agent authoring, and deployment guides.
+
+## License
+
+MIT

package/dist/agent-harness.d.ts

@@ -0,0 +1,108 @@
+import type { JsonObject, JsonSchema, ReasoningLevel } from "@openeve/core";
+/**
+ * Engine-neutral contract between the OpenEve runtime and a primary agent
+ * engine ("harness"). Nothing in this module may reference a specific engine:
+ * continuation state is an opaque JSON object owned by the harness, and all
+ * durability (tool records, pauses, checkpoints, events, usage, spans) stays
+ * in the runtime.
+ */
+/** A tool exposed to the model, described in engine-neutral terms. */
+export interface HarnessToolDescriptor {
+    name: string;
+    description: string;
+    inputSchema: JsonSchema;
+}
+/**
+ * Outcome of a runtime tool execution as seen by the harness.
+ *
+ * - `result`: the tool produced `output`, which the harness returns to the
+ *   model verbatim (the runtime already bounded/redacted it).
+ * - `pause`: the runtime paused the run (approval, human input, connection
+ *   authorization). The harness must stop the loop after returning `output`
+ *   as the tool result. `toolCallId` is an opaque correlation id the runtime
+ *   will echo conceptually when the paused tool later resolves; harnesses
+ *   that splice resumed tool results into their transcript should persist it
+ *   in their continuation state.
+ */
+export type HarnessToolOutcome = {
+    kind: "result";
+    output: unknown;
+} | {
+    kind: "pause";
+    output: unknown;
+    toolCallId?: string;
+};
+/** Model-loop lifecycle events the harness reports back to the runtime. */
+export type AgentHarnessEvent = {
+    type: "request_started";
+    iteration: number;
+    toolNames: string[];
+} | {
+    type: "response_completed";
+    iteration: number;
+    finishReason?: string;
+    toolCallCount: number;
+    usage?: {
+        inputTokens?: number;
+        outputTokens?: number;
+        cachedTokens?: number;
+        costUsd?: number;
+    };
+    provider?: string;
+    responseModel?: string;
+};
+/**
+ * Versioned, opaque harness continuation. The runtime persists this as-is and
+ * hands it back on resume. `state` must be JSON-serializable and is only
+ * interpreted by the harness that produced it (matched by `harness` + `version`).
+ */
+export interface HarnessContinuation {
+    harness: string;
+    version: number;
+    state: JsonObject;
+}
+/** Input for one harness turn: a fresh message or a resume of a paused turn. */
+export type AgentTurnInput = {
+    kind: "message";
+    message: string;
+    recentHistory: string[];
+} | {
+    kind: "resume";
+    continuation: HarnessContinuation;
+    toolResult?: {
+        toolName: string;
+        output: unknown;
+    };
+};
+/** Runtime-provided context for one harness turn. */
+export interface AgentHarnessContext {
+    runId: string;
+    sessionId: string;
+    modelSpec: string;
+    reasoning?: ReasoningLevel | undefined;
+    systemPrompt: string;
+    env: Record<string, string | undefined>;
+    /** Current tool set. Re-invoked before each model request so mid-turn discovery is visible. */
+    tools(): Promise<HarnessToolDescriptor[]>;
+    /** Execute a model-requested tool through runtime durability. */
+    executeTool(call: {
+        toolCallId: string;
+        name: string;
+        input: unknown;
+    }): Promise<HarnessToolOutcome>;
+    /** Report a model-loop lifecycle event (events, usage, spans stay runtime-side). */
+    emit(event: AgentHarnessEvent): void | Promise<void>;
+    /** When provided, called with a fresh continuation snapshot after every model response. */
+    onIterationCheckpoint?(continuation: HarnessContinuation): Promise<void>;
+}
+export interface AgentTurnResult {
+    response: string;
+    paused?: boolean;
+    continuation?: HarnessContinuation;
+}
+export interface AgentHarness {
+    readonly id: string;
+    readonly continuationVersion: number;
+    runTurn(input: AgentTurnInput, ctx: AgentHarnessContext): Promise<AgentTurnResult>;
+}
+//# sourceMappingURL=agent-harness.d.ts.map

package/dist/agent-harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-harness.d.ts","sourceRoot":"","sources":["../src/agent-harness.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE5E;;;;;;GAMG;AAEH,sEAAsE;AACtE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,UAAU,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GACnE;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,GAC7D;IACE,IAAI,EAAE,QAAQ,CAAC;IACf,YAAY,EAAE,mBAAmB,CAAC;IAClC,UAAU,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;CACpD,CAAC;AAEN,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,+FAA+F;IAC/F,KAAK,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC1C,iEAAiE;IACjE,WAAW,CAAC,IAAI,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACrG,oFAAoF;IACpF,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,2FAA2F;IAC3F,qBAAqB,CAAC,CAAC,YAAY,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,mBAAmB,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACpF"}

package/dist/agent-harness.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-harness.js.map

package/dist/agent-harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-harness.js","sourceRoot":"","sources":["../src/agent-harness.ts"],"names":[],"mappings":""}

package/dist/attachments-legacy.d.ts

@@ -0,0 +1,17 @@
+import type { JsonObject } from "@openeve/core";
+import { type AttachmentDownloadRequest } from "./attachments.js";
+/**
+ * Legacy in-runtime provider download builders (Slack files.info, Telegram
+ * getFile, Teams token flow, Photon bridge headers).
+ *
+ * Channels now own attachment resolution through `ChannelModule.resolveAttachment`;
+ * this module only backs turns whose channel module does not implement it —
+ * i.e. manifests/channel packages compiled before the split, plus direct
+ * `run({ trustedAttachmentProvider })` callers. Remove after one release.
+ */
+export declare function legacyAttachmentDownloadRequest(attachment: JsonObject, input: {
+    trustedProvider?: string;
+    env: Record<string, string | undefined>;
+    fetch: typeof fetch;
+}): Promise<AttachmentDownloadRequest | undefined>;
+//# sourceMappingURL=attachments-legacy.d.ts.map

package/dist/attachments-legacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments-legacy.d.ts","sourceRoot":"","sources":["../src/attachments-legacy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAKL,KAAK,yBAAyB,EAC/B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;GAQG;AACH,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE;IACL,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB,GACA,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAgBhD"}

package/dist/attachments-legacy.js

@@ -0,0 +1,273 @@
+import { attachmentFetchTimeoutMs, firstDownloadableUrl, normalizeAttachmentProvider, trustedProviderForAttachment } from "./attachments.js";
+/**
+ * Legacy in-runtime provider download builders (Slack files.info, Telegram
+ * getFile, Teams token flow, Photon bridge headers).
+ *
+ * Channels now own attachment resolution through `ChannelModule.resolveAttachment`;
+ * this module only backs turns whose channel module does not implement it —
+ * i.e. manifests/channel packages compiled before the split, plus direct
+ * `run({ trustedAttachmentProvider })` callers. Remove after one release.
+ */
+export async function legacyAttachmentDownloadRequest(attachment, input) {
+    const telegram = telegramFileIdFromAttachment(attachment, input);
+    if (telegram)
+        return telegramAttachmentDownload(telegram, input);
+    const slack = await slackAttachmentDownload(attachment, input);
+    if (slack)
+        return slack;
+    const url = attachmentDownloadUrl(attachment);
+    if (!url)
+        return undefined;
+    const headers = await attachmentDownloadHeaders(attachment, url, input);
+    return {
+        url,
+        headers,
+        provider: stringValue(attachment.provider),
+        filename: stringValue(attachment.filename) || stringValue(attachment.name)
+    };
+}
+async function telegramAttachmentDownload(fileId, input) {
+    const token = input.env.TELEGRAM_BOT_TOKEN;
+    if (!token)
+        return undefined;
+    const infoUrl = `https://api.telegram.org/bot${encodeURIComponent(token)}/getFile?file_id=${encodeURIComponent(fileId)}`;
+    const response = await input.fetch(infoUrl, { signal: timeoutSignal(attachmentFetchTimeoutMs(input.env)) });
+    const payload = recordValue(await parseJsonResponse(response));
+    if (!response.ok || payload?.ok !== true) {
+        throw new Error(`Telegram file lookup failed: ${response.status}`);
+    }
+    const filePath = stringValue(recordValue(payload.result)?.file_path);
+    if (!filePath)
+        throw new Error("Telegram file lookup did not return file_path.");
+    return {
+        url: `https://api.telegram.org/file/bot${encodeURIComponent(token)}/${filePath}`,
+        headers: {}
+    };
+}
+async function slackAttachmentDownload(attachment, input) {
+    if (!isSlackAttachment(attachment, input))
+        return undefined;
+    const token = slackToken(input.env);
+    const headers = token ? { authorization: `Bearer ${token}` } : {};
+    const directUrl = firstDownloadableUrl([
+        attachment.url_private_download,
+        recordValue(attachment.remote)?.url_private_download,
+        recordValue(attachment.download)?.url_private_download,
+        attachment.downloadUrl,
+        recordValue(attachment.remote)?.downloadUrl,
+        recordValue(attachment.download)?.downloadUrl,
+        attachment.url_private,
+        recordValue(attachment.remote)?.url_private,
+        recordValue(attachment.download)?.url_private
+    ]);
+    const filename = stringValue(attachment.filename) || stringValue(attachment.name);
+    if (directUrl) {
+        if (!isSlackUrl(directUrl))
+            throw new Error("Slack attachment download URL host is not allowed.");
+        return { url: directUrl, headers, provider: "slack", filename };
+    }
+    const fileId = slackFileIdFromAttachment(attachment);
+    if (!fileId || !token)
+        return undefined;
+    const response = await input.fetch(`https://slack.com/api/files.info?file=${encodeURIComponent(fileId)}`, {
+        headers,
+        signal: timeoutSignal(attachmentFetchTimeoutMs(input.env))
+    });
+    const payload = recordValue(await parseJsonResponse(response));
+    if (!response.ok || payload?.ok !== true) {
+        throw new Error(`Slack file lookup failed: ${response.status}`);
+    }
+    const file = recordValue(payload.file);
+    const url = firstDownloadableUrl([
+        file?.url_private_download,
+        file?.url_private
+    ]);
+    if (!url)
+        throw new Error("Slack file lookup did not return a private download URL.");
+    if (!isSlackUrl(url))
+        throw new Error("Slack file lookup returned an untrusted download URL host.");
+    return {
+        url,
+        headers,
+        provider: "slack",
+        filename: stringValue(file?.name) || stringValue(file?.title) || filename
+    };
+}
+async function attachmentDownloadHeaders(attachment, url, input) {
+    const trustedProvider = trustedProviderForAttachment(attachment, input.trustedProvider);
+    if (trustedProvider === "photon") {
+        if (!isPhotonBridgeUrl(url, input.env))
+            throw new Error("Photon attachment download URL host is not allowed.");
+        const token = input.env.PHOTON_BRIDGE_TOKEN;
+        return token ? { authorization: `Bearer ${token}` } : {};
+    }
+    if (trustedProvider === "teams") {
+        if (!isTeamsAttachmentUrl(attachment, url))
+            throw new Error("Teams attachment download URL host is not allowed.");
+        const token = await teamsBotTokenForAttachment(input);
+        return token ? { authorization: `Bearer ${token}` } : {};
+    }
+    if (trustedProvider === "slack") {
+        if (!isSlackUrl(url))
+            throw new Error("Slack attachment download URL host is not allowed.");
+        const token = input.env.SLACK_BOT_TOKEN ?? input.env.SLACK_USER_TOKEN;
+        return token ? { authorization: `Bearer ${token}` } : {};
+    }
+    return {};
+}
+async function teamsBotTokenForAttachment(input) {
+    const appId = input.env.MICROSOFT_APP_ID;
+    const password = input.env.MICROSOFT_APP_PASSWORD;
+    if (!appId || !password)
+        return undefined;
+    const body = new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: appId,
+        client_secret: password,
+        scope: "https://api.botframework.com/.default"
+    });
+    const response = await input.fetch("https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body,
+        signal: timeoutSignal(attachmentFetchTimeoutMs(input.env))
+    });
+    const parsed = recordValue(await parseJsonResponse(response));
+    if (!response.ok)
+        throw new Error(`Teams attachment token request failed: ${response.status}`);
+    return stringValue(parsed?.access_token);
+}
+function attachmentDownloadUrl(attachment) {
+    const remote = recordValue(attachment.remote) ?? recordValue(attachment.download);
+    const candidates = [
+        remote?.downloadUrl,
+        remote?.contentUrl,
+        attachment.downloadUrl,
+        attachment.url_private_download,
+        remote?.url_private_download,
+        attachment.url_private,
+        remote?.url_private,
+        attachment.contentUrl,
+        attachment.mediaUrl,
+        attachment.fileUrl,
+        attachment.url,
+        remote?.url,
+        attachment.href
+    ];
+    return firstDownloadableUrl(candidates);
+}
+function isSlackAttachment(attachment, input) {
+    if (trustedProviderForAttachment(attachment, input.trustedProvider) !== "slack")
+        return false;
+    const provider = normalizeAttachmentProvider(stringValue(attachment.provider) || stringValue(attachment.remoteProvider));
+    const remote = recordValue(attachment.remote) ?? recordValue(attachment.download);
+    const auth = normalizeAttachmentProvider(stringValue(remote?.auth) || stringValue(remote?.authProvider) || stringValue(attachment.authProvider));
+    return provider === "slack" ||
+        auth === "slack" ||
+        Boolean(stringValue(attachment.slackFileId) || stringValue(remote?.slackFileId)) ||
+        Boolean(firstDownloadableUrl([
+            attachment.url_private_download,
+            attachment.url_private,
+            remote?.url_private_download,
+            remote?.url_private
+        ])) ||
+        isSlackUrl(firstDownloadableUrl([attachment.url, attachment.href, remote?.url]));
+}
+function slackFileIdFromAttachment(attachment) {
+    const provider = normalizeAttachmentProvider(stringValue(attachment.provider) || stringValue(attachment.remoteProvider));
+    const remote = recordValue(attachment.remote) ?? recordValue(attachment.download);
+    const direct = stringValue(attachment.slackFileId) || stringValue(attachment.fileId);
+    if (direct)
+        return direct;
+    const remoteFileId = stringValue(remote?.fileId) || stringValue(remote?.slackFileId);
+    if (remoteFileId)
+        return remoteFileId;
+    const id = stringValue(attachment.id);
+    if (id && (provider === "slack" || isSlackUrl(firstDownloadableUrl([attachment.url, attachment.href, remote?.url]))))
+        return id;
+    return undefined;
+}
+function slackToken(env) {
+    return env.SLACK_BOT_TOKEN ?? env.SLACK_USER_TOKEN;
+}
+function isSlackUrl(value) {
+    if (!value)
+        return false;
+    try {
+        const hostname = new URL(value).hostname.toLowerCase();
+        return hostname === "slack.com" || hostname.endsWith(".slack.com") || hostname === "files.slack.com";
+    }
+    catch {
+        return false;
+    }
+}
+function telegramFileIdFromAttachment(attachment, input) {
+    if (trustedProviderForAttachment(attachment, input.trustedProvider) !== "telegram")
+        return undefined;
+    const direct = stringValue(attachment.telegramFileId) || stringValue(attachment.fileId);
+    if (direct && (normalizeAttachmentProvider(stringValue(attachment.provider)) === "telegram" || normalizeAttachmentProvider(stringValue(attachment.remoteProvider)) === "telegram"))
+        return direct;
+    const remote = recordValue(attachment.remote) ?? recordValue(attachment.download);
+    const remoteFileId = stringValue(remote?.fileId);
+    if (remoteFileId && (normalizeAttachmentProvider(stringValue(remote?.provider)) === "telegram" || normalizeAttachmentProvider(stringValue(remote?.auth)) === "telegram"))
+        return remoteFileId;
+    const metadata = attachment.metadata;
+    if (Array.isArray(metadata)) {
+        const record = metadata.map(recordValue).filter((value) => Boolean(value)).at(-1);
+        return stringValue(record?.file_id);
+    }
+    return stringValue(recordValue(metadata)?.file_id);
+}
+function isPhotonBridgeUrl(url, env) {
+    const base = env.PHOTON_TRANSPORT_URL;
+    if (!base)
+        return false;
+    try {
+        return new URL(url).origin === new URL(base).origin;
+    }
+    catch {
+        return false;
+    }
+}
+function isTeamsAttachmentUrl(attachment, url) {
+    const remote = recordValue(attachment.remote) ?? recordValue(attachment.download);
+    const serviceUrl = stringValue(remote?.serviceUrl) || stringValue(attachment.serviceUrl);
+    try {
+        const target = new URL(url);
+        if (target.protocol !== "https:")
+            return false;
+        if (target.hostname.endsWith(".botframework.com"))
+            return true;
+        if (target.hostname.endsWith(".skype.com"))
+            return true;
+        if (!serviceUrl)
+            return false;
+        return target.origin === new URL(serviceUrl).origin;
+    }
+    catch {
+        return false;
+    }
+}
+function timeoutSignal(timeoutMs) {
+    return AbortSignal.timeout(timeoutMs);
+}
+async function parseJsonResponse(response) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return { text };
+    }
+}
+function stringValue(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return String(value);
+    return typeof value === "string" ? value.trim() : "";
+}
+function recordValue(value) {
+    return Boolean(value && typeof value === "object" && !Array.isArray(value)) ? value : undefined;
+}
+//# sourceMappingURL=attachments-legacy.js.map

package/dist/attachments-legacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments-legacy.js","sourceRoot":"","sources":["../src/attachments-legacy.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,2BAA2B,EAC3B,4BAA4B,EAE7B,MAAM,kBAAkB,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,UAAsB,EACtB,KAIC;IAED,MAAM,QAAQ,GAAG,4BAA4B,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjE,IAAI,QAAQ;QAAE,OAAO,0BAA0B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAEjE,MAAM,KAAK,GAAG,MAAM,uBAAuB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/D,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,GAAG,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACxE,OAAO;QACL,GAAG;QACH,OAAO;QACP,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,MAAc,EACd,KAGC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,+BAA+B,kBAAkB,CAAC,KAAK,CAAC,oBAAoB,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;IACzH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACjF,OAAO;QACL,GAAG,EAAE,oCAAoC,kBAAkB,CAAC,KAAK,CAAC,IAAI,QAAQ,EAAE;QAChF,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,UAAsB,EACtB,KAIC;IAED,IAAI,CAAC,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,MAAM,SAAS,GAAG,oBAAoB,CAAC;QACrC,UAAU,CAAC,oBAAoB;QAC/B,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,oBAAoB;QACpD,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,oBAAoB;QACtD,UAAU,CAAC,WAAW;QACtB,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW;QAC3C,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW;QAC7C,UAAU,CAAC,WAAW;QACtB,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW;QAC3C,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,WAAW;KAC9C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAClF,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAClG,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClE,CAAC;IAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,yCAAyC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE;QACxG,OAAO;QACP,MAAM,EAAE,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,oBAAoB,CAAC;QAC/B,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,WAAW;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACpG,OAAO;QACL,GAAG;QACH,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ;KAC1E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,UAAsB,EACtB,GAAW,EACX,KAIC;IAED,MAAM,eAAe,GAAG,4BAA4B,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACxF,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC/G,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC5C,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAClH,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,IAAI,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACtE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAGzC;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAClD,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,QAAQ;QACvB,KAAK,EAAE,uCAAuC;KAC/C,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,sEAAsE,EAAE;QACzG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;QACJ,MAAM,EAAE,aAAa,CAAC,wBAAwB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;KAC3D,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,OAAO,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAsB;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG;QACjB,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,UAAU;QAClB,UAAU,CAAC,WAAW;QACtB,UAAU,CAAC,oBAAoB;QAC/B,MAAM,EAAE,oBAAoB;QAC5B,UAAU,CAAC,WAAW;QACtB,MAAM,EAAE,WAAW;QACnB,UAAU,CAAC,UAAU;QACrB,UAAU,CAAC,QAAQ;QACnB,UAAU,CAAC,OAAO;QAClB,UAAU,CAAC,GAAG;QACd,MAAM,EAAE,GAAG;QACX,UAAU,CAAC,IAAI;KAChB,CAAC;IACF,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAsB,EAAE,KAAmC;IACpF,IAAI,4BAA4B,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC9F,MAAM,QAAQ,GAAG,2BAA2B,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,2BAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;IACjJ,OAAO,QAAQ,KAAK,OAAO;QACzB,IAAI,KAAK,OAAO;QAChB,OAAO,CAAC,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChF,OAAO,CAAC,oBAAoB,CAAC;YAC3B,UAAU,CAAC,oBAAoB;YAC/B,UAAU,CAAC,WAAW;YACtB,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;QACH,UAAU,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,yBAAyB,CAAC,UAAsB;IACvD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrF,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACrF,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,MAAM,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAChI,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,UAAU,CAAC,GAAuC;IACzD,OAAO,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,gBAAgB,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvD,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,KAAK,iBAAiB,CAAC;IACvG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAsB,EAAE,KAAmC;IAC/F,IAAI,4BAA4B,CAAC,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACrG,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACxF,IAAI,MAAM,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,UAAU,IAAI,2BAA2B,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,KAAK,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC;IAClM,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,YAAY,IAAI,CAAC,2BAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,UAAU,IAAI,2BAA2B,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC;QAAE,OAAO,YAAY,CAAC;IAC9L,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAuB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,WAAW,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAuC;IAC7E,MAAM,IAAI,GAAG,GAAG,CAAC,oBAAoB,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAsB,EAAE,GAAW;IAC/D,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC;QAC9B,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACjD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC"}

package/dist/attachments.d.ts

@@ -0,0 +1,49 @@
+import type { JsonObject } from "@assemblyline-agents/core";
+import type { ChannelAttachmentRequest } from "./channel.js";
+import type { BlobAdapter, RunRecord, StateAdapter } from "./index.js";
+export interface AttachmentDownloadRequest {
+    url: string;
+    headers?: Record<string, string>;
+    provider?: string;
+    filename?: string;
+}
+export declare function materializeTurnAttachments(input: {
+    run: RunRecord;
+    channel: string;
+    attachments: JsonObject[];
+    trustedProvider?: string;
+    /**
+     * Attachment resolver bound to the channel module that produced the turn.
+     * When present it replaces the legacy in-runtime provider builders; the
+     * caller enforces the trust boundary (only the turn's own channel module).
+     */
+    resolveAttachment?: (attachment: JsonObject) => Promise<ChannelAttachmentRequest | undefined> | ChannelAttachmentRequest | undefined;
+    env: Record<string, string | undefined>;
+    fetch: typeof fetch;
+    blob: BlobAdapter;
+    state: Pick<StateAdapter, "appendEvent" | "recordFileIndex">;
+}): Promise<JsonObject[]>;
+export declare function fileManifestEntries(attachments: JsonObject[]): JsonObject[];
+export declare function attachmentContentsFromRecord(attachment: JsonObject, blob?: BlobAdapter): Promise<string | Uint8Array | undefined>;
+export declare function attachmentResourcePath(attachment: JsonObject): string;
+export declare function attachmentContentType(attachment: JsonObject): string;
+export declare function isTextualContentType(contentType: string): boolean;
+/**
+ * Extract the first downloadable http(s) URL a channel attachment advertises.
+ * Exported for channel modules implementing `resolveAttachment`.
+ */
+export declare function attachmentRemoteUrl(attachment: JsonObject): string | undefined;
+/**
+ * True when the attachment's own trust markers (`remote.trusted` plus a
+ * matching provider/auth hint) claim the given provider. Channel modules use
+ * this in `resolveAttachment` before attaching credentials, so forged
+ * attachments never receive another provider's tokens.
+ */
+export declare function attachmentTrustedForProvider(attachment: JsonObject, provider: string): boolean;
+/** Exported for channel modules and the transitional legacy resolver module. */
+export declare function firstDownloadableUrl(candidates: unknown[]): string | undefined;
+export declare function trustedProviderForAttachment(attachment: JsonObject, trustedProvider: string | undefined): string | undefined;
+export declare function normalizeAttachmentProvider(value: string | undefined): string | undefined;
+/** Attachment download timeout (`OPENEVE_ATTACHMENT_FETCH_TIMEOUT_MS`). Exported for channel `resolveAttachment` lookups. */
+export declare function attachmentFetchTimeoutMs(env: Record<string, string | undefined>): number;
+//# sourceMappingURL=attachments.d.ts.map

package/dist/attachments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,KAAK,EAAE,WAAW,EAAc,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AASnF,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAWD,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,GAAG,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,GAAG,wBAAwB,GAAG,SAAS,CAAC;IACrI,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,IAAI,EAAE,WAAW,CAAC;IAClB,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,iBAAiB,CAAC,CAAC;CAC9D,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAsLxB;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAsC3E;AAED,wBAAsB,4BAA4B,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC,CAQvI;AAED,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CASrE;AAED,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAKpE;AA6QD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CASjE;AAmDD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAE9E;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9F;AAsBD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,SAAS,CAM9E;AAYD,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAc5H;AAMD,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOzF;AAuGD,6HAA6H;AAC7H,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAExF"}