@contractspec/lib.ai-agent 7.0.7 → 7.0.10

package/dist/agent/agent-factory.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/agent/contract-spec-agent.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/agent/index.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/agent/json-runner.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/agent/unified-agent.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/node/agent/agent-factory.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/node/agent/contract-spec-agent.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/node/agent/index.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/node/agent/json-runner.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/node/agent/unified-agent.js

@@ -2288,8 +2288,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 
 // src/spec/spec.ts

package/dist/node/session/index.js

@@ -119,8 +119,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 export {
   generateSessionId,

package/dist/node/session/store.js

@@ -119,8 +119,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 export {
   generateSessionId,

package/dist/session/index.js

@@ -119,8 +119,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 export {
   generateSessionId,

package/dist/session/store.js

@@ -119,8 +119,33 @@ class InMemorySessionStore {
 function createInMemorySessionStore(options) {
   return new InMemorySessionStore(options);
 }
+function createSecureSessionToken() {
+  const cryptoApi = globalThis.crypto;
+  if (typeof cryptoApi?.randomUUID === "function") {
+    return cryptoApi.randomUUID();
+  }
+  if (typeof cryptoApi?.getRandomValues === "function") {
+    const bytes = cryptoApi.getRandomValues(new Uint8Array(16));
+    const versionByte = bytes.at(6);
+    const variantByte = bytes.at(8);
+    if (versionByte === undefined || variantByte === undefined) {
+      throw new Error("Secure session token generation requires 16 random bytes.");
+    }
+    bytes[6] = versionByte & 15 | 64;
+    bytes[8] = variantByte & 63 | 128;
+    const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
+    return [
+      hex.slice(0, 4).join(""),
+      hex.slice(4, 6).join(""),
+      hex.slice(6, 8).join(""),
+      hex.slice(8, 10).join(""),
+      hex.slice(10, 16).join("")
+    ].join("-");
+  }
+  throw new Error("Secure session IDs require Web Crypto support.");
+}
 function generateSessionId() {
-  return `sess_${Date.now()}_${Math.random().toString(36).slice(2, 11)}`;
+  return `sess_${createSecureSessionToken()}`;
 }
 export {
   generateSessionId,

package/dist/session/store.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contractspec/lib.ai-agent",
-  "version": "7.0.7",
+  "version": "7.0.10",
   "description": "AI agent orchestration with MCP and tool support",
   "keywords": [
     "contractspec",
@@ -41,10 +41,10 @@
     "@ai-sdk/openai": "3.0.41",
     "@modelcontextprotocol/sdk": "^1.27.1",
     "@posthog/react": "^1.8.2",
-    "@posthog/ai": "7.12.1",
-    "@contractspec/lib.contracts-spec": "4.0.0",
-    "@contractspec/lib.ai-providers": "3.7.6",
-    "@contractspec/lib.knowledge": "3.7.7",
+    "@posthog/ai": "7.12.2",
+    "@contractspec/lib.contracts-spec": "4.1.2",
+    "@contractspec/lib.ai-providers": "3.7.8",
+    "@contractspec/lib.knowledge": "3.7.10",
     "compare-versions": "^6.1.1",
     "zod": "^4.3.5"
   },
@@ -52,7 +52,7 @@
     "@anthropic-ai/claude-agent-sdk": ">=0.1.0",
     "@opencode-ai/sdk": ">=1.0.0",
     "posthog-node": ">=4.0.0",
-    "@contractspec/lib.surface-runtime": "0.5.7"
+    "@contractspec/lib.surface-runtime": "0.5.10"
   },
   "peerDependenciesMeta": {
     "@anthropic-ai/claude-agent-sdk": {
@@ -72,9 +72,9 @@
     }
   },
   "devDependencies": {
-    "@contractspec/tool.typescript": "3.7.6",
+    "@contractspec/tool.typescript": "3.7.8",
     "typescript": "^5.9.3",
-    "@contractspec/tool.bun": "3.7.6"
+    "@contractspec/tool.bun": "3.7.8"
   },
   "exports": {
     ".": {