@elevasis/sdk 1.39.0 → 1.41.0

package/dist/cli.cjs

@@ -41214,12 +41214,7 @@ var GoogleConfigSchema = external_exports.object({
 });
 var AnthropicOptionsSchema = external_exports.object({}).strict();
 var AnthropicStandardConfigSchema = external_exports.object({
-  model: external_exports.enum([
-    "claude-sonnet-4-6",
-    "claude-haiku-4-5-20251001",
-    "claude-haiku-4-5",
-    "claude-sonnet-4-5"
-  ]),
+  model: external_exports.enum(["claude-haiku-4-5-20251001", "claude-haiku-4-5"]),
   provider: external_exports.literal("anthropic"),
   apiKey: external_exports.string(),
   temperature: external_exports.number().min(0).max(1).optional(),
@@ -41228,8 +41223,8 @@ var AnthropicStandardConfigSchema = external_exports.object({
   topP: external_exports.number().min(0).max(1).optional(),
   modelOptions: AnthropicOptionsSchema.optional()
 });
-var AnthropicOpus48ConfigSchema = external_exports.object({
-  model: external_exports.literal("claude-opus-4-8"),
+var AnthropicClaude5ConfigSchema = external_exports.object({
+  model: external_exports.enum(["claude-opus-5", "claude-sonnet-5"]),
   provider: external_exports.literal("anthropic"),
   apiKey: external_exports.string(),
   temperature: external_exports.literal(1).optional(),
@@ -41241,7 +41236,7 @@ var AnthropicOpus48ConfigSchema = external_exports.object({
   modelOptions: AnthropicOptionsSchema.optional()
 });
 var AnthropicConfigSchema = external_exports.discriminatedUnion("model", [
-  AnthropicOpus48ConfigSchema,
+  AnthropicClaude5ConfigSchema,
   AnthropicStandardConfigSchema
 ]);
 var MODEL_INFO = {
@@ -41336,7 +41331,7 @@ var MODEL_INFO = {
     configSchema: GoogleConfigSchema
   },
   // Anthropic Claude Models (direct SDK access via @anthropic-ai/sdk)
-  "claude-opus-4-8": {
+  "claude-opus-5": {
     inputCostPer1M: 500,
     // $5.00 per 1M tokens
     outputCostPer1M: 2500,
@@ -41349,7 +41344,9 @@ var MODEL_INFO = {
     category: "reasoning",
     configSchema: AnthropicConfigSchema
   },
-  "claude-sonnet-4-6": {
+  "claude-sonnet-5": {
+    // List pricing. An introductory rate of $2.00/$10.00 runs through 2026-08-31; encoding the
+    // temporary rate would make historical cost analytics wrong once it lapses.
     inputCostPer1M: 300,
     // $3.00 per 1M tokens
     outputCostPer1M: 1500,
@@ -41358,7 +41355,7 @@ var MODEL_INFO = {
     recommendedTokens: 8e3,
     maxTokens: 1e6,
     // 1M context window
-    maxOutputTokens: 64e3,
+    maxOutputTokens: 128e3,
     category: "standard",
     configSchema: AnthropicConfigSchema
   },
@@ -41387,19 +41384,6 @@ var MODEL_INFO = {
     maxOutputTokens: 64e3,
     category: "standard",
     configSchema: AnthropicConfigSchema
-  },
-  "claude-sonnet-4-5": {
-    inputCostPer1M: 300,
-    // $3.00 per 1M tokens
-    outputCostPer1M: 1500,
-    // $15.00 per 1M tokens
-    minTokens: 4e3,
-    recommendedTokens: 8e3,
-    maxTokens: 2e5,
-    // 200k context window
-    maxOutputTokens: 64e3,
-    category: "standard",
-    configSchema: AnthropicConfigSchema
   }
 };
 function getModelInfo(model) {
@@ -45850,7 +45834,7 @@ function wrapAction(commandName, fn) {
 // package.json
 var package_default = {
   name: "@elevasis/sdk",
-  version: "1.39.0",
+  version: "1.41.0",
   description: "SDK for building Elevasis organization resources",
   type: "module",
   bin: {

package/dist/index.d.ts

@@ -426,7 +426,7 @@ type GoogleModel = 'gemini-3-flash-preview' | 'gemini-3.1-flash-lite-preview';
 /**
  * Supported Anthropic models (direct SDK access via @anthropic-ai/sdk)
  */
-type AnthropicModel = 'claude-opus-4-8' | 'claude-sonnet-4-6' | 'claude-haiku-4-5-20251001' | 'claude-haiku-4-5' | 'claude-sonnet-4-5';
+type AnthropicModel = 'claude-opus-5' | 'claude-sonnet-5' | 'claude-haiku-4-5-20251001' | 'claude-haiku-4-5';
 /** Supported LLM models */
 type LLMModel = OpenAIModel | OpenRouterModel | GoogleModel | AnthropicModel | 'mock';
 /**
@@ -1062,6 +1062,20 @@ interface LLMGenerateResponse<T = unknown> {
         totalTokens: number;
     };
     cost?: number;
+    /**
+     * Why this call went out WITHOUT `strict`, on an adapter that tried to send it with one.
+     *
+     * Present only on a refusal, so absence means either "strict was in effect" or "this adapter
+     * does not attempt strict at all" — the two are distinguished by which adapter answered, not by
+     * this field. `toStrictSchema` already computes these reasons and, until now, nothing consumed
+     * them at the call site: an unstrict call was indistinguishable from a strict one anywhere
+     * outside a dev-only flow log. That invisibility is what let every tenant run unstrict against a
+     * strict-capable API for as long as it took someone to recognise a pre-strict error signature.
+     *
+     * Internal-only, like `usage` — `UniversalLLMAdapter` lifts it onto the `ai_calls` row and
+     * strips it before the response reaches callers.
+     */
+    strictRefusalReasons?: string[];
 }
 /**
  * LLM Adapter interface
@@ -1093,6 +1107,14 @@ interface LLMAdapter {
  * Memory types mirror action types for clarity and filtering
  */
 type MemoryEntryType = 'context' | 'input' | 'reasoning' | 'tool-result' | 'delegation-result' | 'error';
+/**
+ * Who authored an entry's content.
+ *
+ * This is what lets the assembled prompt tell framework-authored text apart from text that
+ * originated outside the trust boundary. `'framework'` content is ours; the other three are not
+ * and are rendered inside the JSON data envelope (see `MemoryManager.toContextParts`).
+ */
+type MemoryEntrySource = 'framework' | 'user' | 'tool' | 'model';
 /**
  * Memory entry - represents a single entry in agent memory
  * Stored in agent memory, translated by adapters to vendor-specific formats
@@ -1103,6 +1125,16 @@ interface MemoryEntry {
     timestamp: number;
     turnNumber: number | null;
     iterationNumber: number | null;
+    /**
+     * Provenance. **Optional on purpose** — `undefined` means unknown, which is what every
+     * pre-existing snapshot and every not-yet-redeployed tenant bundle produces. Read sites MUST
+     * test `== null`, never `=== undefined`: the `inTurnScope` predicate in `manager.ts` is the
+     * cautionary precedent, where a `=== undefined` check silently dropped every `null`-stamped
+     * entry. `isMemoryEntry` is deliberately NOT tightened to require this field; doing so would
+     * make every stored snapshot fail validation, and `restoreSessionMemory` fails open by
+     * starting the agent with empty memory rather than throwing.
+     */
+    source?: MemoryEntrySource;
 }
 /**
  * Agent memory - Self-orchestrated memory with session + working storage
@@ -1130,8 +1162,17 @@ interface MemoryStatus {
     sessionMemoryKeys: number;
     sessionMemoryLimit: number;
     currentKeys: string[];
+    sessionMemoryTokens: number;
+    sessionMemoryTokenLimit: number;
+    /**
+     * History tokens as a percentage of `historyBudget` — history ALONE, not history plus session
+     * memory. It previously reported the combined total under this name, so session memory growth
+     * read as history pressure and triggered history compaction that could not relieve it.
+     */
     historyPercent: number;
     historyTokens: number;
+    historyBudget: number;
+    totalTokens: number;
     tokenBudget: number;
 }
 /**
@@ -1148,6 +1189,20 @@ interface MemoryConstraints {
  * Agent provides strings, framework handles wrapping and auto-compaction
  */
 
+/**
+ * The framework's own framing message and the untrusted data envelope, as separate strings.
+ *
+ * They are separate because the model must be able to tell them apart, and so must the input
+ * sanitizer: the framing is framework-authored and trusted, the envelope is not. Concatenating
+ * them — which is what this replaced — made that distinction undecidable at the adapter and left
+ * the framework's own section headers inside the region scanned for delimiter injection.
+ */
+interface MemoryContextParts {
+    /** Framework-authored. Memory status and a description of the envelope. Carries NO stored content. */
+    framing: string;
+    /** Every stored fragment, JSON-encoded and source-tagged. Untrusted. */
+    dataEnvelope: string;
+}
 /**
  * Memory Manager - Agent memory orchestration
  * Provides ultra-simple API for agents (strings only)
@@ -1164,7 +1219,7 @@ declare class MemoryManager {
      * @param key - Session memory key
      * @param content - String content from agent
      */
-    set(key: string, content: string): void;
+    set(key: string, content: string, source?: MemoryEntrySource): void;
     /**
      * Get session memory entry content
      * @param key - Session memory key
@@ -1193,6 +1248,15 @@ declare class MemoryManager {
      * Emergency fallback if agent exceeds limits
      */
     enforceHardLimits(): void;
+    /**
+     * Evict oldest session memory entries until the pool fits its token limit.
+     *
+     * Key count and token count are different constraints: 25 short keys are fine, 25 large ones
+     * are not. Eviction is oldest-first by timestamp, matching the key-count path, and always
+     * leaves at least one entry so a single oversized key degrades to "one key" rather than to
+     * "memory silently emptied".
+     */
+    private enforceSessionMemoryTokenLimit;
     /**
      * Get history length (for logging and introspection)
      * @returns Number of entries in history
@@ -1216,14 +1280,29 @@ declare class MemoryManager {
      */
     getSnapshot(): AgentMemory | undefined;
     /**
-     * Build context string for LLM
-     * Serializes sessionmemory + history memory with clear sections
-     * Shows current iteration entries FIRST (reverse chronological) for LLM attention
+     * Build the framework framing and the untrusted data envelope for an LLM call.
+     *
+     * These are two separate strings because they are two different trust levels, and they used to
+     * be one. Concatenated, the framework's own `=== ... ===` section headers sat in the same string
+     * as stored tool output and user text, so the input sanitizer matched its own scaffolding on
+     * every call and nothing downstream could tell which half a match came from. Splitting them
+     * makes that distinction structural: the framing is ours, the envelope is not.
+     *
+     * The envelope is JSON, which additionally neutralizes the anchored-delimiter attack class —
+     * `JSON.stringify` escapes newlines, so a stored fragment cannot produce a line that starts
+     * with `===` no matter what it contains.
+     *
+     * The current turn's own input is deliberately NOT in either string. It travels as its own
+     * `role:'user'` message (see `buildAgentMessages`), which is the whole point: a model asked to
+     * treat "everything in this block" as data was also being handed the live question inside that
+     * block.
+     *
+     * Shows current iteration entries FIRST (reverse chronological) for LLM attention.
+     *
      * @param currentIteration - Current iteration number (0 = pre-iteration)
      * @param currentTurn - Current turn number (optional, for session context filtering)
-     * @returns Formatted memory context for LLM prompt
      */
-    toContext(currentIteration: number, currentTurn?: number): string;
+    toContextParts(currentIteration: number, currentTurn?: number): MemoryContextParts;
 }
 
 /**
@@ -1345,7 +1424,7 @@ interface AgentConfig extends ResourceDefinition {
      * Security level for system prompt hardening (auto-derived if omitted)
      *
      * - 'standard': Lightweight defense (3 rules) - default for non-session agents
-     * - 'hardened': Comprehensive defense (6 rules) - default for session-capable agents
+     * - 'hardened': Comprehensive defense (5 rules) - default for session-capable agents
      * - 'none': No security prompt - for pure internal agents with no external input
      *
      * If omitted, derived from sessionCapable:
@@ -1422,6 +1501,12 @@ interface IterationContext {
     modelConfig: ModelConfig;
     adapterFactory: LLMAdapterFactory;
     knowledgeMap?: KnowledgeMap;
+    /**
+     * The validated input for this execution, serialized. It travels here because the model gets
+     * it as its own `role:'user'` message; nothing else in this context carried it, so the input
+     * had to be read back out of memory history and shipped inside the memory block.
+     */
+    currentInput: string;
 }
 
 type Json = string | number | boolean | null | {
@@ -4168,6 +4253,7 @@ type Database = {
                     deleted_at: string | null;
                     ended_at: string | null;
                     memory_snapshot: Json;
+                    memory_version: number;
                     metadata: Json | null;
                     organization_id: string;
                     resource_id: string;
@@ -4184,6 +4270,7 @@ type Database = {
                     deleted_at?: string | null;
                     ended_at?: string | null;
                     memory_snapshot: Json;
+                    memory_version?: number;
                     metadata?: Json | null;
                     organization_id: string;
                     resource_id: string;
@@ -4200,6 +4287,7 @@ type Database = {
                     deleted_at?: string | null;
                     ended_at?: string | null;
                     memory_snapshot?: Json;
+                    memory_version?: number;
                     metadata?: Json | null;
                     organization_id?: string;
                     resource_id?: string;
@@ -4537,9 +4625,14 @@ type Database = {
                     p_session_id: string;
                 };
                 Returns: {
+                    context_window_size: number;
                     created_at: string;
+                    cumulative_input_tokens: number;
+                    cumulative_output_tokens: number;
+                    deleted_at: string;
                     ended_at: string;
                     memory_snapshot: Json;
+                    memory_version: number;
                     metadata: Json;
                     organization_id: string;
                     resource_id: string;
@@ -4581,6 +4674,18 @@ type Database = {
                 };
                 Returns: boolean;
             };
+            increment_session_tokens: {
+                Args: {
+                    p_input_tokens: number;
+                    p_output_tokens: number;
+                    p_session_id: string;
+                };
+                Returns: {
+                    context_window_size: number;
+                    cumulative_input_tokens: number;
+                    cumulative_output_tokens: number;
+                }[];
+            };
             is_org_member: {
                 Args: {
                     org_id: string;
@@ -11072,6 +11177,25 @@ declare class MetricsCollector {
     buildExecutionMetrics(metricsConfig?: ResourceMetricsConfig): ExecutionMetricsSummary;
 }
 
+/**
+ * Which `role:'user'` message slot a sanitizer warning came from, derived from the request's
+ * message array (no new plumbing from callers):
+ * - `'memory-context'` — the framework's framing message, identified by the `=== MEMORY STATUS ===`
+ *   banner. Framework-authored and trusted; it is no longer scanned at all, so this source should
+ *   not appear for agent calls. Retained because stale tenant bundles still emit the old combined
+ *   block, and their rows must stay readable.
+ * - `'data-envelope'` — the JSON envelope carrying every stored fragment. Untrusted, and the slot
+ *   where a match is genuine signal.
+ * - `'input'` — the turn's own input, on its own message. Also untrusted.
+ * - `'history'` — replayed prior turns. Untrusted, but already screened at their own front door,
+ *   so warnings here are recorded and never block (see `screenInput`).
+ */
+type InputWarningSource = 'memory-context' | 'data-envelope' | 'history' | 'input';
+/** Per-source breakdown of sanitizer warnings, so a memory-context echo is distinguishable from a genuine hit. */
+interface SourcedInputWarnings {
+    source: InputWarningSource;
+    warnings: string[];
+}
 interface BaseAICall {
     callSequence: number;
     callType: 'agent-reasoning' | 'agent-completion' | 'workflow-step' | 'tool' | 'other';
@@ -11081,6 +11205,62 @@ interface BaseAICall {
     costUsd: number;
     latencyMs: number;
     context?: AICallContext;
+    /**
+     * Distinct prompt-injection pattern types detected in the request's user-role messages.
+     * Present only when the input sanitizer matched something. Non-blocking matches ride along on
+     * the successful call's row; a blocked call records a row of its own (see `inputBlocked`).
+     *
+     * Flat union across all `role:'user'` messages — unchanged shape, kept for existing readers.
+     * See `inputWarningsBySource` for the per-slot breakdown.
+     */
+    inputWarnings?: string[];
+    /**
+     * Additive breakdown of `inputWarnings` by message slot (see `InputWarningSource`). Present only
+     * when at least one source produced a warning. Existing readers that only look at the flat
+     * `inputWarnings` array are unaffected.
+     */
+    inputWarningsBySource?: SourcedInputWarnings[];
+    /**
+     * True when the sanitizer blocked the request and no provider call was made.
+     * Such a row carries zero tokens, zero cost, and zero latency — it exists so a hard,
+     * user-visible failure is observable at all. Before this, a blocked call produced no row.
+     */
+    inputBlocked?: boolean;
+    /**
+     * The validator's message when the provider responded but its output failed `responseSchema`
+     * validation (e.g. `missing required field 'nextActions'`). Present only on such a row.
+     *
+     * This is NOT the blocked-input case: the provider DID respond and tokens WERE spent, so the row
+     * carries real `inputTokens`, `outputTokens`, cost and latency. It is a paid call that produced
+     * nothing usable, and before this it produced no row at all.
+     *
+     * One row per failed attempt — the adapter retries a validation failure up to `LLM_MAX_ATTEMPTS`,
+     * so a turn that exhausts its retries records three. Reading `inputTokens` across these rows is
+     * what measures malformed-output rate against context size rather than inferring it.
+     *
+     * Existing readers that only look at the fields above are unaffected.
+     */
+    outputValidationError?: string;
+    /**
+     * The raw model output that failed validation, JSON-stringified and truncated to a bounded
+     * length. Truncation is visible in the value itself (a trailing `…[truncated: N chars total]`),
+     * never silent. Present only alongside `outputValidationError`.
+     */
+    unvalidatedOutput?: string;
+    /**
+     * Why this call went out without `strict` structured output, on an adapter that tried to send it
+     * with one. Present ONLY on a refusal — its absence on a row from a strict-capable adapter means
+     * strict was in effect.
+     *
+     * This is the row that answers "is this agent's output actually being enforced?" without reading
+     * source. Counting rows that carry it, per resource, is the refusal count: a redeployed agent on
+     * a current bundle should read zero. It exists because the previous answer was a dev-only flow
+     * log, which meant production had no answer — and every sync-managed tenant ran unstrict against
+     * a strict-capable API until a 14-turn session surfaced a pre-strict error signature.
+     *
+     * Existing readers that only look at the fields above are unaffected.
+     */
+    strictRefusalReasons?: string[];
 }
 type AICallContext = AgentReasoningContext | AgentCompletionContext | WorkflowStepContext | ToolCallContext | OtherCallContext;
 interface AgentReasoningContext {
@@ -11126,6 +11306,18 @@ interface LLMUsageData {
     latencyMs: number;
     /** Actual cost from provider in USD (when available, e.g., OpenRouter) */
     cost?: number;
+    /** Distinct prompt-injection pattern types detected in the request's user-role messages */
+    inputWarnings?: string[];
+    /** Additive per-source breakdown of `inputWarnings` — see `SourcedInputWarnings` */
+    inputWarningsBySource?: SourcedInputWarnings[];
+    /** True when the sanitizer blocked the request and no provider call was made */
+    inputBlocked?: boolean;
+    /** Validator message when the provider responded but the output failed `responseSchema` validation */
+    outputValidationError?: string;
+    /** Raw model output that failed validation — JSON-stringified, truncated, truncation marked inline */
+    unvalidatedOutput?: string;
+    /** Why the call went out unstrict, when a strict-capable adapter refused the schema */
+    strictRefusalReasons?: string[];
 }
 interface AIUsageSummary {
     model: LLMModel;

package/dist/index.js

@@ -1472,12 +1472,7 @@ var GoogleConfigSchema = z.object({
 });
 var AnthropicOptionsSchema = z.object({}).strict();
 var AnthropicStandardConfigSchema = z.object({
-  model: z.enum([
-    "claude-sonnet-4-6",
-    "claude-haiku-4-5-20251001",
-    "claude-haiku-4-5",
-    "claude-sonnet-4-5"
-  ]),
+  model: z.enum(["claude-haiku-4-5-20251001", "claude-haiku-4-5"]),
   provider: z.literal("anthropic"),
   apiKey: z.string(),
   temperature: z.number().min(0).max(1).optional(),
@@ -1486,8 +1481,8 @@ var AnthropicStandardConfigSchema = z.object({
   topP: z.number().min(0).max(1).optional(),
   modelOptions: AnthropicOptionsSchema.optional()
 });
-var AnthropicOpus48ConfigSchema = z.object({
-  model: z.literal("claude-opus-4-8"),
+var AnthropicClaude5ConfigSchema = z.object({
+  model: z.enum(["claude-opus-5", "claude-sonnet-5"]),
   provider: z.literal("anthropic"),
   apiKey: z.string(),
   temperature: z.literal(1).optional(),
@@ -1499,7 +1494,7 @@ var AnthropicOpus48ConfigSchema = z.object({
   modelOptions: AnthropicOptionsSchema.optional()
 });
 var AnthropicConfigSchema = z.discriminatedUnion("model", [
-  AnthropicOpus48ConfigSchema,
+  AnthropicClaude5ConfigSchema,
   AnthropicStandardConfigSchema
 ]);
 var MODEL_INFO = {
@@ -1594,7 +1589,7 @@ var MODEL_INFO = {
     configSchema: GoogleConfigSchema
   },
   // Anthropic Claude Models (direct SDK access via @anthropic-ai/sdk)
-  "claude-opus-4-8": {
+  "claude-opus-5": {
     inputCostPer1M: 500,
     // $5.00 per 1M tokens
     outputCostPer1M: 2500,
@@ -1607,7 +1602,9 @@ var MODEL_INFO = {
     category: "reasoning",
     configSchema: AnthropicConfigSchema
   },
-  "claude-sonnet-4-6": {
+  "claude-sonnet-5": {
+    // List pricing. An introductory rate of $2.00/$10.00 runs through 2026-08-31; encoding the
+    // temporary rate would make historical cost analytics wrong once it lapses.
     inputCostPer1M: 300,
     // $3.00 per 1M tokens
     outputCostPer1M: 1500,
@@ -1616,7 +1613,7 @@ var MODEL_INFO = {
     recommendedTokens: 8e3,
     maxTokens: 1e6,
     // 1M context window
-    maxOutputTokens: 64e3,
+    maxOutputTokens: 128e3,
     category: "standard",
     configSchema: AnthropicConfigSchema
   },
@@ -1645,19 +1642,6 @@ var MODEL_INFO = {
     maxOutputTokens: 64e3,
     category: "standard",
     configSchema: AnthropicConfigSchema
-  },
-  "claude-sonnet-4-5": {
-    inputCostPer1M: 300,
-    // $3.00 per 1M tokens
-    outputCostPer1M: 1500,
-    // $15.00 per 1M tokens
-    minTokens: 4e3,
-    recommendedTokens: 8e3,
-    maxTokens: 2e5,
-    // 200k context window
-    maxOutputTokens: 64e3,
-    category: "standard",
-    configSchema: AnthropicConfigSchema
   }
 };
 function getModelInfo(model) {