@elevasis/sdk 1.39.0 → 1.41.0

package/dist/node/index.d.ts

@@ -296,7 +296,7 @@ type GoogleModel = 'gemini-3-flash-preview' | 'gemini-3.1-flash-lite-preview';
 /**
  * Supported Anthropic models (direct SDK access via @anthropic-ai/sdk)
  */
-type AnthropicModel = 'claude-opus-4-8' | 'claude-sonnet-4-6' | 'claude-haiku-4-5-20251001' | 'claude-haiku-4-5' | 'claude-sonnet-4-5';
+type AnthropicModel = 'claude-opus-5' | 'claude-sonnet-5' | 'claude-haiku-4-5-20251001' | 'claude-haiku-4-5';
 /** Supported LLM models */
 type LLMModel = OpenAIModel | OpenRouterModel | GoogleModel | AnthropicModel | 'mock';
 /**
@@ -932,6 +932,20 @@ interface LLMGenerateResponse<T = unknown> {
         totalTokens: number;
     };
     cost?: number;
+    /**
+     * Why this call went out WITHOUT `strict`, on an adapter that tried to send it with one.
+     *
+     * Present only on a refusal, so absence means either "strict was in effect" or "this adapter
+     * does not attempt strict at all" — the two are distinguished by which adapter answered, not by
+     * this field. `toStrictSchema` already computes these reasons and, until now, nothing consumed
+     * them at the call site: an unstrict call was indistinguishable from a strict one anywhere
+     * outside a dev-only flow log. That invisibility is what let every tenant run unstrict against a
+     * strict-capable API for as long as it took someone to recognise a pre-strict error signature.
+     *
+     * Internal-only, like `usage` — `UniversalLLMAdapter` lifts it onto the `ai_calls` row and
+     * strips it before the response reaches callers.
+     */
+    strictRefusalReasons?: string[];
 }
 /**
  * LLM Adapter interface
@@ -963,6 +977,14 @@ interface LLMAdapter {
  * Memory types mirror action types for clarity and filtering
  */
 type MemoryEntryType = 'context' | 'input' | 'reasoning' | 'tool-result' | 'delegation-result' | 'error';
+/**
+ * Who authored an entry's content.
+ *
+ * This is what lets the assembled prompt tell framework-authored text apart from text that
+ * originated outside the trust boundary. `'framework'` content is ours; the other three are not
+ * and are rendered inside the JSON data envelope (see `MemoryManager.toContextParts`).
+ */
+type MemoryEntrySource = 'framework' | 'user' | 'tool' | 'model';
 /**
  * Memory entry - represents a single entry in agent memory
  * Stored in agent memory, translated by adapters to vendor-specific formats
@@ -973,6 +995,16 @@ interface MemoryEntry {
     timestamp: number;
     turnNumber: number | null;
     iterationNumber: number | null;
+    /**
+     * Provenance. **Optional on purpose** — `undefined` means unknown, which is what every
+     * pre-existing snapshot and every not-yet-redeployed tenant bundle produces. Read sites MUST
+     * test `== null`, never `=== undefined`: the `inTurnScope` predicate in `manager.ts` is the
+     * cautionary precedent, where a `=== undefined` check silently dropped every `null`-stamped
+     * entry. `isMemoryEntry` is deliberately NOT tightened to require this field; doing so would
+     * make every stored snapshot fail validation, and `restoreSessionMemory` fails open by
+     * starting the agent with empty memory rather than throwing.
+     */
+    source?: MemoryEntrySource;
 }
 /**
  * Agent memory - Self-orchestrated memory with session + working storage
@@ -1000,8 +1032,17 @@ interface MemoryStatus {
     sessionMemoryKeys: number;
     sessionMemoryLimit: number;
     currentKeys: string[];
+    sessionMemoryTokens: number;
+    sessionMemoryTokenLimit: number;
+    /**
+     * History tokens as a percentage of `historyBudget` — history ALONE, not history plus session
+     * memory. It previously reported the combined total under this name, so session memory growth
+     * read as history pressure and triggered history compaction that could not relieve it.
+     */
     historyPercent: number;
     historyTokens: number;
+    historyBudget: number;
+    totalTokens: number;
     tokenBudget: number;
 }
 /**
@@ -1018,6 +1059,20 @@ interface MemoryConstraints {
  * Agent provides strings, framework handles wrapping and auto-compaction
  */
 
+/**
+ * The framework's own framing message and the untrusted data envelope, as separate strings.
+ *
+ * They are separate because the model must be able to tell them apart, and so must the input
+ * sanitizer: the framing is framework-authored and trusted, the envelope is not. Concatenating
+ * them — which is what this replaced — made that distinction undecidable at the adapter and left
+ * the framework's own section headers inside the region scanned for delimiter injection.
+ */
+interface MemoryContextParts {
+    /** Framework-authored. Memory status and a description of the envelope. Carries NO stored content. */
+    framing: string;
+    /** Every stored fragment, JSON-encoded and source-tagged. Untrusted. */
+    dataEnvelope: string;
+}
 /**
  * Memory Manager - Agent memory orchestration
  * Provides ultra-simple API for agents (strings only)
@@ -1034,7 +1089,7 @@ declare class MemoryManager {
      * @param key - Session memory key
      * @param content - String content from agent
      */
-    set(key: string, content: string): void;
+    set(key: string, content: string, source?: MemoryEntrySource): void;
     /**
      * Get session memory entry content
      * @param key - Session memory key
@@ -1063,6 +1118,15 @@ declare class MemoryManager {
      * Emergency fallback if agent exceeds limits
      */
     enforceHardLimits(): void;
+    /**
+     * Evict oldest session memory entries until the pool fits its token limit.
+     *
+     * Key count and token count are different constraints: 25 short keys are fine, 25 large ones
+     * are not. Eviction is oldest-first by timestamp, matching the key-count path, and always
+     * leaves at least one entry so a single oversized key degrades to "one key" rather than to
+     * "memory silently emptied".
+     */
+    private enforceSessionMemoryTokenLimit;
     /**
      * Get history length (for logging and introspection)
      * @returns Number of entries in history
@@ -1086,14 +1150,29 @@ declare class MemoryManager {
      */
     getSnapshot(): AgentMemory | undefined;
     /**
-     * Build context string for LLM
-     * Serializes sessionmemory + history memory with clear sections
-     * Shows current iteration entries FIRST (reverse chronological) for LLM attention
+     * Build the framework framing and the untrusted data envelope for an LLM call.
+     *
+     * These are two separate strings because they are two different trust levels, and they used to
+     * be one. Concatenated, the framework's own `=== ... ===` section headers sat in the same string
+     * as stored tool output and user text, so the input sanitizer matched its own scaffolding on
+     * every call and nothing downstream could tell which half a match came from. Splitting them
+     * makes that distinction structural: the framing is ours, the envelope is not.
+     *
+     * The envelope is JSON, which additionally neutralizes the anchored-delimiter attack class —
+     * `JSON.stringify` escapes newlines, so a stored fragment cannot produce a line that starts
+     * with `===` no matter what it contains.
+     *
+     * The current turn's own input is deliberately NOT in either string. It travels as its own
+     * `role:'user'` message (see `buildAgentMessages`), which is the whole point: a model asked to
+     * treat "everything in this block" as data was also being handed the live question inside that
+     * block.
+     *
+     * Shows current iteration entries FIRST (reverse chronological) for LLM attention.
+     *
      * @param currentIteration - Current iteration number (0 = pre-iteration)
      * @param currentTurn - Current turn number (optional, for session context filtering)
-     * @returns Formatted memory context for LLM prompt
      */
-    toContext(currentIteration: number, currentTurn?: number): string;
+    toContextParts(currentIteration: number, currentTurn?: number): MemoryContextParts;
 }
 
 /**
@@ -1215,7 +1294,7 @@ interface AgentConfig extends ResourceDefinition {
      * Security level for system prompt hardening (auto-derived if omitted)
      *
      * - 'standard': Lightweight defense (3 rules) - default for non-session agents
-     * - 'hardened': Comprehensive defense (6 rules) - default for session-capable agents
+     * - 'hardened': Comprehensive defense (5 rules) - default for session-capable agents
      * - 'none': No security prompt - for pure internal agents with no external input
      *
      * If omitted, derived from sessionCapable:
@@ -1292,6 +1371,12 @@ interface IterationContext {
     modelConfig: ModelConfig;
     adapterFactory: LLMAdapterFactory;
     knowledgeMap?: KnowledgeMap;
+    /**
+     * The validated input for this execution, serialized. It travels here because the model gets
+     * it as its own `role:'user'` message; nothing else in this context carried it, so the input
+     * had to be read back out of memory history and shipped inside the memory block.
+     */
+    currentInput: string;
 }
 
 declare const OntologyScopeSchema: z.ZodDefault<z.ZodObject<{
@@ -2593,6 +2678,25 @@ declare class MetricsCollector {
     buildExecutionMetrics(metricsConfig?: ResourceMetricsConfig): ExecutionMetricsSummary;
 }
 
+/**
+ * Which `role:'user'` message slot a sanitizer warning came from, derived from the request's
+ * message array (no new plumbing from callers):
+ * - `'memory-context'` — the framework's framing message, identified by the `=== MEMORY STATUS ===`
+ *   banner. Framework-authored and trusted; it is no longer scanned at all, so this source should
+ *   not appear for agent calls. Retained because stale tenant bundles still emit the old combined
+ *   block, and their rows must stay readable.
+ * - `'data-envelope'` — the JSON envelope carrying every stored fragment. Untrusted, and the slot
+ *   where a match is genuine signal.
+ * - `'input'` — the turn's own input, on its own message. Also untrusted.
+ * - `'history'` — replayed prior turns. Untrusted, but already screened at their own front door,
+ *   so warnings here are recorded and never block (see `screenInput`).
+ */
+type InputWarningSource = 'memory-context' | 'data-envelope' | 'history' | 'input';
+/** Per-source breakdown of sanitizer warnings, so a memory-context echo is distinguishable from a genuine hit. */
+interface SourcedInputWarnings {
+    source: InputWarningSource;
+    warnings: string[];
+}
 interface BaseAICall {
     callSequence: number;
     callType: 'agent-reasoning' | 'agent-completion' | 'workflow-step' | 'tool' | 'other';
@@ -2602,6 +2706,62 @@ interface BaseAICall {
     costUsd: number;
     latencyMs: number;
     context?: AICallContext;
+    /**
+     * Distinct prompt-injection pattern types detected in the request's user-role messages.
+     * Present only when the input sanitizer matched something. Non-blocking matches ride along on
+     * the successful call's row; a blocked call records a row of its own (see `inputBlocked`).
+     *
+     * Flat union across all `role:'user'` messages — unchanged shape, kept for existing readers.
+     * See `inputWarningsBySource` for the per-slot breakdown.
+     */
+    inputWarnings?: string[];
+    /**
+     * Additive breakdown of `inputWarnings` by message slot (see `InputWarningSource`). Present only
+     * when at least one source produced a warning. Existing readers that only look at the flat
+     * `inputWarnings` array are unaffected.
+     */
+    inputWarningsBySource?: SourcedInputWarnings[];
+    /**
+     * True when the sanitizer blocked the request and no provider call was made.
+     * Such a row carries zero tokens, zero cost, and zero latency — it exists so a hard,
+     * user-visible failure is observable at all. Before this, a blocked call produced no row.
+     */
+    inputBlocked?: boolean;
+    /**
+     * The validator's message when the provider responded but its output failed `responseSchema`
+     * validation (e.g. `missing required field 'nextActions'`). Present only on such a row.
+     *
+     * This is NOT the blocked-input case: the provider DID respond and tokens WERE spent, so the row
+     * carries real `inputTokens`, `outputTokens`, cost and latency. It is a paid call that produced
+     * nothing usable, and before this it produced no row at all.
+     *
+     * One row per failed attempt — the adapter retries a validation failure up to `LLM_MAX_ATTEMPTS`,
+     * so a turn that exhausts its retries records three. Reading `inputTokens` across these rows is
+     * what measures malformed-output rate against context size rather than inferring it.
+     *
+     * Existing readers that only look at the fields above are unaffected.
+     */
+    outputValidationError?: string;
+    /**
+     * The raw model output that failed validation, JSON-stringified and truncated to a bounded
+     * length. Truncation is visible in the value itself (a trailing `…[truncated: N chars total]`),
+     * never silent. Present only alongside `outputValidationError`.
+     */
+    unvalidatedOutput?: string;
+    /**
+     * Why this call went out without `strict` structured output, on an adapter that tried to send it
+     * with one. Present ONLY on a refusal — its absence on a row from a strict-capable adapter means
+     * strict was in effect.
+     *
+     * This is the row that answers "is this agent's output actually being enforced?" without reading
+     * source. Counting rows that carry it, per resource, is the refusal count: a redeployed agent on
+     * a current bundle should read zero. It exists because the previous answer was a dev-only flow
+     * log, which meant production had no answer — and every sync-managed tenant ran unstrict against
+     * a strict-capable API until a 14-turn session surfaced a pre-strict error signature.
+     *
+     * Existing readers that only look at the fields above are unaffected.
+     */
+    strictRefusalReasons?: string[];
 }
 type AICallContext = AgentReasoningContext | AgentCompletionContext | WorkflowStepContext | ToolCallContext | OtherCallContext;
 interface AgentReasoningContext {
@@ -2647,6 +2807,18 @@ interface LLMUsageData {
     latencyMs: number;
     /** Actual cost from provider in USD (when available, e.g., OpenRouter) */
     cost?: number;
+    /** Distinct prompt-injection pattern types detected in the request's user-role messages */
+    inputWarnings?: string[];
+    /** Additive per-source breakdown of `inputWarnings` — see `SourcedInputWarnings` */
+    inputWarningsBySource?: SourcedInputWarnings[];
+    /** True when the sanitizer blocked the request and no provider call was made */
+    inputBlocked?: boolean;
+    /** Validator message when the provider responded but the output failed `responseSchema` validation */
+    outputValidationError?: string;
+    /** Raw model output that failed validation — JSON-stringified, truncated, truncation marked inline */
+    unvalidatedOutput?: string;
+    /** Why the call went out unstrict, when a strict-capable adapter refused the schema */
+    strictRefusalReasons?: string[];
 }
 interface AIUsageSummary {
     model: LLMModel;

package/dist/test-utils/index.d.ts

@@ -259,7 +259,7 @@ type GoogleModel = 'gemini-3-flash-preview' | 'gemini-3.1-flash-lite-preview';
 /**
  * Supported Anthropic models (direct SDK access via @anthropic-ai/sdk)
  */
-type AnthropicModel = 'claude-opus-4-8' | 'claude-sonnet-4-6' | 'claude-haiku-4-5-20251001' | 'claude-haiku-4-5' | 'claude-sonnet-4-5';
+type AnthropicModel = 'claude-opus-5' | 'claude-sonnet-5' | 'claude-haiku-4-5-20251001' | 'claude-haiku-4-5';
 /** Supported LLM models */
 type LLMModel = OpenAIModel | OpenRouterModel | GoogleModel | AnthropicModel | 'mock';
 /**
@@ -895,6 +895,20 @@ interface LLMGenerateResponse<T = unknown> {
         totalTokens: number;
     };
     cost?: number;
+    /**
+     * Why this call went out WITHOUT `strict`, on an adapter that tried to send it with one.
+     *
+     * Present only on a refusal, so absence means either "strict was in effect" or "this adapter
+     * does not attempt strict at all" — the two are distinguished by which adapter answered, not by
+     * this field. `toStrictSchema` already computes these reasons and, until now, nothing consumed
+     * them at the call site: an unstrict call was indistinguishable from a strict one anywhere
+     * outside a dev-only flow log. That invisibility is what let every tenant run unstrict against a
+     * strict-capable API for as long as it took someone to recognise a pre-strict error signature.
+     *
+     * Internal-only, like `usage` — `UniversalLLMAdapter` lifts it onto the `ai_calls` row and
+     * strips it before the response reaches callers.
+     */
+    strictRefusalReasons?: string[];
 }
 /**
  * LLM Adapter interface
@@ -926,6 +940,14 @@ interface LLMAdapter {
  * Memory types mirror action types for clarity and filtering
  */
 type MemoryEntryType = 'context' | 'input' | 'reasoning' | 'tool-result' | 'delegation-result' | 'error';
+/**
+ * Who authored an entry's content.
+ *
+ * This is what lets the assembled prompt tell framework-authored text apart from text that
+ * originated outside the trust boundary. `'framework'` content is ours; the other three are not
+ * and are rendered inside the JSON data envelope (see `MemoryManager.toContextParts`).
+ */
+type MemoryEntrySource = 'framework' | 'user' | 'tool' | 'model';
 /**
  * Memory entry - represents a single entry in agent memory
  * Stored in agent memory, translated by adapters to vendor-specific formats
@@ -936,6 +958,16 @@ interface MemoryEntry {
     timestamp: number;
     turnNumber: number | null;
     iterationNumber: number | null;
+    /**
+     * Provenance. **Optional on purpose** — `undefined` means unknown, which is what every
+     * pre-existing snapshot and every not-yet-redeployed tenant bundle produces. Read sites MUST
+     * test `== null`, never `=== undefined`: the `inTurnScope` predicate in `manager.ts` is the
+     * cautionary precedent, where a `=== undefined` check silently dropped every `null`-stamped
+     * entry. `isMemoryEntry` is deliberately NOT tightened to require this field; doing so would
+     * make every stored snapshot fail validation, and `restoreSessionMemory` fails open by
+     * starting the agent with empty memory rather than throwing.
+     */
+    source?: MemoryEntrySource;
 }
 /**
  * Agent memory - Self-orchestrated memory with session + working storage
@@ -963,8 +995,17 @@ interface MemoryStatus {
     sessionMemoryKeys: number;
     sessionMemoryLimit: number;
     currentKeys: string[];
+    sessionMemoryTokens: number;
+    sessionMemoryTokenLimit: number;
+    /**
+     * History tokens as a percentage of `historyBudget` — history ALONE, not history plus session
+     * memory. It previously reported the combined total under this name, so session memory growth
+     * read as history pressure and triggered history compaction that could not relieve it.
+     */
     historyPercent: number;
     historyTokens: number;
+    historyBudget: number;
+    totalTokens: number;
     tokenBudget: number;
 }
 /**
@@ -981,6 +1022,20 @@ interface MemoryConstraints {
  * Agent provides strings, framework handles wrapping and auto-compaction
  */
 
+/**
+ * The framework's own framing message and the untrusted data envelope, as separate strings.
+ *
+ * They are separate because the model must be able to tell them apart, and so must the input
+ * sanitizer: the framing is framework-authored and trusted, the envelope is not. Concatenating
+ * them — which is what this replaced — made that distinction undecidable at the adapter and left
+ * the framework's own section headers inside the region scanned for delimiter injection.
+ */
+interface MemoryContextParts {
+    /** Framework-authored. Memory status and a description of the envelope. Carries NO stored content. */
+    framing: string;
+    /** Every stored fragment, JSON-encoded and source-tagged. Untrusted. */
+    dataEnvelope: string;
+}
 /**
  * Memory Manager - Agent memory orchestration
  * Provides ultra-simple API for agents (strings only)
@@ -997,7 +1052,7 @@ declare class MemoryManager {
      * @param key - Session memory key
      * @param content - String content from agent
      */
-    set(key: string, content: string): void;
+    set(key: string, content: string, source?: MemoryEntrySource): void;
     /**
      * Get session memory entry content
      * @param key - Session memory key
@@ -1026,6 +1081,15 @@ declare class MemoryManager {
      * Emergency fallback if agent exceeds limits
      */
     enforceHardLimits(): void;
+    /**
+     * Evict oldest session memory entries until the pool fits its token limit.
+     *
+     * Key count and token count are different constraints: 25 short keys are fine, 25 large ones
+     * are not. Eviction is oldest-first by timestamp, matching the key-count path, and always
+     * leaves at least one entry so a single oversized key degrades to "one key" rather than to
+     * "memory silently emptied".
+     */
+    private enforceSessionMemoryTokenLimit;
     /**
      * Get history length (for logging and introspection)
      * @returns Number of entries in history
@@ -1049,14 +1113,29 @@ declare class MemoryManager {
      */
     getSnapshot(): AgentMemory | undefined;
     /**
-     * Build context string for LLM
-     * Serializes sessionmemory + history memory with clear sections
-     * Shows current iteration entries FIRST (reverse chronological) for LLM attention
+     * Build the framework framing and the untrusted data envelope for an LLM call.
+     *
+     * These are two separate strings because they are two different trust levels, and they used to
+     * be one. Concatenated, the framework's own `=== ... ===` section headers sat in the same string
+     * as stored tool output and user text, so the input sanitizer matched its own scaffolding on
+     * every call and nothing downstream could tell which half a match came from. Splitting them
+     * makes that distinction structural: the framing is ours, the envelope is not.
+     *
+     * The envelope is JSON, which additionally neutralizes the anchored-delimiter attack class —
+     * `JSON.stringify` escapes newlines, so a stored fragment cannot produce a line that starts
+     * with `===` no matter what it contains.
+     *
+     * The current turn's own input is deliberately NOT in either string. It travels as its own
+     * `role:'user'` message (see `buildAgentMessages`), which is the whole point: a model asked to
+     * treat "everything in this block" as data was also being handed the live question inside that
+     * block.
+     *
+     * Shows current iteration entries FIRST (reverse chronological) for LLM attention.
+     *
      * @param currentIteration - Current iteration number (0 = pre-iteration)
      * @param currentTurn - Current turn number (optional, for session context filtering)
-     * @returns Formatted memory context for LLM prompt
      */
-    toContext(currentIteration: number, currentTurn?: number): string;
+    toContextParts(currentIteration: number, currentTurn?: number): MemoryContextParts;
 }
 
 /**
@@ -1178,7 +1257,7 @@ interface AgentConfig extends ResourceDefinition {
      * Security level for system prompt hardening (auto-derived if omitted)
      *
      * - 'standard': Lightweight defense (3 rules) - default for non-session agents
-     * - 'hardened': Comprehensive defense (6 rules) - default for session-capable agents
+     * - 'hardened': Comprehensive defense (5 rules) - default for session-capable agents
      * - 'none': No security prompt - for pure internal agents with no external input
      *
      * If omitted, derived from sessionCapable:
@@ -1255,6 +1334,12 @@ interface IterationContext {
     modelConfig: ModelConfig;
     adapterFactory: LLMAdapterFactory;
     knowledgeMap?: KnowledgeMap;
+    /**
+     * The validated input for this execution, serialized. It travels here because the model gets
+     * it as its own `role:'user'` message; nothing else in this context carried it, so the input
+     * had to be read back out of memory history and shipped inside the memory block.
+     */
+    currentInput: string;
 }
 
 type Json = string | number | boolean | null | {
@@ -4001,6 +4086,7 @@ type Database = {
                     deleted_at: string | null;
                     ended_at: string | null;
                     memory_snapshot: Json;
+                    memory_version: number;
                     metadata: Json | null;
                     organization_id: string;
                     resource_id: string;
@@ -4017,6 +4103,7 @@ type Database = {
                     deleted_at?: string | null;
                     ended_at?: string | null;
                     memory_snapshot: Json;
+                    memory_version?: number;
                     metadata?: Json | null;
                     organization_id: string;
                     resource_id: string;
@@ -4033,6 +4120,7 @@ type Database = {
                     deleted_at?: string | null;
                     ended_at?: string | null;
                     memory_snapshot?: Json;
+                    memory_version?: number;
                     metadata?: Json | null;
                     organization_id?: string;
                     resource_id?: string;
@@ -4370,9 +4458,14 @@ type Database = {
                     p_session_id: string;
                 };
                 Returns: {
+                    context_window_size: number;
                     created_at: string;
+                    cumulative_input_tokens: number;
+                    cumulative_output_tokens: number;
+                    deleted_at: string;
                     ended_at: string;
                     memory_snapshot: Json;
+                    memory_version: number;
                     metadata: Json;
                     organization_id: string;
                     resource_id: string;
@@ -4414,6 +4507,18 @@ type Database = {
                 };
                 Returns: boolean;
             };
+            increment_session_tokens: {
+                Args: {
+                    p_input_tokens: number;
+                    p_output_tokens: number;
+                    p_session_id: string;
+                };
+                Returns: {
+                    context_window_size: number;
+                    cumulative_input_tokens: number;
+                    cumulative_output_tokens: number;
+                }[];
+            };
             is_org_member: {
                 Args: {
                     org_id: string;
@@ -10146,6 +10251,25 @@ declare class MetricsCollector {
     buildExecutionMetrics(metricsConfig?: ResourceMetricsConfig): ExecutionMetricsSummary;
 }
 
+/**
+ * Which `role:'user'` message slot a sanitizer warning came from, derived from the request's
+ * message array (no new plumbing from callers):
+ * - `'memory-context'` — the framework's framing message, identified by the `=== MEMORY STATUS ===`
+ *   banner. Framework-authored and trusted; it is no longer scanned at all, so this source should
+ *   not appear for agent calls. Retained because stale tenant bundles still emit the old combined
+ *   block, and their rows must stay readable.
+ * - `'data-envelope'` — the JSON envelope carrying every stored fragment. Untrusted, and the slot
+ *   where a match is genuine signal.
+ * - `'input'` — the turn's own input, on its own message. Also untrusted.
+ * - `'history'` — replayed prior turns. Untrusted, but already screened at their own front door,
+ *   so warnings here are recorded and never block (see `screenInput`).
+ */
+type InputWarningSource = 'memory-context' | 'data-envelope' | 'history' | 'input';
+/** Per-source breakdown of sanitizer warnings, so a memory-context echo is distinguishable from a genuine hit. */
+interface SourcedInputWarnings {
+    source: InputWarningSource;
+    warnings: string[];
+}
 interface BaseAICall {
     callSequence: number;
     callType: 'agent-reasoning' | 'agent-completion' | 'workflow-step' | 'tool' | 'other';
@@ -10155,6 +10279,62 @@ interface BaseAICall {
     costUsd: number;
     latencyMs: number;
     context?: AICallContext;
+    /**
+     * Distinct prompt-injection pattern types detected in the request's user-role messages.
+     * Present only when the input sanitizer matched something. Non-blocking matches ride along on
+     * the successful call's row; a blocked call records a row of its own (see `inputBlocked`).
+     *
+     * Flat union across all `role:'user'` messages — unchanged shape, kept for existing readers.
+     * See `inputWarningsBySource` for the per-slot breakdown.
+     */
+    inputWarnings?: string[];
+    /**
+     * Additive breakdown of `inputWarnings` by message slot (see `InputWarningSource`). Present only
+     * when at least one source produced a warning. Existing readers that only look at the flat
+     * `inputWarnings` array are unaffected.
+     */
+    inputWarningsBySource?: SourcedInputWarnings[];
+    /**
+     * True when the sanitizer blocked the request and no provider call was made.
+     * Such a row carries zero tokens, zero cost, and zero latency — it exists so a hard,
+     * user-visible failure is observable at all. Before this, a blocked call produced no row.
+     */
+    inputBlocked?: boolean;
+    /**
+     * The validator's message when the provider responded but its output failed `responseSchema`
+     * validation (e.g. `missing required field 'nextActions'`). Present only on such a row.
+     *
+     * This is NOT the blocked-input case: the provider DID respond and tokens WERE spent, so the row
+     * carries real `inputTokens`, `outputTokens`, cost and latency. It is a paid call that produced
+     * nothing usable, and before this it produced no row at all.
+     *
+     * One row per failed attempt — the adapter retries a validation failure up to `LLM_MAX_ATTEMPTS`,
+     * so a turn that exhausts its retries records three. Reading `inputTokens` across these rows is
+     * what measures malformed-output rate against context size rather than inferring it.
+     *
+     * Existing readers that only look at the fields above are unaffected.
+     */
+    outputValidationError?: string;
+    /**
+     * The raw model output that failed validation, JSON-stringified and truncated to a bounded
+     * length. Truncation is visible in the value itself (a trailing `…[truncated: N chars total]`),
+     * never silent. Present only alongside `outputValidationError`.
+     */
+    unvalidatedOutput?: string;
+    /**
+     * Why this call went out without `strict` structured output, on an adapter that tried to send it
+     * with one. Present ONLY on a refusal — its absence on a row from a strict-capable adapter means
+     * strict was in effect.
+     *
+     * This is the row that answers "is this agent's output actually being enforced?" without reading
+     * source. Counting rows that carry it, per resource, is the refusal count: a redeployed agent on
+     * a current bundle should read zero. It exists because the previous answer was a dev-only flow
+     * log, which meant production had no answer — and every sync-managed tenant ran unstrict against
+     * a strict-capable API until a 14-turn session surfaced a pre-strict error signature.
+     *
+     * Existing readers that only look at the fields above are unaffected.
+     */
+    strictRefusalReasons?: string[];
 }
 type AICallContext = AgentReasoningContext | AgentCompletionContext | WorkflowStepContext | ToolCallContext | OtherCallContext;
 interface AgentReasoningContext {
@@ -10200,6 +10380,18 @@ interface LLMUsageData {
     latencyMs: number;
     /** Actual cost from provider in USD (when available, e.g., OpenRouter) */
     cost?: number;
+    /** Distinct prompt-injection pattern types detected in the request's user-role messages */
+    inputWarnings?: string[];
+    /** Additive per-source breakdown of `inputWarnings` — see `SourcedInputWarnings` */
+    inputWarningsBySource?: SourcedInputWarnings[];
+    /** True when the sanitizer blocked the request and no provider call was made */
+    inputBlocked?: boolean;
+    /** Validator message when the provider responded but the output failed `responseSchema` validation */
+    outputValidationError?: string;
+    /** Raw model output that failed validation — JSON-stringified, truncated, truncation marked inline */
+    unvalidatedOutput?: string;
+    /** Why the call went out unstrict, when a strict-capable adapter refused the schema */
+    strictRefusalReasons?: string[];
 }
 interface AIUsageSummary {
     model: LLMModel;