@guuey/threads 0.7.2 → 0.8.1

package/README.md

@@ -13,8 +13,9 @@ harnesses — share it:
   latest-replace snapshot), and the prompt-lane history projection.
 - **`ThreadPersistencePort`** — the narrow surface a binding implements.
   `InMemoryThreadPersistence` ships in the box (dev, tests, CI); guuey's
-  hosted runtime binds DynamoDB; implement the port against your own store
-  for ejected deployments.
+  hosted runtime binds DynamoDB; `HttpThreadPersistence` points a
+  self-hosted agent at guuey's hosted thread API ("eject the code, keep your
+  memory"); or implement the port against your own store.
 - **fold ↔ row mapping** — `agMessageToRow`, `reassembleFold`,
   `uiCardArtifactsFromMessages` and friends: byte-identity persistence of an
   `@silverprotocol/core` `AgReduceResult`, including the projection that
@@ -48,3 +49,32 @@ const history = await store.loadHistory(threadId);
 import { runThreadPersistenceContractSuite } from "@guuey/threads/testing";
 runThreadPersistenceContractSuite("MyBinding", async () => ({ port: makeMyPort() }));
 ```
+
+## Hosted binding — keep your memory after ejecting
+
+`HttpThreadPersistence` implements the same port over guuey's thread API, so
+an agent you run yourself reads and writes the SAME conversation rows the
+hosted runtime does. It is scoped to one app and one end-user: pass the
+end-user's bearer token — one your app's configured identity issuer minted
+(your own IdP, or guuey's per-app widget issuer via `@guuey/widget-auth`).
+The server verifies it against that issuer, derives the same end-user id the
+hosted runtime uses, and confines every op to `(app, user)`.
+
+```ts
+import { HttpThreadPersistence, ThreadStore } from "@guuey/threads";
+
+const appId = process.env.GUUEY_APP_ID!;
+const port = new HttpThreadPersistence({
+  baseUrl: "https://api.us-east-1.guuey.com",
+  appId,
+  token: endUserToken, // per request — the end-user's own token
+});
+const { userId, region } = await port.scope(); // what the token resolves to
+const store = new ThreadStore(port);
+const threadId = await store.ensureThread({ threadId: clientThreadId, userId, appId, region });
+```
+
+Requires the app to run identified end-users (`userAuthMode: "byo"`); guests
+and Cognito sessions are served on-platform only. Errors surface as
+`HttpThreadStoreError` (`status`, `code`). Reads retry once on a network
+failure or 5xx; writes never do.

package/dist/http.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Hosted HTTP binding — {@link ThreadPersistencePort} over guuey's thread
+ * API, `POST <base>/v1/thread-store/<op>` (guuey#208). The "eject the code,
+ * keep your memory" leg of the ejected ladder: point a `ThreadStore` at
+ * this binding with an end-user token and your self-hosted agent reads and
+ * writes the SAME conversation rows guuey's hosted runtime does.
+ *
+ * Wire protocol (the `@guuey/state` `HttpKv` shape):
+ * - Request: JSON body `{ context: { appId }, args: {...} }`, header
+ *   `Authorization: Bearer <token>`.
+ * - Success: `200 { result }`.
+ * - Failure: `4xx/5xx { code, message }` → {@link HttpThreadStoreError}.
+ *
+ * Auth + tenancy: the token is an END-USER token for the app — one the
+ * app's configured identity issuer minted (your own IdP, or guuey's per-app
+ * widget issuer via `@guuey/widget-auth`). The server verifies it against
+ * that issuer, derives the same `byo_…` userId the hosted runtime would, and
+ * scopes every op to `(appId, userId)`: rows you write must carry that
+ * userId, threads you touch must belong to it. `context` on the wire is
+ * advisory — the token is authoritative. Call {@link scope} to learn the
+ * derived userId (and the API's region) before `ensureThread`.
+ *
+ * Retry policy: reads (`getThread`/`listRecentMessages`/
+ * `findByClientMessageId`/`getSnapshot`/`scope`) are idempotent and retried
+ * once on a network failure or a 5xx. Writes (`createThread`/`incrementSeq`/
+ * `putMessage`/`putSnapshot`) are NEVER retried automatically —
+ * `incrementSeq` is not idempotent, and a blind retry after a server-side
+ * apply would double-allocate a seq.
+ */
+import type { ThreadMessageRow, ThreadPersistencePort, ThreadRow, ThreadSnapshotRow } from "./rows.js";
+/** What the token resolves to server-side — the scope every op is bound to. */
+export interface ThreadScope {
+    appId: string;
+    /** The derived end-user id (`byo_…`) — the `userId` to build rows with. */
+    userId: string;
+    /** The API's serving region — the `region` to mint fresh threads with. */
+    region: string;
+}
+export interface HttpThreadPersistenceOptions {
+    /** API origin, e.g. `https://api.us-east-1.guuey.com` (no `/v1`). */
+    baseUrl: string;
+    /** The guuey app whose conversations these are. */
+    appId: string;
+    /** The end-user's bearer token (see the module doc). */
+    token: string;
+    /** Injection seam for tests / custom transports. Defaults to global `fetch`. */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Thrown for every non-2xx response and every exhausted network failure.
+ * `code` is the server's flat error code (`UNAUTHORIZED`, `FORBIDDEN`,
+ * `INVALID_ARGUMENT`, `INVALID_CONTEXT`, `THREAD_NOT_FOUND`, `CONFLICT`,
+ * `NOT_FOUND`, `TRANSPORT`); `status` is the HTTP status (`0` for a network
+ * failure that never produced a response).
+ */
+export declare class HttpThreadStoreError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class HttpThreadPersistence implements ThreadPersistencePort {
+    private readonly baseUrl;
+    private readonly appId;
+    private readonly token;
+    private readonly fetchImpl;
+    constructor(opts: HttpThreadPersistenceOptions);
+    /** The `(appId, userId, region)` the server bound this token to. */
+    scope(): Promise<ThreadScope>;
+    getThread(threadId: string): Promise<ThreadRow | undefined>;
+    createThread(row: ThreadRow): Promise<void>;
+    incrementSeq(threadId: string, preview: string | null, atIso: string): Promise<number>;
+    putMessage(row: ThreadMessageRow): Promise<void>;
+    listRecentMessages(threadId: string, limit: number): Promise<ThreadMessageRow[]>;
+    findByClientMessageId(threadId: string, clientMessageId: string): Promise<ThreadMessageRow | undefined>;
+    getSnapshot(threadId: string): Promise<ThreadSnapshotRow | undefined>;
+    putSnapshot(row: ThreadSnapshotRow): Promise<void>;
+    /**
+     * One shared retry budget (`retried`) covers BOTH retry triggers — a
+     * network failure and a 5xx response — so a retryable op makes at most
+     * 2 total requests, never 3.
+     */
+    private call;
+}
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EACV,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,EACT,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAEnB,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,4BAA4B;IAC3C,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAaD;;;;;;GAMG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM;gBADZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAKhC;AAgBD,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,IAAI,EAAE,4BAA4B;IAO9C,oEAAoE;IAC9D,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC;IAI7B,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;IAI3D,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAItF,UAAU,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAIhF,qBAAqB,CACzB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAUlC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAIrE,WAAW,CAAC,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxD;;;;OAIG;YACW,IAAI;CAqCnB"}

package/dist/http.js

@@ -0,0 +1,106 @@
+/**
+ * Thrown for every non-2xx response and every exhausted network failure.
+ * `code` is the server's flat error code (`UNAUTHORIZED`, `FORBIDDEN`,
+ * `INVALID_ARGUMENT`, `INVALID_CONTEXT`, `THREAD_NOT_FOUND`, `CONFLICT`,
+ * `NOT_FOUND`, `TRANSPORT`); `status` is the HTTP status (`0` for a network
+ * failure that never produced a response).
+ */
+export class HttpThreadStoreError extends Error {
+    status;
+    code;
+    constructor(status, code, message, options) {
+        super(message, options);
+        this.status = status;
+        this.code = code;
+        this.name = "HttpThreadStoreError";
+    }
+}
+async function toError(res) {
+    let body;
+    try {
+        body = (await res.json());
+    }
+    catch {
+        body = {};
+    }
+    return new HttpThreadStoreError(res.status, body.code ?? "TRANSPORT", body.message ?? `guuey thread API error (HTTP ${res.status})`);
+}
+export class HttpThreadPersistence {
+    baseUrl;
+    appId;
+    token;
+    fetchImpl;
+    constructor(opts) {
+        this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+        this.appId = opts.appId;
+        this.token = opts.token;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    /** The `(appId, userId, region)` the server bound this token to. */
+    async scope() {
+        return this.call("scope", {}, true);
+    }
+    async getThread(threadId) {
+        return (await this.call("getThread", { threadId }, true)) ?? undefined;
+    }
+    async createThread(row) {
+        await this.call("createThread", { row }, false);
+    }
+    async incrementSeq(threadId, preview, atIso) {
+        return this.call("incrementSeq", { threadId, preview, atIso }, false);
+    }
+    async putMessage(row) {
+        await this.call("putMessage", { row }, false);
+    }
+    async listRecentMessages(threadId, limit) {
+        return this.call("listRecentMessages", { threadId, limit }, true);
+    }
+    async findByClientMessageId(threadId, clientMessageId) {
+        return ((await this.call("findByClientMessageId", { threadId, clientMessageId }, true)) ?? undefined);
+    }
+    async getSnapshot(threadId) {
+        return (await this.call("getSnapshot", { threadId }, true)) ?? undefined;
+    }
+    async putSnapshot(row) {
+        await this.call("putSnapshot", { row }, false);
+    }
+    // ── internals ──────────────────────────────────────────────────────
+    /**
+     * One shared retry budget (`retried`) covers BOTH retry triggers — a
+     * network failure and a 5xx response — so a retryable op makes at most
+     * 2 total requests, never 3.
+     */
+    async call(op, args, retryable) {
+        const doOnce = async () => this.fetchImpl(`${this.baseUrl}/v1/thread-store/${op}`, {
+            method: "POST",
+            headers: {
+                "content-type": "application/json",
+                authorization: `Bearer ${this.token}`,
+            },
+            body: JSON.stringify({ context: { appId: this.appId }, args }),
+        });
+        let res;
+        let retried = false;
+        for (;;) {
+            try {
+                res = await doOnce();
+            }
+            catch (err) {
+                if (!retryable || retried) {
+                    throw new HttpThreadStoreError(0, "TRANSPORT", `network failure calling guuey thread API${retried ? " (after retry)" : ""}`, { cause: err });
+                }
+                retried = true;
+                continue;
+            }
+            if (res.status >= 500 && retryable && !retried) {
+                retried = true;
+                continue;
+            }
+            break;
+        }
+        if (!res.ok)
+            throw await toError(res);
+        const body = (await res.json());
+        return body.result;
+    }
+}

package/dist/index.d.ts

@@ -8,7 +8,9 @@
  *     (messages + card rows + snapshot), prompt-lane history.
  *   - {@link ThreadPersistencePort} — the narrow surface a binding
  *     implements. `InMemoryThreadPersistence` ships here; guuey's hosted
- *     runtime binds DynamoDB; bring your own store for ejected agents.
+ *     runtime binds DynamoDB; `HttpThreadPersistence` points an ejected
+ *     agent at guuey's hosted thread API with an end-user token ("eject
+ *     the code, keep your memory"); or bring your own store.
  *   - fold↔row mapping — `agMessageToRow`/`reassembleFold`/friends, the
  *     byte-identity persistence of an `AgReduceResult`, including the
  *     UI-card projection (`uiCardArtifactsFromMessages`, guuey#86).
@@ -18,5 +20,6 @@
 export type { StoredHistoryMessage, ThreadMessageKind, ThreadMessageRole, ThreadMessageRow, ThreadPersistencePort, ThreadRow, ThreadSnapshotRow, } from "./rows.js";
 export { ThreadStore, type AppendFoldInput, type AppendFoldResult, type AppendMessageInput, type AppendMessageResult, type EnsureThreadInput, } from "./store.js";
 export { InMemoryThreadPersistence } from "./in-memory.js";
+export { HttpThreadPersistence, HttpThreadStoreError, type HttpThreadPersistenceOptions, type ThreadScope, } from "./http.js";
 export { agArtifactToCardRow, agMessageToRow, cardRowToAgArtifact, messageText, reassembleFold, rowToAgMessage, seedEventsForReducer, uiCardArtifactsFromMessages, type RowCtx, } from "./fold-rows.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,EACT,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,MAAM,GACZ,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,SAAS,EACT,iBAAiB,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,GACvB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,4BAA4B,EACjC,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,MAAM,GACZ,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -1,3 +1,4 @@
 export { ThreadStore, } from "./store.js";
 export { InMemoryThreadPersistence } from "./in-memory.js";
+export { HttpThreadPersistence, HttpThreadStoreError, } from "./http.js";
 export { agArtifactToCardRow, agMessageToRow, cardRowToAgArtifact, messageText, reassembleFold, rowToAgMessage, seedEventsForReducer, uiCardArtifactsFromMessages, } from "./fold-rows.js";

package/dist/store.d.ts

@@ -69,6 +69,15 @@ export declare class ThreadStore {
      * client-chosen id, so squatting is impossible.
      */
     ensureThread(input: EnsureThreadInput): Promise<string>;
+    /**
+     * Whether `threadId` exists AND is owned by `userId` — the SAME ownership
+     * predicate `ensureThread` applies before honouring a client-replayed id,
+     * exposed for doors that must BIND a client-echoed thread to the verified
+     * caller without minting anything (the pod's consent-answer door binds a
+     * `once` grant to a thread this way — guuey#207). No existence oracle: a
+     * missing thread and another user's thread are the same `false`.
+     */
+    ownsThread(threadId: string, userId: string): Promise<boolean>;
     /** Prior messages for the thread (seq-ASC, capped to the most recent N). */
     loadHistory(threadId: string, limit?: number): Promise<StoredHistoryMessage[]>;
     /**

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EAEjB,qBAAqB,EAErB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAOnB,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,CAAC;IACxB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB,2EAA2E;IAC3E,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kEAAkE;IAClE,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAMD,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,qBAAqB;IAEtD;;;;;;;;;;;;;OAaG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IA4B7D,4EAA4E;IACtE,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,MAA8B,GACpC,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAqBlC;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4B5E,+EAA+E;IACzE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAI3E;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA8EpE"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EAEjB,qBAAqB,EAErB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAOnB,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,CAAC;IACxB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB,2EAA2E;IAC3E,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kEAAkE;IAClE,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB;AAMD,qBAAa,WAAW;IACV,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,qBAAqB;IAEtD;;;;;;;;;;;;;OAaG;IACG,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;IA4B7D;;;;;;;OAOG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpE,4EAA4E;IACtE,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,KAAK,GAAE,MAA8B,GACpC,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAqBlC;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA4B5E,+EAA+E;IACzE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAI3E;;;;;;;;;;;;;;;;;OAiBG;IACG,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA8EpE"}

package/dist/store.js

@@ -61,6 +61,18 @@ export class ThreadStore {
         await this.db.createThread(row);
         return row.id;
     }
+    /**
+     * Whether `threadId` exists AND is owned by `userId` — the SAME ownership
+     * predicate `ensureThread` applies before honouring a client-replayed id,
+     * exposed for doors that must BIND a client-echoed thread to the verified
+     * caller without minting anything (the pod's consent-answer door binds a
+     * `once` grant to a thread this way — guuey#207). No existence oracle: a
+     * missing thread and another user's thread are the same `false`.
+     */
+    async ownsThread(threadId, userId) {
+        const existing = await this.db.getThread(threadId);
+        return existing !== undefined && existing.userId === userId;
+    }
     /** Prior messages for the thread (seq-ASC, capped to the most recent N). */
     async loadHistory(threadId, limit = DEFAULT_HISTORY_LIMIT) {
         const rows = await this.db.listRecentMessages(threadId, limit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/threads",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "Universal session/thread persistence for AgJSON agents — the ThreadStore contract (append-fold, history, snapshots), the fold↔row mapping, and an in-memory binding. Guuey's hosted runtime is one binding; implement the port against your own store and run the exported contract suite for the same guarantees.",
   "license": "MIT",
   "type": "module",
@@ -23,7 +23,7 @@
   },
   "dependencies": {
     "@silverprotocol/core": "0.5.0",
-    "@guuey/mcp-apps-host": "0.7.2"
+    "@guuey/mcp-apps-host": "0.8.1"
   },
   "devDependencies": {
     "@types/node": "^24.0.0",