@inkeep/agents-api 0.0.0-dev-20260320143859 → 0.0.0-dev-20260320150253

package/dist/domains/run/services/blob-storage/{external-image-downloader.js → external-file-downloader.js}

@@ -1,12 +1,12 @@
-import { EXTERNAL_FETCH_TIMEOUT_MS, MAX_EXTERNAL_IMAGE_BYTES, MAX_EXTERNAL_REDIRECTS } from "./image-security-constants.js";
-import { BlockedConnectionToPrivateIpError, BlockedExternalImageExceedingError, BlockedExternalImageLargerThanError, ExternalImageResponseBodyEmptyError, FailedToDownloadError, ImageSecurityError, RedirectMissingLocationError, TimedOutDownloadingError, TooManyRedirectsError, UnableToResolveHostError, UnexpectedRedirectStateError } from "./image-security-errors.js";
-import { resolveDownloadedImageMimeType } from "./image-content-security.js";
-import { isBlockedIpAddress, validateExternalImageUrl, validateUrlResolvesToPublicIp } from "./image-url-security.js";
+import { EXTERNAL_FETCH_TIMEOUT_MS, MAX_EXTERNAL_REDIRECTS, MAX_FILE_BYTES } from "./file-security-constants.js";
+import { BlockedConnectionToPrivateIpError, BlockedExternalFileExceedingError, BlockedExternalFileLargerThanError, ExternalFileResponseBodyEmptyError, FailedToDownloadError, FileSecurityError, RedirectMissingLocationError, TimedOutDownloadingError, TooManyRedirectsError, UnableToResolveHostError, UnexpectedRedirectStateError } from "./file-security-errors.js";
+import { resolveDownloadedImageMimeType } from "./file-content-security.js";
+import { isBlockedIpAddress, validateExternalFileUrl, validateUrlResolvesToPublicIp } from "./file-url-security.js";
 import { retryWithBackoff } from "@inkeep/agents-core";
 import { lookup } from "node:dns";
 import { Agent } from "undici";
 
-//#region src/domains/run/services/blob-storage/external-image-downloader.ts
+//#region src/domains/run/services/blob-storage/external-file-downloader.ts
 const externalImageDispatcher = new Agent({ connect: { lookup(hostname, options, callback) {
 	lookup(hostname, options, (error, address, family) => {
 		if (error) {
@@ -34,8 +34,8 @@ const externalImageDispatcher = new Agent({ connect: { lookup(hostname, options,
 	});
 } } });
 const MAX_EXTERNAL_FETCH_ATTEMPTS = 3;
-async function downloadExternalImage(url) {
-	let currentUrl = validateExternalImageUrl(url);
+async function downloadExternalFile(url) {
+	let currentUrl = validateExternalFileUrl(url);
 	await validateUrlResolvesToPublicIp(currentUrl);
 	for (let redirectCount = 0; redirectCount <= MAX_EXTERNAL_REDIRECTS; redirectCount++) {
 		const response = await fetchWithRetry(currentUrl);
@@ -43,15 +43,15 @@ async function downloadExternalImage(url) {
 			const location = response.headers.get("location");
 			if (!location) throw new RedirectMissingLocationError(toSanitizedUrl(currentUrl));
 			if (redirectCount === MAX_EXTERNAL_REDIRECTS) throw new TooManyRedirectsError(toSanitizedUrl(url));
-			currentUrl = validateExternalImageUrl(new URL(location, currentUrl).toString());
+			currentUrl = validateExternalFileUrl(new URL(location, currentUrl).toString());
 			await validateUrlResolvesToPublicIp(currentUrl);
 			continue;
 		}
 		if (!response.ok) throw new FailedToDownloadError(toSanitizedUrl(currentUrl), `${response.status} ${response.statusText}`);
 		const headerContentType = (response.headers.get("content-type") || "").split(";")[0].trim().toLowerCase();
 		const contentLength = response.headers.get("content-length");
-		if (contentLength && Number.isFinite(Number(contentLength)) && Number(contentLength) > MAX_EXTERNAL_IMAGE_BYTES) throw new BlockedExternalImageLargerThanError(MAX_EXTERNAL_IMAGE_BYTES, contentLength);
-		const data = await readResponseBytesWithLimit(response, MAX_EXTERNAL_IMAGE_BYTES);
+		if (contentLength && Number.isFinite(Number(contentLength)) && Number(contentLength) > MAX_FILE_BYTES) throw new BlockedExternalFileLargerThanError(MAX_FILE_BYTES, contentLength);
+		const data = await readResponseBytesWithLimit(response, MAX_FILE_BYTES);
 		return {
 			data,
 			mimeType: await resolveDownloadedImageMimeType(data, headerContentType)
@@ -77,7 +77,7 @@ async function fetchWithRetry(url) {
 	}, {
 		maxAttempts: MAX_EXTERNAL_FETCH_ATTEMPTS,
 		maxDelayMs: 2e3,
-		label: `image-download ${toSanitizedUrl(url)}`
+		label: `file-download ${toSanitizedUrl(url)}`
 	});
 }
 function isRedirectStatus(status) {
@@ -87,7 +87,7 @@ function isRetryableStatus(status) {
 	return status === 429 || status >= 500 && status <= 599;
 }
 async function readResponseBytesWithLimit(response, maxBytes) {
-	if (!response.body) throw new ExternalImageResponseBodyEmptyError();
+	if (!response.body) throw new ExternalFileResponseBodyEmptyError();
 	const reader = response.body.getReader();
 	const chunks = [];
 	let totalBytes = 0;
@@ -97,7 +97,7 @@ async function readResponseBytesWithLimit(response, maxBytes) {
 			if (done) break;
 			if (!value) continue;
 			totalBytes += value.byteLength;
-			if (totalBytes > maxBytes) throw new BlockedExternalImageExceedingError(maxBytes);
+			if (totalBytes > maxBytes) throw new BlockedExternalFileExceedingError(maxBytes);
 			chunks.push(value);
 		}
 	} finally {
@@ -119,15 +119,15 @@ async function fetchWithConnectionIpValidation(url) {
 			dispatcher: externalImageDispatcher
 		});
 	} catch (error) {
-		const imageSecurityError = extractImageSecurityError(error);
-		if (imageSecurityError instanceof BlockedConnectionToPrivateIpError || imageSecurityError instanceof UnableToResolveHostError) throw imageSecurityError;
+		const fileSecurityError = extractFileSecurityError(error);
+		if (fileSecurityError instanceof BlockedConnectionToPrivateIpError || fileSecurityError instanceof UnableToResolveHostError) throw fileSecurityError;
 		if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) throw new TimedOutDownloadingError(toSanitizedUrl(url));
 		throw new FailedToDownloadError(toSanitizedUrl(url), void 0, { cause: error });
 	}
 }
-function extractImageSecurityError(error) {
-	if (error instanceof ImageSecurityError) return error;
-	if (error instanceof Error && error.cause) return extractImageSecurityError(error.cause);
+function extractFileSecurityError(error) {
+	if (error instanceof FileSecurityError) return error;
+	if (error instanceof Error && error.cause) return extractFileSecurityError(error.cause);
 	return null;
 }
 function toSanitizedUrl(url) {
@@ -138,4 +138,4 @@ function toSanitizedUrl(url) {
 }
 
 //#endregion
-export { downloadExternalImage };
+export { downloadExternalFile };

package/dist/domains/run/services/blob-storage/file-content-security.d.ts

@@ -0,0 +1,18 @@
+//#region src/domains/run/services/blob-storage/file-content-security.d.ts
+declare function normalizeInlineImageBytes(file: {
+  bytes: string;
+  mimeType?: string;
+}): Promise<{
+  data: Uint8Array;
+  mimeType: string;
+}>;
+declare function normalizeInlineFileBytes(file: {
+  bytes: string;
+  mimeType?: string;
+}): Promise<{
+  data: Uint8Array;
+  mimeType: string;
+}>;
+declare function resolveDownloadedImageMimeType(data: Uint8Array, headerContentType: string): Promise<string>;
+//#endregion
+export { normalizeInlineFileBytes, normalizeInlineImageBytes, resolveDownloadedImageMimeType };

package/dist/domains/run/services/blob-storage/file-content-security.js

@@ -0,0 +1,55 @@
+import { ALLOWED_EXTERNAL_IMAGE_MIME_TYPES, MAX_FILE_BYTES } from "./file-security-constants.js";
+import { BlockedExternalUnsupportedBytesError, BlockedInlineFileExceedingError, BlockedInlineUnsupportedFileBytesError, InvalidInlineFileMalformedBase64Error } from "./file-security-errors.js";
+import { fileTypeFromBuffer } from "file-type";
+
+//#region src/domains/run/services/blob-storage/file-content-security.ts
+async function normalizeInlineImageBytes(file) {
+	const normalized = await normalizeInlineFileBytes(file);
+	if (normalized.mimeType.startsWith("image/")) return normalized;
+	throw new BlockedInlineUnsupportedFileBytesError(file.mimeType || "unknown");
+}
+async function normalizeInlineFileBytes(file) {
+	const data = decodeBase64Bytes(file.bytes);
+	validateInlineFileSize(data);
+	const requestedMimeType = file.mimeType?.split(";")[0]?.trim().toLowerCase();
+	const sniffedMime = await sniffAllowedInlineFileMimeType(data, requestedMimeType);
+	if (sniffedMime) return {
+		data,
+		mimeType: sniffedMime
+	};
+	throw new BlockedInlineUnsupportedFileBytesError(file.mimeType || "unknown");
+}
+async function resolveDownloadedImageMimeType(data, headerContentType) {
+	const sniffedMime = await sniffAllowedImageMimeType(data);
+	if (sniffedMime) return sniffedMime;
+	throw new BlockedExternalUnsupportedBytesError(headerContentType || "unknown");
+}
+function validateInlineFileSize(data) {
+	if (data.length > MAX_FILE_BYTES) throw new BlockedInlineFileExceedingError(MAX_FILE_BYTES);
+}
+async function sniffAllowedImageMimeType(data) {
+	const sniffedMime = (await fileTypeFromBuffer(data))?.mime?.toLowerCase();
+	if (sniffedMime && ALLOWED_EXTERNAL_IMAGE_MIME_TYPES.has(sniffedMime)) return sniffedMime;
+	return null;
+}
+async function sniffAllowedInlineFileMimeType(data, requestedMimeType) {
+	if (requestedMimeType === "application/pdf") {
+		if (!looksLikePdf(data)) throw new BlockedInlineUnsupportedFileBytesError(requestedMimeType);
+		return "application/pdf";
+	}
+	return await sniffAllowedImageMimeType(data);
+}
+function decodeBase64Bytes(base64Bytes) {
+	const normalized = base64Bytes.replace(/\s+/g, "");
+	if (normalized.length === 0 || normalized.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(normalized)) throw new InvalidInlineFileMalformedBase64Error();
+	const decoded = Buffer.from(normalized, "base64");
+	if (decoded.length === 0 || decoded.toString("base64") !== normalized) throw new InvalidInlineFileMalformedBase64Error();
+	return Uint8Array.from(decoded);
+}
+function looksLikePdf(data) {
+	if (data.length < 5) return false;
+	return data[0] === 37 && data[1] === 80 && data[2] === 68 && data[3] === 70 && data[4] === 45;
+}
+
+//#endregion
+export { normalizeInlineFileBytes, normalizeInlineImageBytes, resolveDownloadedImageMimeType };

package/dist/domains/run/services/blob-storage/{image-security-constants.d.ts → file-security-constants.d.ts}

@@ -1,8 +1,8 @@
-//#region src/domains/run/services/blob-storage/image-security-constants.d.ts
-declare const MAX_EXTERNAL_IMAGE_BYTES: number;
+//#region src/domains/run/services/blob-storage/file-security-constants.d.ts
+declare const MAX_FILE_BYTES: number;
 declare const EXTERNAL_FETCH_TIMEOUT_MS = 10000;
 declare const MAX_EXTERNAL_REDIRECTS = 3;
 declare const ALLOWED_EXTERNAL_IMAGE_MIME_TYPES: Set<string>;
 declare const ALLOWED_HTTP_PORTS: Set<string>;
 //#endregion
-export { ALLOWED_EXTERNAL_IMAGE_MIME_TYPES, ALLOWED_HTTP_PORTS, EXTERNAL_FETCH_TIMEOUT_MS, MAX_EXTERNAL_IMAGE_BYTES, MAX_EXTERNAL_REDIRECTS };
+export { ALLOWED_EXTERNAL_IMAGE_MIME_TYPES, ALLOWED_HTTP_PORTS, EXTERNAL_FETCH_TIMEOUT_MS, MAX_EXTERNAL_REDIRECTS, MAX_FILE_BYTES };

package/dist/domains/run/services/blob-storage/{image-security-constants.js → file-security-constants.js}

@@ -1,7 +1,7 @@
-import { ALLOWED_IMAGE_MIME_TYPES } from "@inkeep/agents-core/constants/allowed-image-formats";
+import { ALLOWED_IMAGE_MIME_TYPES } from "@inkeep/agents-core/constants/allowed-file-formats";
 
-//#region src/domains/run/services/blob-storage/image-security-constants.ts
-const MAX_EXTERNAL_IMAGE_BYTES = 10 * 1024 * 1024;
+//#region src/domains/run/services/blob-storage/file-security-constants.ts
+const MAX_FILE_BYTES = 10 * 1024 * 1024;
 const EXTERNAL_FETCH_TIMEOUT_MS = 1e4;
 const MAX_EXTERNAL_REDIRECTS = 3;
 const ALLOWED_EXTERNAL_IMAGE_MIME_TYPES = ALLOWED_IMAGE_MIME_TYPES;
@@ -12,4 +12,4 @@ const ALLOWED_HTTP_PORTS = new Set([
 ]);
 
 //#endregion
-export { ALLOWED_EXTERNAL_IMAGE_MIME_TYPES, ALLOWED_HTTP_PORTS, EXTERNAL_FETCH_TIMEOUT_MS, MAX_EXTERNAL_IMAGE_BYTES, MAX_EXTERNAL_REDIRECTS };
+export { ALLOWED_EXTERNAL_IMAGE_MIME_TYPES, ALLOWED_HTTP_PORTS, EXTERNAL_FETCH_TIMEOUT_MS, MAX_EXTERNAL_REDIRECTS, MAX_FILE_BYTES };

package/dist/domains/run/services/blob-storage/file-security-errors.d.ts

@@ -0,0 +1,69 @@
+//#region src/domains/run/services/blob-storage/file-security-errors.d.ts
+declare class FileSecurityError extends Error {
+  constructor(message: string, options?: ErrorOptions);
+}
+declare class InvalidExternalFileUrlError extends FileSecurityError {
+  constructor(rawUrl: string);
+}
+declare class BlockedUnsupportedSchemeError extends FileSecurityError {
+  constructor(protocol: string);
+}
+declare class BlockedDisallowedPortError extends FileSecurityError {
+  constructor(port: string);
+}
+declare class BlockedEmbeddedCredentialsError extends FileSecurityError {
+  constructor();
+}
+declare class NoIpResolvedError extends FileSecurityError {
+  constructor(hostname: string);
+}
+declare class BlockedUrlResolvingToPrivateIpError extends FileSecurityError {
+  constructor(ip: string);
+}
+declare class UnableToResolveHostError extends FileSecurityError {
+  constructor(hostname: string, options?: ErrorOptions);
+}
+declare class BlockedConnectionToPrivateIpError extends FileSecurityError {
+  constructor(address: string);
+}
+declare class RedirectMissingLocationError extends FileSecurityError {
+  constructor(url: string);
+}
+declare class TooManyRedirectsError extends FileSecurityError {
+  constructor(url: string);
+}
+declare class FailedToDownloadError extends FileSecurityError {
+  constructor(url: string, statusText?: string, options?: ErrorOptions);
+}
+declare class BlockedExternalFileLargerThanError extends FileSecurityError {
+  constructor(maxBytes: number, contentLength: string);
+}
+declare class BlockedExternalFileExceedingError extends FileSecurityError {
+  constructor(maxBytes: number);
+}
+declare class ExternalFileResponseBodyEmptyError extends FileSecurityError {
+  constructor();
+}
+declare class UnexpectedRedirectStateError extends FileSecurityError {
+  constructor(url: string);
+}
+declare class TimedOutDownloadingError extends FileSecurityError {
+  constructor(url: string);
+}
+declare class BlockedInlineFileExceedingError extends FileSecurityError {
+  constructor(maxBytes: number);
+}
+declare class BlockedInlineUnsupportedFileBytesError extends FileSecurityError {
+  constructor(claimedContentType: string);
+}
+declare class BlockedExternalUnsupportedBytesError extends FileSecurityError {
+  constructor(contentType: string);
+}
+declare class BlockedExternalPdfUrlNotSupportedError extends FileSecurityError {
+  constructor();
+}
+declare class InvalidInlineFileMalformedBase64Error extends FileSecurityError {
+  constructor();
+}
+//#endregion
+export { BlockedConnectionToPrivateIpError, BlockedDisallowedPortError, BlockedEmbeddedCredentialsError, BlockedExternalFileExceedingError, BlockedExternalFileLargerThanError, BlockedExternalPdfUrlNotSupportedError, BlockedExternalUnsupportedBytesError, BlockedInlineFileExceedingError, BlockedInlineUnsupportedFileBytesError, BlockedUnsupportedSchemeError, BlockedUrlResolvingToPrivateIpError, ExternalFileResponseBodyEmptyError, FailedToDownloadError, FileSecurityError, InvalidExternalFileUrlError, InvalidInlineFileMalformedBase64Error, NoIpResolvedError, RedirectMissingLocationError, TimedOutDownloadingError, TooManyRedirectsError, UnableToResolveHostError, UnexpectedRedirectStateError };

package/dist/domains/run/services/blob-storage/file-security-errors.js

@@ -0,0 +1,115 @@
+//#region src/domains/run/services/blob-storage/file-security-errors.ts
+var FileSecurityError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = new.target.name;
+	}
+};
+var InvalidExternalFileUrlError = class extends FileSecurityError {
+	constructor(rawUrl) {
+		super(`Invalid external file URL: ${rawUrl}`);
+	}
+};
+var BlockedUnsupportedSchemeError = class extends FileSecurityError {
+	constructor(protocol) {
+		super(`Blocked external file URL with unsupported scheme: ${protocol}`);
+	}
+};
+var BlockedDisallowedPortError = class extends FileSecurityError {
+	constructor(port) {
+		super(`Blocked external file URL with disallowed port: ${port}`);
+	}
+};
+var BlockedEmbeddedCredentialsError = class extends FileSecurityError {
+	constructor() {
+		super("Blocked external file URL with embedded credentials");
+	}
+};
+var NoIpResolvedError = class extends FileSecurityError {
+	constructor(hostname) {
+		super(`No IP addresses resolved for host: ${hostname}`);
+	}
+};
+var BlockedUrlResolvingToPrivateIpError = class extends FileSecurityError {
+	constructor(ip) {
+		super(`Blocked external file URL resolving to private or reserved IP: ${ip}`);
+	}
+};
+var UnableToResolveHostError = class extends FileSecurityError {
+	constructor(hostname, options) {
+		super(`Unable to resolve external file host: ${hostname}`, options);
+	}
+};
+var BlockedConnectionToPrivateIpError = class extends FileSecurityError {
+	constructor(address) {
+		super(`Blocked external file connection to private or reserved IP: ${address}`);
+	}
+};
+var RedirectMissingLocationError = class extends FileSecurityError {
+	constructor(url) {
+		super(`Redirect response missing location header: ${url}`);
+	}
+};
+var TooManyRedirectsError = class extends FileSecurityError {
+	constructor(url) {
+		super(`Too many redirects while downloading file: ${url}`);
+	}
+};
+var FailedToDownloadError = class extends FileSecurityError {
+	constructor(url, statusText, options) {
+		super(statusText ? `Failed to download file from ${url}: ${statusText}` : `Failed to download file from ${url}`, options);
+	}
+};
+var BlockedExternalFileLargerThanError = class extends FileSecurityError {
+	constructor(maxBytes, contentLength) {
+		super(`Blocked external file larger than ${maxBytes} bytes: ${contentLength}`);
+	}
+};
+var BlockedExternalFileExceedingError = class extends FileSecurityError {
+	constructor(maxBytes) {
+		super(`Blocked external file exceeding ${maxBytes} bytes`);
+	}
+};
+var ExternalFileResponseBodyEmptyError = class extends FileSecurityError {
+	constructor() {
+		super("External file response body is empty");
+	}
+};
+var UnexpectedRedirectStateError = class extends FileSecurityError {
+	constructor(url) {
+		super(`Unexpected redirect handling state for URL: ${url}`);
+	}
+};
+var TimedOutDownloadingError = class extends FileSecurityError {
+	constructor(url) {
+		super(`Timed out downloading file from ${url}`);
+	}
+};
+var BlockedInlineFileExceedingError = class extends FileSecurityError {
+	constructor(maxBytes) {
+		super(`Blocked inline file exceeding ${maxBytes} bytes`);
+	}
+};
+var BlockedInlineUnsupportedFileBytesError = class extends FileSecurityError {
+	constructor(claimedContentType) {
+		super(`Blocked inline file with unsupported bytes signature (claimed content-type: ${claimedContentType})`);
+	}
+};
+var BlockedExternalUnsupportedBytesError = class extends FileSecurityError {
+	constructor(contentType) {
+		super(`Blocked external file with unsupported bytes signature (content-type: ${contentType})`);
+	}
+};
+var BlockedExternalPdfUrlNotSupportedError = class extends FileSecurityError {
+	constructor() {
+		super("External PDF URLs are not supported; provide PDFs as data URIs");
+	}
+};
+var InvalidInlineFileMalformedBase64Error = class extends FileSecurityError {
+	constructor() {
+		super("Invalid inline file: malformed base64 payload");
+	}
+};
+
+//#endregion
+export { BlockedConnectionToPrivateIpError, BlockedDisallowedPortError, BlockedEmbeddedCredentialsError, BlockedExternalFileExceedingError, BlockedExternalFileLargerThanError, BlockedExternalPdfUrlNotSupportedError, BlockedExternalUnsupportedBytesError, BlockedInlineFileExceedingError, BlockedInlineUnsupportedFileBytesError, BlockedUnsupportedSchemeError, BlockedUrlResolvingToPrivateIpError, ExternalFileResponseBodyEmptyError, FailedToDownloadError, FileSecurityError, InvalidExternalFileUrlError, InvalidInlineFileMalformedBase64Error, NoIpResolvedError, RedirectMissingLocationError, TimedOutDownloadingError, TooManyRedirectsError, UnableToResolveHostError, UnexpectedRedirectStateError };

package/dist/domains/run/services/blob-storage/{image-upload-helpers.d.ts → file-upload-helpers.d.ts}

@@ -1,7 +1,7 @@
-import { UploadContext } from "./image-upload.js";
+import { UploadContext } from "./file-upload.js";
 import { MessageContent, Part } from "@inkeep/agents-core";
 
-//#region src/domains/run/services/blob-storage/image-upload-helpers.d.ts
+//#region src/domains/run/services/blob-storage/file-upload-helpers.d.ts
 declare function buildPersistedMessageContent(text: string, parts: Part[], ctx: UploadContext): Promise<MessageContent>;
 //#endregion
 export { buildPersistedMessageContent };

package/dist/domains/run/services/blob-storage/{image-upload-helpers.js → file-upload-helpers.js}

@@ -1,18 +1,18 @@
 import { getLogger } from "../../../../logger.js";
-import { hasFileParts, makeMessageContentParts, uploadPartsImages } from "./image-upload.js";
+import { hasFileParts, makeMessageContentParts, uploadPartsFiles } from "./file-upload.js";
 
-//#region src/domains/run/services/blob-storage/image-upload-helpers.ts
-const logger = getLogger("image-upload-helpers");
+//#region src/domains/run/services/blob-storage/file-upload-helpers.ts
+const logger = getLogger("file-upload-helpers");
 async function buildPersistedMessageContent(text, parts, ctx) {
 	if (!hasFileParts(parts)) return { text };
 	try {
-		const contentParts = makeMessageContentParts(await uploadPartsImages(parts, ctx));
+		const contentParts = makeMessageContentParts(await uploadPartsFiles(parts, ctx));
 		logger.debug({
 			messageId: ctx.messageId,
 			originalParts: parts.length,
 			uploadedParts: contentParts.length,
 			fileParts: contentParts.filter((p) => p.kind === "file").length
-		}, "Built persisted message content with uploaded images");
+		}, "Built persisted message content with uploaded files");
 		return {
 			text,
 			parts: contentParts
@@ -21,7 +21,7 @@ async function buildPersistedMessageContent(text, parts, ctx) {
 		logger.error({
 			error: error instanceof Error ? error.message : String(error),
 			messageId: ctx.messageId
-		}, "Failed to upload images, persisting text only");
+		}, "Failed to upload files, persisting text only");
 		return { text };
 	}
 }

package/dist/domains/run/services/blob-storage/{image-upload.d.ts → file-upload.d.ts}

@@ -1,6 +1,6 @@
 import { MessageContent, Part } from "@inkeep/agents-core";
 
-//#region src/domains/run/services/blob-storage/image-upload.d.ts
+//#region src/domains/run/services/blob-storage/file-upload.d.ts
 type MessageContentPart = NonNullable<MessageContent['parts']>[number];
 interface UploadContext {
   tenantId: string;
@@ -8,8 +8,8 @@ interface UploadContext {
   conversationId: string;
   messageId: string;
 }
-declare function uploadPartsImages(parts: Part[], ctx: UploadContext): Promise<Part[]>;
+declare function uploadPartsFiles(parts: Part[], ctx: UploadContext): Promise<Part[]>;
 declare function makeMessageContentParts(parts: Part[]): MessageContentPart[];
 declare function hasFileParts(parts: Part[]): boolean;
 //#endregion
-export { UploadContext, hasFileParts, makeMessageContentParts, uploadPartsImages };
+export { UploadContext, hasFileParts, makeMessageContentParts, uploadPartsFiles };

package/dist/domains/run/services/blob-storage/{image-upload.js → file-upload.js}

@@ -1,13 +1,14 @@
 import { getLogger } from "../../../../logger.js";
 import { getBlobStorageProvider, toBlobUri } from "./index.js";
 import { buildStorageKey } from "./storage-keys.js";
-import { normalizeInlineImageBytes } from "./image-content-security.js";
-import { downloadExternalImage } from "./external-image-downloader.js";
+import { BlockedExternalPdfUrlNotSupportedError } from "./file-security-errors.js";
+import { normalizeInlineFileBytes } from "./file-content-security.js";
+import { downloadExternalFile } from "./external-file-downloader.js";
 import { createHash } from "node:crypto";
-import { getExtensionFromMimeType } from "@inkeep/agents-core/constants/allowed-image-formats";
+import { getExtensionFromMimeType } from "@inkeep/agents-core/constants/allowed-file-formats";
 
-//#region src/domains/run/services/blob-storage/image-upload.ts
-const logger = getLogger("image-upload");
+//#region src/domains/run/services/blob-storage/file-upload.ts
+const logger = getLogger("file-upload");
 const FILE_UPLOAD_CONCURRENCY = 3;
 async function uploadFilePart(part, ctx, index) {
 	const storage = getBlobStorageProvider();
@@ -15,11 +16,12 @@ async function uploadFilePart(part, ctx, index) {
 	let data;
 	let mimeType;
 	if ("bytes" in file && file.bytes) {
-		const normalized = await normalizeInlineImageBytes(file);
+		const normalized = await normalizeInlineFileBytes(file);
 		data = normalized.data;
 		mimeType = normalized.mimeType;
 	} else if ("uri" in file && file.uri) {
-		const downloaded = await downloadExternalImage(file.uri);
+		if (file.mimeType?.toLowerCase().startsWith("application/pdf")) throw new BlockedExternalPdfUrlNotSupportedError();
+		const downloaded = await downloadExternalFile(file.uri);
 		data = downloaded.data;
 		mimeType = downloaded.mimeType;
 	} else {
@@ -46,7 +48,7 @@ async function uploadFilePart(part, ctx, index) {
 		key,
 		mimeType,
 		size: data.length
-	}, "Uploaded image to blob storage");
+	}, "Uploaded file to blob storage");
 	return {
 		kind: "file",
 		file: {
@@ -56,7 +58,7 @@ async function uploadFilePart(part, ctx, index) {
 		...part.metadata && { metadata: part.metadata }
 	};
 }
-async function uploadPartsImages(parts, ctx) {
+async function uploadPartsFiles(parts, ctx) {
 	const results = parts.map((part) => part.kind === "file" ? null : part);
 	const fileIndices = parts.flatMap((part, index) => part.kind === "file" ? [index] : []);
 	let nextFileCursor = 0;
@@ -71,10 +73,20 @@ async function uploadPartsImages(parts, ctx) {
 			try {
 				results[index] = await uploadFilePart(part, ctx, index);
 			} catch (error) {
+				const file = part.kind === "file" ? {
+					...part.file.mimeType ? { mimeType: part.file.mimeType } : {},
+					..."uri" in part.file && part.file.uri ? { uri: part.file.uri } : {},
+					..."bytes" in part.file && part.file.bytes ? { bytesLength: part.file.bytes.length } : {}
+				} : void 0;
 				logger.error({
 					error: error instanceof Error ? error.message : String(error),
-					index
-				}, "Failed to upload image part, dropping from persisted message to avoid storing base64 in DB");
+					index,
+					tenantId: ctx.tenantId,
+					projectId: ctx.projectId,
+					conversationId: ctx.conversationId,
+					messageId: ctx.messageId,
+					file
+				}, "Failed to upload file part, dropping from persisted message to avoid storing base64 in DB");
 			}
 		}
 	};
@@ -111,4 +123,4 @@ function hasFileParts(parts) {
 }
 
 //#endregion
-export { hasFileParts, makeMessageContentParts, uploadPartsImages };
+export { hasFileParts, makeMessageContentParts, uploadPartsFiles };

package/dist/domains/run/services/blob-storage/file-url-security.d.ts

@@ -0,0 +1,6 @@
+//#region src/domains/run/services/blob-storage/file-url-security.d.ts
+declare function validateExternalFileUrl(rawUrl: string): URL;
+declare function validateUrlResolvesToPublicIp(url: URL): Promise<void>;
+declare function isBlockedIpAddress(ipAddress: string): boolean;
+//#endregion
+export { isBlockedIpAddress, validateExternalFileUrl, validateUrlResolvesToPublicIp };

package/dist/domains/run/services/blob-storage/{image-url-security.js → file-url-security.js}

@@ -1,18 +1,18 @@
 import { getLogger } from "../../../../logger.js";
-import { ALLOWED_HTTP_PORTS } from "./image-security-constants.js";
-import { BlockedDisallowedPortError, BlockedEmbeddedCredentialsError, BlockedUnsupportedSchemeError, BlockedUrlResolvingToPrivateIpError, ImageSecurityError, InvalidExternalImageUrlError, NoIpResolvedError, UnableToResolveHostError } from "./image-security-errors.js";
+import { ALLOWED_HTTP_PORTS } from "./file-security-constants.js";
+import { BlockedDisallowedPortError, BlockedEmbeddedCredentialsError, BlockedUnsupportedSchemeError, BlockedUrlResolvingToPrivateIpError, FileSecurityError, InvalidExternalFileUrlError, NoIpResolvedError, UnableToResolveHostError } from "./file-security-errors.js";
 import { lookup } from "node:dns/promises";
 import { isIP } from "node:net";
 import * as ipaddr from "ipaddr.js";
 
-//#region src/domains/run/services/blob-storage/image-url-security.ts
-const logger = getLogger("image-security");
-function validateExternalImageUrl(rawUrl) {
+//#region src/domains/run/services/blob-storage/file-url-security.ts
+const logger = getLogger("file-security");
+function validateExternalFileUrl(rawUrl) {
 	let parsed;
 	try {
 		parsed = new URL(rawUrl);
 	} catch {
-		throw new InvalidExternalImageUrlError(rawUrl);
+		throw new InvalidExternalFileUrlError(rawUrl);
 	}
 	const protocol = parsed.protocol.toLowerCase();
 	if (protocol !== "http:" && protocol !== "https:") throw new BlockedUnsupportedSchemeError(protocol);
@@ -26,7 +26,7 @@ async function validateUrlResolvesToPublicIp(url) {
 	try {
 		candidateIps = await resolveCandidateIps(hostname);
 	} catch (error) {
-		if (error instanceof ImageSecurityError) throw error;
+		if (error instanceof FileSecurityError) throw error;
 		throw new UnableToResolveHostError(hostname, { cause: error });
 	}
 	if (candidateIps.length === 0) throw new NoIpResolvedError(hostname);
@@ -34,7 +34,7 @@ async function validateUrlResolvesToPublicIp(url) {
 		logger.warn({
 			host: hostname,
 			ip
-		}, "Blocked external image URL resolving to private IP");
+		}, "Blocked external file URL resolving to private IP");
 		throw new BlockedUrlResolvingToPrivateIpError(ip);
 	}
 }
@@ -49,7 +49,7 @@ async function resolveCandidateIps(hostname) {
 		logger.warn({
 			host: hostname,
 			error
-		}, "DNS resolution failed for external image URL");
+		}, "DNS resolution failed for external file URL");
 		throw new UnableToResolveHostError(hostname, { cause: error });
 	}
 }
@@ -66,4 +66,4 @@ function isBlockedIpAddress(ipAddress) {
 }
 
 //#endregion
-export { isBlockedIpAddress, validateExternalImageUrl, validateUrlResolvesToPublicIp };
+export { isBlockedIpAddress, validateExternalFileUrl, validateUrlResolvesToPublicIp };

package/dist/domains/run/services/blob-storage/local-provider.js

@@ -2,7 +2,7 @@ import { getLogger } from "../../../../logger.js";
 import { env } from "../../../../env.js";
 import path from "node:path";
 import { access, lstat, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { getMimeTypeFromExtension } from "@inkeep/agents-core/constants/allowed-image-formats";
+import { getMimeTypeFromExtension } from "@inkeep/agents-core/constants/allowed-file-formats";
 
 //#region src/domains/run/services/blob-storage/local-provider.ts
 const logger = getLogger("LocalBlobStorageProvider");