@jini-ai/chat 0.6.17 → 0.6.21

package/dist/react/hooks/composer-draft-cache.js

@@ -216,31 +216,33 @@ function storedTimestamp(store, { key }) {
 function writeStoredEnvelope(prefix, { conversationId, envelope }) {
     const store = storage();
     if (!store)
-        return;
+        return false;
     const key = `${prefix}${conversationId}`;
     try {
         if (envelope === null) {
             store.removeItem(key);
-            return;
+            return true;
         }
         if (store.getItem(key) === null)
             pruneStored(prefix, MAX_CACHED_CONVERSATION_DRAFTS - 1);
         store.setItem(key, JSON.stringify(envelope));
+        return true;
     }
     catch {
         /* blocked, full, or unusable storage — memory-only is the documented degraded mode */
         /* (on a removal: blocked storage; the in-memory tier is already correct) */
+        return false;
     }
 }
 /**
- * Writes or removes the stored copy for `conversationId`.
+ * Writes or removes the stored copy for `conversationId`; returns false on storage failure.
  *
  * @param draft A blank draft removes the entry; see {@link writeStoredEnvelope}.
  * @complexity Time O(n) in the draft's length; see {@link writeStoredEnvelope}.
  */
 function writeStoredDraft(conversationId, draft) {
     const envelope = draft === '' ? null : { v: 1, t: Date.now(), d: draft };
-    writeStoredEnvelope(COMPOSER_DRAFT_STORAGE_PREFIX, { conversationId, envelope });
+    return writeStoredEnvelope(COMPOSER_DRAFT_STORAGE_PREFIX, { conversationId, envelope });
 }
 /**
  * Records `draft` in the in-memory tier, evicting the oldest-inserted conversation first if this
@@ -274,7 +276,7 @@ export function readCachedDraft({ conversationId }) {
     return stored;
 }
 /**
- * Stores `draft` for `conversationId` in both tiers.
+ * Stores `draft` for `conversationId` in both tiers. Returns whether durable storage accepted it.
  *
  * @param conversationId No-ops when absent (`null`/`undefined`) — there is nothing to key on yet.
  * `useComposer` covers that window by adopting the typed text once an id arrives; see its own doc.
@@ -283,11 +285,11 @@ export function readCachedDraft({ conversationId }) {
  * writes `''` here.
  * @complexity Time/space: O(n) in the draft's length; see {@link writeStoredDraft}.
  */
-export function writeCachedDraft({ conversationId, draft }) {
+export function writeCachedDraft({ conversationId, draft }, _options = {}) {
     if (!conversationId)
-        return;
+        return false;
     rememberCachedDraft({ conversationId: conversationId, draft: draft });
-    writeStoredDraft(conversationId, draft.trim() === '' ? '' : draft);
+    return writeStoredDraft(conversationId, draft.trim() === '' ? '' : draft);
 }
 /**
  * Stores `draft` for `conversationId` in the in-memory tier only, leaving `localStorage` alone.
@@ -436,26 +438,25 @@ export function writeCachedAttachmentBatchId({ conversationId, batchId }, _optio
     setBounded(stagedBatchIds, { key: conversationId, value: batchId });
 }
 /**
- * Stores `attachments` for `conversationId` in both tiers.
+ * Stores `attachments` for `conversationId` in both tiers. Returns whether storage accepted it.
  *
  * @param attachments An empty list deletes the entry, so a sent or cleared turn leaves nothing to
  * restore — the same rule the draft text follows.
  * @complexity Time/space: O(n) in the number of references.
  */
-export function writeCachedAttachments({ conversationId, attachments }) {
+export function writeCachedAttachments({ conversationId, attachments }, _options = {}) {
     if (!conversationId)
-        return;
+        return false;
     if (attachments.length === 0) {
         stagedAttachments.delete(conversationId);
         // A sent or cleared turn's batch is spent; the next upload starts a fresh one.
         stagedBatchIds.delete(conversationId);
-        writeStoredEnvelope(COMPOSER_ATTACHMENTS_STORAGE_PREFIX, { conversationId, envelope: null });
-        return;
+        return writeStoredEnvelope(COMPOSER_ATTACHMENTS_STORAGE_PREFIX, { conversationId, envelope: null });
     }
     setBounded(stagedAttachments, { key: conversationId, value: attachments });
     const batchId = stagedBatchIds.get(conversationId);
     const envelope = { v: 1, t: Date.now(), a: attachments, ...(batchId === undefined ? {} : { b: batchId }) };
-    writeStoredEnvelope(COMPOSER_ATTACHMENTS_STORAGE_PREFIX, { conversationId, envelope });
+    return writeStoredEnvelope(COMPOSER_ATTACHMENTS_STORAGE_PREFIX, { conversationId, envelope });
 }
 /**
  * Test-only: empties the cache so test cases cannot leak drafts into each other.
@@ -489,11 +490,11 @@ export function readCachedFolders({ conversationId }, _options = {}) {
         } });
     return stored ?? [];
 }
-/** Persist exact strings independently of text and attachment validation. */
+/** Persist exact strings independently of text and attachment validation; report storage failure. */
 export function writeCachedFolders({ conversationId, folders }, _options = {}) {
     if (!conversationId)
-        return;
+        return false;
     setBounded(folderDrafts, { key: conversationId, value: [...folders] });
-    writeStoredEnvelope(COMPOSER_FOLDERS_STORAGE_PREFIX, { conversationId, envelope: folders.length ? { v: 1, t: Date.now(), folders } : null });
+    return writeStoredEnvelope(COMPOSER_FOLDERS_STORAGE_PREFIX, { conversationId, envelope: folders.length ? { v: 1, t: Date.now(), folders } : null });
 }
 //# sourceMappingURL=composer-draft-cache.js.map

package/dist/react/hooks/useComposer.js

@@ -49,16 +49,19 @@ const EMPTY_MENTION = { open: false, query: '', results: [] };
  */
 export const DRAFT_PERSIST_DEBOUNCE_MS = 800;
 /**
- * One pending durable draft write at a time, trailing-edge debounced. Flushes on unmount and when
+ * One pending durable draft write at a time, trailing-edge debounced. Release checks flush and
+ * consult the draft owner without adding a browser reload prompt. Flushes on unmount and when
  * the page is hidden (`pagehide`, or `visibilitychange` to hidden — the last event a mobile browser
  * reliably delivers before discarding the tab).
  * @param pageLifecycle The page-exit event sources, captured at mount; `undefined` resolves the
  *   browser's own, `null` subscribes to nothing (unmount still flushes).
  * @complexity Time/space: O(1) per call.
  */
-function useDeferredDraftWrite(pageLifecycle) {
+function useDeferredDraftWrite(pageLifecycle, canRelease) {
     const [lifecycle] = useState(() => (pageLifecycle === undefined ? browserPageLifecycle() : pageLifecycle));
     const pendingRef = useRef(null);
+    const canReleaseRef = useRef(canRelease);
+    canReleaseRef.current = canRelease;
     const cancel = useCallback(() => {
         const pending = pendingRef.current;
         if (!pending)
@@ -91,10 +94,23 @@ function useDeferredDraftWrite(pageLifecycle) {
             if (doc.visibilityState === 'hidden')
                 flush();
         };
+        const onReleaseCheck = (event) => {
+            try {
+                flush();
+                if (!canReleaseRef.current())
+                    event.preventDefault();
+            }
+            catch {
+                // Host persistence may throw; a release must never discard the only surviving copy.
+                event.preventDefault();
+            }
+        };
         page.addEventListener('pagehide', flush);
+        page.addEventListener('jini:release-check', onReleaseCheck);
         doc.addEventListener('visibilitychange', onVisibilityChange);
         return () => {
             page.removeEventListener('pagehide', flush);
+            page.removeEventListener('jini:release-check', onReleaseCheck);
             doc.removeEventListener('visibilitychange', onVisibilityChange);
             flush();
         };
@@ -124,7 +140,20 @@ export function useComposer(options = {}) {
     const [attachments, setAttachments] = useState([]);
     const [agent, setAgent] = useState(options.initialAgent);
     const [mention, setMention] = useState(EMPTY_MENTION);
-    const deferredWrite = useDeferredDraftWrite(options.pageLifecycle);
+    const pendingUploadsRef = useRef(0);
+    const deferredWrite = useDeferredDraftWrite(options.pageLifecycle, () => {
+        if (pendingUploadsRef.current > 0)
+            return false;
+        // Retry even after the debounce: the cache's memory tier cannot survive guest destruction.
+        // Empty values are durable deletions too. A failed remove must not resurrect a cleared draft
+        // after this guest is destroyed and storage becomes readable again.
+        const textSaved = conversationId ? writeCachedDraft({ conversationId, draft }) : draft.trim() === '';
+        const foldersSaved = conversationId ? writeCachedFolders({ conversationId, folders }) : folders.length === 0;
+        // Without the host's liveness validator, a remount deliberately does not restore files.
+        const filesSaved = canReleaseAttachments({ conversationId, attachments, validateAttachments,
+            hydratedFor: attachmentsHydratedForRef.current });
+        return textSaved && foldersSaved && filesSaved;
+    });
     const commitDraft = useCallback((next) => {
         setDraftState(next);
         rememberCachedDraft({ conversationId: conversationId, draft: next });
@@ -263,7 +292,14 @@ export function useComposer(options = {}) {
         if (!project?.uploadFiles) {
             throw new Error('addAttachments requires ProjectContextValue.uploadFiles to be wired by the host');
         }
-        const uploaded = await project.uploadFiles(files);
+        pendingUploadsRef.current++;
+        let uploaded;
+        try {
+            uploaded = await project.uploadFiles(files);
+        }
+        finally {
+            pendingUploadsRef.current--;
+        }
         setAttachments((prev) => [...prev, ...uploaded]);
         // `uploadFiles` resolves 1:1 with `files`, in order, on success (see
         // `create-daemon-attachment-uploader.ts`'s "preserved order" doc) - any failure rejects the
@@ -335,4 +371,16 @@ export function useComposer(options = {}) {
         flushDraft: deferredWrite.flush,
     }), [draft, history, setDraft, folders, addFolders, removeFolder, attachments, addAttachments, addAttachment, removeAttachment, clearAttachments, agent, mention, openMention, closeMention, selectMention, canSubmit, reset, deferredWrite.flush]);
 }
+/** Never erase a pending restore; once settled, confirm persistence of empty lists as well.
+ * Unkeyed empty composers have no stored entry to delete. O(staged files), bounded by the cache.
+ */
+function canReleaseAttachments({ conversationId, attachments, validateAttachments, hydratedFor }, _options = {}) {
+    if (!conversationId)
+        return attachments.length === 0;
+    if (hydratedFor !== conversationId)
+        return false;
+    if (attachments.length > 0 && !validateAttachments)
+        return false;
+    return writeCachedAttachments({ conversationId, attachments });
+}
 //# sourceMappingURL=useComposer.js.map

package/dist/react/hooks/useConversation.js

@@ -1,3 +1,4 @@
+import { formatErrorForLog } from '@jini-ai/core';
 import { acceptedInputUserEvent, projectAcceptedInputEvents } from '../../core/accepted-input.js';
 import { redactUserHistory, redactUserMessage } from '../../core/user-text-redaction.js';
 import { preserveAssistantContent, mergeRunEvents } from '../../core/durable-projection.js';
@@ -36,6 +37,39 @@ function pendingUserMessage({ content, sendOptions, createMessageId }, options =
             ...(sendOptions.attachments ? { attachments: sendOptions.attachments } : {}),
         } }, options).message;
 }
+/** A checkpoint's run id proves acceptance even if the original start request is still pending.
+ * @returns A copy with pending state cleared only for this run's preceding user row; no I/O.
+ * @complexity O(1) time/space, called in the existing transcript reconciliation pass.
+ */
+function acceptPendingUserMessage({ message, reply, assistantId, runId }, _options = {}) {
+    if (!message.inputPending || reply?.id !== assistantId || runId === null)
+        return message;
+    return { ...message, inputPending: false };
+}
+/** The queued assistant bubble a send opens; the run's events fill it in. */
+function pendingAssistantMessage({ id }, { agentId } = {}) {
+    return {
+        id,
+        role: 'assistant',
+        content: '',
+        ...(agentId !== undefined ? { agentId } : {}),
+        runStatus: 'queued',
+        createdAt: Date.now(),
+        startedAt: Date.now(),
+    };
+}
+/** What `run.start` receives for one send: only the options the caller actually set. */
+function runStartInput({ assistantMessageId, history, conversationId, sendOptions }, { agentId } = {}) {
+    return {
+        assistantMessageId,
+        history,
+        ...(agentId !== undefined ? { agentId } : {}),
+        conversationId,
+        ...(sendOptions.folders !== undefined ? { folders: sendOptions.folders } : {}),
+        ...(sendOptions.attachments !== undefined ? { attachments: sendOptions.attachments } : {}),
+        ...(sendOptions.context !== undefined ? { context: sendOptions.context } : {}),
+    };
+}
 export function useConversation(options) {
     const { transport, conversationId = null, agentId, createMessageId = defaultCreateMessageId } = options;
     const [messages, setMessagesState] = useState(() => redactUserHistory({ history: options.initialMessages ?? [] }, { ...(options.redactUserText ? { redactUserText: options.redactUserText } : {}) }));
@@ -66,7 +100,7 @@ export function useConversation(options) {
             }
             catch (error) {
                 if (!disposed)
-                    console.error('[chat] conversation refresh failed', error);
+                    console.error('[chat] conversation refresh failed', formatErrorForLog({ error }));
             }
             finally {
                 pending = false;
@@ -139,9 +173,11 @@ export function useConversation(options) {
         const assistantId = activeAssistantIdRef.current;
         if (!assistantId)
             return;
-        setMessagesState((prev) => prev.map((m) => {
+        setMessagesState((prev) => prev.map((m, index) => {
             if (m.id !== assistantId)
-                return m;
+                return acceptPendingUserMessage({
+                    message: m, reply: prev[index + 1], assistantId, runId: run.runId,
+                });
             // A plain if/else chain (not a nested ternary) — deliberately, so
             // each of the four mapped statuses is its own independently
             // trackable branch under coverage instrumentation. The fallback
@@ -184,20 +220,11 @@ export function useConversation(options) {
     // permanently unset.
     useEffect(() => {
         applyRunToAssistantMessage();
-        // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [run.events, run.status, run.runId]);
     const sendMessage = useCallback(async (content, sendOptions = {}) => {
         const userMessage = pendingUserMessage({ content, sendOptions, createMessageId }, options);
         const resolvedAgentId = sendOptions.agentId ?? agentId;
-        const assistantMessage = {
-            id: createMessageId(),
-            role: 'assistant',
-            content: '',
-            ...(resolvedAgentId !== undefined ? { agentId: resolvedAgentId } : {}),
-            runStatus: 'queued',
-            createdAt: Date.now(),
-            startedAt: Date.now(),
-        };
+        const assistantMessage = pendingAssistantMessage({ id: createMessageId() }, { agentId: resolvedAgentId });
         activeAssistantIdRef.current = assistantMessage.id;
         setSendRefused(false);
         const history = redactUserHistory({ history: [...messagesRef.current, userMessage] }, options);
@@ -209,15 +236,7 @@ export function useConversation(options) {
         // (host stuck-chat investigation, 2026-09-27).
         setMessagesState((prev) => [...prev, userMessage, assistantMessage]);
         setScrollIntent(true);
-        const accepted = await run.start({
-            assistantMessageId: assistantMessage.id,
-            history,
-            ...(resolvedAgentId !== undefined ? { agentId: resolvedAgentId } : {}),
-            conversationId,
-            ...(sendOptions.folders !== undefined ? { folders: sendOptions.folders } : {}),
-            ...(sendOptions.attachments !== undefined ? { attachments: sendOptions.attachments } : {}),
-            ...(sendOptions.context !== undefined ? { context: sendOptions.context } : {}),
-        });
+        const accepted = await run.start(runStartInput({ assistantMessageId: assistantMessage.id, history, conversationId, sendOptions }, { agentId: resolvedAgentId }));
         if (!accepted) {
             // The bubbles go, but the reason must not: it was rendered only on the assistant bubble.
             setMessagesState(prev => prev.filter(message => message.id !== userMessage.id && message.id !== assistantMessage.id));

package/dist/react/hooks/useRunStream.js

@@ -1,3 +1,4 @@
+import { formatErrorForLog } from '@jini-ai/core';
 /**
  * @module useRunStream
  *
@@ -20,7 +21,7 @@
 import { mergeRunEvents } from '../../core/durable-projection.js';
 import { useCallback, useEffect, useRef, useState } from 'react';
 function reportRunStreamHostEffectFailure(effectName, error) {
-    console.error(`[@jini-ai/chat] useRunStream ${effectName} host effect failed:`, error);
+    console.error(`[@jini-ai/chat] useRunStream ${effectName} host effect failed:`, formatErrorForLog({ error }));
 }
 /**
  * Fire-and-forget teardown call to `transport.stopRun`. Invokes it synchronously, then observes

package/dist/react/hooks/useSurfaceRecovery.d.ts

@@ -0,0 +1,23 @@
+import { type McpUiToolCallHandler, type UIResource } from '@jini-ai/ui/mcp-ui';
+import type { ExtEventCall } from '../ext-event-renderer-registry.js';
+/** Restore only an unanswered call: completed decisions must never execute twice. */
+export declare function surfaceNeedsRecovery({ call, runStreaming }: {
+    call: ExtEventCall | undefined;
+    runStreaming: boolean;
+}, _options?: {}): boolean;
+/** Nonvisual card lifecycle: mount/focus restores the server's original invocation; late clicks
+ * use the same stream. A component owns its subscription and aborts it on teardown.
+ * @complexity O(card document size) per emission; O(1) subscriptions per visible card.
+ */
+export declare function useSurfaceRecovery({ resource, call, runStreaming, onToolCall }: {
+    resource: UIResource | undefined;
+    call: ExtEventCall | undefined;
+    runStreaming: boolean;
+    onToolCall: McpUiToolCallHandler | undefined;
+}, _options?: {}): {
+    resource: UIResource | undefined;
+    restored: boolean;
+    live: boolean;
+    onToolCall: McpUiToolCallHandler | undefined;
+};
+//# sourceMappingURL=useSurfaceRecovery.d.ts.map

package/dist/react/hooks/useSurfaceRecovery.js

@@ -0,0 +1,84 @@
+import { useEffect, useRef, useState } from 'react';
+import { parseUIResource } from '@jini-ai/ui/mcp-ui';
+import { recoverableSurfaceResource, surfaceRecoveryInfo, SURFACE_EXCHANGE_META } from '../../core/surface-recovery.js';
+/** Restore only an unanswered call: completed decisions must never execute twice. */
+export function surfaceNeedsRecovery({ call, runStreaming }, _options = {}) {
+    if (!call)
+        return false;
+    if (!call.result)
+        return !runStreaming;
+    return call.result.isError || /\b(expired|abandoned|did not respond|run ended)\b/i.test(call.result.content);
+}
+function recoveryCaller(call) {
+    if (!call || !('restore' in call) || !('answer' in call))
+        return undefined;
+    if (typeof call.restore !== 'function' || typeof call.answer !== 'function')
+        return undefined;
+    return call;
+}
+/** Nonvisual card lifecycle: mount/focus restores the server's original invocation; late clicks
+ * use the same stream. A component owns its subscription and aborts it on teardown.
+ * @complexity O(card document size) per emission; O(1) subscriptions per visible card.
+ */
+export function useSurfaceRecovery({ resource, call, runStreaming, onToolCall }, _options = {}) {
+    const [restored, setRestored] = useState();
+    const [live, setLive] = useState(false);
+    const pending = useRef(undefined);
+    const answerController = useRef(undefined);
+    const completed = useRef(false);
+    const info = surfaceRecoveryInfo({ value: resource?.resource._meta?.[SURFACE_EXCHANGE_META] });
+    const caller = info ? recoveryCaller(onToolCall) : undefined;
+    const needsRecovery = surfaceNeedsRecovery({ call, runStreaming });
+    const onSurface = (emission) => {
+        if (emission.channel !== 'mcp-ui')
+            return;
+        const next = parseUIResource(recoverableSurfaceResource({ resource: emission.payload['resource'], exchange: emission.payload['surfaceExchange'] }));
+        if (next) {
+            setRestored(next);
+            setLive(true);
+        }
+    };
+    useEffect(() => {
+        if (!caller || !info || !needsRecovery)
+            return;
+        let disposed = false;
+        const restore = () => {
+            if (pending.current || disposed || completed.current)
+                return;
+            const controller = new AbortController();
+            pending.current = controller;
+            void caller.restore({ ...info, signal: controller.signal, onSurface: emission => { if (!disposed)
+                    onSurface(emission); } })
+                .then(() => { if (!disposed)
+                completed.current = true; })
+                .catch(() => { })
+                .finally(() => { if (!disposed) {
+                pending.current = undefined;
+                setLive(false);
+            } });
+        };
+        restore();
+        window.addEventListener('focus', restore);
+        return () => {
+            disposed = true;
+            window.removeEventListener('focus', restore);
+            pending.current?.abort();
+            pending.current = undefined;
+            answerController.current?.abort();
+            answerController.current = undefined;
+        };
+    }, [caller, info?.exchangeId, needsRecovery]);
+    useEffect(() => () => answerController.current?.abort(), []);
+    const toolCall = caller ? async (submitted) => {
+        const controller = new AbortController();
+        answerController.current = controller;
+        try {
+            return await caller.answer({ call: submitted, signal: controller.signal, onSurface });
+        }
+        finally {
+            answerController.current = undefined;
+        }
+    } : onToolCall;
+    return { resource: restored ?? resource, restored: restored !== undefined, live, onToolCall: toolCall };
+}
+//# sourceMappingURL=useSurfaceRecovery.js.map

package/dist/react/styles/reference.css

@@ -36,11 +36,10 @@
 }
 
 /* Lets a long agent name inside (e.g. an AgentRuntimePicker trigger) shrink and ellipsis instead
-   of forcing the row wider — flex items default to min-width:auto, which blocks shrinking below
-   content size unless every ancestor in the chain opts out. Docked into a narrow sidebar (< 400px)
-   is exactly where this stops being cosmetic. */
+   of forcing the row wider, while retaining the fixed controls' intrinsic minimum. A zero floor
+   let the effort selector overflow this wrapper across the Send/Stop hit targets in a dock. */
 .jini-composer-footer-accessories {
-  min-width: 0;
+  min-width: min-content;
 }
 
 /* The picker, plus menu and send share this <div>; flex keeps them on one line, and it wraps
@@ -48,7 +47,7 @@
 .jini-composer-footer-trailing {
   display: flex;
   align-items: center;
-  min-width: 0;
+  min-width: min-content;
   margin-left: auto;
 }
 

package/dist/server/durable-runs/recover.js

@@ -165,7 +165,7 @@ export function createDurableRecovery(ports, { logger = console } = {}) {
         const events = recoveredRunEvents({ saved: savedWork({ run }) }, { notice: missingResume ? 'silent' : 'visible' });
         if (!await ports.store.advance({ run, nextRunId, now: ports.now(), events }, {}))
             return "superseded";
-        const next = await ports.store.load({ messageId: run.messageId }, {});
+        const next = await ports.store.load({ messageId: run.messageId }, { includeTranscriptEvents: false });
         // Cancel/deletion can win while the old attempt is being fenced. Re-read after CAS and do
         // not launch against a removed binding or a newer generation.
         if (!next || next.runId !== nextRunId)
@@ -234,7 +234,7 @@ export function createDurableRecovery(ports, { logger = console } = {}) {
     }
     /** The saved row after an await, or the outcome that ends this decision. O(1) store reads. */
     async function reload(run) {
-        const current = await ports.store.load({ messageId: run.messageId }, {});
+        const current = await ports.store.load({ messageId: run.messageId }, { includeTranscriptEvents: false });
         if (!current)
             return "gone";
         // A probe only speaks about the generation it inspected. Never apply its dead result to
@@ -264,7 +264,7 @@ export function createDurableRecovery(ports, { logger = console } = {}) {
     }
     return {
         async recover({ messageId, trigger, expectedRunId }, options) {
-            const run = await ports.store.load({ messageId }, {});
+            const run = await ports.store.load({ messageId }, { includeTranscriptEvents: false });
             if (!run)
                 return "gone";
             if (run.message.runStatus !== "queued" && run.message.runStatus !== "running")

package/dist/store/ports.d.ts

@@ -88,8 +88,22 @@ export interface ChatStore {
     delete(required: {
         readonly id: string;
     }, optional?: Record<string, never>): Promise<void>;
-    /** Compatibility read: all messages in stored position order; unauthorized returns []. */
-    messages(required: ChatMessagePageInput, optional?: Record<string, never>): Promise<ChatMessage[]>;
+    /** Compatibility read in stored order; unauthorized returns []. `false` omits event columns;
+     * `user` keeps input receipts/folders without reading prior assistant payloads. */
+    messages(required: ChatMessagePageInput, optional?: {
+        readonly includeEvents?: boolean | "user";
+    }): Promise<ChatMessage[]>;
+    /** Optional indexed compatibility read; unknown and other-owned rows both return null. */
+    message?(required: ChatMessagePageInput & {
+        readonly messageId: string;
+    }, optional?: Record<string, never>): Promise<ChatMessage | null>;
+    /** Cheap owner-scoped history validator; reads metadata, never message/event payloads. */
+    messagesVersion?(required: ChatMessagePageInput, optional?: Record<string, never>): Promise<string | null>;
+    /** JSON response chunks, preserving stored event JSON instead of serializing event object trees.
+     * The optional ordering policy sees message metadata and receipt-derived folders, without events. */
+    messagesJson?(required: ChatMessagePageInput, optional?: {
+        readonly orderMessages?: (messages: ChatMessage[]) => ChatMessage[];
+    }): Promise<AsyncIterable<string>>;
     /** Idempotent update by message ID within its original conversation; unauthorized: null. */
     appendMessage(required: {
         readonly conversationId: string;
@@ -100,7 +114,7 @@ export interface ChatStore {
     readonly search?: ChatSearchCapability;
 }
 /** Eight-method compatibility subset plus optional bounded history; old hosts/fakes still fit. */
-export type ChatHistoryStore = Pick<ChatStore, 'list' | 'get' | 'create' | 'rename' | 'touch' | 'delete' | 'messages' | 'appendMessage' | 'history'>;
+export type ChatHistoryStore = Pick<ChatStore, 'list' | 'get' | 'create' | 'rename' | 'touch' | 'delete' | 'messages' | 'message' | 'messagesJson' | 'messagesVersion' | 'appendMessage' | 'history'>;
 /** Internal persistence projections. Model-facing tools redact and cap these before returning. */
 export interface ChatHistoryReader {
     list(required: Record<string, never>, optional?: {

package/dist/store/runtime/chat-expiry-sweep.js

@@ -1,3 +1,5 @@
+import { inspect } from 'node:util';
+import { redactSecrets } from '@jini-ai/core';
 import { ChatStoreError } from "../errors.js";
 /**
  * @file Retention for chat history: deletes every conversation whose `expires_at` has passed.
@@ -47,7 +49,7 @@ export function startChatExpirySweep({ maintenance }, options = {}) {
     const onError = options.onError ??
         ((error) => {
             // eslint-disable-next-line no-console
-            console.warn(`[chat-expiry-sweep] sweep failed: ${error instanceof Error ? error.message : String(error)}`);
+            console.warn('[chat-expiry-sweep] sweep failed:', redactSecrets({ input: inspect(error) }, { redactPii: false }));
         });
     let active;
     const pass = () => {

package/dist/store/runtime/chat-history-store.js

@@ -50,6 +50,12 @@ export function createChatHistoryStore({ kernel: hostKernel, scope, isDaemonRunI
         async messages(required, optional = {}) {
             return repairLegacyTurnOrder({ messages: await store.messages(required, optional), isDaemonRunId }, {});
         },
+        // Raw history must apply the same repair before emitting chunks; ordering never needs events.
+        async messagesJson(required, optional = {}) {
+            return store.messagesJson(required, { ...optional,
+                orderMessages: messages => repairLegacyTurnOrder({ messages, isDaemonRunId }, {}),
+            });
+        },
     };
 }
 function storeFactory(transport) {

package/dist/store/runtime/checkpoint-delta.d.ts

@@ -0,0 +1,35 @@
+import type { AgentEvent } from "../../core/index.js";
+import type { CheckpointState, RunProgress } from "../../core/durable-runs/ledger-contracts.js";
+/** A delta may append events or replace the final coalesced text event. Every earlier event
+ * must match; replay reordering, thinking replacement and tool identity deduplication fall back.
+ * @complexity O(prefix bytes + new suffix bytes) time; O(new suffix bytes) temporary space. */
+export declare function checkpointDelta({ previous, progress }: {
+    previous: CheckpointState;
+    progress: RunProgress;
+}, _options?: {}): {
+    removeCharacters: number;
+    suffix: string;
+    grown: boolean;
+} | undefined;
+/** Same tool identity rule as the full checkpoint's progress check. O(saved + incoming events). */
+export declare function hasNewToolProgress({ saved, incoming }: {
+    saved: readonly AgentEvent[];
+    incoming: readonly AgentEvent[];
+}, _options?: {}): boolean;
+/** Durable tool identity shared by the full merge and delta progress check. */
+export declare function toolKey({ event }: {
+    event: AgentEvent;
+}, _options?: {}): string;
+/** Build a receipt only for an exact incoming projection; callers own its watch lifetime.
+ * SQL supplies content/event lengths; the removed tail counts Unicode code points. Retain only
+ * a bounded suffix for CAS, so a multi-MB tool result never becomes a guard parameter twice.
+ * @complexity O(last event bytes) serialization/counting; O(last event bytes) transient space,
+ * with at most 256 UTF-16 units retained beyond the existing projection references.
+ */
+export declare function checkpointState({ progress, length, contentLength, version }: {
+    progress: RunProgress;
+    length: number;
+    contentLength: number;
+    version: string;
+}, _options?: {}): CheckpointState;
+//# sourceMappingURL=checkpoint-delta.d.ts.map