@lunora/agent 1.0.0-alpha.8 → 1.0.0-alpha.81

package/dist/packem_shared/{types.d-boAM2Yi1.d.ts → types.d-DTKxPuh_.d.ts}

@@ -23,7 +23,7 @@ interface AgentStepLike {
   /**
    * Durably hibernate until an external event of `type` arrives, then return
    * its payload. Used for human-in-the-loop approvals: a run pauses on
-   * `approval:<toolCallId>` until a client resolves it. Like `do`, a resolved
+   * `approval:<toolCallId>` until a client resolves it. Like `do`, a resolved
    * wait is memoized — a replay returns the recorded decision without pausing
    * again. Signature mirrors `@lunora/workflow`'s `WorkflowStepLike`.
    */
@@ -42,13 +42,26 @@ interface AgentStepLike {
  * `idempotencyKey`.
  *
  * The `idempotencyKey` is the deterministic durable-step name
- * (`tool:&lt;name>:&lt;toolCallId>`). A COMPLETED tool step is never re-run on a
- * workflow replay (native step memoization) — but a step that FAILS mid-body
- * is retried at-least-once, so a side-effecting tool (charge a card, send a
- * mail) must dedupe on this key itself.
+ * (`tool:<name>:<toolCallId>`, further suffixed per script step for a
+ * `codeTool`). A COMPLETED tool step is never re-run on a workflow replay
+ * (native step memoization) — but a step that FAILS mid-body is retried
+ * at-least-once, so a side-effecting tool (charge a card, send a mail) must
+ * dedupe on this key itself. `functionTool` forwards it to the dispatched
+ * function as `args.idempotencyKey` (pinned after the model input, so it
+ * can't be overridden) — a function that wants to dedupe declares
+ * `idempotencyKey: v.optional(v.string())` in its own args and checks it; a
+ * function that ignores it is unaffected (an undeclared arg field is dropped,
+ * not rejected).
  * @experimental
  */
 interface AgentToolContext {
+  /**
+   * How many sub-agent delegations deep this run already is — 0 for a run a
+   * user started, one more per `agent.asTool` hop. The loop copies it off
+   * {@link AgentRunInput.depth}; `agent.asTool` reads it to refuse spawning a
+   * child past the delegation-depth bound (see `as-tool.ts`). Absent is 0.
+   */
+  depth?: number;
   /** The Worker environment bindings. */
   env: Record<string, unknown>;
   /**
@@ -102,11 +115,45 @@ interface AgentToolContext {
    * skip the write when it is already present.
    */
   setState: (state: Record<string, unknown>) => Promise<void>;
+  /**
+   * The durable-step handle (`step.do`/`waitForEvent`). ALWAYS present:
+   * `agent-loop.ts` threads it into every tool's context unconditionally, and
+   * it is required rather than optional so a missing handle is a compile
+   * error instead of a silent durability downgrade. `codeTool` uses it to give
+   * each script step its OWN nested durable boundary — see `code-tool.ts` — so
+   * a failure at script step 3 retries only step 3, not steps 1–2's
+   * already-committed side effects. Cloudflare Workflows supports a `step.do`
+   * nested inside another `step.do`'s callback (the codeTool call's own
+   * enclosing step). Most tools never touch this directly; a test driving
+   * `execute`/`runToolScript` by hand passes a pass-through double.
+   */
+  step: AgentStepLike;
   /** The thread this tool call belongs to. */
   threadKey: string;
   /** The provider-issued tool-call id. */
   toolCallId: string;
 }
+/**
+ * The view of {@link AgentToolContext} handed to a `needsApproval` gate
+ * function — every field except `setState`, `step`, and `reportProgress`.
+ *
+ * `setState` is dropped because a gate that mutates thread state is a side
+ * effect inside a decision predicate, and `reportProgress` because emitting a
+ * live event is the same thing in observable form — the decision is what the
+ * loop reports, not the deciding. `step` goes because the loop already runs the
+ * gate inside a durable step of its own, so a gate has no business opening
+ * another.
+ *
+ * `getState` and `run` stay: reads are legitimate gate inputs (gate on the
+ * caller's plan tier, on a spend total), and the gate resolves inside its own
+ * durable step, so they are replay-safe there. Note this makes the type a
+ * NARROWING, not a proof of purity — `run` takes any
+ * {@link AgentFunctionReference}, so a gate can still dispatch a mutation
+ * before approval. Nothing in the type system distinguishes a query reference
+ * from a mutation one; keeping the gate side-effect-free is the author's.
+ * @experimental
+ */
+type AgentApprovalContext = Omit<AgentToolContext, "reportProgress" | "setState" | "step">;
 /**
  * An agent tool. Unlike a raw AI SDK tool, `execute` is NOT handed to the
  * model call — the loop runs it itself inside a named durable step so a
@@ -127,17 +174,25 @@ interface AgentToolDefinition<Input = unknown, Output = unknown> {
    * Gate the tool behind a human approval (mirrors the AI SDK's
    * `needsApproval`). When it resolves truthy the durable run PAUSES — the
    * thread moves to `"awaiting_input"` and the workflow hibernates on
-   * `approval:&lt;toolCallId>` — until a client calls `agents:agentResolveApproval`.
+   * `approval:<toolCallId>` — until a client calls `agents:agentResolveApproval`.
    * On approve the tool runs exactly as normal; on reject it is skipped and a
    * tool result explaining the rejection is persisted so the next turn recovers.
    * A boolean gates statically; a function gates per input. Default: `false`
-   * (unchanged behavior). Evaluated from replay-stable input OUTSIDE the
-   * durable step (it re-runs on every replay), so it must be a PURE predicate:
-   * deterministic (no `Date.now()`/`Math.random()`) and free of side effects —
-   * never call {@link AgentToolContext.setState}/`getState` or a mutating `run`
-   * here; state writes belong only in `execute`, inside the memoized step.
+   * (unchanged behavior).
+   *
+   * The boolean/`undefined` forms are compile-time constants re-derived
+   * identically on every replay — no durable step. The FUNCTION form runs
+   * inside its OWN durable step (`tool:approval-gate:<toolCallId>`, distinct
+   * from the tool's own step), so it now runs exactly once per call, not once
+   * per replay. It must still be otherwise pure: deterministic given its
+   * inputs (no `Date.now()`/`Math.random()`) and free of side effects — the
+   * context it receives is {@link AgentApprovalContext}, which has neither
+   * `setState` nor `reportProgress`; state writes and progress events belong
+   * only in `execute`, inside the tool's own memoized step. It still holds
+   * `run`, which the type cannot narrow to reads — see
+   * {@link AgentApprovalContext}.
    */
-  needsApproval?: ((input: Input, context: AgentToolContext) => boolean | Promise<boolean>) | boolean;
+  needsApproval?: ((input: Input, context: AgentApprovalContext) => boolean | Promise<boolean>) | boolean;
 }
 /**
  * Author-supplied tool config (see {@link AgentToolDefinition}).
@@ -252,7 +307,7 @@ interface AgentMemoryOptions {
  * (`key: "default"`) from {@link AgentConfig.memory}, then one per skill that
  * carries `knowledge` (keyed by the skill's name). The key names the durable
  * step — the default source keeps the historic `"memory:retrieve"`, a skill
- * source uses `"memory:retrieve:&lt;key>"` — so replay stays deterministic.
+ * source uses `"memory:retrieve:<key>"` — so replay stays deterministic.
  * @experimental
  */
 interface AgentMemorySource extends AgentMemoryOptions {
@@ -308,7 +363,7 @@ interface SkillConfig {
   knowledge?: AgentMemoryOptions;
   /**
    * The skill's identifier — namespaces this skill's `knowledge` memory source
-   * (the durable step `memory:retrieve:&lt;name>`). Must be identifier-shaped.
+   * (the durable step `memory:retrieve:<name>`). Must be identifier-shaped.
    */
   name: string;
   /**
@@ -318,6 +373,12 @@ interface SkillConfig {
    */
   tools?: Record<string, AnyAgentTool>;
 }
+/**
+ * The code-side parts of a markdown-authored skill — everything `SKILL.md`
+ * cannot carry. `name` and `instructions` come from the file itself.
+ * @experimental
+ */
+type SkillMarkdownExtras = Omit<SkillConfig, "instructions" | "name">;
 /**
  * A `defineSkill` result — config plus the brand the agent merge checks.
  * @experimental
@@ -358,11 +419,43 @@ interface AgentStepFinishInfo {
 }
 /**
  * Called after each LLM turn with that turn's text, tool calls, and usage. Runs
- * inside a named durable step (`agent:step-finish:&lt;turn>`) so it fires exactly
+ * inside a named durable step (`agent:step-finish:<turn>`) so it fires exactly
  * once per turn even across a workflow replay.
  * @experimental
  */
 type AgentOnStepFinish = (info: AgentStepFinishInfo) => Promise<void> | void;
+/**
+ * What {@link AgentConfig.onReply} is called with when a triggered run reaches
+ * its final answer.
+ * @experimental
+ */
+interface AgentReplyInfo {
+  /** The worker `env` — where an outbound credential (a bot token, a mailer binding) lives. */
+  env: Record<string, unknown>;
+  /** Where to reply, captured by the mapper that started this run. */
+  replyRef: AgentReplyRef;
+  /** The run's final answer. */
+  result: AgentRunResult;
+  /** The thread this run belongs to. */
+  threadKey: string;
+}
+/**
+ * Send a triggered run's answer back where it came from — the outbound half of
+ * an `onEmail` / `onInbound` trigger.
+ *
+ * Called once, automatically, when a run started with a `replyRef` produces a
+ * final answer; a run without one (an ordinary in-app `ctx.agents.<name>.run`)
+ * never calls it. It runs inside a named durable step, so a transient failure
+ * is retried and a workflow replay does not send the answer twice.
+ *
+ * Delivery is the app's call, because only the app has the credential: email
+ * has a home already (`replyToEmail(mailer, ref, body)` from
+ * `@lunora/agent/reply`), while Slack/GitHub/Discord bot tokens have no
+ * framework-owned store yet — read them from `info.env` and make the provider
+ * call.
+ * @experimental
+ */
+type AgentOnReply = (info: AgentReplyInfo) => Promise<void> | void;
 /**
  * The input {@link AgentConfig.prepareStep} sees before a turn runs.
  * @experimental
@@ -404,6 +497,39 @@ type AgentPrepareStep = (input: AgentPrepareStepInput) => AgentPrepareStepResult
  * start a run from an inbound email.
  * @experimental
  */
+/**
+ * Where a triggered run should send its answer back to — captured by the
+ * mapper, from fields the verified inbound payload already carries, and carried
+ * through the run so {@link AgentConfig.onReply} can answer in the same place
+ * the question was asked.
+ *
+ * A discriminated union rather than an opaque blob because each channel threads
+ * differently: email by RFC 5322 `In-Reply-To`/`References`, Slack by
+ * `thread_ts`, GitHub by issue number, Discord by channel (plus the triggering
+ * message for a true reply).
+ * @experimental
+ */
+type AgentReplyRef = {
+  channel: "discord";
+  channelId: string;
+  messageId?: string;
+} | {
+  channel: "email";
+  from: string;
+  messageId: string;
+  references?: string;
+  to: string[];
+} | {
+  channel: "github";
+  commentId?: number;
+  issueNumber: number;
+  owner: string;
+  repo: string;
+} | {
+  channel: "slack";
+  channelId: string;
+  threadTs: string;
+};
 interface AgentEmailRun {
   /** The user message that starts (or continues) the thread — the model's prompt. */
   input: string;
@@ -414,6 +540,13 @@ interface AgentEmailRun {
    * `email.from`.
    */
   owner?: string;
+  /**
+   * Where to send the answer — see {@link AgentReplyRef}. Populate it from the
+   * event the mapper already has (`captureEmailReplyRef(email)` does it for
+   * email) and the run calls {@link AgentConfig.onReply} with it once the
+   * final answer is ready. Omit it and the run simply never replies.
+   */
+  replyRef?: AgentReplyRef;
   /** The thread key — reuse to continue a conversation (e.g. a ticket id parsed from the subject). */
   threadKey: string;
   /** Optional thread title, set on first creation. */
@@ -484,6 +617,22 @@ interface AgentInboundChannel {
 interface AgentConfig {
   /** Restrict the tools the model may call, by name. Default: all tools. */
   activeTools?: ReadonlyArray<string>;
+  /**
+   * How long a human-in-the-loop tool approval may stay pending before the
+   * run stops waiting — a Cloudflare Workflows duration: milliseconds, or a
+   * `"<n> <unit>"` string like `"3 days"` (the unit set is the host's, so a
+   * typo is a compile error). Default `"3 days"`.
+   *
+   * On timeout the call is treated as REJECTED (the run records why and
+   * continues down the normal rejection path), so a run whose approver never
+   * answers ends instead of hibernating forever.
+   *
+   * CLAMPED to one week. A longer wait would outlive the thread's
+   * abandoned-run horizon, letting a new run reclaim the thread while the
+   * approval is still pending — which is the exact failure this timeout
+   * exists to prevent, so it cannot be configured back into existence.
+   */
+  approvalTimeout?: `${number} ${"day" | "hour" | "minute" | "month" | "second" | "week" | "year"}${"s" | ""}` | number;
   /**
    * Automatic thread-history compaction. When the persisted history exceeds
    * `maxMessages`, the loop summarizes the older messages (all but the most
@@ -530,7 +679,7 @@ interface AgentConfig {
   model: AgentModelInput;
   /**
    * Optional override for the deployed workflow name (`wrangler.jsonc`
-   * `workflows[].name`). Defaults to `agent-&lt;kebab-cased export name>`. Does
+   * `workflows[].name`). Defaults to `agent-<kebab-cased export name>`. Does
    * NOT change the binding name, which is always derived from the export
    * name (`support` → `AGENT_SUPPORT`).
    */
@@ -543,7 +692,16 @@ interface AgentConfig {
    *
    * - `"reject"` (default) — fail the new run fast with a `CONFLICT` error.
    * - `"replace"` — terminate the in-flight instance and take the thread over.
-   * - `"queue"` — reserved for a future durable queue; currently degrades to `"reject"` (no queue exists yet), tracked as a follow-up.
+   * - `"queue"` — park the new run behind the one in flight (FIFO, up to five deep) and hibernate it until the thread is handed over.
+   *
+   * Each parked run is a live workflow instance waiting on an event, so the
+   * queue's depth cap is a real resource bound: past it, a start is rejected
+   * exactly as `"reject"` would. A `"replace"` arriving later supersedes the
+   * run in FLIGHT, not the queue — parked runs still take their turn after it.
+   *
+   * A dispatch with no instance id (the inbound-email / inbound-channel
+   * paths) cannot be parked, because nothing later can tell it apart from
+   * another such dispatch to wake it; `"queue"` rejects those.
    *
    * A workflow REPLAY re-enters the bootstrap under the SAME instance id and
    * is never a concurrent run (the guard compares the stored instance id).
@@ -563,6 +721,12 @@ interface AgentConfig {
    * signature over the raw body before calling `map`.
    */
   onInbound?: AgentInboundChannel;
+  /**
+   * Called with the final answer when the run was triggered from a channel
+   * that gave it a `replyRef` — see {@link AgentOnReply}. This is how an
+   * inbound-triggered agent answers where it was asked.
+   */
+  onReply?: AgentOnReply;
   /** Called after each LLM turn — see {@link AgentOnStepFinish}. */
   onStepFinish?: AgentOnStepFinish;
   /**
@@ -577,7 +741,7 @@ interface AgentConfig {
    * Opt this agent into being STARTED over the public RPC boundary — i.e. via
    * the auto-registered `agents:agentRun` mutation an HTTP-only client (e.g.
    * the `@lunora/mcp` server) calls. Default `false`: an agent is startable
-   * only from server-side app code (`ctx.agents.&lt;name>.run(...)`), so declaring
+   * only from server-side app code (`ctx.agents.<name>.run(...)`), so declaring
    * an agent does NOT expose it to arbitrary RPC callers. Fail-closed — the run
    * mutation refuses an agent that has not opted in, regardless of any MCP-side
    * `allowAgents` configuration. A started thread is still owner-scoped to
@@ -649,8 +813,20 @@ interface AgentVoiceConfig {
   /**
    * Spoken on connect before the first user turn — a fixed greeting synthesized
    * through the TTS model. Omit for a silent-until-spoken-to session.
+   *
+   * Synthesized once per THREAD, not once per socket: the greeting's persisted
+   * row is keyed per thread, and a reconnect onto a thread that already exists
+   * gets the `ready` frame without paying for the same line again.
    */
   greeting?: string;
+  /**
+   * Cap on how many turns one voice socket may run before it is closed with
+   * code `4002`. Every turn is a full LLM generation plus sentence-by-sentence
+   * TTS — billed and persisted — on a hibernatable socket that can live for
+   * days, and the one-turn-in-flight guard throttles nothing. Defaults to 100;
+   * a client that hits the cap reconnects for a fresh budget.
+   */
+  maxTurns?: number;
   /**
    * TTS voice/speaker id forwarded to the TTS model (e.g. a Deepgram Aura voice
    * like `"aura-asteria-en"`). Model-specific; omitted when unset so the model
@@ -685,10 +861,10 @@ interface AgentSubToolInput {
 interface AgentAsToolOptions {
   /** What the sub-agent does — shown to the parent's model (it decides from it). */
   description: string;
-  /** Cap on child-run status polls before giving up. Default 120. */
+  /** Cap on child-run status polls before giving up — a positive integer. Default 120. */
   maxPolls?: number;
   /**
-   * The child agent's export name — selects its `AGENT_&lt;NAME>` Workflow
+   * The child agent's export name — selects its `AGENT_<NAME>` Workflow
    * binding (e.g. `"researcher"` → `AGENT_RESEARCHER`). The model-facing tool
    * name is the KEY assigned in the parent's `tools` map, not this.
    */
@@ -725,11 +901,39 @@ interface AgentDefinition extends AgentConfig {
    */
   memorySources?: ReadonlyArray<AgentMemorySource>;
 }
+/**
+ * What `agentEnsureThread` reports back to the loop.
+ *
+ * A discriminated union rather than a bag of optional booleans: the four
+ * outcomes are mutually exclusive, and the data each carries only exists for its
+ * own case. `queued` has a position, `replaced` has the instance it took the
+ * thread from, and the other two have nothing — encoding that as five
+ * independent optional fields made every reader re-derive which combination was
+ * legal.
+ * @experimental
+ */
+type EnsureThreadOutcome = {
+  outcome: "continued" | "created";
+} | {
+  outcome: "queued";
+  position: number;
+} | {
+  outcome: "replaced";
+  priorInstanceId: string;
+};
 /**
  * Params of one agent run (the compiled workflow's payload).
  * @experimental
  */
 interface AgentRunInput {
+  /**
+   * Sub-agent delegation depth. A run a user starts omits it (0); each
+   * `agent.asTool` hop stamps its child one deeper, and the tool refuses to
+   * delegate past the bound — `maxTurns` bounds one level's turns, this bounds
+   * the TREE (every hop mints a distinct child `threadKey`, so the per-thread
+   * run-queue cap never applies across them).
+   */
+  depth?: number;
   /** The user message that starts (or continues) the thread. */
   input: string;
   /**
@@ -741,6 +945,8 @@ interface AgentRunInput {
    * the first run.
    */
   owner?: string;
+  /** Where a triggered run sends its answer — see {@link AgentReplyRef}. */
+  replyRef?: AgentReplyRef;
   /** The thread key — reuse to continue a conversation. */
   threadKey: string;
   /** Optional thread title, set on first creation. */
@@ -773,6 +979,17 @@ interface AgentRunResult {
  */
 interface AgentFunctionPaths {
   appendMessage: string;
+  /**
+   * The internal `agents:agentCompleteRun` mutation the loop dispatches at the
+   * end of a run: it writes the terminal status AND hands the thread to the
+   * next queued run in the same mutation.
+   */
+  completeRun: string;
+  /**
+   * The internal `agents:agentDeleteMessage` mutation the loop dispatches to
+   * retire the HITL approval marker once the decision has landed.
+   */
+  deleteMessage: string;
   ensureThread: string;
   /** The internal `agents:agentEpisodeRecall` query the loop dispatches for an episodic-kind read. */
   episodeRecall: string;
@@ -1078,7 +1295,7 @@ interface AgentRunHandle {
   id: string;
 }
 /**
- * The `ctx.agents.&lt;name>` producer handle.
+ * The `ctx.agents.<name>` producer handle.
  * @experimental
  */
 interface AgentHandle {
@@ -1111,4 +1328,4 @@ interface AgentHandle {
   /** Read a run's workflow status by instance id. */
   status: (id: string) => Promise<unknown>;
 }
-export { AgentDefinition as A, AgentGenerateOptions as B, AgentGenerateResult as C, AgentInstructionsContext as D, AgentLiveEvent as E, AgentMemoryOptions as F, AgentMemorySource as G, AgentMessageStatus as H, InboundChannelEvent as I, AgentOnStepFinish as J, AgentPrepareStep as K, AgentPrepareStepInput as L, AgentPrepareStepResult as M, AgentProgressEvent as N, AgentRunHandle as O, AgentStepFinishInfo as P, AgentStepInfo as Q, AgentThreadStatus as R, SkillDefinition as S, AgentTokenDelta as T, AgentToolCall as U, AgentUsage as V, AgentVoiceConfig as W, AgentWorkflowBindingLike as X, AgentWorkflowInstanceLike as Y, AgentToolContext as a, AgentToolDefinition as b, AgentCompact as c, AgentEpisodeExtract as d, AgentGraphExtract as e, AgentGenerate as f, AgentTokenSink as g, AgentRunInput as h, AgentFunctionPaths as i, AgentRunFunction as j, AgentStepLike as k, AgentStreamGenerate as l, AgentRunResult as m, AgentMessageRow as n, AgentConfig as o, AnyAgentTool as p, AgentAsToolOptions as q, AgentSubToolInput as r, AgentBindingSpec as s, AgentHandle as t, AgentToolConfig as u, AgentFunctionReference as v, AgentModelInput as w, SkillConfig as x, AgentEmailMapper as y, AgentEmailRun as z };
+export { AgentVoiceConfig as $, AgentDefinition as A, AgentApprovalContext as B, AgentEmailMapper as C, AgentEmailRun as D, AgentGenerateOptions as E, AgentGenerateResult as F, AgentInstructionsContext as G, AgentLiveEvent as H, InboundChannelEvent as I, AgentMemoryOptions as J, AgentMemorySource as K, AgentMessageStatus as L, AgentOnReply as M, AgentOnStepFinish as N, AgentPrepareStep as O, AgentPrepareStepInput as P, AgentPrepareStepResult as Q, AgentProgressEvent as R, SkillMarkdownExtras as S, AgentReplyInfo as T, AgentRunHandle as U, AgentStepFinishInfo as V, AgentStepInfo as W, AgentThreadStatus as X, AgentTokenDelta as Y, AgentToolCall as Z, AgentUsage as _, AgentReplyRef as a, AgentWorkflowBindingLike as a0, AgentWorkflowInstanceLike as a1, EnsureThreadOutcome as a2, AgentToolContext as b, AgentToolDefinition as c, SkillDefinition as d, AgentCompact as e, AgentEpisodeExtract as f, AgentGraphExtract as g, AgentGenerate as h, AgentTokenSink as i, AgentRunInput as j, AgentFunctionPaths as k, AgentRunFunction as l, AgentStepLike as m, AgentStreamGenerate as n, AgentRunResult as o, AgentMessageRow as p, AgentConfig as q, AnyAgentTool as r, AgentAsToolOptions as s, AgentSubToolInput as t, AgentBindingSpec as u, AgentHandle as v, AgentToolConfig as w, AgentFunctionReference as x, AgentModelInput as y, SkillConfig as z };

package/dist/packem_shared/voice-turn-DhxJgQW1.mjs

@@ -0,0 +1 @@
+import{f as P,a as q}from"./base64-5eyBfWO3.mjs";import{compactHistory as z}from"./runAgentLoop-oAmn3OyN.mjs";import{buildModelMessages as G}from"./buildModelMessages-Y4tGo1T9.mjs";import{toFunctionReference as T}from"./AGENT_MODULE-M4D1EejI.mjs";const D=new TextDecoder;new TextEncoder;const N="=",Q=t=>{if(t)try{const e=t[0]==="{"?t:D.decode(P(t)),n=JSON.parse(e);if(n&&typeof n=="object"&&!Array.isArray(n))return n}catch{}},ct=t=>{if(t){if(!t.startsWith(N))return t;try{return D.decode(P(t.slice(N.length)))}catch{return}}},dt=t=>{const e=Number(t);return Number.isFinite(e)&&e>0?e:void 0},ut=t=>typeof t=="number"&&Date.now()>=t,ft=t=>{try{t.send(JSON.stringify({code:"TOKEN_EXPIRED",error:{code:"TOKEN_EXPIRED",message:"authentication token expired"},type:"error"})),t.close?.(4001,"token_expired")}catch{}},Y=16e3,Z=1,tt=16,M=/[.!?]\s/u,et=/\s/u,nt=async function*(t){if(t instanceof Uint8Array){yield t;return}if(t instanceof ReadableStream){const e=t.getReader();try{for(;;){const{done:n,value:r}=await e.read();if(n)break;yield r}}finally{e.releaseLock()}return}yield*t},yt=(t,e=Y,n=Z,r=tt)=>{const i=n*r/8,p=e*i,m=new ArrayBuffer(44+t.byteLength),s=new DataView(m),u=(l,E)=>{for(let d=0;d<E.length;d+=1)s.setUint8(l+d,E.codePointAt(d)??0)};u(0,"RIFF"),s.setUint32(4,36+t.byteLength,!0),u(8,"WAVE"),u(12,"fmt "),s.setUint32(16,16,!0),s.setUint16(20,1,!0),s.setUint16(22,n,!0),s.setUint32(24,e,!0),s.setUint32(28,p,!0),s.setUint16(32,i,!0),s.setUint16(34,r,!0),u(36,"data"),s.setUint32(40,t.byteLength,!0);const a=new Uint8Array(m);return a.set(t,44),a},st=t=>{const e=[];let n=t,r=M.exec(n);for(;r;){let i=r.index+1;for(;i<n.length&&et.test(n[i]??"");)i+=1;const p=n.slice(0,i).trim();p.length>0&&e.push(p),n=n.slice(i),r=M.exec(n)}return{rest:n,sentences:e}},pt=async t=>{const{agent:e,compact:n,connectionId:r,env:i,exportName:p,owner:m,paths:s,pcm:u,run:a,send:l,sendAudio:E,signal:d,streamGenerate:C,synthesize:H,text:L,threadKey:o,transcribe:F,turn:U,waitForDrain:O}=t,h=()=>d.aborted,v=T(s.appendMessage),$=T(s.ensureThread),B=T(s.listMessages),b=T(s.patchThread);await a($,{agent:p,key:o,...e.initialState===void 0?{}:{initialState:e.initialState},...m===void 0?{}:{owner:m}});try{const f=(L??(u?await F(u):"")).trim();if(f.length===0)return await a(b,{key:o,status:"idle"}),{assistantText:"",interrupted:!1,userText:""};l({text:f,type:"user_transcript"}),await a(v,{content:f,messageKey:`voice:${r}:${String(U)}:user`,role:"user",threadKey:o}),await a(b,{key:o,status:"running"});const I=typeof e.instructions=="function"?e.instructions({env:i,input:f,threadKey:o}):e.instructions,K=await a(B,{key:o}),{history:j,summary:R}=await z({agent:e,compact:n,env:i},K),W=G({history:j,...I===void 0?{}:{instructions:I},...R===void 0?{}:{summary:R}});let g="",w="",S=Promise.resolve();const V=async c=>{if(h()||c.length===0)return;let x=!1;try{for await(const y of nt(await H(c,d))){if(h()||(await O?.(),h()))break;E(y),x=!0}}catch(y){l({message:y instanceof Error?y.message:String(y),type:"error"})}x&&(w=w.length>0?`${w} ${c}`:c)},_=c=>{S=S.then(async()=>V(c))},X=await C({messages:W,signal:d},c=>{if(h())return;l({text:c,type:"assistant_delta"}),g+=c;const{rest:x,sentences:y}=st(g);g=x;for(const J of y)_(J)});!h()&&g.trim().length>0&&_(g.trim()),g="",await S;const A=h(),k=A?w:X.text;return await a(v,{content:k,messageKey:`voice:${r}:${String(U)}:assistant`,role:"assistant",threadKey:o}),await a(b,{key:o,status:"idle"}),l(A?{type:"interrupted"}:{text:k,type:"assistant_done"}),{assistantText:k,interrupted:A,userText:f}}catch(f){throw await a(b,{key:o,status:"idle"}),f}},lt=t=>Q(t),ht=t=>{if(typeof t=="object"&&t!==null&&"text"in t){const{text:e}=t;return typeof e=="string"?e:""}return""},gt=t=>{if(t instanceof Uint8Array||t instanceof ReadableStream)return t;if(t instanceof Response&&t.body)return t.body;if(typeof t=="object"&&t!==null&&"audio"in t){const{audio:e}=t;if(typeof e=="string")return q(e);if(e instanceof ReadableStream||e instanceof Uint8Array)return e}return new Uint8Array(0)};export{dt as a,ft as b,yt as c,ct as d,ht as e,gt as f,ut as i,lt as p,pt as r,nt as t};

package/dist/reply.d.mts

@@ -0,0 +1,40 @@
+import { Mailer } from '@lunora/mail';
+import { InboundEmail } from '@lunora/mail/inbound';
+import { a as AgentReplyRef } from "./packem_shared/types.d-DTKxPuh_.mjs";
+import 'ai';
+/** The email arm of {@link AgentReplyRef}, narrowed for the helpers below. */
+type EmailReplyRef = Extract<AgentReplyRef, {
+  channel: "email";
+}>;
+/**
+ * Capture a reply reference from an already-parsed inbound email — call it in
+ * an `onEmail` mapper and put the result on the run's `replyRef`.
+ *
+ * Returns `undefined` when the message carries no `Message-ID`: there is
+ * nothing to thread a reply against, and an unthreaded reply lands as a new
+ * conversation in the recipient's client, which is worse than not replying.
+ */
+declare const captureEmailReplyRef: (email: InboundEmail) => EmailReplyRef | undefined;
+/** RFC 5322 threading: append the replied-to id to any existing `References` chain. */
+declare const buildReferences: (replyRef: EmailReplyRef) => string;
+/** Subject + body of a reply. */
+interface ReplyBody {
+  subject: string;
+  text: string;
+}
+/**
+ * Send a threaded reply through the app's own `@lunora/mail` mailer.
+ *
+ * The mailer is a parameter rather than something this module constructs: the
+ * app already configures one (API key or `send_email` binding), and passing it
+ * in keeps this module free of any runtime dependency on `@lunora/mail`.
+ *
+ * The reply goes to the original sender, from the mailer's configured default.
+ * An app running several aliases that wants the reply to come from whichever
+ * mailbox received the message passes `from: replyRef.to[0]` itself — a
+ * decision only the app can make.
+ */
+declare const replyToEmail: (mailer: Mailer, replyRef: EmailReplyRef, body: ReplyBody) => Promise<{
+  id: string;
+}>;
+export { type EmailReplyRef, ReplyBody, buildReferences, captureEmailReplyRef, replyToEmail };

package/dist/reply.d.ts

@@ -0,0 +1,40 @@
+import { Mailer } from '@lunora/mail';
+import { InboundEmail } from '@lunora/mail/inbound';
+import { a as AgentReplyRef } from "./packem_shared/types.d-DTKxPuh_.js";
+import 'ai';
+/** The email arm of {@link AgentReplyRef}, narrowed for the helpers below. */
+type EmailReplyRef = Extract<AgentReplyRef, {
+  channel: "email";
+}>;
+/**
+ * Capture a reply reference from an already-parsed inbound email — call it in
+ * an `onEmail` mapper and put the result on the run's `replyRef`.
+ *
+ * Returns `undefined` when the message carries no `Message-ID`: there is
+ * nothing to thread a reply against, and an unthreaded reply lands as a new
+ * conversation in the recipient's client, which is worse than not replying.
+ */
+declare const captureEmailReplyRef: (email: InboundEmail) => EmailReplyRef | undefined;
+/** RFC 5322 threading: append the replied-to id to any existing `References` chain. */
+declare const buildReferences: (replyRef: EmailReplyRef) => string;
+/** Subject + body of a reply. */
+interface ReplyBody {
+  subject: string;
+  text: string;
+}
+/**
+ * Send a threaded reply through the app's own `@lunora/mail` mailer.
+ *
+ * The mailer is a parameter rather than something this module constructs: the
+ * app already configures one (API key or `send_email` binding), and passing it
+ * in keeps this module free of any runtime dependency on `@lunora/mail`.
+ *
+ * The reply goes to the original sender, from the mailer's configured default.
+ * An app running several aliases that wants the reply to come from whichever
+ * mailbox received the message passes `from: replyRef.to[0]` itself — a
+ * decision only the app can make.
+ */
+declare const replyToEmail: (mailer: Mailer, replyRef: EmailReplyRef, body: ReplyBody) => Promise<{
+  id: string;
+}>;
+export { type EmailReplyRef, ReplyBody, buildReferences, captureEmailReplyRef, replyToEmail };

package/dist/reply.mjs

@@ -0,0 +1 @@
+const t=e=>{if(e.messageId!==void 0)return{channel:"email",from:e.from,messageId:e.messageId,to:e.to,...e.references===void 0?{}:{references:e.references}}},n=e=>e.references===void 0?e.messageId:`${e.references} ${e.messageId}`,c=async(e,s,r)=>e.send({headers:{"In-Reply-To":s.messageId,References:n(s)},subject:r.subject,text:r.text,to:s.from});export{n as buildReferences,t as captureEmailReplyRef,c as replyToEmail};

package/dist/sandbox.d.mts

@@ -1,4 +1,4 @@
-import { a as AgentToolContext, b as AgentToolDefinition } from "./packem_shared/types.d-boAM2Yi1.mjs";
+import { b as AgentToolContext, c as AgentToolDefinition } from "./packem_shared/types.d-DTKxPuh_.mjs";
 import '@lunora/mail/inbound';
 import 'ai';
 /**
@@ -25,8 +25,8 @@ type BrowserToolInput = {
 /**
  * The model-provided input to a {@link containerTool} call — a discriminated
  * union on `op`. `fetch` sends an HTTP request to the container; `exec` asks it
- * to run a command (routed as a POST to `/exec`, since the container surface
- * exposes no first-class exec RPC — the container app must serve that route).
+ * to run a command (delegated to `ctx.containers.<name>.exec`, the first-class
+ * exec contract in `@lunora/container`; the container app serves its route).
  * @experimental
  */
 type ContainerToolInput = {
@@ -112,12 +112,13 @@ interface ContainerToolOptions {
   description?: string;
   /**
    * Gate a call behind a human approval. Defaults to gating any command
-   * execution: an `exec`, AND a `fetch` whose path resolves to the privileged
-   * `/exec` route (both reach the same command-execution path in the container,
-   * so gating on the `op` name alone would let a `fetch` to `/exec` run a
-   * command unattended). A plain `fetch` to any other route runs unattended.
-   * Pass a boolean or your own predicate to change that. Evaluated from
-   * replay-stable input, so keep it deterministic.
+   * execution — an `exec` — plus any `fetch` using a non-idempotent method
+   * (POST/PUT/PATCH/DELETE), so a prompt-injected model cannot reach some
+   * other mutating route unattended. A read-only `fetch` runs unattended. The
+   * exec route itself needs no special case: `@lunora/container` reserves
+   * `/__lunora/*` and refuses a `fetch` into it. Pass a boolean or your own
+   * predicate to change that. Evaluated from replay-stable input, so keep it
+   * deterministic.
    */
   needsApproval?: ((input: ContainerToolInput) => boolean) | boolean;
 }
@@ -149,19 +150,19 @@ interface ContainerToolOptions {
 declare const browserTool: (options?: BrowserToolOptions) => AgentToolDefinition<BrowserToolInput, string>;
 /**
  * A batteries-included agent tool that talks to a declared Cloudflare
- * Container. `name` is the `ctx.containers.&lt;name>` key (the `lunora/containers.ts`
+ * Container. `name` is the `ctx.containers.<name>` key (the `lunora/containers.ts`
  * export). One tool exposes `fetch` (HTTP request) and `exec` (run a command);
  * the model picks via `op`. The call dispatches to the auto-registered
  * `sandbox:invoke` action, which carries `ctx.containers`.
  *
  * By default a read-only (GET/HEAD/OPTIONS, or method-omitted) `fetch` runs
  * unattended while everything else is gated behind a human approval — an
- * `exec`; a `fetch` whose path resolves to the privileged `/exec` route (both
+ * `exec`; a `fetch` whose path resolves to the privileged exec route (both
  * reach the same command-execution path in the container, so gating on the
- * `op` name alone would let a `fetch` to `/exec` run a command unattended);
+ * `op` name alone would let a `fetch` to it run a command unattended);
  * and a `fetch` using a non-idempotent method (POST/PUT/PATCH/DELETE) to ANY
  * route, since a prompt-injected model could otherwise mutate container state
- * through some other privileged route just by avoiding the literal `/exec`
+ * through some other privileged route just by avoiding the literal exec
  * path. A `fetch` can still reach any *other read* route unattended, so scope
  * the container's GET routes accordingly. Pass `opts.needsApproval` to widen
  * or disable the gate.