@prur/dsh-chat-service 0.1.14 → 0.1.16

package/lib/index.js

@@ -47,9 +47,10 @@ import { join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
 import { Remote, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { ChatStore, ChatStorageError } from './store.js';
-import { ChatTurnRunner, nextSeq } from './runner.js';
+import { ChatTurnRunner } from './runner.js';
 import { ChatEventBus, ChatEventsGateway } from './events.js';
-import { deriveTitle } from './engine.js';
+import { deriveTitle, regenerateTarget } from './engine.js';
+import { admitEncodedImages } from '@deepseek-ai/dsh-attachment';
 /** Default page size for `chat/history`. */
 const DEFAULT_HISTORY_PAGE = 50;
 /** Upper bound on one history page. */
@@ -92,6 +93,11 @@ let ChatService = (() => {
     let _delete_decorators;
     let _history_decorators;
     let _send_decorators;
+    let _archive_decorators;
+    let _deleteMessage_decorators;
+    let _regenerate_decorators;
+    let _capabilities_decorators;
+    let _attachment_decorators;
     let _cancel_decorators;
     let _selectModel_decorators;
     let _update_decorators;
@@ -104,6 +110,11 @@ let ChatService = (() => {
             _delete_decorators = [Remote('delete')];
             _history_decorators = [Remote('history')];
             _send_decorators = [Remote('send')];
+            _archive_decorators = [Remote('archive')];
+            _deleteMessage_decorators = [Remote('deleteMessage')];
+            _regenerate_decorators = [Remote('regenerate')];
+            _capabilities_decorators = [Remote('capabilities')];
+            _attachment_decorators = [Remote('attachment')];
             _cancel_decorators = [Remote('cancel')];
             _selectModel_decorators = [Remote('selectModel')];
             _update_decorators = [Remote('update')];
@@ -113,6 +124,11 @@ let ChatService = (() => {
             __esDecorate(this, null, _delete_decorators, { kind: "method", name: "delete", static: false, private: false, access: { has: obj => "delete" in obj, get: obj => obj.delete }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _history_decorators, { kind: "method", name: "history", static: false, private: false, access: { has: obj => "history" in obj, get: obj => obj.history }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _send_decorators, { kind: "method", name: "send", static: false, private: false, access: { has: obj => "send" in obj, get: obj => obj.send }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _archive_decorators, { kind: "method", name: "archive", static: false, private: false, access: { has: obj => "archive" in obj, get: obj => obj.archive }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _deleteMessage_decorators, { kind: "method", name: "deleteMessage", static: false, private: false, access: { has: obj => "deleteMessage" in obj, get: obj => obj.deleteMessage }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _regenerate_decorators, { kind: "method", name: "regenerate", static: false, private: false, access: { has: obj => "regenerate" in obj, get: obj => obj.regenerate }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _capabilities_decorators, { kind: "method", name: "capabilities", static: false, private: false, access: { has: obj => "capabilities" in obj, get: obj => obj.capabilities }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _attachment_decorators, { kind: "method", name: "attachment", static: false, private: false, access: { has: obj => "attachment" in obj, get: obj => obj.attachment }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _cancel_decorators, { kind: "method", name: "cancel", static: false, private: false, access: { has: obj => "cancel" in obj, get: obj => obj.cancel }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _selectModel_decorators, { kind: "method", name: "selectModel", static: false, private: false, access: { has: obj => "selectModel" in obj, get: obj => obj.selectModel }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _update_decorators, { kind: "method", name: "update", static: false, private: false, access: { has: obj => "update" in obj, get: obj => obj.update }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -144,6 +160,9 @@ let ChatService = (() => {
         /** Re-run queued sends and settle half-finished conversations on startup. */
         async recover() {
             await this.store.ensure();
+            // Legacy records without seqHighWater get normalized once (mock the
+            // monotonic identity for regenerations and future allocations).
+            await this.store.normalizeSeqHighWaters();
             const records = await this.store.list();
             for (const record of records) {
                 if (record.running) {
@@ -168,6 +187,7 @@ let ChatService = (() => {
                 messageCount: (await this.store.readMessages(record.conversationId)).length,
                 // Read-only: never create a runner just to answer a list query.
                 running: record.running || (this.runners.get(record.conversationId)?.isRunning() ?? false),
+                archived: record.archived === true,
             })));
             return { ok: true, value: { items } };
         }
@@ -192,14 +212,16 @@ let ChatService = (() => {
                 systemPrompt: null,
                 queue: [],
                 running: false,
+                seqHighWater: 0,
             };
             await this.store.put(record);
             return { ok: true, value: { conversationId: record.conversationId } };
         }
         /** Rename a conversation. */
         async rename(conversationId, title) {
-            const record = await this.store.require(conversationId);
-            await this.store.put({ ...record, title, updatedAt: Date.now() });
+            // Atomic record mutation: concurrent archive/select must not restore a
+            // stale renamed title (review P2).
+            await this.store.mutateRecord(conversationId, record => ({ ...record, title, updatedAt: Date.now() }));
             return { ok: true, value: {} };
         }
         /** Delete a conversation and its message log; idempotent. */
@@ -220,35 +242,220 @@ let ChatService = (() => {
         /**
          * Send one user turn into a conversation: the user message persists and is
          * anchored through `chat/message`, then its turn joins the FIFO queue.
+         * Image parts are admitted against the deployment attachment limits and
+         * promoted to durable references on the persisted message (design §3).
          */
         async send(conversationId, content) {
             const record = await this.store.require(conversationId);
-            const blocks = validateTextBlocks(content);
-            if (blocks.length === 0) {
-                throw new ChatServiceError('invalid-request', 'chat: send needs at least one text block');
+            const parts = validateContentParts(content);
+            if (parts.length === 0) {
+                throw new ChatServiceError('invalid-request', 'chat: send needs at least one content part');
+            }
+            const imageParts = parts.filter(part => part.type === 'image');
+            const attachments = this.ctx.get('attachments');
+            if (imageParts.length > 0) {
+                if (attachments === undefined) {
+                    throw new ChatServiceError('image-unsupported', 'chat: host attachment service is unavailable');
+                }
+                let info;
+                try {
+                    info = await this.resolveModelInfo(record.provider, record.model);
+                }
+                catch {
+                    // 未知/不可达：fail-closed（与 sessions 准入一致——拒绝发图并报错呈现）。
+                }
+                if (!this.imageInputAllowed(info)) {
+                    throw new ChatServiceError('image-unsupported', `chat: model "${record.model}" does not support image input`);
+                }
+            }
+            const seq = await this.store.reserveTurnSeq(conversationId);
+            let blocks = [];
+            if (imageParts.length > 0 && attachments !== undefined) {
+                // Image parts are admitted in order; the durable refs replace the upload
+                // bytes on the persisted message (cheap to page back through chat/attachment).
+                const refs = await admitEncodedImages(attachments, imageParts.map(image => ({
+                    mediaType: image.mediaType,
+                    data: image.data,
+                    ...image.name === undefined ? {} : { name: image.name },
+                })));
+                let next = 0;
+                for (const part of parts) {
+                    if (part.type === 'text') {
+                        blocks.push({ type: 'text', text: part.text });
+                    }
+                    else {
+                        const ref = refs[next];
+                        next += 1;
+                        blocks.push({ type: 'image', attachment: toChatImageRef(ref) });
+                    }
+                }
+            }
+            else {
+                blocks = parts
+                    .filter((part) => part.type === 'text')
+                    .map(part => ({ type: 'text', text: part.text }));
             }
-            const history = await this.store.readMessages(conversationId);
             const message = {
-                seq: nextSeq(history),
+                seq,
                 role: 'user',
                 blocks,
                 createdAt: Date.now(),
             };
             await this.store.appendMessage(conversationId, message);
             this.emitMessage(conversationId, message);
-            const title = record.title ?? deriveTitle(blocks.map(block => block.text).join(''));
+            const derived = deriveTitle(parts.filter((part) => part.type === 'text').map(part => part.text).join(''));
+            // 标题落锁内决定：send 早先快照允许并发 rename 抢在前头，派生标题若在
+            // 快照上求值会覆盖用户命名——在 mutate 回调里以锁内当前记录为准。
             // Bind the queued send to its message seq: a queued turn's context must
-            // not include LATER queued user messages (boundary in runTurn).
+            // not include LATER queued user messages (boundary in runTurn). The queue
+            // append is an atomic read-modify-write — a concurrent send must never
+            // lose this entry to an outdated snapshot (store.mutateRecord).
             const pending = { seq: message.seq, content: blocks, createdAt: Date.now() };
-            await this.store.put({
+            await this.store.mutateRecord(conversationId, record => ({
                 ...record,
-                title,
+                title: record.title ?? derived,
                 updatedAt: Date.now(),
                 queue: [...record.queue, pending],
+            }));
+            this.runnerFor(conversationId).enqueue(pending);
+            return { ok: true, value: { accepted: true } };
+        }
+        /**
+         * Toggle a conversation's archive flag (M4). Archived conversations keep
+         * their messages and settings; the client hides them from the active view.
+         */
+        async archive(conversationId, archived) {
+            await this.store.require(conversationId);
+            await this.store.mutateRecord(conversationId, record => ({
+                ...record,
+                archived,
+                updatedAt: Date.now(),
+            }));
+            return { ok: true, value: {} };
+        }
+        /**
+         * Delete a single message (design §2.3): the host rewrites the message
+         * file, so subsequent context assembly excludes it. Queued sends bound to
+         * the deleted seq are dropped too; an in-flight turn keeps its assembled
+         * context and settles normally. Idempotent: absent seq reports removed:
+         * false without error.
+         */
+        async deleteMessage(conversationId, seq) {
+            await this.store.require(conversationId);
+            const result = await this.store.deleteMessage(conversationId, seq);
+            // Both queue mirrors must stay in sync: the runner's in-memory queue and
+            // the persisted index queue (a queued turn for a deleted user message
+            // would otherwise run as an orphan response — review 🔴).
+            this.runners.get(conversationId)?.removeQueued(seq);
+            if (result.removed) {
+                await this.store.mutateRecord(conversationId, record => ({
+                    ...record,
+                    queue: record.queue.filter(pending => pending.seq !== seq),
+                    updatedAt: Date.now(),
+                }));
+            }
+            return { ok: true, value: { removed: result.removed } };
+        }
+        /**
+         * Regenerate the last assistant message (design §3): remove it, then rerun
+         * the last user turn with the same context boundary. Rejected while a turn
+         * is running or when there is no assistant message to regenerate.
+         */
+        async regenerate(conversationId) {
+            const record = await this.store.require(conversationId);
+            const runner = this.runners.get(conversationId);
+            // A running turn or an existing queue means the conversation's tail is
+            // not stable: regenerating would reorder the timeline under the client
+            // (review 🟡#11). The client only offers regenerate on the last settled
+            // assistant message and never while running.
+            if (record.running || record.queue.length > 0 || (runner?.isRunning() ?? false)) {
+                throw new ChatServiceError('invalid-request', 'chat: a turn is running or queued');
+            }
+            // One serialized state transition (review P1): tail check + deletion +
+            // queue insert under the store write lock—competing regenerates/sends see
+            // the previous op's outcome instead of a stale view.
+            const pending = await this.store.mutateConversation(conversationId, async (record, history) => {
+                const target = regenerateTarget(history);
+                if (target === undefined || target.assistant === undefined) {
+                    throw new ChatServiceError('invalid-request', 'chat: no assistant message to regenerate');
+                }
+                if (target.user === undefined) {
+                    throw new ChatServiceError('invalid-request', 'chat: no user message to regenerate against');
+                }
+                // The user message whose turn is regenerated must be the newest user
+                // message; otherwise an unanswered user message exists above it and the
+                // regenerated answer would land before it (timeline confusion).
+                const newerUser = history.some(message => message.role === 'user' && message.seq > target.assistant.seq);
+                if (newerUser) {
+                    throw new ChatServiceError('invalid-request', 'chat: a newer user message exists');
+                }
+                const pending = { seq: target.user.seq, content: target.user.blocks, createdAt: Date.now() };
+                return {
+                    nextRecord: {
+                        ...record,
+                        queue: [...record.queue, pending],
+                        updatedAt: Date.now(),
+                    },
+                    nextMessages: history.filter(message => message.seq !== target.assistant.seq),
+                    result: pending,
+                };
             });
             this.runnerFor(conversationId).enqueue(pending);
             return { ok: true, value: { accepted: true } };
         }
+        /**
+         * Model capability probe for the conversation's current selection
+         * (adapter metadata; design §4.6): the client preflights image sending
+         * instead of discovering a refusal after the bytes were picked.
+         */
+        async capabilities(conversationId) {
+            const record = await this.store.require(conversationId);
+            let info;
+            try {
+                info = await this.resolveModelInfo(record.provider, record.model);
+            }
+            catch {
+                // 探测失败不抛：预检以保守结论（不支持/未知窗口）呈现，客户端可重试。
+            }
+            const imageInput = info !== undefined
+                && this.imageInputAllowed(info)
+                && this.ctx.get('attachments') !== undefined;
+            return {
+                ok: true,
+                value: {
+                    provider: record.provider,
+                    model: record.model,
+                    imageInput,
+                    contextWindow: info?.context?.contextWindow ?? null,
+                },
+            };
+        }
+        /**
+         * Read one image's bytes after proving the conversation's message log
+         * references its attachment id (mirror of `session.attachment`'s
+         * authorization discipline; design §3 读图).
+         */
+        async attachment(conversationId, attachmentId) {
+            await this.store.require(conversationId);
+            const attachments = this.ctx.get('attachments');
+            if (attachments === undefined) {
+                throw new ChatServiceError('image-unsupported', 'chat: host attachment service is unavailable');
+            }
+            const messages = await this.store.readMessages(conversationId);
+            const ref = findImageRef(messages, attachmentId);
+            if (ref === undefined) {
+                throw new ChatServiceError('invalid-request', 'chat: conversation does not reference this attachment');
+            }
+            try {
+                const stored = await attachments.readImage(toAttachmentRef(ref));
+                return { ok: true, value: { attachment: toChatImageRef(stored.ref), data: Buffer.from(stored.data).toString('base64') } };
+            }
+            catch (error) {
+                // AttachmentError 携带稳定 code（INVALID_ATTACHMENT_REF 等）；typert 网关
+                // 按消息投射——统一包装为 ChatServiceError 保 code 稳定（评审 ⚪#8）。
+                throw new ChatServiceError('invalid-request', `chat: cannot read attachment: ${error.message}`);
+            }
+        }
         /** Abort the in-flight turn (frozen partial is persisted); idempotent. */
         async cancel(conversationId) {
             await this.store.require(conversationId);
@@ -260,39 +467,50 @@ let ChatService = (() => {
             if (provider.length === 0 || model.length === 0) {
                 throw new ChatServiceError('invalid-request', 'chat: provider and model must be non-empty');
             }
-            const record = await this.store.require(conversationId);
-            await this.store.put({ ...record, provider, model, updatedAt: Date.now() });
+            await this.store.mutateRecord(conversationId, record => ({ ...record, provider, model, updatedAt: Date.now() }));
             return { ok: true, value: { provider, model } };
         }
         /** Update conversation settings; `null` in the patch unsets a field. */
         async update(conversationId, patch) {
-            const record = await this.store.require(conversationId);
-            const systemPrompt = patch.systemPrompt === undefined ? record.systemPrompt : patch.systemPrompt;
-            if (systemPrompt !== null && systemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
-                throw new ChatServiceError('invalid-request', `chat: system prompt exceeds ${MAX_SYSTEM_PROMPT_CHARS} characters`);
-            }
-            const temperature = patch.temperature === undefined ? record.temperature : patch.temperature;
-            if (temperature !== null && (!Number.isFinite(temperature) || temperature < 0 || temperature > 2)) {
-                throw new ChatServiceError('invalid-request', 'chat: temperature must be within 0..2');
-            }
-            const contextMessages = patch.contextMessages === undefined ? record.contextMessages : patch.contextMessages;
-            if (contextMessages !== null && (!Number.isInteger(contextMessages) || contextMessages <= 0)) {
-                throw new ChatServiceError('invalid-request', 'chat: contextMessages must be a positive integer');
-            }
-            const updatedAt = Date.now();
-            const next = {
-                ...record,
-                systemPrompt,
-                temperature,
-                contextMessages,
-                updatedAt,
-            };
-            await this.store.put(next);
+            // 整个合并在写锁内完成（读当前值 + 校验 + 写回）：先前 require 快照与
+            // mutate 分离的读改写会让两个并发 update 互相覆盖（与 rename/archive 的
+            // P2 同类）；校验抛错发生在锁内，写文件前终止，不留半更新。
+            const next = await this.store.mutateRecord(conversationId, record => {
+                const systemPrompt = patch.systemPrompt === undefined ? record.systemPrompt : patch.systemPrompt;
+                if (systemPrompt !== null && systemPrompt.length > MAX_SYSTEM_PROMPT_CHARS) {
+                    throw new ChatServiceError('invalid-request', `chat: system prompt exceeds ${MAX_SYSTEM_PROMPT_CHARS} characters`);
+                }
+                const temperature = patch.temperature === undefined ? record.temperature : patch.temperature;
+                if (temperature !== null && (!Number.isFinite(temperature) || temperature < 0 || temperature > 2)) {
+                    throw new ChatServiceError('invalid-request', 'chat: temperature must be within 0..2');
+                }
+                const contextMessages = patch.contextMessages === undefined ? record.contextMessages : patch.contextMessages;
+                if (contextMessages !== null && (!Number.isInteger(contextMessages) || contextMessages <= 0)) {
+                    throw new ChatServiceError('invalid-request', 'chat: contextMessages must be a positive integer');
+                }
+                return { ...record, systemPrompt, temperature, contextMessages, updatedAt: Date.now() };
+            });
             return { ok: true, value: settingsView(next) };
         }
         defaultSelection() {
             return this.ctx.get('agentDefaultModel')?.currentSelection();
         }
+        /** Adapter metadata for the conversation's model (structural llm seam). */
+        async resolveModelInfo(provider, model) {
+            return this.ctx.llm.resolveModelInfo(provider, model);
+        }
+        /**
+         * Whether the model accepts image input. Unknown capability is a refusal
+         * (fail-closed, mirror of the session image admission preflight outcome:
+         * an unresolvable adapter must not silently accept an image request).
+         */
+        imageInputAllowed(info) {
+            // Fail-closed: only an explicit 'image' modality is treated as capable;
+            // unknown (absent) capability is a refusal (review P2).
+            return info !== undefined
+                && info.inputModalities !== undefined
+                && info.inputModalities.includes('image');
+        }
         runnerFor(conversationId) {
             let runner = this.runners.get(conversationId);
             if (runner === undefined) {
@@ -324,18 +542,22 @@ let ChatService = (() => {
         }
         /** Persist turn-start bookkeeping: shift the queued send and mark running. */
         async turnStart(conversationId) {
-            const record = await this.store.require(conversationId);
-            await this.store.put({
+            // Atomic read-modify-write: a concurrent chat/send must not lose its
+            // queue append to this outdated snapshot (store.mutateRecord).
+            await this.store.mutateRecord(conversationId, record => ({
                 ...record,
                 running: true,
                 queue: record.queue.slice(1),
                 updatedAt: Date.now(),
-            });
+            }));
         }
         /** Persist turn-end bookkeeping: release the running flag. */
         async turnEnd(conversationId) {
-            const record = await this.store.require(conversationId);
-            await this.store.put({ ...record, running: false, updatedAt: Date.now() });
+            await this.store.mutateRecord(conversationId, record => ({
+                ...record,
+                running: false,
+                updatedAt: Date.now(),
+            }));
         }
         emitMessage(conversationId, message) {
             this.bus.publish('chat/message', [conversationId, message.seq, message]);
@@ -351,16 +573,73 @@ function clampPage(maxMessages) {
         return DEFAULT_HISTORY_PAGE;
     return Math.min(Math.max(Math.trunc(maxMessages), 1), MAX_HISTORY_PAGE);
 }
-/** Accept only text blocks on the v1 wire; anything else is rejected up front. */
-function validateTextBlocks(content) {
-    const blocks = [];
-    for (const block of content) {
-        if (typeof block !== 'object' || block === null || block.type !== 'text' || typeof block.text !== 'string') {
-            throw new ChatServiceError('unsupported-block', 'chat: v1 accepts text blocks only');
-        }
-        blocks.push({ type: 'text', text: block.text });
+/** Accepted raster media types (mirror of the image admission enum). */
+const IMAGE_MEDIA_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/gif'];
+/** Accept text and image content parts; anything else is rejected up front. */
+function validateContentParts(content) {
+    const parts = [];
+    for (const part of content) {
+        if (typeof part !== 'object' || part === null) {
+            throw new ChatServiceError('unsupported-block', 'chat: content parts must be objects');
+        }
+        if (part.type === 'text') {
+            if (typeof part.text !== 'string') {
+                throw new ChatServiceError('unsupported-block', 'chat: text part needs a string text');
+            }
+            parts.push({ type: 'text', text: part.text });
+        }
+        else if (part.type === 'image') {
+            if (typeof part.mediaType !== 'string' || typeof part.data !== 'string' || part.data.length === 0) {
+                throw new ChatServiceError('unsupported-block', 'chat: image part needs mediaType and data');
+            }
+            if (!IMAGE_MEDIA_TYPES.includes(part.mediaType)) {
+                throw new ChatServiceError('unsupported-block', `chat: unsupported image media type: ${part.mediaType}`);
+            }
+            parts.push({
+                type: 'image',
+                mediaType: part.mediaType,
+                data: part.data,
+                ...part.name === undefined ? {} : { name: part.name },
+            });
+        }
+        else {
+            throw new ChatServiceError('unsupported-block', 'chat: unknown content part type');
+        }
+    }
+    return parts;
+}
+/** Map a durable harness image ref onto the chat wire ref (subset shape). */
+function toChatImageRef(ref) {
+    return {
+        attachmentId: ref.attachmentId,
+        mediaType: ref.mediaType,
+        bytes: ref.bytes,
+        width: ref.width,
+        height: ref.height,
+        ...ref.name === undefined ? {} : { name: ref.name },
+    };
+}
+/** Map a chat wire ref back onto the harness ref shape for store reads. */
+function toAttachmentRef(ref) {
+    return {
+        attachmentId: ref.attachmentId,
+        mediaType: ref.mediaType,
+        bytes: ref.bytes,
+        width: ref.width,
+        height: ref.height,
+        ...ref.name === undefined ? {} : { name: ref.name },
+    };
+}
+/** Find the chat message's image ref by attachment id (authorization walk). */
+function findImageRef(messages, attachmentId) {
+    for (const message of messages) {
+        for (const block of message.blocks) {
+            if (block.type === 'image' && block.attachment.attachmentId === attachmentId) {
+                return block.attachment;
+            }
+        }
     }
-    return blocks;
+    return undefined;
 }
 function settingsView(record) {
     return {

package/lib/runner.d.ts

@@ -40,6 +40,7 @@ export interface LlmLike {
         readonly context?: {
             readonly contextWindow: number;
         };
+        readonly inputModalities?: readonly string[];
     }>;
 }
 /** Event sink for the forwarded chat triplet (host allowlist). */
@@ -59,12 +60,12 @@ export interface TurnRecord {
 /** Storage interface the runner needs (subset of {@link ChatStore}). */
 export interface RunnerStore {
     readMessages(conversationId: string): Promise<ChatMessage[]>;
+    /** Allocate the next monotonic seq (durable high-water; never reused). */
+    reserveTurnSeq(conversationId: string): Promise<number>;
     appendMessage(conversationId: string, message: ChatMessage): Promise<{
         trimmed: boolean;
     }>;
 }
-/** Next monotonic message sequence for a conversation's persisted history. */
-export declare function nextSeq(messages: readonly ChatMessage[]): number;
 /**
  * Serialized per-conversation turn machine: sends enqueue; the queue drains
  * one turn at a time; cancel aborts only the in-flight turn.
@@ -92,6 +93,16 @@ export declare class ChatTurnRunner {
     enqueue(send: PendingSend): void;
     /** Abort the in-flight turn; returns whether one was running. */
     cancel(): boolean;
+    /**
+     * Remove one still-queued send (mirror of the index queue filter in
+     * `chat/deleteMessage`): the runner's in-memory queue and the persisted
+     * index queue must never drift, or a deleted user message would still be
+     * answered with an orphan assistant turn. In-flight sends are never
+     * touched (their turn settles; deletion of their context boundary is
+     * handled by the runTurn existence check).
+     * @returns whether a queued send with `seq` was removed.
+     */
+    removeQueued(seq: number): boolean;
     /** Stop queue advances; an in-flight turn still settles before the runner is dropped. */
     dispose(): void;
     private drain;

package/lib/runner.js

@@ -20,15 +20,6 @@ function mapFinishKind(kind) {
         default: return 'completed';
     }
 }
-/** Next monotonic message sequence for a conversation's persisted history. */
-export function nextSeq(messages) {
-    let last = 0;
-    for (const message of messages) {
-        if (message.seq > last)
-            last = message.seq;
-    }
-    return last + 1;
-}
 /**
  * Serialized per-conversation turn machine: sends enqueue; the queue drains
  * one turn at a time; cancel aborts only the in-flight turn.
@@ -71,6 +62,22 @@ export class ChatTurnRunner {
         this.controller.abort();
         return true;
     }
+    /**
+     * Remove one still-queued send (mirror of the index queue filter in
+     * `chat/deleteMessage`): the runner's in-memory queue and the persisted
+     * index queue must never drift, or a deleted user message would still be
+     * answered with an orphan assistant turn. In-flight sends are never
+     * touched (their turn settles; deletion of their context boundary is
+     * handled by the runTurn existence check).
+     * @returns whether a queued send with `seq` was removed.
+     */
+    removeQueued(seq) {
+        const index = this.queue.findIndex(send => send.seq === seq);
+        if (index < 0)
+            return false;
+        this.queue.splice(index, 1);
+        return true;
+    }
     /** Stop queue advances; an in-flight turn still settles before the runner is dropped. */
     dispose() {
         this.disposed = true;
@@ -105,14 +112,20 @@ export class ChatTurnRunner {
     async runTurn(send) {
         const record = await this.deps.record();
         const all = await this.deps.store.readMessages(this.conversationId);
+        // The send's user message was deleted while this send waited in the
+        // queue: the turn has no prompt to answer — skip it silently (the index
+        // queue mirror is already filtered; this guards the in-memory queue).
+        if (!all.some(message => message.seq === send.seq && message.role === 'user')) {
+            return;
+        }
         // Context boundary: this turn answers only its own user message. Later
         // (queued) user messages stay out of the prompt until their own turn.
-        const history = typeof send.seq === 'number'
-            ? all.filter(message => message.seq <= send.seq)
-            : all;
+        const history = all.filter(message => message.seq <= send.seq);
         const window = await this.resolveWindow(record);
         const assembled = assembleContext(history, record.contextMessages, window);
-        const seq = nextSeq(history);
+        // Durable monotonic seq identity: reserved (never reused) even when this
+        // turn later aborts — the high-water mark only ever advances.
+        const seq = await this.deps.store.reserveTurnSeq(this.conversationId);
         const controller = new AbortController();
         this.controller = controller;
         this.emitStatus({ running: true, turn: seq });
@@ -180,7 +193,7 @@ export class ChatTurnRunner {
             ? [{ type: 'text', text }]
             : [];
         // An empty abort persists nothing (nothing was frozen to settle).
-        if (this.disposed || (finishReason === 'aborted' && text.length === 0)) {
+        if (finishReason === 'aborted' && text.length === 0) {
             this.emitStatus({ running: false, turn: seq, reason: 'aborted' });
             return;
         }