@segmentstream/agent 0.8.4 → 0.8.5

package/README.md

@@ -447,6 +447,14 @@ Building the package needs Node.js 24, as eve does: `npm run build` runs `eve ex
 which writes the agent-shaped `dist/extension` tree, its declarations and eve's compatibility
 manifest.
 
+SDK-authored tool results and conversation archive events normalize runtime values to JSON
+before returning or encoding them. Exact decimal/bigint strings and binary byte views are
+preserved; conversion diagnostics identify the boundary and value path without logging payloads.
+Maps use entry arrays so distinct key types and object keys retain every entry. Native brand and
+binary getters avoid provider accessors; projection failures retain their redacted cause graph
+through the shared operator diagnostics reporter.
+This guard does not intercept Eve's own workflow streams or third-party tools.
+
 ## Environment
 
 The platform sets every variable on the workspace's Vercel project. None of them is a model key or

package/dist/_chunks/{build-metadata-ByEgTqDs.mjs → build-metadata-BYl-5kFi.mjs}

@@ -4,7 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-var version = "0.8.4";
+var version = "0.8.5";
 function agentBuild(environment = process.env) {
 	return {
 		agent: version,

package/dist/_chunks/workflow-serializable-BwttWNmY.mjs

@@ -0,0 +1,715 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import { createHash, randomUUID } from "node:crypto";
+import { Buffer as Buffer$1 } from "node:buffer";
+import { types } from "node:util";
+function makeRedactor(values = []) {
+	const secrets = [...new Set(values.filter((v) => typeof v === "string" && v.length > 0))].sort((a, b) => b.length - a.length);
+	return (input) => {
+		let text = input;
+		for (const value of secrets) text = text.replaceAll(value, "[REDACTED]");
+		return redactPrivateKeys(text).replace(/\bsscli_(?:access_)?v1\.[a-f0-9-]{36}\.[A-Za-z0-9_-]{43}\b/gi, "[REDACTED CLI CREDENTIAL]").replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9+/_=.:~-]+/gi, "[REDACTED AUTHORIZATION]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED JWT]").replace(/\b(?:sk|rk|vercel_blob_rw|vercel_blob_r|access_token|refresh_token)_[A-Za-z0-9._~-]{8,}/g, "[REDACTED]").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[REDACTED]@").replace(/([?&](?:access_token|api_key|apikey|key|password|refresh_token|secret|token|signature|sig)=)[^&#\s]*/gi, "$1[REDACTED]").replace(/((?:["']?)(?:password|passwd|credential|secret|client_secret|api_key|access_token|refresh_token|authorization|cookie|set-cookie|token)(?:["']?)\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;})]+)/gi, "$1[REDACTED]").replace(/(Key\s*\([^)]*\)\s*=\s*)\([^)]*\)/gi, "$1([REDACTED])").replace(/(invalid input syntax for [^:]+:\s*)"[^"]*"/gi, "$1[REDACTED]");
+	};
+}
+function environmentSecrets(env) {
+	return Object.entries(env).filter(([key]) => /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|COOKIE|SIGNING_KEY|DATABASE_URL|POSTGRES_URL|GRANT)/i.test(key)).map(([, value]) => value);
+}
+function isSensitiveField(key) {
+	return /password|passwd|credential|secret|token|authorization|cookie|private[_-]?key|api[_-]?key|grant/i.test(key);
+}
+function redactPrivateKeys(text) {
+	const begin = /-----BEGIN [^-]*PRIVATE KEY-----/g;
+	const end = /-----END [^-]*PRIVATE KEY-----/g;
+	const parts = [];
+	let copiedThrough = 0;
+	let opening;
+	while ((opening = begin.exec(text)) !== null) {
+		end.lastIndex = begin.lastIndex;
+		if (end.exec(text) === null) break;
+		parts.push(text.slice(copiedThrough, opening.index), "[REDACTED PRIVATE KEY]");
+		copiedThrough = end.lastIndex;
+		begin.lastIndex = copiedThrough;
+	}
+	parts.push(text.slice(copiedThrough));
+	return parts.join("");
+}
+const failureRedactions = new WeakMap();
+const MAX_BYTES = 1048576;
+const MAX_NODES = 1024;
+const FIELDS = [
+	"fiberId",
+	"code",
+	"status",
+	"statusCode",
+	"provider",
+	"providerCode",
+	"providerRequestId",
+	"method",
+	"host",
+	"path",
+	"retryable",
+	"constraint",
+	"sqlState",
+	"field",
+	"expected",
+	"actual",
+	"setting",
+	"resourceId",
+	"runtimeAttemptId",
+	"sandboxId",
+	"sessionId",
+	"remoteErrorId",
+	"endpoint",
+	"requestId",
+	"providerMessage",
+	"providerDescription",
+	"stderr",
+	"exitCode"
+];
+const links = Symbol.for("segmentstream.diagnostic.links");
+const incomplete = Symbol.for("segmentstream.diagnostic.omissions");
+const RELATIONS = [
+	"cause",
+	"aggregate",
+	"primary",
+	"cleanup",
+	"concurrent"
+];
+const MAX_EDGES = 8192;
+function property(value, key) {
+	if ((typeof value !== "object" || value === null) && typeof value !== "function") return void 0;
+	try {
+		return Reflect.get(value, key);
+	} catch {
+		return;
+	}
+}
+function scalar(value) {
+	return typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+}
+function ownValues(value) {
+	if (!value || typeof value !== "object") return [];
+	try {
+		return Object.values(Object.getOwnPropertyDescriptors(value)).filter((descriptor) => "value" in descriptor).map((descriptor) => descriptor.value);
+	} catch {
+		return [];
+	}
+}
+function schemaInputRedactions(root) {
+	const values = new Set();
+	const seen = new Set();
+	const errors = [root];
+	const issues = [];
+	let limited = false;
+	let traversed = 0;
+	while (errors.length && seen.size < MAX_NODES) {
+		if (++traversed > MAX_EDGES || errors.length > MAX_EDGES) {
+			limited = true;
+			break;
+		}
+		const value = errors.shift();
+		if (seen.has(value)) continue;
+		seen.add(value);
+		if (value !== null && (typeof value === "object" || typeof value === "function")) {
+			for (const secret of failureRedactions.get(value) ?? []) if (secret) values.add(secret);
+		}
+		if (property(value, "_tag") === "SchemaError" || property(value, "name") === "SchemaError") issues.push(property(value, "issue"));
+		const explicit = property(value, links);
+		if (Array.isArray(explicit)) {
+			if (explicit.length > MAX_NODES) limited = true;
+			errors.push(...explicit.slice(0, MAX_NODES).map((item) => property(item, "error")));
+		}
+		const cause = property(value, "cause");
+		if (cause !== void 0) errors.push(cause);
+		const aggregate = property(value, "errors");
+		if (property(value, "name") === "AggregateError" && Array.isArray(aggregate)) {
+			if (aggregate.length > MAX_NODES) limited = true;
+			errors.push(...aggregate.slice(0, MAX_NODES));
+		}
+	}
+	if (errors.length) limited = true;
+	seen.clear();
+	const inputs = [];
+	while (issues.length && seen.size < MAX_NODES) {
+		if (++traversed > MAX_EDGES || issues.length > MAX_EDGES) {
+			limited = true;
+			break;
+		}
+		const issue = issues.pop();
+		if (!issue || seen.has(issue)) continue;
+		seen.add(issue);
+		for (const key of ["input", "actual"]) {
+			const input = property(issue, key);
+			if (input !== void 0) inputs.push(input);
+		}
+		const child = property(issue, "issue");
+		if (child !== void 0) issues.push(child);
+		const children = property(issue, "issues");
+		if (Array.isArray(children)) {
+			if (children.length > MAX_NODES) limited = true;
+			issues.push(...children.slice(0, MAX_NODES));
+		}
+	}
+	if (issues.length) limited = true;
+	seen.clear();
+	let characters = 0;
+	while (inputs.length && seen.size < 4096 && characters < MAX_BYTES) {
+		if (++traversed > MAX_EDGES || inputs.length > MAX_EDGES) {
+			limited = true;
+			break;
+		}
+		const value = inputs.pop();
+		if (seen.has(value)) continue;
+		seen.add(value);
+		if (scalar(value) && String(value)) {
+			const text = String(value);
+			characters += text.length;
+			values.add(text);
+			if (typeof value === "string") values.add(JSON.stringify(value).slice(1, -1));
+		} else {
+			const children = ownValues(value);
+			if (children.length > 4096) limited = true;
+			inputs.push(...children.slice(0, 4096));
+		}
+	}
+	if (inputs.length) limited = true;
+	return {
+		values: [...values],
+		limited
+	};
+}
+function createFailureReport(error, options) {
+	const schemaInputs = schemaInputRedactions(error);
+	if (schemaInputs.limited) return redactionLimitReport();
+	const redact = makeRedactor([...options.redactedValues ?? [], ...schemaInputs.values]);
+	let remaining = 1044480;
+	const omissions = new Set();
+	const clean = (value) => {
+		const safe = redact(value.slice(0, MAX_BYTES));
+		if (value.length > MAX_BYTES) omissions.add("field input exceeded 1 MiB");
+		const bytes = Buffer.from(JSON.stringify(safe));
+		const allowance = Math.max(0, remaining);
+		if (bytes.length > allowance) {
+			omissions.add("report exceeded 1 MiB");
+			remaining = 0;
+			let low = 0;
+			let high = safe.length;
+			while (low < high) {
+				const middle = Math.ceil((low + high) / 2);
+				if (Buffer.byteLength(JSON.stringify(safe.slice(0, middle))) + 20 <= allowance) low = middle;
+				else high = middle - 1;
+			}
+			return safe.slice(0, low).replace(/[\uD800-\uDBFF]$/, "") + " [TRUNCATED]";
+		}
+		remaining -= bytes.length;
+		return safe;
+	};
+	const report = {
+		version: 1,
+		errorId: options.errorId && /^[A-Za-z0-9_.:-]{1,200}$/.test(options.errorId) ? options.errorId : `err_${randomUUID().replaceAll("-", "")}`,
+		timestamp: options.timestamp?.slice(0, 100) ?? new Date().toISOString(),
+		service: clean(options.service),
+		context: {},
+		roots: [],
+		nodes: [],
+		complete: true,
+		omissions: []
+	};
+	const contextEntries = Object.entries(options.context ?? {});
+	if (contextEntries.length > 128) omissions.add("context exceeded 128 fields");
+	for (const [key, value] of contextEntries.slice(0, 128)) if (scalar(value)) report.context[clean(key)] = isSensitiveField(key) ? "[REDACTED]" : typeof value === "string" ? clean(value) : value;
+	const seen = new Map();
+	const queue = [];
+	const add = (value) => {
+		const object = typeof value === "object" && value !== null || typeof value === "function";
+		if (object && seen.has(value)) return seen.get(value);
+		if (queue.length >= MAX_NODES || remaining < 1024) {
+			omissions.add(queue.length >= MAX_NODES ? "report exceeded 1024 nodes" : "report exceeded 1 MiB");
+			return;
+		}
+		const id = `n${queue.length + 1}`;
+		if (object) seen.set(value, id);
+		queue.push({
+			value,
+			id
+		});
+		remaining -= 512;
+		return id;
+	};
+	const root = add(error);
+	if (root) report.roots.push(root);
+	let edges = 0;
+	for (let index = 0; index < queue.length; index++) {
+		const { value, id } = queue[index];
+		const inheritedOmissions = property(value, incomplete);
+		if (Array.isArray(inheritedOmissions)) {
+			for (const reason of inheritedOmissions.slice(0, 128)) if (typeof reason === "string") omissions.add(clean(reason));
+		}
+		const name = property(value, "_tag") ?? property(value, "name");
+		const message = property(value, "message");
+		const node = {
+			id,
+			type: typeof name === "string" ? clean(name) : "NonErrorThrow",
+			message: clean(typeof message === "string" && message ? message : typeof value === "string" ? value : `Thrown ${typeof value} value`),
+			causes: []
+		};
+		for (const key of [
+			"stack",
+			"operation",
+			"diagnostic"
+		]) {
+			const field = property(value, key);
+			if (typeof field === "string") node[key] = clean(field);
+		}
+		const details = {};
+		for (const key of FIELDS) {
+			const field = property(value, key);
+			if (scalar(field)) details[key] = (key === "expected" || key === "actual") && isSensitiveField(String(property(value, "field") ?? "")) ? "[REDACTED]" : typeof field === "string" ? clean(field) : field;
+		}
+		if (Object.keys(details).length) node.details = details;
+		const children = [];
+		const explicit = property(value, links);
+		if (Array.isArray(explicit)) {
+			for (const item of explicit.slice(0, MAX_NODES)) {
+				const relation = property(item, "relation");
+				if (typeof relation === "string" && RELATIONS.includes(relation)) children.push({
+					error: property(item, "error"),
+					relation
+				});
+				else omissions.add("invalid diagnostic cause link");
+			}
+			if (explicit.length > MAX_NODES) omissions.add("cause links exceeded 1024 children");
+		}
+		const cause = property(value, "cause");
+		if (cause !== void 0) children.push({
+			error: cause,
+			relation: "cause"
+		});
+		if (value instanceof AggregateError || property(value, "name") === "AggregateError") {
+			const errors = property(value, "errors");
+			if (Array.isArray(errors)) {
+				for (const item of errors.slice(0, MAX_NODES)) children.push({
+					error: item,
+					relation: "aggregate"
+				});
+				if (errors.length > MAX_NODES) omissions.add("aggregate exceeded 1024 children");
+			}
+		}
+		for (const child of children) {
+			if (edges >= MAX_EDGES || remaining < 100) {
+				omissions.add(edges >= MAX_EDGES ? "report exceeded 8192 cause links" : "report exceeded 1 MiB");
+				break;
+			}
+			edges++;
+			remaining -= 100;
+			const childId = add(child.error);
+			if (childId) node.causes.push({
+				id: childId,
+				relation: child.relation
+			});
+		}
+		report.nodes.push(node);
+	}
+	report.omissions = [...omissions];
+	report.complete = !report.omissions.length;
+	return fitReport(report);
+}
+function redactionLimitReport() {
+	return {
+		version: 1,
+		errorId: `err_${randomUUID().replaceAll("-", "")}`,
+		timestamp: new Date().toISOString(),
+		service: "diagnostics",
+		context: {},
+		roots: ["n1"],
+		nodes: [{
+			id: "n1",
+			type: "RedactionLimitError",
+			message: "Failure details omitted because secret-redaction traversal was incomplete.",
+			causes: []
+		}],
+		complete: false,
+		omissions: ["secret redaction traversal exceeded its defensive budget (1024 graph/issue nodes, 4096 input values, 8192 traversal steps, 1 MiB)"]
+	};
+}
+function fitReport(report) {
+	const wireBytes = () => Buffer.byteLength(JSON.stringify(report));
+	if (wireBytes() <= MAX_BYTES) return report;
+	report.complete = false;
+	report.omissions.push("serialized report exceeded 1 MiB");
+	while (wireBytes() > MAX_BYTES && report.nodes.length > 1) report.nodes.pop();
+	const retained = new Set(report.nodes.map((node) => node.id));
+	report.roots = report.roots.filter((id) => retained.has(id));
+	for (const node of report.nodes) node.causes = node.causes.filter((edge) => retained.has(edge.id));
+	if (wireBytes() > MAX_BYTES) {
+		report.context = {};
+		report.service = report.service.slice(0, 200);
+		report.omissions = report.omissions.map((message) => message.slice(0, 1e3)).slice(0, 128);
+		report.nodes = report.nodes.map((node) => ({
+			id: node.id,
+			type: node.type.slice(0, 200),
+			message: node.message.slice(0, 1e3) + " [TRUNCATED]",
+			causes: node.causes
+		}));
+	}
+	return report;
+}
+function renderFailure(report, maxBytes = 8192) {
+	const nodes = new Map(report.nodes.map((node) => [node.id, node]));
+	const seen = new Set();
+	const pending = report.roots.map((id) => ({
+		id,
+		depth: 0,
+		relation: "root"
+	}));
+	const lines = [`Failure ${report.errorId} (${report.service})`];
+	while (pending.length) {
+		const item = pending.pop();
+		const prefix = `${"  ".repeat(Math.min(item.depth, 32))}${item.relation}: `;
+		if (seen.has(item.id)) {
+			lines.push(`${prefix}[reference ${item.id}]`);
+			continue;
+		}
+		seen.add(item.id);
+		const node = nodes.get(item.id);
+		if (!node) {
+			lines.push(`${prefix}[missing ${item.id}]`);
+			continue;
+		}
+		lines.push(`${prefix}${node.type}${node.diagnostic ? `:${node.diagnostic}` : ""}${node.operation ? ` at ${node.operation}` : ""}: ${node.message}`);
+		if (node.details) lines.push(`${prefix}${JSON.stringify(node.details)}`);
+		for (const child of [...node.causes].reverse()) pending.push({
+			...child,
+			depth: item.depth + 1
+		});
+	}
+	if (!report.complete) lines.push(`Incomplete: ${report.omissions.join("; ")}`);
+	const text = lines.join("\n");
+	if (Buffer.byteLength(text) <= maxBytes) return text;
+	const suffix = `\n[Journal shortened; complete report in diagnostics logs: ${report.errorId}]`;
+	return Buffer.from(text).subarray(0, Math.max(0, maxBytes - Buffer.byteLength(suffix) - 3)).toString("utf8").replace(/\uFFFD$/, "") + suffix;
+}
+function encodeReport(report) {
+	const direct = JSON.stringify({
+		event: "diagnostics.report",
+		report
+	});
+	if (Buffer.byteLength(direct) <= 4096) return [direct];
+	const bytes = Buffer.from(JSON.stringify(report));
+	const checksum = createHash("sha256").update(bytes).digest("hex");
+	const size = 2e3;
+	const correlation = Object.fromEntries([
+		"workflowRunId",
+		"requestId",
+		"pipelineRunId"
+	].flatMap((key) => typeof report.context[key] === "string" && /^[A-Za-z0-9_.:-]{1,200}$/.test(String(report.context[key])) ? [[key, String(report.context[key]).slice(0, 200)]] : []));
+	const total = Math.ceil(bytes.length / size);
+	return Array.from({ length: total }, (_, i) => JSON.stringify({
+		event: "diagnostics.chunk",
+		errorId: report.errorId,
+		part: i + 1,
+		total,
+		checksum,
+		correlation,
+		encoding: "base64",
+		data: bytes.subarray(i * size, (i + 1) * size).toString("base64")
+	}));
+}
+function makeErrorReporter({ configuration, generateId = randomUUID, now = () => new Date(), observe, write = (severity, line) => severity === "warning" ? console.warn(line) : console.error(line) }) {
+	function capture(error, context) {
+		let report;
+		const errorId = context.errorReference ?? `err_${randomUUID().replaceAll("-", "")}`;
+		try {
+			report = createFailureReport(error, {
+				service: configuration.service,
+				context: {
+					environment: configuration.environment,
+					release: configuration.release,
+					region: configuration.region,
+					...context
+				},
+				errorId: context.errorReference ?? `err_${generateId().replaceAll("-", "").toLowerCase()}`,
+				timestamp: now().toISOString(),
+				redactedValues: configuration.redactedValues
+			});
+		} catch {
+			report = createFailureReport(error, {
+				service: configuration.service,
+				errorId,
+				redactedValues: configuration.redactedValues,
+				context: { reportingFailure: true }
+			});
+		}
+		try {
+			const lines = encodeReport(report);
+			if (lines.length > 1) {
+				let budget = 2e3;
+				let summary;
+				do {
+					summary = JSON.stringify({
+						event: "diagnostics.summary",
+						errorId: report.errorId,
+						tree: renderFailure(report, budget),
+						completeReport: "Reconstruct diagnostics.chunk entries by errorId"
+					});
+					budget = Math.floor(budget / 2);
+				} while (Buffer.byteLength(summary) > 4096 && budget > 128);
+				if (Buffer.byteLength(summary) <= 4096) write(context.severity ?? "error", summary);
+			}
+			for (const line of lines) write(context.severity ?? "error", line);
+		} catch {
+			report.context.reportingFailure = true;
+			try {
+				for (const line of encodeReport(report)) process.stderr.write(line + "\n");
+			} catch {}
+		}
+		try {
+			observe?.(report);
+		} catch {}
+		return report;
+	}
+	return {
+		capture,
+		report: (error, context) => capture(error, context).errorId
+	};
+}
+function reportRuntimeFailure(error, context, environment = process.env) {
+	const { service, ...details } = context;
+	return makeErrorReporter({ configuration: {
+		service,
+		redactedValues: environmentSecrets(environment)
+	} }).report(error, details);
+}
+const errorStackGetter = Object.getOwnPropertyDescriptor(new Error(), "stack")?.get;
+function intrinsicGetter(prototype, name) {
+	return Object.getOwnPropertyDescriptor(prototype, name)?.get;
+}
+const binaryGetters = [Object.getPrototypeOf(Uint8Array.prototype), DataView.prototype].map((prototype) => ({
+	buffer: intrinsicGetter(prototype, "buffer"),
+	offset: intrinsicGetter(prototype, "byteOffset"),
+	length: intrinsicGetter(prototype, "byteLength")
+}));
+function binaryBytes(item) {
+	if (!ArrayBuffer.isView(item)) return new Uint8Array(item);
+	const getters = binaryGetters[types.isDataView(item) ? 1 : 0];
+	return new Uint8Array(getters.buffer.call(item), getters.offset.call(item), getters.length.call(item));
+}
+function toWorkflowSerializable(value, report = () => {}) {
+	const ancestors = new WeakSet();
+	let remaining = 5e4;
+	const issue = (path, reason, cause) => {
+		try {
+			report({
+				path,
+				reason,
+				...cause === void 0 ? {} : { cause }
+			});
+		} catch {}
+	};
+	const property = (output, key, item) => {
+		Object.defineProperty(output, key, {
+			value: item,
+			enumerable: true,
+			configurable: true
+		});
+	};
+	const dropped = (item) => item === void 0 || typeof item === "function" || typeof item === "symbol";
+	const dataProperty = (item, key) => {
+		let current = item;
+		for (let depth = 0; current !== null && depth <= 64; depth++) {
+			const descriptor = Object.getOwnPropertyDescriptor(current, key);
+			if (descriptor) return "value" in descriptor ? descriptor.value : void 0;
+			current = Object.getPrototypeOf(current);
+		}
+	};
+	function visit(item, path, depth) {
+		if (--remaining < 0 || depth > 64) {
+			issue(path, "limit");
+			return null;
+		}
+		if (item === null || typeof item === "string" || typeof item === "boolean") return item;
+		if (typeof item === "number") {
+			if (Number.isFinite(item)) return item;
+			issue(path, "non-finite number");
+			return null;
+		}
+		if (typeof item === "bigint") {
+			issue(path, "bigint");
+			return String(item);
+		}
+		if (typeof item !== "object") {
+			issue(path, typeof item);
+			return null;
+		}
+		if (ancestors.has(item)) {
+			issue(path, "cycle");
+			return null;
+		}
+		ancestors.add(item);
+		try {
+			if (types.isDate(item)) {
+				issue(path, "Date");
+				const time = Date.prototype.getTime.call(item);
+				return Number.isFinite(time) ? new Date(time).toISOString() : null;
+			}
+			if (ArrayBuffer.isView(item) || types.isAnyArrayBuffer(item)) {
+				issue(path, "binary");
+				const bytes = binaryBytes(item);
+				return Buffer$1.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
+			}
+			if (types.isMap(item)) {
+				issue(path, "Map");
+				const output = [];
+				for (const [key, entry] of Map.prototype.entries.call(item)) {
+					if (remaining <= 0) {
+						issue(path, "map limit");
+						break;
+					}
+					const index = output.length;
+					output.push([visit(key, `${path}[${index}][0]`, depth + 1), visit(entry, `${path}[${index}][1]`, depth + 1)]);
+				}
+				return output;
+			}
+			if (types.isSet(item)) {
+				issue(path, "Set");
+				const output = [];
+				for (const entry of Set.prototype.values.call(item)) {
+					if (remaining <= 0) {
+						issue(path, "set limit");
+						break;
+					}
+					output.push(visit(entry, `${path}[${output.length}]`, depth + 1));
+				}
+				return output;
+			}
+			if (Array.isArray(item)) {
+				const count = Object.getOwnPropertyDescriptor(item, "length")?.value;
+				if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0) {
+					issue(path, "invalid array length");
+					return null;
+				}
+				const length = Math.min(count, Math.max(remaining, 0));
+				if (length !== count) issue(path, "array limit");
+				return Array.from({ length }, (_, index) => {
+					const descriptor = Object.getOwnPropertyDescriptor(item, String(index));
+					if (descriptor?.get) {
+						issue(`${path}[${index}]`, "accessor");
+						return null;
+					}
+					return visit(descriptor?.value, `${path}[${index}]`, depth + 1);
+				});
+			}
+			const prototype = Object.getPrototypeOf(item);
+			const plain = prototype === null || Object.getPrototypeOf(prototype) === null;
+			const nativeError = types.isNativeError(item);
+			if (!plain) issue(path, nativeError ? "Error" : "class instance");
+			if (nativeError) {
+				const name = dataProperty(item, "name");
+				const message = dataProperty(item, "message");
+				const output = {
+					name: typeof name === "string" ? name : "Error",
+					message: typeof message === "string" ? message : ""
+				};
+				for (const key of Object.getOwnPropertyNames(item)) {
+					if (remaining <= 0) {
+						issue(path, "error limit");
+						break;
+					}
+					const descriptor = Object.getOwnPropertyDescriptor(item, key);
+					if (key === "stack" && errorStackGetter && descriptor?.get) {
+						property(output, key, visit(errorStackGetter.call(item), `${path}.stack`, depth + 1));
+						continue;
+					}
+					if (key !== "__proto__" && descriptor && "value" in descriptor && !dropped(descriptor.value)) property(output, key, visit(descriptor.value, `${path}[${JSON.stringify(key)}]`, depth + 1));
+				}
+				return output;
+			}
+			if (!plain) {
+				let current = prototype;
+				const prototypes = new WeakSet();
+				for (let prototypeDepth = 0; current !== null; prototypeDepth++) {
+					if (prototypeDepth >= 64 || prototypes.has(current)) {
+						issue(path, "prototype limit");
+						break;
+					}
+					prototypes.add(current);
+					const json = Object.getOwnPropertyDescriptor(current, "toJSON");
+					if (typeof json?.value === "function") return visit(json.value.call(item), path, depth + 1);
+					current = Object.getPrototypeOf(current);
+				}
+			}
+			const output = {};
+			for (const key of Reflect.ownKeys(item)) {
+				if (remaining <= 0) {
+					issue(path, "object limit");
+					break;
+				}
+				const descriptor = Object.getOwnPropertyDescriptor(item, key);
+				if (!descriptor?.enumerable) continue;
+				const childPath = `${path}[${JSON.stringify(String(key))}]`;
+				if (typeof key === "symbol" || key === "__proto__" || descriptor.get) {
+					issue(childPath, descriptor.get ? "accessor" : "unsupported key");
+					continue;
+				}
+				if (dropped(descriptor.value)) {
+					if (descriptor.value !== void 0) issue(childPath, typeof descriptor.value);
+					continue;
+				}
+				property(output, key, visit(descriptor.value, childPath, depth + 1));
+			}
+			return output;
+		} catch (cause) {
+			issue(path, "unreadable value", cause);
+			return null;
+		} finally {
+			ancestors.delete(item);
+		}
+	}
+	return visit(value, "$", 0);
+}
+let diagnosticSequence = 0;
+function workflowValue(value, context) {
+	const issues = [];
+	const failures = [];
+	let count = 0;
+	const output = toWorkflowSerializable(value, (issue) => {
+		count++;
+		if ("cause" in issue) failures.push(issue.cause);
+		if (issues.length < 20) issues.push({
+			reason: issue.reason,
+			path: issue.path.replace(/\["(?:[^"\\]|\\.)*"\]/g, "[field]")
+		});
+	});
+	if (count > 0) try {
+		const errorId = globalThis.crypto?.randomUUID?.() ?? `serialization-${Date.now()}-${++diagnosticSequence}`;
+		if (failures.length > 0) reportRuntimeFailure(failures.length === 1 ? failures[0] : new AggregateError(failures, "Workflow value projections failed"), {
+			service: "segmentstream-agent",
+			boundary: context.boundary,
+			operation: "workflow.normalize",
+			severity: "warning",
+			errorReference: errorId
+		});
+		console.warn("[workflow] normalized non-JSON value", {
+			errorId,
+			boundary: context.boundary,
+			toolName: context.toolName,
+			toolCallId: context.toolCallId,
+			eventType: context.eventType,
+			issues,
+			issueCount: count
+		});
+	} catch {}
+	return output;
+}
+function workflowToolResult(value, context) {
+	return workflowValue(value, {
+		boundary: "SDK tool result",
+		toolName: context.toolName,
+		toolCallId: context.callId
+	});
+}
+export { workflowToolResult as n, workflowValue as r, toWorkflowSerializable as t };

package/dist/extension/lib/build-metadata.mjs

@@ -4,5 +4,5 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { t as agentBuild } from "../../_chunks/build-metadata-ByEgTqDs.mjs";
+import { t as agentBuild } from "../../_chunks/build-metadata-BYl-5kFi.mjs";
 export { agentBuild };

package/dist/extension/lib/conversations.mjs

@@ -6,6 +6,7 @@ __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { proxyEnvironment } from "./environment.mjs";
 import { runtimeToken } from "./runtime-token.mjs";
+import { r as workflowValue } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 function collapseConversationEvents(events) {
 	const latest = new Map();
 	for (const event of events) {
@@ -20,7 +21,7 @@ function collapseConversationEvents(events) {
 	return [...latest.values()];
 }
 function conversationEvent(input) {
-	return {
+	return workflowValue({
 		threadId: null,
 		participantIds: [],
 		senderId: null,
@@ -40,7 +41,12 @@ function conversationEvent(input) {
 		attachments: [],
 		at: new Date().toISOString(),
 		...input
-	};
+	}, {
+		boundary: "SDK conversation event",
+		eventType: input.kind,
+		toolName: input.toolName ?? void 0,
+		toolCallId: input.toolCallId ?? void 0
+	});
 }
 function conversations(input = {}) {
 	const environment = input.environment ?? process.env;
@@ -58,7 +64,7 @@ function conversations(input = {}) {
 				"x-segmentstream-organization-id": env.organizationId,
 				"x-segmentstream-runtime-identity": identity
 			},
-			body: JSON.stringify(body),
+			body: JSON.stringify(workflowValue(body, { boundary: "conversation archive" })),
 			signal: AbortSignal.timeout(15e3)
 		});
 		if (!response.ok) throw new Error(`Conversation archive ${path} failed (${response.status}); request ${response.headers.get("x-request-id") ?? "unknown"}.`);
@@ -88,7 +94,7 @@ function summarizeArguments(value) {
 		if (item !== null && typeof item === "object") return Object.fromEntries(Object.entries(item).slice(0, 30).map(([key, entry]) => [key, sensitive.test(key) ? "[redacted]" : visit(entry, depth + 1)]));
 		return typeof item === "string" ? item.replace(/(https?:\/\/)[^/@\s]+:[^/@\s]+@/gu, "$1[redacted]@").replace(/([?&](?:token|access_token|api_key|signature|secret|password)=)[^&#\s]*/giu, "$1[redacted]").replace(/\bBearer [A-Za-z0-9_.~+/-]+=*/giu, "Bearer [redacted]").slice(0, 500) : item;
 	};
-	return (JSON.stringify(visit(value, 0)) ?? "{}").slice(0, 4e3);
+	return JSON.stringify(workflowValue(visit(value, 0), { boundary: "conversation arguments" })).slice(0, 4e3);
 }
 function retainedInboundEvidence(event) {
 	if (event.kind !== "inbound") return;

package/dist/extension/lib/telegram/adapter.mjs

@@ -8,7 +8,7 @@ import { manifestOf } from "../../config.mjs";
 import { appOrigin, channelsEnabled, proxyEnvironment, runtimeIdentityEnvironment, webhookSecret } from "../environment.mjs";
 import { conversationLanguage, telegramPrincipal } from "./principal.mjs";
 import { chooseModel } from "../../model.mjs";
-import { t as agentBuild } from "../../../_chunks/build-metadata-ByEgTqDs.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-BYl-5kFi.mjs";
 import { confirmationLocale } from "./confirmation-text.mjs";
 import { telegramSendScope } from "./send-queue.mjs";
 import { d as failureText, h as withDeliveryLocale, i as withReplacedText, m as safeTelegramFetch, n as currentInboundRequest, p as reportTelegramError, r as runInboundRequest, t as InboundRequest } from "../../../_chunks/inbound-request-B98tr4Pd.mjs";

package/dist/extension/lib/telegram/health.mjs

@@ -4,7 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { t as agentBuild } from "../../../_chunks/build-metadata-ByEgTqDs.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-BYl-5kFi.mjs";
 import { runtimeRequestFailure } from "./runtime-request.mjs";
 import { GET } from "eve/channels";
 const HEALTH_ROUTE = "/eve/v1/telegram/health";

package/dist/extension/lib/telegram/lifecycle.mjs

@@ -4,7 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
-import { t as agentBuild } from "../../../_chunks/build-metadata-ByEgTqDs.mjs";
+import { t as agentBuild } from "../../../_chunks/build-metadata-BYl-5kFi.mjs";
 import { object } from "../confirmation-description.mjs";
 import { n as currentInboundRequest, p as reportTelegramError } from "../../../_chunks/inbound-request-B98tr4Pd.mjs";
 import { needsConfirmation } from "../confirmations.mjs";

package/dist/extension/lib/workflow-serializable.d.ts

@@ -0,0 +1,29 @@
+/** JSON data produced by SDK tools and conversation archive events. */
+export type WorkflowSerializable = null | boolean | number | string | WorkflowSerializable[] | {
+    [key: string]: WorkflowSerializable;
+};
+export interface SerializationIssue {
+    readonly path: string;
+    readonly reason: string;
+    readonly cause?: unknown;
+}
+export interface SerializationContext {
+    readonly boundary: string;
+    readonly toolName?: string;
+    readonly toolCallId?: string;
+    readonly eventType?: string;
+}
+/**
+ * Never mutate a provider result; read own data fields without invoking their getters.
+ * Undefined/functions/symbols disappear from
+ * objects and become null in arrays. An active-ancestor set breaks cycles without losing shared
+ * references. Limits also protect the durable writer from hostile proxies or excessively deep data.
+ */
+export declare function toWorkflowSerializable(value: unknown, report?: (issue: SerializationIssue) => void): WorkflowSerializable;
+/** Log paths and types, never payloads, provider bodies or credential values. */
+export declare function workflowValue(value: unknown, context: SerializationContext): WorkflowSerializable;
+/** Normalize only results authored by this SDK; leave Eve's execution and approval policy intact. */
+export declare function workflowToolResult(value: unknown, context: {
+    readonly toolName: string;
+    readonly callId: string;
+}): WorkflowSerializable;

package/dist/extension/lib/workflow-serializable.mjs

@@ -0,0 +1,8 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import { n as workflowToolResult, r as workflowValue, t as toWorkflowSerializable } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
+export { toWorkflowSerializable, workflowToolResult, workflowValue };

package/dist/extension/tools/attachments_discard.d.ts

@@ -2,29 +2,7 @@
  * `segmentstream__attachments_discard`: drops an attachment at once. It can no longer be read or
  * promoted, and its file is deleted by the platform's maintenance.
  */
-declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, {
-    attachment: {
-        promotion?: {} | undefined;
-        expires_at?: string | undefined;
-        state?: string | undefined;
-        id: string;
-        filename: string;
-        content_type: string;
-        size: number;
-        sha256: string;
-    };
-}> & {
-    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<{
-        attachment: {
-            promotion?: {} | undefined;
-            expires_at?: string | undefined;
-            state?: string | undefined;
-            id: string;
-            filename: string;
-            content_type: string;
-            size: number;
-            sha256: string;
-        };
-    }>;
+declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, import("../lib/workflow-serializable.js").WorkflowSerializable> & {
+    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<import("../lib/workflow-serializable.js").WorkflowSerializable>;
 };
 export default _default;

package/dist/extension/tools/attachments_discard.mjs

@@ -4,6 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { n as workflowToolResult } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 import { ID_INPUT, attachmentForModel, attachmentOwner, stringArgument, toolAttachments } from "../lib/attachment-tools.mjs";
 import { defineTool } from "eve/tools";
 var attachments_discard_default = defineTool({
@@ -16,7 +17,7 @@ var attachments_discard_default = defineTool({
 			sessionId: ctx.session.id
 		});
 		const attachment = await toolAttachments().discard(owner, stringArgument(input, "id"));
-		return { attachment: attachmentForModel(attachment) };
+		return workflowToolResult({ attachment: attachmentForModel(attachment) }, ctx);
 	}
 });
 export { attachments_discard_default as default };

package/dist/extension/tools/attachments_list.d.ts

@@ -2,29 +2,7 @@
  * `segmentstream__attachments_list`: the files the member sent in this chat and session that are
  * still available. Mounted with the extension, so it is there even with `defaultTools: false`.
  */
-declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, {
-    attachments: {
-        promotion?: {} | undefined;
-        expires_at?: string | undefined;
-        state?: string | undefined;
-        id: string;
-        filename: string;
-        content_type: string;
-        size: number;
-        sha256: string;
-    }[];
-}> & {
-    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<{
-        attachments: {
-            promotion?: {} | undefined;
-            expires_at?: string | undefined;
-            state?: string | undefined;
-            id: string;
-            filename: string;
-            content_type: string;
-            size: number;
-            sha256: string;
-        }[];
-    }>;
+declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, import("../lib/workflow-serializable.js").WorkflowSerializable> & {
+    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<import("../lib/workflow-serializable.js").WorkflowSerializable>;
 };
 export default _default;

package/dist/extension/tools/attachments_list.mjs

@@ -4,6 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { n as workflowToolResult } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 import { attachmentForModel, attachmentOwner, toolAttachments } from "../lib/attachment-tools.mjs";
 import { defineTool } from "eve/tools";
 var attachments_list_default = defineTool({
@@ -19,7 +20,8 @@ var attachments_list_default = defineTool({
 			principal: ctx.session.auth.current,
 			sessionId: ctx.session.id
 		});
-		return { attachments: (await toolAttachments().list(owner)).map(attachmentForModel) };
+		const attachments = await toolAttachments().list(owner);
+		return workflowToolResult({ attachments: attachments.map(attachmentForModel) }, ctx);
 	}
 });
 export { attachments_list_default as default };

package/dist/extension/tools/attachments_promote.d.ts

@@ -4,33 +4,7 @@
  * hands the action the file already stored, so nothing is uploaded again, and a file whose SHA-256
  * was already promoted through the same action is not stored twice.
  */
-declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, {
-    attachment: {
-        promotion?: {} | undefined;
-        expires_at?: string | undefined;
-        state?: string | undefined;
-        id: string;
-        filename: string;
-        content_type: string;
-        size: number;
-        sha256: string;
-    };
-    deduplicated: boolean;
-    result: unknown;
-}> & {
-    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<{
-        attachment: {
-            promotion?: {} | undefined;
-            expires_at?: string | undefined;
-            state?: string | undefined;
-            id: string;
-            filename: string;
-            content_type: string;
-            size: number;
-            sha256: string;
-        };
-        deduplicated: boolean;
-        result: unknown;
-    }>;
+declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, import("../lib/workflow-serializable.js").WorkflowSerializable> & {
+    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<import("../lib/workflow-serializable.js").WorkflowSerializable>;
 };
 export default _default;

package/dist/extension/tools/attachments_promote.mjs

@@ -6,6 +6,7 @@ __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { actionApproval } from "../lib/confirmations.mjs";
 import { ontologyTools, promotionTarget } from "../lib/ontology-tools.mjs";
+import { n as workflowToolResult } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 import { attachmentForModel, attachmentOwner, optionalObject, optionalString, stringArgument, toolAttachments } from "../lib/attachment-tools.mjs";
 import { defineTool } from "eve/tools";
 var attachments_promote_default = defineTool({
@@ -76,11 +77,11 @@ var attachments_promote_default = defineTool({
 			...field === void 0 ? {} : { field },
 			...recordId === void 0 ? {} : { recordId }
 		});
-		return {
+		return workflowToolResult({
 			attachment: attachmentForModel(promoted.attachment),
 			deduplicated: promoted.deduplicated,
 			result: promoted.result
-		};
+		}, ctx);
 	}
 });
 export { attachments_promote_default as default };

package/dist/extension/tools/attachments_read.mjs

@@ -4,6 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { n as workflowToolResult } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 import { ID_INPUT, attachmentOwner, headerArgument, optionalString, pageInteger, readOutput, stringArgument, toolAttachments } from "../lib/attachment-tools.mjs";
 import { readStoredFile } from "../lib/stored-files.mjs";
 import { defineTool } from "eve/tools";
@@ -64,14 +65,14 @@ var attachments_read_default = defineTool({
 			id: stringArgument(input, "id"),
 			...optionalString(input, "property") === void 0 ? {} : { property: optionalString(input, "property") }
 		}, ctx.session.auth.current);
-		return readOutput(attachment, bytes, {
+		return workflowToolResult(await readOutput(attachment, bytes, {
 			sheet: optionalString(input, "sheet"),
 			offset: pageInteger(input.offset, 0),
 			...input.limit === void 0 ? {} : { limit: pageInteger(input.limit, 100, 5e4) },
 			character_offset: pageInteger(input.character_offset, 0),
 			...input.header_row === void 0 ? {} : { header_row: headerArgument(input.header_row) },
 			...input.date_order === "day_first" || input.date_order === "month_first" ? { date_order: input.date_order } : {}
-		});
+		}), ctx);
 	},
 	toModelOutput(output) {
 		if (output.kind !== "file") return {

package/dist/extension/tools/attachments_send.d.ts

@@ -1,8 +1,2 @@
-declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, {
-    readonly files: ReadonlyArray<import("../lib/telegram/attachments-send.js").SentFile>;
-} | {
-    readonly error: string;
-    readonly detail: string;
-    readonly reference: string;
-}>;
+declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, import("../lib/workflow-serializable.js").WorkflowSerializable>;
 export default _default;

package/dist/extension/tools/attachments_send.mjs

@@ -5,6 +5,7 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import segmentstream from "../extension.mjs";
+import { n as workflowToolResult } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 import { sendAttachments, sendAttachmentsInput } from "../lib/telegram/attachments-send.mjs";
 import { defineTool } from "eve/tools";
 var attachments_send_default = defineTool({
@@ -47,13 +48,13 @@ var attachments_send_default = defineTool({
 		additionalProperties: false
 	},
 	label: { start: () => "Send stored attachments to Telegram" },
-	execute(input, ctx) {
-		return sendAttachments({
+	async execute(input, ctx) {
+		return workflowToolResult(await sendAttachments({
 			input: sendAttachmentsInput(input),
 			principal: ctx.session.auth.current,
 			sessionId: ctx.session.id,
 			connection: segmentstream.config.channels.telegram?.connection
-		});
+		}), ctx);
 	}
 });
 export { attachments_send_default as default };

package/dist/extension/tools/attachments_table.d.ts

@@ -1,64 +1,4 @@
-declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, {
-    results: Record<string, string | number | null>[];
-    pagination: {
-        offset: number;
-        limit: number;
-        total_pages: number;
-        next_offset: number | null;
-    };
-    attachment: {
-        promotion?: {} | undefined;
-        expires_at?: string | undefined;
-        state?: string | undefined;
-        id: string;
-        filename: string;
-        content_type: string;
-        size: number;
-        sha256: string;
-    };
-    sheet: string;
-    sheets: readonly {
-        readonly name: string;
-        readonly total_rows: number;
-    }[];
-    header_row: number;
-    columns: import("../lib/attachment-tables.js").Column[];
-    warnings: string[];
-    total_rows: number;
-    matched_rows: number;
-    total_results: number;
-    decimal_note: string;
-}> & {
-    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<{
-        results: Record<string, string | number | null>[];
-        pagination: {
-            offset: number;
-            limit: number;
-            total_pages: number;
-            next_offset: number | null;
-        };
-        attachment: {
-            promotion?: {} | undefined;
-            expires_at?: string | undefined;
-            state?: string | undefined;
-            id: string;
-            filename: string;
-            content_type: string;
-            size: number;
-            sha256: string;
-        };
-        sheet: string;
-        sheets: readonly {
-            readonly name: string;
-            readonly total_rows: number;
-        }[];
-        header_row: number;
-        columns: import("../lib/attachment-tables.js").Column[];
-        warnings: string[];
-        total_rows: number;
-        matched_rows: number;
-        total_results: number;
-        decimal_note: string;
-    }>;
+declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, import("../lib/workflow-serializable.js").WorkflowSerializable> & {
+    execute(input: Record<string, unknown>, ctx: import("eve/tools").ToolContext): Promise<import("../lib/workflow-serializable.js").WorkflowSerializable>;
 };
 export default _default;

package/dist/extension/tools/attachments_table.mjs

@@ -4,6 +4,7 @@ import { createRequire as __eveCreateRequire } from "node:module";
 const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
+import { n as workflowToolResult } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 import { readSheets, typedTable } from "../lib/attachment-tables.mjs";
 import { queryTable } from "../lib/attachment-query.mjs";
 import { ID_INPUT, attachmentForModel, attachmentOwner, boundedResultPage, headerArgument, optionalString, pageInteger, stringArgument, toolAttachments } from "../lib/attachment-tools.mjs";
@@ -183,7 +184,7 @@ var attachments_table_default = defineTool({
 			resultOffset += boundedResultPage(queried.results, resultOffset, limit, envelope).length;
 			totalPages++;
 		}
-		return {
+		return workflowToolResult({
 			...envelope,
 			results,
 			pagination: {
@@ -192,7 +193,7 @@ var attachments_table_default = defineTool({
 				total_pages: totalPages,
 				next_offset: offset + results.length < queried.results.length ? offset + results.length : null
 			}
-		};
+		}, ctx);
 	}
 });
 export { attachments_table_default as default };

package/dist/extension/tools/questions_ask.d.ts

@@ -1,14 +1,4 @@
-declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, {
-    pendingQuestion: {
-        address: string;
-        taskId?: string | undefined;
-        replyToMessageId?: string | undefined;
-        id: string;
-        question: string;
-        task: string;
-        memberId: string;
-        chatId: string;
-        messageThreadId: string;
-    };
-}>;
+declare const _default: import("eve/tools").ToolDefinition<Record<string, unknown>, string | number | boolean | import("../lib/workflow-serializable.js").WorkflowSerializable[] | {
+    [key: string]: import("../lib/workflow-serializable.js").WorkflowSerializable;
+} | null>;
 export default _default;

package/dist/extension/tools/questions_ask.mjs

@@ -5,6 +5,7 @@ const __filename = __eveFileURLToPath(import.meta.url);
 __eveDirname(__filename);
 __eveCreateRequire(import.meta.url);
 import { memberIdOf } from "../lib/telegram/principal.mjs";
+import { n as workflowToolResult } from "../../_chunks/workflow-serializable-BwttWNmY.mjs";
 import { pendingQuestions, questionKey } from "../lib/questions.mjs";
 import { stringArgument } from "../lib/attachment-tools.mjs";
 import { defineTool } from "eve/tools";
@@ -46,7 +47,7 @@ var questions_ask_default = defineTool({
 			...all,
 			[questionKey(question)]: question
 		}));
-		return { pendingQuestion: question };
+		return workflowToolResult({ pendingQuestion: question }, ctx);
 	}
 });
 export { questions_ask_default as default };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@segmentstream/agent",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "description": "Mount a SegmentStream workspace's agent on eve: the ontology as tools, acting as the member who writes, and Telegram through the workspace's connection.",
   "license": "Apache-2.0",
   "author": "SegmentStream",