@tangle-network/agent-app 0.43.46 → 0.43.48

package/dist/{file-index-Bn6sitKb.d.ts → file-index-b26ee-_R.d.ts}

@@ -1,4 +1,4 @@
-import { F as FileMention } from './parts-1_3y2JmR.js';
+import { K as FileMention } from './parts-IB-Kbb7z.js';
 
 /**
  * `createSandboxFileIndexRoute` — server side of `@`-file-mentions

package/dist/index.d.ts

@@ -17,9 +17,11 @@ export { KeyCrypto, KeyProvisioner, PlanLimit, PlatformBalanceInfo, PlatformBala
 export { HttpHeadProbeConfig, PreflightProbe, PreflightProbeResult, PreflightProbeVerdict, PreflightReport, RouterChatProbeConfig, SandboxAuthProbeConfig, formatPreflightReport, httpHeadProbe, routerChatProbe, runPreflight, sandboxAuthProbe } from './preflight/index.js';
 export { ObjectBody, ObjectKeyParts, ObjectStore, PutObjectOptions, R2LikeBucket, R2LikeObjectBody, R2LikeObjectHead, SignObjectUrlArgs, VerifyObjectUrlResult, assertSafeKeySegment, createProxiedArtifactRoute, createR2ObjectStore, objectKey, signObjectUrl, verifyObjectUrl } from './object-store/index.js';
 export { B as BULK_DELETE_MAX_THREADS, C as ChatStoreInputError, t as threadTitleFromMessage } from './core-7qIM7svy.js';
-export { C as ChatFilePart, a as ChatImagePart, b as ChatInteractionPart, c as ChatMentionKind, d as ChatMentionPart, e as ChatMessagePart, f as ChatNoticePart, g as ChatPartTime, h as ChatPlanPart, i as ChatReasoningPart, j as ChatStepFinishPart, k as ChatStepStartPart, l as ChatSubtaskPart, m as ChatTextPart, n as ChatToolPart, o as ChatToolState, p as ChatToolStatus, q as ChatUsageTokens, S as StorableHarnessPartKind, r as isChatInteractionPart, s as isChatMentionPart, t as isChatPlanPart, u as isChatStepFinishPart, v as isChatTextPart, w as isChatToolPart, x as mentionInputToPart, y as mentionPartsFromMessageParts, z as toChatMessageParts } from './parts-1_3y2JmR.js';
+export { C as ChatAttachmentKind, a as ChatAttachmentPart, b as ChatFilePart, c as ChatImagePart, d as ChatInteractionPart, e as ChatMentionKind, f as ChatMentionPart, g as ChatMessagePart, h as ChatNoticePart, i as ChatPartTime, j as ChatPlanPart, k as ChatReasoningPart, l as ChatStepFinishPart, m as ChatStepStartPart, n as ChatSubtaskPart, o as ChatTextPart, p as ChatToolPart, q as ChatToolState, r as ChatToolStatus, s as ChatUsageTokens, D as DEFAULT_ATTACHMENT_PROMPT_HEADER, S as StorableHarnessPartKind, t as attachmentInputToPart, u as attachmentKindForMime, v as attachmentPartsFromMessageParts, w as buildAttachmentPromptBlock, x as historyContentWithAttachments, y as isChatAttachmentPart, z as isChatInteractionPart, A as isChatMentionPart, B as isChatPlanPart, E as isChatStepFinishPart, F as isChatTextPart, G as isChatToolPart, H as mentionInputToPart, I as mentionPartsFromMessageParts, J as toChatMessageParts } from './parts-IB-Kbb7z.js';
 export { DeriveKeyOptions, createFieldCrypto, decodeHexKey, decryptAesGcm, decryptBytes, decryptWithKey, deriveKey, encryptAesGcm, encryptBytes, encryptWithKey } from './crypto/index.js';
-export { BufferedTurnEvent, BufferedTurnOptions, BufferedTurnTap, D1LikeForTurns, JsonRecord, MISSING_TOOL_TERMINAL_ERROR, MISSING_TOOL_TERMINAL_REASON, PersistedChatMessageForTurn, PumpBufferedTurnOptions, ReplayTurnEventsOptions, ResolvedChatTurn, StreamEvent, TURN_EVENTS_MIGRATION_SQL, TURN_STATUS_SCOPE_MIGRATION_SQL, TurnEventStore, TurnStatus, asRecord, asString, attachmentPartKey, buildUserTextParts, coalesceChatStreamEvents, coalesceDeltas, collapseRedundantTextParts, createBufferedTurnTap, createD1TurnEventStore, createMemoryTurnEventStore, encodeEvent, finalizeAssistantParts, finalizePendingInteractionParts, getPartKey, mergePersistedPart, messageHasTurnId, normalizeClientTurnId, normalizePersistedPart, normalizeTime, normalizeToolEvent, pumpBufferedTurn, replayTurnEvents, resolveChatTurn, resolveToolId, resolveToolName, terminalizeDanglingAssistantToolUpdates, terminalizeDanglingToolPart, terminalizeDanglingToolParts } from './stream/index.js';
+export { J as JsonRecord, M as MISSING_TOOL_TERMINAL_ERROR, a as MISSING_TOOL_TERMINAL_REASON, S as StreamEvent, b as asRecord, c as asString, d as attachmentPartKey, e as collapseRedundantTextParts, f as encodeEvent, g as finalizeAssistantParts, h as finalizePendingInteractionParts, i as getPartKey, m as mergePersistedPart, n as normalizePersistedPart, j as normalizeTime, k as normalizeToolEvent, r as resolveToolId, l as resolveToolName, t as terminalizeDanglingAssistantToolUpdates, o as terminalizeDanglingToolPart, p as terminalizeDanglingToolParts } from './stream-normalizer-DWvtmY6F.js';
+export { PersistedChatMessageForTurn, ResolvedChatTurn, buildUserTextParts, messageHasTurnId, normalizeClientTurnId, resolveChatTurn } from './stream/index.js';
+export { B as BufferedTurnEvent, a as BufferedTurnOptions, b as BufferedTurnTap, D as D1LikeForTurns, P as PumpBufferedTurnOptions, R as ReplayTurnEventsOptions, T as TURN_EVENTS_MIGRATION_SQL, c as TURN_STATUS_SCOPE_MIGRATION_SQL, d as TurnEventStore, e as TurnStatus, f as coalesceChatStreamEvents, g as coalesceDeltas, h as createBufferedTurnTap, i as createD1TurnEventStore, j as createMemoryTurnEventStore, p as pumpBufferedTurn, r as replayTurnEvents } from './turn-buffer-C9mEgoop.js';
 export { HubExecClient, HubExecClientOptions, HubExecErrorCode, HubExecResult, HubInvokeDeps, HubInvokeInput, HubInvokeOutcome, ParsedIntegrationAction, invokeIntegrationHub, resolveIntegrationAction } from './integrations/index.js';
 export { C as ChatInteraction, a as ChatInteractionField, b as ChatInteractionStatus, c as ChatSelectField, d as ComposerAnswerDelivery, I as INTERACTION_CANCEL_EVENT, e as INTERACTION_EVENT, f as INTERACTION_RESOLVED_EVENT, g as InteractionAnswerValue, h as InteractionAnswers, i as InteractionCancelData, j as InteractionPersistedPart, k as InteractionRequestWire, N as NoticeKind, l as NoticePersistedPart, P as ParseInteractionAnswersResult, m as ParseInteractionResult, n as canTransitionInteractionStatus, o as cancelStatusFor, p as composerAnswerData, q as composerAnswerDeliveries, r as dedupeQuestionInteractionsByContent, s as fieldAcceptsFreeText, t as interactionFromWireRequest, u as interactionPartKey, v as interactionToPersistedPart, w as isRenderableInteractionKind, x as isSafeInteractionFieldKey, y as isTerminalInteractionStatus, z as noticePart, A as noticePartKey, B as parseInteractionAnswers, D as parseInteractionCancel, E as parseInteractionRequest, F as persistedPartToInteraction, G as questionInteractionContentSignature, H as stampInteractionAnswers } from './contract-KfqJh_au.js';
 export { BeforeInteractionAnswerArgs, DurableInteractionRouteArgs, DurableInteractionRoutePersistence, InteractionAnswerBodyValidation, InteractionAnswerRoute, InteractionAnswerRouteOptions, InteractionClientOutcome, InteractionConnectionResolution, InteractionRouteLogger, ResolveInteractionConnectionArgs, SidecarInteractionsConnection, SidecarInteractionsError, SidecarInteractionsResult, createInteractionAnswerRoute, listSessionInteractions, mapInteractionRespondFailure, respondToSessionInteraction, validateInteractionAnswerBody } from './interactions/index.js';

package/dist/index.js

@@ -244,39 +244,20 @@ import {
   threadTitleFromMessage
 } from "./chunk-5EQCITY3.js";
 import {
-  MISSING_TOOL_TERMINAL_ERROR,
-  MISSING_TOOL_TERMINAL_REASON,
   TURN_EVENTS_MIGRATION_SQL,
   TURN_STATUS_SCOPE_MIGRATION_SQL,
-  asRecord,
-  asString,
-  attachmentPartKey,
   buildUserTextParts,
   coalesceChatStreamEvents,
   coalesceDeltas,
-  collapseRedundantTextParts,
   createBufferedTurnTap,
   createD1TurnEventStore,
   createMemoryTurnEventStore,
-  encodeEvent,
-  finalizeAssistantParts,
-  finalizePendingInteractionParts,
-  getPartKey,
-  mergePersistedPart,
   messageHasTurnId,
   normalizeClientTurnId,
-  normalizePersistedPart,
-  normalizeTime,
-  normalizeToolEvent,
   pumpBufferedTurn,
   replayTurnEvents,
-  resolveChatTurn,
-  resolveToolId,
-  resolveToolName,
-  terminalizeDanglingAssistantToolUpdates,
-  terminalizeDanglingToolPart,
-  terminalizeDanglingToolParts
-} from "./chunk-4AUQIAYU.js";
+  resolveChatTurn
+} from "./chunk-23LUHHHN.js";
 import {
   createInteractionAnswerRoute,
   listSessionInteractions,
@@ -296,6 +277,13 @@ import {
   serializeCookie
 } from "./chunk-HFC4BTWJ.js";
 import {
+  DEFAULT_ATTACHMENT_PROMPT_HEADER,
+  attachmentInputToPart,
+  attachmentKindForMime,
+  attachmentPartsFromMessageParts,
+  buildAttachmentPromptBlock,
+  historyContentWithAttachments,
+  isChatAttachmentPart,
   isChatInteractionPart,
   isChatMentionPart,
   isChatPlanPart,
@@ -305,7 +293,28 @@ import {
   mentionInputToPart,
   mentionPartsFromMessageParts,
   toChatMessageParts
-} from "./chunk-6E2XJSCT.js";
+} from "./chunk-JGYOYY5D.js";
+import {
+  MISSING_TOOL_TERMINAL_ERROR,
+  MISSING_TOOL_TERMINAL_REASON,
+  asRecord,
+  asString,
+  attachmentPartKey,
+  collapseRedundantTextParts,
+  encodeEvent,
+  finalizeAssistantParts,
+  finalizePendingInteractionParts,
+  getPartKey,
+  mergePersistedPart,
+  normalizePersistedPart,
+  normalizeTime,
+  normalizeToolEvent,
+  resolveToolId,
+  resolveToolName,
+  terminalizeDanglingAssistantToolUpdates,
+  terminalizeDanglingToolPart,
+  terminalizeDanglingToolParts
+} from "./chunk-5MG74GVQ.js";
 import {
   INTERACTION_CANCEL_EVENT,
   INTERACTION_EVENT,
@@ -524,6 +533,7 @@ export {
   ConversionMetricsSchema,
   CopyContentSchema,
   DEFAULT_APP_TOOL_PATHS,
+  DEFAULT_ATTACHMENT_PROMPT_HEADER,
   DEFAULT_DESIGN_CANVAS_MCP_DESCRIPTION,
   DEFAULT_HARNESS,
   DEFAULT_HEADER_NAMES,
@@ -604,7 +614,10 @@ export {
   assertSceneMediaSrc,
   assertSequenceMediaUrl,
   attachReasoningEffort,
+  attachmentInputToPart,
+  attachmentKindForMime,
   attachmentPartKey,
+  attachmentPartsFromMessageParts,
   authenticateToolRequest,
   bearerSubprotocolToken,
   bearerToken,
@@ -616,6 +629,7 @@ export {
   buildAppToolMcpServer,
   buildAppToolMcpServers,
   buildAppToolOpenAITools,
+  buildAttachmentPromptBlock,
   buildCaptionChunks,
   buildCatalog,
   buildConsentUrl,
@@ -755,6 +769,7 @@ export {
   getClient,
   getPartKey,
   handleAppToolRequest,
+  historyContentWithAttachments,
   httpHeadProbe,
   instantiateTemplate,
   interactionFromWireRequest,
@@ -762,6 +777,7 @@ export {
   interactionToPersistedPart,
   invokeIntegrationHub,
   isAppToolName,
+  isChatAttachmentPart,
   isChatInteractionPart,
   isChatMentionPart,
   isChatPlanPart,

package/dist/{parts-1_3y2JmR.d.ts → parts-IB-Kbb7z.d.ts}

@@ -29,6 +29,27 @@ interface ChatTurnFilePartInput {
     content?: string;
 }
 type ChatTurnPartInput = ChatTurnTextPartInput | ChatTurnFilePartInput;
+/** The image/file split an attachment is rendered and persisted under — the
+ *  same discriminant as {@link ChatMentionKind}, but a distinct name because an
+ *  attachment carries content the product uploaded (`ChatAttachmentInput`)
+ *  while a mention points at a file the box already has. Defined HERE (the
+ *  import-free layer) so `ChatAttachmentInput` can reference it and the client
+ *  composer imports it without pulling the persisted-part vocabulary;
+ *  `/chat-store`'s parts module re-exports it alongside the attachment helpers. */
+type ChatAttachmentKind = 'image' | 'file';
+/** `POST` turn-body entry describing a file already uploaded to the product's
+ *  store (vault/object-store) — distinct from an inline {@link
+ *  ChatTurnFilePartInput} (which carries bytes) and from a {@link FileMention}
+ *  (a sandbox path the box already holds). The route resolves this field with
+ *  {@link resolveChatAttachments}: every path is re-validated and every size is
+ *  re-derived from the stored body, so nothing here is trusted as sent. */
+interface ChatAttachmentInput {
+    path: string;
+    name: string;
+    size: number;
+    mediaType: string;
+    kind: ChatAttachmentKind;
+}
 /** POST body for the turn route. `content` may be empty when `parts` carry the
  *  message (an image-only send). Product routing fields (workspaceId etc.) ride
  *  alongside and are read by the product's `authorize` seam. */
@@ -45,6 +66,12 @@ interface ChatTurnRequestPayload {
      *  route validates this field with {@link parseFileMentions} and replaces it
      *  on the payload with the validated, deduped list. */
     mentions?: FileMention[];
+    /** Files uploaded to the product's store ahead of the turn — path
+     *  references, NOT inline bytes (those ride `parts`). Validated and
+     *  size-re-derived by {@link resolveChatAttachments} into persistable
+     *  attachment parts; a product whose `parts` field is spoken for by inline
+     *  uploads still sends store-backed files here. */
+    attachments?: ChatAttachmentInput[];
     model?: string;
     effort?: 'auto' | 'low' | 'medium' | 'high';
     harness?: string;
@@ -57,6 +84,41 @@ interface ChatTurnRequestPayload {
  *  parser. */
 declare function chatTurnRequestInit(payload: ChatTurnRequestPayload): RequestInit;
 declare const INLINE_PARTS_MAX_BYTES = 950000;
+/** Hard cap on the whole `/prompt` request body as it crosses the sandbox
+ *  proxy — smaller in practice than a raw-file write cap because a dispatch
+ *  carries several inline parts plus the flattened history in one request. */
+declare const DISPATCH_REQUEST_MAX_BYTES: number;
+/** Bytes reserved off the top of {@link DISPATCH_REQUEST_MAX_BYTES} for the
+ *  JSON structure around the parts array (keys, delimiters, per-part
+ *  `type`/`filename`/`mediaType` fields) that {@link base64WireLen} does not
+ *  account for — keeps the inline budget off the exact proxy cap where one
+ *  stray byte trips the 413. */
+declare const DISPATCH_STRUCTURAL_RESERVE_BYTES: number;
+/** Sidecar's hard cap on the `parts` array of one prompt request — a dispatch
+ *  must never assemble more parts than this or the whole turn 400s. */
+declare const DISPATCH_MAX_PARTS = 64;
+/** Product-side cap on media parts per dispatch (current turn + carried
+ *  history), well under {@link DISPATCH_MAX_PARTS}. History trimming that keeps
+ *  a transcript's native media under this is a PRODUCT concern (the pointer
+ *  block keeps trimmed media reachable); `buildDispatchParts` enforces only the
+ *  total {@link DISPATCH_MAX_PARTS} cap. */
+declare const DISPATCH_MAX_MEDIA_PARTS = 24;
+/** Size a base64-encoded string occupies on the wire given the raw
+ *  (pre-encoding) byte length: base64 packs 3 raw bytes into 4 output
+ *  characters, rounded up to the next multiple of 4. */
+declare function base64WireLen(byteLen: number): number;
+/**
+ * Render a raw byte count as a human-readable size (`512B`, `3KB`, `12MB
+ * 500KB`). Ported EXACTLY from gtm-agent's `attachment-limits.ts` — byte-
+ * identical implementation, not a reinterpretation — so `resolve-attachments`'s
+ * and `promote-file-part`'s error strings match gtm's wording verbatim. Lives
+ * in the import-free wire layer (not `resolve-attachments.ts` alone) because
+ * BOTH the aggregate-cap message here and the per-file oversize message in
+ * `promote-file-part.ts` need it; a browser composer wanting the same
+ * formatting for a client-side pre-check can also import it with no engine
+ * pulled in.
+ */
+declare function formatBytes(bytes: number): string;
 declare class ChatTurnInputError extends Error {
     readonly status: number;
     readonly code: string;
@@ -229,11 +291,15 @@ interface ChatToolPart {
     state: ChatToolState;
 }
 /** Union of the sidecar's legacy (path-based) and AI-SDK (url-based) file
- *  shapes; response-side every field besides `type` is optional. */
+ *  shapes; response-side every field besides `type` is optional. `name` is the
+ *  attachment-flavored display label an uploaded/promoted file carries (see
+ *  {@link ChatAttachmentPart}) — absent on a harness-emitted file part, which
+ *  uses `filename`. */
 interface ChatFilePart {
     type: 'file';
     id?: string;
     filename?: string;
+    name?: string;
     mediaType?: string;
     url?: string;
     path?: string;
@@ -242,6 +308,7 @@ interface ChatFilePart {
 interface ChatImagePart {
     type: 'image';
     filename?: string;
+    name?: string;
     mediaType?: string;
     url?: string;
     path?: string;
@@ -364,5 +431,82 @@ declare function mentionPartsFromMessageParts(parts: ReadonlyArray<Record<string
  *  than stored as `undefined`, so a stored row never carries a key that means
  *  nothing. */
 declare function mentionInputToPart(input: FileMention): ChatMentionPart;
+/** `image` for any `image/*` mime, `file` for everything else (including an
+ *  absent/empty mime) — the same split the composer and the persisted-part
+ *  discriminant both key on. */
+declare function attachmentKindForMime(mime?: string): ChatAttachmentKind;
+
+/**
+ * Persisted attachment part: structurally an attachment-flavored `ChatFilePart`
+ * / `ChatImagePart` (`path` + `name` promoted to required) rather than a
+ * separate union member — see the section note above. The index signature keeps
+ * it a `Record<string, unknown>` so it drops into the same untyped `parts`
+ * arrays every other stored part rides in, and lets the `type`-driven
+ * constructors below build it without union-discriminant gymnastics.
+ */
+interface ChatAttachmentPart {
+    type: ChatAttachmentKind;
+    path: string;
+    name: string;
+    size?: number;
+    mediaType?: string;
+    turnId?: string;
+    [key: string]: unknown;
+}
+/** True for any `image`/`file` part carrying a non-empty string `path`.
+ *  DELIBERATELY also matches a sidecar path-bearing file part (a mention-style
+ *  `file` part with only `path`) — the guard is a structural attachment shape,
+ *  not proof of provenance; a caller that needs to exclude those filters
+ *  upstream. The `path.length > 0` check diverges from gtm's original guard
+ *  (which only checked `typeof`), mirroring sibling {@link isChatMentionPart}:
+ *  read-side robustness against a stored `{type:'file', path:''}` row — which
+ *  would otherwise render a malformed `(vault: )` pointer line — justifies the
+ *  small divergence from byte-for-byte gtm parity here; no legitimate write
+ *  path ever produces an empty `path`. */
+declare function isChatAttachmentPart(part: unknown): part is ChatAttachmentPart;
+/** Drop absent/empty optional fields rather than persisting `undefined`/`''`
+ *  — keeps stored parts minimal. */
+declare function attachmentInputToPart(input: ChatAttachmentInput): ChatAttachmentPart;
+/** Every attachment part on one message's stored `parts`, in stored order. */
+declare function attachmentPartsFromMessageParts(parts: ReadonlyArray<Record<string, unknown>> | null | undefined): ChatAttachmentPart[];
+/** gtm's exact default header for {@link buildAttachmentPromptBlock} — kept
+ *  byte-identical because it feeds dispatched prompts (gtm-agent#618
+ *  reproduces the prompt bytes through this module). Override only with intent. */
+declare const DEFAULT_ATTACHMENT_PROMPT_HEADER = "Attached files (already saved to the workspace vault \u2014 read them from these paths):";
+/**
+ * The agent-facing pointer block appended to the dispatched prompt — never
+ * persisted in `message.content`. Empty array → `''` so callers can append
+ * unconditionally. The sole producer of this text: both the current turn's
+ * dispatch and history projection ({@link historyContentWithAttachments}) build
+ * it from here, so the two can never drift. `header` overrides the first line
+ * ({@link DEFAULT_ATTACHMENT_PROMPT_HEADER}); the per-file line format is fixed.
+ *
+ * Every interpolated `name`/`path` is swept for control characters first
+ * (newline/carriage-return/tab included) and each one replaced with a single
+ * space — a single-line-per-file guarantee. Without it, a control character
+ * riding through on a PERSISTED row (`historyContentWithAttachments` reads
+ * whatever is already stored; a legacy or hand-edited row was never re-checked
+ * against `resolveChatAttachments`) could inject extra lines — fabricated
+ * pointer entries or instructions — into a prompt the agent trusts verbatim.
+ * The wire-side validator is the primary control; this is the backstop for
+ * rows it never saw.
+ */
+declare function buildAttachmentPromptBlock(atts: ReadonlyArray<Pick<ChatAttachmentPart, 'name' | 'path'>>, header?: string): string;
+/**
+ * History projection for a persisted message: `content` unchanged when it
+ * carries no attachment parts, else the block is appended once. The
+ * no-double-annotation guarantee holds under the invariant that the block is
+ * never persisted INTO `message.content` — it is appended only at read time,
+ * by this function and the current turn's dispatch, both sourcing from
+ * `attachmentPartsFromMessageParts` — never by content inspection. This
+ * function does not (and cannot) detect an already-embedded block by scanning
+ * `content` for its text: a message whose stored `content` happens to already
+ * contain the block's bytes, alongside attachment parts, still gets the block
+ * appended a second time. See the pinned test for that boundary.
+ */
+declare function historyContentWithAttachments(message: {
+    content: string;
+    parts?: ReadonlyArray<Record<string, unknown>> | null;
+}, header?: string): string;
 
-export { type ChatTurnRequestPayload as A, type ChatTurnPartInput as B, type ChatFilePart as C, type ChatTurnFilePartInput as D, ChatTurnInputError as E, type FileMention as F, type ChatTurnTextPartInput as G, type FileMentionsToPartsOptions as H, INLINE_PARTS_MAX_BYTES as I, type SandboxMentionPathCheck as J, assertPromptPartsWithinCap as K, buildMentionPromptBlock as L, MENTION_MAX_COUNT as M, chatTurnRequestInit as N, fileMentionsToParts as O, mediaTypeForMentionPath as P, mentionKindForPath as Q, parseChatTurnParts as R, type StorableHarnessPartKind as S, parseFileMentions as T, promptPartsByteSize as U, validateSandboxMentionPath as V, type ChatImagePart as a, type ChatInteractionPart as b, type ChatMentionKind as c, type ChatMentionPart as d, type ChatMessagePart as e, type ChatNoticePart as f, type ChatPartTime as g, type ChatPlanPart as h, type ChatReasoningPart as i, type ChatStepFinishPart as j, type ChatStepStartPart as k, type ChatSubtaskPart as l, type ChatTextPart as m, type ChatToolPart as n, type ChatToolState as o, type ChatToolStatus as p, type ChatUsageTokens as q, isChatInteractionPart as r, isChatMentionPart as s, isChatPlanPart as t, isChatStepFinishPart as u, isChatTextPart as v, isChatToolPart as w, mentionInputToPart as x, mentionPartsFromMessageParts as y, toChatMessageParts as z };
+export { base64WireLen as $, isChatMentionPart as A, isChatPlanPart as B, type ChatAttachmentKind as C, DEFAULT_ATTACHMENT_PROMPT_HEADER as D, isChatStepFinishPart as E, isChatTextPart as F, isChatToolPart as G, mentionInputToPart as H, mentionPartsFromMessageParts as I, toChatMessageParts as J, type FileMention as K, type ChatTurnRequestPayload as L, type ChatTurnPartInput as M, type ChatTurnFilePartInput as N, type ChatAttachmentInput as O, ChatTurnInputError as P, type ChatTurnTextPartInput as Q, DISPATCH_MAX_MEDIA_PARTS as R, type StorableHarnessPartKind as S, DISPATCH_MAX_PARTS as T, DISPATCH_REQUEST_MAX_BYTES as U, DISPATCH_STRUCTURAL_RESERVE_BYTES as V, type FileMentionsToPartsOptions as W, INLINE_PARTS_MAX_BYTES as X, MENTION_MAX_COUNT as Y, type SandboxMentionPathCheck as Z, assertPromptPartsWithinCap as _, type ChatAttachmentPart as a, buildMentionPromptBlock as a0, chatTurnRequestInit as a1, fileMentionsToParts as a2, formatBytes as a3, mediaTypeForMentionPath as a4, mentionKindForPath as a5, parseChatTurnParts as a6, parseFileMentions as a7, promptPartsByteSize as a8, validateSandboxMentionPath as a9, type ChatFilePart as b, type ChatImagePart as c, type ChatInteractionPart as d, type ChatMentionKind as e, type ChatMentionPart as f, type ChatMessagePart as g, type ChatNoticePart as h, type ChatPartTime as i, type ChatPlanPart as j, type ChatReasoningPart as k, type ChatStepFinishPart as l, type ChatStepStartPart as m, type ChatSubtaskPart as n, type ChatTextPart as o, type ChatToolPart as p, type ChatToolState as q, type ChatToolStatus as r, type ChatUsageTokens as s, attachmentInputToPart as t, attachmentKindForMime as u, attachmentPartsFromMessageParts as v, buildAttachmentPromptBlock as w, historyContentWithAttachments as x, isChatAttachmentPart as y, isChatInteractionPart as z };

package/dist/sandbox/index.d.ts

@@ -1,4 +1,4 @@
-import { AgentProfileMcpServer, ProvisionEvent, SandboxInstance, AgentProfileFileMount, AgentProfile, StorageConfig, ScopedTokenScope, TurnDriveResult, Sandbox } from '@tangle-network/sandbox';
+import { SandboxInstance, AgentProfileMcpServer, ProvisionEvent, AgentProfileFileMount, AgentProfile, StorageConfig, ScopedTokenScope, TurnDriveResult, Sandbox } from '@tangle-network/sandbox';
 export { StorageConfig } from '@tangle-network/sandbox';
 import { a as ToolHeaderNames } from '../auth-DuptSkWh.js';
 import { f as AppToolName, c as AppToolContext } from '../types-BEOvc_ue.js';

package/dist/stale-turn-lock-C8Na1cFZ.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Recovery policy for a `ChatTurnLock` whose holder died.
+ *
+ * `createChatTurnRoutes` takes the lock as a seam (`acquire`/`release`) and a
+ * lock is a single-flight guard: while it is held, a second turn on the same
+ * scope is refused. Products give it a TTL measured in tens of minutes, so a
+ * turn that dies without releasing wedges chat for that whole window. Every
+ * app on the seam inherits that wedge, which is why the way OUT of it is
+ * policy this package owns rather than something each app rediscovers.
+ *
+ * The policy takes PROBES, not clients: it imports no sandbox SDK, opens no
+ * connection, and knows nothing about how a product finds its box or talks to
+ * a sidecar. That is what makes the rules testable and what keeps the concrete
+ * probes — which box key, which session id, which sidecar endpoint — in the
+ * product.
+ *
+ * The rules, in precedence order:
+ *
+ * 1. The session probe answered and the execution is TERMINAL ⇒ release, once
+ *    the lock is past a short grace period. The authority on "is this turn
+ *    still running" is whatever is actually running it; a terminal verdict is
+ *    proof the lock outlived its turn — but only if the verdict is about THIS
+ *    turn, which is what the grace buys (see
+ *    {@link DEFAULT_TERMINAL_TURN_LOCK_GRACE_MS}).
+ * 2. The session probe answered and the execution is LIVE ⇒ hold, always.
+ *    Nothing below may override this. The lock is doing exactly its job.
+ * 3. The probes could not reach that authority at all — the sandbox could not
+ *    be listed, is gone, is not running, or its session probe failed ⇒ fall
+ *    back on the physical argument: an execution runs INSIDE the box, so a box
+ *    that is not there is running nothing, and the lock is releasable. Without
+ *    this fallback the recovery would depend on the very subsystem whose
+ *    failure produced the stale lock.
+ *
+ * Rule 3 is gated on a grace period because it is an inference, not an
+ * observation — see {@link DEFAULT_STALE_TURN_LOCK_GRACE_MS}.
+ */
+/** Where the box is, as far as the caller can see. `state` on `not-running`
+ *  is the platform's own status string, carried through for the log. */
+type StaleTurnLockSandboxProbeResult = {
+    status: 'running';
+} | {
+    status: 'absent';
+} | {
+    status: 'not-running';
+    state?: string;
+};
+/** What the thing running the turn says about it. `terminal: false` means an
+ *  execution is LIVE — the strongest signal in the policy. `diagnostics` rides
+ *  through to the result and the logs unread. */
+type StaleTurnLockSessionProbeResult = {
+    reachable: true;
+    terminal: boolean;
+    diagnostics?: Record<string, unknown>;
+} | {
+    reachable: false;
+    reason?: string;
+};
+/**
+ * Minimum age a lock must reach before the "sandbox unreachable ⇒ nothing can
+ * be running" fallback may force-release it.
+ *
+ * The lock is acquired BEFORE the box is ensured, so during a cold workspace's
+ * first turn there is a real window in which the lock is held and no box exists
+ * yet — indistinguishable, from a peek, from a box that vanished. The grace
+ * period has to outlast that window (create + bootstrap + whatever the product
+ * hydrates) or a concurrent request steals the lock from a turn that is merely
+ * still provisioning. Five minutes clears observed cold starts with room to
+ * spare while cutting the worst case from a TTL-length wedge down to five
+ * minutes. Raising it makes recovery slower; lowering it risks stealing a lock
+ * mid-provision.
+ */
+declare const DEFAULT_STALE_TURN_LOCK_GRACE_MS: number;
+/**
+ * Minimum age a lock must reach before a TERMINAL session verdict may release
+ * it.
+ *
+ * The session probe is keyed on the THREAD, not on the execution the lock
+ * holds: a sidecar that has nothing running reports `terminal` with
+ * `activeExecutionId: null`, so there is no id to match the lock against. The
+ * lock, meanwhile, is acquired BEFORE the box is ensured and before the
+ * execution registers with the sidecar. Between those two moments a second
+ * request that reconciles the lock asks the sidecar about a turn it has not
+ * heard of yet and gets back the PREVIOUS turn's terminal state — proof about
+ * the wrong execution. Releasing on that verdict hands the second request a
+ * lock the first one is still using, which is two concurrent turns on a scope
+ * whose single-flight guard just voted for itself.
+ *
+ * One minute covers the acquire → box-ensure → sidecar-registration window on
+ * a warm box (the cold-box case is Rule 3's, and has its own, much longer
+ * grace). Deliberately NOT
+ * {@link DEFAULT_STALE_TURN_LOCK_GRACE_MS}: this branch has a positive
+ * observation behind it, so it should recover fast, and stretching it to five
+ * minutes would leave a genuinely dead turn wedged for the whole window that
+ * the session probe exists to shortcut. Raising it delays recovery from a
+ * crashed turn; lowering it narrows the registration window it protects.
+ */
+declare const DEFAULT_TERMINAL_TURN_LOCK_GRACE_MS: number;
+interface ReconcileStaleTurnLockOptions {
+    /** When the held lock was acquired (epoch ms). The grace period is measured
+     *  from here, so it must be the LOCK's start, not the turn's. */
+    lockStartedAt: number;
+    /** Is the box there and running? Never provisions — a peek, not an ensure.
+     *  A throw is treated as unreachable, same as `absent`. */
+    probeSandbox(): Promise<StaleTurnLockSandboxProbeResult>;
+    /** Ask the running box whether the execution is still live. Only called when
+     *  `probeSandbox` reported `running`. A throw is treated as unreachable. */
+    probeSession(): Promise<StaleTurnLockSessionProbeResult>;
+    /** Release the lock, fenced by the instant the releasing evidence was
+     *  observed. `fence.observedAt` is snapshotted BEFORE the probe that
+     *  justified the release, so a store that can compare it against the held
+     *  lock's start refuses to delete a SUCCESSOR lock acquired while the probe
+     *  was in flight. A store that cannot make that comparison may ignore the
+     *  fence, but must not substitute its own `Date.now()` — that timestamp is
+     *  by construction newer than any successor and makes the check vacuous.
+     *
+     *  Returns whether the release actually landed — `false` when the lock was
+     *  already gone (someone else got there first), which is reported, never
+     *  treated as a release. */
+    release(fence: {
+        observedAt: number;
+    }): boolean | Promise<boolean>;
+    /** Override {@link DEFAULT_STALE_TURN_LOCK_GRACE_MS} (Rule 3's fallback). */
+    graceMs?: number;
+    /** Override {@link DEFAULT_TERMINAL_TURN_LOCK_GRACE_MS} (Rule 1's release). */
+    terminalGraceMs?: number;
+    /** Identity fields merged into every log line (workspace, thread, execution
+     *  id — whatever makes the entry findable in the product's logs). */
+    context?: Record<string, unknown>;
+    /** Defaults to `console.warn`. Both the withheld and the force-released
+     *  branches log; a force-release is never silent. */
+    log?(message: string, meta: Record<string, unknown>): void;
+    /** Injectable clock, for tests. */
+    now?(): number;
+}
+interface ReconcileStaleTurnLockResult {
+    released: boolean;
+    /** Why the policy decided what it did — the probe's own diagnostics on the
+     *  reachable path, the unreachable reason and lock age on the fallback. */
+    diagnostics: Record<string, unknown>;
+}
+/**
+ * Decide whether a held lock is stale and, if so, release it.
+ *
+ * Never provisions and never mutates anything but the lock: a reconciliation
+ * attempt on a cold workspace leaves it cold.
+ */
+declare function reconcileStaleTurnLock(options: ReconcileStaleTurnLockOptions): Promise<ReconcileStaleTurnLockResult>;
+
+export { DEFAULT_STALE_TURN_LOCK_GRACE_MS as D, type ReconcileStaleTurnLockOptions as R, type StaleTurnLockSandboxProbeResult as S, DEFAULT_TERMINAL_TURN_LOCK_GRACE_MS as a, type ReconcileStaleTurnLockResult as b, type StaleTurnLockSessionProbeResult as c, reconcileStaleTurnLock as r };