@teaflask/assistant 0.3.0 → 0.7.0

package/dist/core/approval-request-narrowing.d.ts

@@ -1,32 +1,15 @@
 import type { ApprovalRequestedPayload } from "../contract/events.js";
-/** One coworker approval as the turn snapshot lists it, narrowed. */
 export interface CoworkerApprovalRequest {
     ordinal: number;
     label: string;
     childSessionId: string;
-    /** The coworker's own waiting execution already exited (its answer
-     *  still counts — the entity restarts it); never the parent's state. */
     parked: boolean;
     card: ApprovalRequestedPayload;
 }
-/** The turn fields the coworker adoption reads — the serving and the
- *  dashboard turn shapes both satisfy it. A turn with no id has no door
- *  a coworker's decision could be posted to, so it lists nothing. */
 export interface CoworkerApprovalTurn {
     id?: string;
     run_id: string | null;
     pending_coworker_approvals?: readonly unknown[] | null;
 }
-/**
- * Narrow one pending_coworker_approvals item (any by contract): the
- * asker's identity plus the card in the marker's own shape, so the
- * marker narrowing below serves both askers. Malformed → null.
- */
 export declare function coworkerApprovalRequestOf(value: unknown): CoworkerApprovalRequest | null;
-/**
- * Narrow an approval_requested CUSTOM event's wire value (any by contract).
- * Malformed payloads return null and are ignored — the contract's "clients
- * MUST ignore events and fields they do not recognize".
- */
 export declare function approvalRequestedPayloadOf(value: unknown): ApprovalRequestedPayload | null;
-//# sourceMappingURL=approval-request-narrowing.d.ts.map

package/dist/core/approval-request-narrowing.js

@@ -1,15 +1,4 @@
-// The approval wire's narrowers: an approval_requested
-// marker's value and a turn snapshot's coworker approval item, both `any`
-// by contract. Malformed values return null and are ignored — the
-// contract's "clients MUST ignore events and fields they do not
-// recognize". A dependency-free leaf, the twin of
-// execution-request-narrowing.ts.
 import { withoutStepCaption } from "./step-caption.js";
-/**
- * Narrow one pending_coworker_approvals item (any by contract): the
- * asker's identity plus the card in the marker's own shape, so the
- * marker narrowing below serves both askers. Malformed → null.
- */
 export function coworkerApprovalRequestOf(value) {
     if (typeof value !== "object" || value === null) {
         return null;
@@ -32,11 +21,6 @@ export function coworkerApprovalRequestOf(value) {
         card,
     };
 }
-/**
- * Narrow an approval_requested CUSTOM event's wire value (any by contract).
- * Malformed payloads return null and are ignored — the contract's "clients
- * MUST ignore events and fields they do not recognize".
- */
 export function approvalRequestedPayloadOf(value) {
     if (typeof value !== "object" || value === null) {
         return null;
@@ -52,14 +36,11 @@ export function approvalRequestedPayloadOf(value) {
         interrupt_id: record.interrupt_id,
         prompt: record.prompt,
         tool_name: typeof record.tool_name === "string" ? record.tool_name : null,
-        // The model's caption is the row's label, never an argument.
         tool_args: withoutStepCaption(recordOrEmpty(record.tool_args)),
-        // Fail safe against an older wire: no schema means the generic card.
         tool_input_schema: recordOrNull(record.tool_input_schema),
         tool_output_schema: recordOrNull(record.tool_output_schema),
         tool_call_id: typeof record.tool_call_id === "string" ? record.tool_call_id : null,
         round: typeof record.round === "number" ? record.round : 0,
-        // Fail safe against an older wire: no flag means no trust affordance.
         gated: record.gated === true,
         trust_available: record.trust_available === true,
     };
@@ -76,4 +57,3 @@ function recordOrNull(value) {
     }
     return null;
 }
-//# sourceMappingURL=approval-request-narrowing.js.map

package/dist/core/approval-resolved.js

@@ -1,21 +1,3 @@
-// The approval_resolved payload narrower, pure of React. THE PREMISE,
-// stated: the WIRE contract is unchanged — the server records and serves
-// approval_resolved markers carrying interrupt_id, approved, feedback,
-// and resolved_by. This module is the CLIENT-SIDE narrower, and a
-// narrower copies only the fields something renders or decides on.
-// The three consumers: the approval inbox (approvalInboxRecorder →
-// noteApprovalResolved) and the denial ledger (tool-denial-anchors.ts)
-// read exactly interruptId and approved; the dashboard's audit receipt
-// row, which imports this narrower through ./transcript, renders
-// feedback and resolvedBy too — so those ride as optional fields,
-// present only when the wire sent strings. Extra wire fields are
-// ignored by construction (the narrower
-// reads named keys off the payload); narrowing returns null only on a
-// missing/mistyped interrupt_id or approved, so a server sending a richer
-// payload can neither throw nor drop an event here. (The anchoring half
-// this module once carried — recorder, anchor maps, receipt sentences —
-// went with the deleted meta-receipt rows; the file lost the "-anchors"
-// name with it.)
 export function approvalResolvedPayloadOf(value) {
     if (typeof value !== "object" || value === null) {
         return null;
@@ -28,10 +10,7 @@ export function approvalResolvedPayloadOf(value) {
     return {
         interruptId: payload.interrupt_id,
         approved: payload.approved,
-        // The optional fields may arrive as null or be absent entirely —
-        // the stored payload keeps whatever the marker model dumped.
         feedback: typeof payload.feedback === "string" ? payload.feedback : undefined,
         resolvedBy: typeof payload.resolved_by === "string" ? payload.resolved_by : undefined,
     };
 }
-//# sourceMappingURL=approval-resolved.js.map

package/dist/core/assistant-prose.js

@@ -1,17 +1,3 @@
-// The one "assistant prose" predicate.
-//
-// REQUIRED INVARIANT, not incidental sharing: memory attribution
-// (core/memory-provenance-anchors.ts) selects the message id a footer
-// anchors to with this predicate, and the projection
-// (core/transcript-rows.ts) emits the assistant-text row — the footer's
-// ONLY host — under the same predicate. If the two ever disagree (one
-// side trims whitespace, or starts handling array content), an
-// attributed id can fail to project and footers silently stop
-// rendering, with no test naming the cause. Any change to what counts
-// as prose must happen HERE, once, for both consumers.
-/** The newest assistant message with visible prose — the only row kind
- *  a memory footer may render under (tool results, tool-call-only
- *  messages, and reasoning never host one). */
 export function newestAssistantProseIdOf(messages) {
     for (let index = messages.length - 1; index >= 0; index -= 1) {
         const message = messages[index];
@@ -23,4 +9,3 @@ export function newestAssistantProseIdOf(messages) {
     }
     return null;
 }
-//# sourceMappingURL=assistant-prose.js.map

package/dist/core/assistant-session-registry.js

@@ -1,32 +1,9 @@
-// One conversation per session identity, however many providers. Each
-// React root used to build its own TokenSession + store pair, so two
-// custom elements on one host page (the widget and the full page) held
-// two conversations that converged only through localStorage and server
-// history — never live. The registry hoists the pair into module scope,
-// keyed by the session's identity inputs and ref-counted: same-identity
-// providers — across separate React roots — resolve the SAME store, and
-// every surface streams the same turn. Module-scoped on purpose, like
-// the surface registry beside it: the sharing has to cross React trees,
-// and every element loads from one assistant.js, so module state IS the
-// cross-root channel.
-//
-// Per-provider wiring (token resolver, host capabilities, error sink)
-// cannot be baked into the shared pair, so registrants carry it and the
-// entry owns stable closures that delegate by rule:
-//   - host capabilities: the first capable registrant, per capability,
-//     read fresh at each execution pass — a capability-less widget never
-//     masks a page that wired an adapter, and a released provider hands
-//     over automatically on the next scan;
-//   - end-user token: the first identity-wired registrant, scanned at
-//     each mint (same identity key means same signed-in user, so any
-//     resolver is correct; order makes it deterministic);
-//   - reportError: fanned out to every registrant — observability, not
-//     capability; a duplicate report is harmless, a dropped one is a hole.
 import { readStoredThread, writeStoredThread, } from "../persistence/stored-thread.js";
 import { getAssistantConfig, listSubscriptions, } from "../transport/serving-api.js";
-import { TokenSession } from "../transport/token-session.js";
+import { END_USER_ID_MISMATCH, TokenSession, } from "../transport/token-session.js";
 import { NO_GATE, gateOfProjection, gateOfRefusal, gatesEqual, } from "./connect-gate.js";
 import { AssistantConversationStore, } from "./conversation-store.js";
+import { namedUserIdOf } from "./identity-pair.js";
 import { ObservableCell } from "./observable-cell.js";
 export const DEFAULT_BASE_URL = "https://api.teaflask.com";
 class SessionEntry {
@@ -42,10 +19,8 @@ class SessionEntry {
     conversationGate;
     subscriptions;
     connectOpenRequested;
-    /** Insertion-ordered — "first registrant" is this set's iteration order. */
+    planNoticeDue;
     registrations = new Set();
-    /** Ends the wait below; set only while a mint is parked on it, so the
-     *  ordinary case arms no timer. */
     _endFirstRetainWait = null;
     _everRetained = false;
     _tierCell = new ObservableCell(null);
@@ -59,41 +34,28 @@ class SessionEntry {
     _subscriptionsCell = new ObservableCell(null);
     _subscriptionsFetch = null;
     _connectOpenRequestedCell = new ObservableCell(false);
-    /** Arrow field so it travels unbound through the provider's context,
-     *  exactly like a cell's get/subscribe. */
+    _planNoticeDueCell = new ObservableCell(null);
     ensureAssistantConfig = () => {
         this._assistantConfigFetch ??= this._fetchAssistantConfig();
     };
     refreshAssistantConfig = () => {
-        // Refresh only supersedes an existing read: before the first
-        // ensureAssistantConfig there is nothing stale to correct, and the
-        // mount that needs the config will kick its own fetch.
         if (this._assistantConfigFetch !== null) {
             this._assistantConfigFetch = this._fetchAssistantConfig();
         }
     };
     _fetchAssistantConfig() {
         const fetch = getAssistantConfig(this.session).then((config) => {
-            // Only the current flight may write: an older flight resolving
-            // late must not clobber the refresh that superseded it.
             if (this._assistantConfigFetch === fetch) {
                 this._assistantConfigCell.set(config.suggestions);
                 this._attachmentPolicyCell.set(config.attachments ?? null);
                 this._modelChoiceCell.set(config.model_choice ?? null);
                 this._configAnsweredCell.set(true);
-                // Deduped on substance: the projection mints a fresh object
-                // every read, and an unchanged gate must not notify — the
-                // verifying banner re-reads this every few seconds.
                 const gate = gateOfProjection(config.connect);
                 if (!gatesEqual(this._conversationGateCell.get(), gate)) {
                     this._conversationGateCell.set(gate);
                 }
             }
         }, () => {
-            // A failed attempt evicts itself so the next mount retries;
-            // decoration never surfaces an error.
-            // The fetch still ANSWERED — failure is an answer — so the slot
-            // that held blank for the window may now fall back honestly.
             if (this._assistantConfigFetch === fetch) {
                 this._assistantConfigFetch = null;
                 this._configAnsweredCell.set(true);
@@ -101,8 +63,19 @@ class SessionEntry {
         });
         return fetch;
     }
-    /** Same arrow-field discipline as ensureAssistantConfig, same
-     *  single-flight-with-self-eviction shape. */
+    async _ensureAttachmentPolicy() {
+        this.ensureAssistantConfig();
+        let flight = this._assistantConfigFetch;
+        while (flight !== null) {
+            await flight;
+            const current = this._assistantConfigFetch;
+            if (current === null || current === flight) {
+                break;
+            }
+            flight = current;
+        }
+        return this._attachmentPolicyCell.get();
+    }
     ensureSubscriptions = () => {
         this._subscriptionsFetch ??= this._fetchSubscriptions();
     };
@@ -110,26 +83,30 @@ class SessionEntry {
         this._subscriptionsFetch = this._fetchSubscriptions();
     };
     requestSubscriptionConnect = () => {
-        // The ask fires ABOUT the standing (an auth-bounced credential), and
-        // the session-cached read predates the bounce: re-read so the panel
-        // opens on the bounced state and its reconnect affordance, not a
-        // stale "Connected".
         this.refreshSubscriptions();
         this._connectOpenRequestedCell.set(true);
     };
     acknowledgeSubscriptionConnect = () => {
         this._connectOpenRequestedCell.set(false);
     };
+    _onTurnSettled = () => {
+        this.refreshAssistantConfig();
+        if (this._tierCell.get() === "identified") {
+            this.refreshSubscriptions();
+        }
+    };
+    notePlanSignedIn = (provider) => {
+        this._planNoticeDueCell.set(provider);
+    };
+    acknowledgePlanNotice = () => {
+        this._planNoticeDueCell.set(null);
+    };
     _fetchSubscriptions() {
         const fetch = listSubscriptions(this.session).then((subscriptions) => {
-            // Only the current flight may write: an older flight resolving
-            // late must not clobber the refresh that superseded it.
             if (this._subscriptionsFetch === fetch) {
                 this._subscriptionsCell.set(subscriptions);
             }
         }, () => {
-            // A failed attempt evicts itself so the next mount retries — but
-            // only its own flight, never a refresh that superseded it.
             if (this._subscriptionsFetch === fetch) {
                 this._subscriptionsFetch = null;
             }
@@ -147,15 +124,17 @@ class SessionEntry {
         this.conversationGate = this._conversationGateCell;
         this.subscriptions = this._subscriptionsCell;
         this.connectOpenRequested = this._connectOpenRequestedCell;
+        this.planNoticeDue = this._planNoticeDueCell;
         const publishableKey = spec.publishableKey;
+        const userId = spec.userId;
+        const identityProvided = userId !== undefined;
         this.session = new TokenSession({
             publishableKey,
             baseUrl: _withoutTrailingSlash(spec.baseUrl ?? DEFAULT_BASE_URL),
-            getEndUserToken: spec.identityProvided
+            getEndUserToken: identityProvided
                 ? () => this._resolveEndUserToken()
                 : undefined,
-            // Claim-at-mint: the stored anonymous thread rides the sign-in
-            // re-mint, read fresh each time (claim loss is silent by contract).
+            expectedEndUserId: userId,
             claimThreadId: () => {
                 const stored = readStoredThread(publishableKey);
                 return stored !== null && !stored.identified ? stored.threadId : null;
@@ -165,22 +144,14 @@ class SessionEntry {
                 this._setupErrorCell.set(null);
                 this._tierCell.set(minted.tier);
                 if (minted.tier === "identified") {
-                    _markStoredThreadIdentified(publishableKey);
+                    _markStoredThreadIdentified(publishableKey, userId);
                 }
-                // The mint's verdict flows straight to the store; identification
-                // can arrive mid-session and flips the history expectation.
                 this.store.setTier(minted.tier);
-                // A tier flip changes what the projection would answer (a
-                // sign-in gate clears the moment the vouch lands) — re-read.
                 if (previousTier !== null && previousTier !== minted.tier) {
                     this.refreshAssistantConfig();
                 }
             },
             onMintFailed: (error) => {
-                // Only a setup bug takes the surfaces down. A transient failure
-                // (a rate-limit window, a proxy blip) on the proactive background
-                // re-mint must not blank healthy surfaces whose token is still
-                // valid — the next request mints again.
                 if (_isSetupFailure(error)) {
                     this._setupErrorCell.set(error);
                 }
@@ -190,18 +161,12 @@ class SessionEntry {
         this.store = new AssistantConversationStore({
             session: this.session,
             publishableKey,
-            identityProvided: spec.identityProvided,
+            userId,
             hostCapabilitiesOf: () => this._firstCapableRegistrantCapabilities(),
             reportError: (error) => {
                 this._reportToEveryRegistrant(error);
             },
             onTelemetry: (event) => {
-                // The narration gates nothing: attempted fires before the submit
-                // even validates, and the host callback is arbitrary embedder
-                // code — a throw here must never break the approval it narrates
-                // (it would strand the card's synchronous click guard disabled
-                // forever). A broken telemetry hook is itself worth one report
-                // on the error seam, whose own fan-out is throw-proof below.
                 for (const registration of [...this.registrations]) {
                     try {
                         registration.registrant.onTelemetry?.(event);
@@ -211,9 +176,6 @@ class SessionEntry {
                     }
                 }
             },
-            // A gate refusal is the projection's race window surfacing: adopt
-            // it as the gate immediately (the card renders now, not after a
-            // round-trip) and re-read the standing it spoke about.
             onGateRefusal: (error) => {
                 const gate = gateOfRefusal(error);
                 if (gate !== null) {
@@ -221,9 +183,9 @@ class SessionEntry {
                     this.refreshSubscriptions();
                 }
             },
-            // A settled turn may have crossed the taster budget or drained a
-            // window — the projection is the honest re-read.
-            onTurnSettled: this.refreshAssistantConfig,
+            onTurnSettled: this._onTurnSettled,
+            attachmentPolicy: this._attachmentPolicyCell,
+            ensureAttachmentPolicy: () => this._ensureAttachmentPolicy(),
         });
     }
     _resolveEndUserToken() {
@@ -231,13 +193,8 @@ class SessionEntry {
         if (vouch !== undefined) {
             return vouch;
         }
-        // No registrant YET means one of two opposite things, and answering
-        // both anonymously was the silent-anonymous bug: a provider whose
-        // retain effect has not run is moments from an identity; one whose
-        // registrants have left never will be. Only the identity-wired spec
-        // builds this resolver, so retention is the whole question.
         if (this._everRetained) {
-            return null; // The contract's fail-open: the providers have gone.
+            return null;
         }
         return new Promise((resolve) => {
             const timer = setTimeout(resolve, FIRST_RETAIN_WAIT_MS);
@@ -247,8 +204,6 @@ class SessionEntry {
             };
         }).then(() => this._vouchFromRegistrants() ?? null);
     }
-    /** The first registrant's vouch; null when one answered without a
-     *  vouch, undefined when there was none to ask — the wait needs both. */
     _vouchFromRegistrants() {
         for (const registration of this.registrations) {
             const resolve = registration.registrant.resolveEndUserToken;
@@ -258,7 +213,6 @@ class SessionEntry {
         }
         return this.registrations.size === 0 ? undefined : null;
     }
-    /** The wait is over; later mints resolve straight through. */
     settleFirstRetain() {
         this._everRetained = true;
         this._endFirstRetainWait?.();
@@ -282,11 +236,6 @@ class SessionEntry {
                 registration.registrant.reportError(error);
             }
             catch (hookFailure) {
-                // The error channel itself broke — no registrant seam is left to
-                // report through, and observability must never break the path it
-                // narrates (reportError also runs on the approval drop path). The
-                // console keeps the reason on record, the package's manner for
-                // broken host wiring (approval-context's out-of-surface submit).
                 console.warn("A host reportError callback threw while being handed an error:", hookFailure, "— the original error it was reporting:", error);
             }
         }
@@ -294,12 +243,8 @@ class SessionEntry {
 }
 export class AssistantSessionRegistry {
     entries = new Map();
-    /**
-     * Get-or-create, render-safe: both constructors are side-effect-free
-     * (no network, no timers, no listeners), so a discarded render leaves
-     * only an inert map entry that the next same-identity resolve reuses.
-     */
-    entryFor(spec) {
+    entryFor(requested) {
+        const spec = _withNamedUser(requested);
         const key = _identityKeyOf(spec);
         const existing = this.entries.get(key);
         if (existing !== undefined) {
@@ -309,31 +254,21 @@ export class AssistantSessionRegistry {
         this.entries.set(key, entry);
         return entry;
     }
-    /**
-     * Registers the provider's wiring and boots the store on the first
-     * retain (or revives it — `bootstrap()` resets a disposed store by
-     * design, so retain-after-sweep works). Returns the release; calling
-     * it twice is a no-op. The last release sweeps on a microtask, so
-     * StrictMode's synchronous release-then-retain never tears anything
-     * down, and only the sweep disposes the store and session.
-     */
     retain(entry, registrant) {
         if (!(entry instanceof SessionEntry)) {
             throw new Error("Only entries resolved by entryFor() can be retained — construct nothing yourself.");
         }
-        // A wrapper per retain, not the bare registrant: two providers may
-        // pass identical wiring, and each still holds its own registration.
         const registration = { registrant };
         const firstRetain = entry.registrations.size === 0;
         entry.registrations.add(registration);
-        entry.settleFirstRetain(); // Before bootstrap: a parked mint wakes first.
+        entry.settleFirstRetain();
         if (firstRetain) {
             this._reviveIfSwept(entry);
             entry.store.bootstrap();
         }
         return () => {
             if (!entry.registrations.delete(registration)) {
-                return; // released twice — the first release already counted
+                return;
             }
             if (entry.registrations.size > 0) {
                 return;
@@ -343,10 +278,6 @@ export class AssistantSessionRegistry {
             });
         };
     }
-    /** A retain that lands after the sweep emptied the map re-inserts the
-     *  entry, so the next entryFor resolves it again. If a successor entry
-     *  already took the key (a cross-root race through the microtask gap),
-     *  the stale entry simply runs unshared for its lifetime — benign. */
     _reviveIfSwept(entry) {
         if (!this.entries.has(entry.key)) {
             this.entries.set(entry.key, entry);
@@ -356,8 +287,6 @@ export class AssistantSessionRegistry {
         if (entry.registrations.size > 0) {
             return;
         }
-        // Guard against deleting a successor entry that took the key between
-        // this entry emptying and the microtask running.
         if (this.entries.get(entry.key) === entry) {
             this.entries.delete(entry.key);
         }
@@ -365,34 +294,30 @@ export class AssistantSessionRegistry {
         entry.session.dispose();
     }
 }
-/** The one instance every provider resolves through — the module scope
- *  shared by all React roots on the page is the whole mechanism. */
 export const assistantSessionRegistry = new AssistantSessionRegistry();
-// The bound on waiting for a provider's retain effect: React runs it in
-// the same commit, so this covers only the render that never commits,
-// where waiting forever would hang the request rather than answer it.
 const FIRST_RETAIN_WAIT_MS = 2_000;
+function _withNamedUser(spec) {
+    return { ...spec, userId: namedUserIdOf(spec.userId) };
+}
 function _identityKeyOf(spec) {
+    const userId = spec.userId;
     return [
         spec.publishableKey,
         _withoutTrailingSlash(spec.baseUrl ?? DEFAULT_BASE_URL),
-        spec.identityProvided ? "identified" : "anonymous",
+        userId === undefined ? "anonymous" : "identified",
+        userId ?? "",
     ].join("\u0000");
 }
-// The contract's loud-by-design mint failures: a broken key, origin
-// allowlist, or end-user signer needs the developer, not a retry.
 function _isSetupFailure(error) {
     return (error.code === "PUBLISHABLE_KEY_INVALID" ||
         error.code === "ORIGIN_NOT_ALLOWED" ||
-        error.code === "END_USER_TOKEN_INVALID");
+        error.code === "END_USER_TOKEN_INVALID" ||
+        error.code === END_USER_ID_MISMATCH);
 }
-// The mint 201'd with the claim on board: the stored thread is this
-// identity's now (or the claim silently lost and reads will say so) —
-// either way it must not be offered again.
-function _markStoredThreadIdentified(publishableKey) {
+function _markStoredThreadIdentified(publishableKey, userId) {
     const stored = readStoredThread(publishableKey);
     if (stored !== null && !stored.identified) {
-        writeStoredThread(publishableKey, { ...stored, identified: true });
+        writeStoredThread(publishableKey, { ...stored, identified: true, userId });
     }
 }
 function _withoutTrailingSlash(baseUrl) {
@@ -401,4 +326,3 @@ function _withoutTrailingSlash(baseUrl) {
 function _asError(thrown) {
     return thrown instanceof Error ? thrown : new Error(String(thrown));
 }
-//# sourceMappingURL=assistant-session-registry.js.map

package/dist/core/attachment-uploads.js

@@ -1,12 +1,4 @@
-// One attached file's server-side life, driven from the composer: the
-// three-step upload (declare, PUT, finalize) and the on-demand display
-// URL mint with its TTL cache. The _downloadUrls cache stays a store
-// field per the friend convention.
 import { createAttachmentUpload, finalizeAttachment, getAttachmentDownloadUrl, putFileToUploadUrl, } from "../transport/serving-api.js";
-/** The three-step upload as one call: declare, PUT the bytes straight
- *  to storage, finalize (the server sniffs what the file actually is).
- *  Resolves with the settled attachment; throws with a user sentence
- *  when any step refuses — the chip renders it. */
 export async function uploadAttachmentFromStore(store, file) {
     const intent = await createAttachmentUpload(store.deps.session, {
         filename: file.name !== "" ? file.name : "attachment",
@@ -15,10 +7,6 @@ export async function uploadAttachmentFromStore(store, file) {
     await putFileToUploadUrl(intent.upload_url, file);
     return finalizeAttachment(store.deps.session, intent.attachment.id);
 }
-/** Exchange a stable attachment id for a display URL, minted on demand
- *  and reused only while comfortably inside its short TTL. The expiry
- *  rides along so a long-lived renderer knows when to come back for a
- *  fresh one — a widget stays open far longer than a URL lives. */
 export async function mintAttachmentDownloadUrlFromStore(store, attachmentId) {
     const cached = store._downloadUrls.get(attachmentId);
     if (cached !== undefined && cached.expiresAtMs > Date.now()) {
@@ -27,11 +15,8 @@ export async function mintAttachmentDownloadUrlFromStore(store, attachmentId) {
     const fresh = await getAttachmentDownloadUrl(store.deps.session, attachmentId);
     const minted = {
         url: fresh.url,
-        // A 30-second safety margin: a URL about to expire must not be
-        // handed to an <img> that fetches it a beat later.
         expiresAtMs: Date.now() + (fresh.expires_in_seconds - 30) * 1000,
     };
     store._downloadUrls.set(attachmentId, minted);
     return minted;
 }
-//# sourceMappingURL=attachment-uploads.js.map

package/dist/core/block-timing-anchors.js

@@ -1,28 +1,4 @@
-// The block-timing anchor model, pure of React: the recorder reads the
-// per-event server timestamp off every raw event that names a
-// block (a messageId or a toolCallId), folds it into that block's
-// earliest-start/latest-settle pair, and the resume store holds the map
-// across remounts. The indirection exists because the client carries no
-// per-event timestamp onto the messages it builds — this map is the
-// timing's only home on the client, and a snapshot-seeded reconnect
-// replays only past the cursor, so historical blocks keep their timing
-// from here alone. Absent timestamps
-// (old histories, synthesized frames) record nothing: to every consumer,
-// absence means unknown, never zero.
 import { EventType } from "@ag-ui/core";
-/**
- * One observed instant folded into a block's pair, IN PLACE: the
- * earliest observed value is the start, the latest the settle. True when
- * the map moved — the caller's change signal. Deliberately NOT the
- * neighbouring anchors' copy-on-write idiom: timing is the one
- * high-frequency map (every block boundary moves it), and an immutable
- * copy per fold is O(N) per write — O(N²) over an N-block replay — so
- * this map mutates and the resume store's REVISION counter replaces
- * identity as the change signal. ENTRIES stay immutable (a fold sets a
- * fresh pair object, never mutates one), so a snapshot that copied the
- * map never sees its held pairs change; re-applying a replayed sequence
- * changes nothing (min/max are idempotent) and answers false.
- */
 export function foldBlockTimingObserved(timings, blockId, observedAtMs) {
     const existing = timings.get(blockId);
     if (existing === undefined) {
@@ -45,12 +21,6 @@ export function foldBlockTimingObserved(timings, blockId, observedAtMs) {
     timings.set(blockId, { startedAtMs, settledAtMs });
     return true;
 }
-/**
- * A defensive copy for seeding transcript state from the resume store:
- * entries that are not a well-formed pair are dropped rather than
- * rendered (or crashed on) — a dropped pair degrades that block's
- * duration to unknown until the next full replay, never a crash.
- */
 export function wellFormedBlockTimingAnchorsOf(stored) {
     const seeded = new Map();
     const entries = stored;
@@ -62,12 +32,6 @@ export function wellFormedBlockTimingAnchorsOf(stored) {
     }
     return seeded;
 }
-// Only block BOUNDARIES contribute: a delta's timestamp can only land
-// between its block's start and end, so recording it would tighten
-// nothing while republishing the anchors snapshot on every batch. Built
-// from the shipped EventType enum, never raw strings, so a typo or an
-// upstream rename fails the build instead of silently degrading a
-// block's duration to unknown.
 const BLOCK_BOUNDARY_EVENT_TYPES = new Set([
     EventType.TEXT_MESSAGE_START,
     EventType.TEXT_MESSAGE_END,
@@ -79,12 +43,6 @@ const BLOCK_BOUNDARY_EVENT_TYPES = new Set([
     EventType.TOOL_CALL_END,
     EventType.TOOL_CALL_RESULT,
 ]);
-/**
- * Records each timestamped block-boundary event against the block it
- * names. The block id is the durable join — the event's own messageId
- * or toolCallId — never adjacency; an event naming no block (lifecycle
- * frames, thread markers) contributes nothing here.
- */
 export function blockTimingRecorder(onTimingObserved) {
     return {
         onEvent({ event }) {
@@ -112,9 +70,6 @@ function _timestampOf(event) {
     }
     return timestamp;
 }
-/** The durable block id an event names: its toolCallId when it is a
- *  tool-family event, else its messageId (text and reasoning families).
- *  Narrowed from unknown — the wire is distrusted by contract. */
 function _blockIdOf(event) {
     if (typeof event !== "object" || event === null) {
         return undefined;
@@ -136,4 +91,3 @@ function _isWellFormedTiming(timing) {
     const halfIsWellTyped = (half) => half === null || (typeof half === "number" && Number.isFinite(half));
     return halfIsWellTyped(startedAtMs) && halfIsWellTyped(settledAtMs);
 }
-//# sourceMappingURL=block-timing-anchors.js.map