@theoremjs/agents 0.3.4-next.482.g7e608f2 → 0.3.4-next.508.geda6db0

package/esm/src/guardrails/labels.d.ts

@@ -1,7 +1,7 @@
 /** Values that fill a label template's `{param}` placeholders. */
 export type LabelParams = Record<string, string | number>;
 /** Keys are stable API. */
-export declare const LABEL_KEYS: readonly ["provider.decision_failed", "provider.decision_unavailable", "provider.decision_model_missing", "provider.decision_ended", "provider.decision_images_off", "provider.decision_box_model", "provider.budget_exhausted", "provider.adapter_version", "provider.adapter_methods", "provider.adapter_schemas", "provider.fallback_slot", "provider.model_fallback_slot", "provider.host_model", "provider.turn_profile", "provider.model_binding_missing", "provider.session_closed", "provider.settled_call", "provider.session_unavailable", "provider.live_input", "provider.tool_cancel_missing", "provider.kernel_gate", "provider.event_invalid", "provider.response_identity", "provider.credential_resolution", "provider.credential_shape", "provider.stored_continuation", "provider.continuation_mismatch", "provider.continuation_contract", "provider.stateless_history", "provider.events_after_completion", "provider.duplicate_call", "provider.tool_cancel_live", "provider.complete_unavailable", "provider.parallel_tools", "provider.binding_identity", "provider.profile_type", "provider.event_type", "provider.feature", "provider.input_kind", "provider.output_kind", "provider.builtin", "provider.credential_missing", "provider.profile_configuration", "continue.instruction", "canary.bind_note", "user_data.note", "context.note", "taint.blocked", "taint.reason_steered", "taint.reason_tainted", "taint.destination_blocked", "taint.destination_confirm", "advisory.notice_elevated", "advisory.notice_high", "advisory.guidance", "attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "input.too_long", "attachments.limits_unconfigured", "quota.exhausted", "quota.busy", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "repair.default_guidance", "repair.items_guidance", "repair.prompt_header", "repair.prompt_intro", "repair.prompt_instructions", "repair.history_heading", "repair.section_previous_output", "repair.section_validator_rejection", "repair.section_repair_guidance", "repair.section_instructions", "compaction.request", "compaction.tool_call", "compaction.tool_result", "decision.box_image", "detect.blocked", "detect.call_blocked", "detect.output_blocked", "detect.shown_blocked", "detect.hint.ids", "detect.hint.financial", "detect.hint.network", "detect.hint.credentials", "detect.hint.injection", "detect.hint.tool_instructions", "detect.hint.canary_leak", "detect.hint.prompt_leak", "detect.hint.marker_leak", "detect.hint.ungiven_images", "detect.hint.ungiven_links", "detect.hint.tool_leak", "detect.hint.own", "egress.default_repair_guidance", "egress.refusal", "egress.refusal_cut", "egress.rejection", "egress.rejection_found", "egress.hint_unscannable", "egress.hint_provider_tool_leak", "thought.omitted_image", "thought.omitted_link", "thought.omitted_instructions", "session.abandon_gated", "session.tool_denied", "session.tool_aborted", "session.sign_in", "sign_in.link", "sign_in.pending", "sign_in.done", "sign_in.declined", "sign_in.expired", "sign_in.out_of_scope", "session.gate_expired", "session.provider_state_unowned", "session.conversation_unknown", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort", "tool.awaiting_user", "tool.completed_hidden", "tool.t2_loader_needs_snapshot", "tool.t2_loader_shape", "tool.t2_loader_output_invalid", "tool.execution_uncertain", "tool.input_invalid", "tool.input_invalid_after_mutate", "tool.output_invalid_after_mutate", "tool.handler_no_output", "tool.did_not_run", "tool.page_no_answer", "tool.page_timed_out", "tool.output_invalid", "tool.not_loaded_t2", "tool.wait_unknown", "tool.wait_cycle", "tool.not_visible", "tool.builtin_not_enabled", "tool.provider_native", "tool.not_registered", "tool.builtin_needs_snapshot", "tool.not_allowed", "tool.not_eligible", "tool.unsupported_type", "tool.agent_call_limit", "tool.agent_failed", "tool.activity_failed", "protocol.not_served", "protocol.profile_type", "protocol.options", "protocol.option_clash", "protocol.base_options", "protocol.id_clash", "protocol.ws_headers", "protocol.builtin_unwritten", "protocol.provider_missing", "protocol.connection", "protocol.part_schema", "protocol.part_invalid", "protocol.key_invalid", "protocol.no_key", "protocol.reply_shape", "protocol.endpoint_url", "protocol.endpoint_host", "protocol.http", "protocol.no_operation", "protocol.definition", "protocol.provider_id_clash", "protocol.history_needed"];
+export declare const LABEL_KEYS: readonly ["provider.decision_failed", "provider.decision_unavailable", "provider.decision_model_missing", "provider.decision_ended", "provider.decision_images_off", "provider.decision_box_model", "provider.budget_exhausted", "provider.adapter_version", "provider.adapter_methods", "provider.adapter_schemas", "provider.fallback_slot", "provider.model_fallback_slot", "provider.host_model", "provider.turn_profile", "provider.model_binding_missing", "provider.session_closed", "provider.settled_call", "provider.session_unavailable", "provider.live_input", "provider.tool_cancel_missing", "provider.kernel_gate", "provider.event_invalid", "provider.response_identity", "provider.credential_resolution", "provider.credential_shape", "provider.stored_continuation", "provider.continuation_mismatch", "provider.continuation_contract", "provider.stateless_history", "provider.events_after_completion", "provider.duplicate_call", "provider.tool_cancel_live", "provider.complete_unavailable", "provider.parallel_tools", "provider.binding_identity", "provider.profile_type", "provider.event_type", "provider.feature", "provider.input_kind", "provider.output_kind", "provider.builtin", "provider.credential_missing", "provider.profile_configuration", "continue.instruction", "canary.bind_note", "user_data.note", "context.note", "taint.blocked", "taint.reason_steered", "taint.reason_tainted", "taint.destination_blocked", "taint.destination_confirm", "advisory.notice_elevated", "advisory.notice_high", "advisory.guidance", "attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "quota.exhausted", "quota.busy", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "repair.default_guidance", "repair.items_guidance", "repair.prompt_header", "repair.prompt_intro", "repair.prompt_instructions", "repair.history_heading", "repair.section_previous_output", "repair.section_validator_rejection", "repair.section_repair_guidance", "repair.section_instructions", "structured.answer_tool", "structured.answer_missing", "compaction.request", "compaction.tool_call", "compaction.tool_result", "decision.box_image", "detect.blocked", "detect.call_blocked", "detect.output_blocked", "detect.shown_blocked", "detect.hint.ids", "detect.hint.financial", "detect.hint.network", "detect.hint.credentials", "detect.hint.injection", "detect.hint.tool_instructions", "detect.hint.canary_leak", "detect.hint.prompt_leak", "detect.hint.marker_leak", "detect.hint.ungiven_images", "detect.hint.ungiven_links", "detect.hint.tool_leak", "detect.hint.own", "egress.default_repair_guidance", "egress.refusal", "egress.refusal_cut", "egress.rejection", "egress.rejection_found", "egress.hint_unscannable", "egress.hint_provider_tool_leak", "thought.omitted_image", "thought.omitted_link", "thought.omitted_instructions", "session.abandon_gated", "session.tool_denied", "session.tool_aborted", "session.sign_in", "sign_in.link", "sign_in.pending", "sign_in.done", "sign_in.declined", "sign_in.expired", "sign_in.out_of_scope", "session.gate_expired", "session.provider_state_unowned", "session.conversation_unknown", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort", "tool.awaiting_user", "tool.completed_hidden", "tool.t2_loader_needs_snapshot", "tool.t2_loader_shape", "tool.t2_loader_output_invalid", "tool.execution_uncertain", "tool.input_invalid", "tool.input_invalid_after_mutate", "tool.output_invalid_after_mutate", "tool.handler_no_output", "tool.did_not_run", "tool.page_no_answer", "tool.page_timed_out", "tool.output_invalid", "tool.not_loaded_t2", "tool.wait_unknown", "tool.wait_cycle", "tool.not_visible", "tool.builtin_not_enabled", "tool.provider_native", "tool.not_registered", "tool.builtin_needs_snapshot", "tool.not_allowed", "tool.not_eligible", "tool.unsupported_type", "tool.agent_call_limit", "tool.agent_failed", "tool.activity_failed", "protocol.not_served", "protocol.profile_type", "protocol.options", "protocol.option_clash", "protocol.base_options", "protocol.id_clash", "protocol.ws_headers", "protocol.builtin_unwritten", "protocol.provider_missing", "protocol.connection", "protocol.part_schema", "protocol.part_invalid", "protocol.key_invalid", "protocol.no_key", "protocol.reply_shape", "protocol.endpoint_url", "protocol.endpoint_host", "protocol.http", "protocol.no_operation", "protocol.definition", "protocol.provider_id_clash", "protocol.history_needed"];
 /** One of {@linkcode LABEL_KEYS}. */
 export type LabelKey = (typeof LABEL_KEYS)[number];
 /**
@@ -10,7 +10,7 @@ export type LabelKey = (typeof LABEL_KEYS)[number];
  * puts into history. Only these overrides travel to the browser; the rest
  * (repair prompts, canary, taint, egress) stay on the host.
  */
-export declare const CLIENT_LABEL_KEYS: readonly ["attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "input.too_long", "attachments.limits_unconfigured", "detect.blocked", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "session.abandon_gated", "session.tool_denied", "session.sign_in", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "tool.awaiting_user", "tool.completed_hidden", "tool.execution_uncertain", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort"];
+export declare const CLIENT_LABEL_KEYS: readonly ["attachments.too_many_files", "attachments.too_many_of_kind", "attachments.file_too_large", "attachments.turn_too_large", "attachments.not_accepted", "attachments.mime_not_allowed", "attachments.limits_unconfigured", "detect.blocked", "error.config", "error.request", "error.input", "error.action", "error.auth", "error.rate_limit", "error.busy", "error.unsupported", "error.unavailable", "error.bad_response", "error.network", "error.timeout", "error.safety", "error.blocked", "error.declined", "error.failed", "error.cancelled", "error.internal", "session.abandon_gated", "session.tool_denied", "session.sign_in", "session.gate_expired", "session.turn_ended", "session.gate_pending", "session.part_skipped", "live.session_ended", "tool.awaiting_user", "tool.completed_hidden", "tool.execution_uncertain", "voice.unsupported", "voice.permission", "voice.unavailable", "voice.failed", "voice.empty", "stop.cancelled", "stop.interrupted", "stop.length", "stop.filtered", "stop.provider_error", "stop.stream_incomplete", "stop.step_limit", "composer.model", "composer.effort"];
 /** One of {@linkcode CLIENT_LABEL_KEYS}. */
 export type ClientLabelKey = (typeof CLIENT_LABEL_KEYS)[number];
 /** Host-supplied replacement templates, `{param}` placeholders included. */

package/esm/src/guardrails/labels.js

@@ -64,7 +64,6 @@ export const LABEL_KEYS = [
     'attachments.turn_too_large',
     'attachments.not_accepted',
     'attachments.mime_not_allowed',
-    'input.too_long',
     'attachments.limits_unconfigured',
     'quota.exhausted',
     'quota.busy',
@@ -96,6 +95,8 @@ export const LABEL_KEYS = [
     'repair.section_validator_rejection',
     'repair.section_repair_guidance',
     'repair.section_instructions',
+    'structured.answer_tool',
+    'structured.answer_missing',
     'compaction.request',
     'compaction.tool_call',
     'compaction.tool_result',
@@ -222,7 +223,6 @@ export const CLIENT_LABEL_KEYS = [
     'attachments.turn_too_large',
     'attachments.not_accepted',
     'attachments.mime_not_allowed',
-    'input.too_long',
     'attachments.limits_unconfigured',
     'detect.blocked',
     'error.config',
@@ -380,7 +380,6 @@ const DEFAULTS = {
             ? `Sorry, ${name} is a file type that can't be used here.`
             : "Sorry, that file type can't be used here.";
     },
-    'input.too_long': (params) => `Sorry, that message is too long. Please keep it under ${Number(params.maxChars).toLocaleString('en-US')} characters.`,
     'attachments.limits_unconfigured': "Sorry, files can't be used here at the moment.",
     'quota.exhausted': (params) => params.perDay === 1
         ? "You've reached today's limit of 1 message."
@@ -414,6 +413,8 @@ const DEFAULTS = {
     'repair.section_validator_rejection': '### VALIDATOR REJECTION',
     'repair.section_repair_guidance': '### REPAIR GUIDANCE',
     'repair.section_instructions': '### INSTRUCTIONS',
+    'structured.answer_tool': 'Call this once your work is done, with your final answer as its input. Text you write outside this call is shown as progress, not taken as the answer.',
+    'structured.answer_missing': 'The reply did not call {tool}. Call {tool} with your final answer.',
     'compaction.request': 'Summarize the conversation above, including any earlier summary in it. Call the participants the user and the assistant, and keep every name, number, fact, and decision either may need later. Reply with the summary only.',
     'compaction.tool_call': 'Called {tool} with {arguments}',
     'compaction.tool_result': '{tool} returned: {result}',
@@ -594,7 +595,6 @@ export const LABEL_NOTES = {
     'attachments.turn_too_large': "Shown to the user when a message's files together are larger than Turn bytes. Takes {maxTurnBytes}.",
     'attachments.not_accepted': "Shown to the user who sends files or a voice note to an agent that takes none. Takes {channel}: 'voice' or 'attachment'.",
     'attachments.mime_not_allowed': "Shown to the user when a file's type is not in the agent's accepted types. Takes {mimeType}, {channel} ('voice' or 'attachment'), and {fileName} when the file has one.",
-    'input.too_long': 'Shown to the user when one text a turn sends, such as the message or a text file, is longer than Theorem reads. Takes {maxChars}.',
     'attachments.limits_unconfigured': 'Shown to the user who sends a file to an agent whose file limits are not set.',
     'quota.exhausted': 'Shown to the user who has used up the daily message cap. Takes {perDay}.',
     'quota.busy': 'Shown to the user who sends a message while their last one is still being answered (`quotaBusy`).',
@@ -626,6 +626,8 @@ export const LABEL_NOTES = {
     'repair.section_validator_rejection': "The heading over the validator's or egress check's reason in the repair request.",
     'repair.section_repair_guidance': 'The heading over the repair guidance in the repair request.',
     'repair.section_instructions': 'The heading over the numbered steps in the repair request.',
+    'structured.answer_tool': "The description of the answer tool: on a structured turn that has tools, the model calls it with its final answer, and the tool's input is the structured output.",
+    'structured.answer_missing': 'The validator rejection in the repair request when a structured turn with tools ended without calling the answer tool. Takes {tool}.',
     'compaction.request': 'Sent to the compactor after the messages it compacts, asking for the summary.',
     'compaction.tool_call': 'How a tool call reads to the compactor. Takes {tool} and {arguments}, the call as JSON.',
     'compaction.tool_result': 'How a tool result reads to the compactor. Takes {tool} and {result}, the output as sent to the model.',
@@ -759,9 +761,9 @@ const LABEL_PLACEHOLDERS = {
     'attachments.turn_too_large': ['maxTurnBytes'],
     'attachments.not_accepted': ['channel'],
     'attachments.mime_not_allowed': ['mimeType', 'channel', 'fileName'],
-    'input.too_long': ['maxChars'],
     'quota.exhausted': ['perDay'],
     'repair.history_heading': ['count'],
+    'structured.answer_missing': TOOL,
     'compaction.tool_call': ['tool', 'arguments'],
     'compaction.tool_result': ['tool', 'result'],
     'decision.box_image': ['image'],

package/esm/src/guardrails/mod.d.ts

@@ -50,5 +50,5 @@ export type { Directive, DirectiveSignal } from './tool-directives.js';
 export { advisoryLevel, DIRECTIVE_SIGNALS, directives } from './tool-directives.js';
 export type { GuardedToolText, InspectedToolArguments } from './tool-result.js';
 export { checkTaintGate, composeToolText, guardToolFailureText, guardToolResult, inspectToolArguments, isRemoteOrigin, isSuspicious, isTainted, recordTaint, TOOL_CLOSE, toolCallEvent, wrapToolData, } from './tool-result.js';
-export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, DestinationGate, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, Provenance, QuotaGuardrailSpec, ResolvedBlockedReply, ResolvedGuardrailPolicy, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './types.js';
+export type { AdvisoryLevel, BlockedReplyOnBlock, BlockedReplySpec, DecisionDisclosureEnforcer, DecisionDisclosureVerdict, DecisionGuardrailsSpec, DestinationGate, GuardrailAction, GuardrailContext, GuardrailEvent, GuardrailHit, GuardrailStage, HostGuardrailsSpec, NetworkGuardrailSpec, OutboundPayload, ProfileGuardrailsSpec, Provenance, QuotaGuardrailSpec, ResolvedBlockedReply, ResolvedGuardrailPolicy, Severity, TaintGate, TaintGuardrailSpec, ToolOrigin, TrustLevel, TurnTaint, Verdict, } from './types.js';
 export { ADVISORY_LEVELS, BLOCKED_REPLY_ON_BLOCK, DESTINATION_GATES, GUARDRAIL_STAGES, SEVERITIES, TAINT_GATES, TOOL_ORIGINS, TRUST_LEVELS, } from './types.js';

package/esm/src/guardrails/normalize.js

@@ -134,8 +134,10 @@ function withoutMatches(view, pattern) {
     let last = 0;
     const keep = (to) => {
         kept.text += view.text.slice(last, to);
-        kept.start.push(...view.start.slice(last, to));
-        kept.end.push(...view.end.slice(last, to));
+        for (let at = last; at < to; at++) {
+            kept.start.push(view.start[at]);
+            kept.end.push(view.end[at]);
+        }
     };
     for (const match of view.text.matchAll(pattern)) {
         keep(match.index);

package/esm/src/guardrails/prompt-echo.js

@@ -61,8 +61,10 @@ function promptReadings(stretches, canary) {
     const readings = { plain: [], slotted: [] };
     for (const view of PROMPT_VIEWS) {
         const read = viewReadings(stretches.map(view), canary === undefined ? undefined : view(canary));
-        readings.plain.push(...read.plain);
-        readings.slotted.push(...read.slotted);
+        for (const each of read.plain)
+            readings.plain.push(each);
+        for (const each of read.slotted)
+            readings.slotted.push(each);
     }
     return readings;
 }

package/esm/src/guardrails/sensitive.d.ts

@@ -4,8 +4,8 @@ declare const CARD_CANDIDATE: RegExp;
 interface SensitivePattern {
     group: SensitiveGroup;
     pattern: RegExp;
-    /** Whether a match at `at` of `text` counts. */
-    hit?: (match: string, text: string, at: number) => boolean;
+    /** Whether a match at `at` of `text` counts; `lower` is `text` in lower case. */
+    hit?: (match: string, text: string, at: number, lower?: () => string) => boolean;
 }
 /** Every pattern, with its group. */
 declare const SENSITIVE_PATTERNS: readonly SensitivePattern[];

package/esm/src/guardrails/sensitive.js

@@ -81,7 +81,7 @@ const SENSITIVE_PATTERNS = [
     ...CREDENTIALS.map((rule) => ({
         group: 'credentials',
         pattern: new RegExp(rule.pattern.source, `${rule.pattern.flags}g`),
-        hit: (match, text, at) => credentialHit(rule, GLOBAL_ALLOWLIST, match, text, at),
+        hit: (match, text, at, lower) => credentialHit(rule, GLOBAL_ALLOWLIST, match, text, at, lower?.()),
     })),
 ];
 const ALL_GROUPS = {

package/esm/src/interface/profile-interface.js

@@ -29,6 +29,19 @@ const modelBinding = z.object({
         meter: z.enum(COMPACTION_METERS).optional(),
     })
         .optional(),
+    limits: z
+        .object({
+        operationTimeoutMs: z.number().optional(),
+        connectTimeoutMs: z.number().optional(),
+        liveStepTimeoutMs: z.number().optional(),
+        maxWireRecordBytes: z.number().optional(),
+        maxWireResponseBytes: z.number().optional(),
+        maxEventBytes: z.number().optional(),
+        maxStepBytes: z.number().optional(),
+        maxStepEvents: z.number().optional(),
+        maxPendingToolCalls: z.number().optional(),
+    })
+        .optional(),
 });
 const outputs = z.object({
     structured: z

package/esm/src/kernel/answer-tool.d.ts

@@ -0,0 +1,14 @@
+import { type LabelOverrides } from '../guardrails/labels.js';
+import type { ModelRequest, ResolvedGeneration } from './types.js';
+/** The tool a structured turn with tools answers through. */
+export declare const ANSWER_TOOL = "final_answer";
+/**
+ * True when the turn's structured output comes from the answer tool, not from a response format.
+ *
+ * why: Many endpoints refuse a response format beside tools, and many models given both answer in
+ * JSON at once without calling a tool. Read it off the turn's generation, not one step's: the
+ * step that must answer has its tools taken away, and still answers through this tool.
+ */
+export declare function answersByTool(generation: Pick<ResolvedGeneration, 'structured' | 'tools'>): boolean;
+/** The request with the answer tool in place of the response format, when the turn answers by tool. */
+export declare function withAnswerTool(request: ModelRequest, generation: Pick<ResolvedGeneration, 'structured' | 'tools'>, labels: LabelOverrides | undefined): ModelRequest;

package/esm/src/kernel/answer-tool.js

@@ -0,0 +1,26 @@
+import { labelText } from '../guardrails/labels.js';
+/** The tool a structured turn with tools answers through. */
+export const ANSWER_TOOL = 'final_answer';
+/**
+ * True when the turn's structured output comes from the answer tool, not from a response format.
+ *
+ * why: Many endpoints refuse a response format beside tools, and many models given both answer in
+ * JSON at once without calling a tool. Read it off the turn's generation, not one step's: the
+ * step that must answer has its tools taken away, and still answers through this tool.
+ */
+export function answersByTool(generation) {
+    return generation.structured !== null && generation.tools.wire.length > 0;
+}
+/** The request with the answer tool in place of the response format, when the turn answers by tool. */
+export function withAnswerTool(request, generation, labels) {
+    const { structured } = generation;
+    if (!structured || !answersByTool(generation))
+        return request;
+    const tool = {
+        type: 'function',
+        name: ANSWER_TOOL,
+        description: labelText('structured.answer_tool', {}, labels),
+        parameters: structured.jsonSchema,
+    };
+    return { ...request, structured: null, wireTools: [...(request.wireTools ?? []), tool] };
+}

package/esm/src/kernel/engine/decision-references.d.ts

@@ -0,0 +1,14 @@
+import type { DecisionAsset } from '../types.js';
+/** A run of text, or the image a reference in it stands for. */
+export type ReferencePiece = string | {
+    reference: string;
+    asset: DecisionAsset;
+};
+/**
+ * A string split at the image references in it, as TypeSafe reads them: a string that is exactly a
+ * reference is that image; otherwise references match as plain text, left to right, never
+ * overlapping, the longest where two start together. A string with no reference comes back whole.
+ */
+export declare function splitReferences(text: string, assets: Record<string, DecisionAsset>): ReferencePiece[];
+/** The images the strings of `values` reference, in the order of `assets`. */
+export declare function referencedAssets(values: readonly unknown[], assets: Record<string, DecisionAsset>): Record<string, DecisionAsset>;

package/esm/src/kernel/engine/decision-references.js

@@ -0,0 +1,55 @@
+/**
+ * A string split at the image references in it, as TypeSafe reads them: a string that is exactly a
+ * reference is that image; otherwise references match as plain text, left to right, never
+ * overlapping, the longest where two start together. A string with no reference comes back whole.
+ */
+export function splitReferences(text, assets) {
+    if (Object.hasOwn(assets, text))
+        return [{ reference: text, asset: assets[text] }];
+    const references = Object.keys(assets);
+    const pieces = [];
+    let from = 0;
+    while (from < text.length) {
+        let at = -1;
+        let found = '';
+        for (const reference of references) {
+            const index = text.indexOf(reference, from);
+            if (index < 0)
+                continue;
+            if (at < 0 || index < at || (index === at && reference.length > found.length)) {
+                at = index;
+                found = reference;
+            }
+        }
+        if (at < 0)
+            break;
+        if (at > from)
+            pieces.push(text.slice(from, at));
+        pieces.push({ reference: found, asset: assets[found] });
+        from = at + found.length;
+    }
+    if (from < text.length)
+        pieces.push(text.slice(from));
+    return pieces;
+}
+/** Every string value in a JSON value, keys left out: the only places a reference is read. */
+function* stringValues(value) {
+    if (typeof value === 'string')
+        yield value;
+    else if (Array.isArray(value))
+        for (const item of value)
+            yield* stringValues(item);
+    else if (value !== null && typeof value === 'object')
+        for (const item of Object.values(value))
+            yield* stringValues(item);
+}
+/** The images the strings of `values` reference, in the order of `assets`. */
+export function referencedAssets(values, assets) {
+    const used = new Set();
+    for (const value of values)
+        for (const text of stringValues(value))
+            for (const piece of splitReferences(text, assets))
+                if (typeof piece !== 'string')
+                    used.add(piece.reference);
+    return Object.fromEntries(Object.entries(assets).filter(([reference]) => used.has(reference)));
+}

package/esm/src/kernel/engine/decision.d.ts

@@ -3,7 +3,7 @@ import type { TraceSink } from '../../observability/trace-sink.js';
 import type { ProviderHostOptions } from '../protocols/runtime.js';
 import type { KernelRegistry } from '../registry/kernel-registry.js';
 import type { DecisionProfile, DecisionRequest, DecisionResult } from '../types.js';
-/** Where the provider takes decision requests, as its preset states. */
+/** Each decision failure code, and the error kind it reads as. */
 declare const DECISION_ERROR_KINDS: {
     readonly invalid_request: "request";
     readonly authentication: "auth";
@@ -36,8 +36,8 @@ export declare function validateDecisionRequest(request: Omit<DecisionRequest, '
     questions: unknown;
 }, profile: DecisionProfile): asserts request is DecisionRequest;
 /**
- * Exactly one decision request, traced however it ends. An ambiguous POST is never retried,
- * and a trace write failure never changes the decision's outcome.
+ * One decision, traced however it ends. A transient failure (408, 429, a 5xx gateway or a network
+ * error) is retried within five seconds; a trace write failure never changes the decision's outcome.
  */
 export declare function runDecisionInRegistry(registry: KernelRegistry, request: DecisionRequest, options: RunDecisionOptions): Promise<DecisionResult>;
 export {};

package/esm/src/kernel/engine/decision.js

@@ -5,7 +5,8 @@ import { guardedCall } from '../provider-runtime.js';
 import { soleModelId } from '../registry/sole-model.js';
 import { isRecord } from '../util/record.js';
 import { tracedCall } from './call-trace.js';
-/** Where the provider takes decision requests, as its preset states. */
+import { referencedAssets } from './decision-references.js';
+/** Each decision failure code, and the error kind it reads as. */
 const DECISION_ERROR_KINDS = {
     invalid_request: 'request',
     authentication: 'auth',
@@ -65,7 +66,8 @@ function distribution(value, labels, path) {
     for (const label of labels)
         out[label] = finite(value[label], `${path}.${label}`);
     const total = Object.values(out).reduce((sum, item) => sum + item, 0);
-    if (Math.abs(total - 1) > 0.001) {
+    // why: Answers come rounded to hundredths, so each label may be off by half of one.
+    if (Math.abs(total - 1) > 0.005 * labels.length + 1e-9) {
         throw new DecisionError('malformed_response', `${path} must sum to one`); // labels-exempt: upstream contract error
     }
     return out;
@@ -310,19 +312,19 @@ function isDecisionEntry(value) {
     }
     return true;
 }
-async function enforceDisclosure(profile, model, provider, request) {
+async function enforceDisclosure(profile, model, provider, request, assets) {
     const verdict = await profile.guardrails?.disclosure?.enforce(request.state, {
         destination: provider,
         profileId: profile.id,
         model,
         questionIds: Object.keys(request.questions),
-        ...(request.assets ? { assets: request.assets } : {}),
+        ...(assets ? { assets } : {}),
     });
     if (verdict?.action === 'block') {
         throw new DecisionError('disclosure_blocked', 'Decision disclosure was blocked'); // labels-exempt: developer contract error
     }
 }
-function decisionSpanAttributes(profile, modelId, binding, request) {
+function decisionSpanAttributes(profile, modelId, binding, request, assets) {
     return {
         'gen_ai.operation.name': 'decide',
         'gen_ai.provider.name': binding.provider,
@@ -332,10 +334,10 @@ function decisionSpanAttributes(profile, modelId, binding, request) {
         'theorem.decision.contract': profile.decision.contract,
         'theorem.decision.state': traceJson(request.state),
         'theorem.decision.questions': traceJson(request.questions),
-        ...(request.assets
+        ...(assets
             ? {
                 // invariant: Image bytes never reach a trace; it keeps each image's type and size.
-                'theorem.decision.assets': traceJson(Object.fromEntries(Object.entries(request.assets).map(([reference, { mimeType, data }]) => [
+                'theorem.decision.assets': traceJson(Object.fromEntries(Object.entries(assets).map(([reference, { mimeType, data }]) => [
                     reference,
                     { mimeType, bytes: data.length },
                 ]))),
@@ -384,25 +386,38 @@ function decisionProviderError(error) {
     // why: A framework failure's message holds no response body, and says what stopped the decision.
     error instanceof TheoremError ? error.message : labelText('provider.decision_failed'), isRecord(error) && typeof error.status === 'number' ? error.status : undefined, { cause: error });
 }
-async function decide(registry, profile, [modelId, binding], request, options) {
+/** What the provider gets: each box's image said in its instructions, and only the images a string references. */
+function sentCall(request) {
+    const questions = Object.fromEntries(Object.entries(request.questions).map(([id, question]) => [
+        id,
+        providerQuestion(question, request.assets),
+    ]));
+    const assets = request.assets
+        ? referencedAssets([
+            request.state,
+            ...Object.values(questions).flatMap((question) => [
+                question.instructions,
+                'criteria' in question ? question.criteria : undefined,
+            ]),
+        ], request.assets)
+        : {};
+    return {
+        state: request.state,
+        questions,
+        ...(Object.keys(assets).length ? { assets } : {}),
+    };
+}
+async function decide(registry, profile, [modelId, binding], request, sent, options) {
     throwIfAborted(request.signal);
     const provider = registry.providers.require(binding.provider, binding.apiId);
-    await enforceDisclosure(profile, modelId, binding.provider, request);
+    await enforceDisclosure(profile, modelId, binding.provider, request, sent.assets);
     throwIfAborted(request.signal);
     try {
         const call = guardedCall(provider, binding, 'decision', options, {
             ...(request.signal ? { signal: request.signal } : {}),
             ...(binding.timeoutMs ? { timeoutMs: binding.timeoutMs } : {}),
         });
-        const result = await call.decide({
-            apiId: binding.apiId,
-            state: request.state,
-            questions: Object.fromEntries(Object.entries(request.questions).map(([id, question]) => [
-                id,
-                providerQuestion(question, request.assets),
-            ])),
-            ...(request.assets ? { assets: request.assets } : {}),
-        });
+        const result = await call.decide({ apiId: binding.apiId, ...sent });
         if (typeof result.model !== 'string' || !result.model.trim())
             throw new DecisionError('malformed_response', labelText('provider.decision_model_missing'));
         return { ...result, answers: validateAnswers(result.answers, request.questions) };
@@ -414,17 +429,18 @@ async function decide(registry, profile, [modelId, binding], request, options) {
     }
 }
 /**
- * Exactly one decision request, traced however it ends. An ambiguous POST is never retried,
- * and a trace write failure never changes the decision's outcome.
+ * One decision, traced however it ends. A transient failure (408, 429, a 5xx gateway or a network
+ * error) is retried within five seconds; a trace write failure never changes the decision's outcome.
  */
 export async function runDecisionInRegistry(registry, request, options) {
     const profile = requireDecisionProfile(registry, request.profile);
     validateDecisionRequest(request, profile);
     const model = decisionModel(profile);
     const [modelId, binding] = model;
+    const sent = sentCall(request);
     return await tracedCall({
         name: `decide ${binding.apiId}`,
-        attributes: decisionSpanAttributes(profile, modelId, binding, request),
+        attributes: decisionSpanAttributes(profile, modelId, binding, request, sent.assets),
         traceparent: request.traceparent,
         metadata: request.metadata,
         writer: {
@@ -433,7 +449,7 @@ export async function runDecisionInRegistry(registry, request, options) {
             guardrails: profile.guardrails,
         },
     }, async (root) => {
-        const result = await decide(registry, profile, model, request, options);
+        const result = await decide(registry, profile, model, request, sent, options);
         recordResult(root, result);
         return result;
     });

package/esm/src/kernel/engine/embedding.js

@@ -1,4 +1,3 @@
-import { refuseOverlong } from '../../guardrails/detect-at.js';
 import { TheoremError, throwIfAborted } from '../../guardrails/error.js';
 import { protocolOf } from '../protocols/binding.js';
 import { guardedCall } from '../provider-runtime.js';
@@ -47,7 +46,6 @@ function validateInputs(profile, modelId, inputs, model) {
         const files = [];
         for (const part of parts) {
             if (part.type === 'text') {
-                refuseOverlong(part.text, 'embedding input');
                 if (!rules.text)
                     throw new TheoremError('unsupported', `Profile ${profile.id} does not accept text embedding input`);
                 continue;

package/esm/src/kernel/engine/runner/gates.js

@@ -8,6 +8,7 @@ import { labelText } from '../../../guardrails/labels.js';
 import { resolveGuardrailPolicy } from '../../../guardrails/policy.js';
 import { replyIsJudged } from '../../../guardrails/progressive-yield.js';
 import { sanitizeTurnRequest } from '../../../guardrails/sanitize.js';
+import { ANSWER_TOOL, answersByTool } from '../../answer-tool.js';
 import { resolveInputParts } from '../../registry/ingress.js';
 import { profileTurnOutputs } from '../../registry/profile-outputs.js';
 import { injectWouldExceedMaxSteps } from '../../stages.js';
@@ -15,7 +16,7 @@ import { findLast } from '../../util/find-last.js';
 import { guardrailCheckAttributes } from '../turn-trace.js';
 import { collectItemFailures, collectValidationFailures, formatValidationFailures, itemSchemaAt, valueAt, withListAt, } from './schema-validation.js';
 import { applyTurnStage } from './stages.js';
-import { appendUserInput, } from './state.js';
+import { appendUserInput, recordStepEvent, } from './state.js';
 import { executeAttempt } from './steps.js';
 import { isWithheldOnBlock, shownToHost } from './stream.js';
 /** A turn whose final output the egress check blocked (withheld or replaced by policy copy). */
@@ -386,6 +387,31 @@ async function handleValidationGate(validation, flow, state, profile, latestStru
     holdReply(state, withoutItems(reply, refused), refused, outcome.failed);
     return 'pass';
 }
+/**
+ * An attempt on a turn that answers by tool, ended without calling the answer tool: a repair while
+ * `outputs.validation` has a retry left, else a `bad_response` failure.
+ */
+function* handleMissingAnswer(flow, state, profile, latestStructured, 
+/** True when the attempt's events go out at its end (`yieldBufferedAttemptEvents`). */
+held) {
+    if (latestStructured !== undefined || state.lastStop?.kind !== 'completed')
+        return 'pass';
+    if (!answersByTool(flow.currentGen))
+        return 'pass';
+    const validation = profileTurnOutputs(profile)?.validation;
+    if (validation && flow.currentAttempt < (validation.maxRetries ?? 0)) {
+        const rejection = labelText('structured.answer_missing', { tool: ANSWER_TOOL }, profile.labels);
+        const nextRequest = buildRepairRequest(flow.currentReq, collectAttemptText(state.attemptEvents), rejection);
+        yield updateFlowForRetry(flow, state, profile, nextRequest, 'validation');
+        return 'continue';
+    }
+    const failure = toErrorEvent(new TheoremError('bad_response', `the model ended without calling ${ANSWER_TOOL}`));
+    recordStepEvent(failure, state);
+    state.lastStop = { kind: 'provider_error' };
+    if (!held)
+        yield failure;
+    return 'pass';
+}
 /** Puts on the attempt's structured output the fields that still failed. */
 function markFailed(state, failed) {
     const held = findLast(state.attemptEvents, (event) => event.type === 'structured');
@@ -403,9 +429,6 @@ function gateStatusToAction(status) {
 }
 async function* executeSingleAttemptCycle(args) {
     const { flow, state, profile, system, provider } = args;
-    const validation = profileTurnOutputs(profile)?.validation;
-    const policy = resolveGuardrailPolicy(profile.guardrails);
-    const judged = replyIsJudged(policy, TURN_REPLY);
     // invariant: Fresh maxSteps budget per validation/egress attempt. before_end inject
     // re-entry inside this cycle still accumulates stepCount (do not reset there).
     state.stepCount = 0;
@@ -465,6 +488,14 @@ async function* executeSingleAttemptCycle(args) {
         }
         break;
     }
+    return yield* checkAttemptReply(flow, state, profile, system, latestStructured);
+}
+/** The checks on an attempt's finished reply: the egress judge, the answer, then validation. */
+async function* checkAttemptReply(flow, state, profile, system, structured) {
+    const validation = profileTurnOutputs(profile)?.validation;
+    const policy = resolveGuardrailPolicy(profile.guardrails);
+    const judged = replyIsJudged(policy, TURN_REPLY);
+    let latestStructured = structured;
     if (judged) {
         const status = yield* handleEgressGate(policy, flow, state, profile, system.private);
         const action = gateStatusToAction(status);
@@ -473,6 +504,9 @@ async function* executeSingleAttemptCycle(args) {
         }
         latestStructured = projectOutbound(state.attemptEvents).structured ?? latestStructured;
     }
+    if ((yield* handleMissingAnswer(flow, state, profile, latestStructured, Boolean(validation) || judged)) === 'continue') {
+        return { status: 'continue' };
+    }
     if (validation) {
         const status = await handleValidationGate(validation, flow, state, profile, latestStructured);
         if (status !== 'pass') {