@unoverse-platform/studio 0.1.116 → 0.1.117

package/vendor/base/src/manifests/executor/memory.ts

@@ -140,3 +140,30 @@ export function sessionTurnRecorder(
     flush: save,
   };
 }
+
+/**
+ * THE TASK THE APP'S ADDRESS NAMES, in the call before it starts (docs/mcp/MCP_TASKS.md § 5c).
+ * A task found in Spatial lands in the conversation as the search's result, so the model knows
+ * it; a task opened by an address has no search, so what it holds is replayed instead, read by
+ * its id with the official client (`tasks/get`), the same way the memory block above is. Only an
+ * id: a URI (`<org>/<name>`, which a task's own run also carries) is not an opened task.
+ */
+export async function hydrateOpenedTask(config: any, executionContext: any): Promise<any> {
+  const id = executionContext?.publishingContext?.task;
+  if (typeof id !== "string" || !id || id.includes("/")) return config;
+  try {
+    const harness: any = await import("../../agent-mcp/index.js");
+    const task = await harness.readTask(id, { accessToken: executionContext?.auth?.accessToken });
+    const block =
+      `This conversation was opened on a task (${task.status}).` +
+      (task.statusMessage ? ` ${task.statusMessage}` : "") +
+      (task.asks ? `\nIt asks: ${JSON.stringify(task.asks)}` : "") +
+      (task.result ? `\nWhat it holds:\n${task.result}` : "");
+    const history = Array.isArray(config?.conversationHistory) ? config.conversationHistory : [];
+    console.log(`[manifests] opened task ${id} replayed into the call (${task.status})`);
+    return { ...config, conversationHistory: [...history, { role: "user", content: block }] };
+  } catch (e: any) {
+    console.log(`[manifests] opened task ${id} could not be read (non-blocking): ${e?.message ?? e}`);
+    return config;
+  }
+}

package/vendor/base/src/manifests/executor/toolBridge.ts

@@ -12,6 +12,7 @@
 import type { ToolBridge } from "../runtime/index.js";
 import { engineUrl } from "./context.js";
 import { saveAvailableTools } from "../../platform/serviceCalls.js";
+import { recordCall } from "../runtime/tools/toolloop.js";
 
 /** The screen's verbs on an app with places (docs/unoverse/design/screen/UNOVERSE_SCREEN.md §3.3). */
 const SCREEN_VERBS = {
@@ -182,22 +183,79 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
     }
   }
 
-  return {
+  /**
+   * THE TASK THE APP'S ADDRESS NAMES, by its id (docs/mcp/MCP_TASKS.md § 5c). An edge or Spatial
+   * hands the model a task to start; an id names one that already exists, connected through the
+   * official client's `session.task(id)`. The model can read it, and answer it while it waits:
+   * the two things MCP offers on an existing task. A URI (`<org>/<name>`, which a task's own run
+   * also carries) is not this. Fail-soft: a task that cannot be read adds nothing.
+   */
+  const named = pub?.task;
+  if (typeof named === "string" && named && !named.includes("/")) {
+    try {
+      const now = await harness.readTask(named, identity);
+      appInvokers.set("read_task", () => harness.readTask(named, identity));
+      preMinted.push({
+        name: "read_task",
+        description: `The task this conversation was opened on (${now.status}). Read it for where it is, what it asks and what it produced.`,
+        parameters: { type: "object", properties: {} },
+      });
+      if (now.status === "input_required") {
+        appInvokers.set("answer_task", async (input: any) => {
+          await harness.answerTask(named, (input?.answers ?? {}) as Record<string, unknown>, identity);
+          return harness.readTask(named, identity);
+        });
+        preMinted.push({
+          name: "answer_task",
+          description: "Answer what the task this conversation was opened on asks, each answer under the key it asks with.",
+          parameters: { type: "object", properties: { answers: { type: "object", description: "Each answer under the key the task asks with." } }, required: ["answers"] },
+        });
+      }
+      console.log(`[manifests] task ${named} connected (${now.status})`);
+    } catch (e: any) {
+      console.log(`[manifests] task ${named} could not be read: ${e?.message ?? e}`);
+    }
+  }
+
+  /** The tools held behind search_tools on this run, or null when every tool is offered. */
+  let held: Array<{ name: string; description: string; parameters: unknown; server?: string }> | null = null;
+
+  const bridge: ToolBridge = {
     async discover() {
-      const tools = [
-        ...Object.entries<any>(schema.methods).map(([name, m]) => ({
-          name,
-          description: m.description || `Execute ${name}`,
-          parameters: m.input || { type: "object", properties: {} },
-        })),
-        ...preMinted,
-      ];
+      const wired = Object.entries<any>(schema.methods).map(([name, m]) => ({
+        name,
+        description: m.description || `Execute ${name}`,
+        parameters: m.input || { type: "object", properties: {} },
+        ...(m.server ? { server: String(m.server) } : {}),
+      }));
+      // MANY TOOLS ARE HELD BEHIND SEARCH (harness.shouldDefer, MCP Client Best Practices). Spatial
+      // search stays offered: it is how an Agent finds what it does not hold, and what it finds is
+      // minted as a tool. The screen and open pages (preMinted) are never held.
+      const deferrable = wired.filter((t) => !harness.DISCOVERY_TOOL_NAMES.includes(t.name));
+      held = harness.shouldDefer(deferrable) ? deferrable : null;
+      if (held) console.log(`[manifests] ${held.length} tools held behind ${harness.SEARCH_TOOLS} (about ${harness.estimateTokens(held)} tokens of definitions)`);
+      const strip = ({ server: _server, ...t }: any) => t;
+      const tools = [...(held ? [...wired.filter((t) => !held!.includes(t)), ...harness.metaTools(held)] : wired).map(strip), ...preMinted];
       // Everything the model starts with, the screen and open pages included.
       if (caller.executionId && caller.nodeId) saveAvailableTools(caller.executionId, caller.nodeId, tools.map((t) => t.name));
       return tools;
     },
 
-    async call(name, args, hooks) {
+    async call(name, args, hooks): Promise<string> {
+      // A SEARCH IS A CALL LIKE ANY OTHER, recorded on the run with what it asked and what it found:
+      // without it nobody could see which tools an Agent looked for, or why it never used one.
+      if (held && name === harness.SEARCH_TOOLS) {
+        const startTime = Date.now();
+        const answer = harness.searchAnswer(held, args?.query);
+        recordCall({ executionId: caller.executionId, parentNodeId: caller.nodeId, toolName: harness.SEARCH_TOOLS, args, result: answer, startTime, success: true, who: "harness" });
+        return answer;
+      }
+      // A held tool, called by name. Only a tool this Agent was given: the list is its limit.
+      if (held && name === harness.CALL_TOOL) {
+        const target = String(args?.name ?? "");
+        if (!held.some((t) => t.name === target)) return JSON.stringify({ error: `No tool named "${target}". Find it with ${harness.SEARCH_TOOLS} first.` });
+        return bridge.call(target, args?.arguments ?? {}, hooks);
+      }
       const app = appInvokers.get(name);
       // A followed task's status, as it changes, goes to whoever asked (the tool loop narrates it).
       if (app) return stringify(await app(args, hooks));
@@ -276,7 +334,7 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
               // A WORKFLOW-BOUND APP (path A) OPENS, then ends the turn. It used to only end
               // the turn: nothing registered an invoker, so the model's call fell through to
               // `api.callService` and died as an unknown SERVICE method while the run reported
-              // success and the screen stayed blank (SAB, 2026-09-07). Both, in this order —
+              // success and the screen stayed blank (a bank, 2026-09-07). Both, in this order —
               // the app tool renders the surface and fires no workflow itself (server
               // mcp/server/tools.ts), so the handoff that follows is not a second run.
               appInvokers.set(def.name, harness.workflowAppInvoker(mcp, called));
@@ -315,4 +373,5 @@ export async function toolBridgeFor(executionContext: any): Promise<ToolBridge |
       return harness.isTurnEndingHandoff(calls, handoffTools);
     },
   };
+  return bridge;
 }

package/vendor/base/src/manifests/runtime/auth/oauth.ts

@@ -1,6 +1,6 @@
 /**
- * OAUTH2 CLIENT CREDENTIALS. An auth scheme, so it is written once here rather than in
- * every node that needs it (DECLARATIVE_NODES.md §2).
+ * OAUTH2 CLIENT CREDENTIALS AND REFRESH TOKENS. Auth schemes, so they are written once here
+ * rather than in every node that needs them (DECLARATIVE_NODES.md §2).
  *
  * Unlike a bearer key, this is not a value the manifest can template: the credential is a
  * client id and secret that must be EXCHANGED for a short-lived token, over a form-encoded
@@ -10,7 +10,15 @@
  * The token response is put back into scope as `token`, because some vendors return where
  * to talk as well as how. Salesforce returns `instance_url` and the org's API lives there,
  * not at the login host you authenticated against.
+ *
+ * A REFRESH TOKEN is the same exchange with one more secret. Some vendors (LinkedIn) never
+ * issue a token to an app alone: a person approves the app once, and what that leaves behind
+ * is a long-lived refresh token the app trades for short-lived access tokens with nobody
+ * signed in. The person makes it once in the vendor's developer portal and it is pasted into
+ * the credential, as the client secret is.
  */
+import { createHash } from "node:crypto";
+
 
 interface Minted {
   accessToken: string;
@@ -22,16 +30,23 @@ interface Minted {
  * Cached per connected-app identity, not per node or per run.
  *
  * A workflow that makes six calls must not mint six tokens, and a vendor will rate-limit or
- * refuse if it does. Keyed by client id AND token url so two orgs never share an entry.
+ * refuse if it does. Keyed by client id AND token url so two orgs never share an entry, and
+ * for a refresh token by that token too: two orgs may connect through the same vendor app.
  */
 const CACHE = new Map<string, Minted>();
 
 /** Default life. Salesforce client-credentials sessions are ~2h; refresh well before. */
 const DEFAULT_TTL_MS = 110 * 60 * 1000;
 
+function cacheKey(tokenUrl: string, clientId: string, refreshToken?: string): string {
+  // A digest, never the refresh token itself, so the key holds no secret.
+  const who = refreshToken ? `#${createHash("sha256").update(refreshToken).digest("hex").slice(0, 16)}` : "";
+  return `${clientId}@${tokenUrl}${who}`;
+}
+
 /** Drop a cached token, so the next call mints a fresh one. */
-export function invalidateToken(tokenUrl: string, clientId: string): void {
-  CACHE.delete(`${clientId}@${tokenUrl}`);
+export function invalidateToken(tokenUrl: string, clientId: string, refreshToken?: string): void {
+  CACHE.delete(cacheKey(tokenUrl, clientId, refreshToken));
 }
 
 export async function mintClientCredentials(
@@ -41,15 +56,33 @@ export async function mintClientCredentials(
   scope: string | undefined,
   force = false,
 ): Promise<Minted> {
-  const key = `${clientId}@${tokenUrl}`;
+  const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId, client_secret: clientSecret });
+  if (scope) form.set("scope", scope);
+  return mint("oauth2ClientCredentials", tokenUrl, form, cacheKey(tokenUrl, clientId), force);
+}
+
+export async function mintFromRefreshToken(
+  tokenUrl: string,
+  clientId: string,
+  clientSecret: string,
+  refreshToken: string,
+  force = false,
+): Promise<Minted> {
+  const form = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: refreshToken,
+    client_id: clientId,
+    client_secret: clientSecret,
+  });
+  return mint("oauth2RefreshToken", tokenUrl, form, cacheKey(tokenUrl, clientId, refreshToken), force);
+}
+
+async function mint(scheme: string, tokenUrl: string, form: URLSearchParams, key: string, force: boolean): Promise<Minted> {
   const hit = CACHE.get(key);
   if (!force && hit && hit.expiresAt > Date.now()) return hit;
 
   // FORM ENCODED, not JSON. The OAuth2 spec says so and vendors enforce it, which is why
   // this cannot ride the ordinary body path: that one always sends JSON.
-  const form = new URLSearchParams({ grant_type: "client_credentials", client_id: clientId, client_secret: clientSecret });
-  if (scope) form.set("scope", scope);
-
   const res = await fetch(tokenUrl, {
     method: "POST",
     headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" },
@@ -61,7 +94,7 @@ export async function mintClientCredentials(
     // The description, not just the status: "invalid_client" tells you which of the two
     // secrets is wrong, and a bare 400 does not.
     const detail = data?.error_description ?? data?.error ?? res.statusText;
-    throw new Error(`oauth2ClientCredentials: token request to ${tokenUrl} failed (${res.status}): ${detail}`);
+    throw new Error(`${scheme}: token request to ${tokenUrl} failed (${res.status}): ${detail}`);
   }
 
   const minted: Minted = {

package/vendor/base/src/manifests/runtime/events.ts

@@ -211,7 +211,7 @@ export function makeEmitter(node: ComposedNode, onEmit: (e: Emission) => void, b
      * word after the first sitting in `pending`, and the next thing to move it is whatever
      * arrives next, however much later.
      *
-     * Seen live (SAB Account Agent, 2026-09-08): the model said "I'm checking your account
+     * Seen live (a bank's account agent, 2026-09-08): the model said "I'm checking your account
      * activity for food spending last month" in a few milliseconds, the reader saw "I", and
      * the rest appeared eleven seconds afterwards — when a delta from the turn AFTER the
      * tool call finally pushed it out. It read as the stream stopping for the tool. It was

package/vendor/base/src/manifests/runtime/http/request.ts

@@ -10,7 +10,7 @@ import { render, evaluate, primeTemplating } from "../templating.js";
 import { assertAllowedHost } from "./allowedHosts.js";
 import { readSettled, assertOk } from "./response.js";
 import { performState, type StateStore } from "../state.js";
-import { mintClientCredentials, invalidateToken } from "../auth/oauth.js";
+import { mintClientCredentials, mintFromRefreshToken, invalidateToken } from "../auth/oauth.js";
 import { signAwsRequest, presignAwsUrl, encodeDynamoJson, decodeDynamoJson, type AwsSigning } from "../auth/aws.js";
 import { fetchPaginated } from "../loops/paginate.js";
 import { fetchPolled } from "../loops/poll.js";
@@ -116,6 +116,17 @@ export async function buildRequest(
       scoped = { ...ctx, token: { instanceUrl: minted.instanceUrl } } as RunContext;
       break;
     }
+    case "oauth2RefreshToken": {
+      const minted = await mintFromRefreshToken(
+        await required(auth.tokenUrl, "a token url"),
+        await required(auth.clientId, "a client id"),
+        await required(auth.clientSecret, "a client secret"),
+        await required(auth.refreshToken, "a refresh token"),
+        forceReauth,
+      );
+      authHeaders.Authorization = `Bearer ${minted.accessToken}`;
+      break;
+    }
     case "awsSigV4": {
       // The manifest names the SERVICE and the REGION, because those decide what the
       // signature is scoped to and they are properties of the endpoint being described.
@@ -237,6 +248,15 @@ async function resolveValue(value: any, ctx: RunContext): Promise<unknown> {
  * A timeout is an ERROR, not an empty result: it fails with a message naming the limit and the call,
  * so the manifest's own number appears in the log that reports it.
  */
+/** How many times a call whose connection dropped is made again: 2s, 4s, 8s, 16s, 32s, 60s, 60s, 60s, 60s, about five minutes. */
+export const DROPPED_RETRIES = 9;
+/** A failure with no reply at all: the connection dropped, was refused, reset, or never resolved. Never a status. */
+export function dropped(error: any): boolean {
+  const code = String(error?.cause?.code ?? error?.code ?? "");
+  const text = String(error?.message ?? error);
+  return /^(ECONNRESET|ECONNREFUSED|EAI_AGAIN|ENOTFOUND|EPIPE|ETIMEDOUT|UND_ERR_SOCKET|UND_ERR_CONNECT_TIMEOUT)$/.test(code) || /^fetch failed$/i.test(text) || /socket hang up|other side closed/i.test(text);
+}
+
 export async function fetchWithTimeout(url: string, init: any, timeoutMs: unknown, label: string): Promise<Response> {
   const ms = typeof timeoutMs === "number" && timeoutMs > 0 ? timeoutMs : 0;
   if (!ms) return fetch(url, init);
@@ -408,6 +428,21 @@ export async function sendRequest(node: ComposedNode, requestSpec: any, ctx: Run
     waiter?.unref?.();
     try {
       res = await fetchWithTimeout(url, init, requestSpec?.timeoutMs, label);
+    } catch (error: any) {
+      /**
+       * A DROPPED CONNECTION IS ASKED AGAIN (2026-10-22). A host that scales to zero answers its first
+       * call by booting; the gateway in front of it drops the connection while a model loads (NuExtract
+       * on Beam: four and a half minutes), and the engine saw "fetch failed" with no status at all. That
+       * is not the vendor's answer, it is no answer, so the call is made again with a growing wait, up
+       * to about five minutes in all. A reply with a status, good or bad, is never retried here.
+       */
+      if (dropped(error) && attempt <= DROPPED_RETRIES) {
+        const wait = Math.min(60_000, 2_000 * 2 ** (attempt - 1));
+        console.warn(`[manifests] ${label}: the connection dropped (${String(error?.cause?.code ?? error?.message ?? error).slice(0, 80)}); asking again in ${Math.round(wait / 1000)}s (${attempt}/${DROPPED_RETRIES})`);
+        await new Promise((r) => setTimeout(r, wait));
+        continue;
+      }
+      throw error;
     } finally {
       if (waiter) clearInterval(waiter);
     }
@@ -428,8 +463,13 @@ export async function sendRequest(node: ComposedNode, requestSpec: any, ctx: Run
     // A minted token can be revoked or expire early, and the vendor says so with a 401.
     // Refresh ONCE and retry, exactly as the retired client did. Guarded by !forceReauth so
     // a genuinely rejected credential fails rather than looping.
-    if (res.status === 401 && requestSpec?.credential?.scheme === "oauth2ClientCredentials" && !forceReauth) {
-      invalidateToken(String(render(requestSpec.credential.tokenUrl, ctx)), String(render(requestSpec.credential.clientId, ctx)));
+    const scheme = requestSpec?.credential?.scheme;
+    if (res.status === 401 && (scheme === "oauth2ClientCredentials" || scheme === "oauth2RefreshToken") && !forceReauth) {
+      invalidateToken(
+        String(render(requestSpec.credential.tokenUrl, ctx)),
+        String(render(requestSpec.credential.clientId, ctx)),
+        scheme === "oauth2RefreshToken" ? String(render(requestSpec.credential.refreshToken, ctx)) : undefined,
+      );
       console.warn(`[manifests] ${label}: 401, refreshing the access token and retrying once`);
       return sendRequest(node, requestSpec, ctx, label, true);
     }

package/vendor/base/src/manifests/runtime/loops/poll.ts

@@ -141,12 +141,34 @@ export async function fetchPolled(
     `[manifests] ${label}: job started — polling ${url.split("?")[0]} every ${Math.round(interval / 1000)}s (up to ${attempts} attempts)`,
   );
 
+  // THE FIRST CHECKS COME QUICKLY (2026-10-25): one second, then two, four, doubling up to the manifest's interval. A job
+  // answered from the vendor's cache is ready at once, and a fixed ten-second wait before the first check made every
+  // stored parse take ten seconds; a long job still settles into the full interval, so its patience is barely shorter.
+  let wait = Math.min(1000, interval);
   for (let attempt = 1; attempt <= attempts; attempt++) {
-    await new Promise((r) => setTimeout(r, interval));
-
-    const res = await sendRequest(node, statusCall, ctx, `${label} (poll ${attempt}/${attempts})`);
-    const payload = await readSettled(res, call.transport, call.encoding);
-    await assertOk(node, call, payload, `${label} (poll ${attempt}/${attempts})`);
+    await new Promise((r) => setTimeout(r, wait));
+    wait = Math.min(wait * 2, interval);
+
+    /**
+     * A MISSED POLL IS NOT A LOST JOB (2026-10-22). The job runs on the vendor's side; a status ask
+     * that cannot get through (the connection dropped, a gateway answered 502/503/504 while a
+     * container turned over) says nothing about the job. One such miss ended a parse that the
+     * vendor's own log shows finished sixteen seconds later. A miss is counted as an attempt and
+     * the wait goes on; only the attempts bound, or an answer that is an error, ends it.
+     */
+    let payload: any;
+    try {
+      const res = await sendRequest(node, statusCall, ctx, `${label} (poll ${attempt}/${attempts})`);
+      payload = await readSettled(res, call.transport, call.encoding);
+      await assertOk(node, call, payload, `${label} (poll ${attempt}/${attempts})`);
+    } catch (error: any) {
+      const text = String(error?.message ?? error);
+      if (attempt < attempts && /\b50[234]\b|fetch failed|ECONN|EAI_AGAIN|socket|timed out|aborted/i.test(text)) {
+        console.warn(`[manifests] ${label}: poll ${attempt}/${attempts} could not reach the job (${text.slice(0, 160)}); asking again`);
+        continue;
+      }
+      throw error;
+    }
 
     const status = typeof payload?.status === "string" ? payload.status : undefined;
     if (status !== lastStatus || attempt % heartbeat === 0)

package/vendor/base/src/manifests/runtime/tools/toolloop.ts

@@ -331,7 +331,7 @@ export async function runToolLoop(
     // window — and if the model answered inside a single window, that is the whole answer
     // but its first token. It then surfaces on the next turn's first delta, which is after
     // any tool this turn called: the reader saw "I", then the rest eleven seconds later,
-    // and it read as the stream stopping for the tool (SAB, 2026-09-08).
+    // and it read as the stream stopping for the tool (a bank, 2026-09-08).
     //
     // Here rather than in the manifest, and by the LOOP rather than a timer: only the loop
     // knows where a turn ends, which is the same reason it owns counting them.

package/vendor/base/src/platform/inbound.ts

@@ -0,0 +1,67 @@
+/**
+ * IS THIS MESSAGE GENUINE? (docs/auth-security/INBOUND.md § 2 step 3; UNO-239)
+ *
+ * The verifiers, written here and nowhere else. A node only NAMES its scheme and the field of its
+ * credential holding the secret (`inbound:` in node.yaml); it can never describe its own check, so
+ * no node can switch checking off. Each one fails closed: no secret, no timestamp, a wrong or old
+ * signature, all refused. Compared in constant time over the raw bytes, before anything is parsed.
+ *
+ * A service's one-time address check (Slack's `url_verification`) is answered here too, but only
+ * once the request has passed the same check: an unsigned challenge is refused like anything else.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+/** What a verifier decides. `challenge`: the service is checking the address; echo this, do nothing else. */
+export type Verdict = { ok: false; reason: string } | { ok: true; challenge?: string };
+
+/** The schemes a node may name. */
+export const SCHEMES = ["slack"] as const;
+export type Scheme = (typeof SCHEMES)[number];
+
+/** Older than this, or this far in the future, and a message is a replay (Slack's own window). */
+export const MAX_SKEW_SECONDS = 300;
+
+function same(a: string, b: string): boolean {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+
+/**
+ * SLACK (docs.slack.dev, "Verifying requests from Slack"): `X-Slack-Signature` is `v0=` and the hex
+ * HMAC-SHA256, keyed by the app's signing secret, of `v0:<X-Slack-Request-Timestamp>:<raw body>`.
+ */
+function slack(headers: Headers, raw: string, secret: string, nowSeconds: number): Verdict {
+  const ts = headers.get("x-slack-request-timestamp") ?? "";
+  const signature = headers.get("x-slack-signature") ?? "";
+  if (!/^\d+$/.test(ts) || !signature) return { ok: false, reason: "unsigned" };
+  if (Math.abs(nowSeconds - Number(ts)) > MAX_SKEW_SECONDS) return { ok: false, reason: "too old" };
+  const expected = `v0=${createHmac("sha256", secret).update(`v0:${ts}:${raw}`).digest("hex")}`;
+  if (!same(signature, expected)) return { ok: false, reason: "wrong signature" };
+  try {
+    const body = JSON.parse(raw);
+    if (body?.type === "url_verification" && typeof body.challenge === "string") return { ok: true, challenge: body.challenge };
+  } catch {
+    /* a signed body that is not JSON is still genuine; what it says is the next step's to read */
+  }
+  return { ok: true };
+}
+
+const VERIFIERS: Record<Scheme, (headers: Headers, raw: string, secret: string, nowSeconds: number) => Verdict> = { slack };
+
+/**
+ * Check one message with the scheme its node names. `secrets` holds the current secret and, while
+ * one is being replaced, the next: either passing is genuine. No secret at all is a refusal.
+ */
+export function verifyInbound(scheme: string, headers: Headers, raw: string, secrets: Array<string | undefined | null>, nowSeconds = Math.floor(Date.now() / 1000)): Verdict {
+  const verify = VERIFIERS[scheme as Scheme];
+  if (!verify) return { ok: false, reason: `no verifier for "${scheme}"` };
+  const usable = secrets.filter((s): s is string => typeof s === "string" && s.length > 0);
+  if (!usable.length) return { ok: false, reason: "no secret" };
+  let last: Verdict = { ok: false, reason: "no secret" };
+  for (const secret of usable) {
+    last = verify(headers, raw, secret, nowSeconds);
+    if (last.ok) return last;
+  }
+  return last;
+}

package/vendor/base/src/platform/tokenCost.ts

@@ -9,7 +9,7 @@
 type RawUsage = any;
 /** What a model costs, per 1M tokens (or per minute). */
 export interface ModelPricing {
-  input?: number; cachedInput?: number; output?: number; perMinute?: number;
+  input?: number; cachedInput?: number; cacheWrite?: number; output?: number; perMinute?: number;
   audioInput?: number; cachedAudioInput?: number; audioOutput?: number; imageInput?: number; cachedImageInput?: number;
 }
 
@@ -69,6 +69,9 @@ const parseOpenAI = (usage: RawUsage) => {
     const inDetails = usage.input_tokens_details || usage.input_token_details || {};
     const outDetails = usage.output_tokens_details || usage.output_token_details || {};
     const cachedTokens = inDetails.cached_tokens || 0;
+    // WRITTEN TO THE CACHE, the other part of input with its own price (GPT-5.6 bills a cache write
+    // above a fresh token). Like cached, it is counted inside `input_tokens`.
+    const cacheWriteTokens = inDetails.cache_write_tokens || 0;
     const reasoningTokens = outDetails.reasoning_tokens || 0;
     // AUDIO IS PRICED DIFFERENTLY from text, so voice cost cannot be read off a total alone.
     const audioIn = inDetails.audio_tokens || 0;
@@ -101,9 +104,11 @@ const parseOpenAI = (usage: RawUsage) => {
       output: usage.output_tokens || 0,
       reasoning: reasoningTokens,
       cached: cachedTokens,
+      cacheWrite: cacheWriteTokens,
       breakdown: {
         input: usage.input_tokens || 0,
         cached: cachedTokens,
+        ...(cacheWriteTokens ? { cacheWrite: cacheWriteTokens } : {}),
         reasoning: reasoningTokens,
         completion: (usage.output_tokens || 0) - reasoningTokens,
         // Present only on a voice call; omitted rather than shown as 0 for text models, so a
@@ -208,13 +213,18 @@ const parseBedrockClaude = (usage: RawUsage) => {
 const parseGeneric = (usage: RawUsage) => {
   const input = usage.input_tokens || usage.inputTokens || usage.prompt_tokens || 0;
   const output = usage.output_tokens || usage.outputTokens || usage.completion_tokens || 0;
+  // CACHED IS A SUBSET OF INPUT, as OpenAI reports it, and every OpenAI-compatible vendor (Z.AI
+  // GLM) copies that shape. Dropping it priced every cached token at the fresh rate: a GLM Agent's
+  // turn cost about three times what Z.AI bills.
+  const cached = usage.prompt_tokens_details?.cached_tokens || usage.input_tokens_details?.cached_tokens || 0;
 
   return {
     total: usage.total_tokens || input + output,
     input,
     output,
     reasoning: 0,
-    breakdown: { input, output },
+    cached,
+    breakdown: { input, cached, output },
   };
 };
 
@@ -259,7 +269,14 @@ export const calculateTokenCost = (model: string, parsedUsage: any): string => {
     ).toFixed(4);
   }
 
-  const inputCost = per(parsedUsage.input, pricing.input);
+  // Cached input and cache writes are parts of input, each billed at its own rate where the vendor
+  // has one; the rest is fresh.
+  const cached = Math.min(parsedUsage.cached || 0, parsedUsage.input || 0);
+  const written = Math.min(parsedUsage.cacheWrite || 0, (parsedUsage.input || 0) - cached);
+  const inputCost =
+    per((parsedUsage.input || 0) - cached - written, pricing.input) +
+    per(cached, pricing.cachedInput ?? pricing.input) +
+    per(written, pricing.cacheWrite ?? pricing.input);
   const outputCost = per(parsedUsage.output, pricing.output);
 
   return (inputCost + outputCost).toFixed(4);
@@ -270,11 +287,13 @@ export const calculateTokenCost = (model: string, parsedUsage: any): string => {
  */
 export const getModelPricing = (model: string): ModelPricing => {
   const pricing: Record<string, ModelPricing> = {
-    // GPT-5.6 family (Sol/Terra/Luna) — verified against the OpenAI pricing page 2026-08-07
-    "gpt-5.6": { input: 5.0, output: 30.0 }, // alias of gpt-5.6-sol
-    "gpt-5.6-sol": { input: 5.0, output: 30.0 },
-    "gpt-5.6-terra": { input: 2.0, output: 12.0 },
-    "gpt-5.6-luna": { input: 0.2, output: 1.2 },
+    // GPT-5.6 family (Sol/Terra/Luna): standard, short context (up to 272K input), verified against
+    // developers.openai.com/api/docs/pricing 2026-10-11. Cached input and cache writes have their own
+    // rates; without them every cached token was billed fresh.
+    "gpt-5.6": { input: 4.0, cachedInput: 0.4, cacheWrite: 5.0, output: 20.0 }, // alias of gpt-5.6-sol
+    "gpt-5.6-sol": { input: 4.0, cachedInput: 0.4, cacheWrite: 5.0, output: 20.0 },
+    "gpt-5.6-terra": { input: 2.0, cachedInput: 0.2, cacheWrite: 2.5, output: 12.0 },
+    "gpt-5.6-luna": { input: 0.2, cachedInput: 0.02, cacheWrite: 0.25, output: 1.2 },
 
     // Z.AI GLM — verified against docs.z.ai/guides/overview/pricing 2026-10-09
     "glm-5.3": { input: 1.4, cachedInput: 0.26, output: 4.4 },

package/vendor/sdk/lib/core/actions.ts

@@ -22,6 +22,8 @@ export interface ActionContext {
   /** Where APP state lives, when it is not `store`: a template a website page draws keeps its
    *  own slice in its own store and shares the app's state with everything on the page. */
   appStore?: ComponentStore;
+  /** Print what is on screen (host-provided; the `print` action). Resolves when it is done. */
+  print?: () => void | Promise<void>;
 }
 
 /** Resolve a value: a `"{{path}}"` template reads from `scope` (dot-path); anything
@@ -103,6 +105,14 @@ export function dispatchAction(
       if (ctx.nodeId) ctx.store.apply({ type: "COMPONENT_DATA", chatId: ctx.chatId, nodeId: ctx.nodeId, data: { [field]: scope.text } });
       else (ctx.appStore ?? ctx.store).mergeAppState({ [field]: scope.text });
     }
+  } else if (spec.type === "print") {
+    // PRINT asks the host to print what is on screen (`ctx.print`; the web host waits for a still
+    // screen first, dom/element.ts printWhenStill). `then` runs once the print is done. A host
+    // that cannot print does nothing.
+    if (!ctx.print) return;
+    const then = spec.then;
+    void Promise.resolve(ctx.print()).then(() => { if (then) dispatchAction(then, scope, ctx); });
+    return;
   } else {
     // SERVER — narrow the payload by `send` if given, else forward the whole scope.
     const payload = spec.send ? Object.fromEntries(spec.send.map((k) => [k, scope[k]])) : scope;

package/vendor/sdk/lib/core/apps.ts

@@ -57,7 +57,7 @@ export const cssWidth = (w: unknown): string | undefined => (typeof w === "strin
  *
  * ONE function for every caller, because the slot frame once had its own copy without the
  * `flex` word: beside a full-width app it rendered the task surface in a zero-width frame
- * the moment the org's `flex` token went (SAB's comparison, blank, 2026-09-07).
+ * the moment the org's `flex` token went (a bank's comparison, blank, 2026-09-07).
  */
 export function placeWidthStyle(declared: unknown, appSize?: Record<string, string>): Record<string, unknown> | null {
   const width = cssWidth(typeof declared === "string" ? (appSize?.[declared] ?? declared) : undefined);
@@ -377,7 +377,7 @@ export function selectPointers(store: ComponentStore, node: UnoverseNode, scope?
   // THE MOST RECENT WINS (the `limit: 1` law) for EVERY capped select, not only a state
   // select. A slot pinned to a component by `type` with `limit: 1` kept the OLDEST card:
   // the sort lived inside the `where` branch, so a name-pinned cap sliced arrival order
-  // (SAB voice, two Account Agent cards, 2026-09-10). A cap means "the newest N"; an
+  // (a bank's voice app, two Account Agent cards, 2026-09-10). A cap means "the newest N"; an
   // uncapped flow keeps arrival order.
   if (sel.where || sel.limit != null) pointers = [...pointers].sort((a, b) => store.touchOf(b) - store.touchOf(a));
   if (sel.limit != null) pointers = pointers.slice(0, sel.limit);

package/vendor/sdk/lib/core/client.ts

@@ -129,6 +129,17 @@ export class UnoverseClient {
     return this.withSession(() => this.client.callTool({ name, arguments: args }));
   }
 
+  /**
+   * THE TASK A COMPONENT CARRIES (docs/design/lifecycle-hooks.md), run as this viewer: the server
+   * runs the hook in the component's own folder with the instance's fields as `props` and answers
+   * with the fields it filled. A component with no hook for the phase answers `{}`.
+   */
+  async runTask(uri: string, phase: "onStart" | "onEnterView", props?: Record<string, unknown>, state?: string): Promise<Record<string, unknown>> {
+    const res = (await this.callTool("template_task", { uri, phase, ...(props ? { props } : {}), ...(state ? { state } : {}) })) as { content?: Array<{ text?: string }> };
+    const text = res?.content?.[0]?.text;
+    return text ? (JSON.parse(text) as Record<string, unknown>) : {};
+  }
+
 
   /** resources/read a definition by URI (e.g. unoverse://components/card). Cached. A hash on
    *  the address names the state it opens in (`stateOfUri`) and is never sent to the server. */

package/vendor/sdk/lib/core/store.ts

@@ -493,7 +493,7 @@ export class ComponentStore {
       // recomputed order on EVERY update, which is stable only while one thing is updating.
       // A held Agent task has two: the task's face ticking through its steps, and the
       // reply resuming once the result lands. They alternate, so the bottom slot alternated
-      // with them and the pair visibly swapped places on screen (SAB Account Agent,
+      // with them and the pair visibly swapped places on screen (a bank's account agent,
       // 2026-09-08). The case it was written for is served by arrival order too: text
       // placed before a form stays above it.
       this.merge(key, this.shieldGuestFace(key, event.data));

package/vendor/sdk/lib/core/types.ts

@@ -42,6 +42,8 @@ export interface UnoverseNode {
    *  content grows (new turn or streaming text), unless the user has scrolled up. Generic
    *  scroll-container behavior, opt-in via data (e.g. the conversation state's scroll box). */
   autoScroll?: boolean;
+  /** Drag to move around this box's overflow, keeping the centre when its content changes size. */
+  pan?: boolean;
   /** Box: a sticky bar (its own `position: sticky` + `top` in the design definition) that stays HIDDEN while
    *  the element before it (its previous sibling — e.g. a hero image) is on screen, then
    *  fades in once that sibling scrolls away. Overlays the content (no flow gap). Generic