@xopcai/xopc 0.0.99 → 0.0.101

package/dist/src/agent/tools/media-read-tool.js

@@ -0,0 +1,89 @@
+import { mimeTypeFromMediaPath } from "../../media/store.js";
+import { readMediaReference } from "../../media/media-reference.js";
+import { Type } from "@sinclair/typebox";
+//#region src/agent/tools/media-read-tool.ts
+const DEFAULT_MAX_BYTES = 1024 * 1024;
+const HARD_MAX_BYTES = 5 * 1024 * 1024;
+const ReadMediaSchema = Type.Object({
+	uri: Type.String({ description: "The media:// URI from an xopc-media-uri line in the user message." }),
+	maxBytes: Type.Optional(Type.Number({ description: "Maximum bytes to read, capped at 5 MiB." }))
+});
+function isLikelyText(mimeType) {
+	return mimeType.startsWith("text/") || mimeType === "application/json" || mimeType === "application/xml" || mimeType === "application/javascript" || mimeType === "application/typescript";
+}
+function clampMaxBytes(raw) {
+	if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) return DEFAULT_MAX_BYTES;
+	return Math.min(Math.floor(raw), HARD_MAX_BYTES);
+}
+function createReadMediaTool() {
+	return {
+		name: "read_media",
+		label: "Read Media Attachment",
+		description: "Read an attachment by media:// URI. Use this for xopc-media-uri attachments in user messages.",
+		parameters: ReadMediaSchema,
+		async execute(_toolCallId, params, _signal) {
+			const uri = typeof params.uri === "string" ? params.uri.trim() : "";
+			if (!uri) return {
+				content: [{
+					type: "text",
+					text: "Missing media URI."
+				}],
+				details: {
+					ok: false,
+					error: "missing_uri"
+				}
+			};
+			try {
+				const { buffer, path } = await readMediaReference(uri, clampMaxBytes(params.maxBytes));
+				const mimeType = mimeTypeFromMediaPath(path);
+				const metadata = {
+					ok: true,
+					uri,
+					mimeType,
+					size: buffer.byteLength,
+					path
+				};
+				if (isLikelyText(mimeType)) return {
+					content: [{
+						type: "text",
+						text: buffer.toString("utf8")
+					}],
+					details: {
+						...metadata,
+						kind: "text"
+					}
+				};
+				return {
+					content: [{
+						type: "text",
+						text: JSON.stringify({
+							...metadata,
+							kind: "binary",
+							base64: buffer.toString("base64")
+						}, null, 2)
+					}],
+					details: {
+						...metadata,
+						kind: "binary"
+					}
+				};
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				return {
+					content: [{
+						type: "text",
+						text: `Media read error: ${message}`
+					}],
+					details: {
+						ok: false,
+						error: message
+					}
+				};
+			}
+		}
+	};
+}
+//#endregion
+export { createReadMediaTool };
+
+//# sourceMappingURL=media-read-tool.js.map

package/dist/src/agent/tools/media-read-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-read-tool.js","names":[],"sources":["../../../../src/agent/tools/media-read-tool.ts"],"sourcesContent":["import { Type } from '@sinclair/typebox';\nimport type { AgentTool, AgentToolResult } from '@earendil-works/pi-agent-core';\n\nimport { readMediaReference } from '../../media/media-reference.js';\nimport { mimeTypeFromMediaPath } from '../../media/store.js';\n\nconst DEFAULT_MAX_BYTES = 1024 * 1024;\nconst HARD_MAX_BYTES = 5 * 1024 * 1024;\n\nconst ReadMediaSchema = Type.Object({\n  uri: Type.String({\n    description: 'The media:// URI from an xopc-media-uri line in the user message.',\n  }),\n  maxBytes: Type.Optional(Type.Number({\n    description: 'Maximum bytes to read, capped at 5 MiB.',\n  })),\n});\n\nfunction isLikelyText(mimeType: string): boolean {\n  return (\n    mimeType.startsWith('text/') ||\n    mimeType === 'application/json' ||\n    mimeType === 'application/xml' ||\n    mimeType === 'application/javascript' ||\n    mimeType === 'application/typescript'\n  );\n}\n\nfunction clampMaxBytes(raw: unknown): number {\n  if (typeof raw !== 'number' || !Number.isFinite(raw) || raw <= 0) {\n    return DEFAULT_MAX_BYTES;\n  }\n  return Math.min(Math.floor(raw), HARD_MAX_BYTES);\n}\n\nexport function createReadMediaTool(): AgentTool {\n  return {\n    name: 'read_media',\n    label: 'Read Media Attachment',\n    description:\n      'Read an attachment by media:// URI. Use this for xopc-media-uri attachments in user messages.',\n    parameters: ReadMediaSchema,\n\n    async execute(\n      _toolCallId: string,\n      params: { uri?: string; maxBytes?: number },\n      _signal?: AbortSignal,\n    ): Promise<AgentToolResult<Record<string, unknown>>> {\n      const uri = typeof params.uri === 'string' ? params.uri.trim() : '';\n      if (!uri) {\n        return {\n          content: [{ type: 'text', text: 'Missing media URI.' }],\n          details: { ok: false, error: 'missing_uri' },\n        };\n      }\n\n      try {\n        const maxBytes = clampMaxBytes(params.maxBytes);\n        const { buffer, path } = await readMediaReference(uri, maxBytes);\n        const mimeType = mimeTypeFromMediaPath(path);\n        const metadata = {\n          ok: true,\n          uri,\n          mimeType,\n          size: buffer.byteLength,\n          path,\n        };\n\n        if (isLikelyText(mimeType)) {\n          const text = buffer.toString('utf8');\n          return {\n            content: [{ type: 'text', text }],\n            details: { ...metadata, kind: 'text' },\n          };\n        }\n\n        return {\n          content: [\n            {\n              type: 'text',\n              text: JSON.stringify({\n                ...metadata,\n                kind: 'binary',\n                base64: buffer.toString('base64'),\n              }, null, 2),\n            },\n          ],\n          details: { ...metadata, kind: 'binary' },\n        };\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        return {\n          content: [{ type: 'text', text: `Media read error: ${message}` }],\n          details: { ok: false, error: message },\n        };\n      }\n    },\n  } as AgentTool;\n}\n"],"mappings":";;;;AAMA,MAAM,oBAAoB,OAAO;AACjC,MAAM,iBAAiB,IAAI,OAAO;AAElC,MAAM,kBAAkB,KAAK,OAAO;CAClC,KAAK,KAAK,OAAO,EACf,aAAa,qEACd,CAAC;CACF,UAAU,KAAK,SAAS,KAAK,OAAO,EAClC,aAAa,2CACd,CAAC,CAAC;CACJ,CAAC;AAEF,SAAS,aAAa,UAA2B;AAC/C,QACE,SAAS,WAAW,QAAQ,IAC5B,aAAa,sBACb,aAAa,qBACb,aAAa,4BACb,aAAa;;AAIjB,SAAS,cAAc,KAAsB;AAC3C,KAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,SAAS,IAAI,IAAI,OAAO,EAC7D,QAAO;AAET,QAAO,KAAK,IAAI,KAAK,MAAM,IAAI,EAAE,eAAe;;AAGlD,SAAgB,sBAAiC;AAC/C,QAAO;EACL,MAAM;EACN,OAAO;EACP,aACE;EACF,YAAY;EAEZ,MAAM,QACJ,aACA,QACA,SACmD;GACnD,MAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,IAAI,MAAM,GAAG;AACjE,OAAI,CAAC,IACH,QAAO;IACL,SAAS,CAAC;KAAE,MAAM;KAAQ,MAAM;KAAsB,CAAC;IACvD,SAAS;KAAE,IAAI;KAAO,OAAO;KAAe;IAC7C;AAGH,OAAI;IAEF,MAAM,EAAE,QAAQ,SAAS,MAAM,mBAAmB,KADjC,cAAc,OAAO,SACyB,CAAC;IAChE,MAAM,WAAW,sBAAsB,KAAK;IAC5C,MAAM,WAAW;KACf,IAAI;KACJ;KACA;KACA,MAAM,OAAO;KACb;KACD;AAED,QAAI,aAAa,SAAS,CAExB,QAAO;KACL,SAAS,CAAC;MAAE,MAAM;MAAQ,MAFf,OAAO,SAAS,OAEG;MAAE,CAAC;KACjC,SAAS;MAAE,GAAG;MAAU,MAAM;MAAQ;KACvC;AAGH,WAAO;KACL,SAAS,CACP;MACE,MAAM;MACN,MAAM,KAAK,UAAU;OACnB,GAAG;OACH,MAAM;OACN,QAAQ,OAAO,SAAS,SAAS;OAClC,EAAE,MAAM,EAAE;MACZ,CACF;KACD,SAAS;MAAE,GAAG;MAAU,MAAM;MAAU;KACzC;YACM,KAAK;IACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAChE,WAAO;KACL,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM,qBAAqB;MAAW,CAAC;KACjE,SAAS;MAAE,IAAI;MAAO,OAAO;MAAS;KACvC;;;EAGN"}

package/dist/src/auth/credentials.js

@@ -73,7 +73,6 @@ var init_credentials = __esmMin((() => {
 				}, "Resolved API key from environment");
 				return envKey;
 			}
-			log.debug({ provider }, "No API key found");
 			return null;
 		}
 		/**

package/dist/src/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    log.debug({ provider }, 'No API key found');\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    await this.deleteProfile(`${normalizedProvider}:default`);\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAyaA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBAtbsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,OAAI,MAAM,EAAE,UAAU,EAAE,mBAAmB;AAC3C,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;AACjD,SAAM,KAAK,cAAc,GAAG,mBAAmB,UAAU;AACzD,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}
+{"version":3,"file":"credentials.js","names":[],"sources":["../../../src/auth/credentials.ts"],"sourcesContent":["import { readFile, mkdir, rm } from 'fs/promises';\nimport { writeTextAtomic } from '../infra/write-file-atomic.js';\nimport { join, dirname } from 'path';\nimport { createLogger } from '../utils/logger.js';\nimport { getApiKeyFromEnv } from '../providers/env-keys.js';\nimport {\n  resolveCredentialsDir,\n  resolveAuthProfilesPath,\n  resolveAgentAuthProfilesPath,\n  resolveOAuthPath,\n} from '../config/paths.js';\nimport type { Config } from '../config/schema.js';\n\nconst log = createLogger('Credentials');\n\n// ============================================\n// Types\n// ============================================\n\nexport type CredentialType = 'api_key' | 'oauth';\n\nexport interface ApiKeyProfile {\n  type: 'api_key';\n  provider: string;\n  profileName?: string;\n  envVar?: string | null;\n  key: string | null;\n}\n\nexport interface OAuthToken {\n  type: 'oauth';\n  provider: string;\n  access: string;\n  refresh?: string;\n  expiresAt?: number;\n  scope?: string[];\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport type CredentialProfile = ApiKeyProfile;\n\nexport interface AuthProfilesFile {\n  version: number;\n  profiles: Record<string, ApiKeyProfile>;\n}\n\n// ============================================\n// Credential Resolver\n// ============================================\n\nexport interface CredentialResolverOptions {\n  stateDir?: string;\n  /** When set, per-agent auth profiles are read from `resolveAgentAuthProfilesPath(appConfig, agentId)`. */\n  agentId?: string;\n  /** Required when `agentId` is set. */\n  appConfig?: Config;\n}\n\nexport class CredentialResolver {\n  private readonly credentialsDir: string;\n  private readonly agentId?: string;\n  private readonly appConfig?: Config;\n\n  constructor(options: CredentialResolverOptions = {}) {\n    this.credentialsDir = options.stateDir\n      ? join(options.stateDir, 'credentials')\n      : resolveCredentialsDir();\n    this.agentId = options.agentId;\n    this.appConfig = options.appConfig;\n    if (this.agentId && !this.appConfig) {\n      throw new Error('CredentialResolver: appConfig is required when agentId is set');\n    }\n  }\n\n  /**\n   * Resolve API key for a provider\n   * Priority: Agent private > Global > OAuth > Environment\n   */\n  async resolveApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    // 1. Try agent private credentials\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) {\n        log.debug({ provider, source: 'agent' }, 'Resolved API key from agent credentials');\n        return agentKey;\n      }\n    }\n\n    // 2. Try global credentials\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) {\n      log.debug({ provider, source: 'global' }, 'Resolved API key from global credentials');\n      return globalKey;\n    }\n\n    // 3. Try OAuth token (convert to Bearer)\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) {\n      log.debug({ provider, source: 'oauth' }, 'Resolved API key from OAuth token');\n      return oauthToken.access;\n    }\n\n    // 4. Environment variables (see `src/providers/env-keys.ts`)\n    const envKey = getApiKeyFromEnv(normalizedProvider);\n    if (envKey) {\n      log.debug({ provider, source: 'env' }, 'Resolved API key from environment');\n      return envKey;\n    }\n\n    return null;\n  }\n\n  /**\n   * Check if a provider has credentials configured\n   */\n  async hasCredentials(provider: string): Promise<boolean> {\n    const key = await this.resolveApiKey(provider);\n    return key !== null;\n  }\n\n  /**\n   * Which step in {@link resolveApiKey} would supply the key (no secret material).\n   */\n  async resolveApiKeySource(\n    provider: string,\n  ): Promise<'agent' | 'global' | 'oauth' | 'env' | null> {\n    const normalizedProvider = provider.toLowerCase();\n\n    if (this.agentId) {\n      const agentKey = await this.loadFromAgentCredentials(normalizedProvider);\n      if (agentKey) return 'agent';\n    }\n\n    const globalKey = await this.loadFromGlobalCredentials(normalizedProvider);\n    if (globalKey) return 'global';\n\n    const oauthToken = await this.loadOAuthToken(normalizedProvider);\n    if (oauthToken) return 'oauth';\n\n    if (getApiKeyFromEnv(normalizedProvider)) return 'env';\n\n    return null;\n  }\n\n  /**\n   * List all available credential profiles\n   */\n  async listProfiles(): Promise<Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }>> {\n    const profiles: Array<ApiKeyProfile & { id: string; source: 'agent' | 'global' }> = [];\n\n    // Global profiles\n    const globalProfiles = await this.loadAuthProfilesFile();\n    for (const [id, profile] of Object.entries(globalProfiles.profiles)) {\n      profiles.push({ ...profile, id, source: 'global' });\n    }\n\n    // Agent private profiles\n    if (this.agentId) {\n      const agentProfiles = await this.loadAgentAuthProfilesFile();\n      for (const [id, profile] of Object.entries(agentProfiles.profiles)) {\n        profiles.push({ ...profile, id, source: 'agent' });\n      }\n    }\n\n    return profiles;\n  }\n\n  /**\n   * Plaintext API key from global auth profiles only (no env/oauth fallback).\n   * Used by the gateway console reveal endpoint.\n   */\n  async revealGatewayStoredApiKey(provider: string): Promise<string | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, normalizedProvider);\n    const key = profile?.key?.trim();\n    return key || null;\n  }\n\n  /**\n   * Save an API key profile\n   */\n  async saveApiKey(\n    provider: string,\n    key: string,\n    options: {\n      profileName?: string;\n      envVar?: string | null;\n      agentPrivate?: boolean;\n    } = {}\n  ): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const profileId = options.profileName\n      ? `${normalizedProvider}:${options.profileName}`\n      : `${normalizedProvider}:default`;\n\n    const profile: ApiKeyProfile = {\n      type: 'api_key',\n      provider: normalizedProvider,\n      profileName: options.profileName,\n      envVar: options.envVar ?? null,\n      key,\n    };\n\n    if (options.agentPrivate && this.agentId) {\n      await this.saveAgentAuthProfile(profileId, profile);\n    } else {\n      await this.saveGlobalAuthProfile(profileId, profile);\n    }\n\n    log.info({ provider, profileId, agentPrivate: options.agentPrivate }, 'Saved API key');\n  }\n\n  /**\n   * Delete a credential profile\n   */\n  async deleteProfile(profileId: string, options: { agentPrivate?: boolean } = {}): Promise<void> {\n    if (options.agentPrivate && this.agentId) {\n      await this.deleteAgentAuthProfile(profileId);\n    } else {\n      await this.deleteGlobalAuthProfile(profileId);\n    }\n\n    log.info({ profileId, agentPrivate: options.agentPrivate }, 'Deleted credential profile');\n  }\n\n  /**\n   * Load OAuth token for a provider.\n   */\n  async loadOAuthToken(provider: string): Promise<OAuthToken | null> {\n    const token = await this.loadOAuthTokenRecord(provider);\n    if (!token) return null;\n\n    if (token.expiresAt && token.expiresAt < Date.now()) {\n      log.warn({ provider, expiresAt: token.expiresAt }, 'OAuth token is expired');\n      return null;\n    }\n\n    return token;\n  }\n\n  /**\n   * Load the raw OAuth token record, including expired tokens for status UIs.\n   */\n  async loadOAuthTokenRecord(provider: string): Promise<OAuthToken | null> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    try {\n      const content = await readFile(oauthPath, 'utf-8');\n      const token = JSON.parse(content) as OAuthToken;\n      return token.provider === normalizedProvider ? token : null;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Save OAuth token for a provider.\n   */\n  async saveOAuthToken(provider: string, token: Omit<OAuthToken, 'type' | 'provider' | 'updatedAt'>): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n\n    await mkdir(dirname(oauthPath), { recursive: true });\n\n    const fullToken: OAuthToken = {\n      ...token,\n      type: 'oauth',\n      provider: normalizedProvider,\n      updatedAt: new Date().toISOString(),\n    };\n\n    await writeTextAtomic(oauthPath, JSON.stringify(fullToken, null, 2));\n    log.info({ provider: normalizedProvider }, 'Saved OAuth token');\n  }\n\n  /**\n   * Delete the OAuth token persisted for a provider.\n   */\n  async deleteOAuthToken(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    const oauthPath = resolveOAuthPath(normalizedProvider);\n    await rm(oauthPath, { force: true });\n    log.info({ provider: normalizedProvider }, 'Deleted OAuth token');\n  }\n\n  /**\n   * Disconnect the default credential for a provider from local storage.\n   */\n  async deleteProviderCredential(provider: string): Promise<void> {\n    const normalizedProvider = provider.toLowerCase();\n    await this.deleteProfile(`${normalizedProvider}:default`);\n    await this.deleteOAuthToken(normalizedProvider);\n  }\n\n  // ============================================\n  // Private Methods\n  // ============================================\n\n  private async loadFromAgentCredentials(provider: string): Promise<string | null> {\n    if (!this.agentId) return null;\n\n    const profiles = await this.loadAgentAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private async loadFromGlobalCredentials(provider: string): Promise<string | null> {\n    const profiles = await this.loadAuthProfilesFile();\n    const profile = this.findProfileForProvider(profiles, provider);\n\n    if (!profile) return null;\n    if (profile.envVar) return this.loadFromEnv(profile.envVar) ?? profile.key;\n    return profile.key;\n  }\n\n  private loadFromEnv(envVarName: string): string | null {\n    return process.env[envVarName] || null;\n  }\n\n  private findProfileForProvider(\n    file: AuthProfilesFile,\n    provider: string\n  ): ApiKeyProfile | null {\n    const normalizedProvider = provider.toLowerCase();\n\n    // Look for exact match first\n    for (const [, profile] of Object.entries(file.profiles)) {\n      if (profile.provider === normalizedProvider) {\n        return profile;\n      }\n    }\n\n    return null;\n  }\n\n  private async loadAuthProfilesFile(): Promise<AuthProfilesFile> {\n    const path = resolveAuthProfilesPath();\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async loadAgentAuthProfilesFile(): Promise<AuthProfilesFile> {\n    if (!this.agentId || !this.appConfig) return { version: 2, profiles: {} };\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n\n    try {\n      const content = await readFile(path, 'utf-8');\n      const data = JSON.parse(content);\n      return {\n        version: data.version || 1,\n        profiles: data.profiles || {},\n      };\n    } catch {\n      return { version: 2, profiles: {} };\n    }\n  }\n\n  private async saveGlobalAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async saveAgentAuthProfile(profileId: string, profile: ApiKeyProfile): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    await mkdir(dirname(path), { recursive: true });\n\n    const file = await this.loadAgentAuthProfilesFile();\n    file.profiles[profileId] = profile;\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteGlobalAuthProfile(profileId: string): Promise<void> {\n    const path = resolveAuthProfilesPath();\n    const file = await this.loadAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n\n  private async deleteAgentAuthProfile(profileId: string): Promise<void> {\n    if (!this.agentId || !this.appConfig) throw new Error('Agent ID and appConfig required for agent-private profiles');\n\n    const path = resolveAgentAuthProfilesPath(this.appConfig, this.agentId);\n    const file = await this.loadAgentAuthProfilesFile();\n\n    delete file.profiles[profileId];\n\n    await writeTextAtomic(path, JSON.stringify(file, null, 2));\n  }\n}\n\n// ============================================\n// Convenience Functions\n// ============================================\n\nlet defaultResolver: CredentialResolver | null = null;\n\nexport function getCredentialResolver(options?: CredentialResolverOptions): CredentialResolver {\n  if (!defaultResolver || options) {\n    return new CredentialResolver(options);\n  }\n  return defaultResolver;\n}\n\nexport async function resolveApiKey(provider: string, options?: CredentialResolverOptions): Promise<string | null> {\n  const resolver = getCredentialResolver(options);\n  return resolver.resolveApiKey(provider);\n}\n\nexport async function hasCredentials(provider: string, options?: CredentialResolverOptions): Promise<boolean> {\n  const resolver = getCredentialResolver(options);\n  return resolver.hasCredentials(provider);\n}\n"],"mappings":";;;;;;;;;AAwaA,SAAgB,sBAAsB,SAAyD;AAE3F,QAAO,IAAI,mBAAmB,QAAQ;;AAK1C,eAAsB,cAAc,UAAkB,SAA6D;AAEjH,QADiB,sBAAsB,QACxB,CAAC,cAAc,SAAS;;AAGzC,eAAsB,eAAe,UAAkB,SAAuD;AAE5G,QADiB,sBAAsB,QACxB,CAAC,eAAe,SAAS;;;;yBArbsB;cAEd;gBACU;aAMhC;AAGtB,OAAM,aAAa,cAAc;AA8C1B,sBAAb,MAAgC;EAC9B;EACA;EACA;EAEA,YAAY,UAAqC,EAAE,EAAE;AACnD,QAAK,iBAAiB,QAAQ,WAC1B,KAAK,QAAQ,UAAU,cAAc,GACrC,uBAAuB;AAC3B,QAAK,UAAU,QAAQ;AACvB,QAAK,YAAY,QAAQ;AACzB,OAAI,KAAK,WAAW,CAAC,KAAK,UACxB,OAAM,IAAI,MAAM,gEAAgE;;;;;;EAQpF,MAAM,cAAc,UAA0C;GAC5D,MAAM,qBAAqB,SAAS,aAAa;AAGjD,OAAI,KAAK,SAAS;IAChB,MAAM,WAAW,MAAM,KAAK,yBAAyB,mBAAmB;AACxE,QAAI,UAAU;AACZ,SAAI,MAAM;MAAE;MAAU,QAAQ;MAAS,EAAE,0CAA0C;AACnF,YAAO;;;GAKX,MAAM,YAAY,MAAM,KAAK,0BAA0B,mBAAmB;AAC1E,OAAI,WAAW;AACb,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAU,EAAE,2CAA2C;AACrF,WAAO;;GAIT,MAAM,aAAa,MAAM,KAAK,eAAe,mBAAmB;AAChE,OAAI,YAAY;AACd,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAS,EAAE,oCAAoC;AAC7E,WAAO,WAAW;;GAIpB,MAAM,SAAS,iBAAiB,mBAAmB;AACnD,OAAI,QAAQ;AACV,QAAI,MAAM;KAAE;KAAU,QAAQ;KAAO,EAAE,oCAAoC;AAC3E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,eAAe,UAAoC;AAEvD,UAAO,MADW,KAAK,cAAc,SAAS,KAC/B;;;;;EAMjB,MAAM,oBACJ,UACsD;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,OAAI,KAAK;QAEH,MADmB,KAAK,yBAAyB,mBAAmB,CAC1D,QAAO;;AAIvB,OAAI,MADoB,KAAK,0BAA0B,mBAAmB,CAC3D,QAAO;AAGtB,OAAI,MADqB,KAAK,eAAe,mBAAmB,CAChD,QAAO;AAEvB,OAAI,iBAAiB,mBAAmB,CAAE,QAAO;AAEjD,UAAO;;;;;EAMT,MAAM,eAA2F;GAC/F,MAAM,WAA8E,EAAE;GAGtF,MAAM,iBAAiB,MAAM,KAAK,sBAAsB;AACxD,QAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,eAAe,SAAS,CACjE,UAAS,KAAK;IAAE,GAAG;IAAS;IAAI,QAAQ;IAAU,CAAC;AAIrD,OAAI,KAAK,SAAS;IAChB,MAAM,gBAAgB,MAAM,KAAK,2BAA2B;AAC5D,SAAK,MAAM,CAAC,IAAI,YAAY,OAAO,QAAQ,cAAc,SAAS,CAChE,UAAS,KAAK;KAAE,GAAG;KAAS;KAAI,QAAQ;KAAS,CAAC;;AAItD,UAAO;;;;;;EAOT,MAAM,0BAA0B,UAA0C;GACxE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,WAAW,MAAM,KAAK,sBAAsB;AAGlD,UAFgB,KAAK,uBAAuB,UAAU,mBACnC,EAAE,KAAK,MAAM,IAClB;;;;;EAMhB,MAAM,WACJ,UACA,KACA,UAII,EAAE,EACS;GACf,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,QAAQ,cACtB,GAAG,mBAAmB,GAAG,QAAQ,gBACjC,GAAG,mBAAmB;GAE1B,MAAM,UAAyB;IAC7B,MAAM;IACN,UAAU;IACV,aAAa,QAAQ;IACrB,QAAQ,QAAQ,UAAU;IAC1B;IACD;AAED,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,qBAAqB,WAAW,QAAQ;OAEnD,OAAM,KAAK,sBAAsB,WAAW,QAAQ;AAGtD,OAAI,KAAK;IAAE;IAAU;IAAW,cAAc,QAAQ;IAAc,EAAE,gBAAgB;;;;;EAMxF,MAAM,cAAc,WAAmB,UAAsC,EAAE,EAAiB;AAC9F,OAAI,QAAQ,gBAAgB,KAAK,QAC/B,OAAM,KAAK,uBAAuB,UAAU;OAE5C,OAAM,KAAK,wBAAwB,UAAU;AAG/C,OAAI,KAAK;IAAE;IAAW,cAAc,QAAQ;IAAc,EAAE,6BAA6B;;;;;EAM3F,MAAM,eAAe,UAA8C;GACjE,MAAM,QAAQ,MAAM,KAAK,qBAAqB,SAAS;AACvD,OAAI,CAAC,MAAO,QAAO;AAEnB,OAAI,MAAM,aAAa,MAAM,YAAY,KAAK,KAAK,EAAE;AACnD,QAAI,KAAK;KAAE;KAAU,WAAW,MAAM;KAAW,EAAE,yBAAyB;AAC5E,WAAO;;AAGT,UAAO;;;;;EAMT,MAAM,qBAAqB,UAA8C;GACvE,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,WAAW,QAAQ;IAClD,MAAM,QAAQ,KAAK,MAAM,QAAQ;AACjC,WAAO,MAAM,aAAa,qBAAqB,QAAQ;WACjD;AACN,WAAO;;;;;;EAOX,MAAM,eAAe,UAAkB,OAA2E;GAChH,MAAM,qBAAqB,SAAS,aAAa;GACjD,MAAM,YAAY,iBAAiB,mBAAmB;AAEtD,SAAM,MAAM,QAAQ,UAAU,EAAE,EAAE,WAAW,MAAM,CAAC;GAEpD,MAAM,YAAwB;IAC5B,GAAG;IACH,MAAM;IACN,UAAU;IACV,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,SAAM,gBAAgB,WAAW,KAAK,UAAU,WAAW,MAAM,EAAE,CAAC;AACpE,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,oBAAoB;;;;;EAMjE,MAAM,iBAAiB,UAAiC;GACtD,MAAM,qBAAqB,SAAS,aAAa;AAEjD,SAAM,GADY,iBAAiB,mBACjB,EAAE,EAAE,OAAO,MAAM,CAAC;AACpC,OAAI,KAAK,EAAE,UAAU,oBAAoB,EAAE,sBAAsB;;;;;EAMnE,MAAM,yBAAyB,UAAiC;GAC9D,MAAM,qBAAqB,SAAS,aAAa;AACjD,SAAM,KAAK,cAAc,GAAG,mBAAmB,UAAU;AACzD,SAAM,KAAK,iBAAiB,mBAAmB;;EAOjD,MAAc,yBAAyB,UAA0C;AAC/E,OAAI,CAAC,KAAK,QAAS,QAAO;GAE1B,MAAM,WAAW,MAAM,KAAK,2BAA2B;GACvD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,MAAc,0BAA0B,UAA0C;GAChF,MAAM,WAAW,MAAM,KAAK,sBAAsB;GAClD,MAAM,UAAU,KAAK,uBAAuB,UAAU,SAAS;AAE/D,OAAI,CAAC,QAAS,QAAO;AACrB,OAAI,QAAQ,OAAQ,QAAO,KAAK,YAAY,QAAQ,OAAO,IAAI,QAAQ;AACvE,UAAO,QAAQ;;EAGjB,YAAoB,YAAmC;AACrD,UAAO,QAAQ,IAAI,eAAe;;EAGpC,uBACE,MACA,UACsB;GACtB,MAAM,qBAAqB,SAAS,aAAa;AAGjD,QAAK,MAAM,GAAG,YAAY,OAAO,QAAQ,KAAK,SAAS,CACrD,KAAI,QAAQ,aAAa,mBACvB,QAAO;AAIX,UAAO;;EAGT,MAAc,uBAAkD;GAC9D,MAAM,OAAO,yBAAyB;AAEtC,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,4BAAuD;AACnE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,QAAO;IAAE,SAAS;IAAG,UAAU,EAAE;IAAE;GAEzE,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AAEvE,OAAI;IACF,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;IAC7C,MAAM,OAAO,KAAK,MAAM,QAAQ;AAChC,WAAO;KACL,SAAS,KAAK,WAAW;KACzB,UAAU,KAAK,YAAY,EAAE;KAC9B;WACK;AACN,WAAO;KAAE,SAAS;KAAG,UAAU,EAAE;KAAE;;;EAIvC,MAAc,sBAAsB,WAAmB,SAAuC;GAC5F,MAAM,OAAO,yBAAyB;AACtC,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAC9C,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,qBAAqB,WAAmB,SAAuC;AAC3F,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;AACvE,SAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;GAE/C,MAAM,OAAO,MAAM,KAAK,2BAA2B;AACnD,QAAK,SAAS,aAAa;AAE3B,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,wBAAwB,WAAkC;GACtE,MAAM,OAAO,yBAAyB;GACtC,MAAM,OAAO,MAAM,KAAK,sBAAsB;AAE9C,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;;EAG5D,MAAc,uBAAuB,WAAkC;AACrE,OAAI,CAAC,KAAK,WAAW,CAAC,KAAK,UAAW,OAAM,IAAI,MAAM,6DAA6D;GAEnH,MAAM,OAAO,6BAA6B,KAAK,WAAW,KAAK,QAAQ;GACvE,MAAM,OAAO,MAAM,KAAK,2BAA2B;AAEnD,UAAO,KAAK,SAAS;AAErB,SAAM,gBAAgB,MAAM,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC"}

package/dist/src/channels/attachments/attachment-classifiers.d.ts

@@ -0,0 +1,8 @@
+export declare function isImageInboundAttachment(att: {
+    type?: string;
+    mimeType?: string;
+}): boolean;
+export declare function isVoiceInboundAttachment(att: {
+    type?: string;
+    mimeType?: string;
+}): boolean;

package/dist/src/channels/attachments/attachment-classifiers.js

@@ -0,0 +1,11 @@
+//#region src/channels/attachments/attachment-classifiers.ts
+function isImageInboundAttachment(att) {
+	return att.type === "image" || att.type === "photo" || att.mimeType?.startsWith("image/") === true;
+}
+function isVoiceInboundAttachment(att) {
+	return att.type === "voice" || att.type === "audio" || att.mimeType?.startsWith("audio/") === true;
+}
+//#endregion
+export { isImageInboundAttachment, isVoiceInboundAttachment };
+
+//# sourceMappingURL=attachment-classifiers.js.map

package/dist/src/channels/attachments/attachment-classifiers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-classifiers.js","names":[],"sources":["../../../../src/channels/attachments/attachment-classifiers.ts"],"sourcesContent":["export function isImageInboundAttachment(att: {\n  type?: string;\n  mimeType?: string;\n}): boolean {\n  return (\n    att.type === 'image' ||\n    att.type === 'photo' ||\n    att.mimeType?.startsWith('image/') === true\n  );\n}\n\nexport function isVoiceInboundAttachment(att: { type?: string; mimeType?: string }): boolean {\n  return (\n    att.type === 'voice' ||\n    att.type === 'audio' ||\n    att.mimeType?.startsWith('audio/') === true\n  );\n}\n"],"mappings":";AAAA,SAAgB,yBAAyB,KAG7B;AACV,QACE,IAAI,SAAS,WACb,IAAI,SAAS,WACb,IAAI,UAAU,WAAW,SAAS,KAAK;;AAI3C,SAAgB,yBAAyB,KAAoD;AAC3F,QACE,IAAI,SAAS,WACb,IAAI,SAAS,WACb,IAAI,UAAU,WAAW,SAAS,KAAK"}

package/dist/src/channels/attachments/inbound-persist.d.ts

@@ -1,39 +1,18 @@
 /**
- * Persist inbound channel / Web UI uploads under the agent home dir so the markdown
- * workspace stays user-visible; session transcripts reference stable relative paths.
+ * Persist inbound uploads to the global media store (`{stateDir}/media/inbound/`).
  */
-/** New layout: `<agentHome>/inbound/<session>/` — rel paths use this prefix. */
-export declare const INBOUND_REL_ROOT = "inbound";
-export interface InboundAttachmentInput {
-    type: string;
-    mimeType?: string;
-    data?: string;
-    name?: string;
-    size?: number;
-    /** Set after persist (relative to agent home). */
-    workspaceRelativePath?: string;
-}
-export type InternalAttachmentRoots = {
-    /** `…/agents/<id>/` — primary storage */
-    agentHome: string;
-};
-/** Decode base64 or data-URL payload for inbound attachments (also used by voice STT). */
+import type { InboundAttachmentInput, MediaRef } from '../../media/types.js';
+export type { InboundAttachmentInput, MediaRef } from '../../media/types.js';
+export { isImageInboundAttachment, isVoiceInboundAttachment } from './attachment-classifiers.js';
+export { toMediaRef, mediaRefFromUri } from './inbound-types.js';
+/** Decode base64 or data-URL payload (composer wire + voice STT). */
 export declare function decodeInboundAttachmentBase64(data: string): Buffer;
 /**
- * Write non-image attachments with binary data to disk; returns a shallow copy
- * of each attachment with `workspaceRelativePath` set (POSIX-style, `/` separators).
+ * Write attachments with binary `data` to the media store; returns metadata-only refs.
  */
-export declare function persistInboundAttachmentsToWorkspace(agentHomeRoot: string, sessionKey: string, attachments: InboundAttachmentInput[] | undefined): Promise<InboundAttachmentInput[] | undefined>;
-/**
- * Build transcript text for a non-image file for the LLM (includes machine-readable path lines).
- */
-export declare function formatInboundFileTextBlock(att: InboundAttachmentInput, storageRootAbs: string): string;
-/**
- * Remove inbound file transcript blocks from a string (e.g. auto session titles).
- * Matches Web UI `stripInboundFileMachineText`, plus bare `[File: …]` lines when paths are absent.
- */
-export declare function stripInboundFileMetadataFromText(text: string): string;
-/**
- * Resolve a stored relative path under `inbound/`.
- */
-export declare function resolveSafeInboundFilePath(roots: InternalAttachmentRoots, relRaw: string): string | null;
+export declare function persistInboundAttachments(attachments: InboundAttachmentInput[] | undefined, opts?: {
+    maxBytes?: number;
+}): Promise<MediaRef[] | undefined>;
+/** Read attachment bytes by media URI (voice STT, tools). */
+export declare function readInboundAttachmentBuffer(uri: string): Promise<Buffer>;
+export declare function assertMediaUri(uri: string): void;

package/dist/src/channels/attachments/inbound-persist.js

@@ -1,125 +1,57 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
-import { join, resolve } from "path";
-import { mkdir, writeFile } from "fs/promises";
-import { randomBytes } from "crypto";
+import { parseMediaUri } from "../../media/uri.js";
+import { saveMediaBuffer } from "../../media/store.js";
+import { readMediaReference, resolveMediaReference } from "../../media/media-reference.js";
+import { isImageInboundAttachment, isVoiceInboundAttachment } from "./attachment-classifiers.js";
+import { mediaRefFromUri, toMediaRef } from "./inbound-types.js";
 //#region src/channels/attachments/inbound-persist.ts
-/**
-* Persist inbound channel / Web UI uploads under the agent home dir so the markdown
-* workspace stays user-visible; session transcripts reference stable relative paths.
-*/
 init_logger();
 const log = createLogger("InboundPersist");
-/** New layout: `<agentHome>/inbound/<session>/` — rel paths use this prefix. */
-const INBOUND_REL_ROOT = "inbound";
-function sanitizeSessionSegment(sessionKey) {
-	return sessionKey.replace(/[^a-zA-Z0-9_.-]+/g, "_").slice(0, 180) || "session";
-}
-function sanitizeFilename(name) {
-	return (name.replace(/[/\\?%*:|"<>]/g, "_").trim() || "file").slice(0, 200);
-}
-function isImageAttachment(att) {
-	return att.type === "image" || att.type === "photo" || att.mimeType?.startsWith("image/") === true;
-}
-/** Decode base64 or data-URL payload for inbound attachments (also used by voice STT). */
+/** Decode base64 or data-URL payload (composer wire + voice STT). */
 function decodeInboundAttachmentBase64(data) {
 	const trimmed = data.trim();
 	const b64 = trimmed.startsWith("data:") ? trimmed.split(/base64,/)[1] ?? trimmed : trimmed;
 	return Buffer.from(b64.replace(/\s/g, ""), "base64");
 }
-function resolveUnderRoot(root, rel, requiredPrefix) {
-	const normalized = rel.replace(/\\/g, "/").replace(/^\/+/, "");
-	if (normalized.includes("..") || !normalized.startsWith(requiredPrefix)) return null;
-	const abs = resolve(root, ...normalized.split("/"));
-	const rootResolved = resolve(root);
-	if (!abs.startsWith(rootResolved)) return null;
-	return abs;
-}
 /**
-* Write non-image attachments with binary data to disk; returns a shallow copy
-* of each attachment with `workspaceRelativePath` set (POSIX-style, `/` separators).
+* Write attachments with binary `data` to the media store; returns metadata-only refs.
 */
-async function persistInboundAttachmentsToWorkspace(agentHomeRoot, sessionKey, attachments) {
-	if (!attachments?.length) return attachments;
-	const sessionSeg = sanitizeSessionSegment(sessionKey);
-	const inboundAbs = resolve(agentHomeRoot, INBOUND_REL_ROOT, sessionSeg);
-	await mkdir(inboundAbs, { recursive: true });
+async function persistInboundAttachments(attachments, opts) {
+	if (!attachments?.length) return void 0;
+	const maxBytes = opts?.maxBytes ?? 5242880;
 	const out = [];
 	for (const att of attachments) {
-		if (att.workspaceRelativePath) {
-			out.push({ ...att });
-			continue;
-		}
-		if (isImageAttachment(att)) {
-			out.push({ ...att });
-			continue;
-		}
-		if (!att.data || att.data.length === 0) {
-			out.push({ ...att });
+		if (att.uri?.trim()) {
+			const resolved = await resolveMediaReference(att.uri.trim());
+			out.push(mediaRefFromUri(att, resolved.uri, resolved.path, resolved.bucket, resolved.id));
 			continue;
 		}
-		try {
-			const buf = decodeInboundAttachmentBase64(att.data);
-			const fname = `${randomBytes(8).toString("hex")}_${sanitizeFilename(att.name || "file")}`;
-			await writeFile(join(inboundAbs, fname), buf);
-			const workspaceRelativePath = [
-				INBOUND_REL_ROOT,
-				sessionSeg,
-				fname
-			].join("/");
-			log.debug({
-				sessionKey,
-				workspaceRelativePath,
-				bytes: buf.length
-			}, "Inbound file persisted");
-			out.push({
-				...att,
-				workspaceRelativePath,
-				size: att.size ?? buf.length
-			});
-		} catch (err) {
-			log.warn({
-				err,
-				sessionKey,
-				name: att.name
-			}, "Failed to persist inbound attachment");
-			out.push({ ...att });
-		}
+		if (!att.data || att.data.length === 0) throw new Error(`Inbound attachment "${att.name ?? "file"}" is missing data and uri`);
+		const saved = await saveMediaBuffer(decodeInboundAttachmentBase64(att.data), {
+			contentType: att.mimeType,
+			bucket: "inbound",
+			maxBytes,
+			originalFilename: att.name
+		});
+		log.debug({
+			uri: saved.uri,
+			bytes: saved.size,
+			name: att.name
+		}, "Inbound attachment persisted");
+		out.push(toMediaRef(att, saved));
 	}
-	return out;
+	return out.length ? out : void 0;
 }
-/**
-* Build transcript text for a non-image file for the LLM (includes machine-readable path lines).
-*/
-function formatInboundFileTextBlock(att, storageRootAbs) {
-	const head = `[File: ${att.name || "unknown"} (${att.mimeType || "unknown type"}, ${att.size ?? 0} bytes)]`;
-	if (!att.workspaceRelativePath) return head;
-	const rel = att.workspaceRelativePath.replace(/\\/g, "/");
-	return `${head}\nxopc-path:rel:${rel}\nxopc-path:abs:${resolve(storageRootAbs, ...rel.split("/").filter(Boolean))}`;
+/** Read attachment bytes by media URI (voice STT, tools). */
+async function readInboundAttachmentBuffer(uri) {
+	const { buffer } = await readMediaReference(uri);
+	return buffer;
 }
-/**
-* Remove inbound file transcript blocks from a string (e.g. auto session titles).
-* Matches Web UI `stripInboundFileMachineText`, plus bare `[File: …]` lines when paths are absent.
-*/
-function stripInboundFileMetadataFromText(text) {
-	if (!text.includes("[File:") && !text.includes("xopc-path:")) return text;
-	let out = text;
-	out = out.replace(/\s*\[File:[^\]]+\]\s*\r?\nxopc-path:rel:[^\r\n]+\r?\n\s*xopc-path:abs:[^\r\n]+/g, "");
-	out = out.replace(/\s*\[File:[^\]]+\]\s+xopc-path:rel:\S+\s+xopc-path:abs:\S+/g, "");
-	out = out.replace(/\s*\[File:[^\]]+\]\s*xopc-path:rel:\S+\s*xopc-path:abs:\S+/g, "");
-	out = out.replace(/\s*\[File:[^\]]+\]\s*/g, " ");
-	return out.replace(/\n{3,}/g, "\n\n").replace(/\s{2,}/g, " ").trim();
-}
-/**
-* Resolve a stored relative path under `inbound/`.
-*/
-function resolveSafeInboundFilePath(roots, relRaw) {
-	const rel = relRaw.replace(/\\/g, "/").replace(/^\/+/, "");
-	if (rel.includes("..")) return null;
-	if (rel.startsWith(`inbound/`)) return resolveUnderRoot(roots.agentHome, rel, `${INBOUND_REL_ROOT}/`);
-	return null;
+function assertMediaUri(uri) {
+	parseMediaUri(uri);
 }
 //#endregion
-export { INBOUND_REL_ROOT, decodeInboundAttachmentBase64, formatInboundFileTextBlock, persistInboundAttachmentsToWorkspace, resolveSafeInboundFilePath, stripInboundFileMetadataFromText };
+export { assertMediaUri, decodeInboundAttachmentBase64, isImageInboundAttachment, isVoiceInboundAttachment, mediaRefFromUri, persistInboundAttachments, readInboundAttachmentBuffer, toMediaRef };
 
 //# sourceMappingURL=inbound-persist.js.map

package/dist/src/channels/attachments/inbound-persist.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound-persist.js","names":[],"sources":["../../../../src/channels/attachments/inbound-persist.ts"],"sourcesContent":["/**\n * Persist inbound channel / Web UI uploads under the agent home dir so the markdown\n * workspace stays user-visible; session transcripts reference stable relative paths.\n */\n\nimport { mkdir, writeFile } from 'fs/promises';\nimport { join, resolve } from 'path';\nimport { randomBytes } from 'crypto';\nimport { createLogger } from '../../utils/logger.js';\nconst log = createLogger('InboundPersist');\n\n/** New layout: `<agentHome>/inbound/<session>/` — rel paths use this prefix. */\nexport const INBOUND_REL_ROOT = 'inbound';\n\nexport interface InboundAttachmentInput {\n  type: string;\n  mimeType?: string;\n  data?: string;\n  name?: string;\n  size?: number;\n  /** Set after persist (relative to agent home). */\n  workspaceRelativePath?: string;\n}\n\nexport type InternalAttachmentRoots = {\n  /** `…/agents/<id>/` — primary storage */\n  agentHome: string;\n};\n\nfunction sanitizeSessionSegment(sessionKey: string): string {\n  return sessionKey.replace(/[^a-zA-Z0-9_.-]+/g, '_').slice(0, 180) || 'session';\n}\n\nfunction sanitizeFilename(name: string): string {\n  const base = name.replace(/[/\\\\?%*:|\"<>]/g, '_').trim() || 'file';\n  return base.slice(0, 200);\n}\n\nfunction isImageAttachment(att: InboundAttachmentInput): boolean {\n  return att.type === 'image' || att.type === 'photo' || att.mimeType?.startsWith('image/') === true;\n}\n\n/** Decode base64 or data-URL payload for inbound attachments (also used by voice STT). */\nexport function decodeInboundAttachmentBase64(data: string): Buffer {\n  const trimmed = data.trim();\n  const b64 = trimmed.startsWith('data:') ? (trimmed.split(/base64,/)[1] ?? trimmed) : trimmed;\n  return Buffer.from(b64.replace(/\\s/g, ''), 'base64');\n}\n\nfunction resolveUnderRoot(root: string, rel: string, requiredPrefix: string): string | null {\n  const normalized = rel.replace(/\\\\/g, '/').replace(/^\\/+/, '');\n  if (normalized.includes('..') || !normalized.startsWith(requiredPrefix)) {\n    return null;\n  }\n  const abs = resolve(root, ...normalized.split('/'));\n  const rootResolved = resolve(root);\n  if (!abs.startsWith(rootResolved)) {\n    return null;\n  }\n  return abs;\n}\n\n/**\n * Write non-image attachments with binary data to disk; returns a shallow copy\n * of each attachment with `workspaceRelativePath` set (POSIX-style, `/` separators).\n */\nexport async function persistInboundAttachmentsToWorkspace(\n  agentHomeRoot: string,\n  sessionKey: string,\n  attachments: InboundAttachmentInput[] | undefined,\n): Promise<InboundAttachmentInput[] | undefined> {\n  if (!attachments?.length) return attachments;\n\n  const sessionSeg = sanitizeSessionSegment(sessionKey);\n  const inboundAbs = resolve(agentHomeRoot, INBOUND_REL_ROOT, sessionSeg);\n  await mkdir(inboundAbs, { recursive: true });\n\n  const out: InboundAttachmentInput[] = [];\n\n  for (const att of attachments) {\n    if (att.workspaceRelativePath) {\n      out.push({ ...att });\n      continue;\n    }\n    if (isImageAttachment(att)) {\n      out.push({ ...att });\n      continue;\n    }\n    if (!att.data || att.data.length === 0) {\n      out.push({ ...att });\n      continue;\n    }\n\n    try {\n      const buf = decodeInboundAttachmentBase64(att.data);\n      const id = randomBytes(8).toString('hex');\n      const fname = `${id}_${sanitizeFilename(att.name || 'file')}`;\n      const absFile = join(inboundAbs, fname);\n      await writeFile(absFile, buf);\n\n      const workspaceRelativePath = [INBOUND_REL_ROOT, sessionSeg, fname].join('/');\n\n      log.debug({ sessionKey, workspaceRelativePath, bytes: buf.length }, 'Inbound file persisted');\n\n      out.push({\n        ...att,\n        workspaceRelativePath,\n        size: att.size ?? buf.length,\n      });\n    } catch (err) {\n      log.warn({ err, sessionKey, name: att.name }, 'Failed to persist inbound attachment');\n      out.push({ ...att });\n    }\n  }\n\n  return out;\n}\n\n/**\n * Build transcript text for a non-image file for the LLM (includes machine-readable path lines).\n */\nexport function formatInboundFileTextBlock(\n  att: InboundAttachmentInput,\n  storageRootAbs: string,\n): string {\n  const name = att.name || 'unknown';\n  const mime = att.mimeType || 'unknown type';\n  const size = att.size ?? 0;\n  const head = `[File: ${name} (${mime}, ${size} bytes)]`;\n  if (!att.workspaceRelativePath) {\n    return head;\n  }\n  const rel = att.workspaceRelativePath.replace(/\\\\/g, '/');\n  const abs = resolve(storageRootAbs, ...rel.split('/').filter(Boolean));\n  return `${head}\\nxopc-path:rel:${rel}\\nxopc-path:abs:${abs}`;\n}\n\n/**\n * Remove inbound file transcript blocks from a string (e.g. auto session titles).\n * Matches Web UI `stripInboundFileMachineText`, plus bare `[File: …]` lines when paths are absent.\n */\nexport function stripInboundFileMetadataFromText(text: string): string {\n  if (!text.includes('[File:') && !text.includes('xopc-path:')) return text;\n  let out = text;\n  out = out.replace(\n    /\\s*\\[File:[^\\]]+\\]\\s*\\r?\\nxopc-path:rel:[^\\r\\n]+\\r?\\n\\s*xopc-path:abs:[^\\r\\n]+/g,\n    '',\n  );\n  out = out.replace(/\\s*\\[File:[^\\]]+\\]\\s+xopc-path:rel:\\S+\\s+xopc-path:abs:\\S+/g, '');\n  out = out.replace(/\\s*\\[File:[^\\]]+\\]\\s*xopc-path:rel:\\S+\\s*xopc-path:abs:\\S+/g, '');\n  out = out.replace(/\\s*\\[File:[^\\]]+\\]\\s*/g, ' ');\n  return out.replace(/\\n{3,}/g, '\\n\\n').replace(/\\s{2,}/g, ' ').trim();\n}\n\n/**\n * Resolve a stored relative path under `inbound/`.\n */\nexport function resolveSafeInboundFilePath(\n  roots: InternalAttachmentRoots,\n  relRaw: string,\n): string | null {\n  const rel = relRaw.replace(/\\\\/g, '/').replace(/^\\/+/, '');\n  if (rel.includes('..')) {\n    return null;\n  }\n\n  if (rel.startsWith(`${INBOUND_REL_ROOT}/`)) {\n    return resolveUnderRoot(roots.agentHome, rel, `${INBOUND_REL_ROOT}/`);\n  }\n\n  return null;\n}\n"],"mappings":";;;;;;;;;;aAQqD;AACrD,MAAM,MAAM,aAAa,iBAAiB;;AAG1C,MAAa,mBAAmB;AAiBhC,SAAS,uBAAuB,YAA4B;AAC1D,QAAO,WAAW,QAAQ,qBAAqB,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI;;AAGvE,SAAS,iBAAiB,MAAsB;AAE9C,SADa,KAAK,QAAQ,kBAAkB,IAAI,CAAC,MAAM,IAAI,QAC/C,MAAM,GAAG,IAAI;;AAG3B,SAAS,kBAAkB,KAAsC;AAC/D,QAAO,IAAI,SAAS,WAAW,IAAI,SAAS,WAAW,IAAI,UAAU,WAAW,SAAS,KAAK;;;AAIhG,SAAgB,8BAA8B,MAAsB;CAClE,MAAM,UAAU,KAAK,MAAM;CAC3B,MAAM,MAAM,QAAQ,WAAW,QAAQ,GAAI,QAAQ,MAAM,UAAU,CAAC,MAAM,UAAW;AACrF,QAAO,OAAO,KAAK,IAAI,QAAQ,OAAO,GAAG,EAAE,SAAS;;AAGtD,SAAS,iBAAiB,MAAc,KAAa,gBAAuC;CAC1F,MAAM,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC,QAAQ,QAAQ,GAAG;AAC9D,KAAI,WAAW,SAAS,KAAK,IAAI,CAAC,WAAW,WAAW,eAAe,CACrE,QAAO;CAET,MAAM,MAAM,QAAQ,MAAM,GAAG,WAAW,MAAM,IAAI,CAAC;CACnD,MAAM,eAAe,QAAQ,KAAK;AAClC,KAAI,CAAC,IAAI,WAAW,aAAa,CAC/B,QAAO;AAET,QAAO;;;;;;AAOT,eAAsB,qCACpB,eACA,YACA,aAC+C;AAC/C,KAAI,CAAC,aAAa,OAAQ,QAAO;CAEjC,MAAM,aAAa,uBAAuB,WAAW;CACrD,MAAM,aAAa,QAAQ,eAAe,kBAAkB,WAAW;AACvE,OAAM,MAAM,YAAY,EAAE,WAAW,MAAM,CAAC;CAE5C,MAAM,MAAgC,EAAE;AAExC,MAAK,MAAM,OAAO,aAAa;AAC7B,MAAI,IAAI,uBAAuB;AAC7B,OAAI,KAAK,EAAE,GAAG,KAAK,CAAC;AACpB;;AAEF,MAAI,kBAAkB,IAAI,EAAE;AAC1B,OAAI,KAAK,EAAE,GAAG,KAAK,CAAC;AACpB;;AAEF,MAAI,CAAC,IAAI,QAAQ,IAAI,KAAK,WAAW,GAAG;AACtC,OAAI,KAAK,EAAE,GAAG,KAAK,CAAC;AACpB;;AAGF,MAAI;GACF,MAAM,MAAM,8BAA8B,IAAI,KAAK;GAEnD,MAAM,QAAQ,GADH,YAAY,EAAE,CAAC,SAAS,MAChB,CAAC,GAAG,iBAAiB,IAAI,QAAQ,OAAO;AAE3D,SAAM,UADU,KAAK,YAAY,MACV,EAAE,IAAI;GAE7B,MAAM,wBAAwB;IAAC;IAAkB;IAAY;IAAM,CAAC,KAAK,IAAI;AAE7E,OAAI,MAAM;IAAE;IAAY;IAAuB,OAAO,IAAI;IAAQ,EAAE,yBAAyB;AAE7F,OAAI,KAAK;IACP,GAAG;IACH;IACA,MAAM,IAAI,QAAQ,IAAI;IACvB,CAAC;WACK,KAAK;AACZ,OAAI,KAAK;IAAE;IAAK;IAAY,MAAM,IAAI;IAAM,EAAE,uCAAuC;AACrF,OAAI,KAAK,EAAE,GAAG,KAAK,CAAC;;;AAIxB,QAAO;;;;;AAMT,SAAgB,2BACd,KACA,gBACQ;CAIR,MAAM,OAAO,UAHA,IAAI,QAAQ,UAGG,IAFf,IAAI,YAAY,eAEQ,IADxB,IAAI,QAAQ,EACqB;AAC9C,KAAI,CAAC,IAAI,sBACP,QAAO;CAET,MAAM,MAAM,IAAI,sBAAsB,QAAQ,OAAO,IAAI;AAEzD,QAAO,GAAG,KAAK,kBAAkB,IAAI,kBADzB,QAAQ,gBAAgB,GAAG,IAAI,MAAM,IAAI,CAAC,OAAO,QAAQ,CACX;;;;;;AAO5D,SAAgB,iCAAiC,MAAsB;AACrE,KAAI,CAAC,KAAK,SAAS,SAAS,IAAI,CAAC,KAAK,SAAS,aAAa,CAAE,QAAO;CACrE,IAAI,MAAM;AACV,OAAM,IAAI,QACR,mFACA,GACD;AACD,OAAM,IAAI,QAAQ,+DAA+D,GAAG;AACpF,OAAM,IAAI,QAAQ,+DAA+D,GAAG;AACpF,OAAM,IAAI,QAAQ,0BAA0B,IAAI;AAChD,QAAO,IAAI,QAAQ,WAAW,OAAO,CAAC,QAAQ,WAAW,IAAI,CAAC,MAAM;;;;;AAMtE,SAAgB,2BACd,OACA,QACe;CACf,MAAM,MAAM,OAAO,QAAQ,OAAO,IAAI,CAAC,QAAQ,QAAQ,GAAG;AAC1D,KAAI,IAAI,SAAS,KAAK,CACpB,QAAO;AAGT,KAAI,IAAI,WAAW,WAAuB,CACxC,QAAO,iBAAiB,MAAM,WAAW,KAAK,GAAG,iBAAiB,GAAG;AAGvE,QAAO"}
+{"version":3,"file":"inbound-persist.js","names":[],"sources":["../../../../src/channels/attachments/inbound-persist.ts"],"sourcesContent":["/**\n * Persist inbound uploads to the global media store (`{stateDir}/media/inbound/`).\n */\n\nimport { createLogger } from '../../utils/logger.js';\nimport {\n  MEDIA_MAX_BYTES,\n  parseMediaUri,\n  readMediaReference,\n  resolveMediaReference,\n  saveMediaBuffer,\n} from '../../media/index.js';\nimport type { InboundAttachmentInput, MediaRef } from '../../media/types.js';\nimport { mediaRefFromUri, toMediaRef } from './inbound-types.js';\n\nconst log = createLogger('InboundPersist');\n\nexport type { InboundAttachmentInput, MediaRef } from '../../media/types.js';\nexport { isImageInboundAttachment, isVoiceInboundAttachment } from './attachment-classifiers.js';\nexport { toMediaRef, mediaRefFromUri } from './inbound-types.js';\n\n/** Decode base64 or data-URL payload (composer wire + voice STT). */\nexport function decodeInboundAttachmentBase64(data: string): Buffer {\n  const trimmed = data.trim();\n  const b64 = trimmed.startsWith('data:') ? (trimmed.split(/base64,/)[1] ?? trimmed) : trimmed;\n  return Buffer.from(b64.replace(/\\s/g, ''), 'base64');\n}\n\n/**\n * Write attachments with binary `data` to the media store; returns metadata-only refs.\n */\nexport async function persistInboundAttachments(\n  attachments: InboundAttachmentInput[] | undefined,\n  opts?: { maxBytes?: number },\n): Promise<MediaRef[] | undefined> {\n  if (!attachments?.length) return undefined;\n\n  const maxBytes = opts?.maxBytes ?? MEDIA_MAX_BYTES;\n  const out: MediaRef[] = [];\n\n  for (const att of attachments) {\n    if (att.uri?.trim()) {\n      const resolved = await resolveMediaReference(att.uri.trim());\n      out.push(\n        mediaRefFromUri(att, resolved.uri, resolved.path, resolved.bucket, resolved.id),\n      );\n      continue;\n    }\n\n    if (!att.data || att.data.length === 0) {\n      throw new Error(`Inbound attachment \"${att.name ?? 'file'}\" is missing data and uri`);\n    }\n\n    const buf = decodeInboundAttachmentBase64(att.data);\n    const saved = await saveMediaBuffer(buf, {\n      contentType: att.mimeType,\n      bucket: 'inbound',\n      maxBytes,\n      originalFilename: att.name,\n    });\n\n    log.debug({ uri: saved.uri, bytes: saved.size, name: att.name }, 'Inbound attachment persisted');\n\n    out.push(toMediaRef(att, saved));\n  }\n\n  return out.length ? out : undefined;\n}\n\n/** Read attachment bytes by media URI (voice STT, tools). */\nexport async function readInboundAttachmentBuffer(uri: string): Promise<Buffer> {\n  const { buffer } = await readMediaReference(uri);\n  return buffer;\n}\n\nexport function assertMediaUri(uri: string): void {\n  parseMediaUri(uri);\n}\n"],"mappings":";;;;;;;;aAIqD;AAWrD,MAAM,MAAM,aAAa,iBAAiB;;AAO1C,SAAgB,8BAA8B,MAAsB;CAClE,MAAM,UAAU,KAAK,MAAM;CAC3B,MAAM,MAAM,QAAQ,WAAW,QAAQ,GAAI,QAAQ,MAAM,UAAU,CAAC,MAAM,UAAW;AACrF,QAAO,OAAO,KAAK,IAAI,QAAQ,OAAO,GAAG,EAAE,SAAS;;;;;AAMtD,eAAsB,0BACpB,aACA,MACiC;AACjC,KAAI,CAAC,aAAa,OAAQ,QAAO,KAAA;CAEjC,MAAM,WAAW,MAAM,YAAA;CACvB,MAAM,MAAkB,EAAE;AAE1B,MAAK,MAAM,OAAO,aAAa;AAC7B,MAAI,IAAI,KAAK,MAAM,EAAE;GACnB,MAAM,WAAW,MAAM,sBAAsB,IAAI,IAAI,MAAM,CAAC;AAC5D,OAAI,KACF,gBAAgB,KAAK,SAAS,KAAK,SAAS,MAAM,SAAS,QAAQ,SAAS,GAAG,CAChF;AACD;;AAGF,MAAI,CAAC,IAAI,QAAQ,IAAI,KAAK,WAAW,EACnC,OAAM,IAAI,MAAM,uBAAuB,IAAI,QAAQ,OAAO,2BAA2B;EAIvF,MAAM,QAAQ,MAAM,gBADR,8BAA8B,IAAI,KACP,EAAE;GACvC,aAAa,IAAI;GACjB,QAAQ;GACR;GACA,kBAAkB,IAAI;GACvB,CAAC;AAEF,MAAI,MAAM;GAAE,KAAK,MAAM;GAAK,OAAO,MAAM;GAAM,MAAM,IAAI;GAAM,EAAE,+BAA+B;AAEhG,MAAI,KAAK,WAAW,KAAK,MAAM,CAAC;;AAGlC,QAAO,IAAI,SAAS,MAAM,KAAA;;;AAI5B,eAAsB,4BAA4B,KAA8B;CAC9E,MAAM,EAAE,WAAW,MAAM,mBAAmB,IAAI;AAChD,QAAO;;AAGT,SAAgB,eAAe,KAAmB;AAChD,eAAc,IAAI"}

package/dist/src/channels/attachments/inbound-types.d.ts

@@ -0,0 +1,13 @@
+import type { InboundAttachmentInput, MediaRef } from '../../media/types.js';
+import { isImageInboundAttachment, isVoiceInboundAttachment } from './attachment-classifiers.js';
+export type { InboundAttachmentInput, MediaRef } from '../../media/types.js';
+export { isImageInboundAttachment, isVoiceInboundAttachment };
+export declare function toMediaRef(att: InboundAttachmentInput, saved: {
+    id: string;
+    bucket: MediaRef['bucket'];
+    uri: string;
+    path: string;
+    size: number;
+    contentType: string;
+}): MediaRef;
+export declare function mediaRefFromUri(att: InboundAttachmentInput, uri: string, path: string, bucket: MediaRef['bucket'], id: string): MediaRef;

package/dist/src/channels/attachments/inbound-types.js

@@ -0,0 +1,30 @@
+import { isImageInboundAttachment, isVoiceInboundAttachment } from "./attachment-classifiers.js";
+//#region src/channels/attachments/inbound-types.ts
+function toMediaRef(att, saved) {
+	return {
+		id: saved.id,
+		bucket: saved.bucket,
+		type: att.type,
+		mimeType: att.mimeType?.trim() || saved.contentType,
+		name: att.name?.trim() || "file",
+		size: att.size ?? saved.size,
+		uri: saved.uri,
+		path: saved.path
+	};
+}
+function mediaRefFromUri(att, uri, path, bucket, id) {
+	return {
+		id,
+		bucket,
+		type: att.type,
+		mimeType: att.mimeType?.trim() || "application/octet-stream",
+		name: att.name?.trim() || "file",
+		size: att.size ?? 0,
+		uri,
+		path
+	};
+}
+//#endregion
+export { isImageInboundAttachment, isVoiceInboundAttachment, mediaRefFromUri, toMediaRef };
+
+//# sourceMappingURL=inbound-types.js.map

package/dist/src/channels/attachments/inbound-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inbound-types.js","names":[],"sources":["../../../../src/channels/attachments/inbound-types.ts"],"sourcesContent":["import type { InboundAttachmentInput, MediaRef } from '../../media/types.js';\nimport {\n  isImageInboundAttachment,\n  isVoiceInboundAttachment,\n} from './attachment-classifiers.js';\n\nexport type { InboundAttachmentInput, MediaRef } from '../../media/types.js';\nexport { isImageInboundAttachment, isVoiceInboundAttachment };\n\nexport function toMediaRef(\n  att: InboundAttachmentInput,\n  saved: { id: string; bucket: MediaRef['bucket']; uri: string; path: string; size: number; contentType: string },\n): MediaRef {\n  return {\n    id: saved.id,\n    bucket: saved.bucket,\n    type: att.type,\n    mimeType: att.mimeType?.trim() || saved.contentType,\n    name: att.name?.trim() || 'file',\n    size: att.size ?? saved.size,\n    uri: saved.uri,\n    path: saved.path,\n  };\n}\n\nexport function mediaRefFromUri(\n  att: InboundAttachmentInput,\n  uri: string,\n  path: string,\n  bucket: MediaRef['bucket'],\n  id: string,\n): MediaRef {\n  return {\n    id,\n    bucket,\n    type: att.type,\n    mimeType: att.mimeType?.trim() || 'application/octet-stream',\n    name: att.name?.trim() || 'file',\n    size: att.size ?? 0,\n    uri,\n    path,\n  };\n}\n"],"mappings":";;AASA,SAAgB,WACd,KACA,OACU;AACV,QAAO;EACL,IAAI,MAAM;EACV,QAAQ,MAAM;EACd,MAAM,IAAI;EACV,UAAU,IAAI,UAAU,MAAM,IAAI,MAAM;EACxC,MAAM,IAAI,MAAM,MAAM,IAAI;EAC1B,MAAM,IAAI,QAAQ,MAAM;EACxB,KAAK,MAAM;EACX,MAAM,MAAM;EACb;;AAGH,SAAgB,gBACd,KACA,KACA,MACA,QACA,IACU;AACV,QAAO;EACL;EACA;EACA,MAAM,IAAI;EACV,UAAU,IAAI,UAAU,MAAM,IAAI;EAClC,MAAM,IAAI,MAAM,MAAM,IAAI;EAC1B,MAAM,IAAI,QAAQ;EAClB;EACA;EACD"}

package/dist/src/channels/attachments/outbound-tts-persist.d.ts

@@ -1,14 +1,5 @@
 /**
- * Persist outbound TTS audio under `<agentHome>/tts/<session>/`.
+ * Persist outbound TTS audio to `{stateDir}/media/tts/`.
  */
-import type { InternalAttachmentRoots } from './inbound-persist.js';
-export declare const TTS_REL_ROOT = "tts";
-export declare function persistOutboundTtsAudio(agentHomeRoot: string, sessionKey: string, audioBuffer: Buffer, format: string): Promise<{
-    workspaceRelativePath: string;
-    name: string;
-    size: number;
-}>;
-/**
- * Resolve a stored relative path under `tts/`.
- */
-export declare function resolveSafeTtsFilePath(roots: InternalAttachmentRoots, relRaw: string): string | null;
+import type { MediaRef } from '../../media/types.js';
+export declare function persistOutboundTtsAudio(audioBuffer: Buffer, format: string): Promise<MediaRef>;