better-supabase 0.8.0 → 0.10.0

package/dist/ai-sdk/agents/index.js

@@ -1,16 +1,109 @@
 import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { i as searchTool } from "../../embeddings-4ZvFzjsU.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { n as operationMeta, r as operationPermission, t as OPERATION_PREFIXES } from "../../operations-CsIfMED7.js";
+import { r as agentClaims } from "../../actor-KHDOKGb1.js";
+import { t as gatewayOptions } from "../../gateway-options-DcLcWL5_.js";
+import { i as searchTool } from "../../embeddings-CVeOoufZ.js";
 import { ToolLoopAgent, stepCountIs } from "ai";
+//#region src/ai-sdk/agents/authorization.ts
+/**
+* The run context for an agent row, its caller and the tools it may call,
+* frozen. A read-only agent `actor` (the session's own agent level) makes
+* the run's `act` read-only too.
+*/
+function agentRunContext(agent, caller, tools = [], actor) {
+	const readOnly = actor?.kind === "agent" && actor.readOnly;
+	return Object.freeze({
+		userId: caller?.userId,
+		organizationId: caller?.organizationId ?? agent.organizationId,
+		actor: Object.freeze({
+			kind: "agent",
+			id: agent.id
+		}),
+		act: Object.freeze({
+			agent: agent.id,
+			tools: Object.freeze([...tools]),
+			...readOnly ? { readOnly: true } : {}
+		})
+	});
+}
+/** Whether an agent level that lists tools lists `toolName`; every other actor may call it. */
+function toolDelegated(actor, toolName) {
+	return actor?.kind !== "agent" || actor.tools === void 0 || actor.tools.includes(toolName);
+}
+/**
+* Throws a forbidden `DbException` (`AGENT_TOOL_NOT_DELEGATED`) when the
+* actor is an agent whose `act.tools` lists tools and not `toolName`.
+*/
+function assertToolDelegated(actor, toolName) {
+	if (!toolDelegated(actor, toolName)) throw new DbException(dbError("forbidden", `The agent was not delegated the tool ${toolName}.`, { code: "AGENT_TOOL_NOT_DELEGATED" }));
+}
+/**
+* The operation of the tool `name`: the provider's entry for the tool's
+* operation (from `toolOperations`, default `ai.tool.<name>`) first, then
+* the tool's own permission from `permissions`.
+*/
+function agentToolOperation(name, operations, permissions = {}, toolOperations = {}) {
+	const operation = (Object.hasOwn(toolOperations, name) ? toolOperations[name] : void 0) ?? `${OPERATION_PREFIXES.aiTool}${name}`;
+	const own = Object.hasOwn(permissions, name) ? permissions[name] : void 0;
+	const permission = operationPermission(operations, operation, typeof own === "string" ? own : void 0) ?? (own === false ? false : void 0);
+	const meta = operationMeta(operations, operation);
+	return {
+		operation,
+		permission,
+		...meta?.risk === void 0 ? {} : { risk: meta.risk },
+		...meta?.effects === void 0 ? {} : { effects: meta.effects },
+		...meta?.title === void 0 ? {} : { title: meta.title }
+	};
+}
+/** The id `authorizeModel` gets: the string itself, or the model's `modelId`. */
+function modelIdOf(model) {
+	return typeof model === "string" ? model : model.modelId;
+}
+const refused = (modelId) => new DbException(dbError("forbidden", `The model ${modelId} is not allowed.`, { code: "AI_MODEL_NOT_ALLOWED" }));
+/** Throws a forbidden `DbException` unless `authorize` allows the model; a throw refuses. */
+async function assertModelAllowed(authorize, model, context) {
+	const modelId = modelIdOf(model);
+	let allowed;
+	try {
+		allowed = await authorize(modelId, context);
+	} catch {
+		throw refused(modelId);
+	}
+	if (allowed !== true) throw refused(modelId);
+}
+/**
+* Whether the call may run as far as permissions go: a tool the run's
+* `act.tools` doesn't list is refused, a tool with no declared permission is
+* refused, a public one is allowed without a check, and a check that throws
+* refuses.
+*/
+async function toolPermitted(authorize, operation, context) {
+	if (!toolDelegated({
+		kind: "agent",
+		...context.act
+	}, context.toolName)) return false;
+	if (operation.permission === false) return true;
+	if (operation.permission === void 0) return false;
+	try {
+		return await authorize(operation.permission, context) === true;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region src/ai-sdk/agents/agents.ts
 /**
 * The tools an agent may call: the ones it lists (every tool when it lists
-* none), without the tenant's `deny` tools.
+* none), without the tenant's `deny` tools and, when the session's `actor`
+* is an agent that lists tools, without the ones it wasn't delegated.
 */
-function agentTools(agent, available, policies = {}) {
+function agentTools(agent, available, policies = {}, actor) {
 	const allowed = agent.tools.length === 0 ? void 0 : new Set(agent.tools);
 	const tools = {};
 	for (const [name, tool] of Object.entries(available)) {
 		if (allowed !== void 0 && !allowed.has(name)) continue;
+		if (!toolDelegated(actor, name)) continue;
 		if (policies[name] === "deny") continue;
 		tools[name] = tool;
 	}
@@ -30,22 +123,46 @@ const APPROVAL_RANK = {
 };
 const approvalType = (status) => status === void 0 ? "not-applicable" : typeof status === "string" ? status : status.type;
 /**
-* The app's `toolApproval` with the tenant's `ask` tools: the app decides
-* first, and the stricter of the two answers wins (`denied`, then
-* `user-approval`). A function that throws denies the call.
+* The delegation check, the permission check, then the app's
+* `toolApproval`, then the `ask` tools: a tool the session's agent wasn't
+* delegated or a refused permission denies, and otherwise the stricter
+* answer wins (`denied`, then `user-approval`). A function that throws
+* denies the call.
 */
-function composedApproval(approve, tenant) {
+function composedApproval(checks) {
 	return async (options) => {
-		let status;
+		const { toolName } = options.toolCall;
+		const input = options.toolCall.input;
 		try {
-			status = await approve(options);
+			assertToolDelegated(checks.actor, toolName);
+		} catch (error) {
+			return {
+				type: "denied",
+				reason: error instanceof DbException ? error.error.message : "The tool was not delegated"
+			};
+		}
+		if (checks.authorizeTool !== void 0) {
+			const operation = checks.operation(toolName);
+			if (!await toolPermitted(checks.authorizeTool, operation, {
+				...checks.run,
+				toolName,
+				operation: operation.operation,
+				input
+			})) return {
+				type: "denied",
+				reason: "The caller may not use this tool"
+			};
+		}
+		let status = "not-applicable";
+		if (checks.approve !== void 0) try {
+			status = await checks.approve(options);
 		} catch {
 			return {
 				type: "denied",
 				reason: "The tool approval check failed"
 			};
 		}
-		return tenant[options.toolCall.toolName] !== void 0 && APPROVAL_RANK[approvalType(status)] < APPROVAL_RANK["user-approval"] ? "user-approval" : status;
+		return checks.ask[toolName] !== void 0 && APPROVAL_RANK[approvalType(status)] < APPROVAL_RANK["user-approval"] ? "user-approval" : status;
 	};
 }
 /** The knowledge scopes an agent searches; `agent` without an id is its own. */
@@ -58,22 +175,60 @@ function agentScopes(agent) {
 /** A `ToolLoopAgent` from an agent row. */
 function createAgentRuntime(options) {
 	const { agent } = options;
-	const tools = agentTools(agent, options.tools ?? {}, options.policies);
-	if (options.knowledge !== void 0 && agent.knowledgeScopes.length > 0) {
+	const tools = agentTools(agent, options.tools ?? {}, options.policies, options.actor);
+	const searchesKnowledge = options.knowledge !== void 0 && agent.knowledgeScopes.length > 0 && toolDelegated(options.actor, "search_knowledge");
+	const run = agentRunContext(agent, options.caller, [...Object.keys(tools), ...searchesKnowledge ? ["search_knowledge"] : []], options.actor);
+	if (searchesKnowledge) {
 		const { knowledge, organizationId, options: search = {} } = options.knowledge;
+		const filter = options.results;
 		tools["search_knowledge"] = searchTool(knowledge, organizationId, {
 			...search,
-			scopes: agentScopes(agent)
+			scopes: agentScopes(agent),
+			...filter === void 0 ? {} : { results: (hits, { query }) => filter(hits, {
+				...run,
+				toolName: "search_knowledge",
+				query
+			}) }
 		});
 	}
+	const operation = (name) => agentToolOperation(name, options.operations, options.permissions, options.toolOperations);
+	const ask = { ...agentToolApproval(tools, options.policies) };
+	for (const name of Object.keys(tools)) if (operation(name).risk === "high") ask[name] = "user-approval";
 	const instructions = [options.instructions, agent.instructions].filter((text) => text !== void 0 && text !== "").join("\n\n");
+	const gateway = options.gateway === void 0 && options.caller === void 0 ? void 0 : gatewayOptions({
+		...run.userId === void 0 ? {} : { userId: run.userId },
+		...run.organizationId === void 0 ? {} : { organizationId: run.organizationId },
+		...options.gateway?.chatId === void 0 ? {} : { chatId: options.gateway.chatId },
+		feature: options.gateway?.feature ?? "agent",
+		tags: [`agent:${agent.id}`, ...options.gateway?.tags ?? []]
+	}, options.gateway?.options);
+	const { authorizeModel } = options;
 	return new ToolLoopAgent({
 		id: agent.id,
 		model: options.model(agent.model),
 		tools,
-		toolApproval: options.toolApproval === void 0 ? agentToolApproval(tools, options.policies) : composedApproval(options.toolApproval, agentToolApproval(tools, options.policies)),
+		toolApproval: options.toolApproval === void 0 && options.authorizeTool === void 0 && options.actor === void 0 ? ask : composedApproval({
+			actor: options.actor,
+			approve: options.toolApproval,
+			ask,
+			authorizeTool: options.authorizeTool,
+			operation,
+			run
+		}),
 		...instructions === "" ? {} : { instructions },
-		stopWhen: options.stopWhen ?? stepCountIs(20)
+		stopWhen: options.stopWhen ?? stepCountIs(20),
+		runtimeContext: run,
+		prepareCall: (call) => ({
+			...call,
+			runtimeContext: {
+				...call.runtimeContext,
+				...run
+			}
+		}),
+		prepareStep: async ({ model }) => {
+			if (authorizeModel !== void 0) await assertModelAllowed(authorizeModel, model, run);
+			return gateway === void 0 ? void 0 : { providerOptions: gateway };
+		}
 	});
 }
 /** Thrown by the moderation middleware when a check blocks the input or output. */
@@ -104,7 +259,7 @@ function lastUserText(prompt) {
 */
 function moderationMiddleware(options) {
 	const judge = async (text, stage) => {
-		if (text.trim() === "") return void 0;
+		if (text.trim() === "") return;
 		const verdict = await options.check(text, stage);
 		if (verdict === void 0 || verdict.action === "allow") return verdict;
 		const recorded = await options.chats.moderation.record({
@@ -156,4 +311,4 @@ function moderationMiddleware(options) {
 	};
 }
 //#endregion
-export { ModerationBlockedError, agentScopes, agentToolApproval, agentTools, createAgentRuntime, moderationMiddleware };
+export { ModerationBlockedError, agentClaims, agentRunContext, agentScopes, agentToolApproval, agentToolOperation, agentTools, assertToolDelegated, createAgentRuntime, moderationMiddleware, toolDelegated };

package/dist/ai-sdk/batches/index.d.ts

@@ -1,7 +1,7 @@
-import { t as AsyncResult } from "../../result-BchM1XZn.js";
-import { i as CursorPageOptions } from "../../block-helpers-C0Xj8War.js";
-import { m as JobHandler } from "../../types-D__3EN0q.js";
-import { i as AiBatchItemInput, r as AiBatchItem, t as AiBatch, u as AiProviders } from "../../types-CbOUc5IH.js";
+import { t as AsyncResult } from "../../result-Cj3yWhjH.js";
+import { i as CursorPageOptions } from "../../block-helpers-7pMBVsE6.js";
+import { g as JobHandler } from "../../types-P1S1cj6N.js";
+import { i as AiBatchItemInput, r as AiBatchItem, t as AiBatch, u as AiProviders } from "../../types-C_GN-4ed.js";
 import { Experimental_BatchItemResult, Experimental_BatchProvider, Experimental_BatchReference, Experimental_BatchStatus, Experimental_StartBatchOptions, Experimental_StartBatchResult } from "ai";
 //#region src/ai-sdk/batches/batches.d.ts
 /** The AI SDK batch calls, replaceable in tests. */

package/dist/ai-sdk/batches/index.js

@@ -1,8 +1,8 @@
-import { n as dbError } from "../../errors-2M6CKMP4.js";
-import { s as nowInstant } from "../../temporal-BJGitm-h.js";
-import { t as temporal } from "../../temporal-required-BtynQtM-.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DEqHCMKP.js";
-import { l as errorText } from "../../block-helpers-Cy3pB96I.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { s as nowInstant } from "../../temporal-CB5Fpo5d.js";
+import { t as temporal } from "../../temporal-required-DqRzr7i0.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-COkvI9t5.js";
+import { f as errorText } from "../../block-helpers-BfVCR5Fc.js";
 import { experimental_cancelBatch, experimental_getBatchResults, experimental_getBatchStatus, experimental_startBatch } from "ai";
 //#region src/ai-sdk/batches/batches.ts
 const DEFAULT_API = {

package/dist/ai-sdk/cache/index.d.ts

@@ -1,5 +1,5 @@
-import { b as DbError } from "../../result-BchM1XZn.js";
-import { t as AiCache } from "../../ai-cache-DrUMMgp6.js";
+import { b as DbError } from "../../result-Cj3yWhjH.js";
+import { t as AiCache } from "../../ai-cache-CkxtAt4P.js";
 import { LanguageModelMiddleware } from "ai";
 //#region src/ai-sdk/cache/cache.d.ts
 type WrapGenerate = NonNullable<LanguageModelMiddleware["wrapGenerate"]>;

package/dist/ai-sdk/cache/index.js

@@ -1,5 +1,5 @@
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { t as cacheKey } from "../../ai-cache-Dfgk8nBT.js";
+import { t as cacheKey } from "../../ai-cache-DPiuJ-zJ.js";
 import { simulateReadableStream } from "ai";
 //#region src/ai-sdk/cache/cache.ts
 const BYTES = "$bytes";

package/dist/ai-sdk/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as AssistantOptions, c as AssistantRunResult, i as AssistantModeration, l as AssistantTurn, n as AssistantContext, o as AssistantRequestBody, r as AssistantFinish, s as AssistantRunArgs, t as Assistant, u as createAssistant } from "../../assistant-DBlFDZsi.js";
+import { a as AssistantOptions, c as AssistantRunResult, i as AssistantModeration, l as AssistantTurn, n as AssistantContext, o as AssistantRequestBody, r as AssistantFinish, s as AssistantRunArgs, t as Assistant, u as createAssistant } from "../../assistant-BZyhQ8bd.js";
 export { type Assistant, type AssistantContext, type AssistantFinish, type AssistantModeration, type AssistantOptions, type AssistantRequestBody, type AssistantRunArgs, type AssistantRunResult, type AssistantTurn, createAssistant };

package/dist/ai-sdk/chat/index.js

@@ -1,10 +1,11 @@
-import { n as dbError } from "../../errors-2M6CKMP4.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { o as problemResponse } from "../../problem-CJvFeGu7.js";
+import { o as problemResponse } from "../../problem-pIiL3WbE.js";
 import { n as pathToHistory, r as repairDanglingToolCalls } from "../../history-GH1HJWQV.js";
-import { f as problem429, h as usageOf, i as isUIMessage, l as gatewayOptions, p as runRelease, r as fromUIMessage, s as toUIMessages, t as AI_SDK_UI_FORMAT } from "../../messages-CJoHHCWT.js";
-import { n as teeToStore, t as resumeFromStore } from "../../tee-Cb98Vn3b.js";
-import { n as readJson, r as sse, t as badRequest } from "../../http-sbmBe5d2.js";
+import { t as gatewayOptions } from "../../gateway-options-DcLcWL5_.js";
+import { d as problem429, f as runRelease, i as isUIMessage, m as usageOf, r as fromUIMessage, s as toUIMessages, t as AI_SDK_UI_FORMAT } from "../../messages-Cx4ttLJJ.js";
+import { n as teeToStore, t as resumeFromStore } from "../../tee-CdRV1tcj.js";
+import { n as readJson, r as sse, t as badRequest } from "../../http-BF-V0CUF.js";
 import { JsonToSseTransformStream, convertToModelMessages } from "ai";
 //#region src/ai-sdk/chat/assistant.ts
 const TRIGGERS = /* @__PURE__ */ new Set(["submit-message", "regenerate-message"]);
@@ -68,7 +69,7 @@ function createAssistant(options) {
 			message,
 			chat
 		});
-		if (verdict === void 0 || verdict.action === "allow") return void 0;
+		if (verdict === void 0 || verdict.action === "allow") return;
 		await context.chats.moderation.record({
 			organizationId: chat.organizationId,
 			chatId: chat.id,

package/dist/ai-sdk/embeddings/index.d.ts

@@ -1,3 +1,3 @@
-import { n as Embedder, o as KnowledgeHit } from "../../knowledge-CAReFpRA.js";
-import { a as SupabaseAiSession, c as modelName, d as supabaseEmbed, f as toSourceParts, i as SearchToolResult, l as rerankWith, n as Reranker, o as SupabaseEmbedOptions, r as SearchToolOptions, s as embedWith, t as EmbedWithOptions, u as searchTool } from "../../embeddings-B4vhS-dY.js";
-export { type EmbedWithOptions, type Embedder, type KnowledgeHit, type Reranker, type SearchToolOptions, type SearchToolResult, type SupabaseAiSession, type SupabaseEmbedOptions, embedWith, modelName, rerankWith, searchTool, supabaseEmbed, toSourceParts };
+import { n as Embedder, o as KnowledgeHit } from "../../knowledge-BYtgA52P.js";
+import { a as SearchToolResult, c as embedWith, d as searchTool, f as supabaseEmbed, i as SearchToolOptions, l as modelName, n as Reranker, o as SupabaseAiSession, p as toSourceParts, r as ResultsFilter, s as SupabaseEmbedOptions, t as EmbedWithOptions, u as rerankWith } from "../../embeddings-Da0w4A_0.js";
+export { type EmbedWithOptions, type Embedder, type KnowledgeHit, type Reranker, type ResultsFilter, type SearchToolOptions, type SearchToolResult, type SupabaseAiSession, type SupabaseEmbedOptions, embedWith, modelName, rerankWith, searchTool, supabaseEmbed, toSourceParts };

package/dist/ai-sdk/embeddings/index.js

@@ -1,2 +1 @@
-import { a as supabaseEmbed, i as searchTool, n as modelName, o as toSourceParts, r as rerankWith, t as embedWith } from "../../embeddings-4ZvFzjsU.js";
-export { embedWith, modelName, rerankWith, searchTool, supabaseEmbed, toSourceParts };
+export { t as embedWith, n as modelName, r as rerankWith, i as searchTool, a as supabaseEmbed, o as toSourceParts } from "../../embeddings-CVeOoufZ.js";

package/dist/ai-sdk/files/index.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError, t as AsyncResult } from "../../result-BchM1XZn.js";
+import { b as DbError, t as AsyncResult } from "../../result-Cj3yWhjH.js";
 import { r as AiFilePart } from "../../message-B0fNJgq8.js";
-import { c as AiFileSource, f as AiFiles } from "../../types-Bb_4-vdW.js";
+import { c as AiFileSource, f as AiFiles } from "../../types-DM8q3IOr.js";
 import { Experimental_DownloadFunction } from "ai";
 //#region src/ai-sdk/files/files.d.ts
 interface AiFileDownloadOptions {

package/dist/ai-sdk/files/index.js

@@ -1,7 +1,7 @@
-import { n as dbError } from "../../errors-2M6CKMP4.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DEqHCMKP.js";
-import { l as errorText } from "../../block-helpers-Cy3pB96I.js";
-import { r as parseAiFileUrl, t as aiFileUrl } from "../../ai-files-CioLu5du.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-COkvI9t5.js";
+import { f as errorText } from "../../block-helpers-BfVCR5Fc.js";
+import { r as parseAiFileUrl, t as aiFileUrl } from "../../ai-files-BXtV3ygd.js";
 import { createDownload } from "ai";
 //#region src/ai-sdk/files/files.ts
 /** Thrown by the download function, so the SDK reports a failed file part. */

package/dist/ai-sdk/index.d.ts

@@ -1,11 +1,12 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError, t as AsyncResult } from "../result-BchM1XZn.js";
+import { b as DbError, t as AsyncResult } from "../result-Cj3yWhjH.js";
 import { i as AiMessage } from "../message-B0fNJgq8.js";
-import { m as JobHandler } from "../types-D__3EN0q.js";
-import { U as AiSandboxes } from "../ai-chat-DXkMy74O.js";
-import { p as ResolvedProviderKey, u as AiProviders } from "../types-CbOUc5IH.js";
-import { i as Usage } from "../usage-D0NNUFfr.js";
-import { _ as usageOf, a as GatewayClient, c as GatewayOptions, d as costBackfill, f as gatewayOptions, g as usageEntries, h as problem429, i as CostBackfillPayload, l as ModelCatalogRefreshOptions, m as modelInputOf, n as AiUsageMeters, o as GatewayContext, p as modelCatalogRefresh, r as CostBackfillOptions, s as GatewayModelEntry, t as AiUsage, u as UsageSource, v as usageQuota } from "../gateway-S9vicgeo.js";
+import { g as JobHandler } from "../types-P1S1cj6N.js";
+import { U as AiSandboxes } from "../ai-chat-al8b3spK.js";
+import { n as GatewayOptions, r as gatewayOptions, t as GatewayContext } from "../gateway-options-ClvvfuuU.js";
+import { p as ResolvedProviderKey, u as AiProviders } from "../types-C_GN-4ed.js";
+import { a as Usage } from "../usage-CnQHSM_r.js";
+import { a as GatewayClient, c as UsageSource, d as modelInputOf, f as problem429, h as usageQuota, i as CostBackfillPayload, l as costBackfill, m as usageOf, n as AiUsageMeters, o as GatewayModelEntry, p as usageEntries, r as CostBackfillOptions, s as ModelCatalogRefreshOptions, t as AiUsage, u as modelCatalogRefresh } from "../gateway-CJL6ZG17.js";
 import { i as fromModelMessages, n as ModelApproval, r as ModelSource, t as FromModelMessagesOptions } from "../model-messages-D4GZllOD.js";
 import { Experimental_SandboxSession, Telemetry, UIMessage } from "ai";
 //#region src/ai-sdk/messages.d.ts

package/dist/ai-sdk/index.js

@@ -1,7 +1,8 @@
-import { s as nowInstant } from "../temporal-BJGitm-h.js";
+import { s as nowInstant } from "../temporal-CB5Fpo5d.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { c as costBackfill, d as modelInputOf, f as problem429, g as usageQuota, h as usageOf, i as isUIMessage, l as gatewayOptions, m as usageEntries, n as DENIED_TOOL_OUTPUT, o as toUIMessage, r as fromUIMessage, s as toUIMessages, t as AI_SDK_UI_FORMAT, u as modelCatalogRefresh } from "../messages-CJoHHCWT.js";
-import { t as fromModelMessages } from "../model-messages-Cxw_Up4f.js";
+import { t as gatewayOptions } from "../gateway-options-DcLcWL5_.js";
+import { c as costBackfill, d as problem429, h as usageQuota, i as isUIMessage, l as modelCatalogRefresh, m as usageOf, n as DENIED_TOOL_OUTPUT, o as toUIMessage, p as usageEntries, r as fromUIMessage, s as toUIMessages, t as AI_SDK_UI_FORMAT, u as modelInputOf } from "../messages-Cx4ttLJJ.js";
+import { t as fromModelMessages } from "../model-messages-CTu-6kBu.js";
 //#region src/ai-sdk/providers.ts
 /** The `settings` key that names the credential field, `apiKey` unless set. */
 const BYOK_FIELD = "credentialField";

package/dist/ai-sdk/mcp/index.d.ts

@@ -1,7 +1,7 @@
-import { b as DbError, t as AsyncResult } from "../../result-BchM1XZn.js";
-import { i as CredentialRef, r as CredentialProvider } from "../../provider-ib9wzUDz.js";
-import { r as ConnectorServer, s as Connectors } from "../../connectors--PGhmiu0.js";
-import { n as VaultCredentials } from "../../vault-BpmApxxW.js";
+import { b as DbError, t as AsyncResult } from "../../result-Cj3yWhjH.js";
+import { i as CredentialRef, r as CredentialProvider } from "../../provider-CQ1SrhLa.js";
+import { r as ConnectorServer, s as Connectors } from "../../connectors-CZdfZcIg.js";
+import { n as VaultCredentials } from "../../vault-EnOQJWjn.js";
 import { i as SupabaseMcpScope, n as SupabaseMcpModule, t as SupabaseMcpFeature } from "../../supabase-mcp-C6tMoEjn.js";
 import { ToolSet } from "ai";
 import { ElicitResult, ElicitationRequest, MCPClient, OAuthClientMetadata, OAuthClientProvider } from "@ai-sdk/mcp";

package/dist/ai-sdk/mcp/index.js

@@ -1,11 +1,11 @@
 import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../../errors-2M6CKMP4.js";
-import { s as nowInstant } from "../../temporal-BJGitm-h.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DEqHCMKP.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { s as nowInstant } from "../../temporal-CB5Fpo5d.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-COkvI9t5.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { n as credentialRefInTenant, r as foreignCredentialRef } from "../../provider-DxRTex4x.js";
-import { n as loadSupabaseMcp } from "../../supabase-mcp-Cpn5A4i-.js";
-import { O as sha256Hex, l as errorText } from "../../block-helpers-Cy3pB96I.js";
+import { n as credentialRefInTenant, r as foreignCredentialRef } from "../../provider-DKh2xFZb.js";
+import { N as sha256Hex, f as errorText } from "../../block-helpers-BfVCR5Fc.js";
+import { n as loadSupabaseMcp } from "../../supabase-mcp-DomZ-amK.js";
 import { fingerprintTools } from "ai";
 import { ElicitationRequestSchema, auth, createMCPClient, mcpAppClientCapabilities, splitMCPAppTools } from "@ai-sdk/mcp";
 //#region src/ai-sdk/mcp/oauth.ts

package/dist/ai-sdk/memory/index.d.ts

@@ -1,5 +1,6 @@
-import { m as JobHandler } from "../../types-D__3EN0q.js";
-import { n as MemoryCommand, o as MemoryNamespace, t as Memory } from "../../types-DSJ3-m9X.js";
+import { g as JobHandler } from "../../types-P1S1cj6N.js";
+import { r as ResultsFilter } from "../../embeddings-Da0w4A_0.js";
+import { i as MemoryHit, n as MemoryCommand, s as MemoryNamespace, t as Memory } from "../../types-DOaUIJxW.js";
 import { LanguageModel, Tool } from "ai";
 //#region src/ai-sdk/memory/memory.d.ts
 /** The memory tool for any model, with the commands of Anthropic's memory tool. */
@@ -22,6 +23,8 @@ interface RecallToolOptions {
   readonly description?: string;
   /** Facts to return. Default 5. */
   readonly k?: number;
+  /** Drops the memories the caller may not read before the model sees them. */
+  readonly results?: ResultsFilter<MemoryHit>;
 }
 interface RecallToolResult {
   readonly memories: readonly {

package/dist/ai-sdk/memory/index.js

@@ -1,5 +1,5 @@
 import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { t as SPEC_PINS } from "../../spec-pins-DsLfUH7l.js";
+import { t as SPEC_PINS } from "../../spec-pins-S4PymRxp.js";
 import { Output, generateText, jsonSchema, tool } from "ai";
 //#region src/ai-sdk/memory/memory.ts
 const PATH = {
@@ -130,7 +130,7 @@ function recallTool(memory, organizationId, ns, options = {}) {
 				...abortSignal === void 0 ? {} : { signal: abortSignal }
 			});
 			if (!found.ok) throw new DbException(found.error);
-			return { memories: found.data.map((hit) => ({
+			return { memories: (options.results ? await options.results(found.data, { query }) : found.data).map((hit) => ({
 				id: hit.id,
 				content: hit.content
 			})) };

package/dist/ai-sdk/react/index.js

@@ -1,3 +1,2 @@
 "use client";
-import { t as useAssistant } from "../../react-4ZqkP8da.js";
-export { useAssistant };
+export { t as useAssistant } from "../../react-4ZqkP8da.js";

package/dist/ai-sdk/workflow/index.d.ts

@@ -1,8 +1,9 @@
 import { i as AiMessage } from "../../message-B0fNJgq8.js";
-import { A as AiStoredMessageStatus, E as AiRunStatus, i as AiChat } from "../../ai-chat-DXkMy74O.js";
-import { o as StreamStore } from "../../store-DsIYEBnv.js";
-import { c as GatewayOptions, i as CostBackfillPayload, t as AiUsage } from "../../gateway-S9vicgeo.js";
-import { n as AssistantContext, t as Assistant } from "../../assistant-DBlFDZsi.js";
+import { A as AiStoredMessageStatus, E as AiRunStatus, i as AiChat } from "../../ai-chat-al8b3spK.js";
+import { n as GatewayOptions } from "../../gateway-options-ClvvfuuU.js";
+import { o as StreamStore } from "../../store-B5qYKsTh.js";
+import { i as CostBackfillPayload, t as AiUsage } from "../../gateway-CJL6ZG17.js";
+import { n as AssistantContext, t as Assistant } from "../../assistant-BZyhQ8bd.js";
 import { r as ModelSource } from "../../model-messages-D4GZllOD.js";
 import { LanguageModelUsage, ModelMessage } from "ai";
 import { ModelCallStreamPart } from "@ai-sdk/workflow";

package/dist/ai-sdk/workflow/index.js

@@ -1,11 +1,11 @@
-import { n as dbError } from "../../errors-2M6CKMP4.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { o as problemResponse } from "../../problem-CJvFeGu7.js";
-import { h as usageOf, o as toUIMessage, p as runRelease, t as AI_SDK_UI_FORMAT } from "../../messages-CJoHHCWT.js";
-import { t as fromModelMessages } from "../../model-messages-Cxw_Up4f.js";
-import { n as teeToStore, t as resumeFromStore } from "../../tee-Cb98Vn3b.js";
-import { n as readJson, r as sse, t as badRequest } from "../../http-sbmBe5d2.js";
-import { t as WORKFLOW_ATTRIBUTES } from "../../attributes-5dYul0u0.js";
+import { o as problemResponse } from "../../problem-pIiL3WbE.js";
+import { f as runRelease, m as usageOf, o as toUIMessage, t as AI_SDK_UI_FORMAT } from "../../messages-Cx4ttLJJ.js";
+import { t as fromModelMessages } from "../../model-messages-CTu-6kBu.js";
+import { n as teeToStore, t as resumeFromStore } from "../../tee-CdRV1tcj.js";
+import { n as readJson, r as sse, t as badRequest } from "../../http-BF-V0CUF.js";
+import { t as WORKFLOW_ATTRIBUTES } from "../../attributes-D4mA7WhI.js";
 import { JsonToSseTransformStream } from "ai";
 import { createModelCallToUIChunkTransform, normalizeUIMessageStreamParts } from "@ai-sdk/workflow";
 import { getRun, resumeHook, start } from "workflow/api";
@@ -205,7 +205,7 @@ function notDurable() {
 }
 /** The `approvals` of a body, `undefined` when it has none, or a message for a malformed one. */
 function decisionsOf$1(value) {
-	if (value === void 0) return void 0;
+	if (value === void 0) return;
 	if (!Array.isArray(value) || value.length === 0) return "Expected a list of approvals.";
 	const decisions = [];
 	for (const item of value) {