eve 0.22.2 → 0.22.3

package/dist/src/public/extension/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Authoring helpers for eve extensions — reusable packages mounted into an
+ * agent through `agent/extensions/`.
+ *
+ * @example
+ * ```ts
+ * import { defineExtension } from "eve/extension";
+ * ```
+ */
+export { defineExtension, type ExtensionHandle, type MountedExtension, type NoConfigExtensionHandle, } from "#public/definitions/extension.js";

package/dist/src/public/extension/index.js

@@ -0,0 +1 @@
+import{defineExtension}from"#public/definitions/extension.js";export{defineExtension};

package/dist/src/runtime/connections/openapi-client.js

@@ -1 +1 @@
-import{isObject}from"#shared/guards.js";import{jsonSchema,tool}from"ai";import{passesToolFilter,resolveHeaders}from"#runtime/connections/mcp-client.js";import{HTTP_METHODS,operationDescription,operationName,uniqueName}from"#runtime/connections/openapi-operations.js";import{buildInputSchema,deref,derefSchema,isArray}from"#runtime/connections/openapi-schema.js";import{applySecurity,resolveSecurity}from"#runtime/connections/openapi-security.js";import{extractServerUrl,parseSpecDocument}from"#runtime/connections/openapi-spec.js";const SWAGGER_PARAMETER_SCHEMA_KEYS=[`default`,`enum`,`exclusiveMaximum`,`exclusiveMinimum`,`format`,`items`,`maximum`,`maxItems`,`maxLength`,`minimum`,`minItems`,`minLength`,`multipleOf`,`pattern`,`type`,`uniqueItems`];var OpenApiConnectionClient=class{#e;#t;#n;constructor(e){this.#n=e}async connect(){return this.#r()}async getToolMetadata(){return(await this.#r()).metadata}async getTools(){return(await this.#r()).tools}async executeTool(t,n,r){let i=await this.#r(),a=i.operations.get(t);if(a===void 0)throw Error(`Tool "${t}" not found in connection "${this.#n.connectionName}".`);return this.#f(a,i.baseUrl,isObject(n)?n:{},{abortSignal:r?.abortSignal})}async close(){this.#e=void 0,this.#t=void 0}async#r(){if(this.#t!==void 0)return this.#t;if(this.#e!==void 0)return this.#e;this.#e=this.#i();try{return this.#t=await this.#e,this.#t}catch(e){throw this.#e=void 0,e}}async#i(){let i=await this.#o(),a=this.#a(i),o=this.#s(i),s=this.#n.tools,c=s===void 0?o:o.filter(e=>passesToolFilter(e.toolName,s)),l=[],u=new Map,d={};for(let r of c)u.set(r.toolName,r),l.push({description:r.description,inputSchema:r.inputSchema,name:r.toolName}),d[r.toolName]=tool({description:r.description,inputSchema:jsonSchema(r.inputSchema),execute:async(t,n)=>this.#f(r,a,isObject(t)?t:{},{abortSignal:n?.abortSignal})});return{metadata:l,operations:u,tools:d,baseUrl:a}}#a(e){let t=this.#n.url;if(typeof t==`string`&&t.trim().length>0)return t;let n=extractServerUrl(e,this.#n.spec);if(n!==void 0)return n;throw Error(`OpenAPI connection "${this.#n.connectionName}" has no base URL: set "baseUrl" or ensure the document declares an absolute "servers" entry or Swagger "host".`)}async#o(){let t=this.#n.spec;if(t===void 0)throw Error(`OpenAPI connection "${this.#n.connectionName}" is missing its "spec" source.`);if(typeof t!=`string`)return t;let n;try{n=await fetch(t,{headers:{accept:`application/json, application/yaml, text/yaml, */*`}})}catch(e){throw Error(`OpenAPI connection "${this.#n.connectionName}" failed to fetch its spec from "${t}": ${String(e)}`)}if(!n.ok)throw Error(`OpenAPI connection "${this.#n.connectionName}" failed to fetch its spec from "${t}": HTTP ${n.status}.`);let r=await n.text(),i;try{i=parseSpecDocument(r)}catch(e){throw Error(`OpenAPI connection "${this.#n.connectionName}" spec at "${t}" could not be parsed as JSON or YAML: ${String(e)}`)}if(!isObject(i))throw Error(`OpenAPI connection "${this.#n.connectionName}" spec at "${t}" is not an OpenAPI document object.`);return i}#s(t){let n=t.paths;if(!isObject(n))return[];let r=[],i=new Set;for(let[u,d]of Object.entries(n)){if(!isObject(d))continue;let n=isArray(d.parameters)?d.parameters:[];for(let f of HTTP_METHODS){let a=d[f];if(!isObject(a))continue;let p=uniqueName(operationName(a,f,u),i),m=isArray(a.parameters)?a.parameters:[],h=[...n,...m],g=this.#c(t,h),_=this.#l(t,a.requestBody,h);r.push({toolName:p,method:f,pathTemplate:u,description:operationDescription(a),parameters:g,requestBody:_,inputSchema:buildInputSchema(g,_),security:resolveSecurity(t,a)})}}return r}#c(t,n){let r=[];for(let i of n){let n=isObject(i)?deref(t,i):i;if(!isObject(n))continue;let a=n.in;if(a!==`path`&&a!==`query`&&a!==`header`&&a!==`cookie`||typeof n.name!=`string`)continue;let o=this.#u(t,n);r.push({name:n.name,location:a,required:n.required===!0||a===`path`,schema:o,description:typeof n.description==`string`?n.description:void 0})}return r}#l(t,n,r=[]){if(isObject(n)){let r=deref(t,n);if(isObject(r)&&isObject(r.content)){let n=r.content,i=`application/json`in n?`application/json`:Object.keys(n)[0];if(i!==void 0){let a=n[i],o=isObject(a)&&isObject(a.schema)?derefSchema(t,a.schema):{};return{required:r.required===!0,contentType:i,schema:o}}}}return this.#d(t,r)}#u(t,n){if(isObject(n.schema))return derefSchema(t,n.schema);let r={};for(let e of SWAGGER_PARAMETER_SCHEMA_KEYS)n[e]!==void 0&&(r[e]=n[e]);return derefSchema(t,r)}#d(t,n){for(let r of n){let n=isObject(r)?deref(t,r):r;if(!isObject(n)||n.in!==`body`)continue;let i=isObject(n.schema)?derefSchema(t,n.schema):{};return{required:n.required===!0,contentType:`application/json`,schema:i}}}async#f(e,t,n,r){let a=await resolveHeaders(this.#n),o=e.pathTemplate,s=new URLSearchParams,c=[];for(let t of e.parameters){let e=n[t.name];e!=null&&(t.location===`path`?o=o.replace(`{${t.name}}`,encodeURIComponent(String(e))):t.location===`query`?appendQuery(s,t.name,e):t.location===`cookie`?c.push(`${t.name}=${encodeURIComponent(String(e))}`):a[t.name]=String(e))}if(applySecurity(e.security,this.#n,a,s,c),c.length>0){let e=a.cookie??a.Cookie;delete a.Cookie,a.cookie=[e,...c].filter(e=>!!e).join(`; `)}let l=new URL(joinPath(t,o));l.search=s.toString();let u;e.requestBody!==void 0&&n.body!==void 0&&(u=JSON.stringify(n.body),a[`content-type`]=e.requestBody.contentType);let d=await fetch(l,{method:e.method.toUpperCase(),headers:a,body:u,signal:r?.abortSignal});return{status:d.status,statusText:d.statusText,body:await readResponseBody(d)}}};function appendQuery(e,t,n){if(isArray(n)){for(let r of n)e.append(t,String(r));return}e.append(t,String(n))}function joinPath(e,t){return`${e.endsWith(`/`)?e.slice(0,-1):e}${t.startsWith(`/`)?t:`/${t}`}`}async function readResponseBody(e){let t=await e.text();if(t.length===0)return null;if((e.headers.get(`content-type`)??``).includes(`application/json`))try{return JSON.parse(t)}catch{return t}return t}export{OpenApiConnectionClient};
+import{isLoopbackHostname}from"#shared/network-address.js";import{isObject}from"#shared/guards.js";import{jsonSchema,tool}from"ai";import{passesToolFilter,resolveHeaders}from"#runtime/connections/mcp-client.js";import{HTTP_METHODS,operationDescription,operationName,uniqueName}from"#runtime/connections/openapi-operations.js";import{buildInputSchema,deref,derefSchema,isArray}from"#runtime/connections/openapi-schema.js";import{applySecurity,resolveSecurity}from"#runtime/connections/openapi-security.js";import{extractServerUrl,parseSpecDocument}from"#runtime/connections/openapi-spec.js";const SWAGGER_PARAMETER_SCHEMA_KEYS=[`default`,`enum`,`exclusiveMaximum`,`exclusiveMinimum`,`format`,`items`,`maximum`,`maxItems`,`maxLength`,`minimum`,`minItems`,`minLength`,`multipleOf`,`pattern`,`type`,`uniqueItems`];var OpenApiConnectionClient=class{#e;#t;#n;constructor(e){this.#n=e}async connect(){return this.#r()}async getToolMetadata(){return(await this.#r()).metadata}async getTools(){return(await this.#r()).tools}async executeTool(e,n,r){let i=await this.#r(),a=i.operations.get(e);if(a===void 0)throw Error(`Tool "${e}" not found in connection "${this.#n.connectionName}".`);return this.#f(a,i.baseUrl,isObject(n)?n:{},{abortSignal:r?.abortSignal})}async close(){this.#e=void 0,this.#t=void 0}async#r(){if(this.#t!==void 0)return this.#t;if(this.#e!==void 0)return this.#e;this.#e=this.#i();try{return this.#t=await this.#e,this.#t}catch(e){throw this.#e=void 0,e}}async#i(){let e=await this.#o(),a=this.#a(e),o=this.#s(e),s=this.#n.tools,c=s===void 0?o:o.filter(e=>passesToolFilter(e.toolName,s)),l=[],u=new Map,d={};for(let e of c)u.set(e.toolName,e),l.push({description:e.description,inputSchema:e.inputSchema,name:e.toolName}),d[e.toolName]=tool({description:e.description,inputSchema:jsonSchema(e.inputSchema),execute:async(n,r)=>this.#f(e,a,isObject(n)?n:{},{abortSignal:r?.abortSignal})});return{metadata:l,operations:u,tools:d,baseUrl:a}}#a(e){let t=this.#n.url,n=typeof t==`string`&&t.trim().length>0?t:extractServerUrl(e,this.#n.spec);if(n===void 0)throw Error(`OpenAPI connection "${this.#n.connectionName}" has no base URL: set "baseUrl" or ensure the document declares an absolute "servers" entry or Swagger "host".`);return assertSecureUrl(n,this.#n.connectionName,`base`),n}async#o(){let e=this.#n.spec;if(e===void 0)throw Error(`OpenAPI connection "${this.#n.connectionName}" is missing its "spec" source.`);if(typeof e!=`string`)return e;assertSecureUrl(e,this.#n.connectionName,`spec`);let n;try{n=await fetch(e,{headers:{accept:`application/json, application/yaml, text/yaml, */*`}})}catch(t){throw Error(`OpenAPI connection "${this.#n.connectionName}" failed to fetch its spec from "${e}": ${String(t)}`)}if(n.redirected&&assertSecureUrl(n.url,this.#n.connectionName,`spec`),!n.ok)throw Error(`OpenAPI connection "${this.#n.connectionName}" failed to fetch its spec from "${e}": HTTP ${n.status}.`);let r=await n.text(),i;try{i=parseSpecDocument(r)}catch(t){throw Error(`OpenAPI connection "${this.#n.connectionName}" spec at "${e}" could not be parsed as JSON or YAML: ${String(t)}`)}if(!isObject(i))throw Error(`OpenAPI connection "${this.#n.connectionName}" spec at "${e}" is not an OpenAPI document object.`);return i}#s(e){let n=e.paths;if(!isObject(n))return[];let r=[],i=new Set;for(let[a,d]of Object.entries(n)){if(!isObject(d))continue;let n=isArray(d.parameters)?d.parameters:[];for(let f of HTTP_METHODS){let o=d[f];if(!isObject(o))continue;let p=uniqueName(operationName(o,f,a),i),m=isArray(o.parameters)?o.parameters:[],h=[...n,...m],g=this.#c(e,h),_=this.#l(e,o.requestBody,h);r.push({toolName:p,method:f,pathTemplate:a,description:operationDescription(o),parameters:g,requestBody:_,inputSchema:buildInputSchema(g,_),security:resolveSecurity(e,o)})}}return r}#c(e,n){let r=[];for(let i of n){let n=isObject(i)?deref(e,i):i;if(!isObject(n))continue;let a=n.in;if(a!==`path`&&a!==`query`&&a!==`header`&&a!==`cookie`||typeof n.name!=`string`)continue;let o=this.#u(e,n);r.push({name:n.name,location:a,required:n.required===!0||a===`path`,schema:o,description:typeof n.description==`string`?n.description:void 0})}return r}#l(e,n,r=[]){if(isObject(n)){let r=deref(e,n);if(isObject(r)&&isObject(r.content)){let n=r.content,i=`application/json`in n?`application/json`:Object.keys(n)[0];if(i!==void 0){let a=n[i],o=isObject(a)&&isObject(a.schema)?derefSchema(e,a.schema):{};return{required:r.required===!0,contentType:i,schema:o}}}}return this.#d(e,r)}#u(e,n){if(isObject(n.schema))return derefSchema(e,n.schema);let r={};for(let e of SWAGGER_PARAMETER_SCHEMA_KEYS)n[e]!==void 0&&(r[e]=n[e]);return derefSchema(e,r)}#d(e,n){for(let r of n){let n=isObject(r)?deref(e,r):r;if(!isObject(n)||n.in!==`body`)continue;let i=isObject(n.schema)?derefSchema(e,n.schema):{};return{required:n.required===!0,contentType:`application/json`,schema:i}}}async#f(e,t,n,r){let i=await resolveHeaders(this.#n),o=e.pathTemplate,s=new URLSearchParams,c=[];for(let t of e.parameters){let e=n[t.name];e!=null&&(t.location===`path`?o=o.replace(`{${t.name}}`,encodeURIComponent(String(e))):t.location===`query`?appendQuery(s,t.name,e):t.location===`cookie`?c.push(`${t.name}=${encodeURIComponent(String(e))}`):i[t.name]=String(e))}if(applySecurity(e.security,this.#n,i,s,c),c.length>0){let e=i.cookie??i.Cookie;delete i.Cookie,i.cookie=[e,...c].filter(e=>!!e).join(`; `)}let l=new URL(joinPath(t,o));l.search=s.toString();let u;e.requestBody!==void 0&&n.body!==void 0&&(u=JSON.stringify(n.body),i[`content-type`]=e.requestBody.contentType);let d=await fetch(l,{method:e.method.toUpperCase(),headers:i,body:u,signal:r?.abortSignal});return{status:d.status,statusText:d.statusText,body:await readResponseBody(d)}}};function appendQuery(e,t,n){if(isArray(n)){for(let r of n)e.append(t,String(r));return}e.append(t,String(n))}function joinPath(e,t){return`${e.endsWith(`/`)?e.slice(0,-1):e}${t.startsWith(`/`)?t:`/${t}`}`}function assertSecureUrl(t,n,r){let i;try{i=new URL(t)}catch{throw Error(`OpenAPI connection "${n}" has an invalid ${r} URL "${t}".`)}if(i.protocol!==`https:`&&!(i.protocol===`http:`&&isLoopbackHostname(i.hostname)))throw Error(`OpenAPI connection "${n}" must use https for its ${r} (got "${i.protocol}//${i.host}").`)}async function readResponseBody(e){let t=await e.text();if(t.length===0)return null;if((e.headers.get(`content-type`)??``).includes(`application/json`))try{return JSON.parse(t)}catch{return t}return t}export{OpenApiConnectionClient};

package/dist/src/runtime/connections/openapi-spec.js

@@ -1 +1 @@
-import{isObject}from"#shared/guards.js";import matter from"#compiled/gray-matter/index.js";import{isArray}from"#runtime/connections/openapi-schema.js";function parseSpecDocument(e){try{return JSON.parse(e)}catch{}let n=e.replace(/^\uFEFF/,``);return matter(n.trimStart().startsWith(`---`)?n:`---\n${n}\n---`).data??{}}function extractServerUrl(e,t){let n=extractOpenApiServerUrl(e,t);return n===void 0?extractSwaggerBaseUrl(e,t):n}function extractOpenApiServerUrl(t,r){let i=t.servers;if(isArray(i))for(let t of i){if(!isObject(t)||typeof t.url!=`string`||t.url.length===0)continue;let n=isObject(t.variables)?substituteServerVariables(t.url,t.variables):t.url;if(n.startsWith(`http://`)||n.startsWith(`https://`))return n;if(typeof r==`string`&&URL.canParse(r))try{return new URL(n,r).toString()}catch{}}}function extractSwaggerBaseUrl(e,t){let n=typeof e.basePath==`string`?e.basePath:``,r=typeof e.host==`string`&&e.host.length>0?e.host:``,i=typeof t==`string`&&URL.canParse(t)?new URL(t):void 0,a=extractSwaggerScheme(e)??i?.protocol.replace(/:$/,``)??`https`;if(r.length>0)return`${a}://${r}${normalizeBasePath(n)}`;if(i!==void 0){let e=new URL(normalizeBasePath(n)||`/`,i.origin).toString();return e.endsWith(`/`)&&normalizeBasePath(n).length===0?e.slice(0,-1):e}}function extractSwaggerScheme(e){let t=e.schemes;if(isArray(t)){for(let e of t)if(e===`https`||e===`http`)return e}}function normalizeBasePath(e){let t=e.trim();return t.length===0||t===`/`?``:t.startsWith(`/`)?t:`/${t}`}function substituteServerVariables(t,n){return t.replace(/\{([^}]+)\}/g,(t,r)=>{let i=n[r];return isObject(i)&&typeof i.default==`string`?i.default:t})}export{extractServerUrl,parseSpecDocument};
+import{isObject}from"#shared/guards.js";import{parseFrontmatter}from"#internal/helpers/gray-matter.js";import{isArray}from"#runtime/connections/openapi-schema.js";function parseSpecDocument(e){try{return JSON.parse(e)}catch{}let n=e.replace(/^\uFEFF/,``);return parseFrontmatter(n.trimStart().startsWith(`---`)?n:`---\n${n}\n---`).data}function extractServerUrl(e,t){let n=extractOpenApiServerUrl(e,t);return n===void 0?extractSwaggerBaseUrl(e,t):n}function extractOpenApiServerUrl(t,r){let i=t.servers;if(isArray(i))for(let t of i){if(!isObject(t)||typeof t.url!=`string`||t.url.length===0)continue;let n=isObject(t.variables)?substituteServerVariables(t.url,t.variables):t.url;if(n.startsWith(`http://`)||n.startsWith(`https://`))return n;if(typeof r==`string`&&URL.canParse(r))try{return new URL(n,r).toString()}catch{}}}function extractSwaggerBaseUrl(e,t){let n=typeof e.basePath==`string`?e.basePath:``,r=typeof e.host==`string`&&e.host.length>0?e.host:``,i=typeof t==`string`&&URL.canParse(t)?new URL(t):void 0,a=extractSwaggerScheme(e)??i?.protocol.replace(/:$/,``)??`https`;if(r.length>0)return`${a}://${r}${normalizeBasePath(n)}`;if(i!==void 0){let e=new URL(normalizeBasePath(n)||`/`,i.origin).toString();return e.endsWith(`/`)&&normalizeBasePath(n).length===0?e.slice(0,-1):e}}function extractSwaggerScheme(e){let t=e.schemes;if(isArray(t)){for(let e of t)if(e===`https`||e===`http`)return e}}function normalizeBasePath(e){let t=e.trim();return t.length===0||t===`/`?``:t.startsWith(`/`)?t:`/${t}`}function substituteServerVariables(t,n){return t.replace(/\{([^}]+)\}/g,(t,r)=>{let i=n[r];return isObject(i)&&typeof i.default==`string`?i.default:t})}export{extractServerUrl,parseSpecDocument};

package/dist/src/runtime/resolve-dynamic-skill.js

@@ -1 +1 @@
-import{expectFunction,expectObjectRecord}from"#internal/authored-module.js";import{toErrorMessage}from"#shared/errors.js";import{ResolveAgentError,loadResolvedModuleExport}from"#runtime/resolve-helpers.js";async function resolveDynamicSkillDefinition(i,a,o){try{let n=expectObjectRecord(expectObjectRecord(await loadResolvedModuleExport({definition:i,kindLabel:`dynamic-skill`,moduleMap:a,nodeId:o}),describe(i,`to return an object`)).events,describe(i,`to provide an events object`)),r={};for(let t of i.eventNames)r[t]=expectFunction(n[t],describe(i,`to provide a handler for event "${t}"`));return{eventNames:[...i.eventNames],events:r,exportName:i.exportName,logicalPath:i.logicalPath,slug:i.slug,sourceId:i.sourceId,sourceKind:`module`}}catch(e){throw e instanceof ResolveAgentError?e:new ResolveAgentError(`Failed to resolve dynamic skill from "${i.logicalPath}": ${toErrorMessage(e)}`,{logicalPath:i.logicalPath,sourceId:i.sourceId})}}function describe(e,t){return`Expected the dynamic skill export "${e.exportName??`default`}" from "${e.logicalPath}" ${t}.`}export{resolveDynamicSkillDefinition};
+import{expectFunction,expectObjectRecord}from"#internal/authored-module.js";import{toErrorMessage}from"#shared/errors.js";import{ResolveAgentError,loadResolvedModuleExport}from"#runtime/resolve-helpers.js";async function resolveDynamicSkillDefinition(i,a,o){try{let n=expectObjectRecord(expectObjectRecord(await loadResolvedModuleExport({definition:i,kindLabel:`dynamic-skill`,moduleMap:a,nodeId:o}),describe(i,`to return an object`)).events,describe(i,`to provide an events object`)),r={};for(let t of i.eventNames)r[t]=expectFunction(n[t],describe(i,`to provide a handler for event "${t}"`));return{eventNames:[...i.eventNames],events:r,exportName:i.exportName,extensionNamespace:i.extensionNamespace,logicalPath:i.logicalPath,slug:i.slug,sourceId:i.sourceId,sourceKind:`module`}}catch(e){throw e instanceof ResolveAgentError?e:new ResolveAgentError(`Failed to resolve dynamic skill from "${i.logicalPath}": ${toErrorMessage(e)}`,{logicalPath:i.logicalPath,sourceId:i.sourceId})}}function describe(e,t){return`Expected the dynamic skill export "${e.exportName??`default`}" from "${e.logicalPath}" ${t}.`}export{resolveDynamicSkillDefinition};

package/dist/src/runtime/resolve-dynamic-tool.js

@@ -1 +1 @@
-import{expectFunction,expectObjectRecord}from"#internal/authored-module.js";import{toErrorMessage}from"#shared/errors.js";import{ResolveAgentError,loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{registerDefinitionSource,stampDefinitionKey}from"#public/tool-result-narrowing.js";async function resolveDynamicToolDefinition(i,a,o){try{let n=expectObjectRecord(await loadResolvedModuleExport({definition:i,kindLabel:`dynamic-tool`,moduleMap:a,nodeId:o}),describe(i,`to return an object`)),r=expectObjectRecord(n.events,describe(i,`to provide an events object`)),s={};for(let t of i.eventNames)s[t]=expectFunction(r[t],describe(i,`to provide a handler for event "${t}"`));let c=`dynamic-tool-source:${i.sourceId}`;return stampDefinitionKey(n,c),registerDefinitionSource(c,{kind:`tool`,logicalPath:i.logicalPath,name:i.slug}),{eventNames:[...i.eventNames],events:s,exportName:i.exportName,logicalPath:i.logicalPath,slug:i.slug,sourceId:i.sourceId,sourceKind:`module`}}catch(e){throw e instanceof ResolveAgentError?e:new ResolveAgentError(`Failed to resolve dynamic tool from "${i.logicalPath}": ${toErrorMessage(e)}`,{logicalPath:i.logicalPath,sourceId:i.sourceId})}}function describe(e,t){return`Expected the dynamic tool export "${e.exportName??`default`}" from "${e.logicalPath}" ${t}.`}export{resolveDynamicToolDefinition};
+import{expectFunction,expectObjectRecord}from"#internal/authored-module.js";import{toErrorMessage}from"#shared/errors.js";import{ResolveAgentError,loadResolvedModuleExport}from"#runtime/resolve-helpers.js";import{registerDefinitionSource,stampDefinitionKey}from"#public/tool-result-narrowing.js";async function resolveDynamicToolDefinition(i,a,o){try{let n=expectObjectRecord(await loadResolvedModuleExport({definition:i,kindLabel:`dynamic-tool`,moduleMap:a,nodeId:o}),describe(i,`to return an object`)),r=expectObjectRecord(n.events,describe(i,`to provide an events object`)),s={};for(let t of i.eventNames)s[t]=expectFunction(r[t],describe(i,`to provide a handler for event "${t}"`));let c=`dynamic-tool-source:${i.sourceId}`;return stampDefinitionKey(n,c),registerDefinitionSource(c,{kind:`tool`,logicalPath:i.logicalPath,name:i.slug}),{eventNames:[...i.eventNames],events:s,exportName:i.exportName,extensionNamespace:i.extensionNamespace,logicalPath:i.logicalPath,slug:i.slug,sourceId:i.sourceId,sourceKind:`module`}}catch(e){throw e instanceof ResolveAgentError?e:new ResolveAgentError(`Failed to resolve dynamic tool from "${i.logicalPath}": ${toErrorMessage(e)}`,{logicalPath:i.logicalPath,sourceId:i.sourceId})}}function describe(e,t){return`Expected the dynamic tool export "${e.exportName??`default`}" from "${e.logicalPath}" ${t}.`}export{resolveDynamicToolDefinition};

package/dist/src/runtime/types.d.ts

@@ -278,6 +278,11 @@ export interface ResolvedDynamicToolResolver extends Readonly<ModuleSourceRef> {
     readonly slug: string;
     readonly eventNames: readonly string[];
     readonly events: Readonly<Record<string, (event: unknown, ctx: unknown) => unknown | Promise<unknown>>>;
+    /**
+     * Mount namespace when this resolver comes from an extension. Names of tools
+     * the resolver produces are prefixed with `${extensionNamespace}__`.
+     */
+    readonly extensionNamespace?: string;
 }
 /**
  * Runtime resolver for dynamic skills declared via `defineDynamic({ events })`
@@ -288,6 +293,11 @@ export interface ResolvedDynamicSkillResolver extends Readonly<ModuleSourceRef>
     readonly slug: string;
     readonly eventNames: readonly string[];
     readonly events: Readonly<Record<string, (event: unknown, ctx: unknown) => unknown | Promise<unknown>>>;
+    /**
+     * Mount namespace when this resolver comes from an extension. Names of skills
+     * a map resolver produces are prefixed with `${extensionNamespace}__`.
+     */
+    readonly extensionNamespace?: string;
 }
 /**
  * Runtime resolver for dynamic instructions declared via

package/dist/src/services/dev-client/vercel-auth-error.d.ts

@@ -17,10 +17,10 @@ import type { DevelopmentOidcTokenFailure } from "#services/dev-client/request-h
 /** Returns the stable Trusted Sources code embedded in a Vercel error message. */
 export declare function vercelTrustedSourcesErrorCode(message: string): string | undefined;
 /**
- * Returns `true` for an HTTP 401 carrying Vercel's protection challenge.
+ * Returns `true` for a Vercel Deployment Protection challenge.
  *
  * Accepts both real {@link ClientError} instances and structurally
- * compatible duck-typed errors (`{ status: number, body: string }`)
+ * compatible duck-typed errors (`{ status, body, headers }`)
  * so callers can detect the challenge regardless of whether the
  * error survived a network/IPC boundary.
  */

package/dist/src/services/dev-client/vercel-auth-error.js

@@ -1,9 +1,9 @@
 import{isObject}from"#shared/guards.js";import{ClientError}from"#client/client-error.js";const VERCEL_AUTH_CHALLENGE_MARKERS=[`vercel.com/sso-api`,`<title>Authentication Required</title>`],TRUSTED_SOURCES_ERROR_CODE=/^TRUSTED_SOURCES_[A-Z0-9_]+$/u;function vercelTrustedSourcesErrorCode(e){for(let t of e.replaceAll(`\r
 `,`
 `).trim().split(`
-`)){let e=t.trim();if(TRUSTED_SOURCES_ERROR_CODE.test(e))return e}}function bodyLooksLikeVercelAuthChallenge(e){return e.length>0&&VERCEL_AUTH_CHALLENGE_MARKERS.every(t=>e.includes(t))}function isVercelAuthChallenge(n){return n instanceof ClientError?n.status===401&&bodyLooksLikeVercelAuthChallenge(n.body):isObject(n)&&n.status===401&&typeof n.body==`string`&&bodyLooksLikeVercelAuthChallenge(n.body)}function formatVercelAuthChallengeMessage(e){let t=[`Vercel Deployment Protection blocked the request to ${e.serverUrl}.`];return e.oidcTokenFailure!==void 0&&t.push(``,formatDevelopmentOidcTokenFailure(e.oidcTokenFailure)),t.push(``,"To access the deployment from `eve dev`, do one of:","  • Run `vercel link` in this project so the CLI can mint an OIDC",`    token for the deployment automatically.`,`  • Set VERCEL_AUTOMATION_BYPASS_SECRET to a Protection Bypass for`,`    Automation token (Project Settings → Deployment Protection).`,`  • Disable Deployment Protection on the target deployment.`,``,`Docs: https://vercel.com/docs/deployment-protection`),t.join(`
+`)){let e=t.trim();if(TRUSTED_SOURCES_ERROR_CODE.test(e))return e}}function bodyLooksLikeVercelAuthChallenge(e){return e.length>0&&VERCEL_AUTH_CHALLENGE_MARKERS.every(t=>e.includes(t))}function isVercelSsoUrl(e){let t=URL.parse(e);return t?.origin===`https://vercel.com`&&t.pathname===`/sso-api`&&t.searchParams.has(`url`)}function isVercelSsoRedirect(e,t){if(e<300||e>=400||t===void 0)return!1;for(let[e,n]of Object.entries(t))if(e.toLowerCase()===`location`&&typeof n==`string`)return isVercelSsoUrl(n);return!1}function isVercelUnauthorized(e,t){if(e!==401||t===void 0)return!1;for(let[e,n]of Object.entries(t))if(e.toLowerCase()===`x-vercel-error`&&n===`UNAUTHORIZED`)return!0;return!1}function bodyLooksLikeStructuredVercelAuthChallenge(t){let n;try{n=JSON.parse(t)}catch{return!1}if(!isObject(n)||!isObject(n.error)||!isObject(n.protection))return!1;let r=n.error.code,i=n.protection.vercel_auth_callback;return(r===401||r===`401`)&&n.error.message===`Protected deployment`&&typeof i==`string`&&isVercelSsoUrl(i)}function isVercelAuthChallenge(n){let r=n instanceof ClientError||isObject(n)?n:void 0;if(r===void 0||typeof r.status!=`number`||typeof r.body!=`string`)return!1;let i=isObject(r.headers)?r.headers:void 0;return isVercelSsoRedirect(r.status,i)||isVercelUnauthorized(r.status,i)||r.status===401&&(bodyLooksLikeVercelAuthChallenge(r.body)||bodyLooksLikeStructuredVercelAuthChallenge(r.body))}function formatVercelAuthChallengeMessage(e){let t=[`Vercel Deployment Protection blocked the request to ${e.serverUrl}.`];return e.oidcTokenFailure!==void 0&&t.push(``,formatDevelopmentOidcTokenFailure(e.oidcTokenFailure)),t.push(``,"To access the deployment from `eve dev`, do one of:","  • Run `vercel link` in this project so the CLI can mint an OIDC",`    token for the deployment automatically.`,`  • Set VERCEL_AUTOMATION_BYPASS_SECRET to a Protection Bypass for`,`    Automation token (Project Settings → Deployment Protection).`,`  • Disable Deployment Protection on the target deployment.`,``,`Docs: https://vercel.com/docs/deployment-protection`),t.join(`
 `)}function formatDevelopmentOidcTokenFailure(e){switch(e.kind){case`resolution-failed`:return`The local Vercel OIDC token could not be resolved: ${e.message}`;case`malformed-token`:return e.reason===`missing-payload`?`Vercel returned a local OIDC token without a JWT payload.`:`Vercel returned a local OIDC token whose payload is not valid JSON.`;case`invalid-claims`:return`The local Vercel OIDC token has invalid claims: ${e.invalidClaims.join(`, `)}.`;case`target-mismatch`:return`The local Vercel OIDC token does not match the resolved deployment: ${e.mismatchedClaims.join(`, `)}.`;default:return e}}function formatVercelTrustedSourcesFailure(e){let t=e.replaceAll(`\r
 `,`
 `).trim().split(`
-`),n=t.findIndex(e=>TRUSTED_SOURCES_ERROR_CODE.test(e.trim()));if(n<0)return e;let r=t[n].trim(),i=t.slice(0,n).join(`
-`).trim();return i.length===0?e:`${i}\n\n${r}`}export{formatDevelopmentOidcTokenFailure,formatVercelAuthChallengeMessage,formatVercelTrustedSourcesFailure,isVercelAuthChallenge,vercelTrustedSourcesErrorCode};
+`),n=t.findIndex(e=>TRUSTED_SOURCES_ERROR_CODE.test(e.trim()));if(n<0)return e;let i=t[n].trim(),a=t.slice(0,n).join(`
+`).trim();return a.length===0?e:`${a}\n\n${i}`}export{formatDevelopmentOidcTokenFailure,formatVercelAuthChallengeMessage,formatVercelTrustedSourcesFailure,isVercelAuthChallenge,vercelTrustedSourcesErrorCode};

package/dist/src/setup/scaffold/create/project.js

@@ -1,4 +1,4 @@
-import{pinnedNodeEngineMajor}from"../../node-engine.js";import{pathExists,writeTextFile}from"../files.js";import{resolveVersionToken}from"../version-tokens.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{SUPPORTED_AUTHORED_MODULE_FILE_EXTENSIONS}from"../update/module-files.js";import{WEB_APP_TEMPLATE_FILES}from"./web-template.js";import{basename,join,resolve}from"node:path";import{mkdir,readdir,stat}from"node:fs/promises";const CURRENT_DIRECTORY_PROJECT_NAME=`.`,ALLOWED_CREATE_IN_PLACE_ENTRIES=new Set([`.DS_Store`,`.git`,`.gitkeep`,`.hg`]),DEFAULT_AI_PACKAGE_VERSION=`^7.0.0`,DEFAULT_CONNECT_PACKAGE_VERSION=`0.2.2`,DEFAULT_ZOD_PACKAGE_VERSION=`4.4.3`,DEFAULT_EVE_PACKAGE_CONTRACT={version:`0.22.2`,nodeEngine:`>=24`};function resolveEvePackageContract(e=DEFAULT_EVE_PACKAGE_CONTRACT){return{version:resolveVersionToken(`evePackage.version`,e.version),nodeEngine:resolveVersionToken(`evePackage.nodeEngine`,e.nodeEngine)}}function modelProviderSlug(e){let t=(e.split(`/`)[0]??``).replaceAll(/[^A-Za-z0-9._-]/gu,``);return t.length>0?t:`anthropic`}function byokProviderEnvVar(e){let t=modelProviderSlug(e).toUpperCase().replaceAll(/[^A-Z0-9]/gu,`_`);return`${/^[0-9]/.test(t)?`_`:``}${t}_API_KEY`}function agentTemplateFiles(e){return{"agent/agent.ts":BASE_AGENT_TEMPLATE.replaceAll(`__EVE_INIT_MODEL__`,e),"agent/channels/eve.ts":WEB_APP_TEMPLATE_FILES[`agent/channels/eve.ts`],"agent/instructions.md":AGENT_INSTRUCTIONS_TEMPLATE}}function renderTemplate(e,t){return e.replaceAll(`__EVE_INIT_APP_NAME__`,t.appName).replaceAll(`__EVE_INIT_MODEL__`,t.model).replaceAll(`__EVE_INIT_BYOK_PROVIDER__`,modelProviderSlug(t.model)).replaceAll(`__EVE_INIT_BYOK_ENV_VAR__`,byokProviderEnvVar(t.model)).replaceAll(`__EVE_INIT_PACKAGE_VERSION__`,formatEveDependencySpecifier(t.eveVersion)).replaceAll(`__EVE_INIT_AI_SDK_VERSION__`,t.aiPackageVersion).replaceAll(`__EVE_INIT_CONNECT_VERSION__`,t.connectPackageVersion).replaceAll(`__EVE_INIT_ZOD_VERSION__`,t.zodPackageVersion).replaceAll(`__EVE_INIT_TYPESCRIPT_VERSION__`,t.typescriptPackageVersion).replaceAll(`__EVE_INIT_TYPES_NODE_VERSION__`,t.nodeTypesVersion).replaceAll(`__EVE_INIT_NODE_ENGINE__`,t.nodeEngine)}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}const BASE_AGENT_TEMPLATE=`import { defineAgent } from "eve";
+import{pinnedNodeEngineMajor}from"../../node-engine.js";import{pathExists,writeTextFile}from"../files.js";import{resolveVersionToken}from"../version-tokens.js";import{applyPackageManagerWorkspaceConfiguration,isPackageManagerWorkspaceMember,patchWorkspaceRootPackageJson}from"../workspace-root.js";import{SUPPORTED_AUTHORED_MODULE_FILE_EXTENSIONS}from"../update/module-files.js";import{WEB_APP_TEMPLATE_FILES}from"./web-template.js";import{basename,join,resolve}from"node:path";import{mkdir,readdir,stat}from"node:fs/promises";const CURRENT_DIRECTORY_PROJECT_NAME=`.`,ALLOWED_CREATE_IN_PLACE_ENTRIES=new Set([`.DS_Store`,`.git`,`.gitkeep`,`.hg`]),DEFAULT_AI_PACKAGE_VERSION=`^7.0.0`,DEFAULT_CONNECT_PACKAGE_VERSION=`0.2.2`,DEFAULT_ZOD_PACKAGE_VERSION=`4.4.3`,DEFAULT_EVE_PACKAGE_CONTRACT={version:`0.22.3`,nodeEngine:`>=24`};function resolveEvePackageContract(e=DEFAULT_EVE_PACKAGE_CONTRACT){return{version:resolveVersionToken(`evePackage.version`,e.version),nodeEngine:resolveVersionToken(`evePackage.nodeEngine`,e.nodeEngine)}}function modelProviderSlug(e){let t=(e.split(`/`)[0]??``).replaceAll(/[^A-Za-z0-9._-]/gu,``);return t.length>0?t:`anthropic`}function byokProviderEnvVar(e){let t=modelProviderSlug(e).toUpperCase().replaceAll(/[^A-Z0-9]/gu,`_`);return`${/^[0-9]/.test(t)?`_`:``}${t}_API_KEY`}function agentTemplateFiles(e){return{"agent/agent.ts":BASE_AGENT_TEMPLATE.replaceAll(`__EVE_INIT_MODEL__`,e),"agent/channels/eve.ts":WEB_APP_TEMPLATE_FILES[`agent/channels/eve.ts`],"agent/instructions.md":AGENT_INSTRUCTIONS_TEMPLATE}}function renderTemplate(e,t){return e.replaceAll(`__EVE_INIT_APP_NAME__`,t.appName).replaceAll(`__EVE_INIT_MODEL__`,t.model).replaceAll(`__EVE_INIT_BYOK_PROVIDER__`,modelProviderSlug(t.model)).replaceAll(`__EVE_INIT_BYOK_ENV_VAR__`,byokProviderEnvVar(t.model)).replaceAll(`__EVE_INIT_PACKAGE_VERSION__`,formatEveDependencySpecifier(t.eveVersion)).replaceAll(`__EVE_INIT_AI_SDK_VERSION__`,t.aiPackageVersion).replaceAll(`__EVE_INIT_CONNECT_VERSION__`,t.connectPackageVersion).replaceAll(`__EVE_INIT_ZOD_VERSION__`,t.zodPackageVersion).replaceAll(`__EVE_INIT_TYPESCRIPT_VERSION__`,t.typescriptPackageVersion).replaceAll(`__EVE_INIT_TYPES_NODE_VERSION__`,t.nodeTypesVersion).replaceAll(`__EVE_INIT_NODE_ENGINE__`,t.nodeEngine)}function formatEveDependencySpecifier(e){return/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z-.]+)?$/.test(e)?`^${e}`:e}const BASE_AGENT_TEMPLATE=`import { defineAgent } from "eve";
 
 export default defineAgent({
   model: "__EVE_INIT_MODEL__",
@@ -44,8 +44,8 @@ You are a helpful assistant.
 `,SHARED_TEMPLATE_FILES={"agent/channels/eve.ts":WEB_APP_TEMPLATE_FILES[`agent/channels/eve.ts`],"agent/instructions.md":AGENT_INSTRUCTIONS_TEMPLATE,"tsconfig.json":`{
   "compilerOptions": {
     "target": "ES2022",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
+    "module": "esnext",
+    "moduleResolution": "bundler",
     "types": ["node"],
     "strict": true,
     "esModuleInterop": true,

package/dist/src/svelte/index.js

@@ -1,3 +1,3 @@
-import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-CxcKypLZ.js";
+import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-D-S1TPCW.js";
 
 export { defaultMessageReducer, useEveAgent };

package/dist/src/svelte/use-eve-agent.js

@@ -1,3 +1,3 @@
-import { t as useEveAgent } from "../chunks/use-eve-agent-CxcKypLZ.js";
+import { t as useEveAgent } from "../chunks/use-eve-agent-D-S1TPCW.js";
 
 export { useEveAgent };

package/dist/src/vue/index.js

@@ -1,3 +1,3 @@
-import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-CM24ZUEI.js";
+import { n as defaultMessageReducer, t as useEveAgent } from "../chunks/use-eve-agent-Cojyfr4X.js";
 
 export { defaultMessageReducer, useEveAgent };

package/dist/src/vue/use-eve-agent.js

@@ -1,3 +1,3 @@
-import { t as useEveAgent } from "../chunks/use-eve-agent-CM24ZUEI.js";
+import { t as useEveAgent } from "../chunks/use-eve-agent-Cojyfr4X.js";
 
 export { useEveAgent };

package/docs/channels/custom.mdx

@@ -121,7 +121,7 @@ Route handlers can start a session on a different channel via `args.receive(chan
 
 ```ts
 import { defineChannel, POST } from "eve/channels";
-import slack from "./slack.js";
+import slack from "./slack";
 
 export default defineChannel({
   routes: [
@@ -220,7 +220,7 @@ The `context(state, session)` config option builds the per-step `channel` argume
 ```ts
 import { defineChannel } from "eve/channels";
 
-import { mintRef } from "./refs.js";
+import { mintRef } from "./refs";
 
 defineChannel<{ ref: string | null }>({
   state: { ref: null },

package/docs/channels/linear.mdx

@@ -164,7 +164,7 @@ Use the channel's `receive` target to continue an existing Agent Session or crea
 ```ts
 import { defineSchedule } from "eve/schedules";
 
-import linear from "../channels/linear.js";
+import linear from "../channels/linear";
 
 export default defineSchedule({
   cron: "0 14 * * 1",

package/docs/channels/slack.mdx

@@ -101,6 +101,8 @@ when you need the bearer token itself.
 
 The default handlers reply in-thread and show progress. Typing indicators post automatically: `Thinking…` on inbound, `Working…` on `turn.started`, a truncated reasoning snippet on `reasoning.appended`, and an action label on `actions.requested` — the tool name plus its most telling argument (`grep useEveAgent`, `read_file agent/agent.ts`), the subagent or remote-agent name for dispatched calls, and `+N more` when the model requests several actions at once. The model's own pre-tool narration, when present, takes precedence over the derived label. Reasoning snippets build progressively: extensions of at least four characters appear immediately, while smaller streamed deltas use the five-second refresh interval to avoid one Slack request per token. Override `events["reasoning.appended"]` if you prefer generic wording. Override `onAppMention` or the `events` handlers to customize.
 
+Outbound text preserves bare `@` tokens as literal text. To mention a user, embed Slack's `<@USER_ID>` syntax directly or use `channel.thread.mentionUser(userId)`.
+
 When a session starts without a `threadTs` (say, from a schedule or `receive(slack, ...)`), eve gives it a unique temporary continuation token. The first agent post anchors the session to the Slack message timestamp, and later posts and mentions resume that same session. Pass `initialMessage` with a `Card` to land a structured anchor first instead. `threadTs` and `initialMessage` are mutually exclusive.
 
 The example below overrides `onAppMention` to gate on an authored message and posts the completed reply to the thread. Event handlers receive `(eventData, channel, ctx)`, with Slack platform handles on `channel.thread` and `channel.slack`:

package/docs/concepts/context-control.md

@@ -22,7 +22,7 @@ To build the instructions prompt from typed helpers, lib code, or environment-de
 
 ```ts title="agent/instructions.ts"
 import { defineInstructions } from "eve/instructions";
-import { buildInstructionsPrompt } from "./lib/prompts.js";
+import { buildInstructionsPrompt } from "./lib/prompts";
 
 export default defineInstructions({
   markdown: buildInstructionsPrompt(),

package/docs/connections/openapi.mdx

@@ -23,7 +23,7 @@ export default defineOpenAPIConnection({
 
 Each operation becomes `<connection>__<operationId>`, for example `petstore__getInventory`. When an operation has no `operationId`, eve derives a deterministic `<method>_<sanitized-path>` name instead.
 
-`spec` can be an HTTPS URL that eve fetches at runtime, or an inline parsed OpenAPI object. Prefer a URL when the provider owns the contract and updates it; prefer an inline object for private APIs, generated specs you pin in source control, or small hand-authored contracts.
+`spec` can be a URL that eve fetches at runtime, or an inline parsed OpenAPI object. A spec URL must use `https` (plain `http` is allowed only for loopback hosts such as `localhost` during local development), and eve re-checks the transport after any redirects. Prefer a URL when the provider owns the contract and updates it; prefer an inline object for private APIs, generated specs you pin in source control, or small hand-authored contracts.
 
 ## Base URL and servers
 
@@ -34,6 +34,8 @@ eve resolves operation paths against `baseUrl` when you provide one. Otherwise,
 
 Use `baseUrl` when the spec is missing server data, points at the wrong environment, uses a relative server URL you do not want, or needs to be pinned for this agent.
 
+The resolved base URL must use `https` too (loopback hosts may use `http` for local development), since operation calls carry the connection's credentials.
+
 ```ts title="agent/connections/crm.ts"
 import { defineOpenAPIConnection } from "eve/connections";
 

package/docs/evals/assertions.mdx

@@ -77,13 +77,15 @@ Pick the cheapest builder that captures what "correct" means. When exact match i
 
 ## The matcher mini-language
 
-`t.calledTool` and `t.calledSubagent` take matcher objects. Tools accept `{ input, output, status, count }`; subagents accept `{ remoteUrl, output, status, count }`. Calls match `status: "completed"` by default; use `"pending"`, `"failed"`, or `"rejected"` explicitly for lifecycle checks. `count` is the exact number of calls matching every supplied constraint.
+`t.calledTool` and `t.calledSubagent` take matcher objects. Tools accept `{ input, output, status, count }`; subagents accept `{ remoteUrl, output, status, count }`. Calls match `status: "completed"` by default; use `"pending"`, `"failed"`, or `"rejected"` explicitly for lifecycle checks. A numeric `count` requires an exact number of calls matching every supplied constraint. Use a predicate for ranges or other custom count requirements; it receives the observed number of matching calls.
 
 Matcher values accept a literal (objects partial-deep-match), a RegExp, or a predicate function that returns a boolean:
 
 ```ts
 t.calledTool("bash", { input: { command: /^pwd/ }, count: 1 });
 
+t.calledTool("echo", { count: (count) => count >= 2 });
+
 t.calledTool("echo", { output: (value) => String(value).includes(marker) });
 
 parked.calledTool("guarded", { status: "pending", count: 1 });
@@ -108,7 +110,7 @@ const request = session.requireInputRequest({
 
 Beyond the raw `t.events` stream, the runner derives typed facts the assertions read: tool calls (name, input, output, lifecycle status), subagent calls, and HITL input requests. A turn that leaves the session open for a next message is the normal end state of a successful turn; parking on unanswered HITL input is tracked separately.
 
-Typed event matching covers presence, absence, exact counts, partial event data, and ordering:
+Typed event matching covers presence, absence, numeric or predicate counts, partial event data, and ordering:
 
 ```ts
 turn.notEvent("result.completed");

package/docs/extensions.md

@@ -0,0 +1,155 @@
+---
+title: "Extensions"
+description: "Package tools, connections, skills, and hooks as a reusable package and mount it into an agent."
+---
+
+An extension packages eve capabilities — tools, connections, skills, instructions, hooks — as a reusable npm or local package. You author it as an agent-shaped directory; a consuming agent mounts it under `agent/extensions/`, and its contributions compose into the agent under a namespace. Nothing is copied — upgrades come through the package manager.
+
+## Authoring
+
+An extension is an agent-shaped directory without `agent.ts` or `sandbox` (those belong to the consuming agent). Every slot works as it does in an agent, with names derived from paths.
+
+```
+@acme/crm/
+  package.json
+  ext/
+    extension.ts        # the extension declaration — see Configuration
+    tools/search.ts
+    connections/api.ts
+    skills/triage/SKILL.md
+    hooks/audit.ts
+    lib/http.ts         # shared helpers, imported as ../lib/http
+```
+
+Name tools and connections for what they do (`search`, not `crm_search`) — the mount supplies the namespace. Shared code goes in `ext/lib/`, imported by relative path — eve compiles the source, so relative imports need no `.js` extension.
+
+### Configuration
+
+Declare the extension in `ext/extension.ts` with `defineExtension`; its default export is the mount factory a consumer calls. Pass `config` — any [Standard Schema](https://standardschema.dev) (a Zod object here), like a tool's `inputSchema` — to accept consumer settings:
+
+```ts title="ext/extension.ts"
+import { defineExtension } from "eve/extension";
+import { z } from "zod";
+
+export default defineExtension({
+  config: z.object({
+    apiKey: z.string(),
+    baseUrl: z.string().default("https://api.acme.example"),
+  }),
+});
+```
+
+Config is optional — `defineExtension()` with no schema. Read it off the handle, imported from the declaration; it's typed from the schema:
+
+```ts title="ext/tools/search.ts"
+import { defineTool } from "eve/tools";
+
+import extension from "../extension";
+
+export default defineTool({
+  description: "Search the CRM.",
+  inputSchema: {
+    /* ... */
+  },
+  async execute({ query }) {
+    const { apiKey, baseUrl } = extension.config; // validated, defaults applied
+  },
+});
+```
+
+Config is bound once when the consumer mounts the extension and stays constant for the session; per-request values belong in connection auth instead.
+
+### State
+
+`defineState` is scoped to the extension's package automatically, so identically-named state never collides with the consuming agent or another extension. Author it exactly as in an agent — `defineState("budget", …)`.
+
+## Publishing
+
+Point `eve.extension` at the source directory and run `eve build` (wired to `build`/`prepare`):
+
+```jsonc title="package.json"
+{
+  "name": "@acme/crm",
+  "type": "module",
+  "eve": { "extension": "./ext" },
+  "files": ["ext", "dist"],
+  "peerDependencies": { "eve": "^x" },
+  "dependencies": { "zod": "^3" },
+  "scripts": { "build": "eve build", "prepare": "eve build" },
+}
+```
+
+Author the source with `moduleResolution: "bundler"` — eve compiles it, so relative imports need no `.js` extension:
+
+```jsonc title="tsconfig.json"
+{
+  "compilerOptions": {
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "types": ["node"],
+  },
+  "include": ["ext/**/*.ts"],
+}
+```
+
+`eve build` compiles the package's entry points to plain JavaScript with type declarations — the mount factory (`dist/index.mjs`) and the tool re-exports overrides use (`dist/tools`) — and fills the `exports` map so you never hand-list it. Compiling is what lets an installed extension load directly; local and workspace packages also work without publishing.
+
+### Dependencies
+
+`eve` is a **peer** dependency: one eve lives in the consuming app and the extension's `eve/*` imports resolve to it. Declare the eve versions your extension supports as the peer range (`"eve": "^1"`) — eve enforces it when the extension is mounted, failing the build with a clear error if the app's eve is out of range, rather than surfacing a confusing compile break. Everything else the extension imports (SDKs, `zod`, …) goes in `dependencies`; each extension resolves its own versions. The consumer recompiles the extension's contributions from source, so `files` must ship both `ext/` (that source) and `dist/` (the compiled entry points).
+
+Those deps resolve from `node_modules` under `eve dev`/`eve eval` and are bundled into the deployable by `eve build`. A dependency that can't be bundled (a native addon) must be listed in the **consuming agent's** `build.externalDependencies` — an extension can't declare build config, so note it in your README.
+
+## Mounting
+
+A consuming agent mounts an extension under `agent/extensions/` — a single file, or a directory when it needs [overrides](#overrides). The namespace is the file basename or directory name; contributions compose as `<namespace>__<name>` (`crm__search`, `crm__api`).
+
+```ts title="agent/extensions/crm.ts"
+import crm from "@acme/crm";
+
+export default crm({ apiKey: process.env.CRM_API_KEY });
+```
+
+A no-config extension takes no factory call — mount it with a bare re-export:
+
+```ts title="agent/extensions/gizmo.ts"
+export { default } from "@acme/gizmo";
+```
+
+### Overrides
+
+To override a mounted extension's contributions, author the mount as a directory: the declaration in `extension.ts`, override slots alongside it.
+
+```
+agent/extensions/crm/
+  extension.ts         # export default crm({ apiKey: process.env.CRM_API_KEY })
+  tools/search.ts      # composes as crm__search, shadowing the extension's own
+```
+
+A file in an override slot composes under the mount namespace and wins on a name collision. Name it for the bare contribution name (`search`, not `crm__search`) — the directory supplies the prefix. To tweak the extension's own definition, import and re-define it:
+
+```ts title="agent/extensions/crm/tools/search.ts"
+import { search } from "@acme/crm/tools";
+import { defineTool } from "eve/tools";
+import { always } from "eve/tools/approval";
+
+export default defineTool({ ...search, approval: always() });
+```
+
+Or drop it entirely by opting out of the slot with `disableTool()`:
+
+```ts title="agent/extensions/crm/tools/search.ts"
+import { disableTool } from "eve/tools";
+
+export default disableTool();
+```
+
+An override targets one slot, matched by name and kind: a static file replaces the extension's static tool, a dynamic file replaces its dynamic resolver, and `disableTool()` removes whichever the extension put there. Because a dynamic tool wins over a same-named static one at runtime, replace or disable a dynamic tool through its own slot — a static file of the same name won't shadow it.
+
+Overrides only work here — the `<namespace>__` prefix is reserved, so an agent-root contribution named `crm__…` is a build error and an extension can't be shadowed from outside its mount.
+
+## Limits
+
+An extension cannot declare a `sandbox`, agent config, schedules, or limits, and cannot mount other extensions — those are the consuming agent's to own (background scheduling, for instance, runs on the agent's deployment under its limits). An extension's tools run within the consuming agent's per-session limits.

package/docs/guides/client/overview.mdx

@@ -19,7 +19,7 @@ const client = new Client({
 });
 ```
 
-`host` is the origin where the eve routes are mounted. In a same-origin browser integration this is often `""`; scripts and backend services usually name the full URL.
+`host` is the URL where the eve routes are mounted. In a same-origin browser integration this is often `""`; scripts and backend services usually name the full URL. Any query parameters on `host` are included on every request, including session POSTs and event streams. Request-specific parameters, such as a stream cursor, take precedence when names overlap.
 
 ## Check health
 

package/docs/guides/dev-tui.md

@@ -136,6 +136,10 @@ eve dev https://user:pass@<your-app>
 
 For bearer tokens or custom schemes, repeat `-H, --header` to attach request headers.
 
+Query parameters in the target URL are preserved on every request, including
+session POSTs and event streams. This also supports deployment-protection URLs
+that carry their bypass credential in the query string.
+
 At startup the TUI asks Vercel to resolve the remote origin under the active scope. A resolved response is the authority for a project-scoped OIDC token—refreshing an expired development token when refresh credentials exist—or an automation-bypass secret. An unresolved host is probed anonymously. The TUI then requests `/eve/v1/info`, with a ten-second timeout. A successful response marks the remote ready. An eve OIDC challenge, Vercel Deployment Protection challenge, or `TRUSTED_SOURCES_ENVIRONMENT_MISMATCH` opens `/vc:login` automatically; ordinary network failures and server errors remain remote-availability errors and do not start an authentication flow. Esc or Ctrl-C cancels the authentication flow.
 
 In a remote session, `/vc:login` first resolves the deployment's Vercel project from its URL. If the active Vercel scope cannot resolve it, the flow asks for another team and reruns the lookup in that team's scope. If the CLI is logged out, the same panel runs the browser login first. The flow asks before adding any required Trusted Sources rule and requests a project-scoped token through `@vercel/oidc`. It does not relink the directory or modify `.env.local`. Finally, it retries `/eve/v1/info` to prove the credential works. A failure reports any login or Trusted Sources update that completed before it stopped.

package/docs/guides/dynamic-capabilities.md

@@ -30,7 +30,7 @@ The example below builds one tool per warehouse table. A map return names each t
 ```ts title="agent/tools/query.ts"
 import { defineDynamic, defineTool } from "eve/tools";
 import { z } from "zod";
-import { listTables, runReadOnly } from "../lib/warehouse.js";
+import { listTables, runReadOnly } from "../lib/warehouse";
 
 export default defineDynamic({
   events: {
@@ -89,7 +89,7 @@ A single file can declare handlers for several events, and the most recently fir
 ```ts title="agent/tools/catalog.ts"
 import { defineDynamic, defineTool } from "eve/tools";
 import { z } from "zod";
-import { runReadOnly, searchCatalog } from "../lib/catalog.js";
+import { runReadOnly, searchCatalog } from "../lib/catalog";
 
 export default defineDynamic({
   events: {
@@ -120,7 +120,7 @@ A dynamic skills file resolves which [skill](../skills) a caller can load, keyed
 
 ```ts title="agent/skills/team_playbook.ts"
 import { defineDynamic, defineSkill } from "eve/skills";
-import { PLAYBOOKS } from "../lib/playbooks.js";
+import { PLAYBOOKS } from "../lib/playbooks";
 
 export default defineDynamic({
   events: {

package/docs/guides/instrumentation.md

@@ -66,7 +66,7 @@ Use it when the values depend on the current session, turn, step, channel, or mo
 
 ```ts
 import { defineInstrumentation, isChannel } from "eve/instrumentation";
-import supportChannel from "./channels/support.js";
+import supportChannel from "./channels/support";
 
 export default defineInstrumentation({
   events: {

package/docs/guides/state.md

@@ -27,8 +27,8 @@ export const budget = defineState("my-agent.budget", () => ({ count: 0, cap: 25
 ```ts title="agent/tools/spend.ts"
 import { defineTool } from "eve/tools";
 import { z } from "zod";
-import { budget } from "../lib/budget.js";
-import { runQuery } from "../lib/warehouse.js";
+import { budget } from "../lib/budget";
+import { runQuery } from "../lib/warehouse";
 
 export default defineTool({
   description: "Run a query, counting it against the session budget.",
@@ -50,7 +50,7 @@ State is durable by default and does not reset between turns. If you want a clea
 
 ```ts title="agent/hooks/reset-budget.ts"
 import { defineHook } from "eve/hooks";
-import { budget } from "../lib/budget.js";
+import { budget } from "../lib/budget";
 
 export default defineHook({
   events: {

package/docs/instructions.mdx

@@ -21,7 +21,7 @@ A static prompt belongs in markdown (`agent/instructions.md`). Switch to a TypeS
 
 ```ts title="agent/instructions.ts"
 import { defineInstructions } from "eve/instructions";
-import { buildInstructionsPrompt } from "./lib/prompts.js";
+import { buildInstructionsPrompt } from "./lib/prompts";
 
 export default defineInstructions({
   markdown: buildInstructionsPrompt(),

package/docs/meta.json

@@ -12,6 +12,7 @@
     "sandbox",
     "subagents",
     "schedules",
+    "extensions",
     "evals",
     "---",
     "guides",

package/docs/patterns/dynamic-scheduling.md

@@ -30,8 +30,8 @@ This is the only authored schedule. It looks up due application-managed rows and
 
 ```ts title="agent/schedules/dynamic.ts"
 import { defineSchedule } from "eve/schedules";
-import slack from "../channels/slack.js";
-import { scheduleStore } from "../lib/schedule-store.js";
+import slack from "../channels/slack";
+import { scheduleStore } from "../lib/schedule-store";
 
 export default defineSchedule({
   cron: "* * * * *",
@@ -119,8 +119,8 @@ Create a one-time schedule with `everyMinutes: null`, or a recurring one with an
 ```ts title="agent/tools/create_schedule.ts"
 import { defineTool } from "eve/tools";
 import { z } from "zod";
-import { scheduleStore } from "../lib/schedule-store.js";
-import { requireScheduleOwner } from "../lib/tenant.js";
+import { scheduleStore } from "../lib/schedule-store";
+import { requireScheduleOwner } from "../lib/tenant";
 
 export default defineTool({
   description: "Create a one-time or repeating scheduled agent run for this tenant.",
@@ -142,8 +142,8 @@ export default defineTool({
 ```ts title="agent/tools/list_schedules.ts"
 import { defineTool } from "eve/tools";
 import { z } from "zod";
-import { scheduleStore } from "../lib/schedule-store.js";
-import { requireScheduleOwner } from "../lib/tenant.js";
+import { scheduleStore } from "../lib/schedule-store";
+import { requireScheduleOwner } from "../lib/tenant";
 
 export default defineTool({
   description: "List this tenant's dynamic schedules and their latest status.",
@@ -157,8 +157,8 @@ export default defineTool({
 ```ts title="agent/tools/update_schedule.ts"
 import { defineTool } from "eve/tools";
 import { z } from "zod";
-import { scheduleStore } from "../lib/schedule-store.js";
-import { requireScheduleOwner } from "../lib/tenant.js";
+import { scheduleStore } from "../lib/schedule-store";
+import { requireScheduleOwner } from "../lib/tenant";
 
 export default defineTool({
   description: "Change, pause, or resume one of this tenant's schedules.",
@@ -183,8 +183,8 @@ export default defineTool({
 import { defineTool } from "eve/tools";
 import { always } from "eve/tools/approval";
 import { z } from "zod";
-import { scheduleStore } from "../lib/schedule-store.js";
-import { requireScheduleOwner } from "../lib/tenant.js";
+import { scheduleStore } from "../lib/schedule-store";
+import { requireScheduleOwner } from "../lib/tenant";
 
 export default defineTool({
   description: "Permanently delete one of this tenant's schedules.",
@@ -232,7 +232,7 @@ export interface ScheduleStore {
   release(job: ClaimedSchedule, failure: { error: unknown; retryAt: Date }): Promise<void>;
 }
 
-export { scheduleStore } from "../../lib/schedule-store.js";
+export { scheduleStore } from "../../lib/schedule-store";
 ```
 
 Implement that adapter with whichever durable store already belongs to your application. It must preserve a few semantics: