eve 0.44.3 → 0.45.0

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # eve
 
+## 0.45.0
+
+### Minor Changes
+
+- b3cf8ee: eve now compiles framework defaults, authored files, extensions, overrides, and in-memory modules through one authoritative source graph, with replaceable default config, sandbox, home, health, and inspection routes plus agent-info v3. Built-in tool definitions move from `eve/tools/defaults` to individual `eve/tools/<name>` subpaths.
+- 6252784: Move provided tool definitions and capability-specific helpers to dedicated `eve/tools/*` entrypoints. Replace the removed `defineBashTool`, `defineReadFileTool`, `defineWriteFileTool`, `defineGlobTool`, and `defineGrepTool` factories with the corresponding reusable definitions.
+- f439e3d: Persistent subagent sessions are now the default: subagent tools expose `agentId`, completed children remain available for follow-up messages, and eve publishes the `<agents>` listing automatically. Remove `experimental.subagentPersistentSessions` from agent configuration; `false` is no longer an opt-out.
+
+### Patch Changes
+
+- 4a18994: Keep tools available during follow-up turns while an earlier tool approval remains unresolved, allowing unrelated work to continue without resolving the pending call.
+- d2995e1: Stamp Workflow runs with whether eve-managed OTEL tracing is enabled so dashboards can distinguish Workflow-only runs from enabled but unsampled traces. Session titles remain available alongside that metadata.
+- dfe0d18: Expose resumed session catch-up as a distinct `resuming` frontend lifecycle state so hydrated conversations do not show active-turn controls before an in-flight turn is confirmed.
+- 659774f: Refine generated Web Chat with a single Send or Stop composer action, faster question controls, and compact tool calls. Bash commands get a terminal view, while focus states, spacing, typography, and the composer backdrop are polished.
+- fc52796: Allow framework features to derive ordinary source slots from other selected modules through dependency-aware programmatic templates, with consistent composition and module-map hydration.
+- 2be67fa: Agent trace identity is now established before workflow execution begins, allowing workflow runs and OpenTelemetry spans to refer to the same trace from the outset. Delegated agents inherit the parent trace, while already-running sessions retain their current behavior.
+- 7ed4fb1: Workflow session, subagent, and turn rows now include `$eve.trace_id` when a sampled agent trace is available, allowing workflow views to open the corresponding OpenTelemetry trace directly. Rows without an exported agent trace omit the attribute.
+- 0bc8432: Integration setup banners now describe the integration being configured instead of showing eve's generic framework tagline.
+- 3274eee: Send remote-agent Vercel OIDC credentials in both the bearer and trusted-OIDC headers so `vercelOidc()` can reach eve agents behind Vercel Deployment Protection.
+- ae83a08: Update the generated Web Chat starter to close completed reasoning without delay, soften the header-to-content boundary only while content scrolls beneath it, and enable global font antialiasing.
+- 80571ee: Show declared environment variables and an eve setup link after adding a registry integration from the dev TUI. Chat SDK adapter links open the integration page's Configure section.
+- 7c5a69e: Keep durable agent sessions on their persisted OpenTelemetry trace instead of rotating after 200 turns. Agent Trace schema version 2 relies on native trace parentage instead of window, root-session, and duplicated parent-lineage attributes.
+- f38eaf1: Internal cleanup of the experimental background-tasks plumbing: centralized task-view schemas while preserving strict projection and broad tool-output contracts, removed a duplicate task tool-name set, established one task inbox-token import path, and shared serialized-context key-name constants. No behavior change.
+- cfa90d6: Telegram now supports HITL authorization challenges.
+- d79de0b: Expose channel-native receiver identity in model context, plus exact mention state for Slack, Teams, Telegram, and GitHub comments.
+- 687c371: OpenAI and Anthropic model calls now receive privacy-preserving end-user safety identifiers derived from the active session caller when the agent has not provided one, including calls made during context compaction.
+- 8e5d9b2: Add `j` and `k` as down and up shortcuts in non-editing TUI menus and the trace viewer while preserving normal text input in prompts, search fields, and editors.
+- 7eae011: Accept Vercel OIDC tokens issued from the global issuer in `vercelOidc()` and `verifyVercelOidc()`.
+- c6f9c85: Trace capture policies now receive the originating channel's type, letting a policy sample by channel (for example retaining interactive traffic while dropping scheduled runs). Policies that ignore the field are unaffected.
+
+## 0.44.4
+
+### Patch Changes
+
+- dbfa01c: New standalone projects created by `eve init` now include a `README.md` with templated project and development instructions.
+- 5a029d9: Allow `justbash({ customCommands })` to register trusted host application commands in live just-bash sandbox sessions.
+- 2bbb775: Pass the app installation workspace id to function-form Slack bot token providers across events, interactions, proactive sends, and private file downloads.
+- 2a34f75: Chat SDK direct-message channels now support HITL authorization challenges.
+- 1b1f2dd: Resume an existing Web Chat session's active response even when its durable history still ends at the previous turn boundary.
+- 8f2bf7a: Add `eval` and `deploy` scripts to newly scaffolded eve projects.
+- bca1304: Linq and Photon inbound messages now derive user auth from their message authors, allowing user-scoped connections to request authorization by default.
+- 50488a1: `/add` in the dev terminal UI now accepts a registry item address. `/add channel/slack` skips the category and search screens and opens that item's details and confirmation directly, then runs the same installation, setup, add-more, and deployment flow as bare `/add`, which still opens the registry browser.
+- 94a0952: Follow up to ten `web_fetch` redirects while rechecking each destination for SSRF safety. Non-success HTTP responses now return a plain-text failure result with the response body when available instead of failing the tool call.
+- 4464e4d: Slack inbound messages now derive their text from Block Kit blocks and legacy attachments when the top-level `text` field is empty or a short fallback. Alert-style bot posts (sections, fields, headers, markdown blocks, tables, cards, carousels, containers, rich text, legacy attachments) previously reached the model as an empty message body; they now carry the visible message content, and fetched thread replies get the same treatment.
+
 ## 0.44.3
 
 ### Patch Changes

package/README.md

@@ -55,18 +55,19 @@ my-agent/
 
 Every authored directory has a typed helper. Import each from the matching subpath:
 
-| Helper                                                                                                              | Subpath                               | Authored Location                                |
-| ------------------------------------------------------------------------------------------------------------------- | ------------------------------------- | ------------------------------------------------ |
-| `defineAgent(...)`                                                                                                  | `eve`                                 | `agent.ts`, `subagents/<id>/agent.ts`            |
-| `defineInstructions(...)`                                                                                           | `eve/instructions`                    | `instructions.ts` (or `instructions.md`)         |
-| `defineTool(...)`, `defineBashTool(...)`, `defineReadFileTool(...)`, `defineWriteFileTool(...)`, `disableTool(...)` | `eve/tools`                           | `tools/<name>.ts`                                |
-| `defineSkill(...)`, `getSkill(...)`                                                                                 | `eve/skills`                          | `skills/<name>.ts` (or `skills/<name>.md`)       |
-| `defineHook(...)`                                                                                                   | `eve/hooks`                           | `hooks/<slug>.ts`                                |
-| `defineChannel(...)`, `POST`, `GET`                                                                                 | `eve/channels`                        | `channels/<name>.ts`                             |
-| `eveChannel(...)`, `slackChannel(...)`, `vercelOidc(...)`                                                           | `eve/channels/eve`, `/slack`, `/auth` | reused from `channels/<name>.ts`                 |
-| `defineSandbox(...)`                                                                                                | `eve/sandbox`                         | `sandbox.ts` (or `sandbox/sandbox.ts`)           |
-| `defineSchedule(...)`                                                                                               | `eve/schedules`                       | `schedules/<name>.ts` (or `schedules/<name>.md`) |
-| `defineEval(...)`, `defineEvalConfig(...)`                                                                          | `eve/evals`                           | `evals/<name>.eval.ts`, `evals/evals.config.ts`  |
+| Helper                                                          | Subpath                               | Authored Location                                |
+| --------------------------------------------------------------- | ------------------------------------- | ------------------------------------------------ |
+| `defineAgent(...)`                                              | `eve`                                 | `agent.ts`, `subagents/<id>/agent.ts`            |
+| `defineInstructions(...)`                                       | `eve/instructions`                    | `instructions.ts` (or `instructions.md`)         |
+| `defineTool(...)`, `defineDynamic(...)`, `disableTool(...)`     | `eve/tools`                           | `tools/<name>.ts`                                |
+| `bash`, `readFile`, `writeFile`, and other provided definitions | `eve/tools/<name>`                    | `tools/<name>.ts`                                |
+| `defineSkill(...)`, `getSkill(...)`                             | `eve/skills`                          | `skills/<name>.ts` (or `skills/<name>.md`)       |
+| `defineHook(...)`                                               | `eve/hooks`                           | `hooks/<slug>.ts`                                |
+| `defineChannel(...)`, `POST`, `GET`                             | `eve/channels`                        | `channels/<name>.ts`                             |
+| `eveChannel(...)`, `slackChannel(...)`, `vercelOidc(...)`       | `eve/channels/eve`, `/slack`, `/auth` | reused from `channels/<name>.ts`                 |
+| `defineSandbox(...)`                                            | `eve/sandbox`                         | `sandbox.ts` (or `sandbox/sandbox.ts`)           |
+| `defineSchedule(...)`                                           | `eve/schedules`                       | `schedules/<name>.ts` (or `schedules/<name>.md`) |
+| `defineEval(...)`, `defineEvalConfig(...)`                      | `eve/evals`                           | `evals/<name>.eval.ts`, `evals/evals.config.ts`  |
 
 Runtime accessors live on the subpath that owns the concern:
 

package/dist/src/acp/adapter.d.ts

@@ -1,7 +1,7 @@
 import { type AgentContext, type InitializeRequest, type InitializeResponse, type NewSessionRequest, type NewSessionResponse, type PromptRequest, type PromptResponse } from "#compiled/@agentclientprotocol/sdk/index.js";
 import type { ClientOptions, SendTurnInput } from "#client/types.js";
 import type { HandleMessageStreamEvent } from "#protocol/message.js";
-import type { InputResponse } from "#runtime/input/types.js";
+import type { InputResponse } from "#shared/input.js";
 interface AdapterClientSession {
     send(message: SendTurnInput["message"]): Promise<AsyncIterable<HandleMessageStreamEvent>>;
     respond(inputResponses: readonly InputResponse[]): Promise<AsyncIterable<HandleMessageStreamEvent>>;

package/dist/src/approval/definition.d.ts

@@ -0,0 +1,84 @@
+import type { SessionAuthContext } from "#channel/types.js";
+import type { SessionParent, SessionTurn } from "#context/keys.js";
+import type { ToolAuthOptions, ToolAuthProvider } from "#tools/auth.js";
+import type { SessionContext } from "#context/session-context.js";
+import type { TokenResult } from "#shared/connection-types.js";
+type ApprovalToolInput<TInput> = TInput extends object ? Readonly<TInput> : TInput;
+/**
+ * Context passed to an {@link ApprovalPolicy} function.
+ *
+ * Extends {@link SessionContext} so approval policies can make decisions from
+ * the active session, current caller, and turn.
+ */
+export interface ApprovalContext<TInput = Record<string, unknown>> extends SessionContext {
+    readonly approvedTools: ReadonlySet<string>;
+    readonly callId: string;
+    readonly toolInput?: ApprovalToolInput<TInput>;
+    readonly toolName: string;
+}
+/** Request-time approval decision returned by an {@link ApprovalPolicy}. */
+export type ApprovalStatus = undefined | boolean | "not-applicable" | "approved" | "denied" | "user-approval" | {
+    readonly type: "not-applicable";
+    readonly reason?: never;
+} | {
+    readonly type: "approved";
+    readonly reason?: string;
+} | {
+    readonly type: "denied";
+    readonly reason?: string;
+} | {
+    readonly type: "user-approval";
+    readonly reason?: never;
+};
+/** Request-time approval policy shared by authored tools and connections. */
+export type ApprovalPolicy<TInput = Record<string, unknown>> = (ctx: ApprovalContext<TInput>) => ApprovalStatus | Promise<ApprovalStatus>;
+/** Stable tool request passed to a response authorizer. */
+export interface ApprovalRequest<TInput = Record<string, unknown>> {
+    readonly callId: string;
+    readonly requestId: string;
+    readonly toolInput?: ApprovalToolInput<TInput>;
+    readonly toolName: string;
+}
+/** Read-only session identity and lineage available to a response authorizer. */
+export interface ApprovalResponseSession {
+    readonly id: string;
+    readonly initiator: SessionAuthContext | null;
+    readonly parent?: SessionParent;
+    readonly turn: SessionTurn;
+}
+/** Narrow authorization capability available while validating a responder. */
+export interface ApprovalResponseAuth {
+    getToken(provider: ToolAuthProvider, options?: ToolAuthOptions): Promise<TokenResult>;
+    requireAuth(provider: ToolAuthProvider, options?: ToolAuthOptions): never;
+}
+/** Submitted decision passed to an approval response policy. */
+export interface ApprovalResponse {
+    readonly decision: "approve";
+}
+/** Context passed to an approval response policy. */
+export interface ApprovalResponseContext<TInput = Record<string, unknown>> {
+    readonly auth: ApprovalResponseAuth;
+    readonly request: ApprovalRequest<TInput>;
+    readonly response: ApprovalResponse;
+    readonly responder: SessionAuthContext;
+    readonly session: ApprovalResponseSession;
+}
+/** Response policy decision. Rejection keeps the shared request pending. */
+export type ApprovalResponseDecision = {
+    readonly status: "allowed";
+} | {
+    readonly reason: string;
+    readonly status: "rejected";
+};
+/** Decides whether an authenticated responder may approve one request. */
+export type ApprovalResponsePolicy<TInput = Record<string, unknown>> = (ctx: ApprovalResponseContext<TInput>) => ApprovalResponseDecision | Promise<ApprovalResponseDecision>;
+/** Approval definition with request- and response-time policy. */
+export interface ApprovalConfiguration<TInput = Record<string, unknown>> {
+    readonly request: ApprovalPolicy<TInput>;
+    readonly response?: ApprovalResponsePolicy<TInput>;
+}
+/** Shared approval definition used by authored tools and connections. */
+export type Approval<TInput = Record<string, unknown>> = ApprovalPolicy<TInput> | ApprovalConfiguration<TInput>;
+/** Returns the request-time policy from either approval authoring shape. */
+export declare function resolveApprovalPolicy<TInput>(approval: Approval<TInput>): ApprovalPolicy<TInput>;
+export {};

package/dist/src/approval/definition.js

@@ -0,0 +1 @@
+function resolveApprovalPolicy(e){return typeof e==`function`?e:e.request}export{resolveApprovalPolicy};

package/dist/src/channel/adapter.d.ts

@@ -3,7 +3,7 @@ import type { StepInput } from "#harness/types.js";
 import type { UnstampedMessageStreamEvent } from "#protocol/message.js";
 import type { SessionHandle } from "#channel/session.js";
 import type { DeliverPayload } from "#channel/types.js";
-import type { FetchFileResult, FetchFileFunction } from "#shared/channel-definition.js";
+import type { FetchFileContext, FetchFileResult, FetchFileFunction } from "#shared/channel-definition.js";
 import type { ChannelAudienceMetadata } from "#shared/channel-audience.js";
 /**
  * Context available to every adapter handler (`deliver` and event handlers).
@@ -72,7 +72,7 @@ export type ChannelEventHandlers<TCtx extends ChannelAdapterContext<any> = Chann
  * When fields are provided, staging prefers them over the values the
  * channel populated at ingestion time.
  */
-export type { FetchFileResult };
+export type { FetchFileContext, FetchFileResult };
 export type ChannelInstrumentationMetadata = Readonly<Record<string, unknown> & ChannelAudienceMetadata>;
 export type ChannelInstrumentationMetadataProjector = (state: Record<string, unknown> | undefined) => ChannelInstrumentationMetadata;
 /**

package/dist/src/{runtime/governance → channel}/auth/http-basic.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedHttpBasicAuthStrategy, RouteStrategyAuthenticationResult } from "#runtime/governance/auth/types.js";
+import type { ResolvedHttpBasicAuthStrategy, RouteStrategyAuthenticationResult } from "#channel/auth/types.js";
 /**
  * Verifies one HTTP Basic credential against a resolved eve strategy.
  */

package/dist/src/{runtime/governance → channel}/auth/jwt-ecdsa.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedJwtEcdsaAuthStrategy, RouteStrategyAuthenticationResult } from "#runtime/governance/auth/types.js";
+import type { ResolvedJwtEcdsaAuthStrategy, RouteStrategyAuthenticationResult } from "#channel/auth/types.js";
 /**
  * Verifies one bearer token against a resolved ECDSA JWT strategy.
  */

package/dist/src/channel/auth/jwt-ecdsa.js

@@ -0,0 +1 @@
+import{importJWK,importSPKI,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#channel/auth/token-claims.js";const importedJwtPublicKeyCache=new Map;async function authenticateJwtEcdsaStrategy(e){let t;try{t=await getImportedJwtPublicKey(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to import JWT ECDSA public key. ${e instanceof Error?e.message:`Unknown key import failure.`}`}}try{let a=await jwtVerify(e.token,t,{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof a.payload.sub!=`string`||a.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(a.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-ecdsa`,payload:a.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}async function getImportedJwtPublicKey(e){let t=`${e.algorithm}:${e.publicKey}`,n=importedJwtPublicKeyCache.get(t);if(n!==void 0)return await n;let r=importJwtPublicKey(e.publicKey,e.algorithm).catch(e=>{throw importedJwtPublicKeyCache.delete(t),e});return importedJwtPublicKeyCache.set(t,r),await r}async function importJwtPublicKey(n,r){let i=n.trim();return i.startsWith(`{`)?await importJWK(JSON.parse(i),r):await importSPKI(i,r)}export{authenticateJwtEcdsaStrategy};

package/dist/src/{runtime/governance → channel}/auth/jwt-hmac.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedJwtHmacAuthStrategy, RouteStrategyAuthenticationResult } from "#runtime/governance/auth/types.js";
+import type { ResolvedJwtHmacAuthStrategy, RouteStrategyAuthenticationResult } from "#channel/auth/types.js";
 /**
  * Verifies one bearer token against a resolved HMAC JWT strategy.
  */

package/dist/src/channel/auth/jwt-hmac.js

@@ -0,0 +1 @@
+import{createSecretKey}from"node:crypto";import{jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#channel/auth/token-claims.js";async function authenticateJwtHmacStrategy(e){try{let t=await jwtVerify(e.token,createSecretKey(Buffer.from(e.strategy.secret,`utf8`)),{algorithms:[e.strategy.algorithm],audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});return typeof t.payload.sub!=`string`||t.payload.sub.length===0?{kind:`not-authenticated`}:areTokenClaimMatchersSatisfied(t.payload,e.strategy)?{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`jwt-hmac`,payload:t.payload,principalType:`service`})}:{kind:`caller-not-allowed`}}catch{return{kind:`not-authenticated`}}}export{authenticateJwtHmacStrategy};

package/dist/src/{runtime/governance → channel}/auth/oidc.d.ts

@@ -1,4 +1,4 @@
-import type { ResolvedOidcAuthStrategy, RouteStrategyAuthenticationResult } from "#runtime/governance/auth/types.js";
+import type { ResolvedOidcAuthStrategy, RouteStrategyAuthenticationResult } from "#channel/auth/types.js";
 /**
  * Verifies one bearer token against a resolved OIDC strategy.
  */

package/dist/src/channel/auth/oidc.js

@@ -0,0 +1 @@
+import{createRemoteJWKSet,jwtVerify}from"#compiled/jose/index.js";import{areTokenClaimMatchersSatisfied,createJwtAuthenticatedCallerPrincipal}from"#channel/auth/token-claims.js";import{z}from"#compiled/zod/index.js";import{isVercelOidcIssuer}from"#shared/vercel-project.js";const oidcDiscoveryDocumentSchema=z.object({issuer:z.string().optional(),jwks_uri:z.string().url()}).passthrough(),oidcDiscoveryDocumentCache=new Map,oidcJwksCache=new Map;async function authenticateOidcStrategy(e){let i;try{i=await getOidcRemoteJwks(e.strategy)}catch(e){return{kind:`misconfigured`,message:`Failed to load OIDC discovery metadata. ${e instanceof Error?e.message:`Unknown discovery failure.`}`}}try{let a=await jwtVerify(e.token,i,{audience:[...e.strategy.audiences],clockTolerance:e.strategy.clockSkewSeconds,issuer:e.strategy.issuer});if(e.strategy.acceptCurrentVercelProject&&isVercelOidcIssuer(e.strategy.issuer)&&a.payload.external_sub!==void 0)return typeof a.payload.external_sub!=`string`||a.payload.external_sub.length===0||!currentVercelProjectMatches({payload:a.payload,strategy:e.strategy})||!currentVercelEnvironmentMatches({payload:a.payload,strategy:e.strategy})?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,issuerClaims:[`external_iss`,`connector_id`],payload:a.payload,principalType:`user`,subjectClaim:`external_sub`})};if(e.strategy.acceptCurrentVercelProject&&isVercelOidcIssuer(e.strategy.issuer)&&a.payload.user_id!==void 0){if(typeof a.payload.user_id!=`string`||a.payload.user_id.length===0||a.payload.environment!==`development`||!currentVercelProjectMatches({payload:a.payload,strategy:e.strategy}))return{kind:`caller-not-allowed`};if(currentVercelEnvironmentMatches({payload:a.payload,strategy:e.strategy}))return{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:a.payload,principalType:`user`,subjectClaim:`user_id`})}}if(typeof a.payload.sub!=`string`||a.payload.sub.length===0)return{kind:`not-authenticated`};let o=e.strategy.acceptCurrentVercelProject&&isCurrentVercelProjectToken({issuer:e.strategy.issuer,payload:a.payload,strategy:e.strategy}),s=o&&isCurrentVercelEnvironmentToken({payload:a.payload,strategy:e.strategy});return!o&&!areTokenClaimMatchersSatisfied(a.payload,e.strategy)?{kind:`caller-not-allowed`}:{kind:`authenticated`,principal:createJwtAuthenticatedCallerPrincipal({authenticator:`oidc`,payload:a.payload,principalType:s?`runtime`:`service`})}}catch{return{kind:`not-authenticated`}}}async function getOidcRemoteJwks(t){let n=await getOidcDiscoveryDocument(t.discoveryUrl),r=oidcJwksCache.get(n.jwks_uri);if(r!==void 0)return r;let i=createRemoteJWKSet(new URL(n.jwks_uri));return oidcJwksCache.set(n.jwks_uri,i),i}async function getOidcDiscoveryDocument(e){let t=oidcDiscoveryDocumentCache.get(e);if(t!==void 0)return await t;let n=fetch(e,{headers:{accept:`application/json`}}).then(async e=>{if(!e.ok)throw Error(`Discovery route returned HTTP ${e.status}.`);return oidcDiscoveryDocumentSchema.parse(await e.json())}).catch(t=>{throw oidcDiscoveryDocumentCache.delete(e),t});return oidcDiscoveryDocumentCache.set(e,n),await n}function isCurrentVercelProjectToken(e){if(!isVercelOidcIssuer(e.issuer))return!1;let t=e.strategy.currentVercelProject;return t!==void 0&&typeof e.payload.project_id==`string`&&e.payload.project_id===t.projectId}function currentVercelProjectMatches(e){let t=e.strategy.currentVercelProject;return t!==void 0&&typeof e.payload.project_id==`string`&&e.payload.project_id===t.projectId}function isCurrentVercelEnvironmentToken(e){let t=e.strategy.currentVercelProject?.environment;return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}function currentVercelEnvironmentMatches(e){let t=e.strategy.currentVercelProject?.environment;return t===void 0||t.length===0?!1:typeof e.payload.environment==`string`&&e.payload.environment===t}export{authenticateOidcStrategy};

package/dist/src/{runtime/governance → channel}/auth/token-claims.d.ts

@@ -1,5 +1,5 @@
 import type { JWTPayload } from "#compiled/jose/index.js";
-import type { AuthenticatedCallerPrincipal, ResolvedTokenClaimMatchers } from "#runtime/governance/auth/types.js";
+import type { AuthenticatedCallerPrincipal, ResolvedTokenClaimMatchers } from "#channel/auth/types.js";
 /**
  * Returns whether the verified JWT payload satisfies the authored subject and
  * claim selectors.

package/dist/src/{runtime/governance → channel}/auth/types.d.ts

@@ -1,4 +1,4 @@
-import type { RuntimeSessionAuthAttributes, RuntimeSessionAuthContext, RuntimeSessionAuthenticator, RuntimeSessionPrincipalType } from "#runtime/sessions/auth.js";
+import type { RuntimeSessionAuthAttributes, RuntimeSessionAuthContext, RuntimeSessionAuthenticator, RuntimeSessionPrincipalType } from "#shared/session-auth.js";
 /**
  * Shared serializable token-claim projection used by auth verifiers.
  */

package/dist/src/{runtime/governance → channel}/auth/vercel-oidc-project.d.ts

@@ -1,4 +1,4 @@
-import type { CurrentVercelProject } from "#runtime/governance/auth/types.js";
+import type { CurrentVercelProject } from "#channel/auth/types.js";
 type VercelOidcProjectResolver = () => CurrentVercelProject | undefined | Promise<CurrentVercelProject | undefined>;
 /**
  * Binds the current local project only to one request. The global symbol makes

package/dist/src/channel/channel-operations.d.ts

@@ -5,7 +5,7 @@ import { type ChannelAddressDeliveryOptions } from "#channel/channel-address.js"
 import type { SendPayload } from "#channel/routes.js";
 import type { Session } from "#channel/session.js";
 import type { CancelTurnResult, ClearSessionResult, CompactSessionResult, ResetSessionResult, Runtime, SessionAuthContext, SessionCallback, TurnPolicy } from "#channel/types.js";
-import { type InputResponse, type StrictInputResponses } from "#runtime/input/types.js";
+import { type InputResponse, type StrictInputResponses } from "#shared/input.js";
 import type { JsonObject } from "#shared/json.js";
 import type { RunMode } from "#shared/run-mode.js";
 interface BaseChannelSendOptions {

package/dist/src/channel/channel-operations.js

@@ -1 +1 @@
-import{createChannelAddressFn}from"#channel/channel-address.js";import{parseInputResponses}from"#runtime/input/types.js";const INTERNAL_CHANNEL_DELIVER=Symbol(`eve.internal.channel-deliver`);function createChannelOperations(r){let i=createChannelAddressFn(r);return{from(e){let r=i(e);return{async send(e,t){return await r.deliver({context:t.context,message:e,outputSchema:t.outputSchema},t)},async respond(e,n){if(e.length===0)throw Error(`respond() requires at least one input response.`);let i=parseInputResponses(e);return await r.deliver({context:n.context,inputResponses:i,outputSchema:n.outputSchema,state:n.state},n)},async cancel(e){return await r.cancel(e)},async compact(){return await r.compact()},async clear(){return await r.clear()},async reset(e){return await r.reset(e)},async[INTERNAL_CHANNEL_DELIVER](e,t){return await r.deliver(e,t)}}},async resolveSession(e){return await i(e).resolveSession()}}}export{INTERNAL_CHANNEL_DELIVER,createChannelOperations};
+import{createChannelAddressFn}from"#channel/channel-address.js";import{parseInputResponses}from"#shared/input.js";const INTERNAL_CHANNEL_DELIVER=Symbol(`eve.internal.channel-deliver`);function createChannelOperations(r){let i=createChannelAddressFn(r);return{from(e){let r=i(e);return{async send(e,t){return await r.deliver({context:t.context,message:e,outputSchema:t.outputSchema},t)},async respond(e,n){if(e.length===0)throw Error(`respond() requires at least one input response.`);let i=parseInputResponses(e);return await r.deliver({context:n.context,inputResponses:i,outputSchema:n.outputSchema,state:n.state},n)},async cancel(e){return await r.cancel(e)},async compact(){return await r.compact()},async clear(){return await r.clear()},async reset(e){return await r.reset(e)},async[INTERNAL_CHANNEL_DELIVER](e,t){return await r.deliver(e,t)}}},async resolveSession(e){return await i(e).resolveSession()}}}export{INTERNAL_CHANNEL_DELIVER,createChannelOperations};

package/dist/src/channel/instrumentation.d.ts

@@ -1,5 +1,6 @@
 import type { ChannelAdapter, ChannelInstrumentationMetadata } from "#channel/adapter.js";
 export interface ChannelInstrumentationProjection {
+    readonly channelType?: string;
     readonly kind: string;
     readonly metadata: ChannelInstrumentationMetadata;
 }

package/dist/src/channel/instrumentation.js

@@ -1 +1 @@
-import{createLogger}from"#internal/logging.js";import{getAdapterKind}from"#channel/adapter.js";import{isInstrumentationChannelKind,resolveInstrumentationProjection}from"#internal/instrumentation.js";import{normalizeChannelAudience}from"#shared/channel-audience.js";const log=createLogger(`channel.instrumentation`);function buildChannelInstrumentationProjection(e){let{adapter:t,channelName:n,existingKind:r}=e;return{kind:resolveKind({adapter:t,channelName:n,existingKind:r}),metadata:resolveMetadata(t)}}function resolveKind(e){let{adapter:r,channelName:i,existingKind:a}=e;if(a!==void 0)return a;if(i!==void 0&&i.length>0)return`channel:${i}`;let o=getAdapterKind(r);return isInstrumentationChannelKind(o)?o:`channel:${o}`}function resolveMetadata(e){let n=e.instrumentation?.metadata;if(n===void 0)return{audience:`unknown`};let o=resolveInstrumentationProjection({invoke:()=>n(e.state),log,source:getAdapterKind(e)});return{...o,audience:normalizeChannelAudience(o?.audience)}}export{buildChannelInstrumentationProjection};
+import{createLogger}from"#internal/logging.js";import{getAdapterKind}from"#channel/adapter.js";import{isInstrumentationChannelKind,resolveInstrumentationProjection}from"#internal/instrumentation.js";import{normalizeChannelAudience}from"#shared/channel-audience.js";const log=createLogger(`channel.instrumentation`);function buildChannelInstrumentationProjection(e){let{adapter:t,channelName:n,existingKind:r}=e;return{channelType:getAdapterKind(t),kind:resolveKind({adapter:t,channelName:n,existingKind:r}),metadata:resolveMetadata(t)}}function resolveKind(e){let{adapter:n,channelName:r,existingKind:i}=e;if(i!==void 0)return i;if(r!==void 0&&r.length>0)return`channel:${r}`;let a=getAdapterKind(n);return isInstrumentationChannelKind(a)?a:`channel:${a}`}function resolveMetadata(e){let t=e.instrumentation?.metadata;if(t===void 0)return{audience:`unknown`};let a=resolveInstrumentationProjection({invoke:()=>t(e.state),log,source:getAdapterKind(e)});return{...a,audience:normalizeChannelAudience(a?.audience)}}export{buildChannelInstrumentationProjection};

package/dist/src/channel/resolve-text.d.ts

@@ -1,4 +1,4 @@
-import type { InputRequest, InputResponse } from "#runtime/input/types.js";
+import type { InputRequest, InputResponse } from "#shared/input.js";
 /**
  * Maps freeform text to an {@link InputResponse} for a single request.
  *

package/dist/src/channel/routes.d.ts

@@ -1,7 +1,7 @@
 import type { UserContent } from "ai";
 import type { CrossChannelToFn } from "#channel/cross-channel-receive.js";
 import type { ChannelFrom, ChannelResolveSession } from "#channel/channel-operations.js";
-import type { InputResponse } from "#runtime/input/types.js";
+import type { InputResponse } from "#shared/input.js";
 import type { Session } from "#channel/session.js";
 import type { JsonObject } from "#shared/json.js";
 import type { ChannelMethod } from "#public/definitions/channel.js";

package/dist/src/channel/session.d.ts

@@ -4,7 +4,7 @@ import type { MessageStreamEvent } from "#protocol/message.js";
 import type { UserContent } from "ai";
 import type { CancelTurnResult, ClearSessionResult, CompactSessionResult, ResetSessionResult, Runtime, SessionAuthContext, SessionCallback, SessionSendCommandResult, TurnPolicy, TurnCaller } from "#channel/types.js";
 import type { SessionAuth } from "#context/keys.js";
-import { type InputResponse, type StrictInputResponses } from "#runtime/input/types.js";
+import { type InputResponse, type StrictInputResponses } from "#shared/input.js";
 import type { JsonObject } from "#shared/json.js";
 /** Immutable-ID handle for one exact durable session. */
 export interface Session {

package/dist/src/channel/session.js

@@ -1 +1 @@
-import{createChannelDeliveryMetadata}from"#channel/delivery-metadata.js";import{serializeUrlFilePartsInMessage}from"#channel/send-input.js";import{DEFAULT_TURN_POLICY}from"#channel/types.js";import{parseInputResponses}from"#runtime/input/types.js";import{AuthKey,ContinuationTokenKey,InitiatorAuthKey,SessionIdKey}from"#context/keys.js";import{toChannelLocalContinuationToken}from"#shared/continuation-token.js";function createSession(e,i,a={}){return{id:e,async send(r,o){let s=createDelivery(a),c=sessionCallbackToTurnCaller(o.callback),l={message:serializeUrlFilePartsInMessage(r)};o.context!==void 0&&(l.context=o.context),o.outputSchema!==void 0&&(l.outputSchema=o.outputSchema);let u={auth:o.auth,delivery:s,kind:`send`,payload:l,requestId:a.requestId,turnPolicy:o.turnPolicy??a.turnPolicy??DEFAULT_TURN_POLICY};return await i.dispatchSession({command:c===void 0?u:{...u,caller:c},sessionId:e})},async respond(t,n){if(t.length===0)throw Error(`respond() requires at least one input response.`);let o=parseInputResponses(t),s=sessionCallbackToTurnCaller(n.callback),c=createDelivery(a),l={inputResponses:o};n.context!==void 0&&(l.context=n.context),n.outputSchema!==void 0&&(l.outputSchema=n.outputSchema);let u={auth:n.auth,delivery:c,kind:`send`,payload:l,requestId:a.requestId};return await i.dispatchSession({command:s===void 0?u:{...u,caller:s},sessionId:e})},async cancel(t){return await i.dispatchSession({command:{kind:`cancel`,taskId:t?.taskId,turnId:t?.turnId},sessionId:e})},async compact(){return await i.dispatchSession({command:{kind:`compact`},sessionId:e})},async clear(){return await i.dispatchSession({command:{kind:`clear`},sessionId:e})},async reset(t){return await i.dispatchSession({command:{kind:`reset`,reason:t?.reason},sessionId:e})},async getEventStream(t){return i.getEventStream(e,t)},async getStreamTailIndex(){return i.getStreamTailIndex(e)}}}function createAttachSessionFn(e,t={}){return n=>createSession(n,e,t)}function createDelivery(t){return t.channelKind!==void 0&&t.channelName!==void 0?createChannelDeliveryMetadata(t):void 0}function buildSessionHandle(e){return{get id(){return e.get(SessionIdKey)??``},get auth(){return{current:e.get(AuthKey)??null,initiator:e.get(InitiatorAuthKey)??null}},get continuation(){let t=e.get(ContinuationTokenKey);if(!(t===void 0||t.length===0))return{token:toChannelLocalContinuationToken(t),rekey(n){let r=namespaceContinuationToken(t,n);t!==r&&e.set(ContinuationTokenKey,r)}}}}}function namespaceContinuationToken(e,t){let n=e.indexOf(`:`);if(n<=0)throw Error(`Cannot set session continuation token without an existing namespaced continuation token. Start the session with a placeholder continuationToken.`);return`${e.slice(0,n+1)}${t}`}function sessionCallbackToTurnCaller(e){return e===void 0?void 0:{callId:e.callId,replyTo:{kind:`callback`,token:e.token,url:e.url},subagentName:e.subagentName,taskId:e.taskId}}export{buildSessionHandle,createAttachSessionFn,createSession,sessionCallbackToTurnCaller};
+import{createChannelDeliveryMetadata}from"#channel/delivery-metadata.js";import{serializeUrlFilePartsInMessage}from"#channel/send-input.js";import{DEFAULT_TURN_POLICY}from"#channel/types.js";import{parseInputResponses}from"#shared/input.js";import{AuthKey,ContinuationTokenKey,InitiatorAuthKey,SessionIdKey}from"#context/keys.js";import{toChannelLocalContinuationToken}from"#shared/continuation-token.js";function createSession(e,i,a={}){return{id:e,async send(r,o){let s=createDelivery(a),c=sessionCallbackToTurnCaller(o.callback),l={message:serializeUrlFilePartsInMessage(r)};o.context!==void 0&&(l.context=o.context),o.outputSchema!==void 0&&(l.outputSchema=o.outputSchema);let u={auth:o.auth,delivery:s,kind:`send`,payload:l,requestId:a.requestId,turnPolicy:o.turnPolicy??a.turnPolicy??DEFAULT_TURN_POLICY};return await i.dispatchSession({command:c===void 0?u:{...u,caller:c},sessionId:e})},async respond(t,n){if(t.length===0)throw Error(`respond() requires at least one input response.`);let o=parseInputResponses(t),s=sessionCallbackToTurnCaller(n.callback),c=createDelivery(a),l={inputResponses:o};n.context!==void 0&&(l.context=n.context),n.outputSchema!==void 0&&(l.outputSchema=n.outputSchema);let u={auth:n.auth,delivery:c,kind:`send`,payload:l,requestId:a.requestId};return await i.dispatchSession({command:s===void 0?u:{...u,caller:s},sessionId:e})},async cancel(t){return await i.dispatchSession({command:{kind:`cancel`,taskId:t?.taskId,turnId:t?.turnId},sessionId:e})},async compact(){return await i.dispatchSession({command:{kind:`compact`},sessionId:e})},async clear(){return await i.dispatchSession({command:{kind:`clear`},sessionId:e})},async reset(t){return await i.dispatchSession({command:{kind:`reset`,reason:t?.reason},sessionId:e})},async getEventStream(t){return i.getEventStream(e,t)},async getStreamTailIndex(){return i.getStreamTailIndex(e)}}}function createAttachSessionFn(e,t={}){return n=>createSession(n,e,t)}function createDelivery(t){return t.channelKind!==void 0&&t.channelName!==void 0?createChannelDeliveryMetadata(t):void 0}function buildSessionHandle(e){return{get id(){return e.get(SessionIdKey)??``},get auth(){return{current:e.get(AuthKey)??null,initiator:e.get(InitiatorAuthKey)??null}},get continuation(){let t=e.get(ContinuationTokenKey);if(!(t===void 0||t.length===0))return{token:toChannelLocalContinuationToken(t),rekey(n){let r=namespaceContinuationToken(t,n);t!==r&&e.set(ContinuationTokenKey,r)}}}}}function namespaceContinuationToken(e,t){let n=e.indexOf(`:`);if(n<=0)throw Error(`Cannot set session continuation token without an existing namespaced continuation token. Start the session with a placeholder continuationToken.`);return`${e.slice(0,n+1)}${t}`}function sessionCallbackToTurnCaller(e){return e===void 0?void 0:{callId:e.callId,replyTo:{kind:`callback`,token:e.token,url:e.url},subagentName:e.subagentName,taskId:e.taskId}}export{buildSessionHandle,createAttachSessionFn,createSession,sessionCallbackToTurnCaller};

package/dist/src/channel/types.d.ts

@@ -2,8 +2,8 @@ import type { UserContent } from "ai";
 import type { MessageStreamEvent, UnstampedMessageStreamEvent } from "#protocol/message.js";
 import type { CancelTurnResult as ProtocolCancelTurnResult } from "#protocol/cancel-turn.js";
 import type { RunMode } from "#shared/run-mode.js";
-import type { RuntimeSubagentChildResult } from "#runtime/actions/types.js";
-import type { InputRequest, InputResponse } from "#runtime/input/types.js";
+import type { RuntimeSubagentChildResult } from "#shared/action-types.js";
+import type { InputRequest, InputResponse } from "#shared/input.js";
 import type { ChannelAdapter } from "#channel/adapter.js";
 import type { AgentLimitsDefinition } from "#shared/agent-definition.js";
 import type { JsonObject } from "#shared/json.js";