gemi 0.84.1 → 0.85.0

package/dist/ai/providers/call.d.ts

@@ -1,5 +1,6 @@
 import type { ProviderEvent } from "../AgentProvider";
 import type { ProviderTarget } from "./endpoints";
+import { type SentFile } from "./fileRejection";
 import { type FetchLike } from "./http";
 import type { ResponsesRequest } from "./request";
 /**
@@ -42,6 +43,9 @@ export declare function responsesEndpoint(target: ProviderTarget): ResponsesEndp
 export declare function streamResponses(endpoint: ResponsesEndpoint, body: ResponsesRequest, params: {
     signal?: AbortSignal;
     structuredOutput: boolean;
+    /** The file ids `body` sends, with their names — for the note that
+     *  replaces a file the provider refuses. See `providers/fileRejection.ts`. */
+    files?: Map<string, SentFile>;
 }): AsyncGenerator<ProviderEvent>;
 /**
  * What a file is uploaded *for*, which decides where its id is accepted.

package/dist/ai/providers/call.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"call.d.ts","sourceRoot":"","sources":["../../../ai/providers/call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;2DACuD;IACvD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,CAQ3E;AAED;;;;;;GAMG;AACH,wBAAuB,eAAe,CACpC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,gBAAgB,EAAE,OAAO,CAAA;CAAE,GAC1D,cAAc,CAAC,aAAa,CAAC,CA8C/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;AAEvD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,aAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,CAyBjB"}
+{"version":3,"file":"call.d.ts","sourceRoot":"","sources":["../../../ai/providers/call.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAGlD;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB;2DACuD;IACvD,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,CAQ3E;AAED;;;;;;GAMG;AACH,wBAAuB,eAAe,CACpC,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,gBAAgB,EACtB,MAAM,EAAE;IACN,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B;kFAC8E;IAC9E,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;CAC/B,GACA,cAAc,CAAC,aAAa,CAAC,CAkE/B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;AAEvD;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,iBAAiB,EAC3B,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,aAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,CAyBjB"}

package/dist/ai/providers/fileRejection.d.ts

@@ -0,0 +1,84 @@
+import type { AgentMessage } from "../types";
+import type { ResponsesRequest } from "./request";
+/**
+ * A stored file the provider will not read, and what to do about it (#684).
+ *
+ * THE FAILURE. A `FilePart` lives in the thread's history and goes back up on
+ * every request. If the provider refuses its `file_id` — an id from the wrong
+ * upload purpose, a file that was deleted or expired, a resource that no longer
+ * owns it — the turn that added it fails with a 400, and so does every turn
+ * after it, because the history that holds the part is the history every turn
+ * sends. The user's only way out was a new thread.
+ *
+ * THE FIX. When a 400 names a file block of the request, that block is swapped
+ * for a line of text saying the attachment could not be read, and the request
+ * is sent again. The model is told, so it can tell the user rather than answer
+ * as though it had read the file. `Agent` is told too (a `file-rejected`
+ * provider event), and marks the stored part `providerRejected` so later turns
+ * send the note instead of the id and do not pay for a failed request first.
+ *
+ * WHAT A REFUSAL LOOKS LIKE, MEASURED against a live Azure resource (gpt-6-sol,
+ * `/openai/v1`, `api-version=preview`, 2026-10-01). Each body is recorded in
+ * `__fixtures__` and the tests read those files:
+ *
+ *   A `user_data` id (`azure-error-file-id-prefix.json`): `param` points at the
+ *     block, `input[2].content[1].file_id`, and the message says `Expected an
+ *     ID that begins with 'assistant'`. With TWO such ids in one request only
+ *     the first is named, which is why more than one retry is allowed below.
+ *   An id that does not exist, or a file that was deleted
+ *     (`azure-error-files-not-found.json`, `azure-error-file-deleted.json`):
+ *     `param: null`, and the message lists every missing id at once —
+ *     `Files [assistant-…, assistant-…] were not found due to ownership
+ *     verification failure.` So the ids are read out of the message, by
+ *     matching the ids the request actually sent rather than by parsing the
+ *     sentence, which also covers OpenAI's wording without having measured it.
+ *   The right id in the wrong block (`azure-error-file-type.json`): `param:
+ *     "input"` and `… but got .png.`, naming neither the block nor the id. The
+ *     block is found by the extension and the block type the message names,
+ *     and only when that settles on exactly one file: guessing between two
+ *     would hide a file that was fine.
+ *
+ * Anything else is left alone and fails the turn as it did before. In
+ * particular a refusal that names no file in this request is not retried: a
+ * retry is only worth sending when something about the request has changed.
+ */
+/** What the request builder knew about each file id it sent, for the note. */
+export type SentFile = {
+    name?: string;
+    mimeType?: string;
+};
+/**
+ * How many times one call may be re-sent for a rejected file. Each retry has to
+ * take out a file the previous ones did not, so this bounds requests, not
+ * files: Azure names one bad block per 400 (`param` holds a single path), and
+ * a thread that picked up several `user_data` ids before #682 would otherwise
+ * clear one per turn and fail every turn until it ran out.
+ */
+export declare const MAX_FILE_REJECTION_RETRIES = 3;
+/** The file ids in a history, with the name each was attached under. */
+export declare function sentFiles(messages: AgentMessage[]): Map<string, SentFile>;
+/**
+ * The file ids a provider error blames, among the ones `body` sent.
+ *
+ * Empty when the error is not a 400/404 from the API, or names nothing in this
+ * request — which is the signal not to retry.
+ */
+export declare function rejectedFileIds(body: ResponsesRequest, error: unknown, files?: Map<string, SentFile>): string[];
+/**
+ * `body` with every block holding one of `fileIds` replaced by a note.
+ *
+ * A copy: the caller's body is what was sent, and the next attempt is a
+ * different request.
+ */
+export declare function withoutFiles(body: ResponsesRequest, fileIds: Set<string>, files?: Map<string, SentFile>): ResponsesRequest;
+/**
+ * What the model reads where the file would have been.
+ *
+ * It says the file was not read, so the model does not describe a document it
+ * never saw, and it says the provider refused it, so "please re-upload it" is
+ * the obvious next step rather than something the model has to guess at. The
+ * name is JSON-quoted for the reason `attachmentLine` gives: it is the user's,
+ * and can hold anything.
+ */
+export declare function unreadableNote(name: string | undefined): string;
+//# sourceMappingURL=fileRejection.d.ts.map

package/dist/ai/providers/fileRejection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileRejection.d.ts","sourceRoot":"","sources":["../../../ai/providers/fileRejection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,KAAK,EAAsB,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,8EAA8E;AAC9E,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CASzE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAa,GACvC,MAAM,EAAE,CA4CV;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EACpB,KAAK,GAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAa,GACvC,gBAAgB,CAgBlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAG/D"}

package/dist/ai/providers/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../ai/providers/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,YAAY,EAAY,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE;;;;;;;GAOG;AAKH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzD,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,MAAM,EAAE,IAAI,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAC3C,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,oBAAoB,CAAA;CAAE,GACzD,gBAAgB,CAuDlB;AAID;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,EACxB,YAAY,EAAE,oBAAoB,GACjC,kBAAkB,EAAE,CAmHtB;AA4QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAuB7D;AAUD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,CAAC,gBAAgB,GAAG,qBAAqB,CAAC,EAAE,GAAG,SAAS,EAC/D,YAAY,EAAE,oBAAoB,GACjC,aAAa,EAAE,CA2CjB"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../ai/providers/request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,KAAK,EAAE,YAAY,EAAY,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE;;;;;;;GAOG;AAKH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzD,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,MAAM,EAAE,IAAI,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAC3C,SAAS,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,oBAAoB,EAC5B,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,oBAAoB,CAAA;CAAE,GACzD,gBAAgB,CAuDlB;AAID;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,YAAY,EAAE,EACxB,YAAY,EAAE,oBAAoB,GACjC,kBAAkB,EAAE,CA4HtB;AA4QD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAuB7D;AAUD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,CAAC,gBAAgB,GAAG,qBAAqB,CAAC,EAAE,GAAG,SAAS,EAC/D,YAAY,EAAE,oBAAoB,GACjC,aAAa,EAAE,CA2CjB"}

package/dist/ai/redact.d.ts

@@ -0,0 +1,70 @@
+import type { AgentError } from "./types";
+/**
+ * A tool failure whose message is meant to be read: by the model, which can
+ * act on it, and by the client, which shows it.
+ *
+ * Any other exception a tool throws reaches the model and the client as a
+ * generic sentence (see `redactError`), because its message is whatever the
+ * code underneath happened to say: a database driver's connection string, an
+ * internal hostname, a third party's error body. The full error is logged.
+ * Throw this instead when the message is written for the person:
+ *
+ * ```ts
+ * if (!order) throw new ToolError(`There is no order ${input.orderId}.`);
+ * ```
+ */
+export declare class ToolError extends Error {
+    /** Whether the model may try the call again. Default `true`. */
+    readonly retryable: boolean;
+    constructor(message: string, options?: {
+        retryable?: boolean;
+        cause?: unknown;
+    });
+}
+/**
+ * Where an error being redacted came from, with the unredacted detail.
+ *
+ * - `run`: the run's own failure, on its `error` frame. `failure` is what
+ *   `result().error` returns: the provider's own message, its HTTP status and
+ *   request id.
+ * - `tool`: a tool threw. `cause` is what it threw; the result the model and
+ *   the client read is the redacted one.
+ */
+export type ErrorRedactionInfo = {
+    source: "run";
+    failure: AgentError & {
+        status?: number;
+        requestId?: string;
+    };
+} | {
+    source: "tool";
+    toolName: string;
+    cause: unknown;
+};
+/**
+ * Decides what a client (and, for a tool, the model) is told about a failure.
+ * Return the error to send. Full detail is never lost: it stays on
+ * `result().error`, in the log and in the controller's `onError`.
+ */
+export type ErrorRedactor = (error: AgentError, info: ErrorRedactionInfo) => AgentError;
+/**
+ * The default redaction, and what an override of `AgentController.redactError`
+ * falls back to.
+ *
+ * Keeps `code`, `retryable` and `toolCallId`, which are what a client branches
+ * on, and replaces a message that did not come from gemi with a fixed sentence
+ * for its code. A tool's exception keeps its message only when it is a
+ * `ToolError`.
+ */
+export declare function redactError(error: AgentError, info: ErrorRedactionInfo): AgentError;
+/**
+ * Runs an app's redactor and keeps only the `AgentError` fields of what it
+ * returns, so a redactor that spreads the failure (`{ ...info.failure }`)
+ * cannot put its status or request id on the wire by accident. A redactor
+ * that throws falls back to the default rather than to the unredacted error.
+ */
+export declare function applyRedaction(redactor: ErrorRedactor | undefined, error: AgentError, info: ErrorRedactionInfo, onFailure: (err: unknown) => void): AgentError;
+export declare function rememberUnredacted(redacted: AgentError, original: AgentError): void;
+/** The original of `error` when it was redacted in this process, else `error`. */
+export declare function unredactedError(error: AgentError): AgentError;
+//# sourceMappingURL=redact.d.ts.map

package/dist/ai/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../ai/redact.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,qBAAa,SAAU,SAAQ,KAAK;IAClC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;gBAEhB,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAKpF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IACE,MAAM,EAAE,KAAK,CAAC;IACd,OAAO,EAAE,UAAU,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D,GACD;IACE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAEN;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,KAAK,UAAU,CAAC;AAmBxF;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,GAAG,UAAU,CAUnF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,aAAa,GAAG,SAAS,EACnC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,kBAAkB,EACxB,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAChC,UAAU,CAcZ;AAUD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,GAAG,IAAI,CAEnF;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAE7D"}

package/dist/ai/signing.d.ts

@@ -1,3 +1,4 @@
+import { type NonceStore } from "./store/Nonces";
 /**
  * Signing for pending tool calls.
  *
@@ -177,19 +178,47 @@ export declare function signNestedRun(claims: NestedRunClaims, options?: SignOpt
  */
 export declare function verifyNestedRun(signature: string, claims: Omit<NestedRunClaims, "runId">, options?: VerifyOptions): VerifyResult;
 /**
- * Spends a signature's nonce. `false` means it was already spent — the answer
- * is a replay and must not be acted on.
+ * Spending a nonce.
+ *
+ * The MAC makes a token unforgeable; it does not make it single-use. Without
+ * this a captured signature approves the same call again every time it is
+ * presented, because a token that carries its own `runId` is a token that
+ * asserts its own binding — which is no binding at all. Verifying tells you the
+ * server once asked this exact question; spending the nonce is what says nobody
+ * has answered it yet.
+ *
+ * Where spent nonces live is a `NonceStore` (`store/Nonces.ts`, #445). The
+ * default is the process-wide `MemoryNonceStore`, which is exact for one
+ * instance; an app with several instances gives the agent a shared store
+ * (`RedisNonceStore`, or a table) so a rewound history cannot be replayed once
+ * against each of them. The store's `consume` is insert-if-absent, so two
+ * instances answering at once cannot both win.
+ *
+ * The other guard is the app's own message store: once a call has a result
+ * next to it, the call is no longer open and the answer has nothing to attach
+ * to. This is what stands in for that in stateless mode, where the history the
+ * client returns can be rewound to before the result existed.
+ */
+/**
+ * Spends a signature's nonce in `store`. `false` means it was already spent —
+ * the answer is a replay and must not be acted on — or the token is malformed.
+ * A store that throws rejects; the caller refuses the answer.
  *
  * Separate from `verifyPendingCall` rather than folded into it, because verify
  * is a pure question a caller may want to ask twice (logging a forgery, say)
  * and this one is a state change that must happen exactly once per answer.
  */
-export declare function consumePendingCall(signature: string, options?: VerifyOptions): boolean;
+export declare function spendPendingCall(signature: string, store: NonceStore): Promise<boolean>;
 /**
- * Spends a parked-run record's nonce, on the same registry and the same terms.
+ * Spends a parked-run record's nonce, on the same store and the same terms.
  * `false` means the record has already re-entered its tool once — the turn is
  * a replay of a history from before the answer was delivered, and the body
  * must not run again on it.
  */
+export declare function spendNestedRun(signature: string, store: NonceStore): Promise<boolean>;
+/** `spendPendingCall` on the process-wide default store, synchronously.
+ *  `now` is injectable for tests. */
+export declare function consumePendingCall(signature: string, options?: VerifyOptions): boolean;
+/** `spendNestedRun` on the process-wide default store, synchronously. */
 export declare function consumeNestedRun(signature: string, options?: VerifyOptions): boolean;
 //# sourceMappingURL=signing.d.ts.map

package/dist/ai/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../ai/signing.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,CAAC;AAkB9D;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAkDD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAO5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAE5D;AA6BD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAmBF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAOxF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EACtC,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AA2CD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAE1F;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAExF"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../ai/signing.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,2CAA2C;AAC3C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;IACzC,KAAK,EAAE,OAAO,CAAC;IACf;;;;;;;;;OASG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAA;CAAE,CAAC;AAkB9D;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnD;AAkDD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAO5F;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAChB;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAE5D;AA6BD,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,iFAAiF;IACjF,KAAK,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,wFAAwF;IACxF,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;;OAOG;IACH,KAAK,EAAE,OAAO,CAAC;CAChB,CAAC;AAmBF;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,GAAE,WAAgB,GAAG,MAAM,CAOxF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EACtC,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAwBd;AAID;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAErF;AAUD;qCACqC;AACrC,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAG1F;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAGxF"}

package/dist/ai/store/Attachments.d.ts

@@ -1,3 +1,4 @@
+import { ToolError } from "../redact";
 import type { PutFileParams, ReadFileParams, ReadResult } from "../../services/file-storage/drivers/types";
 import type { Usage } from "../types";
 /**
@@ -158,17 +159,18 @@ export interface AttachmentStorage {
  * is a tenant census delivered through the very tool the injection was aimed at.
  * One error, one wording, one code, for both.
  *
- * A plain `Error` rather than a `RequestBreakerError`: this is thrown inside a
+ * A `ToolError` rather than a `RequestBreakerError`: this is thrown inside a
  * tool, where the agent loop turns a throw into a tool result the model reads
  * and can recover from, not inside a route where it would decide a status code.
+ * A `ToolError` so the model and the client are shown its message (#446).
  */
-export declare class AttachmentNotFoundError extends Error {
+export declare class AttachmentNotFoundError extends ToolError {
     readonly id: string;
     readonly code = "attachment_not_found";
     constructor(id: string);
 }
 /** Raised for a scope no caller could have meant. See `assertScope`. */
-export declare class InvalidAttachmentScopeError extends Error {
+export declare class InvalidAttachmentScopeError extends ToolError {
     readonly code = "invalid_attachment_scope";
     constructor(message: string);
 }

package/dist/ai/store/Attachments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Attachments.d.ts","sourceRoot":"","sources":["../../../ai/store/Attachments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACX,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;OAUG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,qBAAqB,CAAC;CACpC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACtE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAEpB,EAAE,EAAE,MAAM;IADtC,QAAQ,CAAC,IAAI,0BAA0B;gBACX,EAAE,EAAE,MAAM;CAIvC;AAED,wEAAwE;AACxE,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,IAAI,8BAA8B;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAsBD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAFL,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,eAAe;IAKzC;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ1C;;;;;;;;OAQG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI3C;;;;;;;;;OASG;YACW,UAAU;IAOxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASrC;;;;;;;;;;;;;OAaG;IACG,GAAG,CACP,IAAI,EAAE,IAAI,EACV,MAAM,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GACjE,OAAO,CAAC,UAAU,CAAC;CAkCvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnE,iEAAiE;IACjE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,oCAAoC;IACpC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,yEAAyE;IACzE,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU,EAAE,UAAU,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,KAAK,CAAC;KACd,CAAC;IACF,qDAAqD;IACrD,KAAK,CAAC,EAAE;QACN,qEAAqE;QACrE,MAAM,EAAE,MAAM,CAAC;QACf,+EAA+E;QAC/E,SAAS,EAAE,MAAM,CAAC;QAClB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC;AAExE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IAEhD,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlE,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAY1E,2EAA2E;IAC3E,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,uBAA8B,CAAC"}
+{"version":3,"file":"Attachments.d.ts","sourceRoot":"","sources":["../../../ai/store/Attachments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACX,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB;;;;;;;;;;OAUG;IACH,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,qBAAqB,CAAC;CACpC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE;;;;;;OAMG;IACH,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;CACtE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5D;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,uBAAwB,SAAQ,SAAS;aAExB,EAAE,EAAE,MAAM;IADtC,QAAQ,CAAC,IAAI,0BAA0B;gBACX,EAAE,EAAE,MAAM;CAIvC;AAED,wEAAwE;AACxE,qBAAa,2BAA4B,SAAQ,SAAS;IACxD,QAAQ,CAAC,IAAI,8BAA8B;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAsBD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAEhD,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAFL,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,eAAe;IAKzC;;;;;;;;;;;;;;OAcG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAQ1C;;;;;;;;OAQG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAI3C;;;;;;;;;OASG;YACW,UAAU;IAOxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+BG;IACG,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASrC;;;;;;;;;;;;;OAaG;IACG,GAAG,CACP,IAAI,EAAE,IAAI,EACV,MAAM,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GACjE,OAAO,CAAC,UAAU,CAAC;CAkCvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnE,iEAAiE;IACjE,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,oCAAoC;IACpC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,yEAAyE;IACzE,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU,EAAE,UAAU,CAAC;IACvB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,SAAS,CAAC,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,KAAK,CAAC;KACd,CAAC;IACF,qDAAqD;IACrD,KAAK,CAAC,EAAE;QACN,qEAAqE;QACrE,MAAM,EAAE,MAAM,CAAC;QACf,+EAA+E;QAC/E,SAAS,EAAE,MAAM,CAAC;QAClB,4CAA4C;QAC5C,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG;IAAE,MAAM,EAAE,IAAI,CAAA;CAAE,CAAC;AAExE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrE;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IAEhD,GAAG,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlE,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAY1E,2EAA2E;IAC3E,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,uBAA8B,CAAC"}

package/dist/ai/store/FileOwners.d.ts

@@ -0,0 +1,59 @@
+/**
+ * WHO UPLOADED A PROVIDER FILE (#443).
+ *
+ * A provider's file id (`file-…`) is scoped to the OpenAI/Azure org, not to
+ * any user of the app: the vendor will hand the document to whichever request
+ * names it. So an id is a bearer token for the file, and ids leak — a shared
+ * transcript, a log line, a browser history entry. Before this, a user who
+ * learned another user's id could put it in their own `turn.files` and have
+ * the model read the other user's document.
+ *
+ * `AgentController.upload` now records the id with the uploader's owner key
+ * (the same `runOwner(req)` that owns a run, #442), and `stream` refuses a
+ * turn naming an id recorded for anyone else with a 403.
+ *
+ * A record is `{ owner, name, mimeType, size, createdAt }`, keyed by the
+ * provider's id. `owner: null` is an anonymous upload and is unowned: it
+ * answers whoever holds the id, exactly as every id did before this existed.
+ */
+export type FileOwnerRecord = {
+    /** `runOwner(req)` at upload: `user:<id>` by default, `null` for anonymous. */
+    owner: string | null;
+    name?: string;
+    mimeType?: string;
+    size?: number;
+    createdAt: string;
+};
+/**
+ * Where the records live. Two methods so an app can put them in its own table:
+ *
+ *   class DbFileOwners implements FileOwners {
+ *     async record(fileId, record) { await db.agentFile.create({ data: { fileId, ...record } }) }
+ *     async get(fileId) { return db.agentFile.findUnique({ where: { fileId } }) }
+ *   }
+ *
+ * `get` answers `null` for an id it has no record of. What the controller does
+ * with that is `AgentController.requireKnownFiles`.
+ */
+export interface FileOwners {
+    record(fileId: string, record: FileOwnerRecord): Promise<void>;
+    get(fileId: string): Promise<FileOwnerRecord | null>;
+}
+/**
+ * The default: records last as long as the process, like `MemoryAgentStore`
+ * and `MemoryAttachmentStore`. Bounded, oldest first, so an upload loop cannot
+ * grow it without end; an evicted id reads as unknown.
+ *
+ * A record is never overwritten: the first owner of an id keeps it, so a
+ * second `record` for the same id (which a provider never mints, but a buggy
+ * or hostile override could forward) cannot move a file to another user.
+ */
+export declare class MemoryFileOwners implements FileOwners {
+    private readonly maxEntries;
+    private readonly records;
+    constructor(maxEntries?: number);
+    record(fileId: string, record: FileOwnerRecord): Promise<void>;
+    get(fileId: string): Promise<FileOwnerRecord | null>;
+}
+export declare const defaultFileOwners: MemoryFileOwners;
+//# sourceMappingURL=FileOwners.d.ts.map

package/dist/ai/store/FileOwners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"FileOwners.d.ts","sourceRoot":"","sources":["../../../ai/store/FileOwners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACtD;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IAGrC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAFvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;gBAEjC,UAAU,SAAU;IAE3C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAU9D,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAI3D;AAED,eAAO,MAAM,iBAAiB,kBAAyB,CAAC"}

package/dist/ai/store/LiveRuns.d.ts

@@ -33,6 +33,18 @@ export declare class LiveRunNotFoundError extends Error {
 }
 export type RegisterParams = {
     threadId?: string;
+    /**
+     * Who started the run, as an opaque key (`AgentController.runOwner` makes it
+     * `user:<id>`), or `null`/absent for a run nobody in particular owns: an
+     * anonymous turn, or one the server started itself (#442).
+     *
+     * Recorded so `attach` and `stop` can tell the caller from the owner without a
+     * store round trip: a `threadId`, a `runId` and a client-minted `clientRunId`
+     * are all handles a third party can come to hold, and none of them says whose
+     * run it is. An owned run answers only the same key; an unowned one answers
+     * whoever holds a handle, which is what every run did before this existed.
+     */
+    owner?: string | null;
     /**
      * The client's own name for this run, minted before the run had one.
      *
@@ -141,6 +153,19 @@ export declare class MemoryLiveRuns implements LiveRuns {
         seq: number;
     } | null>;
     get(runId: string): AgentRun | null;
+    /** Who started the run (see `RegisterParams.owner`); `null` for an unowned
+     *  run and for one this process does not hold. */
+    ownerOf(runId: string): string | null;
+    /**
+     * Whether `caller` may read or stop the run: an unowned run (and one this
+     * process does not hold) answers anyone, an owned one only its owner. A
+     * caller with no key (`null`, an anonymous request) is not the owner of
+     * anything.
+     */
+    mayAccess(runId: string, caller: string | null): boolean;
+    /** Whether the run is still going, as opposed to ended and kept for `ttlMs`,
+     *  or not here at all. */
+    isRunning(runId: string): boolean;
     /**
      * The buffered frames from `from` onwards, followed by live ones until the
      * run ends.

package/dist/ai/store/LiveRuns.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LiveRuns.d.ts","sourceRoot":"","sources":["../../../ai/store/LiveRuns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAmDnE;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAI9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM;IALzB,QAAQ,CAAC,IAAI,0BAA0B;gBAG5B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM;CAO1B;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAGjC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAFlC,QAAQ,CAAC,IAAI,wBAAwB;gBAEhB,KAAK,EAAE,MAAM;CAGnC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;0EACsE;IACtE,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AA6CF;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB,OAAO,CAAC,IAAI,CAA4B;IACxC,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAA6B;IAC7C,+DAA+D;IAC/D,OAAO,CAAC,WAAW,CAA6B;gBAEpC,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO;IAMzF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAE,cAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BnE;;;;;;;OAOG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD,0EAA0E;IACpE,IAAI,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAexF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAInC;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,gBAAgB,CAAC;IAcrE,2EAA2E;IAC3E,KAAK,IAAI,IAAI;IAkBb,IAAI,IAAI,IAAI,MAAM,CAEjB;YAEa,IAAI;YAsDH,KAAK;IA4CpB,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,gBAAgB;IA+BxB;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAqBvB;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,gBAAuB,CAAC"}
+{"version":3,"file":"LiveRuns.d.ts","sourceRoot":"","sources":["../../../ai/store/LiveRuns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAmDnE;;;;;;;;GAQG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAI9C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM;IALzB,QAAQ,CAAC,IAAI,0BAA0B;gBAG5B,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM;CAO1B;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAGjC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAFlC,QAAQ,CAAC,IAAI,wBAAwB;gBAEhB,KAAK,EAAE,MAAM;CAGnC;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D;0EACsE;IACtE,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3C;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,CAAC;AA+CF;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAe,YAAW,QAAQ;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAExB,OAAO,CAAC,IAAI,CAA4B;IACxC,yDAAyD;IACzD,OAAO,CAAC,QAAQ,CAA6B;IAC7C,+DAA+D;IAC/D,OAAO,CAAC,WAAW,CAA6B;gBAEpC,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAO;IAMzF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,GAAE,cAAmB,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BnE;;;;;;;OAOG;IACH,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAKrD,0EAA0E;IACpE,IAAI,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAexF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAInC;sDACkD;IAClD,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAIrC;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO;IAKxD;8BAC0B;IAC1B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAKjC;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,gBAAgB,CAAC;IAcrE,2EAA2E;IAC3E,KAAK,IAAI,IAAI;IAkBb,IAAI,IAAI,IAAI,MAAM,CAEjB;YAEa,IAAI;YAsDH,KAAK;IA4CpB,OAAO,CAAC,IAAI;IAOZ,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,gBAAgB;IA+BxB;;;;OAIG;IACH,OAAO,CAAC,cAAc;CAqBvB;AAED;;;GAGG;AACH,eAAO,MAAM,QAAQ,gBAAuB,CAAC"}

package/dist/ai/store/MemoryAgentStore.d.ts

@@ -41,6 +41,7 @@ export declare class MemoryAgentStore implements AgentStore {
     }>;
     loadThread(threadId: string): Promise<AgentMessage[] | null>;
     appendMessages(threadId: string, messages: AgentMessage[]): Promise<void>;
+    removeMessages(threadId: string, messageIds: string[]): Promise<void>;
     /** Test seam, and a way for an app to drop a conversation on request. */
     delete(threadId: string): void;
     get size(): number;

package/dist/ai/store/MemoryAgentStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MemoryAgentStore.d.ts","sourceRoot":"","sources":["../../../ai/store/MemoryAgentStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAgB7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;gFAC4E;IAC5E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAK;gBAEV,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO;IAK/D,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAWjF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC;IAiB5D,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiC/E,yEAAyE;IACzE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI9B,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,KAAK,CAAC,GAAG,SAAa,GAAG,IAAI;CAW9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,kBAAyB,CAAC"}
+{"version":3,"file":"MemoryAgentStore.d.ts","sourceRoot":"","sources":["../../../ai/store/MemoryAgentStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAgB7C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;gFAC4E;IAC5E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,SAAS,CAAK;gBAEV,MAAM,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO;IAK/D,YAAY,CAAC,MAAM,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAWjF,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC;IAiB5D,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCzE,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3E,yEAAyE;IACzE,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI9B,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,KAAK,CAAC,GAAG,SAAa,GAAG,IAAI;CAW9B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,kBAAyB,CAAC"}

package/dist/ai/store/Nonces.d.ts

@@ -0,0 +1,109 @@
+/**
+ * SPENT NONCES: what makes a signed answer single-use (#445).
+ *
+ * A pending call's signature (and a parked sub-run's record) carries a nonce
+ * and an expiry. Verifying the MAC says the server once asked this exact
+ * question; spending the nonce says nobody has answered it yet. Without that a
+ * stateless client rewinds its history to before the result and replays the
+ * same signed approval, and the human who approved once has approved forever.
+ *
+ * Spending has to be shared by every process that can receive the answer, and
+ * it has to be atomic: insert-if-absent, so two instances handed the same
+ * answer at the same moment cannot both be told "first". A check followed by a
+ * write is not enough, since both reads can happen before either write.
+ *
+ * Implementations:
+ *
+ *   MemoryNonceStore — the default. One process, lost on restart. Correct for
+ *                      a single instance; with several, each instance accepts
+ *                      the same answer once.
+ *   RedisNonceStore  — `SET key 1 PX <ttl> NX` on the app's Redis. Shared,
+ *                      atomic, and Redis drops each key at the token's expiry.
+ *   your own         — e.g. a table with the nonce as its primary key:
+ *
+ *     class DbNonceStore implements NonceStore {
+ *       async consume(nonce, expiresAt) {
+ *         // INSERT ... ON CONFLICT (nonce) DO NOTHING, then look at the row count.
+ *         const inserted = await db.$executeRaw`
+ *           INSERT INTO agent_nonces (nonce, expires_at)
+ *           VALUES (${nonce}, ${new Date(expiresAt)})
+ *           ON CONFLICT (nonce) DO NOTHING`;
+ *         return inserted === 1;
+ *       }
+ *     }
+ *     // and, from a cron: DELETE FROM agent_nonces WHERE expires_at < now()
+ *
+ * Expired tokens fail verification on their own, so a store only has to
+ * remember a nonce until `expiresAt`; anything older may be dropped.
+ */
+export interface NonceStore {
+    /**
+     * Records `nonce` as spent until `expiresAt` (epoch milliseconds). Resolves
+     * `true` when this call is the one that spent it, `false` when it was
+     * already spent. Must be atomic across every process sharing the store.
+     *
+     * A rejection is treated as "could not be spent": the answer is refused,
+     * and the user is asked again. A replay guard that silently lets an answer
+     * through when its backing store is down is not a guard.
+     */
+    consume(nonce: string, expiresAt: number): Promise<boolean>;
+}
+/**
+ * The in-process store. Bounded by the tokens issued in one TTL window: an
+ * entry is dropped once its token expires, swept amortized O(1) per insert.
+ */
+export declare class MemoryNonceStore implements NonceStore {
+    private readonly spent;
+    /** Sweep when the map has grown past this, so sweeping costs O(1) per insert
+     *  amortized instead of walking every entry on every answer. */
+    private sweepAt;
+    consume(nonce: string, expiresAt: number): Promise<boolean>;
+    /**
+     * The same decision without the promise. JavaScript runs it to completion,
+     * so within one process it is atomic. `now` is injectable for tests.
+     */
+    consumeSync(nonce: string, expiresAt: number, now?: number): boolean;
+    get size(): number;
+    private sweep;
+}
+/** The slice of Bun's `RedisClient` this store needs: `send(command, args)`. */
+export interface NonceRedisClient {
+    send(command: string, args: string[]): Promise<any>;
+}
+export interface RedisNonceStoreOptions {
+    /**
+     * Client to run against. Defaults to the app's shared client from
+     * `RedisServiceProvider`, resolved on first use so constructing the store
+     * never needs a kernel or a connection.
+     */
+    client?: NonceRedisClient;
+    /** Key namespace. Defaults to `gemi:ai:nonce`. */
+    prefix?: string;
+}
+/**
+ * Spent nonces in Redis, shared by every instance of the app. `SET ... NX` is
+ * a single command, so the insert-if-absent is atomic in Redis; `PX` hands the
+ * cleanup to Redis at the token's own expiry.
+ *
+ * ```ts
+ * const nonces = new RedisNonceStore();
+ *
+ * class ChatController extends AgentController<typeof chat> {
+ *   agent = chat;
+ *   nonces = nonces;
+ * }
+ * ```
+ *
+ * A Redis failure rejects, and the answer it was checking is refused (see
+ * `NonceStore.consume`).
+ */
+export declare class RedisNonceStore implements NonceStore {
+    private readonly injectedClient?;
+    private readonly prefix;
+    constructor(options?: RedisNonceStoreOptions);
+    consume(nonce: string, expiresAt: number): Promise<boolean>;
+    private get client();
+}
+/** The process-wide default, shared by every agent that is not given a store. */
+export declare const defaultNonceStore: MemoryNonceStore;
+//# sourceMappingURL=Nonces.d.ts.map

package/dist/ai/store/Nonces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Nonces.d.ts","sourceRoot":"","sources":["../../../ai/store/Nonces.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAED;;;GAGG;AACH,qBAAa,gBAAiB,YAAW,UAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD;oEACgE;IAChE,OAAO,CAAC,OAAO,CAAQ;IAEjB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIjE;;;OAGG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO;IAUxE,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,OAAO,CAAC,KAAK;CAMd;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACrD;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAmB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAEpB,OAAO,GAAE,sBAA2B;IAK1C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAejE,OAAO,KAAK,MAAM,GAYjB;CACF;AAED,iFAAiF;AACjF,eAAO,MAAM,iBAAiB,kBAAyB,CAAC"}

package/dist/ai/store/index.d.ts

@@ -1,5 +1,7 @@
 export { type Attachment, ATTACHMENT_ID_PREFIX, type AttachmentDestination, attachmentObjectName, AttachmentNotFoundError, type AttachmentScope, type AttachmentStorage, type AttachmentStore, defaultAttachmentStore, InvalidAttachmentScopeError, MemoryAttachmentStore, newAttachmentId, type PutAttachmentParams, ScopedAttachments, type ToolAttachmentPut, type ToolAttachmentRecord, type ToolAttachments, } from "./Attachments";
+export { defaultFileOwners, type FileOwnerRecord, type FileOwners, MemoryFileOwners, } from "./FileOwners";
 export { defaultAgentStore, MemoryAgentStore } from "./MemoryAgentStore";
+export { defaultNonceStore, MemoryNonceStore, type NonceRedisClient, type NonceStore, RedisNonceStore, type RedisNonceStoreOptions, } from "./Nonces";
 export { FrameCursorEvictedError, LiveRunNotFoundError, liveRuns, MemoryLiveRuns, type RegisterParams, } from "./LiveRuns";
 export { encodeFrame, sseHeaders, sseResponse } from "./sse";
 //# sourceMappingURL=index.d.ts.map

package/dist/ai/store/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../ai/store/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EACf,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../ai/store/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EACf,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,oBAAoB,EACpB,uBAAuB,EACvB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,EACrB,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,eAAe,EACf,KAAK,sBAAsB,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC"}

package/dist/ai/types.d.ts

@@ -160,6 +160,15 @@ export type FilePart = {
      * `Agent.ts`.
      */
     attachmentId?: string;
+    /**
+     * Set by the run when the provider refused `fileId` (a deleted or expired
+     * file, an id from the wrong upload purpose, #684). From then on the request
+     * carries a line saying the attachment could not be read instead of the id,
+     * so one bad file costs one turn a retry rather than failing every turn of
+     * the thread. `fileId` is kept, as the record of what was refused; a UI can
+     * use the flag to show the file as unreadable.
+     */
+    providerRejected?: true;
 };
 /**
  * A sub-agent's run, recorded on the tool call that drove it.
@@ -348,6 +357,14 @@ export type AgentMessage<T extends ToolShapes = ToolShapes, O = unknown> = {
      * calling a tool closes its message `awaiting-input` or `max-steps`.
      */
     outputTruncated?: true;
+    /**
+     * What the model call that wrote this assistant message cost — that step
+     * alone, not the turn (#467). A run of three steps has three messages, each
+     * with its own. Tools' spending (sub-runs, `generate()`, images) is in the
+     * run total — `result().usage` and the `usage` frame — and a sub-run's own
+     * total is on its `NestedRun`. Absent on user messages and on a message whose
+     * call never reported usage (aborted mid-stream).
+     */
     usage?: Usage;
     /**
      * The run writing this message, on a copy the controller stored while the
@@ -616,7 +633,19 @@ export type AgentStreamEvent<T extends ToolShapes = ToolShapes, O = unknown> = {
     messageId: string;
     finishReason: FinishReason;
     outputTruncated?: true;
-} | {
+    /**
+     * What the model call that wrote this message cost, and only it (#467).
+     * The same value as `AgentMessage.usage`. Absent when the provider never
+     * reported usage for the call (it was aborted mid-stream).
+     */
+    usage?: Usage;
+}
+/**
+ * The whole turn's usage so far: every step's model call plus what tools
+ * spent through sub-runs, `generate()` and image calls. Not any one message's
+ * — that is on `message-end` and `AgentMessage.usage`.
+ */
+ | {
     type: "usage";
     usage: Usage;
 }