lumiverse-spindle-types 0.6.28 → 0.6.30

package/dist/api.d.ts

@@ -2845,6 +2845,10 @@ export interface SwipeEditedPayloadDTO {
  * role boundaries directly instead of re-parsing the flattened `args.context`
  * string. Multi-part message content is flattened to its text portion before
  * being delivered. `undefined` for non-council invocation paths.
+ *
+ * Authenticated user context is intentionally NOT part of this payload. Hosts deliver
+ * it separately as the TOOL_INVOCATION handler's second argument so model-controlled
+ * args cannot spoof or collide with identity metadata.
  */
 export interface ToolInvocationPayloadDTO {
     /** The bare (unqualified) tool name, matching what was passed to `registerTool`. */
@@ -4683,6 +4687,13 @@ export type HostToWorker = {
     requestId: string;
     toolName: string;
     args: Record<string, unknown>;
+    /**
+     * Trusted host context identifying the user whose generation triggered this tool invocation.
+     * This value is host-owned transport metadata: it is never sourced from, merged into, or
+     * exposed through model-controlled tool args. The worker runtime delivers it as the second
+     * argument to the TOOL_INVOCATION handler. Optional for compatibility with older hosts.
+     */
+    userId?: string;
     /**
      * Populated when the invocation originates from a council execution
      * cycle — carries the assigned council member's identity, role, chance,

package/dist/spindle-api.d.ts

@@ -185,8 +185,13 @@ export interface SpindleAPI {
      * includes a `councilMember` snapshot describing the assigned member
      * (identity, role, chance, avatar URL, and Lumia personality fields) so the
      * extension can tailor its tool output to that member's voice.
+     *
+     * The optional second `userId` argument is trusted host context identifying the
+     * user whose generation triggered the invocation. Multi-user/operator-scoped
+     * extensions should pass it through to user-scoped Spindle APIs. It is deliberately
+     * kept separate from `payload.args` so tool/model input cannot spoof identity.
      */
-    on(event: "TOOL_INVOCATION", handler: (payload: ToolInvocationPayloadDTO) => string | Promise<string> | void | Promise<void>): () => void;
+    on(event: "TOOL_INVOCATION", handler: (payload: ToolInvocationPayloadDTO, userId?: string) => string | Promise<string> | void | Promise<void>): () => void;
     /** Subscribe to a Lumiverse event. Multi-user extensions should use the optional `userId` to keep per-user state and notifications isolated. */
     on(event: string, handler: (payload: unknown, userId?: string) => void): () => void;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lumiverse-spindle-types",
-  "version": "0.6.28",
+  "version": "0.6.30",
   "type": "module",
   "types": "./dist/index.d.ts",
   "keywords": [