veryfront 0.1.755 → 0.1.756

package/esm/cli/auth/callback-server.d.ts

@@ -7,6 +7,9 @@ export interface CallbackServer {
     waitForCallback(timeoutMs?: number): Promise<CallbackResult>;
     stop(): Promise<void>;
 }
-export declare function startCallbackServer(preferredPort?: number): Promise<CallbackServer>;
+export interface CallbackServerOptions {
+    expectedState?: string;
+}
+export declare function startCallbackServer(preferredPort?: number, options?: CallbackServerOptions): Promise<CallbackServer>;
 export declare function getCallbackUrl(port: number): string;
 //# sourceMappingURL=callback-server.d.ts.map

package/esm/cli/auth/callback-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/callback-server.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AA6QD,wBAAsB,mBAAmB,CACvC,aAAa,GAAE,MAA8B,GAC5C,OAAO,CAAC,cAAc,CAAC,CAGzB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"callback-server.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/callback-server.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7D,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAoUD,wBAAsB,mBAAmB,CACvC,aAAa,GAAE,MAA8B,EAC7C,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,cAAc,CAAC,CAGzB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/esm/cli/auth/callback-server.js

@@ -144,17 +144,42 @@ function isAddrInUseError(error) {
     }
     return false;
 }
-function handleCallback(url) {
+function callbackError(message) {
+    return { result: { token: "", error: message }, html: renderErrorPage(message) };
+}
+function headerOrigin(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return null;
+    }
+}
+function hasCrossOriginHeader(headers, url) {
+    const expectedOrigin = url.origin;
+    const origin = headers.get("origin");
+    if (origin && headerOrigin(origin) !== expectedOrigin)
+        return true;
+    const referer = headers.get("referer");
+    if (referer && headerOrigin(referer) !== expectedOrigin)
+        return true;
+    return false;
+}
+function handleCallback(url, headers, options = {}) {
+    if (hasCrossOriginHeader(headers, url))
+        return callbackError("Invalid callback origin");
+    if (options.expectedState && url.searchParams.get("state") !== options.expectedState) {
+        return callbackError("Invalid OAuth state");
+    }
     const token = url.searchParams.get("token");
     const error = url.searchParams.get("error");
     if (error)
         return { result: { token: "", error }, html: renderErrorPage(error) };
     if (token)
         return { result: { token }, html: renderSuccessPage() };
-    const message = "No token received";
-    return { result: { token: "", error: message }, html: renderErrorPage(message) };
+    return callbackError("No token received");
 }
-function tryStartDenoServer(port) {
+function tryStartDenoServer(port, options = {}) {
     let resolveCallback = () => { };
     const callbackPromise = new Promise((resolve) => {
         resolveCallback = resolve;
@@ -166,7 +191,7 @@ function tryStartDenoServer(port) {
         if (url.pathname !== "/callback") {
             return new Response("Not Found", { status: 404, headers: { Connection: "close" } });
         }
-        const { result, html } = handleCallback(url);
+        const { result, html } = handleCallback(url, request.headers, options);
         resolveCallback(result);
         // Close connection immediately to allow clean server shutdown
         return new Response(html, {
@@ -181,10 +206,10 @@ function tryStartDenoServer(port) {
         },
     };
 }
-function startDenoServer(startPort) {
+function startDenoServer(startPort, options = {}) {
     for (let port = startPort, i = 0; i < MAX_PORT_ATTEMPTS; i++, port++) {
         try {
-            return tryStartDenoServer(port);
+            return tryStartDenoServer(port, options);
         }
         catch (error) {
             if (!isAddrInUseError(error) || i === MAX_PORT_ATTEMPTS - 1) {
@@ -195,7 +220,21 @@ function startDenoServer(startPort) {
     }
     throw new Error("Could not find an available port");
 }
-async function tryStartNodeServer(port) {
+function nodeHeadersToHeaders(headers) {
+    const result = new Headers();
+    for (const [name, value] of Object.entries(headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                result.append(name, item);
+            continue;
+        }
+        result.set(name, value);
+    }
+    return result;
+}
+async function tryStartNodeServer(port, options = {}) {
     const http = await import("node:http");
     let resolveCallback = () => { };
     const callbackPromise = new Promise((resolve) => {
@@ -208,7 +247,7 @@ async function tryStartNodeServer(port) {
             res.end("Not Found");
             return;
         }
-        const { result, html } = handleCallback(url);
+        const { result, html } = handleCallback(url, nodeHeadersToHeaders(req.headers), options);
         resolveCallback(result);
         res.setHeader("Content-Type", "text/html; charset=utf-8");
         res.end(html);
@@ -228,10 +267,10 @@ async function tryStartNodeServer(port) {
         },
     };
 }
-async function startNodeServer(startPort) {
+async function startNodeServer(startPort, options = {}) {
     for (let port = startPort, i = 0; i < MAX_PORT_ATTEMPTS; i++, port++) {
         try {
-            return await tryStartNodeServer(port);
+            return await tryStartNodeServer(port, options);
         }
         catch (error) {
             if (!isAddrInUseError(error) || i === MAX_PORT_ATTEMPTS - 1) {
@@ -242,9 +281,9 @@ async function startNodeServer(startPort) {
     }
     throw new Error("Could not find an available port");
 }
-export async function startCallbackServer(preferredPort = DEFAULT_CALLBACK_PORT) {
+export async function startCallbackServer(preferredPort = DEFAULT_CALLBACK_PORT, options = {}) {
     // Server functions handle port retry internally to avoid race conditions
-    return isDeno ? startDenoServer(preferredPort) : startNodeServer(preferredPort);
+    return isDeno ? startDenoServer(preferredPort, options) : startNodeServer(preferredPort, options);
 }
 export function getCallbackUrl(port) {
     return `http://localhost:${port}/callback`;

package/esm/cli/auth/index.d.ts

@@ -1,4 +1,4 @@
-export { type AuthMethod, deleteToken, ensureAuthenticated, hasToken, login, logout, readToken, saveToken, type UserInfo, validateToken, whoami, } from "./login.js";
+export { type AuthMethod, createOAuthAuthorizationUrl, createOAuthState, deleteToken, ensureAuthenticated, hasToken, login, logout, readToken, saveToken, type UserInfo, validateToken, whoami, } from "./login.js";
 export { type CallbackServer, getCallbackUrl, startCallbackServer } from "./callback-server.js";
 export { getTokenLocation } from "./token-store.js";
 export { canOpenBrowser, openBrowser } from "./browser.js";

package/esm/cli/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EACf,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,KAAK,QAAQ,EACb,aAAa,EACb,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EACf,2BAA2B,EAC3B,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,SAAS,EACT,KAAK,QAAQ,EACb,aAAa,EACb,MAAM,GACP,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,KAAK,cAAc,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/esm/cli/auth/index.js

@@ -1,4 +1,4 @@
-export { deleteToken, ensureAuthenticated, hasToken, login, logout, readToken, saveToken, validateToken, whoami, } from "./login.js";
+export { createOAuthAuthorizationUrl, createOAuthState, deleteToken, ensureAuthenticated, hasToken, login, logout, readToken, saveToken, validateToken, whoami, } from "./login.js";
 export { getCallbackUrl, startCallbackServer } from "./callback-server.js";
 export { getTokenLocation } from "./token-store.js";
 export { canOpenBrowser, openBrowser } from "./browser.js";

package/esm/cli/auth/login.d.ts

@@ -6,6 +6,8 @@ export interface UserInfo {
     email: string;
     name?: string;
 }
+export declare function createOAuthState(): string;
+export declare function createOAuthAuthorizationUrl(provider: "google" | "github" | "microsoft", callbackUrl: string, state: string): string;
 export declare function validateToken(token: string): Promise<UserInfo | null>;
 export declare function login(method?: AuthMethod): Promise<UserInfo | null>;
 export declare function ensureAuthenticated(env?: EnvironmentConfig): Promise<UserInfo | null>;

package/esm/cli/auth/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/login.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,WAAW,EAAoB,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQjG,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AASD,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAgB3E;AA8ID,wBAAsB,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8BzE;AAED,wBAAsB,mBAAmB,CACvC,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqB1B;AAED,wBAAsB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAI5C;AAED,wBAAsB,MAAM,CAC1B,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAmD1B;AAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/cli/auth/login.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AACzF,OAAO,EAAE,WAAW,EAAoB,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAQjG,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AAErE,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AASD,wBAAgB,gBAAgB,IAAI,MAAM,CAIzC;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,EAC3C,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,GACZ,MAAM,CAMR;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAgB3E;AA6ID,wBAAsB,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA8BzE;AAED,wBAAsB,mBAAmB,CACvC,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAqB1B;AAED,wBAAsB,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAI5C;AAED,wBAAsB,MAAM,CAC1B,GAAG,GAAE,iBAA0C,GAC9C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAmD1B;AAED,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC"}

package/esm/cli/auth/login.js

@@ -1,3 +1,4 @@
+import * as dntShim from "../../_dnt.shims.js";
 import { cliLogger } from "../utils/index.js";
 import { getStdinReader, setRawMode, writeStdout } from "../../src/platform/index.js";
 import { getEnvironmentConfig } from "../../src/config/index.js";
@@ -6,7 +7,7 @@ import { getCallbackUrl, startCallbackServer } from "./callback-server.js";
 import { canOpenBrowser, openBrowser } from "./browser.js";
 import { isTTY, promptUser } from "../utils/index.js";
 import { brand, dim, error, muted, success, warning } from "../ui/colors.js";
-import { DEFAULT_LOGIN_TIMEOUT_MS, getApiUrl } from "../shared/constants.js";
+import { DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, getApiUrl } from "../shared/constants.js";
 import { createSuccessEnvelope, isJsonMode, outputJson } from "../shared/json-output.js";
 const AUTH_OPTIONS = [
     { id: "google", label: "Google" },
@@ -14,6 +15,18 @@ const AUTH_OPTIONS = [
     { id: "microsoft", label: "Microsoft" },
     { id: "token", label: "API Token" },
 ];
+export function createOAuthState() {
+    const bytes = new Uint8Array(32);
+    dntShim.crypto.getRandomValues(bytes);
+    return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+export function createOAuthAuthorizationUrl(provider, callbackUrl, state) {
+    // The hosted auth endpoint must echo `state` back to the loopback callback.
+    const authUrl = new URL(`${getApiUrl().replace(/\/$/, "")}/auth/${provider}`);
+    authUrl.searchParams.set("redirect_uri", callbackUrl);
+    authUrl.searchParams.set("state", state);
+    return authUrl.toString();
+}
 export async function validateToken(token) {
     try {
         const response = await fetch(`${getApiUrl()}/me`, {
@@ -91,26 +104,25 @@ async function loginWithOAuth(provider) {
         return null;
     }
     console.log("  " + dim("Starting authentication server..."));
+    const state = createOAuthState();
     let server;
     try {
-        server = await startCallbackServer();
+        server = await startCallbackServer(DEFAULT_CALLBACK_PORT, { expectedState: state });
     }
     catch (e) {
         console.log("  " + error(`Failed to start server: ${e}`));
         return null;
     }
     const callbackUrl = getCallbackUrl(server.port);
-    const authUrl = `${getApiUrl()}/auth/${provider}?redirect_uri=${encodeURIComponent(callbackUrl)}`;
+    const authUrl = createOAuthAuthorizationUrl(provider, callbackUrl, state);
     console.log("  " + brand("Opening browser to log in..."));
     console.log();
-    console.log("  " + dim("If the browser doesn't open, visit:"));
-    console.log("  " + dim(authUrl));
-    console.log();
     try {
         await openBrowser(authUrl);
     }
     catch {
         console.log("  " + dim("Could not open browser automatically."));
+        console.log("  " + dim("Please use the API token option instead."));
     }
     console.log("  " + muted("Waiting for login..."));
     try {

package/esm/cli/commands/demo/demo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/demo/demo.ts"],"names":[],"mappings":"AAqDA,KAAK,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AA8Y9D,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8CAA8C;IAC9C,WAAW,CAAC,EAAE,UAAU,CAAC;CAC1B;AA+DD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4G1E"}
+{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/demo/demo.ts"],"names":[],"mappings":"AA2DA,KAAK,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;AA6Y9D,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8CAA8C;IAC9C,WAAW,CAAC,EAAE,UAAU,CAAC;CAC1B;AA+DD,wBAAsB,WAAW,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4G1E"}

package/esm/cli/commands/demo/demo.js

@@ -9,10 +9,10 @@ import { getStdinReader, setRawMode } from "../../../src/platform/index.js";
 import { join } from "../../../src/platform/compat/path/index.js";
 import { AnimatedDotMatrix, bold, brand, dim, error, formatDuration, HIDE_CURSOR, muted, SHOW_CURSOR, success, successBanner, typeCommand, typeLine, } from "../../ui/index.js";
 import { exitProcess, isTTY } from "../../utils/index.js";
-import { readToken, saveToken, validateToken } from "../../auth/index.js";
+import { createOAuthAuthorizationUrl, createOAuthState, readToken, saveToken, validateToken, } from "../../auth/index.js";
 import { canOpenBrowser, openBrowser } from "../../auth/browser.js";
 import { getCallbackUrl, startCallbackServer } from "../../auth/callback-server.js";
-import { DEFAULT_LOGIN_TIMEOUT_MS, getApiUrl } from "../../shared/constants.js";
+import { DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS } from "../../shared/constants.js";
 import { initCommand } from "../init/index.js";
 import { writeProjectSlug } from "../../shared/config.js";
 import { randomSuffix } from "../../shared/slug.js";
@@ -146,26 +146,25 @@ async function demoLogin(preselectedMethod) {
         return false;
     }
     console.log(`  ${dim("Starting authentication server...")}`);
+    const state = createOAuthState();
     let server;
     try {
-        server = await startCallbackServer();
+        server = await startCallbackServer(DEFAULT_CALLBACK_PORT, { expectedState: state });
     }
     catch (e) {
         console.log(`  ${error(`Failed to start server: ${e}`)}`);
         return false;
     }
     const callbackUrl = getCallbackUrl(server.port);
-    const authUrl = `${getApiUrl()}/auth/${method}?redirect_uri=${encodeURIComponent(callbackUrl)}`;
+    const authUrl = createOAuthAuthorizationUrl(method, callbackUrl, state);
     console.log(`  ${brand("Opening browser to log in...")}`);
     console.log();
-    console.log(`  ${dim("If the browser doesn't open, visit:")}`);
-    console.log(`  ${dim(authUrl)}`);
-    console.log();
     try {
         await openBrowser(authUrl);
     }
     catch {
         console.log(`  ${dim("Could not open browser automatically.")}`);
+        console.log(`  ${dim("Please use the API token option instead.")}`);
     }
     console.log(`  ${muted("Waiting for login...")}`);
     try {

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "veryfront",
-    "version": "0.1.755",
+    "version": "0.1.756",
     "license": "Apache-2.0",
     "nodeModulesDir": "auto",
     "minimumDependencyAge": "P2D",

package/esm/src/agent/runtime/index.d.ts

@@ -10,9 +10,8 @@
  *
  * @module ai/agent/runtime
  */
-import { type AgentConfig, type AgentResponse, type Message, type MessagePart, type ToolCall, type ToolResultPart } from "../types.js";
+import { type AgentConfig, type AgentResponse, type Message, type ToolCall } from "../types.js";
 import { type Memory } from "../memory/index.js";
-import { type ChatStreamState, type StreamingToolCall, type StreamingToolResult } from "./chat-stream-handler.js";
 export { closeSSEStream, generateMessageId, sendSSE } from "./sse-utils.js";
 export { RunAlreadyExistsError, RunCancelledError, RunNotActiveError, RunResumeSessionManager, WaitConflictError, WaitNotPendingError, } from "./resume-session.js";
 export type { RunResumeSessionManagerOptions, RunSessionStatus, SubmitResumeValueOutcome, } from "./resume-session.js";
@@ -23,100 +22,8 @@ export { accumulateUsage, getMaxSteps, normalizeInput } from "./input-utils.js";
 export { createStreamState, processStream } from "./chat-stream-handler.js";
 export type { ChatStreamCallbacks, ChatStreamState, StreamingToolCall, } from "./chat-stream-handler.js";
 export { DEFAULT_MAX_STEPS, DEFAULT_MAX_TOKENS, DEFAULT_TEMPERATURE, MAX_STREAM_BUFFER_SIZE, } from "./constants.js";
-import type { RuntimeGenerateToolResult } from "./runtime-tool-types.js";
-export declare function collectFinalStreamToolResults(state: Pick<ChatStreamState, "toolResults">): Map<string, StreamingToolResult>;
-export declare function collectPersistedToolResults(messages: Message[]): Map<string, ToolResultPart>;
-export declare function collectGeneratedToolResults(toolResults: RuntimeGenerateToolResult[] | undefined): Map<string, RuntimeGenerateToolResult>;
-export declare function shouldContinueAfterStreamStep(state: Pick<ChatStreamState, "accumulatedText" | "finishReason" | "toolCalls" | "toolResults">): boolean;
-export declare function captureStreamedToolCallInput(toolCall: Pick<StreamingToolCall, "arguments">): {
-    args: Record<string, unknown>;
-    inputText?: string;
-    parseError?: string;
-};
-/**
- * A streamed tool call is "incomplete" when the provider stream terminated
- * (abort, stall, timeout, transport error) before the SDK emitted the
- * finalizing `tool-call` event that sets `inputAvailable: true`. In that state
- * `arguments` only holds partial JSON fragments from `tool-input-delta` events,
- * so the tool call is NOT a committed model choice and must not be parsed or
- * executed. This is semantically distinct from a parse failure on a finalized
- * tool call (`inputAvailable: true` but malformed JSON — which only happens on
- * genuine provider bugs) and needs to be reported as a stream-termination
- * error rather than a tool-argument error.
- */
-export declare function isStreamedToolCallIncomplete(toolCall: Pick<StreamingToolCall, "inputAvailable">): boolean;
-/**
- * A non-finalized streamed tool call is a "recoverable placeholder" when its
- * accumulated `arguments` are empty or only the transient empty-object
- * placeholder `"{}"` (after stripping leading placeholders). This happens when
- * a provider emits `tool-input-start` + a `"{}"` `tool-input-delta` and then
- * finishes the step WITHOUT ever sending the finalizing `tool-call` /
- * `tool-input-end` event — the model never actually committed any arguments.
- *
- * Unlike an incomplete-dead tool call (which carries real truncated partial
- * JSON and must stop the loop to avoid retry storms), a recoverable
- * placeholder carries no committed intent, so the runtime can safely re-call
- * the model to recover the real tool call. Such placeholders must NOT be
- * executed and must NOT surface a stream-termination error.
- */
-export declare function isRecoverablePlaceholderToolCall(toolCall: Pick<StreamingToolCall, "inputAvailable" | "arguments">): boolean;
-/**
- * Classification of a streamed tool call when we reach end-of-stream and need
- * to persist it into the assistant message. Three distinct cases, each with
- * different semantics downstream:
- *
- * - `complete`: provider emitted the finalizing `tool-call` event and the
- *   arguments parsed cleanly. Execute the tool normally.
- * - `parse-error`: provider emitted the finalizing `tool-call` event but the
- *   arguments are not valid JSON. This is a provider/SDK bug; record it as a
- *   tool-argument error so the step can recover.
- * - `incomplete`: stream terminated before the finalizing event fired. The
- *   model never committed this tool use; record it as a stream-termination
- *   error so the parent (e.g. child-fork watchdog) can decide whether to
- *   retry the step cleanly instead of seeing a malformed tool call.
- */
-export type StreamedToolCallMaterialization = {
-    readonly kind: "complete";
-    readonly part: MessagePart;
-} | {
-    readonly kind: "parse-error";
-    readonly part: MessagePart;
-    readonly parseError: string;
-} | {
-    readonly kind: "incomplete";
-    readonly part: MessagePart;
-    readonly partialArgumentsLength: number;
-    readonly partialArgumentsPreview: string;
-};
-/**
- * Classify and build the persisted `MessagePart` for a single streamed tool
- * call. Pure function — no logging, no SSE, no memory. Callers decide what to
- * do with the result so this stays unit-testable.
- *
- * The resulting `part` is always pushed into the assistant message so the
- * conversation history is transparent: even incomplete tool calls leave a
- * visible trace with their partial `inputText`. What differs is the caller's
- * error-surfacing behavior (log warning, SSE event, tool-result error).
- */
-export declare function materializeStreamedToolCall(tc: StreamingToolCall): StreamedToolCallMaterialization;
-/**
- * Extract and validate the skill policy from a load_skill tool result.
- * Returns `[]` (no tools allowed) for invalid/missing policies instead of
- * `undefined` (no restrictions), preventing accidental policy bypass.
- */
-export declare function extractSkillPolicy(result: unknown): string[] | undefined;
-/** Result of skill policy enforcement for a single tool call */
-type SkillPolicyResult = {
-    allowed: true;
-} | {
-    allowed: false;
-    error: string;
-};
-/**
- * Enforce skill policy on a single tool call.
- * Shared between generate() and stream() paths.
- */
-export declare function enforceSkillPolicy(toolName: string, activeSkillPolicy: string[] | undefined, mustLoadSkillFirst: boolean): SkillPolicyResult;
+export { captureStreamedToolCallInput, collectFinalStreamToolResults, collectGeneratedToolResults, collectPersistedToolResults, isRecoverablePlaceholderToolCall, isStreamedToolCallIncomplete, materializeStreamedToolCall, shouldContinueAfterStreamStep, type StreamedToolCallMaterialization, } from "./tool-result-continuation.js";
+export { enforceSkillPolicy, extractSkillPolicy, type SkillPolicyResult, } from "./skill-policy-enforcement.js";
 /** Implement agent runtime. */
 export declare class AgentRuntime {
     private id;

package/esm/src/agent/runtime/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,aAAa,EAGlB,KAAK,OAAO,EACZ,KAAK,WAAW,EAEhB,KAAK,QAAQ,EAEb,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAc/D,OAAO,EACL,KAAK,eAAe,EAGpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAYlC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,8BAA8B,EAC9B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,0BAA0B,EAC1B,iCAAiC,EACjC,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC5E,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AAiBxB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAwGzE,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,GAC1C,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAYlC;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,OAAO,EAAE,GAClB,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAkB7B;AAED,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,yBAAyB,EAAE,GAAG,SAAS,GACnD,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAQxC;AAED,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,iBAAiB,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAC,GAC7F,OAAO,CAuET;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GAC7C;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAOA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,GAClD,OAAO,CAET;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,gBAAgB,GAAG,WAAW,CAAC,GAChE,OAAO,CAMT;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,+BAA+B,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACzD;IACA,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;CAC1C,CAAC;AAEJ;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,EAAE,EAAE,iBAAiB,GACpB,+BAA+B,CAoCjC;AA0BD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CA6BxE;AAED,gEAAgE;AAChE,KAAK,iBAAiB,GAClB;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,GACjB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtC;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,iBAAiB,EAAE,MAAM,EAAE,GAAG,SAAS,EACvC,kBAAkB,EAAE,OAAO,GAC1B,iBAAiB,CAiBnB;AA2DD,+BAA+B;AAC/B,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAS;IACnB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAuB;gBAEzB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;YAS7B,qBAAqB;YA2BrB,mBAAmB;YAsBnB,gBAAgB;IAS9B;;OAEG;IACG,QAAQ,CACZ,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,EACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,aAAa,CAAC;IAoDzB;;;OAGG;IACG,MAAM,CACV,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC1C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;QAClC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;KAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAoItC;;OAEG;YACW,gBAAgB;IAiS9B;;;;OAIG;YACW,yBAAyB;IA2ZvC;;OAEG;YACW,eAAe;IAgC7B;;OAEG;YACW,mBAAmB;IAOjC;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC;IAI5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IAIF;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;CAGnC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/src/agent/runtime/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,KAAK,WAAW,EAEhB,KAAK,aAAa,EAGlB,KAAK,OAAO,EAGZ,KAAK,QAAQ,EAGd,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAiD/D,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,8BAA8B,EAC9B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,mBAAmB,EACxB,0BAA0B,EAC1B,iCAAiC,EACjC,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC5E,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,4BAA4B,EAC5B,6BAA6B,EAC7B,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,KAAK,+BAA+B,GACrC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,iBAAiB,GACvB,MAAM,+BAA+B,CAAC;AAgDvC,+BAA+B;AAC/B,qBAAa,YAAY;IACvB,OAAO,CAAC,EAAE,CAAS;IACnB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,MAAM,CAAuB;gBAEzB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW;YAS7B,qBAAqB;YA2BrB,mBAAmB;YAsBnB,gBAAgB;IAS9B;;OAEG;IACG,QAAQ,CACZ,KAAK,EAAE,MAAM,GAAG,OAAO,EAAE,EACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,aAAa,CAAC;IAqDzB;;;OAGG;IACG,MAAM,CACV,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,SAAS,CAAC,EAAE;QACV,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,IAAI,CAAC;QAC1C,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;QAClC,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;KAC9C,EACD,aAAa,CAAC,EAAE,MAAM,EACtB,uBAAuB,CAAC,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAqItC;;OAEG;YACW,gBAAgB;IAmS9B;;;;OAIG;YACW,yBAAyB;IA6ZvC;;OAEG;YACW,eAAe;IAgC7B;;OAEG;YACW,mBAAmB;IAOjC;;OAEG;IACH,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,sBAAsB;IAc9B;;OAEG;IACH,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC;IAI5B;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IAIF;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;CAGnC"}