eve@0.28.0

Minor Changes

• 98d17c7: Input requests now include a required kind discriminator so clients can route tool approvals, questions, and session-limit decisions without inferring behavior from tool names or request IDs. Descendant session-limit Stop responses now let the parent own turn cancellation, avoiding a parent-child wait cycle.

• 7ff4f77: Every session stream event now carries a stable, evt_-prefixed ULID in meta.id, and stream consumers use it to drop re-delivery without collapsing distinct events. Retried steps re-emit under new ids, while reconnects, rewinds, and saved-log overlap preserve the original id.

  Breaking: MessageStreamEvent is now the canonical public type for events read from a stream, with meta.id and meta.at required. HandleMessageStreamEvent remains as a deprecated alias, so existing imports continue to compile; code that constructs unstamped events under that type must add the envelope. Client, channel, hook, frontend, and eval APIs carry MessageStreamEvent end to end, so consumers can read meta.id without guards. Events persisted by an earlier version carry meta.at but no meta.id, so rewinding into a session that started before this release yields events whose id is absent despite the type. eve passes those through rather than dropping them, and they cannot be deduplicated; the exposure ends when those sessions do.

Patch Changes

• 28417c4: Declining a session token-limit prompt no longer leaves a stale copy of the prompt in the parked session. Previously the cancelled turn settled with a snapshot that resurrected the already-answered prompt, so every follow-up message was queued behind it and never re-raised the prompt; follow-ups now reach the budget gate, which re-raises a fresh prompt while the session is over budget.
• 33ea372: Records Vercel AI Gateway cost on local trace spans: agent.step spans now carry gen_ai.usage.cost, gen_ai.usage.gateway_cost, gen_ai.usage.input_cost/output_cost, and gen_ai.generation.id when the gateway reports them. The attributes only exist for gateway-served calls — other providers emit nothing.
• 28417c4: Session token limits are now tracked as a runtime limit — an absolute lifetime-usage ceiling that each approved continuation re-anchors to usage + configured limit — replacing the window-baseline bookkeeping. Behavior is unchanged except the continuation prompt's usedTokens now reports the absolute session total instead of the window-relative amount.
• feac858: Complete durable sessions after 30 days by default, and add limits.sessionTimeoutMs to configure or disable the lifetime for each agent. Once an expired session settles, the next qualifying channel message for its continuation starts a fresh session.
• 28417c4: Keep one session token-limit prompt pending while concurrent input queues behind it. Approving restores the configured budget window, delegated sessions inherit from the fresh window, and zero-quota child tasks no longer raise continuation prompts that cannot grant tokens.
• dbc8eae: Splits token usage on local trace spans: model and step spans now record gen_ai.usage.cache_read.input_tokens and gen_ai.usage.cache_creation.input_tokens (OTel GenAI semantic-convention names) alongside the input/output totals when the provider reports detailed usage — cached tokens price differently, so the split makes cost attribution exact. Providers without detailed usage emit only the totals.
• 46c6ce3: The dev TUI now renders the session token-limit continuation prompt as a proper question — prompt copy and labeled Approve/Stop options in the question pane — instead of a generic y/n tool-approval line, and answers every confirmation prompt with the request's own option ids instead of hardcoded approve/deny. Previously, approving the continuation prompt in the TUI submitted an option the server did not recognize, so the same prompt was re-raised indefinitely.