chore: bump @cloudflare/think from 0.12.1 to 0.13.0 in the ai group

[dependabot]

Bumps the ai group with 1 update: @cloudflare/think.

Updates @cloudflare/think from 0.12.1 to 0.13.0

Release notes

Sourced from @​cloudflare/think's releases.

@​cloudflare/think@​0.13.0

Minor Changes

• #1907 38bf87a Thanks @​cjol! - feat(think): add channelSpeakerLabel option to MessengerDefinition for configurable channel speaker prefixing

  Channel (non-DM) messages and action events are prefixed with the speaker label so the model can attribute multi-user traffic; direct messages never get a prefix. Previously action events were labelled even in DMs — they now follow the same channel-only rule as regular messages.

• #1921 7e0c069 Thanks @​cjol! - Add ChatOptions.metadata — a per-turn, recovery-safe metadata carrier.

  Server-side callers of chat() / chatWithMessengerContext() can now attach immutable per-turn metadata (e.g. "which authenticated principal initiated this turn"). It is stamped onto the turn's user message alongside channel (as metadata.turnMetadata) so a recovered/continued turn re-resolves it from durable history, and is readable turn-scoped via the new Think.activeTurnMetadata getter.

  The trust model mirrors the channel stamp: the reserved metadata keys channel and turnMetadata are now stripped from client-supplied messages at intake, so a client can never forge server-written turn context (this also closes the prior gap where a client message could carry a forged metadata.channel). This lets messenger/RPC entry points carry correct multi-user identity without either mutable agent-wide state (a last-writer-wins race) or the submission path (which loses incremental streaming).

Patch Changes

• #1920 0235fc9 Thanks @​cjol! - Rewrite the bot's own unresolved self-mention in messenger events to its readable handle before the model sees it.

  When a user @-mentions a Think messenger bot, the triggering message leads with the bot's own mention. Adapters resolve every other user's mention to @DisplayName but leave the bot's own as a raw user-id token (for example, Slack's @U0BD9EYL52S), which small models can misread as a third party the sender was trying to reach. Think now rewrites that surviving self-mention to @<userName> (the bot handle already required on every messenger) in defaultChatSdkEvent, reconstructing the @handle the sender originally typed.

  Adds the exported resolveSelfMention helper. Rewriting only applies when the adapter exposes a botUserId, so handle-based adapters (for example, Telegram) are unaffected. No new configuration is required.

Changelog

Sourced from @​cloudflare/think's changelog.

0.13.0

Minor Changes

• #1907 38bf87a Thanks @​cjol! - feat(think): add channelSpeakerLabel option to MessengerDefinition for configurable channel speaker prefixing

  Channel (non-DM) messages and action events are prefixed with the speaker label so the model can attribute multi-user traffic; direct messages never get a prefix. Previously action events were labelled even in DMs — they now follow the same channel-only rule as regular messages.

• #1921 7e0c069 Thanks @​cjol! - Add ChatOptions.metadata — a per-turn, recovery-safe metadata carrier.

  Server-side callers of chat() / chatWithMessengerContext() can now attach immutable per-turn metadata (e.g. "which authenticated principal initiated this turn"). It is stamped onto the turn's user message alongside channel (as metadata.turnMetadata) so a recovered/continued turn re-resolves it from durable history, and is readable turn-scoped via the new Think.activeTurnMetadata getter.

  The trust model mirrors the channel stamp: the reserved metadata keys channel and turnMetadata are now stripped from client-supplied messages at intake, so a client can never forge server-written turn context (this also closes the prior gap where a client message could carry a forged metadata.channel). This lets messenger/RPC entry points carry correct multi-user identity without either mutable agent-wide state (a last-writer-wins race) or the submission path (which loses incremental streaming).

Patch Changes

• #1920 0235fc9 Thanks @​cjol! - Rewrite the bot's own unresolved self-mention in messenger events to its readable handle before the model sees it.

  When a user @-mentions a Think messenger bot, the triggering message leads with the bot's own mention. Adapters resolve every other user's mention to @DisplayName but leave the bot's own as a raw user-id token (for example, Slack's @U0BD9EYL52S), which small models can misread as a third party the sender was trying to reach. Think now rewrites that surviving self-mention to @<userName> (the bot handle already required on every messenger) in defaultChatSdkEvent, reconstructing the @handle the sender originally typed.

  Adds the exported resolveSelfMention helper. Rewriting only applies when the adapter exposes a botUserId, so handle-based adapters (for example, Telegram) are unaffected. No new configuration is required.

Commits

• 03cdc82 Version Packages (#1899)
• 38bf87a fix(think): label channel speakers in messenger messages (#1907)
• 0235fc9 fix(think): resolve messenger self-mentions (#1920)
• 7e0c069 feat(think): add ChatOptions.metadata per-turn recovery-safe metadata carrier...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.