@arnilo/prism 0.0.1 → 0.0.2

package/dist/node/contribution-discovery.js

@@ -0,0 +1,163 @@
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { isJsonObject } from "../config.js";
+import { assertPermission } from "../security.js";
+import { isPathInsideReal } from "./trust.js";
+import { parseSkillFile } from "../contribution-parsing.js";
+/**
+ * Discover contributions on disk. Scans the workspace `.agents/` tree only;
+ * no global root. One `readdir` per kind-root; no `import()`. Inert output —
+ * executable behavior is host-owned.
+ */
+export async function discoverContributions(options) {
+    const kinds = options.kinds;
+    const merged = new Map();
+    if (options.workspaceRoot) {
+        for (const kind of kinds) {
+            const entries = await scanKindRoot(options.workspaceRoot, kind, options);
+            for (const c of entries)
+                merged.set(`${c.kind}/${c.name}`, c);
+        }
+    }
+    return [...merged.values()];
+}
+// ponytail: single-level named-subdir scan; nested layouts would need a recursive walk if added later.
+async function scanKindRoot(root, kind, options) {
+    const kindDir = join(root, ".agents", kindDirName(kind));
+    if (options.trust) {
+        const decision = await options.trust.check({ kind: "project", target: kindDir });
+        if (!decision.trusted)
+            return []; // untrusted workspace root: skip, no throw
+    }
+    let names;
+    try {
+        names = await readdir(kindDir);
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return []; // missing kind root is normal
+        throw error;
+    }
+    const out = [];
+    for (const name of names) {
+        const dir = join(kindDir, name);
+        let isDir;
+        try {
+            isDir = (await stat(dir)).isDirectory();
+        }
+        catch (error) {
+            if (isMissingFile(error))
+                continue;
+            throw error;
+        }
+        if (!isDir)
+            continue;
+        // Symlinks escaping the kind root are excluded via realpath containment.
+        if (!(await isPathInsideReal(kindDir, dir)))
+            continue;
+        await assertPermission(options.permission, { kind: "resource", action: "load", target: dir });
+        const entry = await readEntry(dir, name, kind, "workspace");
+        if (entry)
+            out.push(entry);
+    }
+    return out;
+}
+async function readEntry(dir, fallbackName, kind, origin) {
+    switch (kind) {
+        case "skill":
+            return readSkillEntry(dir, fallbackName, origin);
+        default:
+            // tool / context / instructions → manifest.json declaration
+            return readManifestEntry(dir, fallbackName, kind, origin);
+    }
+}
+async function readSkillEntry(dir, fallbackName, origin) {
+    const path = join(dir, "SKILL.md");
+    if (!(await isPathInsideReal(dir, path)))
+        return undefined;
+    const text = await readOptionalFile(path);
+    if (text === undefined)
+        return undefined;
+    const skill = parseSkillFile(text, path);
+    return { kind: "skill", name: skill.name, origin, path, skill };
+}
+async function readManifestEntry(dir, fallbackName, kind, origin) {
+    const path = join(dir, "manifest.json");
+    if (!(await isPathInsideReal(dir, path)))
+        return undefined;
+    const text = await readOptionalFile(path);
+    if (text === undefined)
+        return undefined;
+    const declaration = parseManifestDeclaration(text, path, kind, fallbackName);
+    return { kind, name: declaration.name, origin, path, declaration };
+}
+// ponytail: Phase 31 — exported so the system/project prompt file loader reuses the scanner's
+// ENOENT-tolerant read instead of duplicating it. isMissingFile stays private (only readOptionalFile needs it).
+export async function readOptionalFile(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return undefined;
+        throw error;
+    }
+}
+// --- Internal helpers. ---
+// ponytail: parseSkillFile/parseAgentFile live in ../contribution-parsing.ts (core, fs-free); this
+// Node module owns directory walking + manifest.json parsing only.
+function isMissingFile(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+function parseManifestDeclaration(text, path, dirKind, fallbackName) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`Invalid JSON manifest ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`Manifest ${path} must be a JSON object`);
+    }
+    const obj = parsed;
+    const name = typeof obj.name === "string" && obj.name.length > 0 ? obj.name : fallbackName;
+    const declaration = {
+        kind: kindToManifestKind(dirKind),
+        name,
+        ...(typeof obj.module === "string" ? { module: obj.module } : {}),
+        ...(typeof obj.exportName === "string" ? { exportName: obj.exportName } : {}),
+        ...(typeof obj.resource === "string" ? { resource: obj.resource } : {}),
+        ...(typeof obj.metadata === "object" && obj.metadata !== null && !Array.isArray(obj.metadata) && isJsonObject(obj.metadata)
+            ? { metadata: obj.metadata }
+            : {}),
+    };
+    return declaration;
+}
+function kindToManifestKind(kind) {
+    switch (kind) {
+        case "tool":
+            return "tool";
+        case "context":
+            return "contextProvider";
+        case "instructions":
+            return "systemPromptContribution";
+        case "skill":
+            return "skill";
+    }
+}
+// ponytail: Phase 29 fix — `${kind}s` produced `instructionss`/`contexts`; the documented layout is
+// `.agents/{skills,tools,context,instructions}/` (instructions and context are already the right form).
+function kindDirName(kind) {
+    switch (kind) {
+        case "skill":
+            return "skills";
+        case "tool":
+            return "tools";
+        case "context":
+            return "context";
+        case "instructions":
+            return "instructions";
+    }
+}
+//# sourceMappingURL=contribution-discovery.js.map

package/dist/node/instruction-injectors.d.ts

@@ -0,0 +1,32 @@
+import type { DiscoveredContribution, InstructionInjector } from "../contracts.js";
+import type { ContributionRegistries } from "../contributions.js";
+import type { PermissionPolicy, TrustPolicy } from "../security.js";
+export interface LoadInstructionInjectorOptions {
+    /** Host-owned module loader for declarations with a `module` field. Core never
+     *  auto-`import()`s (matches Phase 29's tools/context stance); when a module
+     *  injector is discovered but no loader is supplied, it is skipped. */
+    readonly moduleLoader?: (module: string, exportName?: string) => Promise<InstructionInjector>;
+    /** Optional escape hatch for instruction resources outside the contribution dir. */
+    readonly resourceTrust?: TrustPolicy;
+    readonly permission?: PermissionPolicy;
+}
+/**
+ * Turn a discovered `kind: "instructions"` contribution into a live
+ * {@link InstructionInjector}. Markdown-only contributions (no `module`)
+ * load as a static `{ instructions, when: "every_turn" }` injector; module
+ * contributions load through the host-supplied `moduleLoader` (or skipped when
+ * absent). Core performs no `import()`; fs reads happen only via this Node
+ * adapter, never on plain SDK in-memory use.
+ *
+ * ponytail: reuses Phase 29's scanner output (DiscoveredContribution); this is
+ * only the per-kind adapter, mirroring how skills are realized in core. */
+export declare function loadInstructionInjector(contribution: DiscoveredContribution, options?: LoadInstructionInjectorOptions): Promise<InstructionInjector | undefined>;
+/** Load every discovered `instructions` contribution into injectors.
+ *  Same-name merge order (workspace over global) is already resolved by the
+ *  Phase 29 scanner (`discoverContributions` dedupes on `(kind, name)`); this
+ *  adapter only turns the deduped list into injectors. */
+export declare function loadInstructionInjectors(contributions: readonly DiscoveredContribution[], options?: LoadInstructionInjectorOptions): Promise<readonly InstructionInjector[]>;
+/** Load discovered instruction injectors and register them into
+ *  `registries.instructionInjectors`. Host-owned entry point — never invoked by
+ *  plain SDK in-memory use (which leaves the registry empty). */
+export declare function registerDiscoveredInstructionInjectors(registries: ContributionRegistries, contributions: readonly DiscoveredContribution[], options?: LoadInstructionInjectorOptions): Promise<void>;

package/dist/node/instruction-injectors.js

@@ -0,0 +1,72 @@
+import { readFile } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+import { assertPermission, assertTrusted } from "../security.js";
+import { isPathInsideReal } from "./trust.js";
+/**
+ * Turn a discovered `kind: "instructions"` contribution into a live
+ * {@link InstructionInjector}. Markdown-only contributions (no `module`)
+ * load as a static `{ instructions, when: "every_turn" }` injector; module
+ * contributions load through the host-supplied `moduleLoader` (or skipped when
+ * absent). Core performs no `import()`; fs reads happen only via this Node
+ * adapter, never on plain SDK in-memory use.
+ *
+ * ponytail: reuses Phase 29's scanner output (DiscoveredContribution); this is
+ * only the per-kind adapter, mirroring how skills are realized in core. */
+export async function loadInstructionInjector(contribution, options = {}) {
+    if (contribution.kind !== "instructions")
+        return undefined;
+    const name = contribution.name;
+    const decl = contribution.declaration;
+    // ponytail: module-referenced injector — host owns import(); no core auto-import.
+    if (decl?.module) {
+        if (!options.moduleLoader)
+            return undefined;
+        const loaded = await options.moduleLoader(decl.module, decl.exportName);
+        return { ...loaded, name };
+    }
+    // markdown-only instructions: read resource text → static every_turn injector.
+    const text = await readInstructionsText(contribution, options);
+    return {
+        name,
+        description: `Discovered instruction injector ${name}`,
+        apply: () => ({ instructions: text, when: "every_turn" }),
+    };
+}
+/** Load every discovered `instructions` contribution into injectors.
+ *  Same-name merge order (workspace over global) is already resolved by the
+ *  Phase 29 scanner (`discoverContributions` dedupes on `(kind, name)`); this
+ *  adapter only turns the deduped list into injectors. */
+export async function loadInstructionInjectors(contributions, options = {}) {
+    const injectors = [];
+    for (const contribution of contributions) {
+        if (contribution.kind !== "instructions")
+            continue;
+        const injector = await loadInstructionInjector(contribution, options);
+        if (injector)
+            injectors.push(injector);
+    }
+    return injectors;
+}
+/** Load discovered instruction injectors and register them into
+ *  `registries.instructionInjectors`. Host-owned entry point — never invoked by
+ *  plain SDK in-memory use (which leaves the registry empty). */
+export async function registerDiscoveredInstructionInjectors(registries, contributions, options = {}) {
+    const injectors = await loadInstructionInjectors(contributions, options);
+    const registry = registries.instructionInjectors;
+    for (const injector of injectors)
+        registry.register(injector.name, injector);
+}
+async function readInstructionsText(contribution, options) {
+    const dir = dirname(contribution.path);
+    const resource = contribution.declaration?.resource;
+    // ponytail: resource resolved against the manifest dir; outside reads need explicit host trust.
+    const target = resource ? (isAbsolute(resource) ? resource : join(dir, resource)) : join(dir, "INSTRUCTIONS.md");
+    if (!(await isPathInsideReal(dir, target))) {
+        if (!options.resourceTrust)
+            throw new Error(`Instruction resource escapes contribution directory: ${target}`);
+        await assertTrusted(options.resourceTrust, { kind: "resource", target, capability: "instruction-resource" });
+    }
+    await assertPermission(options.permission, { kind: "resource", action: "load", target });
+    return await readFile(target, "utf8");
+}
+//# sourceMappingURL=instruction-injectors.js.map

package/dist/node/session-store-jsonl.d.ts

@@ -1,4 +1,4 @@
-import type { SessionEntry, SessionStore } from "../contracts.js";
+import { type SessionEntry, type SessionStore } from "../contracts.js";
 export interface JsonlSessionStoreOptions {
     readonly path: string;
     readonly createDirectory?: boolean;

package/dist/node/session-store-jsonl.js

@@ -1,16 +1,35 @@
 import { mkdir, readFile, appendFile } from "node:fs/promises";
 import { dirname } from "node:path";
+import { SESSION_APPEND_CONFLICT_CODE, SessionAppendConflictError, isSessionEntryKind, SESSION_ENTRY_SCHEMA_VERSION } from "../contracts.js";
 export function createJsonlSessionStore(pathOrOptions) {
     const options = typeof pathOrOptions === "string" ? { path: pathOrOptions, createDirectory: true } : pathOrOptions;
     const path = options.path;
     let appendChain = Promise.resolve();
+    // ponytail: single-process only. The appendChain serializes appends within one
+    // process; there is no cross-process lock, so two processes writing the same
+    // file can still race. Multi-writer safety is host-owned (DB adapter or external
+    // lock). The expectedParentId/idempotency guards below mirror the memory store;
+    // a DB adapter enforces them via a conditional transaction + unique index.
+    const idempotencySeen = new Set();
     return {
-        append(entry) {
+        append(entry, appendOptions) {
             appendChain = appendChain.then(async () => {
                 if (options.createDirectory !== false)
                     await mkdir(dirname(path), { recursive: true });
-                if (await findEntry(path, entry.id))
+                const entries = await readEntries(path);
+                const dedupKey = appendOptions?.idempotencyKey
+                    ? `${entry.sessionId}\u0000${appendOptions.idempotencyKey}\u0000${appendOptions.expectedParentId ?? ""}`
+                    : undefined;
+                if (dedupKey !== undefined && idempotencySeen.has(dedupKey)) {
+                    throw new SessionAppendConflictError({ code: SESSION_APPEND_CONFLICT_CODE, idempotencyDuplicate: true });
+                }
+                if (appendOptions?.expectedParentId !== undefined && !entries.some((existing) => existing.id === appendOptions.expectedParentId)) {
+                    throw new SessionAppendConflictError({ code: SESSION_APPEND_CONFLICT_CODE, expectedParentId: appendOptions.expectedParentId });
+                }
+                if (entries.some((existing) => existing.id === entry.id))
                     throw new Error(`Duplicate session entry id: ${entry.id}`);
+                if (dedupKey !== undefined)
+                    idempotencySeen.add(dedupKey);
                 await appendFile(path, `${JSON.stringify(entry)}\n`, "utf8");
             });
             return appendChain;
@@ -71,7 +90,15 @@ function validateSessionEntry(value, lineNumber, raw) {
     if (entry.parentId !== undefined && typeof entry.parentId !== "string") {
         return { ok: false, error: { line: lineNumber, message: "Invalid parentId: expected string", raw } };
     }
-    switch (entry.kind) {
+    const schemaVersion = entry.schemaVersion ?? SESSION_ENTRY_SCHEMA_VERSION;
+    if (typeof schemaVersion !== "number" || schemaVersion !== SESSION_ENTRY_SCHEMA_VERSION) {
+        return { ok: false, error: { line: lineNumber, message: `Unsupported session entry schema version: ${schemaVersion}`, raw } };
+    }
+    const kind = entry.kind;
+    if (!isSessionEntryKind(kind)) {
+        return { ok: false, error: { line: lineNumber, message: `Unknown session entry kind: ${kind}`, raw } };
+    }
+    switch (kind) {
         case "message":
             if (!isMessage(entry.message))
                 return { ok: false, error: { line: lineNumber, message: "Invalid message entry: expected Message object", raw } };
@@ -98,8 +125,16 @@ function validateSessionEntry(value, lineNumber, raw) {
             if (typeof entry.label !== "string")
                 return { ok: false, error: { line: lineNumber, message: "Invalid label entry: expected string label", raw } };
             break;
+        case "event":
+            if (!isAgentEvent(entry.event))
+                return { ok: false, error: { line: lineNumber, message: "Invalid event entry: expected AgentEvent object", raw } };
+            break;
+        case "metadata":
+            if (!isPlainObject(entry.data))
+                return { ok: false, error: { line: lineNumber, message: "Invalid metadata entry: expected object data", raw } };
+            break;
     }
-    return { ok: true, entry };
+    return { ok: true, entry: entry };
 }
 function isBasicSessionEntry(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -122,6 +157,9 @@ function isModelConfig(value) {
     const model = value;
     return typeof model.provider === "string" && typeof model.model === "string";
 }
+function isAgentEvent(value) {
+    return isPlainObject(value) && typeof value.type === "string";
+}
 function isPlainObject(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }

package/dist/node/system-project-prompts.d.ts

@@ -0,0 +1,30 @@
+import type { SystemPromptContribution } from "../contracts.js";
+import type { PermissionPolicy, TrustPolicy } from "../security.js";
+export interface SystemPromptFilesOptions {
+    /** Workspace root. Reads `<workspaceRoot>/AGENTS.md` (project prompt, `source: "app"`).
+     *  Trust-gated via `trust` (untrusted workspace → skipped silently, fail-closed). */
+    readonly workspaceRoot?: string;
+    /** Global root. Reads `<globalRoot>/.prism/agent/SYSTEM.md` (user/global prompt, `source: "user"`).
+     *  User-owned: no workspace trust check; its presence is the user's explicit choice. */
+    readonly globalRoot?: string;
+    /** Override path for `AGENTS.md` (e.g. `--agents-md-file`). Still `source: "app"`, still trust-gated;
+     *  the caller builds `trust` with the file's parent in its trusted roots so the explicit opt-in is honored. */
+    readonly agentsMdPath?: string;
+    /** Override path for `SYSTEM.md` (e.g. `--system-md-file`). Still `source: "user"`, no trust gate (user-owned). */
+    readonly systemMdPath?: string;
+    readonly trust?: TrustPolicy;
+    readonly permission?: PermissionPolicy;
+}
+/** Load the standard system/project prompt files as `SystemPromptContribution` layers,
+ *  feeding the existing `composeSystemPrompt` pipeline (no parallel mechanism). Returns
+ *  `SYSTEM.md` first (`source: "user"`, the Phase 31 base layer) then `AGENTS.md`
+ *  (`source: "app"`); the rank order is enforced by `composeSystemPrompt`'s `sourceRank`,
+ *  so input order here only matters for the stable tie-break when sources collide.
+ *
+ *  Standalone SDK use (no `workspaceRoot`/`globalRoot`/override paths) returns `[]` and
+ *  performs no filesystem I/O — `AgentConfig.instructions`/`systemPrompt` keep working unchanged.
+ *
+ *  ponytail: two `readFile` calls max, no `readdir`, no scan, no `import()`. Root-level
+ *  singletons don't fit `discoverContributions`' named-subdir scanner, so this is a
+ *  sibling loader mirroring `src/node/instruction-injectors.ts`'s per-concern adapter shape. */
+export declare function loadSystemPromptFiles(options: SystemPromptFilesOptions): Promise<readonly SystemPromptContribution[]>;

package/dist/node/system-project-prompts.js

@@ -0,0 +1,53 @@
+import { join } from "node:path";
+import { assertPermission, isTrusted } from "../security.js";
+import { readOptionalFile } from "./contribution-discovery.js";
+/** Load the standard system/project prompt files as `SystemPromptContribution` layers,
+ *  feeding the existing `composeSystemPrompt` pipeline (no parallel mechanism). Returns
+ *  `SYSTEM.md` first (`source: "user"`, the Phase 31 base layer) then `AGENTS.md`
+ *  (`source: "app"`); the rank order is enforced by `composeSystemPrompt`'s `sourceRank`,
+ *  so input order here only matters for the stable tie-break when sources collide.
+ *
+ *  Standalone SDK use (no `workspaceRoot`/`globalRoot`/override paths) returns `[]` and
+ *  performs no filesystem I/O — `AgentConfig.instructions`/`systemPrompt` keep working unchanged.
+ *
+ *  ponytail: two `readFile` calls max, no `readdir`, no scan, no `import()`. Root-level
+ *  singletons don't fit `discoverContributions`' named-subdir scanner, so this is a
+ *  sibling loader mirroring `src/node/instruction-injectors.ts`'s per-concern adapter shape. */
+export async function loadSystemPromptFiles(options) {
+    const agentsPath = options.agentsMdPath
+        ?? (options.workspaceRoot !== undefined ? join(options.workspaceRoot, "AGENTS.md") : undefined);
+    const systemPath = options.systemMdPath
+        ?? (options.globalRoot !== undefined ? join(options.globalRoot, ".prism", "agent", "SYSTEM.md") : undefined);
+    const out = [];
+    if (systemPath !== undefined) {
+        const layer = await readSystemFile(systemPath, options.permission);
+        if (layer)
+            out.push(layer);
+    }
+    if (agentsPath !== undefined) {
+        const layer = await readAgentsFile(agentsPath, options.trust, options.permission);
+        if (layer)
+            out.push(layer);
+    }
+    return out;
+}
+async function readSystemFile(path, permission) {
+    await assertPermission(permission, { kind: "resource", action: "load", target: path });
+    const text = await readOptionalFile(path);
+    if (text === undefined)
+        return undefined;
+    return { id: "system-md", source: "user", mode: "append", text };
+}
+async function readAgentsFile(path, trust, permission) {
+    // ponytail: trust gate mirrors discoverContributions — untrusted AGENTS.md is skipped silently
+    // (fail-closed, no throw). createPathTrustPolicy resolves symlinks internally, so a symlinked
+    // AGENTS.md escaping the trusted root fails containment inside the policy.
+    if (!(await isTrusted(trust, { kind: "project", target: path })))
+        return undefined;
+    await assertPermission(permission, { kind: "resource", action: "load", target: path });
+    const text = await readOptionalFile(path);
+    if (text === undefined)
+        return undefined;
+    return { id: "agents-md", source: "app", mode: "append", text };
+}
+//# sourceMappingURL=system-project-prompts.js.map

package/dist/provider-events.d.ts

@@ -1,4 +1,4 @@
-import type { ContentBlock, JsonObject, ProviderEvent, ToolCallContent, Usage } from "./contracts.js";
+import type { ContentBlock, JsonObject, ProviderEvent, ToolCallContent, ToolCallDeltaContent, Usage } from "./contracts.js";
 export declare function providerTextDelta(text: string): ProviderEvent;
 export declare function providerThinkingDelta(text: string, signature?: string): ProviderEvent;
 export declare function providerContentDelta(content: ContentBlock): ProviderEvent;
@@ -9,6 +9,8 @@ export declare function providerToolCallDelta(delta: {
     readonly name?: string;
     readonly argumentsText?: string;
 }): ProviderEvent;
+export declare function providerToolCallDeltaContent(delta: Omit<ToolCallDeltaContent, "type">): ToolCallDeltaContent;
+export declare function reconstructToolCallDeltas(events: readonly ProviderEvent[]): readonly ToolCallContent[];
 export declare function providerUsage(usage: Usage): ProviderEvent;
 export declare function providerDone(usage?: Usage): ProviderEvent;
 export declare function providerError(error: unknown, secrets?: readonly (string | undefined)[]): ProviderEvent;

package/dist/provider-events.js

@@ -14,6 +14,29 @@ export function providerToolCall(call) {
 export function providerToolCallDelta(delta) {
     return { type: "tool_call_delta", ...delta };
 }
+export function providerToolCallDeltaContent(delta) {
+    return { type: "tool_call_delta", ...delta };
+}
+export function reconstructToolCallDeltas(events) {
+    const partials = new Map();
+    for (const event of events) {
+        if (event.type !== "tool_call_delta")
+            continue;
+        const partial = partials.get(event.index) ?? { argumentsText: "" };
+        if (event.id !== undefined)
+            partial.id = event.id;
+        if (event.name !== undefined)
+            partial.name = event.name;
+        if (event.argumentsText !== undefined)
+            partial.argumentsText += event.argumentsText;
+        partials.set(event.index, partial);
+    }
+    return [...partials.entries()].sort(([a], [b]) => a - b).map(([index, partial]) => {
+        if (!partial.id || !partial.name)
+            throw new Error(`Incomplete tool call delta at index ${index}`);
+        return toolCallContent(partial.id, partial.name, parseToolCallArguments(partial.argumentsText, index));
+    });
+}
 export function providerUsage(usage) {
     return { type: "usage", usage };
 }
@@ -27,4 +50,15 @@ export function providerError(error, secrets = []) {
 export function toolCallContent(id, name, args = {}) {
     return { type: "tool_call", id, name, arguments: args };
 }
+function parseToolCallArguments(text, index) {
+    try {
+        const value = text ? JSON.parse(text) : {};
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("not object");
+        return value;
+    }
+    catch (error) {
+        throw new Error(`Invalid tool call arguments at index ${index}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 //# sourceMappingURL=provider-events.js.map

package/dist/provider-request-policy.js

@@ -14,6 +14,7 @@ export function createProviderRequestPolicyChain(policies) {
         },
     };
 }
+// Legacy cacheKey/cacheRetention policy; structured cache hints are merged separately.
 export function createSessionCachePolicy(options = {}) {
     return {
         name: "session-cache",
@@ -35,13 +36,26 @@ export function mergeProviderRequestOptions(base, patch) {
         return patch;
     if (!patch)
         return base;
-    return {
+    const merged = {
         ...base,
         ...patch,
         headers: patch.headers || base.headers ? { ...base.headers, ...patch.headers } : undefined,
         compat: patch.compat || base.compat ? { ...base.compat, ...patch.compat } : undefined,
         extra: patch.extra || base.extra ? { ...base.extra, ...patch.extra } : undefined,
     };
+    if (!patch.cache && !base.cache)
+        return merged;
+    return {
+        ...merged,
+        cache: {
+            ...base.cache,
+            ...patch.cache,
+            breakpoints: base.cache?.breakpoints || patch.cache?.breakpoints ? [
+                ...(base.cache?.breakpoints ?? []),
+                ...(patch.cache?.breakpoints ?? []),
+            ] : undefined,
+        },
+    };
 }
 export function normalizeProviderRequestPolicyResult(result) {
     return "request" in result ? result : { request: result };

package/dist/providers/openai-compatible.js

@@ -17,8 +17,8 @@ export function createOpenAICompatibleProvider(options) {
                 const response = await fetchImpl(`${options.baseUrl.replace(/\/$/, "")}/chat/completions`, {
                     method: "POST",
                     headers: {
-                        "content-type": "application/json",
                         ...request.options?.headers,
+                        "content-type": "application/json",
                         ...(apiKey ? { authorization: `Bearer ${apiKey}` } : {}),
                     },
                     body: JSON.stringify(toOpenAIRequest(request)),

package/dist/providers.d.ts

@@ -1,8 +1,12 @@
-import type { AIProvider, ModelConfig } from "./contracts.js";
+import type { AIProvider, ModelConfig, ProviderResolver } from "./contracts.js";
+import { type DuplicateRegistrationOptions } from "./registry-options.js";
 export interface ProviderRegistry {
     register(provider: AIProvider): void;
     get(id: string): AIProvider | undefined;
     resolve(model: Pick<ModelConfig, "provider"> | string): AIProvider;
     list(): readonly AIProvider[];
 }
-export declare function createProviderRegistry(providers?: readonly AIProvider[]): ProviderRegistry;
+export interface ProviderRegistryOptions extends DuplicateRegistrationOptions {
+}
+export declare function createProviderRegistry(providers?: readonly AIProvider[], options?: ProviderRegistryOptions): ProviderRegistry;
+export declare function createProviderResolver(source: ProviderRegistry | readonly AIProvider[]): ProviderResolver;

package/dist/providers.js

@@ -1,7 +1,9 @@
-export function createProviderRegistry(providers = []) {
+import { assertCanRegister } from "./registry-options.js";
+export function createProviderRegistry(providers = [], options = {}) {
     const byId = new Map();
     const registry = {
         register(provider) {
+            assertCanRegister(byId, provider.id, "provider", provider.id, options.duplicate);
             byId.set(provider.id, provider);
         },
         get(id) {
@@ -22,4 +24,16 @@ export function createProviderRegistry(providers = []) {
         registry.register(provider);
     return registry;
 }
+function isProviderRegistry(source) {
+    return !Array.isArray(source);
+}
+export function createProviderResolver(source) {
+    // ponytail: array source builds the lookup map once at construction; registry
+    // source reuses ProviderRegistry.get so there is one lookup implementation.
+    if (isProviderRegistry(source)) {
+        return (model) => source.get(model.provider) ?? undefined;
+    }
+    const lookup = new Map(source.map((p) => [p.id, p]));
+    return (model) => lookup.get(model.provider) ?? undefined;
+}
 //# sourceMappingURL=providers.js.map

package/dist/redaction.d.ts

@@ -1,4 +1,4 @@
-import type { AgentEvent, ErrorInfo, Message, ProviderRequest, SessionEntry } from "./contracts.js";
+import type { AgentEvent, ErrorInfo, Message, ProviderRequest, RunLedgerRecord, SessionEntry } from "./contracts.js";
 export interface SecretRedactor {
     redact<T>(value: T): T;
 }
@@ -7,5 +7,6 @@ export declare function redactMessage(message: Message, redactor?: SecretRedacto
 export declare function redactAgentEvent(event: AgentEvent, redactor?: SecretRedactor): AgentEvent;
 export declare function redactSessionEntry(entry: SessionEntry, redactor?: SecretRedactor): SessionEntry;
 export declare function redactProviderRequest(request: ProviderRequest, redactor?: SecretRedactor): ProviderRequest;
+export declare function redactRunLedgerRecord<T extends RunLedgerRecord>(record: T, redactor?: SecretRedactor): T;
 export declare function redactSecrets<T>(value: T, secrets: readonly (string | undefined)[]): T;
 export declare function errorToErrorInfo(error: unknown, secrets?: readonly (string | undefined)[]): ErrorInfo;

package/dist/redaction.js

@@ -14,6 +14,9 @@ export function redactSessionEntry(entry, redactor) {
 export function redactProviderRequest(request, redactor) {
     return redactor?.redact(request) ?? request;
 }
+export function redactRunLedgerRecord(record, redactor) {
+    return redactor?.redact(record) ?? record;
+}
 export function redactSecrets(value, secrets) {
     const needles = secrets.filter((secret) => Boolean(secret));
     if (needles.length === 0)

package/dist/registry-options.d.ts

@@ -0,0 +1,5 @@
+export type DuplicateRegistrationPolicy = "replace" | "error";
+export interface DuplicateRegistrationOptions {
+    readonly duplicate?: DuplicateRegistrationPolicy;
+}
+export declare function assertCanRegister<K>(map: ReadonlyMap<K, unknown>, key: K, label: string, displayKey?: string, duplicate?: DuplicateRegistrationPolicy): void;

package/dist/registry-options.js

@@ -0,0 +1,5 @@
+export function assertCanRegister(map, key, label, displayKey = String(key), duplicate = "replace") {
+    if (duplicate === "error" && map.has(key))
+        throw new Error(`Duplicate ${label}: ${displayKey}`);
+}
+//# sourceMappingURL=registry-options.js.map