@arnilo/prism 0.0.15 → 0.0.17

package/dist/testing/extension-conformance.js

@@ -23,7 +23,12 @@ export async function assertExtensionConforms(extension, options = {}) {
     // provider/tool/skill capabilities until host code resolves and calls them).
     if (options.expectThrow) {
         // A second extension that throws must rethrow under errorPolicy: "throw".
-        const failing = { name: "conformance-failing", setup: () => { throw new Error("conformance setup failed"); } };
+        const failing = {
+            name: "conformance-failing",
+            setup: () => {
+                throw new Error("conformance setup failed");
+            },
+        };
         let threw = false;
         try {
             await kernel.load([failing]);
@@ -37,9 +42,16 @@ export async function assertExtensionConforms(extension, options = {}) {
     }
     if (options.secrets && options.secrets.length > 0) {
         const secret = options.secrets[0];
-        const failing = { name: "conformance-failing", setup: () => { throw new Error(`boom ${secret}`); } };
+        const failing = {
+            name: "conformance-failing",
+            setup: () => {
+                throw new Error(`boom ${secret}`);
+            },
+        };
         const errors = [];
-        kernel.events.on("extension_error", (event) => { errors.push(event.error ?? {}); });
+        kernel.events.on("extension_error", (event) => {
+            errors.push(event.error ?? {});
+        });
         await kernel.load([failing]);
         if (errors.length === 0)
             throw new Error("Failing extension setup did not emit an extension_error event");

package/dist/testing/feedback.d.ts

@@ -1,6 +1,4 @@
 import type { RunFeedbackStore } from "../contracts.js";
-export interface RunFeedbackConformanceFactory {
-    (): RunFeedbackStore | Promise<RunFeedbackStore>;
-}
+export type RunFeedbackConformanceFactory = () => RunFeedbackStore | Promise<RunFeedbackStore>;
 /** Shared minimum behavior for memory and production feedback stores. */
 export declare function runFeedbackConformance(factory: RunFeedbackConformanceFactory): Promise<void>;

package/dist/testing/feedback.js

@@ -31,7 +31,7 @@ export async function runFeedbackConformance(factory) {
     if (await store.delete({ id: "feedback-1", tenantId: "feedback-tenant", userId: "other" })) {
         throw new Error("cross-owner feedback deletion succeeded");
     }
-    if (!await store.delete({ id: "feedback-1", ...owner }))
+    if (!(await store.delete({ id: "feedback-1", ...owner })))
         throw new Error("owned feedback deletion failed");
 }
 //# sourceMappingURL=feedback.js.map

package/dist/testing/persistence-schema.js

@@ -301,34 +301,160 @@ export function createPersistenceSchemaModel() {
             },
         ],
         indexes: [
-            { name: "prism_sessions_tenant_created_idx", table: "prism_sessions", columns: ["tenant_id", "account_id", "user_id", "created_at"], purpose: "tenant-scoped session listing" },
+            {
+                name: "prism_sessions_tenant_created_idx",
+                table: "prism_sessions",
+                columns: ["tenant_id", "account_id", "user_id", "created_at"],
+                purpose: "tenant-scoped session listing",
+            },
             { name: "prism_sessions_expires_idx", table: "prism_sessions", columns: ["expires_at"], purpose: "retention expiry scans" },
             { name: "prism_branches_session_name_idx", table: "prism_branches", columns: ["session_id", "name"], purpose: "named branch lookup" },
             { name: "prism_branches_leaf_idx", table: "prism_branches", columns: ["leaf_entry_id"], purpose: "leaf-to-branch resolution" },
-            { name: "prism_session_entries_session_parent_idx", table: "prism_session_entries", columns: ["session_id", "parent_id"], purpose: "parent existence checks and child lookups" },
-            { name: "prism_session_entries_session_kind_ts_idx", table: "prism_session_entries", columns: ["session_id", "kind", "timestamp"], purpose: "kind-filtered entry listing" },
-            { name: "prism_session_entries_session_run_ts_idx", table: "prism_session_entries", columns: ["session_id", "run_id", "timestamp"], purpose: "run-scoped entry listing" },
-            { name: "prism_session_entries_session_ts_id_idx", table: "prism_session_entries", columns: ["session_id", "timestamp", "id"], purpose: "cursor pagination without full scans" },
-            { name: "prism_session_entries_session_id_idx", table: "prism_session_entries", columns: ["session_id", "id"], purpose: "append parent validation and recursive branch reads" },
-            { name: "prism_session_append_idempotency_unique", table: "prism_session_append_idempotency", columns: ["session_id", "expected_parent_id", "idempotency_key"], purpose: "append retry deduplication (primary key enforces uniqueness)" },
-            { name: "prism_runs_session_started_idx", table: "prism_runs", columns: ["session_id", "started_at", "id"], purpose: "run history pagination" },
-            { name: "prism_runs_branch_started_idx", table: "prism_runs", columns: ["branch_id", "started_at", "id"], purpose: "branch-scoped runs" },
-            { name: "prism_runs_tenant_idempotency_unique", table: "prism_runs", columns: ["tenant_id", "idempotency_key"], unique: true, purpose: "run-level idempotency deduplication per tenant" },
-            { name: "prism_agent_events_run_sequence_idx", table: "prism_agent_events", columns: ["run_id", "sequence"], purpose: "stable per-run event timeline pagination" },
-            { name: "prism_agent_events_session_ts_id_idx", table: "prism_agent_events", columns: ["session_id", "timestamp", "id"], purpose: "event stream pagination" },
-            { name: "prism_tool_calls_session_name_started_idx", table: "prism_tool_calls", columns: ["session_id", "name", "started_at"], purpose: "tool usage by name" },
-            { name: "prism_tool_calls_run_started_idx", table: "prism_tool_calls", columns: ["run_id", "started_at"], purpose: "run tool-call listing" },
-            { name: "prism_usage_run_recorded_idx", table: "prism_usage", columns: ["run_id", "recorded_at", "id"], purpose: "run usage pagination" },
-            { name: "prism_usage_session_recorded_idx", table: "prism_usage", columns: ["session_id", "recorded_at"], purpose: "usage aggregation" },
-            { name: "prism_usage_session_scope_recorded_idx", table: "prism_usage", columns: ["session_id", "scope", "recorded_at"], purpose: "scope-safe usage aggregation" },
-            { name: "prism_run_feedback_owner_created_idx", table: "prism_run_feedback", columns: ["tenant_id", "account_id", "user_id", "created_at", "id"], purpose: "ownership-scoped feedback pagination" },
-            { name: "prism_run_feedback_run_created_idx", table: "prism_run_feedback", columns: ["run_id", "created_at", "id"], purpose: "run feedback lookup" },
-            { name: "prism_run_feedback_trace_created_idx", table: "prism_run_feedback", columns: ["trace_id", "created_at", "id"], purpose: "trace feedback lookup" },
-            { name: "prism_agent_definitions_name_version_idx", table: "prism_agent_definitions", columns: ["name", "version"], purpose: "definition lookup" },
-            { name: "prism_legal_holds_owner_resource_idx", table: "prism_legal_holds", columns: ["tenant_id", "account_id", "user_id", "resource_kind", "resource_id"], purpose: "hold lookup by owned resource" },
-            { name: "prism_legal_holds_created_id_idx", table: "prism_legal_holds", columns: ["created_at", "id"], purpose: "hold export pagination" },
-            { name: "prism_tenant_quotas_owner_kind_idx", table: "prism_tenant_quotas", columns: ["tenant_id", "account_id", "user_id", "resource_kind"], purpose: "tenant quota lookup" },
-            { name: "prism_migrations_name_version_idx", table: "prism_migrations", columns: ["name", "version"], purpose: "applied-migration lookup (table constraint enforces uniqueness)" },
+            {
+                name: "prism_session_entries_session_parent_idx",
+                table: "prism_session_entries",
+                columns: ["session_id", "parent_id"],
+                purpose: "parent existence checks and child lookups",
+            },
+            {
+                name: "prism_session_entries_session_kind_ts_idx",
+                table: "prism_session_entries",
+                columns: ["session_id", "kind", "timestamp"],
+                purpose: "kind-filtered entry listing",
+            },
+            {
+                name: "prism_session_entries_session_run_ts_idx",
+                table: "prism_session_entries",
+                columns: ["session_id", "run_id", "timestamp"],
+                purpose: "run-scoped entry listing",
+            },
+            {
+                name: "prism_session_entries_session_ts_id_idx",
+                table: "prism_session_entries",
+                columns: ["session_id", "timestamp", "id"],
+                purpose: "cursor pagination without full scans",
+            },
+            {
+                name: "prism_session_entries_session_id_idx",
+                table: "prism_session_entries",
+                columns: ["session_id", "id"],
+                purpose: "append parent validation and recursive branch reads",
+            },
+            {
+                name: "prism_session_append_idempotency_unique",
+                table: "prism_session_append_idempotency",
+                columns: ["session_id", "expected_parent_id", "idempotency_key"],
+                purpose: "append retry deduplication (primary key enforces uniqueness)",
+            },
+            {
+                name: "prism_runs_session_started_idx",
+                table: "prism_runs",
+                columns: ["session_id", "started_at", "id"],
+                purpose: "run history pagination",
+            },
+            {
+                name: "prism_runs_branch_started_idx",
+                table: "prism_runs",
+                columns: ["branch_id", "started_at", "id"],
+                purpose: "branch-scoped runs",
+            },
+            {
+                name: "prism_runs_tenant_idempotency_unique",
+                table: "prism_runs",
+                columns: ["tenant_id", "idempotency_key"],
+                unique: true,
+                purpose: "run-level idempotency deduplication per tenant",
+            },
+            {
+                name: "prism_agent_events_run_sequence_idx",
+                table: "prism_agent_events",
+                columns: ["run_id", "sequence"],
+                purpose: "stable per-run event timeline pagination",
+            },
+            {
+                name: "prism_agent_events_session_ts_id_idx",
+                table: "prism_agent_events",
+                columns: ["session_id", "timestamp", "id"],
+                purpose: "event stream pagination",
+            },
+            {
+                name: "prism_tool_calls_session_name_started_idx",
+                table: "prism_tool_calls",
+                columns: ["session_id", "name", "started_at"],
+                purpose: "tool usage by name",
+            },
+            {
+                name: "prism_tool_calls_run_started_idx",
+                table: "prism_tool_calls",
+                columns: ["run_id", "started_at"],
+                purpose: "run tool-call listing",
+            },
+            {
+                name: "prism_usage_run_recorded_idx",
+                table: "prism_usage",
+                columns: ["run_id", "recorded_at", "id"],
+                purpose: "run usage pagination",
+            },
+            {
+                name: "prism_usage_session_recorded_idx",
+                table: "prism_usage",
+                columns: ["session_id", "recorded_at"],
+                purpose: "usage aggregation",
+            },
+            {
+                name: "prism_usage_session_scope_recorded_idx",
+                table: "prism_usage",
+                columns: ["session_id", "scope", "recorded_at"],
+                purpose: "scope-safe usage aggregation",
+            },
+            {
+                name: "prism_run_feedback_owner_created_idx",
+                table: "prism_run_feedback",
+                columns: ["tenant_id", "account_id", "user_id", "created_at", "id"],
+                purpose: "ownership-scoped feedback pagination",
+            },
+            {
+                name: "prism_run_feedback_run_created_idx",
+                table: "prism_run_feedback",
+                columns: ["run_id", "created_at", "id"],
+                purpose: "run feedback lookup",
+            },
+            {
+                name: "prism_run_feedback_trace_created_idx",
+                table: "prism_run_feedback",
+                columns: ["trace_id", "created_at", "id"],
+                purpose: "trace feedback lookup",
+            },
+            {
+                name: "prism_agent_definitions_name_version_idx",
+                table: "prism_agent_definitions",
+                columns: ["name", "version"],
+                purpose: "definition lookup",
+            },
+            {
+                name: "prism_legal_holds_owner_resource_idx",
+                table: "prism_legal_holds",
+                columns: ["tenant_id", "account_id", "user_id", "resource_kind", "resource_id"],
+                purpose: "hold lookup by owned resource",
+            },
+            {
+                name: "prism_legal_holds_created_id_idx",
+                table: "prism_legal_holds",
+                columns: ["created_at", "id"],
+                purpose: "hold export pagination",
+            },
+            {
+                name: "prism_tenant_quotas_owner_kind_idx",
+                table: "prism_tenant_quotas",
+                columns: ["tenant_id", "account_id", "user_id", "resource_kind"],
+                purpose: "tenant quota lookup",
+            },
+            {
+                name: "prism_migrations_name_version_idx",
+                table: "prism_migrations",
+                columns: ["name", "version"],
+                purpose: "applied-migration lookup (table constraint enforces uniqueness)",
+            },
         ],
     };
 }
@@ -346,13 +472,25 @@ function migrationStep(version, name, description) {
         : version === 2
             ? { table: "prism_usage", columns: ["scope", "turn", "attempt"], indexes: ["prism_usage_session_scope_recorded_idx"] }
             : version === 3
-                ? { tables: ["prism_run_feedback"], indexes: model.indexes.filter((index) => index.name.startsWith("prism_run_feedback_")).map((index) => index.name) }
+                ? {
+                    tables: ["prism_run_feedback"],
+                    indexes: model.indexes.filter((index) => index.name.startsWith("prism_run_feedback_")).map((index) => index.name),
+                }
                 : version === 4
-                    // Adapter-local FTS objects (SQLite FTS5 / Postgres tsvector) map to this canonical name.
-                    ? { search: ["prism_session_search"], indexes: ["prism_sessions_updated_id_idx"] }
+                    ? // Adapter-local FTS objects (SQLite FTS5 / Postgres tsvector) map to this canonical name.
+                        { search: ["prism_session_search"], indexes: ["prism_sessions_updated_id_idx"] }
                     : version === 5
-                        ? { tables: ["prism_legal_holds", "prism_tenant_quotas"], indexes: ["prism_legal_holds_owner_resource_idx", "prism_legal_holds_created_id_idx", "prism_tenant_quotas_owner_kind_idx"] }
-                        : (() => { throw new Error(`Unknown migration version ${version}`); })();
+                        ? {
+                            tables: ["prism_legal_holds", "prism_tenant_quotas"],
+                            indexes: [
+                                "prism_legal_holds_owner_resource_idx",
+                                "prism_legal_holds_created_id_idx",
+                                "prism_tenant_quotas_owner_kind_idx",
+                            ],
+                        }
+                        : (() => {
+                            throw new Error(`Unknown migration version ${version}`);
+                        })();
     return {
         version,
         name,
@@ -379,13 +517,33 @@ export function createPersistenceMigrationContract() {
 /** Indexed cursor columns adapters must support for paginated reads. */
 export function getPersistencePaginationCursors() {
     return [
-        { table: "prism_session_entries", columns: ["session_id", "timestamp", "id"], supportsOrder: ["asc", "desc"], purpose: "entry listing and branch paging" },
+        {
+            table: "prism_session_entries",
+            columns: ["session_id", "timestamp", "id"],
+            supportsOrder: ["asc", "desc"],
+            purpose: "entry listing and branch paging",
+        },
         { table: "prism_runs", columns: ["session_id", "started_at", "id"], supportsOrder: ["asc", "desc"], purpose: "run history" },
-        { table: "prism_agent_events", columns: ["run_id", "sequence"], supportsOrder: ["asc", "desc"], purpose: "stable per-run event timeline" },
-        { table: "prism_agent_events", columns: ["session_id", "timestamp", "id"], supportsOrder: ["asc", "desc"], purpose: "session event stream" },
+        {
+            table: "prism_agent_events",
+            columns: ["run_id", "sequence"],
+            supportsOrder: ["asc", "desc"],
+            purpose: "stable per-run event timeline",
+        },
+        {
+            table: "prism_agent_events",
+            columns: ["session_id", "timestamp", "id"],
+            supportsOrder: ["asc", "desc"],
+            purpose: "session event stream",
+        },
         { table: "prism_usage", columns: ["run_id", "recorded_at", "id"], supportsOrder: ["asc", "desc"], purpose: "run usage totals" },
         { table: "prism_tool_calls", columns: ["run_id", "started_at"], supportsOrder: ["asc", "desc"], purpose: "run tool-call listing" },
-        { table: "prism_run_feedback", columns: ["tenant_id", "account_id", "user_id", "created_at", "id"], supportsOrder: ["asc", "desc"], purpose: "owned feedback listing" },
+        {
+            table: "prism_run_feedback",
+            columns: ["tenant_id", "account_id", "user_id", "created_at", "id"],
+            supportsOrder: ["asc", "desc"],
+            purpose: "owned feedback listing",
+        },
     ];
 }
 /** Build a tenant-scoped unique key column list for adapter DDL. */
@@ -418,7 +576,13 @@ export function assertPersistenceSchemaModel(model) {
         throw new Error("Runs table must include tenant-scoped tenant_id");
     }
     const indexTables = new Set(model.indexes.map((index) => index.table));
-    for (const requiredIndex of ["prism_session_append_idempotency", "prism_session_entries", "prism_agent_events", "prism_runs", "prism_run_feedback"]) {
+    for (const requiredIndex of [
+        "prism_session_append_idempotency",
+        "prism_session_entries",
+        "prism_agent_events",
+        "prism_runs",
+        "prism_run_feedback",
+    ]) {
         if (!indexTables.has(requiredIndex)) {
             throw new Error(`Persistence schema missing indexes for ${requiredIndex}`);
         }
@@ -462,7 +626,10 @@ function schemaKey(columns) {
     return columns.join("\u0000");
 }
 function normalizedDefault(value) {
-    return value?.trim().toLowerCase().replace(/::[a-z_ ]+$/, "");
+    return value
+        ?.trim()
+        .toLowerCase()
+        .replace(/::[a-z_ ]+$/, "");
 }
 function compatibleColumnType(dialect, actual, expected) {
     const type = actual.trim().toUpperCase();
@@ -527,7 +694,9 @@ export function assertPersistenceSchemaShape(shape, dialect, model = createPersi
         const actual = actualIndexes.get(expected.name);
         if (!actual)
             throw new Error(`Persistence schema missing required index ${expected.name}`);
-        if (actual.table !== expected.table || schemaKey(actual.columns) !== schemaKey(expected.columns) || actual.unique !== (expected.unique === true)) {
+        if (actual.table !== expected.table ||
+            schemaKey(actual.columns) !== schemaKey(expected.columns) ||
+            actual.unique !== (expected.unique === true)) {
             throw new Error(`Persistence schema index ${expected.name} has incompatible definition`);
         }
     }

package/dist/testing/provider-conformance.js

@@ -73,7 +73,7 @@ export function assertProviderOwnedHeadersWin(captured, options) {
             throw new Error(`Caller header overrode provider-owned "${name}": expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
     }
     for (const [name, callerValue] of Object.entries(options.caller)) {
-        if (Object.prototype.hasOwnProperty.call(ownedLower, name.toLowerCase()))
+        if (Object.hasOwn(ownedLower, name.toLowerCase()))
             continue;
         const actual = captured.get(name);
         if (actual !== callerValue)
@@ -90,7 +90,7 @@ export function assertNoSecretLeak(events, secrets) {
     }
 }
 export function assertUsageAccounting(events, expected) {
-    const usage = [...events].reverse().find((event) => event.type === "done" && event.usage || event.type === "usage");
+    const usage = [...events].reverse().find((event) => (event.type === "done" && event.usage) || event.type === "usage");
     const actual = usage?.type === "usage" ? usage.usage : usage?.usage;
     if (!actual)
         throw new Error("Provider stream did not include usage");
@@ -155,6 +155,6 @@ function jsonPrimitives(value) {
     return primitives;
 }
 function textFrom(events) {
-    return events.map((event) => event.type === "content_delta" && event.content.type === "text" ? event.content.text : "").join("");
+    return events.map((event) => (event.type === "content_delta" && event.content.type === "text" ? event.content.text : "")).join("");
 }
 //# sourceMappingURL=provider-conformance.js.map

package/dist/testing/run-ledger-conformance.js

@@ -138,7 +138,7 @@ export async function assertRunLedgerConforms(fixture, options = {}) {
         await fixture.ledger.appendRun(otherRun);
         const runs = await fixture.readRuns();
         const stored = runs.find((row) => row.id === "run-tenant-b");
-        if (!stored || stored.tenantId !== "tenant-b") {
+        if (stored?.tenantId !== "tenant-b") {
             throw new Error("RunLedger must persist tenant_id on records for tenant-scoped isolation");
         }
         const scoped = runs.filter((row) => row.tenantId === tenantId);

package/dist/testing/session-store-conformance.js

@@ -155,7 +155,7 @@ async function assertSessionStoreBranchIsolation(store, options) {
         throw new Error("SessionStore leaked entries across session ids");
     }
 }
-async function assertConcurrentParentAppendAllowed(store, sessionId, now, make) {
+async function assertConcurrentParentAppendAllowed(store, sessionId, _now, make) {
     const forkRoot = make("fork-root");
     await store.append(forkRoot);
     const childA = make("fork-a", forkRoot.id);

package/dist/testing/tool-conformance.js

@@ -26,15 +26,38 @@ export async function assertToolDispatchConforms(registry, options) {
     // 1. unknown tool → blocked "unknown_tool".
     await assertToolBlocked({ call: call("does-not-exist", {}), context: baseContext, ...shared, ...pickPolicy(options) }, "unknown_tool");
     // 2. denied tool (filter) → blocked "tool_denied".
-    await assertToolBlocked({ call: call(options.tool.name, options.validArgs), context: baseContext, ...shared, ...pickPolicy(options), filter: { deny: [options.tool.name] } }, "tool_denied");
+    await assertToolBlocked({
+        call: call(options.tool.name, options.validArgs),
+        context: baseContext,
+        ...shared,
+        ...pickPolicy(options),
+        filter: { deny: [options.tool.name] },
+    }, "tool_denied");
     // 3. invalid (non-object) arguments → blocked "invalid_arguments".
     await assertToolBlocked({ call: call(options.tool.name, "not-an-object"), context: baseContext, ...shared, ...pickPolicy(options) }, "invalid_arguments");
     // 4. permission denial → blocked "permission_denied".
-    await assertToolBlocked({ call: call(options.tool.name, options.validArgs), context: baseContext, ...shared, ...pickPolicy(options), permission: denyAllPermission }, "permission_denied");
+    await assertToolBlocked({
+        call: call(options.tool.name, options.validArgs),
+        context: baseContext,
+        ...shared,
+        ...pickPolicy(options),
+        permission: denyAllPermission,
+    }, "permission_denied");
     // 5. validator failure → blocked "validation_failed".
-    await assertToolBlocked({ call: call(options.tool.name, options.validArgs), context: baseContext, ...shared, ...pickPolicy(options), validate: alwaysInvalidValidator }, "validation_failed");
+    await assertToolBlocked({
+        call: call(options.tool.name, options.validArgs),
+        context: baseContext,
+        ...shared,
+        ...pickPolicy(options),
+        validate: alwaysInvalidValidator,
+    }, "validation_failed");
     // 6. valid call → executes (tool_execution_started), no error, no blocked event.
-    const probe = await dispatchAndCollect({ call: call(options.tool.name, options.validArgs), context: baseContext, ...shared, ...pickPolicy(options) });
+    const probe = await dispatchAndCollect({
+        call: call(options.tool.name, options.validArgs),
+        context: baseContext,
+        ...shared,
+        ...pickPolicy(options),
+    });
     if (probe.result.error)
         throw new Error(`Valid tool call was not executed: ${probe.result.error.message}`);
     if (!probe.events.some((event) => event.type === "tool_execution_started")) {
@@ -69,7 +92,9 @@ export async function dispatchAndCollect(probe) {
         permission: probe.permission,
         validate: probe.validate,
         secrets: probe.secrets,
-        emit: (event) => { events.push(event); },
+        emit: (event) => {
+            events.push(event);
+        },
     });
     return { result, events };
 }

package/dist/thinking.js

@@ -47,7 +47,10 @@ export function applyThinkingLevel(options, level, family = "reasoning_effort")
     if (!normalized || family === "noop")
         return options ?? {};
     const patch = thinkingCompatFor(family, normalized);
-    if (family === "openai_reasoning" && options?.compat?.reasoning && typeof options.compat.reasoning === "object" && !Array.isArray(options.compat.reasoning)) {
+    if (family === "openai_reasoning" &&
+        options?.compat?.reasoning &&
+        typeof options.compat.reasoning === "object" &&
+        !Array.isArray(options.compat.reasoning)) {
         return mergeProviderRequestOptions(options, {
             compat: {
                 reasoning: {

package/dist/tools.d.ts

@@ -1,15 +1,15 @@
 import type { AgentEvent, ErrorInfo, Guardrails, JsonObject, OwnershipScope, RunLedger, ToolCallContent, ToolDefinition, ToolExecutionContext, ToolRegistry, ToolResult } from "./contracts.js";
-import type { RunLimitTracker } from "./run-limits.js";
 import type { MiddlewareRegistry } from "./middleware.js";
 import { type SecretRedactor } from "./redaction.js";
 import { type DuplicateRegistrationOptions } from "./registry-options.js";
+import type { RunLimitTracker } from "./run-limits.js";
 import { type PermissionPolicy, type TrustPolicy } from "./security.js";
 export interface ToolFilter {
     readonly allow?: readonly string[];
     readonly deny?: readonly string[];
 }
 export type ToolFilterInput = ToolFilter | readonly ToolFilter[];
-export type ToolValidator = (tool: ToolDefinition, args: JsonObject, context: ToolExecutionContext) => void | string | ErrorInfo | Promise<void | string | ErrorInfo>;
+export type ToolValidator = (tool: ToolDefinition, args: JsonObject, context: ToolExecutionContext) => undefined | string | ErrorInfo | Promise<undefined | string | ErrorInfo>;
 export interface ToolArgumentValidationError {
     readonly path?: string;
     readonly message: string;

package/dist/tools.js

@@ -1,7 +1,7 @@
 import { isJsonObject } from "./config.js";
-import { createId } from "./ids.js";
 import { GuardrailError, runGuardrails } from "./guardrails.js";
 import { assertIdentityActive, assertIdentityMatchesOwnership } from "./identity.js";
+import { createId } from "./ids.js";
 import { errorToErrorInfo, redactRunLedgerRecord, redactSecrets } from "./redaction.js";
 import { assertCanRegister } from "./registry-options.js";
 import { assertPermission, assertTrusted } from "./security.js";
@@ -52,7 +52,9 @@ export function createToolRegistry(tools = [], options = {}) {
 export function filterTools(tools, filter) {
     const filters = Array.isArray(filter) ? filter : filter ? [filter] : [];
     const denied = new Set(filters.flatMap((item) => item.deny ?? []));
-    const allows = filters.map((item) => item.allow?.length ? new Set(item.allow) : undefined).filter((item) => Boolean(item));
+    const allows = filters
+        .map((item) => (item.allow?.length ? new Set(item.allow) : undefined))
+        .filter((item) => Boolean(item));
     return tools.filter((tool) => !denied.has(tool.name) && allows.every((allow) => allow.has(tool.name)));
 }
 function toolExecutionMetadata(startedAt, status) {
@@ -114,8 +116,18 @@ export async function dispatchToolCall(options) {
             assertIdentityActive(context.identity);
             assertIdentityMatchesOwnership(context.identity, options.ownership);
         }
-        await assertTrusted(options.trust, { kind: "tool", target: mediatedCall.name, capability: "execute", metadata: options.context.metadata });
-        await assertPermission(options.permission, { kind: "tool", action: "execute", target: mediatedCall.name, metadata: options.context.metadata });
+        await assertTrusted(options.trust, {
+            kind: "tool",
+            target: mediatedCall.name,
+            capability: "execute",
+            metadata: options.context.metadata,
+        });
+        await assertPermission(options.permission, {
+            kind: "tool",
+            action: "execute",
+            target: mediatedCall.name,
+            metadata: options.context.metadata,
+        });
     }
     catch (error) {
         return blocked(mediatedCall, context, "permission_denied", errorToErrorInfo(error, secrets), options, startedAt);
@@ -170,7 +182,14 @@ export async function dispatchToolCall(options) {
         const result = { toolCallId: mediatedCall.id, name: mediatedCall.name, error: info };
         const finishedAt = new Date().toISOString();
         const metadata = toolExecutionMetadata(startedAt, "error");
-        await options.emit?.({ type: "tool_execution_error", sessionId: context.sessionId, runId: context.runId, call: mediatedCall, error: info, metadata });
+        await options.emit?.({
+            type: "tool_execution_error",
+            sessionId: context.sessionId,
+            runId: context.runId,
+            call: mediatedCall,
+            error: info,
+            metadata,
+        });
         await appendToolCallRecord(options, "error", mediatedCall, startedAt, { finishedAt, result });
         return result;
     }