@jini-ai/agent-runtime 0.3.10 → 0.4.0

package/dist/providers/connection-guard.d.ts

@@ -1,7 +1,7 @@
 /**
  * @module providers/connection-guard
  *
- * Minimal, self-contained SSRF-guard + secret-redaction utilities needed by
+ * SSRF validation and pinned transport needed by
  * this package's own `model-catalog.ts`. Vendored from the small generic
  * subset of OD's `packages/contracts/src/api/connectionTest.ts` (the
  * `isLoopbackApiHost`/`isBlockedExternalApiHostname`/`validateBaseUrl` triad)
@@ -10,17 +10,25 @@
  * 2,600-line file, which is almost entirely OD's own agent-CLI
  * connection-test orchestration (proxy dispatchers, product-specific
  * executable-fallback copy and env-var names) and out of this task's
- * scope; see `source-map.md` for the exact origin details. These four
- * functions are pure security/text utilities with
+ * scope; see `archived provenance ledger` for the exact origin details. The shared classifiers now live in `@jini-ai/platform/net`, and redaction
+ * lives in core. Validation and transport here retain
  * no product coupling in the origin — reject requests to loopback-disguised
  * or RFC1918/link-local/CGNAT/metadata-service addresses, and strip bearer
  * tokens / API-key headers / `?key=` query values out of free-form text
- * before it is logged or surfaced to a caller.
+ * before it is logged or surfaced to a caller. Provider modules call core with
+ * explicit exactSecrets because upstream 401 bodies can echo configured credentials.
  *
- * Also exports `pinnedFetch` — a `node:https`/`node:http`-based POST that dials the exact address
+ * The provider redaction contract removes bearer tokens,
+ * `x-api-key`/`api-key`/`x-goog-api-key` headers, `?key=` query values,
+ * and exact secret strings supplied by the caller from free-form text.
+ * It is used for logging or surfacing upstream failures without leaking
+ * credentials embedded in them (some providers echo the key in a 401 body).
+ * Core owns this union now; provider model/request IDs remain readable.
+ *
+ * Exports `pinnedFetch` — a `node:https`/`node:http`-based POST that dials the exact address
  * `validateBaseUrlResolved` already validated, instead of leaving the transport to re-resolve DNS
  * independently when it connects. Added later than the four functions above, for the same
- * dependency-free package; see `pinnedFetch`'s own doc for why `fetch()` itself cannot do this.
+ * explicit network boundary; see `pinnedFetch`'s own doc for why `fetch()` itself cannot do this.
  *
  * ## Paired with `@jini-ai/ui`'s `utils/endpoint-policy.ts`
  *
@@ -31,7 +39,7 @@
  * imports by design and this package is Node-only (`validateBaseUrlResolved`
  * needs `node:dns`); see that file's header for the full reasoning.
  *
- * **If the block-list here changes, change it there too.** A divergence means
+ * **If the platform/net block-list changes, change the browser copy too.** A divergence means
  * the UI accepts an endpoint this guard then refuses — or, in the direction
  * that actually matters, the UI accepts one this guard would have refused.
  */
@@ -49,10 +57,6 @@ export interface BaseUrlValidationResult {
      */
     pinnedAddress?: DnsLookupAddress;
 }
-/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
-export declare function isLoopbackApiHost(hostname: string): boolean;
-/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
-export declare function isBlockedExternalApiHostname(hostname: string): boolean;
 /**
  * Synchronous base-URL check: scheme allow-list + literal-hostname block-list.
  * Does not resolve DNS — see {@link validateBaseUrlResolved}.
@@ -73,12 +77,16 @@ export declare function isBlockedExternalApiHostname(hostname: string): boolean;
  * is the only shape that would let the block-list inspect one string while the
  * network used another.
  */
-export declare function validateBaseUrl(baseUrl: string): BaseUrlValidationResult;
+export declare function validateBaseUrl({ baseUrl }: {
+    baseUrl: string;
+}): BaseUrlValidationResult;
 export type DnsLookupAddress = {
     address: string;
     family: number;
 };
-export type DnsLookupFn = (hostname: string) => Promise<DnsLookupAddress[]>;
+export type DnsLookupFn = (requiredArgs: {
+    hostname: string;
+}) => Promise<DnsLookupAddress[]>;
 /**
  * DNS-aware companion to {@link validateBaseUrl}. The synchronous check only
  * inspects the literal hostname string, so a public DNS name pointing at
@@ -110,15 +118,19 @@ export type DnsLookupFn = (hostname: string) => Promise<DnsLookupAddress[]>;
  * unvalidated address; `pinnedFetch` never follows one regardless (`node:https`/`node:http` don't,
  * unlike `fetch`'s default), but callers still pass `redirect: 'error'` for self-documentation.
  *
- * DNS lookup failures are not treated as a security signal — the caller is
- * going to surface a connection error from `fetch` anyway, and turning a
- * transient resolver hiccup into a rejection would just confuse callers. The
+ * DNS lookup failures and empty answers fail closed: an unpinned fallback
+ * would let the transport resolve the host again without checking that answer.
+ * Earlier behavior deferred resolver hiccups to the transport; that bypassed
+ * validation if its independent lookup succeeded, so it is no longer allowed. The
  * synchronous hostname check still rejects the obvious literal-IP cases
- * before DNS is ever consulted. `lookup` defaults to `node:dns`'s promise
- * `lookup(hostname, { all: true, family: 0 })`, injectable for tests and for
- * hosts that already own a resolver.
+ * before DNS is ever consulted. `lookup` is a required injected resolver;
+ * a Node host can wrap `node:dns`'s promise
+ * `lookup(hostname, { all: true, family: 0 })` in this port's object signature.
  */
-export declare function validateBaseUrlResolved(baseUrl: string, lookup: DnsLookupFn): Promise<BaseUrlValidationResult>;
+export declare function validateBaseUrlResolved({ baseUrl, lookup }: {
+    baseUrl: string;
+    lookup: DnsLookupFn;
+}): Promise<BaseUrlValidationResult>;
 /** Request options accepted by {@link pinnedFetch} — the subset of `fetch`'s `init` this package's provider adapters actually pass. `redirect` is accepted only as documentation of intent: `pinnedFetch` never follows a redirect regardless of this field, so a caller cannot opt back into `fetch`'s default follow-redirects behavior. */
 export interface PinnedFetchInit {
     readonly method: string;
@@ -144,7 +156,11 @@ export interface PinnedFetchResponse {
  * behavior, including the SSRF guard and DNS pinning, never changes unless a caller explicitly
  * overrides it.
  */
-export type PinnedFetch = (url: string, init: PinnedFetchInit, pinnedAddress: DnsLookupAddress | undefined) => Promise<PinnedFetchResponse>;
+export type PinnedFetch = (requiredArgs: {
+    url: string;
+    init: PinnedFetchInit;
+    pinnedAddress: DnsLookupAddress | undefined;
+}) => Promise<PinnedFetchResponse>;
 /**
  * `fetch()`-shaped POST that dials `pinnedAddress` directly instead of letting the transport
  * re-resolve DNS when it connects — see {@link validateBaseUrlResolved}'s doc for the TOCTOU this
@@ -173,15 +189,13 @@ export type PinnedFetch = (url: string, init: PinnedFetchInit, pinnedAddress: Dn
  * (`lookup` option simply omitted). That is intentional, not a gap: an IP literal has nothing left
  * to re-resolve, and loopback literals are the documented carve-out, outside this threat model.
  */
-export declare function pinnedFetch(url: string, init: PinnedFetchInit, pinnedAddress: DnsLookupAddress | undefined): Promise<PinnedFetchResponse>;
-/**
- * Redacts bearer tokens, `x-api-key`/`api-key`/`x-goog-api-key` headers,
- * `?key=` query values, and any exact secret strings supplied via
- * `exactSecrets` out of free-form text — for logging or surfacing an
- * upstream error message to a caller without leaking credentials embedded in
- * it (some providers echo the key back in a 401 body).
- */
-export declare function redactSecrets(text: string, exactSecrets?: ReadonlyArray<string | undefined | null>): string;
+export declare function pinnedFetch({ url, init, pinnedAddress }: {
+    url: string;
+    init: PinnedFetchInit;
+    pinnedAddress: DnsLookupAddress | undefined;
+}): Promise<PinnedFetchResponse>;
 /** Default DNS lookup for {@link validateBaseUrlResolved} — `node:dns/promises`' `lookup(hostname, { all: true, family: 0 })`. */
-export declare function defaultDnsLookup(hostname: string): Promise<DnsLookupAddress[]>;
+export declare function defaultDnsLookup({ hostname }: {
+    hostname: string;
+}): Promise<DnsLookupAddress[]>;
 //# sourceMappingURL=connection-guard.d.ts.map

package/dist/providers/connection-guard.js

@@ -1,7 +1,7 @@
 /**
  * @module providers/connection-guard
  *
- * Minimal, self-contained SSRF-guard + secret-redaction utilities needed by
+ * SSRF validation and pinned transport needed by
  * this package's own `model-catalog.ts`. Vendored from the small generic
  * subset of OD's `packages/contracts/src/api/connectionTest.ts` (the
  * `isLoopbackApiHost`/`isBlockedExternalApiHostname`/`validateBaseUrl` triad)
@@ -10,17 +10,25 @@
  * 2,600-line file, which is almost entirely OD's own agent-CLI
  * connection-test orchestration (proxy dispatchers, product-specific
  * executable-fallback copy and env-var names) and out of this task's
- * scope; see `source-map.md` for the exact origin details. These four
- * functions are pure security/text utilities with
+ * scope; see `archived provenance ledger` for the exact origin details. The shared classifiers now live in `@jini-ai/platform/net`, and redaction
+ * lives in core. Validation and transport here retain
  * no product coupling in the origin — reject requests to loopback-disguised
  * or RFC1918/link-local/CGNAT/metadata-service addresses, and strip bearer
  * tokens / API-key headers / `?key=` query values out of free-form text
- * before it is logged or surfaced to a caller.
+ * before it is logged or surfaced to a caller. Provider modules call core with
+ * explicit exactSecrets because upstream 401 bodies can echo configured credentials.
  *
- * Also exports `pinnedFetch` — a `node:https`/`node:http`-based POST that dials the exact address
+ * The provider redaction contract removes bearer tokens,
+ * `x-api-key`/`api-key`/`x-goog-api-key` headers, `?key=` query values,
+ * and exact secret strings supplied by the caller from free-form text.
+ * It is used for logging or surfacing upstream failures without leaking
+ * credentials embedded in them (some providers echo the key in a 401 body).
+ * Core owns this union now; provider model/request IDs remain readable.
+ *
+ * Exports `pinnedFetch` — a `node:https`/`node:http`-based POST that dials the exact address
  * `validateBaseUrlResolved` already validated, instead of leaving the transport to re-resolve DNS
  * independently when it connects. Added later than the four functions above, for the same
- * dependency-free package; see `pinnedFetch`'s own doc for why `fetch()` itself cannot do this.
+ * explicit network boundary; see `pinnedFetch`'s own doc for why `fetch()` itself cannot do this.
  *
  * ## Paired with `@jini-ai/ui`'s `utils/endpoint-policy.ts`
  *
@@ -31,99 +39,11 @@
  * imports by design and this package is Node-only (`validateBaseUrlResolved`
  * needs `node:dns`); see that file's header for the full reasoning.
  *
- * **If the block-list here changes, change it there too.** A divergence means
+ * **If the platform/net block-list changes, change the browser copy too.** A divergence means
  * the UI accepts an endpoint this guard then refuses — or, in the direction
  * that actually matters, the UI accepts one this guard would have refused.
  */
-function normalizeBracketedIpv6(hostname) {
-    const stripped = hostname.startsWith('[') && hostname.endsWith(']')
-        ? hostname.slice(1, -1)
-        : hostname;
-    // FQDN trailing-dot form (RFC 1034) resolves identically to the dotless
-    // form, so `localhost.` must normalize to `localhost` before the equality
-    // check below — and `0.0.0.0.`, `10.0.0.1.`, etc. must normalize before
-    // isBlockedIpv4 parses them. Strips one or more trailing dots.
-    return stripped.toLowerCase().replace(/\.+$/, '');
-}
-function parseIpv4(hostname) {
-    const parts = hostname.split('.');
-    if (parts.length !== 4)
-        return null;
-    const parsed = parts.map((part) => {
-        if (!/^\d{1,3}$/.test(part))
-            return null;
-        const value = Number(part);
-        return value >= 0 && value <= 255 ? value : null;
-    });
-    if (parsed.some((part) => part === null))
-        return null;
-    return parsed;
-}
-function isLoopbackIpv4(hostname) {
-    const parts = parseIpv4(hostname);
-    return Boolean(parts && parts[0] === 127);
-}
-function isBlockedIpv4(hostname) {
-    const parts = parseIpv4(hostname);
-    if (!parts)
-        return false;
-    const [a, b] = parts;
-    return (a === 0 ||
-        (a === 100 && b >= 64 && b <= 127) ||
-        (a === 169 && b === 254) ||
-        a === 10 ||
-        (a === 192 && b === 168) ||
-        (a === 172 && b >= 16 && b <= 31) ||
-        a >= 224);
-}
-function ipv4MappedToDotted(hostname) {
-    const host = normalizeBracketedIpv6(hostname);
-    const mapped = /^::ffff:(.+)$/i.exec(host)?.[1];
-    if (!mapped)
-        return null;
-    if (parseIpv4(mapped.toLowerCase()))
-        return mapped.toLowerCase();
-    const hexParts = mapped.split(':');
-    if (hexParts.length !== 2 ||
-        !hexParts.every((part) => /^[0-9a-f]{1,4}$/i.test(part))) {
-        return null;
-    }
-    // Non-null assertions, not a runtime guard: the length/regex checks above
-    // already guarantee exactly two non-empty hex segments here.
-    const hi = hexParts[0];
-    const lo = hexParts[1];
-    const value = (Number.parseInt(hi, 16) << 16) | Number.parseInt(lo, 16);
-    return [
-        (value >>> 24) & 255,
-        (value >>> 16) & 255,
-        (value >>> 8) & 255,
-        value & 255,
-    ].join('.');
-}
-/** True for `localhost`, `::1`, `127.0.0.0/8`, and their IPv4-mapped-IPv6 forms. */
-export function isLoopbackApiHost(hostname) {
-    const host = normalizeBracketedIpv6(hostname);
-    if (host === 'localhost' || host === '::1')
-        return true;
-    if (isLoopbackIpv4(host))
-        return true;
-    const mapped = ipv4MappedToDotted(host);
-    return Boolean(mapped && isLoopbackIpv4(mapped));
-}
-/** True for RFC1918/link-local/CGNAT/multicast/unspecified/unique-local-IPv6 addresses — private network space a public caller should never be steered into. */
-export function isBlockedExternalApiHostname(hostname) {
-    const host = normalizeBracketedIpv6(hostname);
-    if (host === '::')
-        return true;
-    if (isBlockedIpv4(host))
-        return true;
-    if (/^f[cd][0-9a-f]{2}:/i.test(host))
-        return true;
-    if (/^fe[89ab][0-9a-f]:/i.test(host))
-        return true;
-    const mapped = ipv4MappedToDotted(host);
-    return Boolean(mapped && isBlockedIpv4(mapped));
-}
+import { isLoopbackApiHost, isBlockedExternalApiHostname } from '@jini-ai/platform/net';
 /**
  * Synchronous base-URL check: scheme allow-list + literal-hostname block-list.
  * Does not resolve DNS — see {@link validateBaseUrlResolved}.
@@ -144,7 +64,7 @@ export function isBlockedExternalApiHostname(hostname) {
  * is the only shape that would let the block-list inspect one string while the
  * network used another.
  */
-export function validateBaseUrl(baseUrl) {
+export function validateBaseUrl({ baseUrl }) {
     let parsed;
     try {
         // Trim BEFORE stripping trailing slashes: in `"https://x/ "` the trailing
@@ -158,7 +78,7 @@ export function validateBaseUrl(baseUrl) {
         return { error: 'Only http/https allowed' };
     }
     const hostname = parsed.hostname.toLowerCase();
-    if (!isLoopbackApiHost(hostname) && isBlockedExternalApiHostname(hostname)) {
+    if (!isLoopbackApiHost({ hostname: hostname }) && isBlockedExternalApiHostname({ hostname: hostname })) {
         return { error: 'Internal IPs blocked', forbidden: true };
     }
     return { parsed };
@@ -202,46 +122,47 @@ function looksLikeIpLiteral(hostname) {
  * unvalidated address; `pinnedFetch` never follows one regardless (`node:https`/`node:http` don't,
  * unlike `fetch`'s default), but callers still pass `redirect: 'error'` for self-documentation.
  *
- * DNS lookup failures are not treated as a security signal — the caller is
- * going to surface a connection error from `fetch` anyway, and turning a
- * transient resolver hiccup into a rejection would just confuse callers. The
+ * DNS lookup failures and empty answers fail closed: an unpinned fallback
+ * would let the transport resolve the host again without checking that answer.
+ * Earlier behavior deferred resolver hiccups to the transport; that bypassed
+ * validation if its independent lookup succeeded, so it is no longer allowed. The
  * synchronous hostname check still rejects the obvious literal-IP cases
- * before DNS is ever consulted. `lookup` defaults to `node:dns`'s promise
- * `lookup(hostname, { all: true, family: 0 })`, injectable for tests and for
- * hosts that already own a resolver.
+ * before DNS is ever consulted. `lookup` is a required injected resolver;
+ * a Node host can wrap `node:dns`'s promise
+ * `lookup(hostname, { all: true, family: 0 })` in this port's object signature.
  */
-export async function validateBaseUrlResolved(baseUrl, lookup) {
-    const sync = validateBaseUrl(baseUrl);
+export async function validateBaseUrlResolved({ baseUrl, lookup }) {
+    const sync = validateBaseUrl({ baseUrl: baseUrl });
     if (sync.error || !sync.parsed)
         return sync;
     const hostname = sync.parsed.hostname.toLowerCase();
-    if (isLoopbackApiHost(hostname))
+    if (isLoopbackApiHost({ hostname: hostname }))
         return sync;
     if (looksLikeIpLiteral(hostname))
         return sync;
     let addresses;
     try {
-        addresses = await lookup(hostname);
+        addresses = await lookup({ hostname });
     }
     catch {
-        return sync;
+        return { error: 'DNS lookup failed', forbidden: true };
     }
+    if (addresses.length === 0)
+        return { error: 'DNS lookup returned no addresses', forbidden: true };
     for (const addr of addresses) {
         const ip = String(addr.address).toLowerCase();
-        if (isLoopbackApiHost(ip))
+        if (isLoopbackApiHost({ hostname: ip }))
             continue;
-        if (isBlockedExternalApiHostname(ip)) {
+        if (isBlockedExternalApiHostname({ hostname: ip })) {
             return { error: 'Internal IPs blocked', forbidden: true };
         }
     }
     // Pin to the FIRST resolved address — the loop above already proved every address in this list
     // cleared the block-list, so this is "the address the guard actually approved", singular, ready
-    // to hand to `pinnedFetch`. An empty `addresses` array (a `lookup` that resolves to nothing
-    // without throwing) leaves `pinnedAddress` unset; a real `dns.lookup` throws ENOTFOUND rather
-    // than resolving to `[]`, so this is not a realistic gap, just a graceful fallback to the
-    // pre-pinning pass-through behavior.
-    const pinnedAddress = addresses[0];
-    return pinnedAddress ? { ...sync, pinnedAddress } : sync;
+    // to hand to `pinnedFetch`. A real `dns.lookup` throws ENOTFOUND rather than resolving to `[]`;
+    // injected resolvers can do either, and both fail closed above instead of reviving the earlier
+    // pre-pinning pass-through behavior. The nonempty check guarantees the first address exists.
+    return { ...sync, pinnedAddress: addresses[0] };
 }
 /**
  * Idle-socket safety net, applied to every `pinnedFetch` request regardless of `init.signal`.
@@ -280,7 +201,7 @@ const PINNED_FETCH_IDLE_TIMEOUT_MS = 300_000;
  * (`lookup` option simply omitted). That is intentional, not a gap: an IP literal has nothing left
  * to re-resolve, and loopback literals are the documented carve-out, outside this threat model.
  */
-export async function pinnedFetch(url, init, pinnedAddress) {
+export async function pinnedFetch({ url, init, pinnedAddress }) {
     const parsed = new URL(url);
     const isHttps = parsed.protocol === 'https:';
     const { request: httpsRequest } = await import('node:https');
@@ -380,32 +301,8 @@ export async function pinnedFetch(url, init, pinnedAddress) {
         req.end(init.body);
     });
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-/**
- * Redacts bearer tokens, `x-api-key`/`api-key`/`x-goog-api-key` headers,
- * `?key=` query values, and any exact secret strings supplied via
- * `exactSecrets` out of free-form text — for logging or surfacing an
- * upstream error message to a caller without leaking credentials embedded in
- * it (some providers echo the key back in a 401 body).
- */
-export function redactSecrets(text, exactSecrets = []) {
-    if (typeof text !== 'string' || text.length === 0)
-        return '';
-    let redacted = text
-        .replace(/Bearer\s+[A-Za-z0-9_\-.+/=]+/gi, 'Bearer [REDACTED]')
-        .replace(/(x-api-key|api-key|x-goog-api-key)\s*[:=]\s*[^\s,;"']+/gi, '$1: [REDACTED]')
-        .replace(/([?&]key=)[^&\s]+/gi, '$1[REDACTED]');
-    for (const secret of exactSecrets) {
-        if (typeof secret !== 'string' || secret.length === 0)
-            continue;
-        redacted = redacted.replace(new RegExp(escapeRegExp(secret), 'g'), '[REDACTED]');
-    }
-    return redacted;
-}
 /** Default DNS lookup for {@link validateBaseUrlResolved} — `node:dns/promises`' `lookup(hostname, { all: true, family: 0 })`. */
-export async function defaultDnsLookup(hostname) {
+export async function defaultDnsLookup({ hostname }) {
     const { promises: dnsPromises } = await import('node:dns');
     const result = await dnsPromises.lookup(hostname, { all: true, family: 0 });
     return result.map(({ address, family }) => ({ address, family }));

package/dist/providers/connection-test.d.ts

@@ -58,5 +58,5 @@ export interface ConnectionTestResponse {
  * @complexity O(1) — one bounded-size HTTP request with a hard timeout.
  * @overallScore 100
  */
-export declare function testProviderConnection(input: ProviderConnectionTestInput): Promise<ConnectionTestResponse>;
+export declare function testProviderConnection(requiredArgs: Pick<ProviderConnectionTestInput, "protocol" | "baseUrl" | "apiKey" | "model">, optionalArgs?: Omit<ProviderConnectionTestInput, "protocol" | "baseUrl" | "apiKey" | "model">): Promise<ConnectionTestResponse>;
 //# sourceMappingURL=connection-test.d.ts.map

package/dist/providers/connection-test.js

@@ -1,23 +1,5 @@
-/**
- * @module providers/connection-test
- *
- * BYOK connection smoke test — sends a tiny "Reply with only: ok" completion
- * request to the configured provider endpoint and classifies the outcome, so
- * a settings UI can tell the operator "this endpoint works" without spending
- * a real chat turn to find out. Ported from OD's `apps/daemon/src/connectionTest.ts`
- * (`testProviderConnection` + `buildProviderCall` + `inspectProviderCompletion`),
- * narrowed to the four protocols `@jini-ai/ui`'s execution-tab canary exposes
- * (`anthropic` / `openai` / `azure` / `google`) — the origin also covers
- * `ollama` / `senseaudio` / `aihubmix` / `bedrock`, which stay out of scope
- * here the same way `model-catalog.ts` keeps Bedrock to a static seed and
- * Azure to an explicit "unsupported" response for model discovery.
- *
- * Shares this package's own vendored SSRF guard / secret redaction
- * (`connection-guard.ts`) and vendored connectivity types (`types.ts`) —
- * no OD workspace-package imports, matching every other file in this
- * directory.
- */
-import { defaultDnsLookup, redactSecrets, validateBaseUrlResolved } from './connection-guard.js';
+import { redactSecrets } from '@jini-ai/core';
+import { defaultDnsLookup, validateBaseUrlResolved } from './connection-guard.js';
 import { googleGenerateContentUrl } from './google.js';
 import { buildOpenAIChatTokenParam, buildLegacyMaxTokensParam, buildMaxCompletionTokensParam } from './token-params.js';
 const SMOKE_PROMPT = 'Reply with only: ok';
@@ -185,7 +167,7 @@ function buildProviderCall(input) {
                 },
                 body: {
                     model,
-                    ...buildOpenAIChatTokenParam(model, CONNECTION_TEST_MAX_TOKENS),
+                    ...buildOpenAIChatTokenParam({ model: model, maxTokens: CONNECTION_TEST_MAX_TOKENS }),
                     messages: [{ role: 'user', content: SMOKE_PROMPT }],
                     stream: false,
                 },
@@ -206,7 +188,7 @@ function buildProviderCall(input) {
                 headers: { 'content-type': 'application/json', 'api-key': apiKey },
                 body: {
                     ...(usesVersionedOpenAIPath ? { model } : {}),
-                    ...buildLegacyMaxTokensParam(CONNECTION_TEST_MAX_TOKENS),
+                    ...buildLegacyMaxTokensParam({ maxTokens: CONNECTION_TEST_MAX_TOKENS }),
                     messages: [{ role: 'user', content: SMOKE_PROMPT }],
                     stream: false,
                 },
@@ -216,7 +198,7 @@ function buildProviderCall(input) {
         case 'google': {
             const effectiveBaseUrl = baseUrl.trim() || 'https://generativelanguage.googleapis.com';
             return {
-                url: googleGenerateContentUrl(effectiveBaseUrl, model),
+                url: googleGenerateContentUrl({ baseUrl: effectiveBaseUrl, model: model }),
                 headers: { 'content-type': 'application/json', 'x-goog-api-key': apiKey },
                 body: {
                     contents: [{ role: 'user', parts: [{ text: SMOKE_PROMPT }] }],
@@ -247,7 +229,7 @@ function buildProviderCall(input) {
 // rejected `max_tokens` param; this smoke test keeps the simpler single-shot
 // legacy param (a connection test failing on a param-name mismatch on a
 // reasoning-tier Azure deployment is a known, narrow gap — see this
-// package's `source-map.md`) rather than porting OD's full retry-on-400 loop.
+// package's `archived provenance ledger`) rather than porting OD's full retry-on-400 loop.
 void buildMaxCompletionTokensParam;
 /**
  * Probes a BYOK provider endpoint with the supplied credentials by sending a
@@ -262,7 +244,8 @@ void buildMaxCompletionTokensParam;
  * @complexity O(1) — one bounded-size HTTP request with a hard timeout.
  * @overallScore 100
  */
-export async function testProviderConnection(input) {
+export async function testProviderConnection(requiredArgs, optionalArgs = {}) {
+    const input = { ...optionalArgs, ...requiredArgs };
     const start = Date.now();
     const model = input.model.trim();
     if (!isSupportedProtocol(input.protocol)) {
@@ -290,7 +273,7 @@ export async function testProviderConnection(input) {
             detail: 'No API key saved. Save one to test the connection.',
         };
     }
-    const validated = await validateBaseUrlResolved(input.baseUrl, input.dnsLookup ?? defaultDnsLookup);
+    const validated = await validateBaseUrlResolved({ baseUrl: input.baseUrl, lookup: input.dnsLookup ?? defaultDnsLookup });
     if (validated.error || !validated.parsed) {
         return {
             ok: false,
@@ -310,7 +293,7 @@ export async function testProviderConnection(input) {
             kind: 'unknown',
             latencyMs: Date.now() - start,
             model,
-            detail: redactSecrets(err instanceof Error ? err.message : String(err), [input.apiKey]),
+            detail: redactSecrets({ input: err instanceof Error ? err.message : String(err) }, { exactSecrets: [input.apiKey] }),
         };
     }
     const controller = new AbortController();
@@ -342,7 +325,7 @@ export async function testProviderConnection(input) {
             // paths below, both of which treat an empty `data` as "no usable text".
         }
         if (!response.ok) {
-            const redactedDetail = redactSecrets(extractProviderErrorDetail(data, rawText).slice(0, 240), [input.apiKey]);
+            const redactedDetail = redactSecrets({ input: extractProviderErrorDetail(data, rawText).slice(0, 240) }, { exactSecrets: [input.apiKey] });
             result = {
                 ok: false,
                 kind: statusToKind(response.status, redactedDetail),
@@ -366,7 +349,7 @@ export async function testProviderConnection(input) {
                 // header puts the operator's key in `detail` verbatim. Two independent
                 // audits reproduced that, each from a different call boundary; the
                 // redaction was simply missing on this one branch.
-                const sample = truncateSample(redactSecrets(text, [input.apiKey]));
+                const sample = truncateSample(redactSecrets({ input: text }, { exactSecrets: [input.apiKey] }));
                 // Naming the stop reason turns an unactionable "it returned nothing" into a diagnosis:
                 // `MAX_TOKENS` means the smoke budget was too small (usually a thinking model), a safety or
                 // content-filter reason means the probe was blocked, not that the endpoint is broken.
@@ -392,7 +375,7 @@ export async function testProviderConnection(input) {
             kind: networkErrorToKind(err),
             latencyMs: Date.now() - start,
             model,
-            detail: redactSecrets(err instanceof Error ? err.message : String(err), [input.apiKey]),
+            detail: redactSecrets({ input: err instanceof Error ? err.message : String(err) }, { exactSecrets: [input.apiKey] }),
         };
     }
     finally {

package/dist/providers/elevenlabs.d.ts

@@ -10,7 +10,9 @@ export interface ElevenLabsCredentials {
     baseUrl?: string;
 }
 /** Host-supplied credential lookup — replaces OD's product-owned settings-store reader. */
-export type ElevenLabsCredentialResolver = (workspaceKey: string) => Promise<ElevenLabsCredentials>;
+export type ElevenLabsCredentialResolver = (requiredArgs: {
+    workspaceKey: string;
+}) => Promise<ElevenLabsCredentials>;
 /** Thrown when {@link ElevenLabsCredentialResolver} resolves no API key. */
 export declare class ElevenLabsCredentialMissingError extends Error {
     constructor();
@@ -21,7 +23,10 @@ export declare class ElevenLabsCredentialMissingError extends Error {
  * result for {@link ELEVENLABS_VOICE_CACHE_TTL_MS}. Throws
  * {@link ElevenLabsCredentialMissingError} when no API key is configured.
  */
-export declare function listElevenLabsVoiceOptions(workspaceKey: string, resolveCredentials: ElevenLabsCredentialResolver, options?: {
+export declare function listElevenLabsVoiceOptions({ workspaceKey, resolveCredentials }: {
+    workspaceKey: string;
+    resolveCredentials: ElevenLabsCredentialResolver;
+}, options?: {
     limit?: number;
     requestInit?: Pick<RequestInit, 'dispatcher'>;
 }): Promise<ElevenLabsVoiceOption[]>;

package/dist/providers/elevenlabs.js

@@ -9,14 +9,14 @@
  * De-branded: the origin resolved the API key/base URL via OD's own
  * `resolveProviderConfig` (`../media/config.js`, a product-owned
  * settings-store reader entirely out of this package's scope) and threw a
- * hardcoded product-prefixed env-var hint (see `source-map.md` for the
+ * hardcoded product-prefixed env-var hint (see `archived provenance ledger` for the
  * exact original string). Both are replaced by an
  * injected {@link ElevenLabsCredentialResolver} port — a host supplies its
  * own settings-store/env lookup; this package only knows how to call the
  * ElevenLabs wire API once it has a key.
  */
 import { createHash } from 'node:crypto';
-import { FETCH_TIMEOUT_MS, fetchWithTimeout } from '@jini-ai/platform';
+import { FETCH_TIMEOUT_MS, fetchWithTimeout } from '@jini-ai/platform/fetch-with-timeout';
 const ELEVENLABS_DEFAULT_BASE_URL = 'https://api.elevenlabs.io';
 const ELEVENLABS_DEFAULT_VOICE_LIMIT = 100;
 const ELEVENLABS_MAX_VOICE_LIMIT = 100;
@@ -93,8 +93,8 @@ function cloneVoiceOptions(voices) {
  * result for {@link ELEVENLABS_VOICE_CACHE_TTL_MS}. Throws
  * {@link ElevenLabsCredentialMissingError} when no API key is configured.
  */
-export async function listElevenLabsVoiceOptions(workspaceKey, resolveCredentials, options = {}) {
-    const credentials = await resolveCredentials(workspaceKey);
+export async function listElevenLabsVoiceOptions({ workspaceKey, resolveCredentials }, options = {}) {
+    const credentials = await resolveCredentials({ workspaceKey });
     if (!credentials.apiKey) {
         throw new ElevenLabsCredentialMissingError();
     }