@jini-ai/agent-runtime 0.3.9 → 0.4.0

package/dist/providers/google.js

@@ -6,7 +6,7 @@
  * verbatim.
  */
 /** Strips any trailing `/v1`/`/v1beta` API-version segment and trailing slashes from a configured base URL. */
-export function googleGenerativeLanguageBaseUrl(baseUrl) {
+export function googleGenerativeLanguageBaseUrl({ baseUrl }) {
     const url = new URL(baseUrl);
     url.search = '';
     url.hash = '';
@@ -17,25 +17,25 @@ export function googleGenerativeLanguageBaseUrl(baseUrl) {
     return url.toString().replace(/\/+$/, '');
 }
 /** Strips the `models/` prefix Google's API sometimes includes in a model id. */
-export function normalizeGoogleModelId(model) {
+export function normalizeGoogleModelId({ model }) {
     const trimmed = model.trim();
     return trimmed.startsWith('models/') ? trimmed.slice('models/'.length) : trimmed;
 }
 /** URL-encodes a normalized model id for use as a path segment. */
-export function googleModelPathSegment(model) {
-    return encodeURIComponent(normalizeGoogleModelId(model));
+export function googleModelPathSegment({ model }) {
+    return encodeURIComponent(normalizeGoogleModelId({ model: model }));
 }
 /** Builds the non-streaming `generateContent` endpoint URL for a model. */
-export function googleGenerateContentUrl(baseUrl, model) {
-    return `${googleGenerativeLanguageBaseUrl(baseUrl)}/v1beta/models/${googleModelPathSegment(model)}:generateContent`;
+export function googleGenerateContentUrl({ baseUrl, model }) {
+    return `${googleGenerativeLanguageBaseUrl({ baseUrl: baseUrl })}/v1beta/models/${googleModelPathSegment({ model: model })}:generateContent`;
 }
 /** Builds the SSE-streaming `streamGenerateContent` endpoint URL for a model. */
-export function googleStreamGenerateContentUrl(baseUrl, model) {
-    return `${googleGenerativeLanguageBaseUrl(baseUrl)}/v1beta/models/${googleModelPathSegment(model)}:streamGenerateContent?alt=sse`;
+export function googleStreamGenerateContentUrl({ baseUrl, model }) {
+    return `${googleGenerativeLanguageBaseUrl({ baseUrl: baseUrl })}/v1beta/models/${googleModelPathSegment({ model: model })}:streamGenerateContent?alt=sse`;
 }
 /** Builds the model-catalog listing endpoint URL, with the API key attached as a query param. */
-export function googleProviderModelsUrl(baseUrl, apiKey) {
-    const url = new URL(`${googleGenerativeLanguageBaseUrl(baseUrl)}/v1beta/models`);
+export function googleProviderModelsUrl({ baseUrl, apiKey }) {
+    const url = new URL(`${googleGenerativeLanguageBaseUrl({ baseUrl: baseUrl })}/v1beta/models`);
     url.searchParams.set('key', apiKey);
     return url.toString();
 }

package/dist/providers/index.d.ts

@@ -2,7 +2,7 @@
  * @module providers
  *
  * Generic LLM-provider integration material ported from OD's
- * `apps/daemon/src/integrations/` (13 files). See `source-map.md` for the
+ * `apps/daemon/src/integrations/` (13 files). See `archived provenance ledger` for the
  * full per-file provenance and the MIXED-classification split: OD's own
  * AMR/vela provider adapter (`vela*.ts`, 4 files) is a specific provider's
  * own daemon-coupled implementation, not generic material, and was left
@@ -15,7 +15,7 @@
  * `chat.ts` (this task did not have direct access to that file for the
  * 2026-07-21 pass; the 2026-07-22 pass did read the real OD source for
  * Azure's api-version default — see `azure-chat.ts`'s header) — see each
- * module's own header and `source-map.md`'s dated sections for the full
+ * module's own header and `archived provenance ledger`'s dated sections for the full
  * rationale.
  */
 export * from './types.js';
@@ -37,4 +37,5 @@ export * from './oauth-provider.js';
 export * from './oauth-callback-server.js';
 export * from './oauth-tokens.js';
 export * from './oauth-credentials.js';
+export * from './tool-turn.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/index.js

@@ -2,7 +2,7 @@
  * @module providers
  *
  * Generic LLM-provider integration material ported from OD's
- * `apps/daemon/src/integrations/` (13 files). See `source-map.md` for the
+ * `apps/daemon/src/integrations/` (13 files). See `archived provenance ledger` for the
  * full per-file provenance and the MIXED-classification split: OD's own
  * AMR/vela provider adapter (`vela*.ts`, 4 files) is a specific provider's
  * own daemon-coupled implementation, not generic material, and was left
@@ -15,7 +15,7 @@
  * `chat.ts` (this task did not have direct access to that file for the
  * 2026-07-21 pass; the 2026-07-22 pass did read the real OD source for
  * Azure's api-version default — see `azure-chat.ts`'s header) — see each
- * module's own header and `source-map.md`'s dated sections for the full
+ * module's own header and `archived provenance ledger`'s dated sections for the full
  * rationale.
  */
 export * from './types.js';
@@ -37,4 +37,5 @@ export * from './oauth-provider.js';
 export * from './oauth-callback-server.js';
 export * from './oauth-tokens.js';
 export * from './oauth-credentials.js';
+export * from './tool-turn.js';
 //# sourceMappingURL=index.js.map

package/dist/providers/model-catalog.d.ts

@@ -28,5 +28,5 @@ export type ProviderModelsInput = ProviderModelsRequest & {
  * "unsupported" response for Azure), and normalizes every provider's
  * response envelope into a de-duplicated, alphabetized `{ id, label }[]`.
  */
-export declare function listProviderModels(input: ProviderModelsInput): Promise<ProviderModelsResponse>;
+export declare function listProviderModels(requiredArgs: Pick<ProviderModelsInput, "protocol" | "baseUrl" | "apiKey">, optionalArgs?: Omit<ProviderModelsInput, "protocol" | "baseUrl" | "apiKey">): Promise<ProviderModelsResponse>;
 //# sourceMappingURL=model-catalog.d.ts.map

package/dist/providers/model-catalog.js

@@ -1,19 +1,5 @@
-/**
- * @module providers/model-catalog
- *
- * Live model-catalog discovery for BYOK providers (OpenAI-compatible,
- * Anthropic, Google, AIHubMix, SenseAudio, plus static seeds for Bedrock and
- * an explicit "unsupported" response for Azure). Ported from OD's
- * `integrations/provider-models.ts` (`listProviderModels`) with its
- * upstream contracts-package type imports repointed at this package's own
- * vendored `types.ts`, and its `../connectionTest.js` SSRF-guard /
- * secret-redaction imports repointed at this package's own vendored
- * `connection-guard.ts` (see that module's doc comment for what was and
- * wasn't pulled from the 2,600-line origin file). Logic is otherwise
- * unchanged — product-neutral as found (a bare BYOK-protocol model lister,
- * no OD-branded strings).
- */
-import { defaultDnsLookup, redactSecrets, validateBaseUrlResolved } from './connection-guard.js';
+import { redactSecrets } from '@jini-ai/core';
+import { defaultDnsLookup, validateBaseUrlResolved } from './connection-guard.js';
 import { aihubmixCatalogUrl, aihubmixHeaders, parseAIHubMixCatalog } from './aihubmix.js';
 import { googleProviderModelsUrl, normalizeGoogleModelId } from './google.js';
 const PROVIDER_MODELS_TIMEOUT_MS = 12_000;
@@ -164,11 +150,11 @@ function extractAnthropicModels(data) {
 }
 function googleModelId(rawName, rawBaseModelId) {
     if (typeof rawBaseModelId === 'string' && rawBaseModelId.trim()) {
-        return normalizeGoogleModelId(rawBaseModelId);
+        return normalizeGoogleModelId({ model: rawBaseModelId });
     }
     if (typeof rawName !== 'string')
         return '';
-    return normalizeGoogleModelId(rawName);
+    return normalizeGoogleModelId({ model: rawName });
 }
 function supportsGoogleGenerateContent(item) {
     const methods = item
@@ -201,7 +187,7 @@ function providerModelsUrl(protocol, baseUrl, apiKey) {
     if (protocol === 'aihubmix') {
         // AIHubMix exposes its chat catalogue on a dedicated endpoint
         // (GET /api/v1/models?type=llm), not the OpenAI /v1/models route.
-        return aihubmixCatalogUrl(baseUrl, 'llm');
+        return aihubmixCatalogUrl({ baseUrl: baseUrl, type: 'llm' });
     }
     if (protocol === 'openai' || protocol === 'senseaudio') {
         return appendVersionedApiPath(baseUrl, '/models');
@@ -212,7 +198,7 @@ function providerModelsUrl(protocol, baseUrl, apiKey) {
         return url.toString();
     }
     if (protocol === 'google') {
-        return googleProviderModelsUrl(baseUrl, apiKey);
+        return googleProviderModelsUrl({ baseUrl: baseUrl, apiKey: apiKey });
     }
     throw new Error(`Unsupported protocol: ${protocol}`);
 }
@@ -224,7 +210,7 @@ function providerModelsHeaders(protocol, apiKey) {
         // The catalogue is public — only attach Bearer auth (+ APP-Code) when the
         // caller actually supplied a key. An empty `Bearer ` would be rejected by
         // some gateways, so send no headers when the key is blank.
-        return apiKey.trim() ? aihubmixHeaders(apiKey) : {};
+        return apiKey.trim() ? aihubmixHeaders({ apiKey: apiKey }) : {};
     }
     if (protocol === 'anthropic') {
         return {
@@ -242,7 +228,7 @@ function extractModels(protocol, data) {
     // (e.g. gpt-image-2 -> "image_generation,llm") would otherwise leak in. Those
     // belong to the dedicated image/video/audio pickers.
     if (protocol === 'aihubmix')
-        return parseAIHubMixCatalog(data, { chatOnly: true });
+        return parseAIHubMixCatalog({ data: data }, { chatOnly: true });
     if (protocol === 'openai' || protocol === 'senseaudio')
         return extractOpenAiModels(data);
     if (protocol === 'anthropic')
@@ -256,7 +242,8 @@ function extractModels(protocol, data) {
  * "unsupported" response for Azure), and normalizes every provider's
  * response envelope into a de-duplicated, alphabetized `{ id, label }[]`.
  */
-export async function listProviderModels(input) {
+export async function listProviderModels(requiredArgs, optionalArgs = {}) {
+    const input = { ...optionalArgs, ...requiredArgs };
     const start = Date.now();
     if (input.protocol === 'azure') {
         return {
@@ -266,7 +253,7 @@ export async function listProviderModels(input) {
             detail: 'Azure OpenAI deployment discovery is not supported from the inference endpoint.',
         };
     }
-    const validated = await validateBaseUrlResolved(input.baseUrl, input.dnsLookup ?? defaultDnsLookup);
+    const validated = await validateBaseUrlResolved({ baseUrl: input.baseUrl, lookup: input.dnsLookup ?? defaultDnsLookup });
     if (validated.error || !validated.parsed) {
         return {
             ok: false,
@@ -362,7 +349,7 @@ export async function listProviderModels(input) {
                 kind: statusToKind(response.status),
                 latencyMs,
                 status: response.status,
-                detail: redactSecrets(detail, [input.apiKey]),
+                detail: redactSecrets({ input: detail }, { exactSecrets: [input.apiKey] }),
             };
         }
         if (parseError) {
@@ -371,7 +358,7 @@ export async function listProviderModels(input) {
                 kind: 'unknown',
                 latencyMs,
                 status: response.status,
-                detail: redactSecrets(parseError, [input.apiKey]),
+                detail: redactSecrets({ input: parseError }, { exactSecrets: [input.apiKey] }),
             };
         }
         // Safe: `url` above only resolves for the five protocols
@@ -403,7 +390,7 @@ export async function listProviderModels(input) {
             ok: false,
             kind,
             latencyMs,
-            detail: redactSecrets(message, [input.apiKey]),
+            detail: redactSecrets({ input: message }, { exactSecrets: [input.apiKey] }),
         };
     }
     finally {

package/dist/providers/oauth-callback-server.d.ts

@@ -31,5 +31,5 @@ export interface OAuthCallbackListener {
  * via `onCallback`. The listener self-closes after the first matching
  * callback OR after `timeoutMs` (default 30 min), whichever comes first.
  */
-export declare function startOAuthCallbackListener(input: StartOAuthCallbackListenerInput): Promise<OAuthCallbackListener>;
+export declare function startOAuthCallbackListener(requiredArgs: Pick<StartOAuthCallbackListenerInput, "host" | "port" | "path" | "expectedState" | "onCallback">, optionalArgs?: Omit<StartOAuthCallbackListenerInput, "host" | "port" | "path" | "expectedState" | "onCallback">): Promise<OAuthCallbackListener>;
 //# sourceMappingURL=oauth-callback-server.d.ts.map

package/dist/providers/oauth-callback-server.js

@@ -9,7 +9,7 @@
  * Ported from OD's `integrations/xai-oauth-server.ts`, de-branded: the
  * origin hardcoded xAI's fixed callback port/host/path as module constants
  * and had the origin product's own name baked into the result-page HTML
- * (see `source-map.md` for the exact original strings). Both are now
+ * (see `archived provenance ledger` for the exact original strings). Both are now
  * caller-supplied — `host`/`port`/
  * `path` are required input fields instead of defaulted constants (a
  * provider whose OAuth client_id is locked to a specific redirect URI, like
@@ -27,7 +27,8 @@ const DEFAULT_TIMEOUT_MS = 30 * 60 * 1000; // 30 min
  * via `onCallback`. The listener self-closes after the first matching
  * callback OR after `timeoutMs` (default 30 min), whichever comes first.
  */
-export async function startOAuthCallbackListener(input) {
+export async function startOAuthCallbackListener(requiredArgs, optionalArgs = {}) {
+    const input = { ...optionalArgs, ...requiredArgs };
     const { host, port, path: callbackPath } = input;
     const timeoutMs = input.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     let consumed = false;

package/dist/providers/oauth-credentials.d.ts

@@ -25,5 +25,11 @@ export interface ResolvedOAuthCredential {
  * the refresh call fails. Callers should treat null as "no OAuth available,
  * fall back to API key / re-login UI".
  */
-export declare function resolveOAuthBearer(config: OAuthPkceProviderConfig, tokenFileName: string, dataDir: string, fetchImpl?: typeof fetch): Promise<ResolvedOAuthCredential | null>;
+export declare function resolveOAuthBearer({ config, tokenFileName, dataDir }: {
+    config: OAuthPkceProviderConfig;
+    tokenFileName: string;
+    dataDir: string;
+}, { fetchImpl }?: {
+    fetchImpl?: typeof fetch;
+}): Promise<ResolvedOAuthCredential | null>;
 //# sourceMappingURL=oauth-credentials.d.ts.map

package/dist/providers/oauth-credentials.js

@@ -21,11 +21,11 @@ import { getStoredOAuthToken, isOAuthTokenExpired, setStoredOAuthToken, } from '
  * the refresh call fails. Callers should treat null as "no OAuth available,
  * fall back to API key / re-login UI".
  */
-export async function resolveOAuthBearer(config, tokenFileName, dataDir, fetchImpl) {
-    const stored = await getStoredOAuthToken(dataDir, tokenFileName);
+export async function resolveOAuthBearer({ config, tokenFileName, dataDir }, { fetchImpl } = {}) {
+    const stored = await getStoredOAuthToken({ dataDir: dataDir, fileName: tokenFileName });
     if (!stored)
         return null;
-    if (!isOAuthTokenExpired(stored)) {
+    if (!isOAuthTokenExpired({ token: stored })) {
         return { accessToken: stored.accessToken, source: 'stored' };
     }
     // Within skew window — try a refresh. If there's no refresh_token (some
@@ -34,7 +34,7 @@ export async function resolveOAuthBearer(config, tokenFileName, dataDir, fetchIm
     if (!stored.refreshToken)
         return null;
     try {
-        const fresh = await refreshOAuthPkceToken({
+        const fresh = await (({ config, refreshToken, ...optionalArgs }) => refreshOAuthPkceToken({ config, refreshToken }, optionalArgs))({
             config,
             refreshToken: stored.refreshToken,
             ...(fetchImpl ? { fetchImpl } : {}),
@@ -57,7 +57,7 @@ export async function resolveOAuthBearer(config, tokenFileName, dataDir, fetchIm
         }
         if (fresh.scope)
             next.scope = fresh.scope;
-        await setStoredOAuthToken(dataDir, tokenFileName, next);
+        await setStoredOAuthToken({ dataDir: dataDir, fileName: tokenFileName, token: next });
         return { accessToken: next.accessToken, source: 'refreshed' };
     }
     catch {

package/dist/providers/oauth-provider.d.ts

@@ -61,7 +61,7 @@ export interface CompleteOAuthPkceInput {
  * exchanges `code` for tokens. Throws if `state` is unknown, expired,
  * already consumed, or was issued for a different provider.
  */
-export declare function completeOAuthPkce(input: CompleteOAuthPkceInput): Promise<OAuthTokenResponse>;
+export declare function completeOAuthPkce(requiredArgs: Pick<CompleteOAuthPkceInput, "config" | "pending" | "state" | "code">, optionalArgs?: Omit<CompleteOAuthPkceInput, "config" | "pending" | "state" | "code">): Promise<OAuthTokenResponse>;
 export interface RefreshOAuthPkceInput {
     config: OAuthPkceProviderConfig;
     refreshToken: string;
@@ -72,7 +72,7 @@ export interface RefreshOAuthPkceInput {
  * client_id that originally received it (RFC 6749 §6); since the same fixed
  * client_id is always used, it doesn't need to be persisted per-token.
  */
-export declare function refreshOAuthPkceToken(input: RefreshOAuthPkceInput): Promise<OAuthTokenResponse>;
+export declare function refreshOAuthPkceToken(requiredArgs: Pick<RefreshOAuthPkceInput, "config" | "refreshToken">, optionalArgs?: Omit<RefreshOAuthPkceInput, "config" | "refreshToken">): Promise<OAuthTokenResponse>;
 /** Stable provider id used to key an xAI token in any per-provider cache. */
 export declare const XAI_OAUTH_PROVIDER_ID = "xai";
 export declare const XAI_OAUTH_REDIRECT_HOST = "127.0.0.1";

package/dist/providers/oauth-provider.js

@@ -39,16 +39,9 @@ function authServerMetadata(config) {
 export function beginOAuthPkce(input) {
     const { config, pending, redirectUri } = input;
     const codeVerifier = generateCodeVerifier();
-    const codeChallenge = deriveCodeChallenge(codeVerifier);
+    const codeChallenge = deriveCodeChallenge({ verifier: codeVerifier });
     const state = generateState();
-    const authorizeUrl = buildAuthorizeUrl({
-        authServer: authServerMetadata(config),
-        clientId: config.clientId,
-        redirectUri,
-        state,
-        codeChallenge,
-        scope: config.scope,
-    });
+    const authorizeUrl = buildAuthorizeUrl({ authServer: authServerMetadata(config), clientId: config.clientId, redirectUri, state, codeChallenge }, { scope: config.scope });
     const pendingState = {
         serverId: config.providerId,
         authServerIssuer: config.issuer,
@@ -59,7 +52,7 @@ export function beginOAuthPkce(input) {
         scope: config.scope,
         createdAt: Date.now(),
     };
-    pending.put(state, pendingState);
+    pending.put({ state: state, value: pendingState });
     return { authorizeUrl, state };
 }
 /**
@@ -68,33 +61,35 @@ export function beginOAuthPkce(input) {
  * exchanges `code` for tokens. Throws if `state` is unknown, expired,
  * already consumed, or was issued for a different provider.
  */
-export async function completeOAuthPkce(input) {
-    const consumed = input.pending.consume(input.state);
+export async function completeOAuthPkce(requiredArgs, optionalArgs = {}) {
+    const input = { ...optionalArgs, ...requiredArgs };
+    const consumed = input.pending.consume({ state: input.state });
     if (!consumed) {
         throw new Error(`${input.config.providerId} OAuth state not found or expired`);
     }
     if (consumed.serverId !== input.config.providerId) {
         throw new Error(`${input.config.providerId} OAuth state mismatch: expected serverId=${input.config.providerId}, got ${consumed.serverId}`);
     }
-    return exchangeCodeForToken({
-        tokenEndpoint: consumed.tokenEndpoint,
-        clientId: consumed.clientId,
-        redirectUri: consumed.redirectUri,
-        code: input.code,
-        codeVerifier: consumed.codeVerifier,
-    }, input.fetchImpl ?? fetch);
+    return exchangeCodeForToken({ input: {
+            tokenEndpoint: consumed.tokenEndpoint,
+            clientId: consumed.clientId,
+            redirectUri: consumed.redirectUri,
+            code: input.code,
+            codeVerifier: consumed.codeVerifier,
+        } }, { fetchImpl: input.fetchImpl ?? fetch });
 }
 /**
  * Refreshes an existing access token. The refresh_token is bound to the
  * client_id that originally received it (RFC 6749 §6); since the same fixed
  * client_id is always used, it doesn't need to be persisted per-token.
  */
-export async function refreshOAuthPkceToken(input) {
-    return refreshAccessToken({
-        tokenEndpoint: input.config.tokenEndpoint,
-        clientId: input.config.clientId,
-        refreshToken: input.refreshToken,
-    }, input.fetchImpl ?? fetch);
+export async function refreshOAuthPkceToken(requiredArgs, optionalArgs = {}) {
+    const input = { ...optionalArgs, ...requiredArgs };
+    return refreshAccessToken({ input: {
+            tokenEndpoint: input.config.tokenEndpoint,
+            clientId: input.config.clientId,
+            refreshToken: input.refreshToken,
+        } }, { fetchImpl: input.fetchImpl ?? fetch });
 }
 // ---------------------------------------------------------------------------
 // Concrete preset: the one OAuth+PKCE provider the origin actually shipped.

package/dist/providers/oauth-tokens.d.ts

@@ -22,14 +22,34 @@ export interface OAuthTokenFile {
     token?: StoredOAuthToken;
 }
 /** Coerces a freeform JSON blob into the typed shape, dropping anything that doesn't deserialize cleanly. Used both at read time and as a defensive pass when third-party tooling has hand-edited the file. */
-export declare function sanitizeOAuthTokenFile(raw: unknown): OAuthTokenFile;
-export declare function readOAuthTokenFile(dataDir: string, fileName: string): Promise<OAuthTokenFile>;
+export declare function sanitizeOAuthTokenFile({ raw }: {
+    raw: unknown;
+}): OAuthTokenFile;
+export declare function readOAuthTokenFile({ dataDir, fileName }: {
+    dataDir: string;
+    fileName: string;
+}): Promise<OAuthTokenFile>;
 /** Gets the current stored OAuth token for `fileName`, or null when none is stored (or the persisted entry is malformed). */
-export declare function getStoredOAuthToken(dataDir: string, fileName: string): Promise<StoredOAuthToken | null>;
+export declare function getStoredOAuthToken({ dataDir, fileName }: {
+    dataDir: string;
+    fileName: string;
+}): Promise<StoredOAuthToken | null>;
 /** Atomically replaces the stored OAuth token for `fileName`. */
-export declare function setStoredOAuthToken(dataDir: string, fileName: string, token: StoredOAuthToken): Promise<void>;
+export declare function setStoredOAuthToken({ dataDir, fileName, token }: {
+    dataDir: string;
+    fileName: string;
+    token: StoredOAuthToken;
+}): Promise<void>;
 /** Atomically deletes the stored OAuth token for `fileName`. No-op when absent. */
-export declare function clearStoredOAuthToken(dataDir: string, fileName: string): Promise<void>;
+export declare function clearStoredOAuthToken({ dataDir, fileName }: {
+    dataDir: string;
+    fileName: string;
+}): Promise<void>;
 /** True when the stored token is past its `expiresAt` (or within `skew` milliseconds of expiring). Returns false when no `expiresAt` is recorded — some providers issue non-expiring tokens. */
-export declare function isOAuthTokenExpired(token: StoredOAuthToken, now?: number, skew?: number): boolean;
+export declare function isOAuthTokenExpired({ token }: {
+    token: StoredOAuthToken;
+}, { now, skew }?: {
+    now?: number;
+    skew?: number;
+}): boolean;
 //# sourceMappingURL=oauth-tokens.d.ts.map

package/dist/providers/oauth-tokens.js

@@ -22,7 +22,7 @@ function isPlainObject(v) {
     return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
 }
 /** Coerces a freeform JSON blob into the typed shape, dropping anything that doesn't deserialize cleanly. Used both at read time and as a defensive pass when third-party tooling has hand-edited the file. */
-export function sanitizeOAuthTokenFile(raw) {
+export function sanitizeOAuthTokenFile({ raw }) {
     if (!isPlainObject(raw))
         return {};
     const tok = sanitizeToken(raw.token);
@@ -58,10 +58,10 @@ function sanitizeToken(raw) {
         out.expiresAt = expiresAt;
     return out;
 }
-export async function readOAuthTokenFile(dataDir, fileName) {
+export async function readOAuthTokenFile({ dataDir, fileName }) {
     try {
         const raw = await readFile(tokenFilePath(dataDir, fileName), 'utf8');
-        return sanitizeOAuthTokenFile(JSON.parse(raw));
+        return sanitizeOAuthTokenFile({ raw: JSON.parse(raw) });
     }
     catch (err) {
         const e = err;
@@ -108,27 +108,27 @@ async function writeTokenFile(dataDir, fileName, next) {
     return next;
 }
 /** Gets the current stored OAuth token for `fileName`, or null when none is stored (or the persisted entry is malformed). */
-export async function getStoredOAuthToken(dataDir, fileName) {
-    const file = await readOAuthTokenFile(dataDir, fileName);
+export async function getStoredOAuthToken({ dataDir, fileName }) {
+    const file = await readOAuthTokenFile({ dataDir: dataDir, fileName: fileName });
     return file.token ?? null;
 }
 /** Atomically replaces the stored OAuth token for `fileName`. */
-export async function setStoredOAuthToken(dataDir, fileName, token) {
+export async function setStoredOAuthToken({ dataDir, fileName, token }) {
     await withLock(`${dataDir}\0${fileName}`, async () => {
         await writeTokenFile(dataDir, fileName, { token });
     });
 }
 /** Atomically deletes the stored OAuth token for `fileName`. No-op when absent. */
-export async function clearStoredOAuthToken(dataDir, fileName) {
+export async function clearStoredOAuthToken({ dataDir, fileName }) {
     await withLock(`${dataDir}\0${fileName}`, async () => {
-        const file = await readOAuthTokenFile(dataDir, fileName);
+        const file = await readOAuthTokenFile({ dataDir: dataDir, fileName: fileName });
         if (!file.token)
             return;
         await writeTokenFile(dataDir, fileName, {});
     });
 }
 /** True when the stored token is past its `expiresAt` (or within `skew` milliseconds of expiring). Returns false when no `expiresAt` is recorded — some providers issue non-expiring tokens. */
-export function isOAuthTokenExpired(token, now = Date.now(), skew = 120_000) {
+export function isOAuthTokenExpired({ token }, { now = Date.now(), skew = 120_000 } = {}) {
     if (typeof token.expiresAt !== 'number')
         return false;
     return token.expiresAt - skew <= now;