@jini-ai/core 0.4.8 → 0.6.10

package/dist/feature-flags.d.ts

@@ -0,0 +1,21 @@
+/** A boolean rollout decision with its winning layer; feature flags never grant permissions. */
+export interface FeatureFlagDecision {
+    enabled: boolean;
+    source: 'environment' | 'runtime' | 'workspace' | 'default';
+}
+/** Evaluate one flag. Environment is the deployment override; runtime precedes persisted workspace.
+ * An explicitly malformed layer disables the feature instead of falling through to an enabling layer.
+ * @param requiredArgs - Flag key for a stable caller contract (the host owns lookup).
+ * @param optionalArgs - Layer values, with absent layers represented by undefined. Defaults off.
+ * @returns The winning decision and source, with no I/O or mutation.
+ * @complexity O(1) time and space.
+ */
+export declare function evaluateFeatureFlag(_requiredArgs: {
+    key: string;
+}, { environment, runtime, workspace, defaultEnabled }?: {
+    environment?: unknown;
+    runtime?: unknown;
+    workspace?: unknown;
+    defaultEnabled?: boolean;
+}): FeatureFlagDecision;
+//# sourceMappingURL=feature-flags.d.ts.map

package/dist/feature-flags.js

@@ -0,0 +1,17 @@
+/** Evaluate one flag. Environment is the deployment override; runtime precedes persisted workspace.
+ * An explicitly malformed layer disables the feature instead of falling through to an enabling layer.
+ * @param requiredArgs - Flag key for a stable caller contract (the host owns lookup).
+ * @param optionalArgs - Layer values, with absent layers represented by undefined. Defaults off.
+ * @returns The winning decision and source, with no I/O or mutation.
+ * @complexity O(1) time and space.
+ */
+export function evaluateFeatureFlag(_requiredArgs, { environment, runtime, workspace, defaultEnabled = false } = {}) {
+    if (environment !== undefined)
+        return { enabled: environment === 'true' || environment === '1', source: 'environment' };
+    if (runtime !== undefined)
+        return { enabled: runtime === true, source: 'runtime' };
+    if (workspace !== undefined)
+        return { enabled: workspace === true, source: 'workspace' };
+    return { enabled: defaultEnabled === true, source: 'default' };
+}
+//# sourceMappingURL=feature-flags.js.map

package/dist/fetch/index.d.ts

@@ -1,5 +1,6 @@
 /** Framework-neutral query contracts and cache; hosts supply transport callbacks and environment ports. */
 export { DEFAULT_STALE_TIME, IDLE_RETENTION, FetchQueryCache, toQueryError } from './cache.js';
 export type { QueryCacheSchedulerPort, FetchQueryEnvironmentPort, FetchQueryCacheOptions, QueryState, QueryObserver, CacheEntry } from './cache.js';
-export type { QueryKey, QueryStatus, QueryResult, FetchQueryOptions, MutationStatus, MutationResult, FetchMutationOptions, CachedLoaderOptions, CachedLoader, FetchQueryAdapter } from './types.js';
+export type { QueryKey, QueryStatus, QueryResult, FetchQueryOptions, MutationStatus, MutationResult, FetchMutationOptions, CachedLoaderOptions, CachedLoaderDefaults, CachedLoader, FetchQueryAdapter } from './types.js';
+export { missingCachedLoaderFetchError, withCachedLoaderFetch } from './loader-read.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/fetch/index.js

@@ -1,3 +1,4 @@
 /** Framework-neutral query contracts and cache; hosts supply transport callbacks and environment ports. */
 export { DEFAULT_STALE_TIME, IDLE_RETENTION, FetchQueryCache, toQueryError } from './cache.js';
+export { missingCachedLoaderFetchError, withCachedLoaderFetch } from './loader-read.js';
 //# sourceMappingURL=index.js.map

package/dist/fetch/loader-read.d.ts

@@ -0,0 +1,16 @@
+import type { CachedLoaderDefaults, CachedLoaderOptions, QueryKey } from './types.js';
+/**
+ * The error an argument-less `load()` rejects with when its loader was created without a default
+ * `fetch`. Named, rather than left to a `TypeError: fetch is not a function` from deep inside a cache
+ * adapter, so the misuse points at the call site that needs to pass `{ key, fetch }`.
+ */
+export declare function missingCachedLoaderFetchError(key: QueryKey): Error;
+/**
+ * Runs `read` with a fully specified `{ key, fetch }`, or rejects with
+ * {@link missingCachedLoaderFetchError} when `required` (a loader's own defaults, for an argument-less
+ * `load()`) carries no fetch. It rejects BEFORE `read` runs, so a misuse never enters the shared cache:
+ * a failed fetch there would publish an error state to every observer of that key.
+ * Shared by every `FetchQueryAdapter` so each adapter's `load` stays a single straight-line call.
+ */
+export declare function withCachedLoaderFetch<T>(required: CachedLoaderDefaults<T>, read: (resolved: Pick<CachedLoaderOptions<T>, 'key' | 'fetch'>) => Promise<T>): Promise<T>;
+//# sourceMappingURL=loader-read.d.ts.map

package/dist/fetch/loader-read.js

@@ -0,0 +1,22 @@
+/**
+ * The error an argument-less `load()` rejects with when its loader was created without a default
+ * `fetch`. Named, rather than left to a `TypeError: fetch is not a function` from deep inside a cache
+ * adapter, so the misuse points at the call site that needs to pass `{ key, fetch }`.
+ */
+export function missingCachedLoaderFetchError(key) {
+    return new Error(`Cached loader for key ${JSON.stringify(key)} has no default fetch: call load({ key, fetch }) with a fetch of its own`);
+}
+/**
+ * Runs `read` with a fully specified `{ key, fetch }`, or rejects with
+ * {@link missingCachedLoaderFetchError} when `required` (a loader's own defaults, for an argument-less
+ * `load()`) carries no fetch. It rejects BEFORE `read` runs, so a misuse never enters the shared cache:
+ * a failed fetch there would publish an error state to every observer of that key.
+ * Shared by every `FetchQueryAdapter` so each adapter's `load` stays a single straight-line call.
+ */
+export function withCachedLoaderFetch(required, read) {
+    const { key, fetch } = required;
+    if (fetch === undefined)
+        return Promise.reject(missingCachedLoaderFetchError(key));
+    return read({ key, fetch });
+}
+//# sourceMappingURL=loader-read.js.map

package/dist/fetch/types.d.ts

@@ -67,13 +67,23 @@ export interface CachedLoaderOptions<T> {
     fetch: () => Promise<T>;
     staleTime?: number;
 }
+/**
+ * What a loader hook is created with: the key its `peek`/`replace` (and an argument-less `load`)
+ * address, plus an optional default `fetch`. The default is optional because a loader whose every
+ * `load` names its own `{ key, fetch }` (per-id detail lookups, per-path file reads) would otherwise
+ * have to invent a fetch that can never run. An argument-less `load()` on a loader created without
+ * one rejects with {@link missingCachedLoaderFetchError} instead of touching the cache.
+ */
+export type CachedLoaderDefaults<T> = Pick<CachedLoaderOptions<T>, "key"> & {
+    fetch?: CachedLoaderOptions<T>["fetch"] | undefined;
+};
 /**
  * A plain promise loader serves components that own their loading UI rather than consuming
  * a hook result. It shares the provider cache, including one in-flight request per key.
  */
 export interface CachedLoader<T> {
     peek: () => T | undefined;
-    load: (required?: Pick<CachedLoaderOptions<T>, "key" | "fetch">) => Promise<T>;
+    load: (required?: Pick<CachedLoaderOptions<T>, "key" | "fetch">, optional?: Pick<CachedLoaderOptions<T>, "staleTime">) => Promise<T>;
     replace: (required: {
         value: T;
     }) => void;
@@ -88,6 +98,6 @@ export interface FetchQueryAdapter {
     useInvalidate: () => (required: {
         key: QueryKey;
     }) => void;
-    useCachedLoader: <T>(required: Pick<CachedLoaderOptions<T>, "key" | "fetch">, optional?: Omit<CachedLoaderOptions<T>, "key" | "fetch">) => CachedLoader<T>;
+    useCachedLoader: <T>(required: CachedLoaderDefaults<T>, optional?: Omit<CachedLoaderOptions<T>, "key" | "fetch">) => CachedLoader<T>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/gated-mutations/gateway.js

@@ -40,13 +40,36 @@ export async function authorizeForHooks(required) {
     }
     return deps.authorizeInstance({ principalId, permission });
 }
+/** Fresh authorization gate shared by plan/confirm/execute; refuses with NOT_AUTHORIZED. */
+async function requireAuthorization(required) {
+    const { principalId, permission } = required;
+    const authResult = await authorizeForHooks(required);
+    if (!authResult.allowed) {
+        throw new ForbiddenError({ message: `principal '${principalId}' is not authorized for '${permission}' (${authResult.reason})`, reasonCode: "NOT_AUTHORIZED" });
+    }
+}
+/** The refusal for a token that cannot be redeemed: already redeemed, otherwise expired. */
+function unredeemableTokenError(record) {
+    if (record?.status === "redeemed") {
+        return new TokenAlreadyRedeemedError({ message: `confirmation token has already been redeemed` });
+    }
+    return new TokenExpiredError({ message: `confirmation token has expired` });
+}
+/** Look up the presented token and refuse it unless it is still minted and unexpired. */
+async function loadRedeemableToken(required) {
+    const { deps, confirmationToken } = required;
+    const record = await deps.tokens.findByToken({ token: confirmationToken });
+    if (!record) {
+        throw new TokenExpiredError({ message: `confirmation token was not found` });
+    }
+    if (!isRedeemable({ record, now: nowIso({ clock: deps.clock }) }))
+        throw unredeemableTokenError(record);
+    return record;
+}
 // Planning is read-only: check read permission and derive details, never invoke executeMutation.
 export async function plan(required, _optional = {}) {
     const { deps, principalId, hooks } = required;
-    const authResult = await authorizeForHooks({ deps, hooks, principalId, permission: hooks.readPermission });
-    if (!authResult.allowed) {
-        throw new ForbiddenError({ message: `principal '${principalId}' is not authorized for '${hooks.readPermission}' (${authResult.reason})`, reasonCode: "NOT_AUTHORIZED" });
-    }
+    await requireAuthorization({ deps, hooks, principalId, permission: hooks.readPermission });
     const { planHash, details } = await hooks.computePlan({});
     return { domain: hooks.domain, planId: deps.idGen.newId(), planHash, details };
 }
@@ -57,10 +80,7 @@ export async function confirm(required, _optional = {}) {
     if (principalKind === "agent") {
         throw new ForbiddenError({ message: `agent principals may not confirm a gated mutation`, reasonCode: "AGENT_CANNOT_CONFIRM" });
     }
-    const authResult = await authorizeForHooks({ deps, hooks, principalId, permission: hooks.mutatePermission });
-    if (!authResult.allowed) {
-        throw new ForbiddenError({ message: `principal '${principalId}' is not authorized for '${hooks.mutatePermission}' (${authResult.reason})`, reasonCode: "NOT_AUTHORIZED" });
-    }
+    await requireAuthorization({ deps, hooks, principalId, permission: hooks.mutatePermission });
     const token = mintToken({
         planId,
         planHash,
@@ -82,20 +102,8 @@ export async function confirm(required, _optional = {}) {
 export async function execute(required, _optional = {}) {
     // Reevaluate authorization here; confirm-time permission is not authority to execute later.
     const { deps, principalId, principalKind, hooks, confirmationToken } = required;
-    const authResult = await authorizeForHooks({ deps, hooks, principalId, permission: hooks.mutatePermission });
-    if (!authResult.allowed) {
-        throw new ForbiddenError({ message: `principal '${principalId}' is not authorized for '${hooks.mutatePermission}' (${authResult.reason})`, reasonCode: "NOT_AUTHORIZED" });
-    }
-    const record = await deps.tokens.findByToken({ token: confirmationToken });
-    if (!record) {
-        throw new TokenExpiredError({ message: `confirmation token was not found` });
-    }
-    if (!isRedeemable({ record, now: nowIso({ clock: deps.clock }) })) {
-        if (record.status === "redeemed") {
-            throw new TokenAlreadyRedeemedError({ message: `confirmation token has already been redeemed` });
-        }
-        throw new TokenExpiredError({ message: `confirmation token has expired` });
-    }
+    await requireAuthorization({ deps, hooks, principalId, permission: hooks.mutatePermission });
+    const record = await loadRedeemableToken({ deps, confirmationToken });
     const resolvedIdentity = await hooks.resolveActorClassIdentity({ principalId, principalKind });
     if (resolvedIdentity !== record.confirmerPrincipalId) {
         throw new ForbiddenError({ message: `principal '${principalId}' (kind '${principalKind}') is not the confirmer of this token`, reasonCode: "ACTOR_CLASS_MISMATCH" });
@@ -113,11 +121,8 @@ export async function execute(required, _optional = {}) {
     // Concurrent executions can pass every earlier check; atomic redemption makes the loser fail
     // before its domain mutation, preventing a second application of the same approval.
     const { redeemed, record: latestRecord } = await deps.tokens.tryRedeem({ token: confirmationToken, now: nowIso({ clock: deps.clock }) });
-    if (!redeemed) {
-        if (!latestRecord || latestRecord.status !== "redeemed")
-            throw new TokenExpiredError({ message: `confirmation token has expired` });
-        throw new TokenAlreadyRedeemedError({ message: `confirmation token has already been redeemed` });
-    }
+    if (!redeemed)
+        throw unredeemableTokenError(latestRecord);
     return hooks.executeMutation({ planHash, details });
 }
 //# sourceMappingURL=gateway.js.map

package/dist/index.d.ts

@@ -12,11 +12,14 @@ export * from './origin-validation.js';
 export * from './principal.js';
 export * from './surface-exchanges.js';
 export type { AuthorizationDecision, RunRef, SurfaceEmission, SurfaceEmitter, ToolAuthorizationContext, ToolDescriptor, ToolExecutionContext, ToolExecutionOptions, ToolHandler, ToolPolicy, ToolRegistration, ToolRegistry, } from './tool-registry.js';
-export { createToolRegistrationScope, toolRegistryRevision, createToolRegistry, isReadOnlyTool, ToolInputError } from './tool-registry.js';
+export { createToolRegistrationScope, toolRegistryRevision, createToolRegistry, isReadOnlyTool, toolDiscoveryMetadata, ToolInputError } from './tool-registry.js';
 export * from './tool-tokens.js';
+export * from './tool-exposure.js';
 export * from './gated-mutations.js';
 export * from './model-facing-tool-errors.js';
 export * from './contribution-registry.js';
+export * from './provider-registry.js';
+export * from './object-store.js';
 export * from './naming.js';
 export type { AgentToolSideEffect, AgentToolActorClassRule, AgentToolDefinition } from './agent-tools.js';
 export * from "./registration-kit.js";
@@ -24,4 +27,8 @@ export * from "./approval.js";
 export * from './target-scope.js';
 export * from "./native-regexp.js";
 export { ForbiddenError as ToolPermissionDeniedError, requireToolPermission, adaptLegacyAuthorize, type LegacyToolAuthorizeFn, type AuthorizationPort as ToolPermissionAuthorizationPort, type RequireToolPermissionRequired, type RequireToolPermissionOptional, } from "./tool-permissions.js";
+export { evaluateFeatureFlag, type FeatureFlagDecision } from './feature-flags.js';
+export { normalizeToolInput, withNormalizationNotes, ToolInputNormalizationError, type NormalizedToolInput, type ToolInputNormalizer } from './tool-input-normalization.js';
+export { applyBatchInputs, BATCH_GUIDANCE_MARKER, withoutBatchGuidance, batchOutcomeFor, batchDescriptorFor, batchEligibilityFor, defaultBatchableTools, withBatchInput, DEFAULT_MAX_BATCH_ITEMS, type BatchableTool, type BatchEligibility, type BatchOptOut, type BatchResult, type BatchItemResult } from './batch-tool-inputs.js';
+export type { MediaProviderCatalogPolicy, MediaProviderOption, ProviderPreset, ProviderPresetKind } from './provider-catalog.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -9,15 +9,21 @@ export * from './api-token-auth.js';
 export * from './origin-validation.js';
 export * from './principal.js';
 export * from './surface-exchanges.js';
-export { createToolRegistrationScope, toolRegistryRevision, createToolRegistry, isReadOnlyTool, ToolInputError } from './tool-registry.js';
+export { createToolRegistrationScope, toolRegistryRevision, createToolRegistry, isReadOnlyTool, toolDiscoveryMetadata, ToolInputError } from './tool-registry.js';
 export * from './tool-tokens.js';
+export * from './tool-exposure.js';
 export * from './gated-mutations.js';
 export * from './model-facing-tool-errors.js';
 export * from './contribution-registry.js';
+export * from './provider-registry.js';
+export * from './object-store.js';
 export * from './naming.js';
 export * from "./registration-kit.js";
 export * from "./approval.js";
 export * from './target-scope.js';
 export * from "./native-regexp.js";
 export { ForbiddenError as ToolPermissionDeniedError, requireToolPermission, adaptLegacyAuthorize, } from "./tool-permissions.js";
+export { evaluateFeatureFlag } from './feature-flags.js';
+export { normalizeToolInput, withNormalizationNotes, ToolInputNormalizationError } from './tool-input-normalization.js';
+export { applyBatchInputs, BATCH_GUIDANCE_MARKER, withoutBatchGuidance, batchOutcomeFor, batchDescriptorFor, batchEligibilityFor, defaultBatchableTools, withBatchInput, DEFAULT_MAX_BATCH_ITEMS } from './batch-tool-inputs.js';
 //# sourceMappingURL=index.js.map

package/dist/object-store.d.ts

@@ -0,0 +1,115 @@
+/**
+ * @file The ONE object-storage contract (2026-10-21): key → bytes, with an optional public-read
+ * capability. It absorbs four overlapping shapes (cms `BlobStorePort`, capability-providers
+ * `StorageProvider`, devops `ArtifactStorePort`, platform `BlobStorage`); those stay as thin views
+ * over this one until their consumers move. Providers are keyed in a `createProviderRegistry`
+ * (`contract: 'object_store'`), default `local`.
+ *
+ * Universal: types and pure helpers only, so every storage package (all of which already depend
+ * on core) can implement it. Filesystem and network adapters live in node/host packages.
+ *
+ * Data-plane calls REJECT on a storage fault (as every existing byte port did), and report absence
+ * as `null`/`false`, never as a rejection: a caller must never mistake "the store failed" for "the
+ * object is gone". Only `ObjectStoreProvider.create` returns a `ProviderResult`, so a bad or missing
+ * setting is a refusal the host can report, not a boot crash.
+ */
+import { type ProviderDefinition, type ProviderRegistry, type ProviderResult } from './provider-registry.js';
+/** Registry contract name for object-store providers. */
+export declare const OBJECT_STORE_CONTRACT = "object_store";
+/** The built-in default provider id (local filesystem). */
+export declare const DEFAULT_OBJECT_STORE_PROVIDER_ID = "local";
+export interface ObjectStorePutOptions {
+    readonly contentType?: string;
+    /** Extra stored response headers (e.g. `content-disposition`); a provider may drop unsupported ones. */
+    readonly headers?: Readonly<Record<string, string>>;
+    /**
+     * Create-only write: lands `bytes` iff no object occupies `key`, atomically with respect to any
+     * other concurrent writer of the SAME key. No adapter may implement this as a separate existence
+     * check followed by a write — that pair is exactly the TOCTOU gap this flag exists to close.
+     */
+    readonly ifAbsent?: boolean;
+    readonly signal?: AbortSignal;
+}
+export interface ObjectStoreCallOptions {
+    readonly signal?: AbortSignal;
+}
+/** Anonymous read access, present only on a store whose objects are publicly reachable. */
+export interface PublicObjectAccess {
+    /** The public URL a recipient fetches `key` at. */
+    url(required: {
+        readonly key: string;
+    }): string;
+    /** Anonymous read check: present with `bytes`, or a confirmed 404/410 when `present` is false. Errors are not absence. */
+    verify(required: {
+        readonly key: string;
+        readonly url: string;
+        readonly present: boolean;
+        readonly bytes?: number;
+    }, optional?: ObjectStoreCallOptions): Promise<boolean>;
+}
+export interface ObjectStore {
+    /** `written: false` only when `ifAbsent` was set and the key was already occupied. */
+    put(required: {
+        readonly key: string;
+        readonly bytes: Uint8Array;
+    }, optional?: ObjectStorePutOptions): Promise<{
+        readonly written: boolean;
+    }>;
+    /** `null` only when the key is absent; every other fault rejects. */
+    get(required: {
+        readonly key: string;
+    }, optional?: ObjectStoreCallOptions): Promise<Uint8Array | null>;
+    /** Byte count without reading the payload; `null` only when the key is absent. */
+    head(required: {
+        readonly key: string;
+    }, optional?: ObjectStoreCallOptions): Promise<{
+        readonly size: number;
+    } | null>;
+    /** Idempotent — deleting an absent key is not an error. */
+    delete(required: {
+        readonly key: string;
+    }, optional?: ObjectStoreCallOptions): Promise<void>;
+    readonly publicAccess?: PublicObjectAccess;
+}
+/** What a host hands a provider: non-secret settings, a pre-resolved credential, and its own kit. */
+export interface ObjectStoreCreateInput<H = unknown> {
+    readonly settings: Readonly<Record<string, string | undefined>>;
+    /** Pre-resolved by the host (`fields` non-secret, `secret` the one secret value); never looked up by the provider. */
+    readonly credential?: {
+        readonly fields: Readonly<Record<string, string | undefined>>;
+        readonly secret: string;
+    };
+    /** Host capabilities a plain-JS plugin cannot import (signing, guarded fetch, observability). */
+    readonly host: H;
+}
+export interface ObjectStoreProvider<H = unknown> {
+    create(required: ObjectStoreCreateInput<H>, optional?: Record<string, never>): ProviderResult<ObjectStore>;
+}
+/**
+ * Shape check for a provider value, usable as a registry `validate` or a plugin module `validate`.
+ * @returns The reason it is not a provider, or `undefined`.
+ * @complexity O(1).
+ */
+export declare function objectStoreProviderFault(required: {
+    readonly provider: unknown;
+}): string | undefined;
+/**
+ * A keyed registry for object-store providers whose default is the local filesystem provider.
+ * The `local` provider itself is node-only, so the host registers it (`seed` or `register`).
+ * @complexity O(seed).
+ */
+export declare function createObjectStoreRegistry<H = unknown>(_required?: Record<string, never>, optional?: {
+    readonly seed?: readonly ProviderDefinition<ObjectStoreProvider<H>>[];
+}): ProviderRegistry<ObjectStoreProvider<H>>;
+/**
+ * An `ObjectStore` whose real store is resolved on first use — for hosts whose boot must hand out
+ * a store before the provider choice (a setting, an installed plugin) can be read. A successful
+ * load is kept; a failed load rejects that call and is retried by the next one, so a transient
+ * plugin or settings fault does not pin the store broken for the life of the process.
+ * `publicAccess` is not forwarded: a deferred store cannot know it synchronously.
+ * @complexity O(1) per call after the first successful load.
+ */
+export declare function deferObjectStore(required: {
+    readonly load: () => Promise<ObjectStore>;
+}, _optional?: Record<string, never>): ObjectStore;
+//# sourceMappingURL=object-store.d.ts.map

package/dist/object-store.js

@@ -0,0 +1,70 @@
+/**
+ * @file The ONE object-storage contract (2026-10-21): key → bytes, with an optional public-read
+ * capability. It absorbs four overlapping shapes (cms `BlobStorePort`, capability-providers
+ * `StorageProvider`, devops `ArtifactStorePort`, platform `BlobStorage`); those stay as thin views
+ * over this one until their consumers move. Providers are keyed in a `createProviderRegistry`
+ * (`contract: 'object_store'`), default `local`.
+ *
+ * Universal: types and pure helpers only, so every storage package (all of which already depend
+ * on core) can implement it. Filesystem and network adapters live in node/host packages.
+ *
+ * Data-plane calls REJECT on a storage fault (as every existing byte port did), and report absence
+ * as `null`/`false`, never as a rejection: a caller must never mistake "the store failed" for "the
+ * object is gone". Only `ObjectStoreProvider.create` returns a `ProviderResult`, so a bad or missing
+ * setting is a refusal the host can report, not a boot crash.
+ */
+import { createProviderRegistry } from './provider-registry.js';
+/** Registry contract name for object-store providers. */
+export const OBJECT_STORE_CONTRACT = 'object_store';
+/** The built-in default provider id (local filesystem). */
+export const DEFAULT_OBJECT_STORE_PROVIDER_ID = 'local';
+/**
+ * Shape check for a provider value, usable as a registry `validate` or a plugin module `validate`.
+ * @returns The reason it is not a provider, or `undefined`.
+ * @complexity O(1).
+ */
+export function objectStoreProviderFault(required) {
+    const { provider } = required;
+    if (typeof provider !== 'object' || provider === null)
+        return 'an object-store provider must be an object';
+    return typeof provider.create === 'function' ? undefined : 'an object-store provider must define create()';
+}
+/**
+ * A keyed registry for object-store providers whose default is the local filesystem provider.
+ * The `local` provider itself is node-only, so the host registers it (`seed` or `register`).
+ * @complexity O(seed).
+ */
+export function createObjectStoreRegistry(_required = {}, optional = {}) {
+    return createProviderRegistry({ contract: OBJECT_STORE_CONTRACT }, {
+        defaultProviderId: DEFAULT_OBJECT_STORE_PROVIDER_ID,
+        validate: objectStoreProviderFault,
+        ...(optional.seed === undefined ? {} : { seed: optional.seed }),
+    });
+}
+/**
+ * An `ObjectStore` whose real store is resolved on first use — for hosts whose boot must hand out
+ * a store before the provider choice (a setting, an installed plugin) can be read. A successful
+ * load is kept; a failed load rejects that call and is retried by the next one, so a transient
+ * plugin or settings fault does not pin the store broken for the life of the process.
+ * `publicAccess` is not forwarded: a deferred store cannot know it synchronously.
+ * @complexity O(1) per call after the first successful load.
+ */
+export function deferObjectStore(required, _optional = {}) {
+    let loaded;
+    const current = () => {
+        if (!loaded) {
+            const pending = required.load();
+            loaded = pending;
+            pending.catch(() => { if (loaded === pending)
+                loaded = undefined; });
+        }
+        return loaded;
+    };
+    return {
+        put: async (input, options) => (await current()).put(input, options),
+        get: async (input, options) => (await current()).get(input, options),
+        head: async (input, options) => (await current()).head(input, options),
+        delete: async (input, options) => (await current()).delete(input, options),
+    };
+}
+//# sourceMappingURL=object-store.js.map