@jini-ai/core 0.6.15-rc.1 → 0.6.15

package/dist/redact.js

@@ -53,7 +53,16 @@ export const SECRET_SHAPE_PATTERNS = [
     { name: PEM_PATTERN_NAME, pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
 ];
 /** Broad token shapes for agent-failure text; consumers retain their plain [REDACTED] pipeline. */
-export const AGENT_FAILURE_SECRET_SHAPE_RE = /\b(?:AIza[\w-]+|AQ\.[\w.\/-]+|sk-[\w.-]+|gh[pousr]_[\w]+|github_pat_[\w]+|ya29\.[\w.-]+|eyJ[\w-]+\.[\w-]+(?:\.[\w-]+)?)/g;
+const AGENT_FAILURE_TOKEN_SHAPES = [
+    /AIza[\w-]+/, // Google API key
+    /AQ\.[\w.\/-]+/, // AI Studio key
+    /sk-[\w.-]+/, // OpenAI-style secret key
+    /gh[pousr]_\w+/, // GitHub token
+    /github_pat_\w+/, // GitHub fine-grained token
+    /ya29\.[\w.-]+/, // Google OAuth access token
+    /eyJ[\w-]+\.[\w-]+(?:\.[\w-]+)?/, // JWT
+];
+export const AGENT_FAILURE_SECRET_SHAPE_RE = new RegExp(`\\b(?:${AGENT_FAILURE_TOKEN_SHAPES.map((shape) => shape.source).join('|')})`, 'g');
 /**
  * Exact path SEGMENT names refused at any depth, matched case-insensitively against each segment
  * of the caller-supplied path (never a substring — a directory named `not-secrets-actually` is not
@@ -89,6 +98,12 @@ export const LOCAL_OWNER_PROXY_MARKER_HEADERS = [
 // Order matters: list specific rules before more general ones. Langfuse
 // keys (`sk-lf-...`) would otherwise be eaten by the generic `sk-...`
 // rule and labeled as a generic OpenAI-style key.
+// One IPv4 octet, 0-255, so junk shapes like 999.1.1.1 do not count.
+const IPV4_OCTET = '(?:25[0-5]|2[0-4]\\d|[01]?\\d?\\d)';
+// Optional +country code, then a bare or parenthesized area code, with optional separators.
+const PHONE_SEPARATOR = '[\\s.-]?';
+const PHONE_COUNTRY_CODE = /(?:\+?\d{1,3}[\s.-]?)?/;
+const PHONE_AREA_CODE = /(?:\(\d{3}\)|\d{3})/;
 const PATTERNS = [
     // Langfuse public/secret keys (pk-lf- / sk-lf-). Must run before the
     // generic sk- rule so the more specific label wins.
@@ -124,14 +139,16 @@ const PATTERNS = [
     // Bearer tokens in HTTP Authorization header copy/paste. We only match
     // the value, not the literal 'Bearer ', so the marker stays readable in
     // the redacted output ("Authorization: Bearer [REDACTED:bearer_token]").
-    { name: 'bearer_token', regex: /(?<=\bBearer\s+)[A-Za-z0-9._~+/-]{16,}={0,2}/g },
+    // The leading lookahead only lets the lookbehind run where a value can start, so a long
+    // whitespace run is not rescanned from every position inside it.
+    { name: 'bearer_token', regex: /(?=[A-Za-z0-9._~+/-])(?<=\bBearer\s+)[A-Za-z0-9._~+/-]{16,}={0,2}/g },
     // Alphabetic TLDs preserve versioned package paths in error stacks (e.g. pkg@1.2.3).
     { name: 'email', regex: /\b[\w.+-]+@(?:[\w-]+\.)+[A-Za-z]{2,}\b/g },
     // IPv4. Reject all-zero / 255.255.255.255-ish junk shapes by gating on
     // each octet being 0-255.
     {
         name: 'ipv4',
-        regex: /\b(?:(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d?\d)\b/g,
+        regex: new RegExp(`\\b(?:${IPV4_OCTET}\\.){3}${IPV4_OCTET}\\b`, 'g'),
     },
     // Phone numbers. Tight US-leaning shape; a global PII detector would
     // need a real lib. We keep this so US-based test prompts ('call me at
@@ -141,7 +158,7 @@ const PATTERNS = [
     // hashes and identifiers stay readable; separators within phones still match.
     {
         name: 'phone',
-        regex: /(?<![\w-])(?:\+?\d{1,3}[\s.-]?)?(?:\(\d{3}\)|\d{3})[\s.-]?\d{3}[\s.-]?\d{4}(?![\w-])/g,
+        regex: new RegExp(`(?<![\\w-])${PHONE_COUNTRY_CODE.source}${PHONE_AREA_CODE.source}${PHONE_SEPARATOR}\\d{3}${PHONE_SEPARATOR}\\d{4}(?![\\w-])`, 'g'),
     },
 ];
 // Credit card sweep is special: a naive 13-19 digit run matches a lot of
@@ -184,14 +201,18 @@ function isLuhnValid(digits) {
 const SECRET_LABELS = 'authorization|bearer|api[-_]?key|access[-_]?token|refresh[-_]?token|client[-_]?secret|password|secret|cookie';
 export const LABELED_SECRET_RE = new RegExp(`\\b(${SECRET_LABELS})\\b\\s*[:=]\\s*\\S+`, 'gi');
 export const OPAQUE_TOKEN_RE = /[A-Za-z0-9_-]{20,}/g;
-export const NON_SECRET_TOKEN_RE = /^(?:ERR-[0-9A-F]{4}(?:-[0-9A-F]{4}){3}|delegated-tool-calls|[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+)$/;
+// Pattern parts, only ever used inside the anchored NON_SECRET_TOKEN_RE.
+const CORRELATION_ID = 'ERR-[0-9A-F]{4}(?:-[0-9A-F]{4}){3}';
+const UPPER_SNAKE_DIAGNOSTIC = '[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+';
+export const NON_SECRET_TOKEN_RE = new RegExp(`^(?:${CORRELATION_ID}|delegated-tool-calls|${UPPER_SNAKE_DIAGNOSTIC})$`);
 // Runtime markers must survive a second pass; the bounded sanitizer deliberately retains
 // its historical lowercase marker contract and uses the unmodified lexical vocabulary.
 // Reject a masked header/query value before matching, so a following field's credential
 // remains available to the global scan rather than being consumed beside the marker.
 const MASK_AWARE_LABELED_SECRET_RE = new RegExp(LABELED_SECRET_RE.source.replace(/\\S\+$/, "(?!Bearer\\s+\\[REDACTED:[^\\]]+\\](?:\\s|$))(?!\\[REDACTED:[^\\]]+\\][;&])(\\S+)"), LABELED_SECRET_RE.flags);
 // Provider failures also echo short bearer values. Exclude our own marker on subsequent passes.
-const SHORT_BEARER_RE = /(?<=Bearer\s+)[A-Za-z0-9_\-.+/=]+/gi;
+// The leading lookahead only lets the lookbehind run where a value can start (see bearer_token).
+const SHORT_BEARER_RE = /(?=[\w.+/=-])(?<=Bearer\s+)[\w.+/=-]+/gi;
 const PROVIDER_API_KEY_HEADER = /(x-api-key|api-key|x-goog-api-key)\s*[:=]\s*([^\s,;"']+)/gi;
 const PROVIDER_API_KEY_QUERY = /([?&]key=)([^&\s]+)/gi;
 // URL userinfo and signed query values have explicit credential context; unlike opaque runs,
@@ -205,7 +226,8 @@ const SIGNED_QUERY_RE = /([?&](?:signature|sig|x-amz-signature|x-goog-signature|
 // monkey) are masked too; over-masking a URL value is the cheaper failure. Empty values stay.
 // Match through a trailing fragment; only '&', quotes, parentheses or whitespace end the value.
 // Both name runs are bounded so a long separator-free run costs linear time, not quadratic.
-const URL_SECRET_PARAM_RE = /[?&#;]([\w.-]{0,128}?(?:token|key|secret|signature|sig|code|password|passwd|pwd|auth|authorization|credential)s?(?=[._=-])[\w.-]{0,128})=[^&\s"'<>()]+/gi;
+const URL_SECRET_WORDS = 'token|key|secret|signature|sig|code|password|passwd|pwd|auth|authorization|credential';
+const URL_SECRET_PARAM_RE = new RegExp(`[?&#;]([\\w.-]{0,128}?(?:${URL_SECRET_WORDS})s?(?=[._=-])[\\w.-]{0,128})=[^&\\s"'<>()]+`, 'gi');
 // A parameter the labeled rule already names (password, client_secret, ...) keeps that category.
 const LABELED_URL_PARAM_NAME_RE = new RegExp(`(?:^|[.-])(?:${SECRET_LABELS})$`, 'i');
 // Only an entire marker is already masked. A secret glued onto marker-like text still needs

package/dist/registration-kit.js

@@ -443,9 +443,7 @@ function registrationFor({ spec, id, handler }) {
 /** The tripwire: a catalog entry is either wired or recorded as deliberately unwired, never silently neither. */
 function assertEveryEntryIsWiredOrDeclared({ spec }, { unwiredToolIds } = {}) {
     for (const id of spec.catalog.keys()) {
-        if (id in spec.handlers)
-            continue;
-        if (unwiredToolIds?.has(id))
+        if (id in spec.handlers || unwiredToolIds?.has(id))
             continue;
         throw new Error(`tool-registrations: ${spec.domain} catalog entry '${id}' is neither wired nor declared unwired — wire a handler for it, or add it to that domain's unwired set with the reason recorded next to it`);
     }

package/dist/settings/agent-tools.js

@@ -43,6 +43,8 @@
  * See docs/decisions/DR-003-settings-ledger-invariants.md.
  */
 import { AGENT_WRITABLE_PREFERENCE_IDS, AGENT_WRITABLE_PREFERENCES } from "./agent-writable-preferences.js";
+/** The side-effect class every settings write tool declares. */
+const MUTATES_DURABLE_STATE = "mutates-durable-state";
 /**
    * JSON Schema for this tool's `input`, published to the model via `ToolDescriptor.inputSchema`
    * (a host's tool-registration layer refuses to wire any tool lacking one). Optional — the two bulk/schema
@@ -163,7 +165,7 @@ export function getSettingsAgentToolCatalog() {
         {
             name: "settings_set_ui_preference",
             description: "Sets one of the operator's own admin-UI preferences (interface language, theme, accent color, or notification sounds) and returns the stored value. Writes only to the calling operator's own user layer — it cannot target another operator, another scope, or any setting outside its fixed list. Use settings_get_effective to read current values first.",
-            sideEffects: "mutates-durable-state",
+            sideEffects: MUTATES_DURABLE_STATE,
             // The narrowest write grant in the system, and it is what this tool derives BECAUSE it never
             // names a target principal (`write-service.ts`'s `deriveRequiredPermission`). Declared here
             // to match; the handler does not pass this string, it lets the chokepoint derive it, so the
@@ -174,14 +176,14 @@ export function getSettingsAgentToolCatalog() {
         {
             name: "settings_set_value",
             description: "Sets one registered setting at workspace scope (default) or the caller's own user scope. Call settings_list_definitions for valid keys, schemas, scopes and confirmation policy. Returns {key, scope, previous, value, revisionSeq}; previous is the old override, or null if absent. Privacy, instructions and host-protected assistant settings need a human confirmation card; the agent cannot confirm itself. Rejects unknown/tombstoned keys, disallowed scopes, invalid values and missing permissions. Cannot write globally, target another operator, reset a namespace or change definitions.",
-            sideEffects: "mutates-durable-state",
+            sideEffects: MUTATES_DURABLE_STATE,
             authorization: { permission: "settings.workspace.write" },
             inputSchema: SET_VALUE_SCHEMA,
         },
         {
             name: "settings_clear_value",
             description: "Clears one setting override at workspace scope (default) or the caller's own user scope so the next layer/default applies. Use to put one setting back to its inherited value; not to reset a namespace or delete a definition. Returns {key, scope, previous, effective}; restore a non-null previous override with settings_set_value. Protected assistant settings require a human confirmation card. Rejects unknown/tombstoned keys, disallowed scopes and missing permissions; cannot target global or another operator's layer.",
-            sideEffects: "mutates-durable-state",
+            sideEffects: MUTATES_DURABLE_STATE,
             authorization: { permission: "settings.workspace.write" },
             inputSchema: CLEAR_VALUE_SCHEMA,
         },
@@ -190,7 +192,7 @@ export function getSettingsAgentToolCatalog() {
             // clears every value in an operator-named namespace at a scope in one call, irreversible.
             name: "settings_reset",
             description: "Resets every setting in a namespace to defaults at a scope. NEVER agent-callable — see file header.",
-            sideEffects: "mutates-durable-state",
+            sideEffects: MUTATES_DURABLE_STATE,
             authorization: { permission: "settings.reset.workspace" },
         },
         {
@@ -199,7 +201,7 @@ export function getSettingsAgentToolCatalog() {
             // every existing stored value for that key is interpreted platform-wide.
             name: "settings_register_definitions",
             description: "Registers, renames, retypes, deprecates, or tombstones setting definitions. NEVER agent-callable — see file header.",
-            sideEffects: "mutates-durable-state",
+            sideEffects: MUTATES_DURABLE_STATE,
             authorization: { permission: "settings.definitions.manage" },
         },
     ];

package/dist/settings/agent-value-write-tools.js

@@ -56,8 +56,11 @@ function snapshotJsonValue(toolId, input) {
         throw new ToolInputError({ message: `${toolId}: value must be valid JSON.` }, { cause });
     }
 }
+/** `typeof` results JSON cannot represent. */
+const NON_JSON_TYPES = new Set(["undefined", "function", "symbol"]);
 function rejectNonJson(_key, value) {
-    if (value === undefined || typeof value === "function" || typeof value === "symbol" || (typeof value === "number" && !Number.isFinite(value)))
+    const nonFiniteNumber = typeof value === "number" && !Number.isFinite(value);
+    if (NON_JSON_TYPES.has(typeof value) || nonFiniteNumber)
         throw new Error("not JSON");
     return value;
 }
@@ -70,7 +73,8 @@ async function resolveTarget(deps, target, isSet) {
         throw new DefinitionNotFoundError(`setting '${name}' was not found`);
     if (definition.status === "tombstone")
         throw new DefinitionTombstonedError(`setting '${name}' has been tombstoned`);
-    if ((definition.scopes & SCOPE_BIT[target.scope]) === 0)
+    const scopeAllowed = (definition.scopes & SCOPE_BIT[target.scope]) !== 0;
+    if (!scopeAllowed)
         throw new ScopeNotAllowedError(name);
     if (isSet && !validateValueAgainstSchema(definition.schema, target.value))
         throw new ValueValidationFailedError(`value for '${name}' does not match the definition schema`);
@@ -211,7 +215,7 @@ export function buildSettingsValueWriteHandler(deps, toolId) {
             return await applyWrite(deps, request, prepared);
         }
         catch (error) {
-            rethrowWriteError(error, toolId, target, permission);
+            return rethrowWriteError(error, toolId, target, permission);
         }
     };
 }

package/dist/settings/dictionaries/index.d.ts

@@ -14,28 +14,6 @@
  * IS the key" — `translateSettingsDialog` falls back to the raw key for English and any
  * unrecognized locale.
  */
-import { SETTINGS_DIALOG_ES } from './settings-dialog.es.js';
-import { SETTINGS_DIALOG_ID } from './settings-dialog.id.js';
-import { SETTINGS_DIALOG_DE } from './settings-dialog.de.js';
-import { SETTINGS_DIALOG_ZH_CN } from './settings-dialog.zh-CN.js';
-import { SETTINGS_DIALOG_ZH_TW } from './settings-dialog.zh-TW.js';
-import { SETTINGS_DIALOG_PT_BR } from './settings-dialog.pt-BR.js';
-import { SETTINGS_DIALOG_RU } from './settings-dialog.ru.js';
-import { SETTINGS_DIALOG_FA } from './settings-dialog.fa.js';
-import { SETTINGS_DIALOG_AR } from './settings-dialog.ar.js';
-import { SETTINGS_DIALOG_JA } from './settings-dialog.ja.js';
-import { SETTINGS_DIALOG_KO } from './settings-dialog.ko.js';
-import { SETTINGS_DIALOG_PL } from './settings-dialog.pl.js';
-import { SETTINGS_DIALOG_HU } from './settings-dialog.hu.js';
-import { SETTINGS_DIALOG_FR } from './settings-dialog.fr.js';
-import { SETTINGS_DIALOG_UK } from './settings-dialog.uk.js';
-import { SETTINGS_DIALOG_TR } from './settings-dialog.tr.js';
-import { SETTINGS_DIALOG_TH } from './settings-dialog.th.js';
-import { SETTINGS_DIALOG_IT } from './settings-dialog.it.js';
-import { SETTINGS_DIALOG_HI } from './settings-dialog.hi.js';
-import { SETTINGS_DIALOG_UR } from './settings-dialog.ur.js';
-import { SETTINGS_DIALOG_BN } from './settings-dialog.bn.js';
-export { SETTINGS_DIALOG_ES, SETTINGS_DIALOG_ID, SETTINGS_DIALOG_DE, SETTINGS_DIALOG_ZH_CN, SETTINGS_DIALOG_ZH_TW, SETTINGS_DIALOG_PT_BR, SETTINGS_DIALOG_RU, SETTINGS_DIALOG_FA, SETTINGS_DIALOG_AR, SETTINGS_DIALOG_JA, SETTINGS_DIALOG_KO, SETTINGS_DIALOG_PL, SETTINGS_DIALOG_HU, SETTINGS_DIALOG_FR, SETTINGS_DIALOG_UK, SETTINGS_DIALOG_TR, SETTINGS_DIALOG_TH, SETTINGS_DIALOG_IT, SETTINGS_DIALOG_HI, SETTINGS_DIALOG_UR, SETTINGS_DIALOG_BN, };
 /** Every non-English locale this dictionary covers, keyed the same way `@jini-ai/ui`'s
  *  `SETTINGS_DIALOG_DICTIONARIES` is. */
 export declare const SETTINGS_DIALOG_DICTIONARIES: Readonly<Record<string, Record<string, string>>>;

package/dist/settings/dictionaries/index.js

@@ -35,7 +35,6 @@ import { SETTINGS_DIALOG_IT } from './settings-dialog.it.js';
 import { SETTINGS_DIALOG_HI } from './settings-dialog.hi.js';
 import { SETTINGS_DIALOG_UR } from './settings-dialog.ur.js';
 import { SETTINGS_DIALOG_BN } from './settings-dialog.bn.js';
-export { SETTINGS_DIALOG_ES, SETTINGS_DIALOG_ID, SETTINGS_DIALOG_DE, SETTINGS_DIALOG_ZH_CN, SETTINGS_DIALOG_ZH_TW, SETTINGS_DIALOG_PT_BR, SETTINGS_DIALOG_RU, SETTINGS_DIALOG_FA, SETTINGS_DIALOG_AR, SETTINGS_DIALOG_JA, SETTINGS_DIALOG_KO, SETTINGS_DIALOG_PL, SETTINGS_DIALOG_HU, SETTINGS_DIALOG_FR, SETTINGS_DIALOG_UK, SETTINGS_DIALOG_TR, SETTINGS_DIALOG_TH, SETTINGS_DIALOG_IT, SETTINGS_DIALOG_HI, SETTINGS_DIALOG_UR, SETTINGS_DIALOG_BN, };
 /** Every non-English locale this dictionary covers, keyed the same way `@jini-ai/ui`'s
  *  `SETTINGS_DIALOG_DICTIONARIES` is. */
 export const SETTINGS_DIALOG_DICTIONARIES = {

package/dist/settings/ensure-definitions.js

@@ -49,14 +49,16 @@ export async function ensureSettingDefinitions(deps, input) {
     };
     for (const def of input.definitions) {
         const existing = await resolveDefinitionRaw({ repo: deps.settingsRepo }, { namespace: target.namespace, key: def.key, workspaceId });
-        if (!existing)
+        if (!existing) {
             await registerMissingDefinition(target, def);
+            continue;
+        }
         // Core registration is once-only, but the DEFAULT is not. Without this, a
         // `defaultValue` changed in source is unreachable in any install that
         // has already booted — the stored `default_json` from first boot keeps
         // winning, for every settings-dialog tab. See `reconcileDefinitionDefault`
         // for the bug this closes.
-        else if (isReconcilableCoreSlot(existing, { ownerKind: target.ownerKind, namespace: target.namespace, key: def.key })) {
+        if (isReconcilableCoreSlot(existing, { ownerKind: target.ownerKind, namespace: target.namespace, key: def.key })) {
             await reconcileExistingCoreDefinition(target, def);
         }
     }

package/dist/settings/express/http-request.js

@@ -43,7 +43,8 @@ export function readValueMutation(body, operation) {
     const namespace = String(body.namespace ?? "");
     const key = String(body.key ?? "");
     const scope = body.scope;
-    const complete = namespace && key && SETTING_SCOPES.includes(scope) && (operation === "clear" || "valueJson" in body);
+    const hasValue = operation === "clear" || "valueJson" in body;
+    const complete = namespace && key && SETTING_SCOPES.includes(scope) && hasValue;
     return complete ? { namespace, key, scope } : null;
 }
 //# sourceMappingURL=http-request.js.map

package/dist/settings/express/http.js

@@ -177,12 +177,20 @@ export function registerSettingsRoutes(required, optional = {}) {
         const close = await openSettingsChangeStream({ request: req, response: res, workspaceId, principalId,
             changeFeed: required.changeFeed, authorize: required.authorize, permission: permissions.read, scheduler: required.scheduler,
             onClose: ({ close }) => { streams.delete(close); }, isDisposed: () => disposed }, optional);
-        if (disposed)
+        if (disposed) {
             close();
-        else if (!res.destroyed && !res.writableEnded)
+            return;
+        }
+        if (!res.destroyed && !res.writableEnded)
             streams.add(close);
     }));
-    return { dispose: () => { disposed = true; for (const close of streams)
-            close(); streams.clear(); } };
+    return {
+        dispose: () => {
+            disposed = true;
+            for (const close of streams)
+                close();
+            streams.clear();
+        },
+    };
 }
 //# sourceMappingURL=http.js.map

package/dist/settings/repo.memory.js

@@ -1,3 +1,5 @@
+/** Statuses a definition lookup can resolve to (everything but superseded rows). */
+const RESOLVABLE_STATUSES = new Set(["active", "alias", "tombstone"]);
 /**
  * @file In-memory adapter for `SettingsRepoPort` (the rule-of-two: in-memory + production adapters).
  *
@@ -45,7 +47,7 @@ export class InMemorySettingsRepo {
         return (this.definitions.find((d) => d.namespace === required.namespace &&
             d.key === required.key &&
             d.workspaceId === required.workspaceId &&
-            (d.status === "active" || d.status === "alias" || d.status === "tombstone")) ?? null);
+            RESOLVABLE_STATUSES.has(d.status)) ?? null);
     }
     async findDefinitionBySettingId(required) {
         const candidates = this.definitions.filter((d) => d.settingId === required.settingId);
@@ -122,7 +124,8 @@ export class InMemorySettingsRepo {
             v.settingId === required.settingId));
     }
     async appendRevision(record) {
-        const seq = this.nextSeq++;
+        const seq = this.nextSeq;
+        this.nextSeq += 1;
         this.revisions.push({ ...record, seq });
         return seq;
     }

package/dist/settings/settings.js

@@ -40,7 +40,8 @@ export function validateDefinitionInput(input) {
         };
     }
     // a site-owned def (workspace_id NOT NULL) may never declare the global scope bit. See docs/decisions/DR-003-settings-ledger-invariants.md.
-    if (input.workspaceId !== null && (input.scopes & SCOPE_BIT.global) !== 0) {
+    const declaresGlobalScope = (input.scopes & SCOPE_BIT.global) !== 0;
+    if (input.workspaceId !== null && declaresGlobalScope) {
         return {
             valid: false,
             error: new DefinitionInvalidError(
@@ -77,6 +78,9 @@ export function validateValueAgainstSchema(schema, value) {
             // registering feature's own write-path job — see
             // docs/decisions/settings-json-schema-variant.md.
             return true;
+        default:
+            // Unreachable for a typed schema; a stored row with an unknown type validates nothing.
+            return false;
     }
 }
 /** Identity-registry of total coercers keyed by `coercionTag`. `"identity"` is always registered. See docs/decisions/DR-003-settings-ledger-invariants.md. */

package/dist/settings/tool-registrations.js

@@ -26,6 +26,14 @@ const CROSS_PRINCIPAL_SETTINGS_READ_PERMISSION = "settings.user.read";
  * @complexity O(1); at most one `authorize()` call (none for a self-read or no-op read).
  * @overallScore 100
  */
+/** Why a dotted key did not resolve to exactly one namespace/key pair. */
+function dottedKeyMismatchMessage(matches) {
+    if (matches.length === 0) {
+        return "settings_set_value: no registered namespace/key pair matches this dotted key. Call settings_list_definitions to see valid keys; send namespace and key explicitly.";
+    }
+    const candidates = matches.map(match => `namespace=${match.namespace}, key=${match.key}`).join("; ");
+    return `settings_set_value: dotted key is ambiguous (${candidates}). Send namespace and key explicitly.`;
+}
 async function resolveOwnOrOtherPrincipalRead(routeDeps, required) {
     const { requestedPrincipalId, callerPrincipalId } = required;
     // Defaults to the CALLER, never to `undefined`. `undefined` does not mean "the caller" to
@@ -271,9 +279,7 @@ export function buildSettingsRegistrations(routeDeps) {
                 await routeDeps.settingsUiTabsReady;
                 const matches = await findDottedKeySplits(routeDeps, input.key);
                 if (matches.length !== 1)
-                    throw new ToolInputError({ message: matches.length
-                            ? `settings_set_value: dotted key is ambiguous (${matches.map(match => `namespace=${match.namespace}, key=${match.key}`).join("; ")}). Send namespace and key explicitly.`
-                            : "settings_set_value: no registered namespace/key pair matches this dotted key. Call settings_list_definitions to see valid keys; send namespace and key explicitly." });
+                    throw new ToolInputError({ message: dottedKeyMismatchMessage(matches) });
                 return { input: { ...input, ...matches[0] }, notes: ["dotted key→namespace + key"] };
             } },
     }, { unwiredToolIds: UNWIRED_SETTINGS_TOOL_IDS });

package/dist/settings/write-service.js

@@ -154,15 +154,19 @@ async function assertTargetPrincipalInWorkspace(deps, input) {
  * The caller's enclosing transaction rolls the appended revision back on conflict.
  * @complexity At most one scoped value read; no reads when the option is omitted.
  */
+/** The one stored value the write addresses, at its own scope. */
+function readAddressedValue({ repo, settingId, input }) {
+    if (input.scope === "global")
+        return repo.getGlobalValue(settingId);
+    if (input.scope === "workspace")
+        return repo.getWorkspaceValue({ workspaceId: input.workspaceId, settingId });
+    return repo.getUserValue({ workspaceId: input.workspaceId, principalId: input.principalId ?? input.callerPrincipalId, settingId });
+}
 async function assertExpectedRevision(required, optional = {}) {
     if (optional.expectedRevisionSeq === undefined)
         return;
     const { repo, settingId, input } = required;
-    const current = input.scope === "global"
-        ? await repo.getGlobalValue(settingId)
-        : input.scope === "workspace"
-            ? await repo.getWorkspaceValue({ workspaceId: input.workspaceId, settingId })
-            : await repo.getUserValue({ workspaceId: input.workspaceId, principalId: input.principalId ?? input.callerPrincipalId, settingId });
+    const current = await readAddressedValue({ repo, settingId, input });
     const actualRevisionSeq = current?.seq ?? 0;
     if (actualRevisionSeq !== optional.expectedRevisionSeq) {
         throw new SettingsRevisionConflictError({ expectedRevisionSeq: optional.expectedRevisionSeq, actualRevisionSeq });
@@ -198,7 +202,7 @@ export async function set(required, optional = {}) {
         throw new ValueValidationFailedError(`value for '${input.namespace}.${input.key}' does not match the definition schema`);
     }
     await assertTargetPrincipalInWorkspace(deps, input);
-    const result = await deps.repo.transaction(async () => {
+    return deps.repo.transaction(async () => {
         const now = kernelNowIso({ clock: deps.clock });
         const revisionSeq = await deps.repo.appendRevision({
             entityKind: "value",
@@ -246,7 +250,6 @@ export async function set(required, optional = {}) {
         }
         return { value: input.value, revisionSeq };
     });
-    return result;
 }
 /**
  * Authorize -> cleared value + revision in one transaction; the optional concurrency guard has
@@ -327,8 +330,7 @@ export async function clear(required, optional = {}) {
     };
     // `skipTransaction` means an enclosing caller already owns the boundary, so
     // this write joins it and a later failure rolls this one back too.
-    const result = input.skipTransaction ? await runClear() : await deps.repo.transaction(runClear);
-    return result;
+    return input.skipTransaction ? runClear() : deps.repo.transaction(runClear);
 }
 /**
  * — an explicit, human-invoked orchestrator: authorize

package/dist/target-scope.js

@@ -65,7 +65,8 @@ export function applyTargetScope(required, optional = {}) {
                 const target = ctx.input[param];
                 if (typeof target !== 'string')
                     throw new ToolInputError({ message: `${param} must be a string` });
-                const { [param]: _target, ...input } = ctx.input;
+                const input = { ...ctx.input };
+                delete input[param];
                 if (!scoped) {
                     if (!await required.isCurrentTarget({ target }))
                         throw new ToolInputError({ message: refuseMessage });

package/dist/text/index.d.ts

@@ -1,4 +1,6 @@
 export { sanitizeUntrustedText, stripControlSequences } from './sanitize-untrusted-text.js';
 export type { SanitizeTextOptions } from './sanitize-untrusted-text.js';
 export { escapeHtml, escapeXml } from "./escape.js";
+export { trimChars, trimCharsEnd, trimCharsStart } from "../primitives/trim-chars.js";
+export { captureLineTail } from "./line-tail.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/text/index.js

@@ -1,3 +1,5 @@
 export { sanitizeUntrustedText, stripControlSequences } from './sanitize-untrusted-text.js';
 export { escapeHtml, escapeXml } from "./escape.js";
+export { trimChars, trimCharsEnd, trimCharsStart } from "../primitives/trim-chars.js";
+export { captureLineTail } from "./line-tail.js";
 //# sourceMappingURL=index.js.map

package/dist/text/line-tail.d.ts

@@ -0,0 +1,17 @@
+/**
+ * @file A linear-time stand-in for the regex tail `\s*(.+)$` / `\s+(.+)$`. In those spellings the
+ * whitespace run and `.+` can both match the same characters, so the engine backtracks
+ * quadratically on long whitespace runs. A leaf module with no imports.
+ */
+/**
+ * Returns what `(.+)` captures when `rest` is matched against `\s{minWhitespace,}(.+)$` from its
+ * start, or null when that pattern does not match. A whitespace-only `rest` captures its final
+ * character, exactly as the greedy regex gives back one character to `.+`.
+ * @complexity O(rest length).
+ */
+export declare function captureLineTail({ rest }: {
+    rest: string;
+}, { minWhitespace }?: {
+    minWhitespace?: 0 | 1;
+}): string | null;
+//# sourceMappingURL=line-tail.d.ts.map

package/dist/text/line-tail.js

@@ -0,0 +1,25 @@
+/**
+ * @file A linear-time stand-in for the regex tail `\s*(.+)$` / `\s+(.+)$`. In those spellings the
+ * whitespace run and `.+` can both match the same characters, so the engine backtracks
+ * quadratically on long whitespace runs. A leaf module with no imports.
+ */
+/** Characters `.` does not match without the `s` flag. */
+const LINE_TERMINATOR = /[\n\r\u2028\u2029]/;
+/**
+ * Returns what `(.+)` captures when `rest` is matched against `\s{minWhitespace,}(.+)$` from its
+ * start, or null when that pattern does not match. A whitespace-only `rest` captures its final
+ * character, exactly as the greedy regex gives back one character to `.+`.
+ * @complexity O(rest length).
+ */
+export function captureLineTail({ rest }, { minWhitespace = 0 } = {}) {
+    const stripped = rest.trimStart();
+    if (stripped !== "") {
+        const leading = rest.length - stripped.length;
+        return leading >= minWhitespace && !LINE_TERMINATOR.test(stripped) ? stripped : null;
+    }
+    if (rest.length < minWhitespace + 1)
+        return null;
+    const last = rest.slice(-1);
+    return LINE_TERMINATOR.test(last) ? null : last;
+}
+//# sourceMappingURL=line-tail.js.map

package/dist/text/sanitize-untrusted-text.js

@@ -79,14 +79,16 @@ function escapeSequenceEnd(text, start) {
  */
 export function stripControlSequences({ text }) {
     let out = '';
-    for (let i = 0; i < text.length; i++) {
+    let i = 0;
+    while (i < text.length) {
         const code = text.charCodeAt(i);
         if (code === ESC) {
-            i = escapeSequenceEnd(text, i); // land on the last consumed byte; the loop's i++ steps past it
+            i = escapeSequenceEnd(text, i) + 1; // escapeSequenceEnd is the last consumed byte; step past it
             continue;
         }
         if (!isOtherControlCode(code))
             out += text[i];
+        i += 1;
     }
     return out;
 }
@@ -103,7 +105,34 @@ const DIAGNOSTIC_TOKENS = new Set([
  * @complexity O(n) in token length; pure. */
 function isIdentifierShaped({ token }) {
     return token.length <= 31 && /[a-z]/.test(token)
-        && /^(?:[a-z]{1,15}|[0-9]{1,15})(?:[-_](?:[a-z]{1,15}|[0-9]{1,15})){2,}$/.test(token);
+        && /^(?:[a-z]{1,15}|\d{1,15})(?:[-_](?:[a-z]{1,15}|\d{1,15})){2,}$/.test(token);
+}
+const isSpace = (char) => char !== undefined && /\s/.test(char);
+const LABEL_SEPARATORS = ':=';
+/** Replaces the value after a label's `:`/`=` with `[redacted]`, exactly as
+ * `match.replace(/([:=]\s*)\S+$/, '$1[redacted]')` does, without that pattern's quadratic
+ * backtracking. The value is the final non-space run; its separator is the `:`/`=` right before
+ * the spaces preceding it, else the first one inside the run. @complexity O(match length). */
+function redactLabeledValue(match) {
+    let valueStart = match.length;
+    while (valueStart > 0 && !isSpace(match[valueStart - 1]))
+        valueStart -= 1;
+    if (valueStart === match.length)
+        return match;
+    let gapStart = valueStart;
+    while (isSpace(match[gapStart - 1]))
+        gapStart -= 1;
+    const spacedSeparator = gapStart > 0 && gapStart < valueStart && LABEL_SEPARATORS.includes(match.charAt(gapStart - 1));
+    if (spacedSeparator)
+        return match.slice(0, valueStart) + '[redacted]';
+    return redactAfterInnerSeparator(match, valueStart);
+}
+function redactAfterInnerSeparator(match, valueStart) {
+    for (let i = valueStart; i < match.length - 1; i += 1) {
+        if (LABEL_SEPARATORS.includes(match.charAt(i)))
+            return match.slice(0, i + 1) + '[redacted]';
+    }
+    return match;
 }
 /** Mask credentials before preserving trusted IDs and UPPER_SNAKE diagnostics; redact opaque spans elsewhere.
  * `keepIdentifiers` additionally exempts identifier-shaped runs (see {@link isIdentifierShaped}).
@@ -113,7 +142,7 @@ function redactSecretLike({ text }, options = {}) {
     const keepOpaque = (match) => NON_SECRET_TOKEN_RE.test(match) || DIAGNOSTIC_TOKENS.has(match)
         || (options.keepIdentifiers === true && isIdentifierShaped({ token: match }));
     return redactSecrets({ input: text }, { redactPii: false, exactSecrets: options.exactSecrets ?? [] })
-        .replace(LABELED_SECRET_RE, match => match.replace(/([:=]\s*)\S+$/, '$1[redacted]'))
+        .replace(LABELED_SECRET_RE, match => redactLabeledValue(match))
         .replace(/\[REDACTED:[^\]\r\n]+\]/g, '[redacted]')
         // Trust whole dotted IDs so their components cannot become a general redaction bypass.
         .replace(/[A-Za-z0-9_-]+(?:\.[A-Za-z0-9_-]+)*/g, token => diagnosticToolIds.has(token) ? token

package/dist/tool-exposure.js

@@ -1,4 +1,4 @@
-const SAFE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+const SAFE_NAME = /^[A-Za-z_]\w{0,63}$/;
 const MAX_NAME_LENGTH = 64;
 /** A stable, non-security hash keeps transformed names independent of discovery order.
  * Collisions are still checked against the entire namespace, never trusted as unique. */
@@ -11,7 +11,7 @@ function nameHash(id) {
 function nameBase(id) {
     if (SAFE_NAME.test(id))
         return id;
-    const readable = id.replace(/[^A-Za-z0-9_]/g, '_');
+    const readable = id.replace(/\W/g, '_');
     return `tool_${readable.slice(0, 49)}_${nameHash(id)}`;
 }
 /** O(c) collision probes for c occupied alternatives; suffix space stays inside the wire limit. */
@@ -22,7 +22,8 @@ function assignName(index, id) {
     let candidate = base;
     let counter = 1;
     while (index.occupied.has(candidate)) {
-        const suffix = `_${counter++}`;
+        const suffix = `_${counter}`;
+        counter += 1;
         candidate = `${base.slice(0, MAX_NAME_LENGTH - suffix.length)}${suffix}`;
     }
     index.forward.set(id, candidate);
@@ -89,6 +90,14 @@ function pinDescriptor(descriptor) {
     }
 }
 /** Count and byte caps reject new entries without evicting any previously callable definition. */
+/** A tool that can join the snapshot (pinned), or why it is skipped. */
+function promotionCandidate(descriptor, snapshot, limits) {
+    if (!descriptor)
+        return { reason: 'not-found' };
+    const pinned = pinDescriptor(descriptor);
+    const reason = limitReason(snapshot, pinned.bytes, limits);
+    return reason ? { reason } : { pinned };
+}
 function limitReason(snapshot, bytes, limits) {
     if (snapshot.tools.length >= limits.maxTools)
         return 'tool-limit';
@@ -107,21 +116,16 @@ function promoteDescriptors(snapshot, toolIds, descriptors, names, limits) {
     for (const toolId of new Set(toolIds)) {
         if (published.has(toolId))
             continue;
-        const descriptor = available.get(toolId);
-        if (!descriptor) {
-            skipped.push({ toolId, reason: 'not-found' });
-            continue;
+        const candidate = promotionCandidate(available.get(toolId), { tools, schemaBytes, revision: snapshot.revision }, limits);
+        if ('reason' in candidate) {
+            skipped.push({ toolId, reason: candidate.reason });
         }
-        const pinned = pinDescriptor(descriptor);
-        const reason = limitReason({ tools, schemaBytes, revision: snapshot.revision }, pinned.bytes, limits);
-        if (reason) {
-            skipped.push({ toolId, reason });
-            continue;
+        else {
+            assignName(names, toolId);
+            tools.push({ wireName: names.forward.get(toolId), descriptor: candidate.pinned.descriptor });
+            schemaBytes += candidate.pinned.bytes;
+            added.push(toolId);
         }
-        assignName(names, toolId);
-        tools.push({ wireName: names.forward.get(toolId), descriptor: pinned.descriptor });
-        schemaBytes += pinned.bytes;
-        added.push(toolId);
     }
     let next = snapshot;
     if (added.length > 0)