@jini-ai/daemon 0.1.0

package/dist/continuation/run-start-handler.js

@@ -0,0 +1,32 @@
+/**
+ * Builds the default `RunStartHandler`-shaped driver: resolves the real
+ * agent input via `options.resolveRunInput`, then hands it straight to
+ * `options.agentExecutor.run()`. A host wires this in as
+ * `RunHttpDeps.onStarted` (or `CreateLocalNodeDaemonConfig.onRunStarted`)
+ * instead of writing its own driver from scratch — it still owns
+ * `resolveRunInput` itself (gap 2 stays host-owned), but no longer needs to
+ * know `AgentExecutor`'s call shape or wire cancellation/journaling by hand.
+ * @param options.agentExecutor - The executor this handler drives. Any byte-journaling is the executor's own concern (see `CreateAgentExecutorOptions.journal`) — this handler does not journal directly.
+ * @param options.resolveRunInput - Host-owned composition seam — see module doc.
+ * @returns A handler structurally assignable to `@jini-ai/http`'s `RunStartHandler`.
+ * @throws Whatever `resolveRunInput` or `agentExecutor.run()` throw — `@jini-ai/http`'s `runStartRoute` already treats a rejecting `onStarted` as a failed run (finishes it, reports the internal error), so this handler deliberately does not swallow either failure itself.
+ * @complexity O(1) plus `resolveRunInput`'s and `agentExecutor.run()`'s own costs.
+ * @overallScore 100/100
+ */
+export function createDefaultRunStartHandler(options) {
+    return async (context) => {
+        const resolved = await options.resolveRunInput({
+            runId: context.run.id,
+            contextRef: context.request.contextRef,
+            ...(context.request.agentId !== undefined ? { agentId: context.request.agentId } : {}),
+        });
+        await options.agentExecutor.run({
+            runId: context.run.id,
+            agentId: resolved.agentId,
+            prompt: resolved.prompt,
+            cwd: resolved.cwd,
+            ...(resolved.env !== undefined ? { env: resolved.env } : {}),
+        });
+    };
+}
+//# sourceMappingURL=run-start-handler.js.map

package/dist/continuation/run-start-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-start-handler.js","sourceRoot":"","sources":["../../src/continuation/run-start-handler.ts"],"names":[],"mappings":"AA8DA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAA4C;IAE5C,OAAO,KAAK,EAAE,OAA8B,EAAiB,EAAE;QAC7D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC;YAC7C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACrB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;YACtC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvF,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC;YAC9B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;YACrB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/delegated-tool-bridge.d.ts

@@ -0,0 +1,53 @@
+/**
+ * `DelegatedToolBridge` — the execution path for agents/protocols that ask
+ * Jini to run a registered tool on their behalf. It is deliberately separate
+ * from ACP's `session/request_permission`: ACP authorizes an agent's *native*
+ * tool loop, whereas this bridge invokes Jini's `ToolExecutor` and therefore
+ * enforces Jini's registry policy, confirmation, timeout, cancellation, and
+ * audit trail before any registered handler runs.
+ */
+import type { Principal } from '@jini-ai/core';
+import type { RunLifecycle } from './run-lifecycle.js';
+import type { ToolExecutionResult, ToolExecutor } from './tool-executor.js';
+/** A tool request received through a Jini-owned delegated-execution protocol. */
+export interface DelegatedToolInvocation {
+    /** The already-started run that owns the request. */
+    readonly runId: string;
+    /** Stable agent-side correlation id, mirrored in run `tool_use`/`tool_result` events. */
+    readonly toolUseId: string;
+    /** Jini registry id — never an agent-vendor-specific tool name. */
+    readonly toolId: string;
+    readonly principal: Principal;
+    readonly input: unknown;
+    /** Optional transport disconnect/abort signal, combined with run cancellation. */
+    readonly signal?: AbortSignal;
+}
+export interface DelegatedToolBridge {
+    /**
+     * Emits a canonical `tool_use`, executes through `ToolExecutor`, then emits
+     * exactly one matching `tool_result`. Unknown tool ids remain programmer or
+     * routing errors from `ToolExecutor` and are rethrown after their error
+     * result is recorded.
+     */
+    execute(invocation: DelegatedToolInvocation): Promise<ToolExecutionResult>;
+}
+export interface CreateDelegatedToolBridgeOptions {
+    readonly lifecycle: RunLifecycle;
+    readonly toolExecutor: ToolExecutor;
+}
+/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
+export declare function serializeDelegatedToolOutput(output: unknown): string;
+/**
+ * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
+ * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
+ * output/failure reason. Exported so both real callers share one mapping rather than drifting.
+ */
+export declare function resultContent(result: ToolExecutionResult): string;
+/**
+ * Creates the transport-neutral bridge used by future ACP-delegate, MCP, or
+ * other host protocols. This module does not invent a server transport: a
+ * concrete protocol calls this bridge after it has decoded and authenticated a
+ * delegated tool request.
+ */
+export declare function createDelegatedToolBridge(options: CreateDelegatedToolBridgeOptions): DelegatedToolBridge;
+//# sourceMappingURL=delegated-tool-bridge.d.ts.map

package/dist/delegated-tool-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-tool-bridge.d.ts","sourceRoot":"","sources":["../src/delegated-tool-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,SAAS,EAAU,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE5E,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yFAAyF;IACzF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,mEAAmE;IACnE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,OAAO,CAAC,UAAU,EAAE,uBAAuB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC5E;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;CACrC;AAMD,sFAAsF;AACtF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CASpE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAejE;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,mBAAmB,CA8CxG"}

package/dist/delegated-tool-bridge.js

@@ -0,0 +1,92 @@
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
+export function serializeDelegatedToolOutput(output) {
+    if (typeof output === 'string')
+        return output;
+    if (output === undefined)
+        return '';
+    try {
+        const serialized = JSON.stringify(output);
+        return serialized === undefined ? String(output) : serialized;
+    }
+    catch {
+        return String(output);
+    }
+}
+/**
+ * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
+ * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
+ * output/failure reason. Exported so both real callers share one mapping rather than drifting.
+ */
+export function resultContent(result) {
+    switch (result.status) {
+        case 'completed':
+            return serializeDelegatedToolOutput(result.output);
+        case 'denied':
+            return 'Tool execution denied by policy.';
+        case 'confirmation-denied':
+            return 'Tool execution denied during confirmation.';
+        case 'timed-out':
+            return 'Tool execution timed out.';
+        case 'cancelled':
+            return 'Tool execution cancelled.';
+        case 'failed':
+            return result.error ?? 'Tool execution failed.';
+    }
+}
+/**
+ * Creates the transport-neutral bridge used by future ACP-delegate, MCP, or
+ * other host protocols. This module does not invent a server transport: a
+ * concrete protocol calls this bridge after it has decoded and authenticated a
+ * delegated tool request.
+ */
+export function createDelegatedToolBridge(options) {
+    const { lifecycle, toolExecutor } = options;
+    async function execute(invocation) {
+        const { runId, toolUseId, toolId, principal, input } = invocation;
+        await lifecycle.emit(runId, {
+            event: 'agent',
+            data: { type: 'tool_use', id: toolUseId, name: toolId, input },
+        });
+        const controller = new AbortController();
+        const unsubscribeCancel = lifecycle.onCancelRequested(runId, () => controller.abort());
+        const abortFromTransport = () => controller.abort();
+        if (invocation.signal) {
+            if (invocation.signal.aborted)
+                controller.abort();
+            else
+                invocation.signal.addEventListener('abort', abortFromTransport, { once: true });
+        }
+        const run = { id: runId };
+        try {
+            try {
+                const result = await toolExecutor.execute(principal, run, toolId, input, controller.signal);
+                await lifecycle.emit(runId, {
+                    event: 'agent',
+                    data: {
+                        type: 'tool_result',
+                        toolUseId,
+                        content: resultContent(result),
+                        ...(result.status === 'completed' ? {} : { isError: true }),
+                    },
+                });
+                return result;
+            }
+            catch (error) {
+                await lifecycle.emit(runId, {
+                    event: 'agent',
+                    data: { type: 'tool_result', toolUseId, content: errorMessage(error), isError: true },
+                });
+                throw error;
+            }
+        }
+        finally {
+            unsubscribeCancel();
+            invocation.signal?.removeEventListener('abort', abortFromTransport);
+        }
+    }
+    return { execute };
+}
+//# sourceMappingURL=delegated-tool-bridge.js.map

package/dist/delegated-tool-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-tool-bridge.js","sourceRoot":"","sources":["../src/delegated-tool-bridge.ts"],"names":[],"mappings":"AAyCA,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,4BAA4B,CAAC,MAAe;IAC1D,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAA2B;IACvD,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;QACtB,KAAK,WAAW;YACd,OAAO,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,KAAK,QAAQ;YACX,OAAO,kCAAkC,CAAC;QAC5C,KAAK,qBAAqB;YACxB,OAAO,4CAA4C,CAAC;QACtD,KAAK,WAAW;YACd,OAAO,2BAA2B,CAAC;QACrC,KAAK,WAAW;YACd,OAAO,2BAA2B,CAAC;QACrC,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,KAAK,IAAI,wBAAwB,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAyC;IACjF,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAE5C,KAAK,UAAU,OAAO,CAAC,UAAmC;QACxD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAClE,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;YAC1B,KAAK,EAAE,OAAO;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE;SAC/D,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACpD,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;;gBAC7C,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,GAAG,GAAW,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBAC5F,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;oBAC1B,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE;wBACJ,IAAI,EAAE,aAAa;wBACnB,SAAS;wBACT,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;wBAC9B,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;qBAC5D;iBACF,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;oBAC1B,KAAK,EAAE,OAAO;oBACd,IAAI,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;iBACtF,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,iBAAiB,EAAE,CAAC;YACpB,UAAU,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,CAAC"}

package/dist/event-log.d.ts

@@ -0,0 +1,134 @@
+/**
+ * `EventLog` — the durable event-log kernel port (extraction-plan §12 C1).
+ *
+ * OD's own event durability is split across three tiers today: a ~2000-event
+ * in-memory ring (`apps/daemon/src/runtimes/runs.ts` on the researched
+ * `arch/server-startserver-endgame` branch), a durable copy written into the
+ * product's own `messages.events_json` column, and a best-effort JSONL tail
+ * file that nothing ever reads back for replay. Because the durable half
+ * lives outside any port, a non-OD consumer that only wires the in-memory
+ * ring silently loses in-flight output on a long-run reload. `EventLog` is
+ * the fix: a single, storage-agnostic port that any adapter (this package's
+ * in-memory reference implementation, or `@jini-ai/sqlite`'s future durable
+ * adapter — task 8) can satisfy. Every method returns a `Promise` even
+ * though the in-memory implementation resolves synchronously, so a real
+ * persistent adapter is a drop-in swap rather than an API break
+ * (extraction-plan §2.6: "ports are async-only from day one").
+ */
+/** One durably-ordered record in a run's event log. */
+export interface EventLogEntry<Payload = unknown> {
+    /** Monotonic per-run cursor, assigned by the log — never by the caller. */
+    readonly id: string;
+    readonly event: string;
+    readonly data: Payload;
+    /** Epoch-ms wall-clock time the entry was recorded. */
+    readonly recordedAt: number;
+}
+export interface EventLogAppendInput<Payload = unknown> {
+    readonly runId: string;
+    readonly event: string;
+    readonly data: Payload;
+    /**
+     * Optional producer-supplied dedup token. Appending twice with the same
+     * `dedupeKey` for the same run returns the original entry unchanged rather
+     * than recording a second one — this is what makes at-least-once producers
+     * (a retried emit after a timeout, a driver that re-delivers on
+     * reconnect) safe to layer on top of an otherwise plain ordered log.
+     */
+    readonly dedupeKey?: string;
+}
+/**
+ * Result of `EventLog.replay`. `'ok'` and `'unknown-run'` are the two happy
+ * paths (a fresh run and a run this log has never heard of are both valid,
+ * un-exceptional states). `'replay-gap'` is the case OD's own ring buffer
+ * gets wrong today (see the module doc): the requested cursor references
+ * events that have already been evicted, so silently returning "whatever is
+ * still buffered" would hand the caller a stream with an undetectable hole
+ * in it. Making the gap a distinguishable result forces every caller
+ * (a transport reconnect handler, a test) to decide explicitly how to
+ * recover (full resync, error to the end user, etc.) instead of trusting
+ * data that looks contiguous but isn't. `'invalid-cursor'` covers a
+ * non-numeric cursor string, which is a caller/transport bug rather than a
+ * storage-shape problem and should not be conflated with a real gap.
+ */
+export type EventLogReplayResult<Payload = unknown> = {
+    readonly kind: 'ok';
+    readonly entries: readonly EventLogEntry<Payload>[];
+    /**
+     * `true` only when `afterCursor` was `null` (a first-time subscribe) AND this run's
+     * earliest entries have already been evicted, so `entries` starts after cursor 1 rather
+     * than at the true beginning. Omitted (not `false`) on every non-truncated result, so
+     * existing exact-match assertions against untruncated replays are unaffected. This does
+     * NOT make a first-time null-cursor replay a `'replay-gap'` — that would break the
+     * documented "nothing was ever promised to a caller that never asked" contract below and
+     * turn every legitimate first-time subscribe of a long-lived, intentionally-bounded run
+     * into a hard error. It exists so a caller that *cares* (a dashboard, a consumer with its
+     * own durability expectations) can distinguish "this run only ever had N events" from
+     * "this run had more, but some were evicted before I asked" instead of the two being
+     * silently indistinguishable on the wire.
+     */
+    readonly truncated?: true;
+} | {
+    readonly kind: 'replay-gap';
+    readonly requestedCursor: string;
+    /** The oldest cursor the log can still furnish, or `null` if the run's log is currently empty. */
+    readonly oldestAvailableCursor: string | null;
+} | {
+    readonly kind: 'invalid-cursor';
+    readonly requestedCursor: string;
+} | {
+    readonly kind: 'unknown-run';
+};
+/**
+ * A replayable, ordered, per-run event log. Kernel port — `@jini-ai/daemon`
+ * ships `createInMemoryEventLog` as the reference implementation; a durable
+ * adapter (`@jini-ai/sqlite`, task 8) implements the same interface.
+ */
+export interface EventLog {
+    /**
+     * Appends one event to `input.runId`'s ordered log.
+     *
+     * @returns The recorded entry (with its assigned cursor `id`), or the
+     * original entry unchanged if `input.dedupeKey` matches a prior append.
+     */
+    append<Payload>(input: EventLogAppendInput<Payload>): Promise<EventLogEntry<Payload>>;
+    /**
+     * Returns every entry recorded after `afterCursor` for `runId`, or a
+     * distinguishable non-`'ok'` result — see {@link EventLogReplayResult}.
+     * `afterCursor: null` means "from the beginning of whatever is still
+     * retained" (a first-time subscribe, not a reconnect, so a run whose
+     * earliest events were already evicted before this call is not a gap —
+     * nothing was ever promised to this caller).
+     */
+    replay(runId: string, afterCursor: string | null): Promise<EventLogReplayResult>;
+    /** Lists every run for which this log retains durable state. Used by a host at boot to rehydrate its `RunLifecycle` index. */
+    listRunIds(): Promise<readonly string[]>;
+    /** Discards all retained state for `runId` (e.g. once a terminal run's retention window has passed). */
+    drop(runId: string): Promise<void>;
+}
+export interface InMemoryEventLogOptions {
+    /**
+     * Maximum entries retained per run before the oldest are evicted. Eviction is opt-in: if
+     * omitted, retention is unbounded and nothing is ever silently dropped. Pass an explicit
+     * value only when bounded memory (or, for `@jini-ai/sqlite`, bounded disk) is a deliberate
+     * choice — the caller then owns the tradeoff, rather than inheriting a hidden 2000-entry
+     * cap OD's own in-memory ring happened to use.
+     */
+    readonly maxEntriesPerRun?: number;
+}
+/**
+ * Reference `EventLog` implementation: a per-run FIFO array, optionally capped at
+ * `maxEntriesPerRun` (opt-in — see {@link InMemoryEventLogOptions}), functionally a ring
+ * buffer once a cap is set (oldest entries evicted once the cap is exceeded) without needing
+ * an actual circular-index structure at this scale. This is the in-memory half only — no
+ * durable copy — matching this task's scope (a real persistent adapter is `@jini-ai/sqlite`'s
+ * job).
+ *
+ * @param options.maxEntriesPerRun - Retention cap per run, see {@link InMemoryEventLogOptions}.
+ * @returns An `EventLog` port implementation.
+ * @complexity `append`/`drop` are O(1) amortized (O(k) only on the eviction
+ * splice, k = entries over cap, which is normally 1). `replay` is O(n) in
+ * the number of retained entries for the run.
+ */
+export declare function createInMemoryEventLog(options?: InMemoryEventLogOptions): EventLog;
+//# sourceMappingURL=event-log.d.ts.map

package/dist/event-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-log.d.ts","sourceRoot":"","sources":["../src/event-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,uDAAuD;AACvD,MAAM,WAAW,aAAa,CAAC,OAAO,GAAG,OAAO;IAC9C,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,uDAAuD;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,GAAG,OAAO;IACpD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,oBAAoB,CAAC,OAAO,GAAG,OAAO,IAC9C;IACE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,kGAAkG;IAClG,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/C,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,WAAW,QAAQ;IACvB;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjF,8HAA8H;IAC9H,UAAU,IAAI,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IACzC,wGAAwG;IACxG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,uBAA4B,GAAG,QAAQ,CAgFtF"}

package/dist/event-log.js

@@ -0,0 +1,108 @@
+/**
+ * `EventLog` — the durable event-log kernel port (extraction-plan §12 C1).
+ *
+ * OD's own event durability is split across three tiers today: a ~2000-event
+ * in-memory ring (`apps/daemon/src/runtimes/runs.ts` on the researched
+ * `arch/server-startserver-endgame` branch), a durable copy written into the
+ * product's own `messages.events_json` column, and a best-effort JSONL tail
+ * file that nothing ever reads back for replay. Because the durable half
+ * lives outside any port, a non-OD consumer that only wires the in-memory
+ * ring silently loses in-flight output on a long-run reload. `EventLog` is
+ * the fix: a single, storage-agnostic port that any adapter (this package's
+ * in-memory reference implementation, or `@jini-ai/sqlite`'s future durable
+ * adapter — task 8) can satisfy. Every method returns a `Promise` even
+ * though the in-memory implementation resolves synchronously, so a real
+ * persistent adapter is a drop-in swap rather than an API break
+ * (extraction-plan §2.6: "ports are async-only from day one").
+ */
+/**
+ * Reference `EventLog` implementation: a per-run FIFO array, optionally capped at
+ * `maxEntriesPerRun` (opt-in — see {@link InMemoryEventLogOptions}), functionally a ring
+ * buffer once a cap is set (oldest entries evicted once the cap is exceeded) without needing
+ * an actual circular-index structure at this scale. This is the in-memory half only — no
+ * durable copy — matching this task's scope (a real persistent adapter is `@jini-ai/sqlite`'s
+ * job).
+ *
+ * @param options.maxEntriesPerRun - Retention cap per run, see {@link InMemoryEventLogOptions}.
+ * @returns An `EventLog` port implementation.
+ * @complexity `append`/`drop` are O(1) amortized (O(k) only on the eviction
+ * splice, k = entries over cap, which is normally 1). `replay` is O(n) in
+ * the number of retained entries for the run.
+ */
+export function createInMemoryEventLog(options = {}) {
+    const maxEntriesPerRun = options.maxEntriesPerRun;
+    const runs = new Map();
+    function getOrCreateRunLog(runId) {
+        let runLog = runs.get(runId);
+        if (!runLog) {
+            runLog = { entries: [], nextId: 1, dedupeIndex: new Map() };
+            runs.set(runId, runLog);
+        }
+        return runLog;
+    }
+    return {
+        async append(input) {
+            const runLog = getOrCreateRunLog(input.runId);
+            if (input.dedupeKey !== undefined) {
+                const existing = runLog.dedupeIndex.get(input.dedupeKey);
+                if (existing) {
+                    return existing;
+                }
+            }
+            const entry = {
+                id: String(runLog.nextId),
+                event: input.event,
+                data: input.data,
+                recordedAt: Date.now(),
+            };
+            runLog.nextId += 1;
+            runLog.entries.push(entry);
+            if (input.dedupeKey !== undefined) {
+                runLog.dedupeIndex.set(input.dedupeKey, entry);
+            }
+            if (maxEntriesPerRun !== undefined && runLog.entries.length > maxEntriesPerRun) {
+                runLog.entries.splice(0, runLog.entries.length - maxEntriesPerRun);
+            }
+            return entry;
+        },
+        async replay(runId, afterCursor) {
+            const runLog = runs.get(runId);
+            if (!runLog) {
+                return { kind: 'unknown-run' };
+            }
+            if (afterCursor === null) {
+                const oldest = runLog.entries[0];
+                const truncated = oldest !== undefined && Number(oldest.id) > 1;
+                return {
+                    kind: 'ok',
+                    entries: runLog.entries.slice(),
+                    ...(truncated ? { truncated: true } : {}),
+                };
+            }
+            const afterCursorNum = Number(afterCursor);
+            if (!Number.isFinite(afterCursorNum)) {
+                return { kind: 'invalid-cursor', requestedCursor: afterCursor };
+            }
+            const oldestRetained = runLog.entries[0];
+            const oldestRetainedId = oldestRetained ? Number(oldestRetained.id) : runLog.nextId;
+            if (afterCursorNum < oldestRetainedId - 1) {
+                return {
+                    kind: 'replay-gap',
+                    requestedCursor: afterCursor,
+                    oldestAvailableCursor: oldestRetained ? oldestRetained.id : null,
+                };
+            }
+            return {
+                kind: 'ok',
+                entries: runLog.entries.filter((entry) => Number(entry.id) > afterCursorNum),
+            };
+        },
+        async listRunIds() {
+            return Array.from(runs.keys()).sort();
+        },
+        async drop(runId) {
+            runs.delete(runId);
+        },
+    };
+}
+//# sourceMappingURL=event-log.js.map

package/dist/event-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-log.js","sourceRoot":"","sources":["../src/event-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAiHH;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAmC,EAAE;IAC1E,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEvC,SAAS,iBAAiB,CAAC,KAAa;QACtC,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAU,KAAmC;YACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBACzD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAkC,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,MAAM,KAAK,GAA2B;gBACpC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;aACvB,CAAC;YACF,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YACnB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAsB,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAsB,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAC/E,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,WAA0B;YACpD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YACjC,CAAC;YACD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;gBAChE,OAAO;oBACL,IAAI,EAAE,IAAI;oBACV,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE;oBAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC;YACJ,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC;YAClE,CAAC;YACD,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,gBAAgB,GAAG,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;YACpF,IAAI,cAAc,GAAG,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBAC1C,OAAO;oBACL,IAAI,EAAE,YAAY;oBAClB,eAAe,EAAE,WAAW;oBAC5B,qBAAqB,EAAE,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;iBACjE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC;aAC7E,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,UAAU;YACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAa;YACtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/frontend-capability-tools.d.ts

@@ -0,0 +1,102 @@
+/**
+ * @module frontend-capability-tools
+ *
+ * The half of frontend control that makes it *reachable*. `FrontendSessionRegistry` can route a
+ * call to the surface bound to a run, but a registry is not something an agent can call — only a
+ * registered tool is. This module projects a frontend's capability manifest into
+ * `{descriptor, handler, policy}` triples a host registers into the same `ToolRegistry` its
+ * server-side tools live in.
+ *
+ * That projection is the entire point, and it is deliberately the ONLY door. Each handler is
+ * invoked by `ToolExecutor` *after* authorization, confirmation, timeout, cancellation, output
+ * truncation and audit have already run, and its whole body is "route this call and await the
+ * answer". A route that called `registry.invoke` directly would reach the same tab having skipped
+ * every one of those, which is precisely the second, weaker execution path this layering exists to
+ * prevent. There is no reason to add one: anything that can execute a tool can execute these.
+ *
+ * **Typed structurally, not against the frontend packages.** A capability spec here is anything
+ * with an `id` and a `description` — `@jini-ai/agentic`'s `CapabilityDef` satisfies it without
+ * knowing this module exists. Importing that type would point a server package at the browser
+ * vocabulary and invert the one-way edge the engine's layering depends on; the same reasoning as
+ * `@jini-ai/core`'s `RunRef`.
+ *
+ * **Every registration carries a timeout by default.** A surface that never answers — a
+ * backgrounded tab, a closed laptop, a tab killed between the call and the reply — is the normal
+ * case here, not the exotic one, and `FrontendSessionRegistry.invoke` only rejects when its
+ * caller's signal aborts. Without a `timeoutMs` on the descriptor that signal never fires and the
+ * run waits forever, so the default is applied rather than left to each host to remember.
+ */
+import type { ToolPolicy, ToolRegistration } from '@jini-ai/core';
+import type { FrontendSessionRegistry } from './frontend-session-registry.js';
+/**
+ * Deny-by-default `ToolPolicy` for frontend capabilities, matching
+ * `terminal-session.ts`'s `denyAllTerminalCreatePolicy` and `db-ops.ts`'s `denyAllDaemonDbPolicy`.
+ *
+ * A permissive default was rejected for the same reason as those: these tools drive a real user's
+ * real screen — clicking controls, filling fields, navigating away from what they were reading —
+ * and a host must opt into that explicitly, not acquire it merely by registering a manifest.
+ */
+export declare const denyAllFrontendCapabilityPolicy: ToolPolicy;
+/**
+ * How long a handler waits for the surface before `ToolExecutor` aborts it and reports
+ * `'timed-out'`. Generous enough for a slow render or a busy main thread, short enough that a tab
+ * that is never coming back fails the tool call rather than the whole run.
+ */
+export declare const DEFAULT_FRONTEND_CAPABILITY_TIMEOUT_MS = 30000;
+/**
+ * The minimum a manifest entry must describe. Structural on purpose — see the module doc.
+ *
+ * Every field here exists on `@jini-ai/agentic`'s `CapabilityDef`, so a manifest satisfies this
+ * without conversion. The first version of this type accepted only `id`, `description`, and
+ * `requiresConfirmation` and silently dropped the rest, which made the projection **lossy**: a
+ * registered capability could no longer say what arguments it took or how dangerous it was, so
+ * nothing downstream could describe it to an agent or reason about it. Discovery cannot be correct
+ * on top of a projection that has already thrown the answer away.
+ */
+export interface FrontendCapabilitySpec {
+    readonly id: string;
+    readonly description: string;
+    /** Surfaced on the descriptor so `ToolExecutor`'s confirmation gate enforces it. */
+    readonly requiresConfirmation?: boolean;
+    /** Carried onto `ToolDescriptor.inputSchema` so a discovery surface can state the arguments. */
+    readonly inputSchema?: unknown;
+}
+/**
+ * Deliberately NOT projected yet: `CapabilityDef`'s `risk` and `surface`.
+ *
+ * They belong on whatever a discovery surface returns — `risk` labels how dangerous a capability
+ * is, and `surface` says whether "no frontend is bound" is a temporary condition or a permanent
+ * refusal, which decides whether a caller should wait or give up. But nothing reads them until
+ * that surface exists, and a public type carrying fields no code consumes is indistinguishable
+ * from one carrying fields whose consumer was deleted. They graduate here when the catalog that
+ * needs them lands, together with the decision about whether they belong on `ToolDescriptor` (and
+ * so on `ToolRegistry.list()`) or are joined from the host's manifest.
+ *
+ * A host still loses nothing today: a `CapabilityDef` satisfies {@link FrontendCapabilitySpec}
+ * structurally with those fields intact on the value it already holds.
+ */
+export interface CreateFrontendCapabilityRegistrationsOptions {
+    readonly registry: FrontendSessionRegistry;
+    /** The capabilities to expose. Ids become tool ids verbatim, so an agent names `page.click`. */
+    readonly capabilities: readonly FrontendCapabilitySpec[];
+    /** @default {@link denyAllFrontendCapabilityPolicy} — see its doc for why a permissive default was rejected. */
+    readonly policy?: ToolPolicy;
+    /** @default {@link DEFAULT_FRONTEND_CAPABILITY_TIMEOUT_MS} — see the module doc for why this is defaulted rather than optional. */
+    readonly timeoutMs?: number;
+    /** Passed through to every descriptor. Frontend output is untrusted text; a host that reads it back into a prompt should bound it. */
+    readonly maxOutputBytes?: number;
+}
+/**
+ * Builds one `ToolRegistration` per capability, each routing through `registry.invoke` on the
+ * calling run's bound surface.
+ *
+ * @param options - The registry to route through, the manifest to expose, and the gate to apply.
+ * @returns Registrations in manifest order, ready to hand to a `ToolRegistry` (or to
+ * `@jini-ai/node-host`'s `toolRegistrations` config option).
+ * @throws Never. A duplicate id is reported by `ToolRegistry.register` at registration time,
+ * naming the id — this function does not pre-empt that with a second, differently-worded error.
+ *
+ * @complexity O(n) in `capabilities`; each handler is O(1) plus the round trip to the surface.
+ */
+export declare function createFrontendCapabilityRegistrations(options: CreateFrontendCapabilityRegistrationsOptions): readonly ToolRegistration[];
+//# sourceMappingURL=frontend-capability-tools.d.ts.map

package/dist/frontend-capability-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-capability-tools.d.ts","sourceRoot":"","sources":["../src/frontend-capability-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,EAAE,UAE7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,QAAS,CAAC;AAE7D;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,4CAA4C;IAC3D,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,gGAAgG;IAChG,QAAQ,CAAC,YAAY,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACzD,gHAAgH;IAChH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,mIAAmI;IACnI,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,sIAAsI;IACtI,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAoBD;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,OAAO,EAAE,4CAA4C,GACpD,SAAS,gBAAgB,EAAE,CAkC7B"}

package/dist/frontend-capability-tools.js

@@ -0,0 +1,68 @@
+/**
+ * Deny-by-default `ToolPolicy` for frontend capabilities, matching
+ * `terminal-session.ts`'s `denyAllTerminalCreatePolicy` and `db-ops.ts`'s `denyAllDaemonDbPolicy`.
+ *
+ * A permissive default was rejected for the same reason as those: these tools drive a real user's
+ * real screen — clicking controls, filling fields, navigating away from what they were reading —
+ * and a host must opt into that explicitly, not acquire it merely by registering a manifest.
+ */
+export const denyAllFrontendCapabilityPolicy = {
+    authorize: () => 'deny',
+};
+/**
+ * How long a handler waits for the surface before `ToolExecutor` aborts it and reports
+ * `'timed-out'`. Generous enough for a slow render or a busy main thread, short enough that a tab
+ * that is never coming back fails the tool call rather than the whole run.
+ */
+export const DEFAULT_FRONTEND_CAPABILITY_TIMEOUT_MS = 30_000;
+/**
+ * Normalizes a tool's `unknown` input into the record `FrontendSessionRegistry.invoke` takes.
+ *
+ * A missing input is `{}` — several capabilities legitimately take no arguments, and forcing a
+ * caller to send an empty object to use them would be noise. Anything else non-object is a caller
+ * error reported by name, not silently coerced into `{}`, which would turn "you sent a string"
+ * into the much more confusing "the capability says a required field is missing".
+ */
+function toCapabilityInput(capabilityId, input) {
+    if (input === undefined || input === null)
+        return {};
+    if (typeof input !== 'object' || Array.isArray(input)) {
+        throw new Error(`${capabilityId}: input must be a JSON object, received ${Array.isArray(input) ? 'array' : typeof input}`);
+    }
+    return input;
+}
+/**
+ * Builds one `ToolRegistration` per capability, each routing through `registry.invoke` on the
+ * calling run's bound surface.
+ *
+ * @param options - The registry to route through, the manifest to expose, and the gate to apply.
+ * @returns Registrations in manifest order, ready to hand to a `ToolRegistry` (or to
+ * `@jini-ai/node-host`'s `toolRegistrations` config option).
+ * @throws Never. A duplicate id is reported by `ToolRegistry.register` at registration time,
+ * naming the id — this function does not pre-empt that with a second, differently-worded error.
+ *
+ * @complexity O(n) in `capabilities`; each handler is O(1) plus the round trip to the surface.
+ */
+export function createFrontendCapabilityRegistrations(options) {
+    const { registry, capabilities, policy = denyAllFrontendCapabilityPolicy, timeoutMs = DEFAULT_FRONTEND_CAPABILITY_TIMEOUT_MS, maxOutputBytes, } = options;
+    return capabilities.map((capability) => ({
+        descriptor: {
+            id: capability.id,
+            description: capability.description,
+            timeoutMs,
+            ...(capability.requiresConfirmation !== undefined
+                ? { requiresConfirmation: capability.requiresConfirmation }
+                : {}),
+            // Absent rather than `undefined`: a descriptor that *has* an `inputSchema` key holding
+            // `undefined` is indistinguishable from one describing a schemaless tool once serialized,
+            // and a catalog would render "takes no arguments" for a capability that takes several.
+            ...(capability.inputSchema !== undefined ? { inputSchema: capability.inputSchema } : {}),
+            ...(maxOutputBytes !== undefined ? { maxOutputBytes } : {}),
+        },
+        policy,
+        // `ctx.signal` is `ToolExecutor`'s own timeout/cancel signal, so the descriptor's `timeoutMs`
+        // and a cancelled run both reach the pending invocation without this module owning a timer.
+        handler: async (ctx) => registry.invoke(ctx.run.id, capability.id, toCapabilityInput(capability.id, ctx.input), ctx.signal),
+    }));
+}
+//# sourceMappingURL=frontend-capability-tools.js.map

package/dist/frontend-capability-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"frontend-capability-tools.js","sourceRoot":"","sources":["../src/frontend-capability-tools.ts"],"names":[],"mappings":"AA+BA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAe;IACzD,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM;CACxB,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,MAAM,CAAC;AAgD7D;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,KAAc;IAC7D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,2CAA2C,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE,CAC1G,CAAC;IACJ,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qCAAqC,CACnD,OAAqD;IAErD,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,MAAM,GAAG,+BAA+B,EACxC,SAAS,GAAG,sCAAsC,EAClD,cAAc,GACf,GAAG,OAAO,CAAC;IAEZ,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACvC,UAAU,EAAE;YACV,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,SAAS;YACT,GAAG,CAAC,UAAU,CAAC,oBAAoB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,oBAAoB,EAAE,UAAU,CAAC,oBAAoB,EAAE;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,uFAAuF;YACvF,0FAA0F;YAC1F,uFAAuF;YACvF,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D;QACD,MAAM;QACN,8FAA8F;QAC9F,4FAA4F;QAC5F,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CACrB,QAAQ,CAAC,MAAM,CACb,GAAG,CAAC,GAAG,CAAC,EAAE,EACV,UAAU,CAAC,EAAE,EACb,iBAAiB,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,EAC3C,GAAG,CAAC,MAAM,CACX;KACJ,CAAC,CAAC,CAAC;AACN,CAAC"}