@jini-ai/daemon 0.3.8 → 0.5.0

package/dist/terminal-session.js

@@ -12,7 +12,7 @@
  *
  * 1. **A real `node-pty`-backed `PtySpawn`.** `@jini-ai/platform` intentionally
  *    does not depend on `node-pty` (a native compiled addon); `@jini-ai/daemon`
- *    does (see this package's `package.json` and `source-map.md`'s dated
+ *    does (see this package's `package.json` and `archived provenance ledger`'s dated
  *    section for why that dependency now lives here, not in `@jini-ai/http-kit` or
  *    `@jini-ai/platform`). {@link loadRealSpawnPty} is the real, dynamically
  *    imported default the reference session manager below uses.
@@ -95,7 +95,7 @@ function toPtyProcess(pty) {
  * package (`@jini-ai/daemon`) actually declares — this is exactly the
  * resolver injection seam `spawnHelperCandidatePaths` was built for.
  */
-export async function loadRealSpawnPty() {
+export async function loadRealSpawnPty(_requiredArgs) {
     ensureSpawnHelperExecutable(spawnHelperCandidatePaths({ resolve: (specifier) => daemonRequire.resolve(specifier) }));
     const nodePty = await import('node-pty');
     return (shell, args, options) => toPtyProcess(nodePty.spawn(shell, args, options));
@@ -141,10 +141,11 @@ async function runExclusive(locks, id, fn) {
  * the kill/write/resize lock, and (via {@link createTerminalToolRegistrations})
  * `ToolExecutor` gating for creation. See module doc for the full design.
  */
-export function createTerminalSessionManager(options = {}) {
+export function createTerminalSessionManager(requiredArgs, optionalArgs = {}) {
+    const options = { ...requiredArgs, ...optionalArgs };
     const terminalService = options.terminalService ??
         createTerminalService({
-            loadSpawnPty: options.loadSpawnPty ?? loadRealSpawnPty,
+            loadSpawnPty: options.loadSpawnPty ?? (() => loadRealSpawnPty({})),
             ...(options.maxEvents !== undefined ? { maxEvents: options.maxEvents } : {}),
             ...(options.maxBufferBytes !== undefined ? { maxBufferBytes: options.maxBufferBytes } : {}),
             ...(options.exitTailBytes !== undefined ? { exitTailBytes: options.exitTailBytes } : {}),
@@ -177,7 +178,7 @@ export function createTerminalSessionManager(options = {}) {
             return null;
         return { session, meta };
     }
-    async function create(principal, createOptions) {
+    async function create({ principal, options: createOptions }) {
         const session = await terminalService.create({
             cwd: createOptions.cwd,
             ...(createOptions.cols !== undefined ? { cols: createOptions.cols } : {}),
@@ -188,11 +189,11 @@ export function createTerminalSessionManager(options = {}) {
         metadata.set(session.id, { principalId: principal.id, resourceRef, killed: false });
         return toSessionInfo(session, resourceRef);
     }
-    function get(principal, id) {
+    function get({ principal, id }) {
         const found = checkOwnership(principal, id);
         return found ? { status: 'ok', session: toSessionInfo(found.session, found.meta.resourceRef) } : { status: 'not-found' };
     }
-    function list(principal, filter = {}) {
+    function list({ principal }, { filter = {} } = {}) {
         const result = [];
         for (const session of terminalService.list()) {
             const meta = metadata.get(session.id);
@@ -209,7 +210,7 @@ export function createTerminalSessionManager(options = {}) {
         const session = terminalService.get(id);
         return session ? toSessionInfo(session, resourceRef) : null;
     }
-    async function write(principal, id, input) {
+    async function write({ principal, id, input }) {
         const found = checkOwnership(principal, id);
         if (!found)
             return { status: 'not-found' };
@@ -224,7 +225,7 @@ export function createTerminalSessionManager(options = {}) {
             return { status: 'ok', ok, session: currentSnapshot(id, meta.resourceRef) };
         });
     }
-    async function resize(principal, id, cols, rows) {
+    async function resize({ principal, id, cols, rows }) {
         const found = checkOwnership(principal, id);
         if (!found)
             return { status: 'not-found' };
@@ -237,7 +238,7 @@ export function createTerminalSessionManager(options = {}) {
             return { status: 'ok', ok, session: currentSnapshot(id, meta.resourceRef) };
         });
     }
-    async function kill(principal, id, signal) {
+    async function kill({ principal, id }, { signal } = {}) {
         const found = checkOwnership(principal, id);
         if (!found)
             return { status: 'not-found' };
@@ -252,13 +253,13 @@ export function createTerminalSessionManager(options = {}) {
             return { status: 'ok', ok, session: currentSnapshot(id, meta?.resourceRef ?? null) };
         });
     }
-    function attach(principal, id, lastEventId, sink) {
+    function attach({ principal, id, lastEventId, sink }) {
         const found = checkOwnership(principal, id);
         if (!found)
             return 'not-found';
         return terminalService.attach(id, lastEventId, sink);
     }
-    function detach(id, sink) {
+    function detach({ id, sink }) {
         terminalService.detach(id, sink);
     }
     async function shutdownActive(shutdownOptions) {
@@ -278,7 +279,8 @@ function isRecord(value) {
  * audit trail (matching `db-ops.ts`'s `createDaemonDbToolRegistrations`
  * precedent).
  */
-export function createTerminalToolRegistrations(options) {
+export function createTerminalToolRegistrations(requiredArgs, optionalArgs = {}) {
+    const options = { ...requiredArgs, ...optionalArgs };
     const { manager, policy = denyAllTerminalCreatePolicy, requiresConfirmation, timeoutMs } = options;
     const descriptorExtras = {
         ...(requiresConfirmation !== undefined ? { requiresConfirmation } : {}),
@@ -302,13 +304,13 @@ export function createTerminalToolRegistrations(options) {
                 const cols = typeof record.cols === 'number' ? record.cols : undefined;
                 const rows = typeof record.rows === 'number' ? record.rows : undefined;
                 const shell = typeof record.shell === 'string' ? record.shell : null;
-                return manager.create(ctx.principal, {
-                    resourceRef,
-                    cwd,
-                    ...(cols !== undefined ? { cols } : {}),
-                    ...(rows !== undefined ? { rows } : {}),
-                    shell,
-                });
+                return manager.create({ principal: ctx.principal, options: {
+                        resourceRef,
+                        cwd,
+                        ...(cols !== undefined ? { cols } : {}),
+                        ...(rows !== undefined ? { rows } : {}),
+                        shell,
+                    } });
             },
         },
     };

package/dist/tokens.js

@@ -12,8 +12,8 @@
  * architecture debate found it violated §2.1's "NO ... artifacts ... in the kernel" rule.
  */
 import { token } from '@jini-ai/core';
-export const RunLifecycleToken = token('jini.runLifecycle');
-export const EventLogToken = token('jini.eventLog');
-export const ToolExecutorToken = token('jini.toolExecutor');
-export const AgentExecutorToken = token('jini.agentExecutor');
+export const RunLifecycleToken = token({ id: 'jini.runLifecycle' });
+export const EventLogToken = token({ id: 'jini.eventLog' });
+export const ToolExecutorToken = token({ id: 'jini.toolExecutor' });
+export const AgentExecutorToken = token({ id: 'jini.agentExecutor' });
 //# sourceMappingURL=tokens.js.map

package/dist/tool-audit.d.ts

@@ -0,0 +1,114 @@
+import type { Principal, RunRef, SurfaceEmitter } from '@jini-ai/core';
+import type { ConfirmationDecision, ToolExecutionAuditRecord, ToolExecutionPhase, ToolExecutionResult, ToolExecutionStatus, ToolExecutor } from './tool-executor.js';
+/** The daemon vocabulary, plus attempts that never acquired an execution ID. */
+export type ToolAttemptPhase = Extract<ToolExecutionPhase, 'requested' | ToolExecutionStatus> | 'unknown-tool';
+export declare const TOOL_ATTEMPT_PHASES: readonly ["requested", "completed", "denied", "confirmation-denied", "timed-out", "cancelled", "failed", "unknown-tool"];
+export interface ToolAttemptEvent {
+    readonly attemptId: string;
+    readonly executionId: string | null;
+    readonly workspaceId: string;
+    readonly runId: string;
+    readonly toolId: string;
+    readonly principalId: string;
+    readonly phase: ToolAttemptPhase;
+    readonly at: string;
+    /** Value-free metadata; never raw input, query, output or error text. */
+    readonly detail?: string | null;
+}
+export interface ToolAttemptAuditSink {
+    append(requiredArgs: Pick<ToolAttemptEvent, "attemptId" | "executionId" | "workspaceId" | "runId" | "toolId" | "principalId" | "phase" | "at">, optionalArgs?: Pick<ToolAttemptEvent, "detail">): Promise<void>;
+}
+export interface ToolAuditDependencies {
+    readonly sink: ToolAttemptAuditSink;
+    readonly now: () => string;
+    readonly newAttemptId: () => string;
+}
+export interface ToolAuditOptions {
+    readonly onSinkError?: (error: unknown) => void;
+}
+export declare function describeInput({ input }: {
+    readonly input: unknown;
+}): string;
+export interface AuditedToolExecutor {
+    execute(args: {
+        principal: Principal;
+        run: RunRef;
+        toolId: string;
+        input: unknown;
+    }, options?: {
+        signal?: AbortSignal;
+        emitSurface?: SurfaceEmitter;
+    }): Promise<ToolExecutionResult>;
+    resumeConfirmation(args: {
+        executionId: string;
+        decision: ConfirmationDecision;
+    }): void;
+    cancel(args: {
+        executionId: string;
+    }): void;
+    getAuditRecord(args: {
+        executionId: string;
+    }): ToolExecutionAuditRecord | null;
+}
+/** Wraps the existing boundary without creating another executor or another phase vocabulary. */
+export declare function withToolAttemptAudit(deps: ToolAuditDependencies & {
+    readonly inner: ToolExecutor;
+    readonly workspaceId: string;
+    readonly readErrorId: (args: {
+        result: ToolExecutionResult;
+    }) => string | undefined;
+}, options?: ToolAuditOptions): AuditedToolExecutor;
+export declare function searchToolsAuditDetail({ query, limit, hits }: {
+    query: string;
+    limit: number | null;
+    hits: readonly {
+        id: string;
+    }[];
+}): string;
+export declare function describeToolAuditDetail({ id, entry }: {
+    id: string;
+    entry: unknown | null;
+}): string;
+export interface ToolCatalogAuditIdentity {
+    readonly workspaceId: string;
+    readonly runId: string;
+    readonly principalId: string;
+}
+export interface ToolCatalogAttemptEvent extends ToolCatalogAuditIdentity {
+    readonly toolId: string;
+    readonly detail: string;
+}
+export declare function appendToolCatalogAttempt(deps: ToolAuditDependencies & {
+    readonly event: ToolCatalogAttemptEvent;
+}, options?: ToolAuditOptions): void;
+/** Structural source port: no database or catalog-provider dependency. */
+export interface ToolCatalogAuditSource<Hit extends {
+    id: string;
+}, Entry> {
+    search(args: {
+        query: string;
+    }, options?: {
+        limit?: number;
+    }): readonly Hit[];
+    describe(args: {
+        id: string;
+    }): Entry | null;
+}
+export declare function withToolCatalogAudit<Hit extends {
+    id: string;
+}, Entry>(deps: ToolAuditDependencies & {
+    catalog: ToolCatalogAuditSource<Hit, Entry>;
+    identity: ToolCatalogAuditIdentity;
+    searchToolId: string;
+    describeToolId: string;
+}, options?: ToolAuditOptions): {
+    search({ query }: {
+        query: string;
+    }, { limit }?: {
+        limit?: number;
+    }): readonly Hit[];
+    describe({ id }: {
+        id: string;
+    }): Entry | null;
+};
+//# sourceMappingURL=tool-audit.d.ts.map

package/dist/tool-audit.js

@@ -0,0 +1,95 @@
+export const TOOL_ATTEMPT_PHASES = [
+    'requested', 'completed', 'denied', 'confirmation-denied', 'timed-out', 'cancelled', 'failed', 'unknown-tool',
+];
+function reportSinkError(error, options) {
+    // An observer's reporter is itself an observer: a throwing reporter cannot gate a tool.
+    try {
+        options.onSinkError?.(error);
+    }
+    catch { /* execution remains authoritative */ }
+}
+async function appendSafely(event, deps, options) {
+    try {
+        await deps.sink.append(event);
+    }
+    catch (error) {
+        reportSinkError(error, options);
+    }
+}
+export function describeInput({ input }) {
+    if (input === null || input === undefined)
+        return `input: ${String(input)}`;
+    if (Array.isArray(input))
+        return `input: an array of ${input.length}`;
+    if (typeof input !== 'object')
+        return `input: a ${typeof input}`;
+    try {
+        const parts = Object.entries(input).map(([key, value]) => Array.isArray(value) ? `${key}[${value.length}]` : key).sort();
+        return parts.length === 0 ? 'keys: none' : `keys: ${parts.join(', ')}`;
+    }
+    catch {
+        return 'input: an unreadable object';
+    }
+}
+/** Wraps the existing boundary without creating another executor or another phase vocabulary. */
+export function withToolAttemptAudit(deps, options = {}) {
+    return {
+        async execute({ principal, run, toolId, input }, { signal, emitSurface } = {}) {
+            const base = { attemptId: deps.newAttemptId(), workspaceId: deps.workspaceId, runId: run.id, toolId, principalId: principal.id };
+            await appendSafely({ ...base, executionId: null, phase: 'requested', at: deps.now(), detail: describeInput({ input }) }, deps, options);
+            let result;
+            try {
+                result = await deps.inner.execute({ principal, run, toolId, input }, {
+                    ...(signal === undefined ? {} : { signal }),
+                    ...(emitSurface === undefined ? {} : { emitSurface }),
+                });
+            }
+            catch (error) {
+                const phase = error instanceof Error && /unknown tool/i.test(error.message) ? 'unknown-tool' : 'failed';
+                await appendSafely({ ...base, executionId: null, phase, at: deps.now(), detail: error instanceof Error ? error.name : typeof error }, deps, options);
+                throw error;
+            }
+            let detail = result.truncated ? 'output truncated' : null;
+            // Host error-ID metadata is optional observation, never part of execution success.
+            if (detail === null) {
+                try {
+                    const id = deps.readErrorId({ result });
+                    if (id !== undefined)
+                        detail = `errorId=${id}`;
+                }
+                catch (error) {
+                    reportSinkError(error, options);
+                }
+            }
+            await appendSafely({ ...base, executionId: result.executionId, phase: result.status, at: deps.now(), detail }, deps, options);
+            return result;
+        },
+        resumeConfirmation: ({ executionId, decision }) => deps.inner.resumeConfirmation({ executionId: executionId, decision: decision }),
+        cancel: ({ executionId }) => deps.inner.cancel({ executionId }),
+        getAuditRecord: ({ executionId }) => deps.inner.getAuditRecord({ executionId: executionId }),
+    };
+}
+export function searchToolsAuditDetail({ query, limit, hits }) {
+    return JSON.stringify({ queryLength: query.length, limit, resultIds: hits.map(hit => hit.id), resultCount: hits.length });
+}
+export function describeToolAuditDetail({ id, entry }) {
+    return JSON.stringify({ id, found: entry !== null });
+}
+export function appendToolCatalogAttempt(deps, options = {}) {
+    void appendSafely({ ...deps.event, attemptId: deps.newAttemptId(), executionId: null, phase: 'completed', at: deps.now() }, deps, options);
+}
+export function withToolCatalogAudit(deps, options = {}) {
+    return {
+        search({ query }, { limit } = {}) {
+            const hits = deps.catalog.search({ query }, limit === undefined ? {} : { limit });
+            appendToolCatalogAttempt({ ...deps, event: { ...deps.identity, toolId: deps.searchToolId, detail: searchToolsAuditDetail({ query, limit: limit ?? null, hits }) } }, options);
+            return hits;
+        },
+        describe({ id }) {
+            const entry = deps.catalog.describe({ id });
+            appendToolCatalogAttempt({ ...deps, event: { ...deps.identity, toolId: deps.describeToolId, detail: describeToolAuditDetail({ id, entry }) } }, options);
+            return entry;
+        },
+    };
+}
+//# sourceMappingURL=tool-audit.js.map

package/dist/tool-executor.d.ts

@@ -85,12 +85,27 @@ export interface ToolExecutor {
      * see `@jini-ai/core`'s `SurfaceEmitter` for why a handler that waits on a human needs it.
      * @throws If `toolId` isn't registered — a routing/programming error, distinct from the denial/confirmation-denial states `ToolExecutionResult.status` covers.
      */
-    execute(principal: Principal, run: RunRef, toolId: string, input: unknown, signal?: AbortSignal, emitSurface?: SurfaceEmitter): Promise<ToolExecutionResult>;
+    execute(args: {
+        readonly principal: Principal;
+        readonly run: RunRef;
+        readonly toolId: string;
+        readonly input: unknown;
+    }, optionalArgs?: {
+        readonly signal?: AbortSignal;
+        readonly emitSurface?: SurfaceEmitter;
+    }): Promise<ToolExecutionResult>;
     /** @throws If `executionId` has no confirmation currently pending (already resumed, never required one, or unknown). */
-    resumeConfirmation(executionId: string, decision: ConfirmationDecision): void;
+    resumeConfirmation(args: {
+        readonly executionId: string;
+        readonly decision: ConfirmationDecision;
+    }): void;
     /** Aborts an in-flight handler, or resolves a still-pending confirmation as denied. No-op if `executionId` is already terminal or unknown. */
-    cancel(executionId: string): void;
-    getAuditRecord(executionId: string): ToolExecutionAuditRecord | null;
+    cancel(args: {
+        readonly executionId: string;
+    }): void;
+    getAuditRecord(args: {
+        readonly executionId: string;
+    }): ToolExecutionAuditRecord | null;
 }
 export interface CreateToolExecutorOptions {
     readonly registry: ToolRegistry;
@@ -103,15 +118,15 @@ export interface CreateToolExecutorOptions {
  * in-memory gate over a `ToolRegistry`. No persistence — a real host that
  * needs audit records to survive a restart layers a durable store behind
  * `getAuditRecord`/an append hook later; out of this task's scope (see
- * `source-map.md`).
+ * `archived provenance ledger`).
  *
  * @param options.registry - The `ToolRegistry` to resolve and authorize
- * tools against, via `@jini-ai/core/internal`'s `authorizeToolInvocation`
+ * tools against, via `@jini-ai/core/composition`'s `authorizeToolInvocation`
  * — the one and only caller of that internal export.
  * @param options.delegate - Transport-supplied authorize/confirm UI seam;
  * omit for a headless caller whose tools never need interactive gating.
  * @complexity `execute` is O(1) plus the handler's own cost; `resumeConfirmation`/`cancel`/`getAuditRecord` are O(1) map lookups.
  * @overallScore 100/100
  */
-export declare function createToolExecutor(options: CreateToolExecutorOptions): ToolExecutor;
+export declare function createToolExecutor(requiredArgs: Pick<CreateToolExecutorOptions, "registry">, optionalArgs?: Pick<CreateToolExecutorOptions, "delegate" | "now">): ToolExecutor;
 //# sourceMappingURL=tool-executor.d.ts.map

package/dist/tool-executor.js

@@ -3,7 +3,7 @@
  * §8 task 6). This is **new design work, not a port**: OD only *observes*
  * `tool_use` (`apps/daemon/src/runtimes/tool-loop-guard.ts` watches for
  * runaway repetition; it never gates a call before it runs), so there is
- * no upstream source to lift here — see `source-map.md` for the fuller
+ * no upstream source to lift here — see `archived provenance ledger` for the fuller
  * account of why and where this diverges from every other file in this
  * repo.
  *
@@ -47,7 +47,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { ToolInputError, } from '@jini-ai/core';
-import { authorizeToolInvocation } from '@jini-ai/core/internal';
+import { authorizeToolInvocation } from '@jini-ai/core/composition';
 /**
  * Enforces `maxOutputBytes` in BYTES, which is what the option is named for.
  *
@@ -74,17 +74,18 @@ function truncateOutput(output, maxOutputBytes) {
  * in-memory gate over a `ToolRegistry`. No persistence — a real host that
  * needs audit records to survive a restart layers a durable store behind
  * `getAuditRecord`/an append hook later; out of this task's scope (see
- * `source-map.md`).
+ * `archived provenance ledger`).
  *
  * @param options.registry - The `ToolRegistry` to resolve and authorize
- * tools against, via `@jini-ai/core/internal`'s `authorizeToolInvocation`
+ * tools against, via `@jini-ai/core/composition`'s `authorizeToolInvocation`
  * — the one and only caller of that internal export.
  * @param options.delegate - Transport-supplied authorize/confirm UI seam;
  * omit for a headless caller whose tools never need interactive gating.
  * @complexity `execute` is O(1) plus the handler's own cost; `resumeConfirmation`/`cancel`/`getAuditRecord` are O(1) map lookups.
  * @overallScore 100/100
  */
-export function createToolExecutor(options) {
+export function createToolExecutor(requiredArgs, optionalArgs = {}) {
+    const options = { ...requiredArgs, ...optionalArgs };
     const { registry, delegate = {} } = options;
     const now = options.now ?? Date.now;
     const audits = new Map();
@@ -140,7 +141,7 @@ export function createToolExecutor(options) {
         // to `createToolExecutor`) so a delegate that gains `onAuthorize` after construction still
         // gets consulted, matching the pre-`authorizeToolInvocation` behaviour.
         const onAuthorize = delegate.onAuthorize?.bind(delegate);
-        return authorizeToolInvocation(registry, toolId, principal, run, input, onAuthorize ? { onAuthorize } : undefined);
+        return authorizeToolInvocation({ registry: registry, toolId: toolId, principal: principal, run: run, input: input }, onAuthorize === undefined ? {} : { delegate: { onAuthorize } });
     }
     /**
      * Arms the descriptor's execution timeout, if it declares one. The returned `timedOut()` reports
@@ -173,14 +174,14 @@ export function createToolExecutor(options) {
         const errorKind = err instanceof ToolInputError ? 'validation' : 'internal';
         return { executionId, status: 'failed', error: message, errorKind };
     }
-    async function execute(principal, run, toolId, input, signal, emitSurface) {
+    async function execute({ principal, run, toolId, input }, { signal, emitSurface } = {}) {
         // Existence is checked separately from — and before — authorization so the audit record can
         // be opened before the (possibly slow, possibly throwing) authorization gate runs, matching
         // pre-authorizeToolInvocation timing: `requested` used to precede `policy.authorize`, and a
         // policy that hangs or throws used to still leave a record behind. `has()` only confirms
         // existence, never returns a handler, so this doesn't reopen the leak authorizeToolInvocation
         // closed — that gate still runs, still unconditionally, inside the call below.
-        if (!registry.has(toolId)) {
+        if (!registry.has({ toolId })) {
             throw new Error(`ToolExecutor: unknown tool "${toolId}"`);
         }
         const executionId = openAudit(principal, run, toolId);
@@ -202,7 +203,7 @@ export function createToolExecutor(options) {
                 appendEvent(executionId, 'cancelled');
                 return { executionId, status: 'cancelled' };
             }
-            onTransportAbort = () => cancel(executionId);
+            onTransportAbort = () => cancel({ executionId: executionId });
             signal.addEventListener('abort', onTransportAbort, { once: true });
         }
         // Both gates below can throw on INFRASTRUCTURE failure — a policy that rejects, a confirmation
@@ -234,7 +235,7 @@ export function createToolExecutor(options) {
             appendEvent(executionId, 'cancelled');
             return { executionId, status: 'cancelled' };
         }
-        // `registry.has(toolId)` above already confirmed the tool exists, and `ToolRegistry` is
+        // `registry.has({ toolId })` above already confirmed the tool exists, and `ToolRegistry` is
         // append-only (no unregister — see `createToolRegistry`'s doc), so `authorizeToolInvocation`
         // resolving the same `toolId` against the same `registry` cannot come back `undefined` here.
         const { descriptor } = resolved;
@@ -300,7 +301,7 @@ export function createToolExecutor(options) {
         appendEvent(executionId, 'started');
         try {
             // `emitSurface` is spread in only when the transport supplied one, so a handler can test
-            // `ctx.emitSurface` and get a truthful answer about whether a surface it emits would actually
+            // `options.emitSurface` and get a truthful answer about whether a surface it emits would actually
             // reach anybody. An always-present no-op would read as "yes" and let a handler park forever.
             const rawOutput = await handler({
                 executionId,
@@ -308,8 +309,7 @@ export function createToolExecutor(options) {
                 run,
                 input,
                 signal: controller.signal,
-                ...(emitSurface !== undefined ? { emitSurface } : {}),
-            });
+            }, { ...(emitSurface !== undefined ? { emitSurface } : {}) });
             // A handler is not OBLIGED to honour `signal` — it is handed one, not policed by one. A
             // handler that ignores it and resolves normally after the timer fired (or after `cancel`)
             // used to land here and be recorded `completed`, because the timeout/abort state was only
@@ -334,7 +334,7 @@ export function createToolExecutor(options) {
             return failureResult(executionId, err, timeout.timedOut(), controller.signal.aborted);
         }
     }
-    function resumeConfirmation(executionId, decision) {
+    function resumeConfirmation({ executionId, decision }) {
         const resolve = pendingConfirmations.get(executionId);
         if (!resolve) {
             throw new Error(`ToolExecutor: no pending confirmation for execution "${executionId}"`);
@@ -342,7 +342,7 @@ export function createToolExecutor(options) {
         pendingConfirmations.delete(executionId);
         resolve(decision);
     }
-    function cancel(executionId) {
+    function cancel({ executionId }) {
         const controller = activeControllers.get(executionId);
         if (controller) {
             controller.abort();
@@ -355,7 +355,7 @@ export function createToolExecutor(options) {
             resolve('deny');
         }
     }
-    function getAuditRecord(executionId) {
+    function getAuditRecord({ executionId }) {
         return audits.get(executionId) ?? null;
     }
     return { execute, resumeConfirmation, cancel, getAuditRecord };

package/dist/tool-result-media.d.ts

@@ -75,5 +75,7 @@ export interface ExtractResultMedia {
  * plain JSON) pass through untouched with no media.
  * @complexity O(n) in the number of content blocks.
  */
-export declare function extractResultMedia(output: unknown): ExtractResultMedia;
+export declare function extractResultMedia({ output }: {
+    readonly output: unknown;
+}): ExtractResultMedia;
 //# sourceMappingURL=tool-result-media.d.ts.map

package/dist/tool-result-media.js

@@ -58,7 +58,7 @@ function asImageBlock(block) {
  * plain JSON) pass through untouched with no media.
  * @complexity O(n) in the number of content blocks.
  */
-export function extractResultMedia(output) {
+export function extractResultMedia({ output }) {
     if (!isRecord(output))
         return { remainder: output, media: [] };
     const content = output['content'];

package/dist/tool-result-surfaces.d.ts

@@ -74,5 +74,7 @@ export interface SplitToolResultSurfaces {
  *   non-envelope value is passed through by reference with no surfaces.
  * @complexity O(n) in the number of content blocks.
  */
-export declare function splitToolResultSurfaces(output: unknown): SplitToolResultSurfaces;
+export declare function splitToolResultSurfaces({ output }: {
+    readonly output: unknown;
+}): SplitToolResultSurfaces;
 //# sourceMappingURL=tool-result-surfaces.d.ts.map

package/dist/tool-result-surfaces.js

@@ -63,7 +63,7 @@ function isRecord(value) {
  *   non-envelope value is passed through by reference with no surfaces.
  * @complexity O(n) in the number of content blocks.
  */
-export function splitToolResultSurfaces(output) {
+export function splitToolResultSurfaces({ output }) {
     if (!isRecord(output))
         return { modelOutput: output, surfaces: [] };
     const content = output['content'];