@jini-ai/daemon 0.6.12 → 0.6.15-rc.1

package/dist/store/event-log/sqlite-policy.js

@@ -0,0 +1,74 @@
+/**
+ * Default per-run retention cap applied when `SqliteEventLogOptions.maxEntriesPerRun` is
+ * omitted — see that option's doc for why a durable adapter defaults to a bound instead of
+ * mirroring the in-memory reference adapter's unbounded-by-default behavior.
+ */
+export const DEFAULT_MAX_ENTRIES_PER_RUN = 2000;
+/** @internal Validates and resolves `options.maxEntriesPerRun`, applying the documented default. */
+export function resolveMaxEntriesPerRun(value) {
+    if (value === undefined)
+        return DEFAULT_MAX_ENTRIES_PER_RUN;
+    if (!Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`createSqliteEventLog: options.maxEntriesPerRun must be a non-negative safe integer, got ${value}`);
+    }
+    return value;
+}
+/** @internal Validates a `replay(runId, afterCursor)` cursor. `null` ("from the beginning") is always valid. */
+export function assertValidReplayCursor(afterCursor) {
+    if (afterCursor === null)
+        return;
+    const n = Number(afterCursor);
+    if (!Number.isSafeInteger(n) || n < 0) {
+        throw new Error(`createSqliteEventLog: invalid replay cursor ${JSON.stringify(afterCursor)} — must be a non-negative safe integer string`);
+    }
+}
+/** Decode the persisted JSON boundary while preserving the original cursor and timestamp. */
+export function rowToEntry(row) {
+    return {
+        id: String(row.cursor),
+        event: row.event,
+        data: JSON.parse(row.data),
+        recordedAt: row.recorded_at,
+    };
+}
+/** Resolve an existing row without writes; legacy retries do not serialize the new payload. */
+export function existingAppendResult({ row, input }, options = {}) {
+    if (options.detectConflicts && (row.event !== input.event || row.data !== JSON.stringify(input.data ?? null))) {
+        return { kind: 'conflict' };
+    }
+    return { kind: 'existing', entry: rowToEntry(row) };
+}
+/** Decide replay status before loading payloads, keeping a replay gap to indexed lookups only. */
+export function replayResult({ run, oldest, afterCursor }) {
+    if (afterCursor === null) {
+        const truncated = oldest !== undefined && oldest.cursor > 1;
+        return { kind: 'ok', entries: [], ...(truncated ? { truncated: true } : {}) };
+    }
+    const oldestRetainedId = oldest ? oldest.cursor : run.next_cursor;
+    if (Number(afterCursor) < oldestRetainedId - 1) {
+        return { kind: 'replay-gap', requestedCursor: afterCursor, oldestAvailableCursor: oldest ? String(oldest.cursor) : null };
+    }
+    return { kind: 'ok', entries: [] };
+}
+/** Owner's DDL for both automatic setup and host-managed migrations; no schema fork. */
+export const SQLITE_EVENT_LOG_SCHEMA = `
+    CREATE TABLE IF NOT EXISTS jini_event_log_runs (
+      run_id TEXT PRIMARY KEY,
+      next_cursor INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS jini_event_log_entries (
+      run_id TEXT NOT NULL,
+      cursor INTEGER NOT NULL,
+      event TEXT NOT NULL,
+      data TEXT NOT NULL,
+      recorded_at INTEGER NOT NULL,
+      dedupe_key TEXT,
+      PRIMARY KEY (run_id, cursor)
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_jini_event_log_entries_dedupe
+      ON jini_event_log_entries (run_id, dedupe_key)
+      WHERE dedupe_key IS NOT NULL;
+`;
+//# sourceMappingURL=sqlite-policy.js.map

package/dist/store/event-log/sqlite.d.ts

@@ -1,4 +1,3 @@
-import { type Clock } from '@jini-ai/core/primitives';
 /**
  * `createSqliteEventLog` — the durable `EventLog` adapter (extraction-plan §8 task 8,
  * §2.6: "`@jini-ai/daemon/store/event-log/sqlite` is the default adapter... an adapter conformance suite covers
@@ -23,35 +22,12 @@ import { type Clock } from '@jini-ai/core/primitives';
  * adapter preserves its existing bounded SQL/schema behavior rather than adding a hidden archive.
  */
 import { type SqliteDb, type SqliteSyncOpener } from '@jini-ai/db/sqlite';
-import type { EventLog } from '@jini-ai/protocol';
+import { type SqliteEventLogOptions, type SqliteEventLogWithReceipts } from './sqlite-policy.js';
+export { DEFAULT_MAX_ENTRIES_PER_RUN, SQLITE_EVENT_LOG_SCHEMA } from './sqlite-policy.js';
+export type { SqliteEventLog, SqliteEventLogOptions, SqliteEventLogWithReceipts, SqliteEventLogDatabase, SqliteEventLogAppendOptions, SqliteEventLogAppendResult, } from './sqlite-policy.js';
+export { createKernelSqliteEventLog } from './sqlite-kernel.js';
 /**
- * Default per-run retention cap applied when `SqliteEventLogOptions.maxEntriesPerRun` is
- * omitted — see that option's doc for why a durable adapter defaults to a bound instead of
- * mirroring the in-memory reference adapter's unbounded-by-default behavior.
- */
-export declare const DEFAULT_MAX_ENTRIES_PER_RUN = 2000;
-export interface SqliteEventLogOptions {
-    /**
-     * Maximum entries retained per run before the oldest are evicted. Defaults to
-     * {@link DEFAULT_MAX_ENTRIES_PER_RUN} (2000) when omitted — unlike the in-memory reference
-     * adapter (`@jini-ai/daemon`'s `createInMemoryEventLog`), where an omitted cap means unbounded,
-     * a durable on-disk store defaults to a bounded retention window because unbounded persistent
-     * growth is a real, unattended operational risk (disk exhaustion across long-lived runs) in a
-     * way an in-process, GC'd, process-lifetime-bounded structure is not. Pass an explicit value
-     * (larger, smaller, or `0`) to override the default in either direction — the caller then
-     * owns that tradeoff explicitly. Must be a non-negative safe integer; anything else (negative,
-     * fractional, `NaN`, `Infinity`) throws at construction time.
-     */
-    readonly maxEntriesPerRun?: number;
-    /** Core Clock for durable recordedAt values; omitted clock preserves system wall time. */
-    readonly clock?: Clock;
-}
-/** A `@jini-ai/daemon` `EventLog` backed by a `better-sqlite3` database, plus a `close()` to release the file handle. */
-export interface SqliteEventLog extends EventLog {
-    close(_args: Record<string, never>): Promise<void>;
-}
-/**
- * Borrows the caller's connection and ensures the dedicated event-log schema idempotently.
+ * Borrows the caller's connection; ensures schema unless schemaSetup is 'host'.
  * Closing this adapter never closes a borrowed handle or changes its pragmas.
  * Use openSqliteEventLog with an explicit file/opener to acquire an owned connection.
  * @throws Host SQL/setup failures, or a missing borrowed connection.
@@ -59,7 +35,7 @@ export interface SqliteEventLog extends EventLog {
  */
 export declare function createSqliteEventLog(input: {
     db: SqliteDb;
-}, options?: SqliteEventLogOptions): SqliteEventLog;
+}, options?: SqliteEventLogOptions): SqliteEventLogWithReceipts;
 /**
  * Acquires a connection through the host opener; setup failure closes that connection.
  * Successful close is idempotent and closes only this owned handle.
@@ -71,5 +47,5 @@ export declare function createSqliteEventLog(input: {
 export declare function openSqliteEventLog(input: {
     file: string;
     open: SqliteSyncOpener;
-}, options?: SqliteEventLogOptions): SqliteEventLog;
+}, options?: SqliteEventLogOptions): SqliteEventLogWithReceipts;
 //# sourceMappingURL=sqlite.d.ts.map

package/dist/store/event-log/sqlite.js

@@ -23,40 +23,11 @@ import { createSystemClock } from '@jini-ai/core/primitives';
  * adapter preserves its existing bounded SQL/schema behavior rather than adding a hidden archive.
  */
 import { openSqliteConnection } from '@jini-ai/db/sqlite';
+import { resolveMaxEntriesPerRun, assertValidReplayCursor, existingAppendResult, replayResult, rowToEntry, SQLITE_EVENT_LOG_SCHEMA, } from './sqlite-policy.js';
+export { DEFAULT_MAX_ENTRIES_PER_RUN, SQLITE_EVENT_LOG_SCHEMA } from './sqlite-policy.js';
+export { createKernelSqliteEventLog } from './sqlite-kernel.js';
 /**
- * Default per-run retention cap applied when `SqliteEventLogOptions.maxEntriesPerRun` is
- * omitted — see that option's doc for why a durable adapter defaults to a bound instead of
- * mirroring the in-memory reference adapter's unbounded-by-default behavior.
- */
-export const DEFAULT_MAX_ENTRIES_PER_RUN = 2000;
-/** @internal Validates and resolves `options.maxEntriesPerRun`, applying the documented default. */
-function resolveMaxEntriesPerRun(value) {
-    if (value === undefined)
-        return DEFAULT_MAX_ENTRIES_PER_RUN;
-    if (!Number.isSafeInteger(value) || value < 0) {
-        throw new Error(`createSqliteEventLog: options.maxEntriesPerRun must be a non-negative safe integer, got ${value}`);
-    }
-    return value;
-}
-/** @internal Validates a `replay(runId, afterCursor)` cursor. `null` ("from the beginning") is always valid. */
-function assertValidReplayCursor(afterCursor) {
-    if (afterCursor === null)
-        return;
-    const n = Number(afterCursor);
-    if (!Number.isSafeInteger(n) || n < 0) {
-        throw new Error(`createSqliteEventLog: invalid replay cursor ${JSON.stringify(afterCursor)} — must be a non-negative safe integer string`);
-    }
-}
-function rowToEntry(row) {
-    return {
-        id: String(row.cursor),
-        event: row.event,
-        data: JSON.parse(row.data),
-        recordedAt: row.recorded_at,
-    };
-}
-/**
- * Borrows the caller's connection and ensures the dedicated event-log schema idempotently.
+ * Borrows the caller's connection; ensures schema unless schemaSetup is 'host'.
  * Closing this adapter never closes a borrowed handle or changes its pragmas.
  * Use openSqliteEventLog with an explicit file/opener to acquire an owned connection.
  * @throws Host SQL/setup failures, or a missing borrowed connection.
@@ -98,30 +69,12 @@ export function openSqliteEventLog(input, options = {}) {
         throw error;
     }
 }
-/** Binds the unchanged cursor/dedupe/retention SQL to a borrowed synchronous connection. */
+/** Binds event-log policies to a borrowed synchronous connection and its atomic transactions. */
 function bindSqliteEventLog(db, options) {
     const maxEntriesPerRun = resolveMaxEntriesPerRun(options.maxEntriesPerRun);
     const clock = options.clock ?? createSystemClock();
-    db.exec(`
-    CREATE TABLE IF NOT EXISTS jini_event_log_runs (
-      run_id TEXT PRIMARY KEY,
-      next_cursor INTEGER NOT NULL
-    );
-
-    CREATE TABLE IF NOT EXISTS jini_event_log_entries (
-      run_id TEXT NOT NULL,
-      cursor INTEGER NOT NULL,
-      event TEXT NOT NULL,
-      data TEXT NOT NULL,
-      recorded_at INTEGER NOT NULL,
-      dedupe_key TEXT,
-      PRIMARY KEY (run_id, cursor)
-    );
-
-    CREATE INDEX IF NOT EXISTS idx_jini_event_log_entries_dedupe
-      ON jini_event_log_entries (run_id, dedupe_key)
-      WHERE dedupe_key IS NOT NULL;
-  `);
+    if (options.schemaSetup !== 'host')
+        db.exec(SQLITE_EVENT_LOG_SCHEMA);
     const getRunStmt = db.prepare('SELECT run_id, next_cursor FROM jini_event_log_runs WHERE run_id = ?');
     const insertRunStmt = db.prepare('INSERT INTO jini_event_log_runs (run_id, next_cursor) VALUES (?, ?)');
     const updateNextCursorStmt = db.prepare('UPDATE jini_event_log_runs SET next_cursor = ? WHERE run_id = ?');
@@ -144,66 +97,45 @@ function bindSqliteEventLog(db, options) {
     // returned `Transaction` type is non-generic), so this runs on `unknown` payloads and the
     // public `append<Payload>` method below casts at the boundary — the same pattern
     // `createInMemoryEventLog` uses for its dedupe-hit early return.
-    const appendTxn = db.transaction((input) => {
+    const appendTxn = db.transaction((input, options) => {
+        if (options.dedupeKey !== undefined) {
+            const existing = getByDedupeStmt.get(input.runId, options.dedupeKey);
+            if (existing)
+                return existingAppendResult({ row: existing, input }, options);
+        }
+        if (options.retentionPolicy === 'reject' && countEntriesStmt.get(input.runId).count >= maxEntriesPerRun) {
+            return { kind: 'capacity-exceeded', maxEntriesPerRun };
+        }
         let runRow = getRunStmt.get(input.runId);
         if (!runRow) {
             insertRunStmt.run(input.runId, 1);
             runRow = { run_id: input.runId, next_cursor: 1 };
         }
-        if (input.dedupeKey !== undefined) {
-            const existing = getByDedupeStmt.get(input.runId, input.dedupeKey);
-            if (existing) {
-                return rowToEntry(existing);
-            }
-        }
         const cursor = runRow.next_cursor;
         const recordedAt = clock.nowMs();
-        insertEntryStmt.run(input.runId, cursor, input.event, JSON.stringify(input.data ?? null), recordedAt, input.dedupeKey ?? null);
+        insertEntryStmt.run(input.runId, cursor, input.event, JSON.stringify(input.data ?? null), recordedAt, options.dedupeKey ?? null);
         updateNextCursorStmt.run(cursor + 1, input.runId);
         const { count } = countEntriesStmt.get(input.runId);
         if (count > maxEntriesPerRun) {
             evictOldestStmt.run(input.runId, input.runId, count - maxEntriesPerRun);
         }
-        return {
-            id: String(cursor),
-            event: input.event,
-            data: input.data,
-            recordedAt,
-        };
+        return { kind: 'inserted', entry: { id: String(cursor), event: input.event, data: input.data, recordedAt } };
     });
     function replaySync(runId, afterCursor) {
         // Validated up front, independent of whether `runId` is known: a malformed cursor is a
         // caller/transport bug regardless of run state, so it throws rather than being folded into
         // (or masked by) an `'unknown-run'`/`'replay-gap'` result.
         assertValidReplayCursor(afterCursor);
-        const runRow = getRunStmt.get(runId);
-        if (!runRow) {
+        const run = getRunStmt.get(runId);
+        if (!run)
             return { kind: 'unknown-run' };
-        }
-        if (afterCursor === null) {
-            const oldestRow = selectOldestStmt.get(runId);
-            const truncated = oldestRow !== undefined && oldestRow.cursor > 1;
-            return {
-                kind: 'ok',
-                entries: selectAllStmt.all(runId).map(rowToEntry),
-                ...(truncated ? { truncated: true } : {}),
-            };
-        }
+        const oldest = selectOldestStmt.get(runId);
+        const result = replayResult({ run, oldest, afterCursor });
+        if (result.kind !== 'ok')
+            return result;
         // Safe: assertValidReplayCursor already proved this parses to a non-negative safe integer.
-        const afterCursorNum = Number(afterCursor);
-        const oldestRow = selectOldestStmt.get(runId);
-        const oldestRetainedId = oldestRow ? oldestRow.cursor : runRow.next_cursor;
-        if (afterCursorNum < oldestRetainedId - 1) {
-            return {
-                kind: 'replay-gap',
-                requestedCursor: afterCursor,
-                oldestAvailableCursor: oldestRow ? String(oldestRow.cursor) : null,
-            };
-        }
-        return {
-            kind: 'ok',
-            entries: selectAfterStmt.all(runId, afterCursorNum).map(rowToEntry),
-        };
+        const rows = afterCursor === null ? selectAllStmt.all(runId) : selectAfterStmt.all(runId, Number(afterCursor));
+        return { ...result, entries: rows.map(rowToEntry) };
     }
     const dropTxn = db.transaction((runId) => {
         deleteRunEntriesStmt.run(runId);
@@ -211,7 +143,12 @@ function bindSqliteEventLog(db, options) {
     });
     return {
         async append(input, options = {}) {
-            return appendTxn({ ...input, dedupeKey: options.dedupeKey });
+            // Forwarding only dedupeKey guarantees an inserted/existing receipt, never a refusal.
+            const result = appendTxn(input, options.dedupeKey === undefined ? {} : { dedupeKey: options.dedupeKey });
+            return result.entry;
+        },
+        async appendWithResult(input, options = {}) {
+            return appendTxn(input, options);
         },
         async replay({ runId, afterCursor }) {
             return replaySync(runId, afterCursor);

package/dist/tool-recovery/analytics.d.ts

@@ -0,0 +1,27 @@
+import type { ToolExecutor } from "../tool-executor.js";
+import { type IsRegisteredTool } from "./observability.js";
+/** The one `ProductAnalyticsPort` method this decorator calls. */
+export interface ToolCallAnalytics {
+    capture(event: {
+        name: string;
+        userId: string;
+        properties?: Readonly<Record<string, string | number | boolean>>;
+    }): void;
+}
+export declare const TOOL_CALL_EVENT = "tool_call";
+/**
+ * Wraps `inner` so each `execute` emits one {@link TOOL_CALL_EVENT}: `tool_id` (or the fixed
+ * unregistered label), `outcome` (the settled status, or `threw`), `failed`, and `error_kind` for a
+ * failure, as `userId` = the principal's pseudonymous id. No input, output or error text is sent.
+ * @param required The executor and the analytics port slice.
+ * @param optional `isRegisteredTool`: the host's registry check (same rule as the observability decorator).
+ * @returns A drop-in `ToolExecutor`; results and throws pass through unchanged.
+ * @complexity O(1) beyond `inner`'s own cost.
+ */
+export declare function withToolCallAnalytics({ inner, analytics }: {
+    inner: ToolExecutor;
+    analytics: ToolCallAnalytics;
+}, { isRegisteredTool }?: {
+    isRegisteredTool?: IsRegisteredTool;
+}): ToolExecutor;
+//# sourceMappingURL=analytics.d.ts.map

package/dist/tool-recovery/analytics.js

@@ -0,0 +1,38 @@
+import { pseudonymousUserId, toolCallLabel } from "./observability.js";
+export const TOOL_CALL_EVENT = "tool_call";
+/**
+ * Wraps `inner` so each `execute` emits one {@link TOOL_CALL_EVENT}: `tool_id` (or the fixed
+ * unregistered label), `outcome` (the settled status, or `threw`), `failed`, and `error_kind` for a
+ * failure, as `userId` = the principal's pseudonymous id. No input, output or error text is sent.
+ * @param required The executor and the analytics port slice.
+ * @param optional `isRegisteredTool`: the host's registry check (same rule as the observability decorator).
+ * @returns A drop-in `ToolExecutor`; results and throws pass through unchanged.
+ * @complexity O(1) beyond `inner`'s own cost.
+ */
+export function withToolCallAnalytics({ inner, analytics }, { isRegisteredTool } = {}) {
+    const emit = ({ principal, toolId }, properties) => {
+        try {
+            analytics.capture({ name: TOOL_CALL_EVENT, userId: pseudonymousUserId({ principal }), properties: { tool_id: toolCallLabel({ toolId }, { isRegisteredTool }), ...properties } });
+        }
+        catch { /* analytics never fails a tool call */ }
+    };
+    return {
+        execute: async ({ principal, run, toolId, input }, { signal, emitSurface } = {}) => {
+            let result;
+            try {
+                result = await inner.execute({ principal, run, toolId, input }, { ...(signal === undefined ? {} : { signal }), ...(emitSurface === undefined ? {} : { emitSurface }) });
+            }
+            catch (error) {
+                emit({ principal, toolId }, { outcome: "threw", failed: true });
+                throw error;
+            }
+            const failed = result.status === "failed" || result.status === "timed-out";
+            emit({ principal, toolId }, { outcome: result.status, failed, ...(result.status === "failed" ? { error_kind: result.errorKind ?? "internal" } : {}) });
+            return result;
+        },
+        resumeConfirmation: (args) => inner.resumeConfirmation(args),
+        cancel: (args) => inner.cancel(args),
+        getAuditRecord: (args) => inner.getAuditRecord(args),
+    };
+}
+//# sourceMappingURL=analytics.js.map

package/dist/tool-recovery/index.d.ts

@@ -3,4 +3,6 @@ export * from "./recovery.js";
 export * from "./redaction.js";
 export * from "./stack.js";
 export * from "./federated-refusal.js";
+export * from "./observability.js";
+export * from "./analytics.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/tool-recovery/index.js

@@ -3,4 +3,6 @@ export * from "./recovery.js";
 export * from "./redaction.js";
 export * from "./stack.js";
 export * from "./federated-refusal.js";
+export * from "./observability.js";
+export * from "./analytics.js";
 //# sourceMappingURL=index.js.map

package/dist/tool-recovery/observability.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @file Every tool call as one observed operation. The executor is the one chokepoint every
+ * delegated, BYOK and visitor tool call already passes through, so instrumenting it here covers
+ * them all without touching a single tool handler or route.
+ *
+ * The port is taken structurally ({@link ToolCallObservability}), not imported: this package does not
+ * depend on `@jini-ai/diagnostics`, and `ObservabilityPort` satisfies the slice as-is. That keeps the
+ * daemon free of any observability vendor AND of the diagnostics package; the host composes them.
+ * A host whose telemetry is off should not wrap at all (diagnostics' `isNoopObservabilityPort`), so
+ * a disabled install keeps its exact executor object and pays no wrapper frame.
+ */
+import { type Principal } from "@jini-ai/core";
+import type { ToolExecutor } from "../tool-executor.js";
+type Attributes = Readonly<Record<string, string | number>>;
+/** The two `ObservabilityPort` methods this decorator calls; the port itself satisfies it. */
+export interface ToolCallObservability {
+    trackOperation(input: {
+        name: string;
+        attributes?: Attributes;
+    }): {
+        run<T>(fn: () => T): T;
+        end(outcome: {
+            outcome: string;
+            failed: boolean;
+            attributes?: Attributes;
+        }): void;
+    };
+    reportError(report: {
+        error: unknown;
+        context: {
+            operation: string;
+            attributes?: Attributes;
+        };
+    }): void;
+}
+export declare const TOOL_CALL_OPERATION = "tool.call";
+/** The settled result's text as an Error, so an error tracker gets a type to group on. The text is
+ * whatever the inner stack left (the host's `withRedactedToolFailures` has already blanked secrets);
+ * adapters redact again regardless. */
+export declare class ToolExecutionFailure extends Error {
+    readonly name = "ToolExecutionFailure";
+}
+/** The `tool.id` label for an id nobody registered. Observation starts before the registry has looked
+ * the id up, and a delegated request can carry any string there, a pasted key included (review
+ * 2026-10-25 #1): an unregistered id is never exported, only this fixed label. */
+export declare const UNREGISTERED_TOOL_LABEL = "unregistered";
+/** Host check, when it has one: is this id a tool the registry knows? */
+export type IsRegisteredTool = (input: {
+    toolId: string;
+}) => boolean;
+export declare function toolCallLabel({ toolId }: {
+    toolId: string;
+}, { isRegisteredTool }: {
+    isRegisteredTool?: IsRegisteredTool | undefined;
+}): string;
+/** WHO did it, as the principal's opaque id (owner 2026-10-25). Pseudonymous only: an id that looks
+ * like an e-mail address or carries a secret shape is replaced, never exported. */
+export declare const UNIDENTIFIED_USER_LABEL = "unidentified";
+export declare function pseudonymousUserId({ principal }: {
+    principal: Principal;
+}): string;
+/**
+ * Wraps `inner` so each `execute` is one `tool.call` operation: `tool.id` (or the fixed
+ * {@link UNREGISTERED_TOOL_LABEL}), `agent.run.id` and `user.id` (the principal, pseudonymous) at start,
+ * the settled status as outcome, `tool.error_kind` (`validation` vs `internal`) for a failure, and
+ * the duration the adapter measures between start and end. Execution errors (an internal failure, a
+ * timeout, a non-input throw) also go through `reportError`, inside the operation's scope so trace
+ * adapters attach them to its span. A validation failure is NOT reported: it is the caller (usually
+ * the model) sending bad input — counted on the operation, but not an incident to page anyone for.
+ * @param required The executor and the observability port slice.
+ * @param optional `isRegisteredTool`: the host's registry check; without it only the id's shape is checked.
+ * @returns A drop-in `ToolExecutor`; results and throws pass through unchanged; other methods delegate.
+ * @complexity O(1) beyond `inner`'s own cost.
+ */
+export declare function withToolCallObservability({ inner, observability }: {
+    inner: ToolExecutor;
+    observability: ToolCallObservability;
+}, { isRegisteredTool }?: {
+    isRegisteredTool?: IsRegisteredTool;
+}): ToolExecutor;
+export {};
+//# sourceMappingURL=observability.d.ts.map

package/dist/tool-recovery/observability.js

@@ -0,0 +1,88 @@
+/**
+ * @file Every tool call as one observed operation. The executor is the one chokepoint every
+ * delegated, BYOK and visitor tool call already passes through, so instrumenting it here covers
+ * them all without touching a single tool handler or route.
+ *
+ * The port is taken structurally ({@link ToolCallObservability}), not imported: this package does not
+ * depend on `@jini-ai/diagnostics`, and `ObservabilityPort` satisfies the slice as-is. That keeps the
+ * daemon free of any observability vendor AND of the diagnostics package; the host composes them.
+ * A host whose telemetry is off should not wrap at all (diagnostics' `isNoopObservabilityPort`), so
+ * a disabled install keeps its exact executor object and pays no wrapper frame.
+ */
+import { redactSecrets, ToolInputError } from "@jini-ai/core";
+export const TOOL_CALL_OPERATION = "tool.call";
+// A denial, a declined confirmation and a cancellation are the system working as designed, not
+// failures; a timeout and a failed handler are.
+const FAILED_STATUSES = new Set(["failed", "timed-out"]);
+/** The settled result's text as an Error, so an error tracker gets a type to group on. The text is
+ * whatever the inner stack left (the host's `withRedactedToolFailures` has already blanked secrets);
+ * adapters redact again regardless. */
+export class ToolExecutionFailure extends Error {
+    name = "ToolExecutionFailure";
+}
+/** The `tool.id` label for an id nobody registered. Observation starts before the registry has looked
+ * the id up, and a delegated request can carry any string there, a pasted key included (review
+ * 2026-10-25 #1): an unregistered id is never exported, only this fixed label. */
+export const UNREGISTERED_TOOL_LABEL = "unregistered";
+/** Registered tool ids are short dotted/underscored names. Used only when the host gives no registry check. */
+const TOOL_ID_SHAPE = /^[A-Za-z][\w.:-]{0,127}$/;
+export function toolCallLabel({ toolId }, { isRegisteredTool }) {
+    const shapeOk = TOOL_ID_SHAPE.test(toolId) && redactSecrets({ input: toolId }) === toolId;
+    return shapeOk && (isRegisteredTool?.({ toolId }) ?? true) ? toolId : UNREGISTERED_TOOL_LABEL;
+}
+/** WHO did it, as the principal's opaque id (owner 2026-10-25). Pseudonymous only: an id that looks
+ * like an e-mail address or carries a secret shape is replaced, never exported. */
+export const UNIDENTIFIED_USER_LABEL = "unidentified";
+export function pseudonymousUserId({ principal }) {
+    const id = principal.id;
+    if (!id || id.includes("@") || id.length > 128 || redactSecrets({ input: id }) !== id)
+        return UNIDENTIFIED_USER_LABEL;
+    return id;
+}
+function errorKindOf(result) {
+    return result.status === "failed" ? result.errorKind ?? "internal" : undefined;
+}
+/**
+ * Wraps `inner` so each `execute` is one `tool.call` operation: `tool.id` (or the fixed
+ * {@link UNREGISTERED_TOOL_LABEL}), `agent.run.id` and `user.id` (the principal, pseudonymous) at start,
+ * the settled status as outcome, `tool.error_kind` (`validation` vs `internal`) for a failure, and
+ * the duration the adapter measures between start and end. Execution errors (an internal failure, a
+ * timeout, a non-input throw) also go through `reportError`, inside the operation's scope so trace
+ * adapters attach them to its span. A validation failure is NOT reported: it is the caller (usually
+ * the model) sending bad input — counted on the operation, but not an incident to page anyone for.
+ * @param required The executor and the observability port slice.
+ * @param optional `isRegisteredTool`: the host's registry check; without it only the id's shape is checked.
+ * @returns A drop-in `ToolExecutor`; results and throws pass through unchanged; other methods delegate.
+ * @complexity O(1) beyond `inner`'s own cost.
+ */
+export function withToolCallObservability({ inner, observability }, { isRegisteredTool } = {}) {
+    return {
+        execute: async ({ principal, run, toolId, input }, { signal, emitSurface } = {}) => {
+            const attributes = { "tool.id": toolCallLabel({ toolId }, { isRegisteredTool }), "agent.run.id": run.id, "user.id": pseudonymousUserId({ principal }) };
+            const context = { operation: TOOL_CALL_OPERATION, attributes };
+            const tracker = observability.trackOperation({ name: TOOL_CALL_OPERATION, attributes });
+            let result;
+            try {
+                result = await tracker.run(() => inner.execute({ principal, run, toolId, input }, { ...(signal === undefined ? {} : { signal }), ...(emitSurface === undefined ? {} : { emitSurface }) }));
+            }
+            catch (error) {
+                // An unknown tool id throws ToolInputError: the same caller mistake as a validation failure.
+                const errorKind = error instanceof ToolInputError ? "validation" : "internal";
+                if (errorKind === "internal")
+                    tracker.run(() => observability.reportError({ error, context }));
+                tracker.end({ outcome: "threw", failed: true, attributes: { "tool.error_kind": errorKind } });
+                throw error;
+            }
+            const errorKind = errorKindOf(result);
+            if (result.status === "timed-out" || errorKind === "internal") {
+                tracker.run(() => observability.reportError({ error: new ToolExecutionFailure(result.error ?? result.status), context }));
+            }
+            tracker.end({ outcome: result.status, failed: FAILED_STATUSES.has(result.status), ...(errorKind ? { attributes: { "tool.error_kind": errorKind } } : {}) });
+            return result;
+        },
+        resumeConfirmation: (args) => inner.resumeConfirmation(args),
+        cancel: (args) => inner.cancel(args),
+        getAuditRecord: (args) => inner.getAuditRecord(args),
+    };
+}
+//# sourceMappingURL=observability.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/daemon",
-  "version": "0.6.12",
+  "version": "0.6.15-rc.1",
   "description": "The stateful agent daemon runtime: run lifecycle, durable event-log port, the tool-execution boundary, agent executor, terminal sessions, and routines.",
   "license": "Apache-2.0",
   "repository": {
@@ -139,29 +139,30 @@
     "@types/pg": "8.23.1",
     "express": "^4.21.0",
     "@types/express": "^4.17.21",
-    "@jini-ai/http-kit": "0.6.12",
-    "@jini-ai/db": "0.6.12",
-    "@jini-ai/chat": "0.6.12",
-    "@jini-ai/agent-runtime": "^0.6.12",
-    "@jini-ai/platform": "^0.6.12",
-    "@jini-ai/protocol": "^0.6.12",
-    "@jini-ai/core": "^0.6.12"
+    "@jini-ai/db": "0.6.15-rc.1",
+    "@jini-ai/chat": "0.6.15-rc.1",
+    "@jini-ai/http-kit": "0.6.15-rc.1",
+    "@jini-ai/protocol": "^0.6.15-rc.1",
+    "@jini-ai/agent-runtime": "^0.6.15-rc.1",
+    "@jini-ai/platform": "^0.6.15-rc.1",
+    "@jini-ai/core": "^0.6.15-rc.1"
   },
   "dependencies": {
-    "@jini-ai/protocol": "^0.6.12",
-    "@jini-ai/core": "^0.6.12"
+    "smol-toml": "1.9.1",
+    "@jini-ai/core": "^0.6.15-rc.1",
+    "@jini-ai/protocol": "^0.6.15-rc.1"
   },
   "peerDependencies": {
     "node-pty": "^1.1.0",
-    "@jini-ai/db": "^0.6.10",
+    "@jini-ai/db": "^0.6.15-rc.1",
     "kysely": "^0.29.6",
     "better-sqlite3": "^13.0.0",
     "@electric-sql/pglite": "0.5.8",
     "pg": "^8.23.0",
-    "@jini-ai/http-kit": "^0.6.10",
+    "@jini-ai/http-kit": "^0.6.15-rc.1",
     "express": "^4.21.0 || ^5.0.0",
-    "@jini-ai/agent-runtime": "^0.6.10",
-    "@jini-ai/platform": "^0.6.10"
+    "@jini-ai/agent-runtime": "^0.6.15-rc.1",
+    "@jini-ai/platform": "^0.6.15-rc.1"
   },
   "peerDependenciesMeta": {
     "node-pty": {