@jini-ai/daemon 0.6.8 → 0.6.10

package/dist/attachment-content.js

@@ -1,4 +1,15 @@
 import { Buffer } from 'node:buffer';
+/** MIME types a runtime with image access receives as native image input; any other type is a file. */
+const NATIVE_IMAGE_MIME_TYPES = new Set(['image/png', 'image/jpeg', 'image/gif', 'image/webp']);
+/** The notice for an attachment that is not delivered as a native image. */
+function fileNotice({ source, fileAccess }) {
+    const video = source.mimeType.startsWith('video/');
+    if (!fileAccess || !source.path)
+        return `${source.name}: ${video ? 'video' : 'file'} attachments are unsupported by this runtime.`;
+    return video
+        ? `${source.name}: video attachments are unsupported by this runtime; the file is available at ${source.path}.`
+        : `${source.name}: read the attached file at ${source.path}.`;
+}
 /** One byte-bearing message path for CLI and API consumers. The host reader owns authorization,
  * integrity and MIME sniffing; this module never opens a caller-selected path itself. Unsupported
  * files are explicit so the model cannot mistake a filename for content it has received. */
@@ -8,24 +19,16 @@ export async function prepareMessageAttachments({ refs, read }, { fileAccess = f
     const imagePaths = [];
     for (const ref of refs) {
         const source = await read({ ref }, {});
-        if (['image/png', 'image/jpeg', 'image/gif', 'image/webp'].includes(source.mimeType)) {
-            if (!imageAccess) {
-                notices.push(`${source.name}: image attachments are unsupported by this runtime.`);
-                continue;
-            }
-            if (source.path)
-                imagePaths.push(source.path);
-            images.push({ mimeType: source.mimeType, data: Buffer.from(source.bytes).toString('base64') });
-            continue;
+        if (!NATIVE_IMAGE_MIME_TYPES.has(source.mimeType)) {
+            notices.push(fileNotice({ source, fileAccess }));
         }
-        const video = source.mimeType.startsWith('video/');
-        if (fileAccess && source.path) {
-            notices.push(video
-                ? `${source.name}: video attachments are unsupported by this runtime; the file is available at ${source.path}.`
-                : `${source.name}: read the attached file at ${source.path}.`);
+        else if (!imageAccess) {
+            notices.push(`${source.name}: image attachments are unsupported by this runtime.`);
         }
         else {
-            notices.push(`${source.name}: ${video ? 'video' : 'file'} attachments are unsupported by this runtime.`);
+            if (source.path)
+                imagePaths.push(source.path);
+            images.push({ mimeType: source.mimeType, data: Buffer.from(source.bytes).toString('base64') });
         }
     }
     return { images, imagePaths, notice: notices.length ? `\n\nAttachments to this message:\n${notices.join('\n')}` : '' };

package/dist/core/read-only-tools.d.ts

@@ -1,6 +1,7 @@
 import { type Principal, type ToolRegistry } from '@jini-ai/core';
 import type { ToolExecutor } from '../tool-executor.js';
 import type { IdGenerator } from '@jini-ai/core/primitives';
+import type { ToolCatalogQuery } from '../http/tool-catalog.js';
 /**
  * A `Principal` narrowed to tools that only read.
  *
@@ -71,6 +72,20 @@ export declare function constrainPrincipalToReadOnlyTools({ principal }: {
 export declare function principalIsReadOnlyConstrained({ principal }: {
     principal: Principal;
 }, _optional?: Record<string, never>): boolean;
+/**
+ * Hide writes and unclassified tools from a constrained caller's search and schema discovery.
+ * Uses the same classification as dispatch; discovery never grants execution authority.
+ * @param required - Per-call identity, live descriptors, and the existing catalog owner.
+ * @returns A filtered catalog, or the original catalog for an unconstrained caller.
+ * @example filterReadOnlyToolCatalog({ principal, registry, catalog });
+ * @complexity O(n + h) per search for n live registrations and h ranked hits. Overfetch is bounded
+ * by registered tool count so withheld writes cannot displace permitted reads at a small limit.
+ */
+export declare function filterReadOnlyToolCatalog(required: {
+    principal: Principal;
+    registry: Pick<ToolRegistry, 'list'>;
+    catalog: ToolCatalogQuery;
+}, _optional?: Record<string, never>): ToolCatalogQuery;
 /** @returns Required host wording for a registered non-read-only tool. */
 export declare function readOnlyToolRefusalMessage({ toolId, messages }: {
     toolId: string;

package/dist/core/read-only-tools.js

@@ -1,4 +1,4 @@
-import { isReadOnlyTool } from '@jini-ai/core';
+import { isReadOnlyTool, toolDiscoveryMetadata } from '@jini-ai/core';
 import { toolCandidates } from './tool-candidates.js';
 /**
  * Default daemon refusal wording, replaceable by the host. Unknown registrations and writes both
@@ -22,6 +22,34 @@ export function constrainPrincipalToReadOnlyTools({ principal }, _optional = {})
 export function principalIsReadOnlyConstrained({ principal }, _optional = {}) {
     return 'toolAccess' in principal && principal.toolAccess === 'read-only';
 }
+/**
+ * Hide writes and unclassified tools from a constrained caller's search and schema discovery.
+ * Uses the same classification as dispatch; discovery never grants execution authority.
+ * @param required - Per-call identity, live descriptors, and the existing catalog owner.
+ * @returns A filtered catalog, or the original catalog for an unconstrained caller.
+ * @example filterReadOnlyToolCatalog({ principal, registry, catalog });
+ * @complexity O(n + h) per search for n live registrations and h ranked hits. Overfetch is bounded
+ * by registered tool count so withheld writes cannot displace permitted reads at a small limit.
+ */
+export function filterReadOnlyToolCatalog(required, _optional = {}) {
+    if (!principalIsReadOnlyConstrained({ principal: required.principal }))
+        return required.catalog;
+    const allowedTools = () => new Map(required.registry.list({})
+        .filter(descriptor => isReadOnlyTool({ descriptor })).map(descriptor => [descriptor.id, descriptor]));
+    return {
+        search(input, { limit = 10 } = {}) {
+            const allowed = allowedTools();
+            return required.catalog.search(input, { limit: Math.max(limit, required.registry.list({}).length) })
+                .filter(hit => allowed.has(hit.id)).slice(0, limit)
+                .map(hit => ({ ...hit, ...toolDiscoveryMetadata({ descriptor: allowed.get(hit.id) }) }));
+        },
+        describe(input) {
+            const descriptor = allowedTools().get(input.id);
+            const entry = descriptor ? required.catalog.describe(input) : null;
+            return entry ? { ...entry, ...toolDiscoveryMetadata({ descriptor }) } : null;
+        },
+    };
+}
 /** @returns Required host wording for a registered non-read-only tool. */
 export function readOnlyToolRefusalMessage({ toolId, messages }, _optional = {}) {
     return messages.toolRefusalMessage({ toolId });

package/dist/core/tool-audit.d.ts

@@ -13,7 +13,9 @@ export interface ToolAttemptEvent {
     readonly principalId: string;
     readonly phase: ToolAttemptPhase;
     readonly at: string;
-    /** Value-free metadata; never raw input, query, output or error text. */
+    /** Value-free metadata; never raw input, query, output or error text.
+     * Reserved native_tool_gap rows instead carry redacted command/path metadata (ToolGapEntry).
+     * They never carry file bodies, tool output or full edit patches. */
     readonly detail?: string | null;
 }
 export interface ToolAttemptAuditSink {

package/dist/core/tool-audit.js

@@ -33,6 +33,35 @@ export function describeInput({ input }, _optional = {}) {
         return 'input: an unreadable object';
     }
 }
+/** Forward only the channels the caller supplied; an explicit undefined key is never forwarded. */
+function forwardedOptions({ signal, emitSurface }, _optional = {}) {
+    return {
+        ...(signal === undefined ? {} : { signal }),
+        ...(emitSurface === undefined ? {} : { emitSurface }),
+    };
+}
+/** Label a thrown delegation by phase and value-free detail. */
+function thrownAttempt({ error }, _optional = {}) {
+    if (!(error instanceof Error))
+        return { phase: 'failed', detail: typeof error };
+    // The boundary exposes no typed unknown-tool error. Wording drift loses only label
+    // precision, never the row or execution behavior; retain the error class, not its message.
+    return { phase: /unknown tool/i.test(error.message) ? 'unknown-tool' : 'failed', detail: error.name };
+}
+/** Settled details retain truncation or an errorId link, never error text or operator content. */
+function settledDetail({ result, readErrorId }, options) {
+    if (result.truncated)
+        return 'output truncated';
+    // Host error-ID metadata is optional observation, never part of execution success.
+    try {
+        const id = readErrorId({ result });
+        return id === undefined ? null : `errorId=${id}`;
+    }
+    catch (error) {
+        reportSinkError(error, options);
+        return null;
+    }
+}
 /** Append requested BEFORE delegation: unknown tools and throwing authorization have no execution
  * record yet, and wrapping a handler would miss denied/confirmed attempts. The executor's own
  * in-memory audit remains authoritative for getAuditRecord; an injected sink can retain history.
@@ -47,36 +76,20 @@ export function withToolAttemptAudit(deps, options = {}) {
             await appendSafely({ ...base, executionId: null, phase: 'requested', at: deps.now(), detail: describeInput({ input }) }, deps, options);
             let result;
             try {
-                result = await deps.inner.execute({ principal, run, toolId, input }, {
-                    ...(signal === undefined ? {} : { signal }),
-                    ...(emitSurface === undefined ? {} : { emitSurface }),
-                });
+                result = await deps.inner.execute({ principal, run, toolId, input }, forwardedOptions({ signal, emitSurface }));
             }
             catch (error) {
-                // The boundary exposes no typed unknown-tool error. Wording drift loses only label
-                // precision, never the row or execution behavior; retain the error class, not its message.
-                const phase = error instanceof Error && /unknown tool/i.test(error.message) ? 'unknown-tool' : 'failed';
-                await appendSafely({ ...base, executionId: null, phase, at: deps.now(), detail: error instanceof Error ? error.name : typeof error }, deps, options);
+                const { phase, detail } = thrownAttempt({ error });
+                await appendSafely({ ...base, executionId: null, phase, at: deps.now(), detail }, deps, options);
                 throw error;
             }
-            let detail = result.truncated ? 'output truncated' : null;
-            // Host error-ID metadata is optional observation, never part of execution success.
-            if (detail === null) {
-                try {
-                    const id = deps.readErrorId({ result });
-                    if (id !== undefined)
-                        detail = `errorId=${id}`;
-                }
-                catch (error) {
-                    reportSinkError(error, options);
-                }
-            }
+            const detail = settledDetail({ result, readErrorId: deps.readErrorId }, options);
             await appendSafely({ ...base, executionId: result.executionId, phase: result.status, at: deps.now(), detail }, deps, options);
             return result;
         },
-        resumeConfirmation: ({ executionId, decision }) => deps.inner.resumeConfirmation({ executionId: executionId, decision: decision }),
+        resumeConfirmation: ({ executionId, decision }) => deps.inner.resumeConfirmation({ executionId, decision }),
         cancel: ({ executionId }) => deps.inner.cancel({ executionId }),
-        getAuditRecord: ({ executionId }) => deps.inner.getAuditRecord({ executionId: executionId }),
+        getAuditRecord: ({ executionId }) => deps.inner.getAuditRecord({ executionId }),
     };
 }
 /** Keep ids in returned rank order and record queryLength/limit, never raw query text, scores

package/dist/core/tool-gaps.d.ts

@@ -0,0 +1,60 @@
+import type { RunProtocolEvent } from '@jini-ai/protocol';
+import type { ToolAttemptAuditSink, ToolAttemptEvent } from './tool-audit.js';
+/** Reserved audit marker; detail is a redacted ToolGapEntry, never tool output or file content. */
+export declare const TOOL_GAP_AUDIT_ID = "native_tool_gap";
+export interface ToolGapEntry {
+    type: 'tool_gap' | 'native_tool_used';
+    id: string;
+    at: string;
+    site: string;
+    chatId: string;
+    runId: string;
+    provider: string;
+    toolUsed: string;
+    summary: string;
+    gapLine: string | null;
+}
+/** Decode only the public metadata shape; corrupt/older audit rows are skipped. Pure, O(n) JSON. */
+export declare function decodeToolGapEntry(required: {
+    json: string | null;
+}, _optional?: {}): ToolGapEntry | null;
+/** Project the in-memory audit adapter with the SQL reader's same latest-revision semantics.
+ * Pure, O(n) over retained audit events; bounded output, no provider or database coupling. */
+export declare function toolGapsFromAuditEvents(required: {
+    events: readonly ToolAttemptEvent[];
+    workspaceId: string;
+    principalId: string;
+}, optional?: {
+    limit?: number;
+}): readonly ToolGapEntry[];
+/** Extract command/path metadata only. File bodies, patches and tool output never enter audit.
+ * Pure, O(n) in the tool input size. Redaction must precede truncation at the collector boundary. */
+export declare function nativeFallbackSummary(required: {
+    name: string;
+    input: unknown;
+}, _optional?: {}): string | null;
+/** Observe normalized CLI events, independent of model cooperation. Writes immediately at tool use;
+ * a later explanation appends a revision with the same id. One collector per live run.
+ * Sink/redactor are injected; O(n) text work, O(g) identity state for g fallbacks in the run.
+ * @example const audit = createToolGapCollector({ ...identity, sink, redact }, {});
+ */
+export declare function createToolGapCollector(required: {
+    sink: ToolAttemptAuditSink;
+    workspaceId: string;
+    principalId: string;
+    site: string;
+    chatId: string;
+    runId: string;
+    provider: string;
+    redact: (text: string) => string;
+}, optional?: {
+    onError?: (error: unknown) => void;
+}): {
+    /** Called synchronously from the run's existing subscription; no recursive run events. */
+    observe({ event }: {
+        event: RunProtocolEvent;
+    }, _options?: {}): void;
+    /** Await outstanding audit writes during graceful shutdown/tests. */
+    flush: () => Promise<void>;
+};
+//# sourceMappingURL=tool-gaps.d.ts.map

package/dist/core/tool-gaps.js

@@ -0,0 +1,199 @@
+/** Reserved audit marker; detail is a redacted ToolGapEntry, never tool output or file content. */
+export const TOOL_GAP_AUDIT_ID = 'native_tool_gap';
+const GAP_ENTRY_STRING_KEYS = ['id', 'at', 'site', 'chatId', 'runId', 'provider', 'toolUsed', 'summary'];
+/** True when a parsed row carries every public metadata field; older rows may omit `type`. */
+function hasToolGapShape(entry) {
+    if (!GAP_ENTRY_STRING_KEYS.every(key => typeof entry[key] === 'string'))
+        return false;
+    if (entry.gapLine !== null && typeof entry.gapLine !== 'string')
+        return false;
+    return entry.type === undefined || entry.type === 'tool_gap' || entry.type === 'native_tool_used';
+}
+/** Decode only the public metadata shape; corrupt/older audit rows are skipped. Pure, O(n) JSON. */
+export function decodeToolGapEntry(required, _optional = {}) {
+    try {
+        const entry = JSON.parse(required.json ?? 'null');
+        if (!entry || typeof entry !== 'object' || !hasToolGapShape(entry))
+            return null;
+        return { ...entry, type: entry.type ?? 'tool_gap' };
+    }
+    catch {
+        return null;
+    }
+}
+/** Default 100, at most 200, at least 1; zero/NaN/fractions below 1 fall back to the default. */
+function clampGapLimit(limit) {
+    return Math.max(1, Math.min(200, Math.trunc(limit ?? 100) || 100));
+}
+/** A reserved gap row owned by the requested workspace and principal. */
+function isGapRowFor(row, owner) {
+    return row.toolId === TOOL_GAP_AUDIT_ID && row.workspaceId === owner.workspaceId && row.principalId === owner.principalId;
+}
+/** Project the in-memory audit adapter with the SQL reader's same latest-revision semantics.
+ * Pure, O(n) over retained audit events; bounded output, no provider or database coupling. */
+export function toolGapsFromAuditEvents(required, optional = {}) {
+    const limit = clampGapLimit(optional.limit);
+    const entries = new Map();
+    for (let index = required.events.length - 1; index >= 0 && entries.size < limit; index--) {
+        const row = required.events[index];
+        if (!isGapRowFor(row, required))
+            continue;
+        const entry = decodeToolGapEntry({ json: row.detail ?? null }, {});
+        if (entry && !entries.has(entry.id))
+            entries.set(entry.id, entry);
+    }
+    return [...entries.values()];
+}
+const CATALOG_BRIDGE_TOOLS = new Set(['search_tools', 'describe_tool', 'execute_delegated_tool', 'execute_readonly_delegated_tool']);
+const FALLBACK_NAMES = new Set([
+    'Bash', 'BashOutput', 'KillShell', 'Edit', 'Write', 'MultiEdit', 'NotebookEdit',
+    'shell', 'shell_command', 'exec_command', 'write_stdin', 'run_shell_command',
+    'apply_patch', 'write_file', 'replace', 'edit_file', 'file_change',
+]);
+/** Extract command/path metadata only. File bodies, patches and tool output never enter audit.
+ * Pure, O(n) in the tool input size. Redaction must precede truncation at the collector boundary. */
+export function nativeFallbackSummary(required, _optional = {}) {
+    const name = required.name.replace(/^functions\./, '');
+    if (!FALLBACK_NAMES.has(name))
+        return null;
+    if (typeof required.input === 'string')
+        return summarizeTextInput(name, required.input);
+    return summarizeStructuredInput(required.input);
+}
+const NO_COMMAND_OR_PATH = '[no command/path reported]';
+/** Raw text input is omitted, except patch file headers. */
+function summarizeTextInput(name, text) {
+    if (name === 'apply_patch')
+        return text.split('\n').filter(line => /^\*\*\* (?:Add|Update|Delete) File:/.test(line)).join('; ');
+    return '[native tool input omitted]';
+}
+/** Prefer a command, then the first reported path field. */
+function summarizeStructuredInput(value) {
+    const input = value;
+    if (!input || typeof input !== 'object')
+        return NO_COMMAND_OR_PATH;
+    const command = input.command ?? input.cmd;
+    if (typeof command === 'string')
+        return command;
+    return summarizePaths(input.file_path ?? input.path ?? input.notebook_path ?? input.paths);
+}
+function summarizePaths(paths) {
+    if (typeof paths === 'string')
+        return paths;
+    if (Array.isArray(paths))
+        return paths.filter(path => typeof path === 'string').join('; ');
+    return NO_COMMAND_OR_PATH;
+}
+/** Observe normalized CLI events, independent of model cooperation. Writes immediately at tool use;
+ * a later explanation appends a revision with the same id. One collector per live run.
+ * Sink/redactor are injected; O(n) text work, O(g) identity state for g fallbacks in the run.
+ * @example const audit = createToolGapCollector({ ...identity, sink, redact }, {});
+ */
+export function createToolGapCollector(required, optional = {}) {
+    const seen = new Set();
+    let tail = '';
+    let discardingLine = false;
+    let explanation = null;
+    let lastGap = null;
+    let pending = Promise.resolve();
+    const safe = (text) => required.redact(text).slice(0, 500);
+    const append = (entry) => {
+        pending = pending.then(() => required.sink.append({
+            attemptId: entry.id, executionId: null, workspaceId: required.workspaceId,
+            principalId: required.principalId, runId: required.runId, toolId: TOOL_GAP_AUDIT_ID,
+            phase: 'requested', at: entry.at,
+        }, { detail: JSON.stringify(entry) })).catch(error => {
+            // Observation must not strand later writes if a host's error reporter itself throws.
+            try {
+                optional.onError?.(error);
+            }
+            catch { /* host reporter failed */ }
+        });
+    };
+    const readLine = (line) => {
+        const match = /(?:^|\s)Tool gap:\s*(.+)/.exec(line);
+        if (!match)
+            return;
+        // Prefer the next fallback: a missing explanation on an earlier tool must not steal the
+        // line announcing a later one. A final explanation is attached on the terminal event.
+        explanation = safe(`Tool gap: ${match[1]}`);
+    };
+    /** Terminal event: read an unfinished line, then attach a final explanation as a revision. */
+    const finishRun = () => {
+        if (!discardingLine)
+            readLine(tail);
+        if (lastGap && explanation && lastGap.gapLine === null) {
+            lastGap = { ...lastGap, gapLine: explanation };
+            append(lastGap);
+        }
+        tail = '';
+        explanation = null;
+    };
+    const readDelta = (delta) => {
+        const lines = (tail + delta).split('\n');
+        // String.prototype.split always returns at least one element, so the last piece exists.
+        tail = lines.pop();
+        for (const line of lines) {
+            if (!discardingLine)
+                readLine(line);
+            discardingLine = false;
+        }
+        // Discard whole oversized lines rather than cutting a secret token before redaction.
+        if (tail.length > 2048)
+            discardingLine = true;
+        if (discardingLine)
+            tail = '';
+    };
+    const recordNativeTool = (tool, ts) => {
+        // Never store native/MCP inputs: they may contain prompts, credentials or document bodies.
+        append({ id: `${required.runId}:native:${tool.id}`, type: 'native_tool_used',
+            at: new Date(ts).toISOString(), site: required.site, chatId: required.chatId,
+            runId: required.runId, provider: required.provider, toolUsed: safe(tool.name),
+            summary: 'Native tool used', gapLine: null });
+    };
+    const recordGap = (tool, summary, ts) => {
+        if (!discardingLine)
+            readLine(tail);
+        tail = '';
+        discardingLine = false;
+        lastGap = { id: `${required.runId}:gap:${tool.id}`, type: 'tool_gap', at: new Date(ts).toISOString(),
+            site: required.site, chatId: required.chatId, runId: required.runId,
+            provider: required.provider, toolUsed: safe(tool.name), summary: safe(summary), gapLine: explanation };
+        explanation = null;
+        append(lastGap);
+    };
+    const recordToolUse = (tool, ts) => {
+        if (seen.has(tool.id))
+            return;
+        // Catalog bridge calls are already audited by the catalog itself and are never marked seen.
+        if (CATALOG_BRIDGE_TOOLS.has(tool.name.replace(/^(?:mcp__jini__|functions\.)/, '')))
+            return;
+        seen.add(tool.id);
+        const summary = nativeFallbackSummary({ name: tool.name, input: tool.input }, {});
+        if (summary === null)
+            recordNativeTool(tool, ts);
+        else
+            recordGap(tool, summary, ts);
+    };
+    return {
+        /** Called synchronously from the run's existing subscription; no recursive run events. */
+        observe({ event }, _options = {}) {
+            if (event.runId !== required.runId)
+                return;
+            if (event.kind === 'end') {
+                finishRun();
+                return;
+            }
+            if (event.kind !== 'agent')
+                return;
+            const payload = event.payload;
+            if (payload.type === 'text_delta')
+                readDelta(payload.delta);
+            else if (payload.type === 'tool_use')
+                recordToolUse(payload, event.ts);
+        },
+        /** Await outstanding audit writes during graceful shutdown/tests. */
+        flush: () => pending,
+    };
+}
+//# sourceMappingURL=tool-gaps.js.map

package/dist/delegated-result-correlation.d.ts

@@ -0,0 +1,26 @@
+import type { CredentialCryptoPort } from './run-credentials.js';
+interface ResultIdentity {
+    readonly runId: string;
+    readonly toolUseId: string;
+    readonly content: readonly unknown[];
+    readonly isError: boolean;
+}
+/** Run-scoped proof of a saved bridge result. Implementations retain digests, never pixels. */
+export interface DelegatedResultCorrelation {
+    record(input: ResultIdentity, options?: Record<string, never>): void;
+    matches(input: ResultIdentity, options?: Record<string, never>): boolean;
+    clearRun(input: {
+        runId: string;
+    }, options?: Record<string, never>): void;
+}
+/** Bounded digest store. Eviction only disables summarization, so legacy output remains safe.
+ * Share this instance with bridge/executor/lifecycle; lifecycle eviction clears each run.
+ * @complexity O(n) hashing plus JSON key sorting; O(r*c) retained fixed-size digests. */
+export declare function createDelegatedResultCorrelation({ crypto }: {
+    crypto: Pick<CredentialCryptoPort, 'digest'>;
+}, { maxRuns, maxCallsPerRun }?: {
+    maxRuns?: number;
+    maxCallsPerRun?: number;
+}): DelegatedResultCorrelation;
+export {};
+//# sourceMappingURL=delegated-result-correlation.d.ts.map

package/dist/delegated-result-correlation.js

@@ -0,0 +1,68 @@
+/** Accept only the complete base64 source shape; extra fields must remain part of the digest. */
+function base64ImageSource({ source }, _options = {}) {
+    if (typeof source !== 'object' || source === null)
+        return undefined;
+    const image = source;
+    if (image.type !== 'base64' || typeof image.media_type !== 'string' || typeof image.data !== 'string' || Object.keys(image).length !== 3)
+        return undefined;
+    return { data: image.data, media_type: image.media_type };
+}
+/** Convert only source-only images; dual representations and extra source fields stay in the proof. */
+function normalizeSourceImage({ record }, _options = {}) {
+    if (record.type !== 'image' || 'data' in record || 'mimeType' in record)
+        return record;
+    const image = base64ImageSource({ source: record.source });
+    if (!image)
+        return record;
+    const { source: _source, ...rest } = record;
+    return { ...rest, data: image.data, mimeType: image.media_type };
+}
+/** Normalize unambiguous CLI images and JSON object key order.
+ * @complexity O(n + k log k) for n bytes and k keys per object; inputs are wire JSON. */
+function normalizedJson(_key, value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return value;
+    const record = normalizeSourceImage({ record: value });
+    return Object.fromEntries(Object.keys(record).sort().map(key => [key, record[key]]));
+}
+/** Bounded digest store. Eviction only disables summarization, so legacy output remains safe.
+ * Share this instance with bridge/executor/lifecycle; lifecycle eviction clears each run.
+ * @complexity O(n) hashing plus JSON key sorting; O(r*c) retained fixed-size digests. */
+export function createDelegatedResultCorrelation({ crypto }, { maxRuns = 256, maxCallsPerRun = 2048 } = {}) {
+    if (!Number.isSafeInteger(maxRuns) || maxRuns < 1 || !Number.isSafeInteger(maxCallsPerRun) || maxCallsPerRun < 1)
+        throw new Error('correlation limits must be positive integers');
+    const runs = new Map();
+    // Optional correlation must not turn an otherwise serializable legacy fallback into a failure
+    // (for example, a cyclic in-process tool result handled by serializeDelegatedToolOutput).
+    const digest = (input) => {
+        try {
+            return crypto.digest({ token: JSON.stringify({ isError: input.isError, content: input.content }, normalizedJson) });
+        }
+        catch {
+            return undefined;
+        }
+    };
+    return {
+        record(input) {
+            const fingerprint = digest(input);
+            if (fingerprint === undefined)
+                return;
+            let calls = runs.get(input.runId);
+            if (!calls) {
+                if (runs.size >= maxRuns)
+                    runs.delete(runs.keys().next().value);
+                calls = new Map();
+                runs.set(input.runId, calls);
+            }
+            if (calls.size >= maxCallsPerRun)
+                calls.delete(calls.keys().next().value);
+            calls.set(input.toolUseId, fingerprint);
+        },
+        matches(input) {
+            const expected = runs.get(input.runId)?.get(input.toolUseId);
+            return expected !== undefined && expected === digest(input);
+        },
+        clearRun({ runId }) { runs.delete(runId); },
+    };
+}
+//# sourceMappingURL=delegated-result-correlation.js.map

package/dist/delegated-tool-bridge.d.ts

@@ -6,8 +6,9 @@
  * enforces Jini's registry policy, confirmation, timeout, cancellation, and
  * audit trail before any registered handler runs.
  */
-import type { Principal } from '@jini-ai/core';
+import { type Principal } from '@jini-ai/core';
 import type { RunLifecycle } from './run-lifecycle.js';
+import type { DelegatedResultCorrelation } from './delegated-result-correlation.js';
 import type { ToolExecutionResult, ToolExecutor } from './tool-executor.js';
 /**
  * Run-protocol `type` for a human-only surface withheld from a tool result.
@@ -42,24 +43,15 @@ export interface DelegatedToolBridge {
 export interface CreateDelegatedToolBridgeOptions {
     readonly lifecycle: RunLifecycle;
     readonly toolExecutor: ToolExecutor;
+    /** Share with the executor and lifecycle only after the host negotiates marker v1. */
+    readonly delegatedResultCorrelation?: DelegatedResultCorrelation;
 }
-/** Converts arbitrary registered-tool output into the string-bearing run protocol. */
-export declare function serializeDelegatedToolOutput({ output }: {
-    readonly output: unknown;
-}): string;
-/**
- * Maps a `ToolExecutionResult`'s status to the string a delegated-tool caller (this bridge, or
- * gap 3's stdin-tool-result injector in `agent-executor.ts`) reports back as the tool's visible
- * output/failure reason. Exported so both real callers share one mapping rather than drifting.
- */
-export declare function resultContent({ result }: {
-    readonly result: ToolExecutionResult;
-}): string;
+export { serializeDelegatedToolOutput, resultContent } from './tool-result-media.js';
 /**
  * Creates the transport-neutral bridge used by future ACP-delegate, MCP, or
  * other host protocols. This module does not invent a server transport: a
  * concrete protocol calls this bridge after it has decoded and authenticated a
  * delegated tool request.
  */
-export declare function createDelegatedToolBridge(options: CreateDelegatedToolBridgeOptions): DelegatedToolBridge;
+export declare function createDelegatedToolBridge(requiredArgs: Pick<CreateDelegatedToolBridgeOptions, 'lifecycle' | 'toolExecutor'>, optionalArgs?: Pick<CreateDelegatedToolBridgeOptions, 'delegatedResultCorrelation'>): DelegatedToolBridge;
 //# sourceMappingURL=delegated-tool-bridge.d.ts.map