@jini-ai/daemon 0.6.8 → 0.6.9

package/dist/http/attachments.js

@@ -24,9 +24,10 @@
  *   `claim()` is what exchanges those ids for real paths, server-side.
  *
  * **What `claim()` guarantees.** Exactly once per registered attachment, and only if the file is
- * still the same file: `lstat` must report a regular non-symlink whose `dev`/`ino`/`size` match
- * what was recorded at registration, and `realpath` must equal the recorded path (so neither the
- * file nor any parent directory was swapped for a symlink between upload and run start). Every
+ * still the same file: `lstat` must report a regular non-symlink whose `dev`/`ino`/`size` and
+ * recorded modification/change timestamps match, and `realpath` must equal the recorded path
+ * (so neither the file nor any parent directory was swapped for a symlink between upload and run
+ * start). Legacy sidecars establish their timestamp baseline on first verified read. Every
  * claimed attachment must belong to one batch, so the single `batchDirectory` a host grants the
  * agent read access to cannot be widened by mixing batches.
  *
@@ -104,6 +105,7 @@ import { basename, dirname, extname, resolve } from 'node:path';
 import { createApiError } from '@jini-ai/protocol';
 import { guardSameOrigin } from '@jini-ai/http-kit';
 import { sendApiError, sendJson } from '@jini-ai/http-kit';
+import { writeJsonFileAtomicAsync } from '@jini-ai/platform/fs';
 /**
  * A refusal this module classified itself, as opposed to an unexpected filesystem/programming
  * error. The route pack turns the `reason` into a status code and lets the `message` through only
@@ -179,8 +181,12 @@ function hasAvifBrandAt(body, offset) {
 }
 /** The `ftyp` box's declared end offset (big-endian size at bytes 0-3), clamped to the bytes
  * actually present so a truncated or size-inflating file can never push the brand scan past the
- * captured signature window. */
-function ftypBoxEnd(body) {
+ * captured signature window.
+ *
+ * Exported so its short-body bounds guard can be exercised directly: {@link hasAvifSignature}, its
+ * only caller, already requires 8 bytes before calling it, so no call through that path can reach
+ * the guard — but the guard is what keeps this function safe on its own and stays. */
+export function ftypBoxEnd({ body }, _optional = {}) {
     if (body.length < FTYP_MAJOR_BRAND_OFFSET)
         return 0;
     const declared = ((body[0] << 24) | (body[1] << 16) | (body[2] << 8) | body[3]) >>> 0;
@@ -205,7 +211,7 @@ export function hasAvifSignature({ body }, _optional = {}) {
         return false;
     if (hasAvifBrandAt(body, FTYP_MAJOR_BRAND_OFFSET))
         return true;
-    const boxEnd = ftypBoxEnd(body);
+    const boxEnd = ftypBoxEnd({ body });
     for (let index = 0; index < MAX_SCANNED_COMPATIBLE_BRANDS; index++) {
         const offset = FTYP_COMPATIBLE_BRANDS_OFFSET + index * 4;
         if (offset + 4 > boxEnd)
@@ -229,7 +235,9 @@ const SIGNATURE_BYTES = FTYP_COMPATIBLE_BRANDS_OFFSET + MAX_SCANNED_COMPATIBLE_B
  * Every condition is a distinct real attack: a regular file swapped for a symlink or directory, a
  * parent directory swapped for a symlink pointing elsewhere, the file replaced by a different file
  * at the same path (new inode), the same inode truncated or appended to (new size), or the path
- * now resolving onto a different device.
+ * now resolving onto a different device. Modification/change timestamps also detect same-size
+ * rewrites and replacement files whose inode was recycled. Legacy records lack timestamps and
+ * use their original identity checks until the first verified read establishes that baseline.
  *
  * Pure and exported on purpose. Staging a *device* change for a file that keeps its path is not
  * something a test can do on a real filesystem, and a check that can only be exercised in
@@ -240,7 +248,9 @@ export function isUnchangedAttachment({ recorded, observed }, _optional = {}) {
         && observed.canonicalPath === recorded.filePath
         && observed.dev === recorded.dev
         && observed.ino === recorded.ino
-        && observed.size === recorded.size;
+        && observed.size === recorded.size
+        && (recorded.mtimeMs === undefined || observed.mtimeMs === recorded.mtimeMs)
+        && (recorded.ctimeMs === undefined || observed.ctimeMs === recorded.ctimeMs);
 }
 /**
  * Phase 1 of `claim()`: synchronously reserves `attachments` for `runId`, or throws (releasing
@@ -288,6 +298,7 @@ export function reserveAttachmentRecords({ attachments, records, runId, maxAttac
  * Throws without releasing `claimed`'s reservations; releasing is the caller's job (`claim`'s own
  * `catch`), so a rejected claim still leaves nothing half-claimed and the caller can retry with a
  * corrected set.
+ * Missing legacy timestamps are filled from the verified stat; adoption persists that baseline.
  *
  * Exported so the integrity and mixed-batch checks can be exercised directly against fabricated
  * records over real files on disk, without a full `createDiskAttachmentStore` around them.
@@ -303,6 +314,8 @@ export async function verifyClaimedAttachments({ claimed }, _optional = {}) {
                 dev: info.dev,
                 ino: info.ino,
                 size: info.size,
+                mtimeMs: info.mtimeMs,
+                ctimeMs: info.ctimeMs,
                 canonicalPath,
             }
         })) {
@@ -311,6 +324,8 @@ export async function verifyClaimedAttachments({ claimed }, _optional = {}) {
         if (index > 0 && record.batchDirectory !== batchDirectory) {
             throw new AttachmentRejectedError({ reason: 'mixed-batch', message: 'Attachments must belong to one batch' });
         }
+        record.mtimeMs ??= info.mtimeMs;
+        record.ctimeMs ??= info.ctimeMs;
         batchDirectory = record.batchDirectory;
     }
     return batchDirectory;
@@ -450,7 +465,8 @@ const PERSISTED_FIELD_TYPES = {
 };
 function hasPersistedFieldTypes(candidate) {
     return Object.entries(PERSISTED_FIELD_TYPES)
-        .every(([field, type]) => typeof candidate[field] === type);
+        .every(([field, type]) => typeof candidate[field] === type)
+        && ['mtimeMs', 'ctimeMs'].every((field) => candidate[field] === undefined || typeof candidate[field] === 'number');
 }
 function isPersistedAttachmentShape(raw) {
     if (typeof raw !== 'object' || raw === null)
@@ -465,6 +481,7 @@ function isPersistedAttachmentShape(raw) {
 /**
  * Turns one sidecar's parsed JSON back into an `AttachmentRecord`, or `undefined` for anything that
  * is not a well-formed record naming a file inside its own batch directory.
+ * Legacy sidecars may lack timestamps; adoption verifies their recorded identity before backfill.
  *
  * `batchDirectory` is re-derived here and `filePath`'s containment is re-checked against it with
  * the same parent-equality test `register` uses — the two checks that make an adopted record no
@@ -490,6 +507,8 @@ export function parsePersistedAttachment({ raw, canonicalUploadDirectory }, _opt
         batchDirectory,
         dev: raw.dev,
         ino: raw.ino,
+        ...(raw.mtimeMs === undefined ? {} : { mtimeMs: raw.mtimeMs }),
+        ...(raw.ctimeMs === undefined ? {} : { ctimeMs: raw.ctimeMs }),
         createdAt: raw.createdAt,
         ...(raw.ownerId === undefined ? {} : { ownerId: raw.ownerId }),
     };
@@ -504,6 +523,23 @@ export function parsePersistedAttachment({ raw, canonicalUploadDirectory }, _opt
 export function attachmentSidecarFileName({ id }, _optional = {}) {
     return `${id.replaceAll(/[^a-zA-Z0-9-]/gu, '_')}.json`;
 }
+async function writePersistedAttachment({ record, sidecarPath }, _optional = {}) {
+    const persisted = {
+        id: record.id,
+        filePath: record.filePath,
+        name: record.name,
+        kind: record.kind,
+        size: record.size,
+        batchId: record.batchId,
+        dev: record.dev,
+        ino: record.ino,
+        mtimeMs: record.mtimeMs,
+        ctimeMs: record.ctimeMs,
+        createdAt: record.createdAt,
+        ...(record.ownerId === undefined ? {} : { ownerId: record.ownerId }),
+    };
+    await writeJsonFileAtomicAsync({ filePath: sidecarPath, data: persisted }, { mode: 0o600 });
+}
 async function readPersistedAttachment(sidecarPath, canonicalUploadDirectory) {
     try {
         const raw = JSON.parse(await readFile(sidecarPath, 'utf8'));
@@ -522,14 +558,19 @@ async function readPersistedAttachment(sidecarPath, canonicalUploadDirectory) {
  * the SAME `dev`/`ino`/`size`/`realpath` gate `claim()` applies, or a restart would become the one
  * moment at which a file swapped underneath the store gets handed to an agent anyway.
  */
-async function isAdoptableAttachment(record) {
+/** The record, now timestamped, when its file is still the one registration accepted; else `undefined`. */
+async function adoptableAttachment(record) {
     try {
         await verifyClaimedAttachments({ claimed: [record] });
-        return true;
     }
     catch {
-        return false;
+        return undefined;
     }
+    // A successful verification backfills both timestamps in place (`record.mtimeMs ??= ...`).
+    return record;
+}
+function needsAttachmentTimestampBackfill({ record }, _options = {}) {
+    return record?.mtimeMs === undefined || record?.ctimeMs === undefined;
 }
 /**
  * Rebuilds the record map from the sidecar directory, adopting only records that are (a) well
@@ -537,6 +578,8 @@ async function isAdoptableAttachment(record) {
  * file registration accepted. Anything failing any of those is deleted — sidecar first, then the
  * file it named, and the file ONLY when containment passed, so an unparseable sidecar can never
  * make this an arbitrary-file-delete primitive for whatever the daemon can unlink.
+ * Legacy records use their original identity checks before timestamps are backfilled atomically.
+ * A backfill write failure propagates before cleanup, preserving the attachment for a later retry.
  *
  * **The retention consequence, stated rather than assumed harmless.** Because `claimedRunId` is not
  * persisted (see {@link PersistedAttachmentRecord}), a file claimed by a run that died with the
@@ -553,18 +596,31 @@ export async function loadPersistedAttachments(requiredArgs, optionalArgs = {})
     await mkdir(sidecarDirectory, { recursive: true, mode: 0o700 });
     const adopted = new Map();
     for (const entry of await readdir(sidecarDirectory)) {
-        const sidecarPath = resolve(sidecarDirectory, entry);
-        const record = await readPersistedAttachment(sidecarPath, canonicalUploadDirectory);
-        if (record && now - record.createdAt < retentionMs && await isAdoptableAttachment(record)) {
-            adopted.set(record.id, record);
-            continue;
-        }
-        await rm(sidecarPath, { force: true });
+        const record = await adoptOrDiscardSidecar({ sidecarPath: resolve(sidecarDirectory, entry), canonicalUploadDirectory, retentionMs, now });
         if (record)
-            await rm(record.filePath, { force: true });
+            adopted.set(record.id, record);
     }
     return adopted;
 }
+/**
+ * One sidecar of {@link loadPersistedAttachments}: the adopted (timestamp-backfilled) record, or
+ * `undefined` after deleting the sidecar and — only when its record parsed, i.e. passed
+ * containment — the file it named. @complexity O(1) file operations.
+ */
+async function adoptOrDiscardSidecar({ sidecarPath, canonicalUploadDirectory, retentionMs, now }) {
+    const record = await readPersistedAttachment(sidecarPath, canonicalUploadDirectory);
+    const needsBackfill = needsAttachmentTimestampBackfill({ record });
+    const adoptable = record && now - record.createdAt < retentionMs ? await adoptableAttachment(record) : undefined;
+    if (adoptable) {
+        if (needsBackfill)
+            await writePersistedAttachment({ record: adoptable, sidecarPath });
+        return adoptable;
+    }
+    await rm(sidecarPath, { force: true });
+    if (record)
+        await rm(record.filePath, { force: true });
+    return undefined;
+}
 /** Deletes everything in one batch directory that no adopted record names, then tidies the
  *  directory away if that emptied it. A root entry that is not a directory at all is removed
  *  outright — the store never creates one, so it can only be debris. */
@@ -643,20 +699,8 @@ export async function createDiskAttachmentStore(requiredArgs, optionalArgs = {})
     const persistRecord = async (record) => {
         if (!retainAcrossRestarts)
             return;
-        const persisted = {
-            id: record.id,
-            filePath: record.filePath,
-            name: record.name,
-            kind: record.kind,
-            size: record.size,
-            batchId: record.batchId,
-            dev: record.dev,
-            ino: record.ino,
-            createdAt: record.createdAt,
-            ...(record.ownerId === undefined ? {} : { ownerId: record.ownerId }),
-        };
         try {
-            await writeFile(sidecarPathFor(record), JSON.stringify(persisted), { mode: 0o600 });
+            await writePersistedAttachment({ record, sidecarPath: sidecarPathFor(record) });
         }
         catch (error) {
             records.delete(record.id);
@@ -764,6 +808,8 @@ export async function createDiskAttachmentStore(requiredArgs, optionalArgs = {})
                     batchDirectory,
                     dev: info.dev,
                     ino: info.ino,
+                    mtimeMs: info.mtimeMs,
+                    ctimeMs: info.ctimeMs,
                     createdAt: Date.now(),
                     ...(input.ownerId === undefined ? {} : { ownerId: input.ownerId }),
                 };
@@ -907,6 +953,52 @@ function passesOriginGuard(req, res, deps, adapter) {
     sendApiError({ res, status: 403, error: origin.error });
     return false;
 }
+/**
+ * The refusal for an upload that must not start, or `undefined` when it may. Both checks run before
+ * a slot is taken or a byte is written, and in this order: the limiter answers first, so a host at
+ * its upload budget never pays for diagnosing a misconfigured body parser.
+ */
+function refusalBeforeUpload({ req, state, maxConcurrentUploads }) {
+    if (state.activeUploads >= maxConcurrentUploads) {
+        return new AttachmentRejectedError({ reason: 'too-many-concurrent-uploads', message: 'Too many attachment uploads are in progress' });
+    }
+    // Checked before a single byte is written: a drained stream would otherwise produce a zero-byte
+    // file and the misleading "attachment is empty". See this module's body-parser doc.
+    if (req.readableEnded) {
+        return new AttachmentRejectedError({ reason: 'attachment-body-consumed', message: `the request body was already consumed before ${ATTACHMENTS_ROUTE_PATH} received it — mount this route pack before any global body parser, or scope that parser to skip this path` });
+    }
+    return undefined;
+}
+/**
+ * The body of one admitted upload: prune, batch directory, bounded stream to disk, signature sniff,
+ * register, answer. Throws for the caller to map; the caller owns the slot and the `finally` tidy.
+ */
+async function storeAttachmentUpload({ req, res, deps, batchId, name, maxAttachmentBytes }) {
+    await deps.store.pruneExpired({});
+    const batchDirectory = await deps.store.createBatchDirectory({ batchId });
+    // A fresh UUID, never the client's filename. The extension is carried over (bounded) only
+    // because some agent runtimes decide how to read a file from its suffix.
+    const suffix = extname(name).slice(0, 12);
+    const path = resolve(batchDirectory, `${randomUUID()}${suffix}`);
+    const upload = await writeBoundedAttachmentBody({ request: req, filePath: path, maxBytes: maxAttachmentBytes });
+    if (upload.size === 0) {
+        await rm(path, { force: true });
+        sendApiError({ res, status: 400, error: createApiError({ code: 'BAD_REQUEST', message: 'Attachment is empty' }) });
+        return;
+    }
+    const ownerId = deps.resolveOwnerId?.({ req });
+    const attachment = await deps.store.register({
+        input: {
+            batchId,
+            path,
+            name,
+            kind: detectAttachmentKind({ body: upload.signature }),
+            size: upload.size,
+            ...(ownerId === undefined ? {} : { ownerId }),
+        }
+    });
+    sendJson({ res, status: 201, body: { attachment } });
+}
 /**
  * Handles one upload: rate-limit, batch directory, bounded stream to disk, signature sniff,
  * register. Exported so a host mounting its own path (or its own framework) can reuse the whole
@@ -919,42 +1011,14 @@ export async function handleAttachmentUpload({ req, res, deps, state }, _optiona
     const batchId = typeof req.query.batch === 'string' ? req.query.batch : '';
     // Every refusal below goes through `respondToUploadFailure`, so the reason -> status/code mapping
     // lives in exactly one place rather than being partly inlined here.
-    if (state.activeUploads >= maxConcurrentUploads) {
-        respondToUploadFailure(res, deps, new AttachmentRejectedError({ reason: 'too-many-concurrent-uploads', message: 'Too many attachment uploads are in progress' }), batchId, 'attachment-upload');
-        return;
-    }
-    // Checked before a single byte is written: a drained stream would otherwise produce a zero-byte
-    // file and the misleading "attachment is empty". See this module's body-parser doc.
-    if (req.readableEnded) {
-        respondToUploadFailure(res, deps, new AttachmentRejectedError({ reason: 'attachment-body-consumed', message: `the request body was already consumed before ${ATTACHMENTS_ROUTE_PATH} received it — mount this route pack before any global body parser, or scope that parser to skip this path` }), batchId, 'attachment-upload');
+    const refusal = refusalBeforeUpload({ req, state, maxConcurrentUploads });
+    if (refusal !== undefined) {
+        respondToUploadFailure(res, deps, refusal, batchId, 'attachment-upload');
         return;
     }
     state.activeUploads += 1;
     try {
-        await deps.store.pruneExpired({});
-        const batchDirectory = await deps.store.createBatchDirectory({ batchId });
-        // A fresh UUID, never the client's filename. The extension is carried over (bounded) only
-        // because some agent runtimes decide how to read a file from its suffix.
-        const suffix = extname(name).slice(0, 12);
-        const path = resolve(batchDirectory, `${randomUUID()}${suffix}`);
-        const upload = await writeBoundedAttachmentBody({ request: req, filePath: path, maxBytes: maxAttachmentBytes });
-        if (upload.size === 0) {
-            await rm(path, { force: true });
-            sendApiError({ res, status: 400, error: createApiError({ code: 'BAD_REQUEST', message: 'Attachment is empty' }) });
-            return;
-        }
-        const ownerId = deps.resolveOwnerId?.({ req });
-        const attachment = await deps.store.register({
-            input: {
-                batchId,
-                path,
-                name,
-                kind: detectAttachmentKind({ body: upload.signature }),
-                size: upload.size,
-                ...(ownerId === undefined ? {} : { ownerId }),
-            }
-        });
-        sendJson({ res, status: 201, body: { attachment } });
+        await storeAttachmentUpload({ req, res, deps, batchId, name, maxAttachmentBytes });
     }
     catch (error) {
         respondToUploadFailure(res, deps, error, batchId, 'attachment-upload');

package/dist/http/connectors.d.ts

@@ -48,30 +48,6 @@ export interface StorageProvider {
         readonly prefix?: string | undefined;
     }): Promise<StorageObjectMeta[]>;
 }
-export interface ChargeInput {
-    readonly amountCents: number;
-    readonly currency: string;
-    readonly customerRef: string;
-    readonly description?: string;
-}
-export type ChargeStatus = 'pending' | 'succeeded' | 'failed' | 'refunded';
-export interface Charge {
-    readonly id: string;
-    readonly status: ChargeStatus;
-    readonly amountCents: number;
-    readonly currency: string;
-    readonly customerRef: string;
-    readonly createdAt: number;
-}
-export interface PaymentsProvider {
-    charge(requiredArgs: Omit<ChargeInput, 'description'>, optionalArgs?: Pick<ChargeInput, 'description'>): Promise<Charge>;
-    getCharge({ id }: {
-        readonly id: string;
-    }, _optional?: Record<string, never>): Promise<Charge | null>;
-    refund({ id }: {
-        readonly id: string;
-    }, _optional?: Record<string, never>): Promise<Charge>;
-}
 export interface DbRecord {
     readonly id: string;
     readonly [field: string]: unknown;
@@ -114,7 +90,7 @@ export interface RealtimeProvider {
     }, _optional?: Record<string, never>): () => void;
 }
 export interface ConnectorsInternalErrorContext {
-    readonly source: 'auth' | 'storage' | 'payments' | 'db' | 'realtime';
+    readonly source: 'auth' | 'storage' | 'db' | 'realtime';
     readonly operation: string;
     readonly correlationId: string;
     readonly error: unknown;
@@ -122,7 +98,6 @@ export interface ConnectorsInternalErrorContext {
 export interface ConnectorsHttpDeps {
     readonly auth?: AuthProvider;
     readonly storage?: StorageProvider;
-    readonly payments?: PaymentsProvider;
     readonly db?: DbProvider;
     readonly realtime?: RealtimeProvider;
     /** Host-owned sink for the real exception behind a generic `INTERNAL_ERROR` response (SEC-005). Defaults to `console.error`. */
@@ -162,12 +137,6 @@ export declare const connectorsStoragePutRoute: import("@jini-ai/http-kit").Json
 export declare const connectorsStorageGetRoute: import("@jini-ai/http-kit").JsonRouteSpec<string, ConnectorsStorageGetResponse, ConnectorsHttpDeps, undefined>;
 export declare const connectorsStorageDeleteRoute: import("@jini-ai/http-kit").JsonRouteSpec<string, ConnectorsOkResponse, ConnectorsHttpDeps, undefined>;
 export declare const connectorsStorageListRoute: import("@jini-ai/http-kit").JsonRouteSpec<string | undefined, ConnectorsStorageListResponse, ConnectorsHttpDeps, undefined>;
-export interface ConnectorsChargeResponse {
-    readonly charge: Charge;
-}
-export declare const connectorsPaymentsChargeRoute: import("@jini-ai/http-kit").JsonRouteSpec<ChargeInput, ConnectorsChargeResponse, ConnectorsHttpDeps, undefined>;
-export declare const connectorsPaymentsGetRoute: import("@jini-ai/http-kit").JsonRouteSpec<string, ConnectorsChargeResponse, ConnectorsHttpDeps, undefined>;
-export declare const connectorsPaymentsRefundRoute: import("@jini-ai/http-kit").JsonRouteSpec<string, ConnectorsChargeResponse, ConnectorsHttpDeps, undefined>;
 interface DbInsertRequest {
     readonly collection: string;
     readonly record: DbRecord;

package/dist/http/connectors.js

@@ -1,20 +1,29 @@
 /**
  * @module connectors
  *
- * `POST/GET /api/connectors/{auth,storage,payments,db,realtime}/...` — JSON transport over five
+ * `POST/GET /api/connectors/{auth,storage,db,realtime}/...` — JSON transport over four
  * narrow provider ports. The ports live here because they are the exact behavior this transport
  * consumes; concrete adapters such as `@jini-ai/capability-providers` satisfy them structurally at a
  * product composition root. That dependency direction is deliberate: the daemon route pack must not
  * point down into an incubating implementation package.
  *
- * **SEC-005 throughout**: every provider call is wrapped so a raw Stripe/SQL/JWT/WebSocket error
+ * **No payments slot (removed 2026-10-21).** This pack used to mount `POST /payments/charge`,
+ * `GET /payments/:id` and `POST /payments/:id/refund` over a `PaymentsProvider` port. The two
+ * POSTs moved money with no approval and no idempotency key (a retried request could charge
+ * twice), which made them a second, ungated way to move money beside `@jini-ai/commerce`. Money
+ * now moves only through commerce's `PaymentsPort`, behind approval binding; payment reads belong
+ * to commerce's own read models. The GET was dropped with them rather than kept on its own: its
+ * port type still required `charge`/`refund`, so keeping it would have kept hosts wiring a
+ * money-moving object into these deps. Do not re-add a payments slot here.
+ *
+ * **SEC-005 throughout**: every provider call is wrapped so a raw storage/SQL/JWT/WebSocket error
  * never reaches the HTTP caller verbatim — matching `media.ts`/`delegated-tools.ts`'s
  * `reportInternalError` precedent exactly (a correlation-id-bearing generic `INTERNAL_ERROR`, the
  * real error only reaching a host-owned sink).
  *
  * **`NOT_CONFIGURED` (503)**: every route's very first check is whether its one required
- * capability slot (`deps.auth`/`deps.storage`/`deps.payments`/`deps.db`/`deps.realtime`) is even
- * supplied — all five are independently optional on {@link ConnectorsHttpDeps}, and
+ * capability slot (`deps.auth`/`deps.storage`/`deps.db`/`deps.realtime`) is even
+ * supplied — all four are independently optional on {@link ConnectorsHttpDeps}, and
  * `@jini-ai/server`'s zero-config default (see that package's `create-local-node-daemon.ts` wiring)
  * leaves every slot unconfigured. A request against an unconfigured capability gets a clean 503
  * before touching anything else, never a crash or a fabricated result — the same "capability exists
@@ -204,67 +213,6 @@ export const connectorsStorageListRoute = defineJsonRoute({
     }
 });
 // ---------------------------------------------------------------------------
-// payments
-// ---------------------------------------------------------------------------
-function parseChargeInput(input) {
-    if (!isRecord(input.body))
-        return err({ error: validationError({ message: 'body must be a JSON object' }) });
-    const amountCents = input.body.amountCents;
-    // Cents are a whole, positive unit. `isFinite` alone let `-125.5` reach `payments.charge()`,
-    // where a negative amount is a refund nobody requested and a fractional one is rounded by the
-    // provider in a way the caller cannot predict — and neither is recoverable once the charge
-    // exists. `isSafeInteger` also rejects magnitudes past the point where JSON round-trips stop
-    // being exact, which at a money boundary is a value nobody should be allowed to guess at.
-    if (typeof amountCents !== 'number' || !Number.isSafeInteger(amountCents) || amountCents <= 0) {
-        return err({ error: validationError({ message: 'amountCents must be a positive whole number of cents' }, { issues: [{ path: 'amountCents', message: 'required positive integer' }] }) });
-    }
-    const currency = nonEmptyString(input.body.currency);
-    if (!currency)
-        return err({ error: validationError({ message: 'currency must be a non-empty string' }, { issues: [{ path: 'currency', message: 'required non-empty string' }] }) });
-    const customerRef = nonEmptyString(input.body.customerRef);
-    if (!customerRef) {
-        return err({ error: validationError({ message: 'customerRef must be a non-empty string' }, { issues: [{ path: 'customerRef', message: 'required non-empty string' }] }) });
-    }
-    const description = input.body.description;
-    if (description !== undefined && typeof description !== 'string') {
-        return err({ error: validationError({ message: 'description must be a string when provided' }) });
-    }
-    return ok({ value: { amountCents, currency, customerRef, ...(description !== undefined ? { description: description } : {}) } });
-}
-function parseChargeId(input) {
-    const id = input.params.id;
-    return typeof id === 'string' && id.length > 0 ? ok({ value: id }) : err({ error: validationError({ message: 'id must be a non-empty path parameter' }) });
-}
-export const connectorsPaymentsChargeRoute = defineJsonRoute({
-    method: 'post', path: '/api/connectors/payments/charge', parse: parseChargeInput, handle: async ({ input, deps }) => {
-        if (!deps.payments)
-            return err({ error: notConfiguredError('payments') });
-        const { description, ...required } = input;
-        const result = await guardedCall(deps, 'payments', 'charge', () => deps.payments.charge(required, description === undefined ? {} : { description }));
-        return result.ok ? ok({ value: { charge: result.value } }) : result;
-    }
-}, { requireSameOrigin: true, successStatus: 201 });
-export const connectorsPaymentsGetRoute = defineJsonRoute({
-    method: 'get', path: '/api/connectors/payments/:id', parse: parseChargeId, handle: async ({ input: id, deps }) => {
-        if (!deps.payments)
-            return err({ error: notConfiguredError('payments') });
-        const result = await guardedCall(deps, 'payments', 'getCharge', () => deps.payments.getCharge({ id }));
-        if (!result.ok)
-            return result;
-        if (result.value === null)
-            return err({ error: createApiError({ code: 'NOT_FOUND', message: 'charge not found' }) });
-        return ok({ value: { charge: result.value } });
-    }
-});
-export const connectorsPaymentsRefundRoute = defineJsonRoute({
-    method: 'post', path: '/api/connectors/payments/:id/refund', parse: parseChargeId, handle: async ({ input: id, deps }) => {
-        if (!deps.payments)
-            return err({ error: notConfiguredError('payments') });
-        const result = await guardedCall(deps, 'payments', 'refund', () => deps.payments.refund({ id }));
-        return result.ok ? ok({ value: { charge: result.value } }) : result;
-    }
-}, { requireSameOrigin: true });
-// ---------------------------------------------------------------------------
 // db
 // ---------------------------------------------------------------------------
 function parseDbCollection(input) {
@@ -396,9 +344,6 @@ export function registerConnectorsRoutes({ app, deps, adapter }, _optional = {})
     mountJsonRoute({ app, spec: connectorsStorageGetRoute, deps, adapter });
     mountJsonRoute({ app, spec: connectorsStorageDeleteRoute, deps, adapter });
     mountJsonRoute({ app, spec: connectorsStorageListRoute, deps, adapter });
-    mountJsonRoute({ app, spec: connectorsPaymentsChargeRoute, deps, adapter });
-    mountJsonRoute({ app, spec: connectorsPaymentsGetRoute, deps, adapter });
-    mountJsonRoute({ app, spec: connectorsPaymentsRefundRoute, deps, adapter });
     mountJsonRoute({ app, spec: connectorsDbInsertRoute, deps, adapter });
     mountJsonRoute({ app, spec: connectorsDbGetRoute, deps, adapter });
     mountJsonRoute({ app, spec: connectorsDbUpdateRoute, deps, adapter });

package/dist/http/delegated-tools.d.ts

@@ -23,7 +23,11 @@ export interface DelegatedToolExecuteRequest {
     readonly requireReadOnly?: boolean;
 }
 export interface DelegatedToolExecuteResponse {
-    readonly result: ToolExecutionResult;
+    readonly result: Omit<ToolExecutionResult, 'status'> & {
+        readonly status: ToolExecutionResult['status'] | 'partial_failure' | 'error';
+        readonly outcome?: 'completed' | 'partial_failure' | 'error';
+        readonly isError?: true;
+    };
 }
 /**
  * Diagnostic detail for an internal-error response the public API deliberately does not

package/dist/http/delegated-tools.js

@@ -27,11 +27,9 @@
  */
 import { randomUUID } from 'node:crypto';
 import { createApiError } from '@jini-ai/protocol';
-import { ToolInputError } from '@jini-ai/core';
+import { batchOutcomeFor, ToolInputError } from '@jini-ai/core';
 import { createDelegatedToolBridge } from '../index.js';
-import { defineJsonRoute, mountJsonRoute } from '@jini-ai/http-kit';
-import { validationError } from '@jini-ai/http-kit';
-import { err, ok } from '@jini-ai/http-kit';
+import { defineJsonRoute, err, mountJsonRoute, ok, validationError } from '@jini-ai/http-kit';
 import * as readOnlyTools from '../core/read-only-tools.js';
 /** Route preflight shares the same registration decision as nested dispatch. */
 function checkReadOnlyConstraint(deps, input) {
@@ -68,20 +66,14 @@ function describeSafely(deps, context) {
         return undefined;
     }
 }
-function reportInternalError(deps, source, error, runId, toolId, status) {
+function reportInternalError(deps, report) {
     const correlationId = randomUUID();
-    const context = {
-        source,
-        runId,
-        toolId,
-        correlationId,
-        error,
-        ...(status === undefined ? {} : { status }),
-    };
+    // Every caller either omits `status` or sets it, so spreading keeps "absent" absent.
+    const context = { ...report, correlationId };
     const sink = deps.onInternalError ?? defaultInternalErrorSink;
     sink(context);
     const message = describeSafely(deps, context) ?? 'an internal error occurred';
-    return createApiError({ code: 'INTERNAL_ERROR', message: message }, { requestId: correlationId });
+    return createApiError({ code: 'INTERNAL_ERROR', message }, { requestId: correlationId });
 }
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -118,7 +110,8 @@ function parseDelegatedToolExecute(input) {
 /**
  * Maps a settled `ToolExecutionResult` to the wire `Result` — the same status mapping
  * `db-ops.ts`'s `toolResultToApiResult` establishes for this identical `ToolExecutionResult`
- * union, kept consistent here rather than reinvented: `completed` → `200 {result}`,
+ * union: `completed` → `200 {result}`; a batch with failed items carries
+ * `partial_failure` or `error` plus its per-item output and isError. Other states map as follows:
  * `denied`/`confirmation-denied` → `403 TOOL_OPERATION_DENIED`, `timed-out`/`cancelled` → a
  * SEC-005-redacted `500 INTERNAL_ERROR` (the real status/error goes to `onInternalError`, never the
  * wire — unless the host supplies `deps.describeInternalError`, whose text then replaces the generic
@@ -135,26 +128,33 @@ function parseDelegatedToolExecute(input) {
  * vouches for this exact result via `deps.isModelSafeToolFailure` (it has already redacted the text
  * itself), in which case it is a `422 TOOL_EXECUTION_FAILED` carrying the host's text verbatim.
  */
-function toolExecutionResultToApiResult(deps, runId, toolId, result) {
+function toolExecutionResultToApiResult(deps, { runId, toolId, result }) {
     switch (result.status) {
-        case 'completed':
-            return ok({ value: { result } });
+        case 'completed': {
+            const outcome = batchOutcomeFor({ output: result.output });
+            return ok({ value: { result: outcome === undefined || outcome === 'completed' ? result
+                        : { ...result, status: outcome, outcome, isError: true } } });
+        }
         case 'denied':
             return err({ error: createApiError({ code: 'TOOL_OPERATION_DENIED', message: 'this operation was denied by policy' }) });
         case 'confirmation-denied':
             return err({ error: createApiError({ code: 'TOOL_OPERATION_DENIED', message: 'this operation was denied during confirmation' }) });
         case 'timed-out':
         case 'cancelled':
-            return err({ error: reportInternalError(deps, 'delegated-tool-execute', result.status, runId, toolId, result.status) });
+            return err({ error: reportInternalError(deps, { source: 'delegated-tool-execute', error: result.status, runId, toolId, status: result.status }) });
         case 'failed':
-            if (result.errorKind === 'validation') {
-                return err({ error: createApiError({ code: 'BAD_REQUEST', message: result.error ?? 'invalid tool input' }) });
-            }
-            if (result.error && deps.isModelSafeToolFailure?.({ result }) === true) {
-                return err({ error: createApiError({ code: 'TOOL_EXECUTION_FAILED', message: result.error }) });
-            }
-            return err({ error: reportInternalError(deps, 'delegated-tool-execute', result.error ?? result.status, runId, toolId, 'failed') });
+            return err({ error: failedResultToApiError(deps, { runId, toolId, result }) });
+    }
+}
+/** The `failed` arm of {@link toolExecutionResultToApiResult} — see its doc for the three-way split. */
+function failedResultToApiError(deps, { runId, toolId, result }) {
+    if (result.errorKind === 'validation') {
+        return createApiError({ code: 'BAD_REQUEST', message: result.error ?? 'invalid tool input' });
+    }
+    if (result.error && deps.isModelSafeToolFailure?.({ result }) === true) {
+        return createApiError({ code: 'TOOL_EXECUTION_FAILED', message: result.error });
     }
+    return reportInternalError(deps, { source: 'delegated-tool-execute', error: result.error ?? result.status, runId, toolId, status: 'failed' });
 }
 /**
  * `POST /api/delegated-tool-calls` — executes one delegated tool call against an already-started
@@ -183,7 +183,7 @@ export const delegatedToolExecuteRoute = defineJsonRoute({
             principal = await deps.resolvePrincipal({ request: input });
         }
         catch (error) {
-            return err({ error: reportInternalError(deps, 'resolve-principal', error, input.runId, input.toolId) });
+            return err({ error: reportInternalError(deps, { source: 'resolve-principal', error, runId: input.runId, toolId: input.toolId }) });
         }
         // Attenuates the resolved principal itself for a `requireReadOnly` call, so the constraint
         // survives past this route: a consumer's own `ToolExecutor` composition may dispatch a tool id
@@ -217,13 +217,13 @@ export const delegatedToolExecuteRoute = defineJsonRoute({
                 input: input.input,
                 ...(signal !== undefined ? { signal } : {}),
             });
-            return toolExecutionResultToApiResult(deps, input.runId, input.toolId, result);
+            return toolExecutionResultToApiResult(deps, { runId: input.runId, toolId: input.toolId, result });
         }
         catch (error) {
             if (error instanceof ToolInputError) {
                 return err({ error: createApiError({ code: 'BAD_REQUEST', message: error.message }) });
             }
-            return err({ error: reportInternalError(deps, 'delegated-tool-execute', error, input.runId, input.toolId) });
+            return err({ error: reportInternalError(deps, { source: 'delegated-tool-execute', error, runId: input.runId, toolId: input.toolId }) });
         }
     }
 }, { requireSameOrigin: true });