@jini-ai/server 0.6.3 → 0.6.4

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.4 — 2026-10-22
+
+- 2026-10-22: Kernel composition and feature-activation updates, security fixes, complexity refactors, coverage.
+
 ## 0.6.3 — 2026-10-14
 
 - Express 5 accepted: the optional `express` peer is now `^4.21.0 || ^5.0.0` (1442d875), so an Express 5 host no longer hits ERESOLVE.

package/dist/builtin-features.d.ts

@@ -12,34 +12,14 @@ import { type JiniFeature } from './feature.js';
  * existed before it.
  */
 export declare const LOCAL_DAEMON_PRINCIPAL: Principal;
-/**
- * The identity a delegated tool call runs as when the host supplies no resolver. Carries **no
- * roles**, deliberately.
- *
- * ## What actually makes this inert, because an earlier version of this comment named the wrong
- * mechanism
- *
- * It previously claimed inertness came from "every registered tool's own deny-by-default
- * `ToolPolicy`". That is **false**, and believing it is dangerous. `@jini-ai/cms` registers every
- * one of its tools with a pass-through `policy: { authorize: () => 'allow' }` — deliberately, and
- * documented as such in `core/tools/registration-kit.ts`: each tool's permission is evaluated
- * exactly once, inside the domain function or via that file's `requireToolPermission`, so a second
- * evaluator in the policy would be the bug rather than the guard.
- *
- * What actually denies this principal is the identity layer being fail-closed on an UNKNOWN
- * subject: `identity/authorize.ts` starts with `principals.findById(...)` and returns
- * `{ allowed: false, reason: 'principal_disabled' }` when no row comes back. `anonymous-delegated`
- * has no row, so every permission-gated tool refuses it.
- *
- * ## The residual risk that follows from that, stated plainly
- *
- * The protection is the *tool's own* permission check, not this identity and not the registry. A
- * tool registered by some other host with a permissive `ToolPolicy` **and** no internal permission
- * check would execute for this principal. That is exactly why `@jini-ai/http-kit`'s
- * `DelegatedToolsHttpDeps.resolvePrincipal` documents itself as mandatory, and why the fallback
- * below warns rather than staying silent.
- */
+/** @deprecated Compatibility export only; never selected as a default delegated identity. */
 export declare const ANONYMOUS_DELEGATED_PRINCIPAL: Principal;
+/** Resolves a delegated caller through the host's identity owner, refusing absent resolution.
+ * @throws Error when the host supplies no resolver. O(1) plus the host resolver's work. */
+export declare function resolveDelegatedToolPrincipal({ request, resolvePrincipal }: {
+    request: DelegatedToolExecuteRequest;
+    resolvePrincipal: ((request: DelegatedToolExecuteRequest) => Principal | Promise<Principal>) | undefined;
+}, _options?: {}): Principal | Promise<Principal>;
 /** Per-feature configuration, closed over when the catalog is built. */
 export interface BuiltInFeatureOptions {
     readonly health?: {

package/dist/builtin-features.js

@@ -36,47 +36,14 @@ export const LOCAL_DAEMON_PRINCIPAL = { id: 'local-daemon' };
 const require = createRequire(import.meta.url);
 /** This package's own version, the default a composition reports when a host names none. */
 const packageVersion = require('../package.json').version;
-/**
- * The identity a delegated tool call runs as when the host supplies no resolver. Carries **no
- * roles**, deliberately.
- *
- * ## What actually makes this inert, because an earlier version of this comment named the wrong
- * mechanism
- *
- * It previously claimed inertness came from "every registered tool's own deny-by-default
- * `ToolPolicy`". That is **false**, and believing it is dangerous. `@jini-ai/cms` registers every
- * one of its tools with a pass-through `policy: { authorize: () => 'allow' }` — deliberately, and
- * documented as such in `core/tools/registration-kit.ts`: each tool's permission is evaluated
- * exactly once, inside the domain function or via that file's `requireToolPermission`, so a second
- * evaluator in the policy would be the bug rather than the guard.
- *
- * What actually denies this principal is the identity layer being fail-closed on an UNKNOWN
- * subject: `identity/authorize.ts` starts with `principals.findById(...)` and returns
- * `{ allowed: false, reason: 'principal_disabled' }` when no row comes back. `anonymous-delegated`
- * has no row, so every permission-gated tool refuses it.
- *
- * ## The residual risk that follows from that, stated plainly
- *
- * The protection is the *tool's own* permission check, not this identity and not the registry. A
- * tool registered by some other host with a permissive `ToolPolicy` **and** no internal permission
- * check would execute for this principal. That is exactly why `@jini-ai/http-kit`'s
- * `DelegatedToolsHttpDeps.resolvePrincipal` documents itself as mandatory, and why the fallback
- * below warns rather than staying silent.
- */
+/** @deprecated Compatibility export only; never selected as a default delegated identity. */
 export const ANONYMOUS_DELEGATED_PRINCIPAL = { id: 'anonymous-delegated' };
-/**
- * The `resolvePrincipal` fallback, wrapped so the fallback is announced once at composition rather
- * than taken silently. Warns at wiring time, not per request: a per-request warning on a route that
- * can be called in a loop is a log-flood, and the thing worth knowing is a deployment fact, not a
- * request fact.
- */
-function warnAndUseAnonymousDelegatedPrincipal() {
-    // eslint-disable-next-line no-console
-    console.warn('[@jini-ai/server] delegatedToolCalls is enabled without `resolvePrincipal`; delegated tool ' +
-        `calls will run as "${ANONYMOUS_DELEGATED_PRINCIPAL.id}", which every permission-gated tool ` +
-        'refuses (the identity layer is fail-closed on an unknown subject) but a tool with a ' +
-        'permissive ToolPolicy and no internal permission check would still execute for.');
-    return () => ANONYMOUS_DELEGATED_PRINCIPAL;
+/** Resolves a delegated caller through the host's identity owner, refusing absent resolution.
+ * @throws Error when the host supplies no resolver. O(1) plus the host resolver's work. */
+export function resolveDelegatedToolPrincipal({ request, resolvePrincipal }, _options = {}) {
+    if (!resolvePrincipal)
+        throw new Error('Delegated tool calls require a host principal resolver');
+    return resolvePrincipal(request);
 }
 /** Thrown when a feature is activated without the host-supplied options it cannot default. */
 function requireOptions(value, featureId, optionPath) {
@@ -143,6 +110,10 @@ export function isExecutableDetectedAgent(agent) {
     const def = getAgentDef({ id: agent.id });
     return def === null || isAgentExecutorSupported({ def });
 }
+function projectAgentDiagnostic({ agent }, _optional = {}) {
+    const diagnostic = agent.diagnostics?.[0]?.message;
+    return diagnostic ? { diagnostic } : {};
+}
 /** Projects a real `DetectedAgent` probe onto the HTTP summary shape. */
 export function projectDetectedAgent(agent) {
     return {
@@ -160,7 +131,7 @@ export function projectDetectedAgent(agent) {
             : {}),
         modelsSource: agent.modelsSource,
         ...(agent.supportsCustomModel !== undefined ? { supportsCustomModel: agent.supportsCustomModel } : {}),
-        ...(agent.diagnostics?.[0]?.message ? { diagnostic: agent.diagnostics[0].message } : {}),
+        ...projectAgentDiagnostic({ agent }),
     };
 }
 /**
@@ -395,7 +366,7 @@ export function createBuiltInFeatures(options = {}) {
                 }, {
                     http: ({ app, services }) => registerToolCatalogRoutes({ app: app, deps: {
                             catalog: {
-                                search: ({ query }, { limit } = {}) => searchToolCatalog({ db: sqlite.connection, query }, limit === undefined ? {} : { limit }),
+                                search: ({ query }, optionalArgs) => searchToolCatalog({ db: sqlite.connection, query }, optionalArgs),
                                 describe: ({ id }) => getToolCatalogEntry({ db: sqlite.connection, id }),
                             },
                         }, adapter: services.context.adapter }),
@@ -435,16 +406,7 @@ export function createBuiltInFeatures(options = {}) {
                         // gate — an unverifiable constraint is refused, never waived — it would just make the
                         // read-only gateway refuse everything, so a kernel host gets it wired by default.
                         toolRegistry: services.context.kernel.registry,
-                        // `DelegatedToolsHttpDeps.resolvePrincipal` documents itself as MANDATORY — "there is
-                        // no safe default identity this package could assume on a host's behalf" — and this
-                        // line supplied one anyway, silently. The default stays (removing it is a breaking
-                        // change for hosts already relying on it, and is the owner's call, not this file's)
-                        // but it no longer happens quietly: a host that enables this route without deciding
-                        // who its calls run as should learn that from a startup line, not from an audit.
-                        // See ANONYMOUS_DELEGATED_PRINCIPAL for what does and does not make it inert.
-                        resolvePrincipal: resolveDelegatedPrincipal
-                            ? ({ request }) => resolveDelegatedPrincipal(request)
-                            : warnAndUseAnonymousDelegatedPrincipal(),
+                        resolvePrincipal: ({ request }) => resolveDelegatedToolPrincipal({ request, resolvePrincipal: resolveDelegatedPrincipal }),
                     }, adapter: services.context.adapter }),
             }),
         }),

package/dist/compose-jini-kernel.js

@@ -45,24 +45,17 @@ function mountPhase(phase, app, composed, daemon) {
         mountPackHttp({ app, packs: [entry.pack], daemon });
     }
 }
-/**
- * Composes the kernel, the selected feature set, and the caller's own packs onto `config.app`.
- *
- * @throws For any activation error (unknown feature id, denied capability under an explicit enable,
- * unmet `requires`), any missing required feature option, a duplicate tool id, or a failed
- * rehydration. Every kernel resource opened before the failure is disposed and closed before the
- * error propagates, so a failed composition never leaks a sqlite file handle or a pty manager.
- */
-export async function composeJiniKernel(config) {
+const originConfig = { allowedOriginsEnvVar: 'JINI_ALLOWED_ORIGINS', webPortEnvVar: 'JINI_WEB_PORT', bindHostEnvVar: 'JINI_BIND_HOST' };
+function prepareComposition({ config }, _optional = {}) {
     const security = config.security;
     if (!security || !['host', 'jini-local', 'sidecar-strict'].includes(security.mode)) {
         throw new Error(defaultServerMessages.invalidSecurityMode);
     }
     const env = config.env ?? process.env;
     // Boot-time, unconditional — deliberately not scoped to `security.mode === 'sidecar-strict' |
-    // 'jini-local'` the way the two `configuredAllowedOrigins({ config, env })` calls below are. Those compute
+    // 'jini-local'` the way `mountApiSecurity`'s `configuredAllowedOrigins({ config, env })` call is. It computes
     // `extraAllowedOrigins` once at composition time too, but only for the two modes that mount
-    // `registerApiOriginGuardMiddleware`; the explicit `'host'` mode never reaches either call, so a
+    // `registerApiOriginGuardMiddleware`; the explicit `'host'` mode never reaches that call, so a
     // malformed `JINI_ALLOWED_ORIGINS` would otherwise go undetected at boot regardless of mode and
     // only surface later, inside `isLocalSameOrigin` (via `guardSameOrigin`, which every
     // `mountJsonRoute` route and the attachment/model-proxy routes call), on whichever request
@@ -70,7 +63,6 @@ export async function composeJiniKernel(config) {
     // opens, matching the "fails before a single resource is opened" convention just below — turns
     // that into a fail-fast boot error instead. `configuredAllowedOrigins` itself no longer throws
     // (see its own doc): this is the ONE place that still does, deliberately.
-    const originConfig = { allowedOriginsEnvVar: 'JINI_ALLOWED_ORIGINS', webPortEnvVar: 'JINI_WEB_PORT', bindHostEnvVar: 'JINI_BIND_HOST' };
     assertValidAllowedOrigins({ config: originConfig, env });
     const profile = JINI_PROFILES[config.profile ?? 'agent-core-v1'];
     const catalog = [
@@ -84,6 +76,80 @@ export async function composeJiniKernel(config) {
         ...(config.capabilities === undefined ? {} : { capabilities: config.capabilities }),
         ...(config.features === undefined ? {} : { featureOverrides: config.features }),
     });
+    return { security, env, catalog, activation };
+}
+function composeFeatures({ base, adapter, env, catalog, activation, composed }, _optional = {}) {
+    const featureContext = { kernel: base, adapter, env };
+    const byId = new Map(catalog.map((feature) => [feature.id, feature]));
+    for (const record of activation.active) {
+        const feature = byId.get(record.id);
+        const composition = feature.compose(featureContext);
+        composed.push({
+            feature,
+            pack: composition.pack,
+            ...(composition.afterTools === undefined ? {} : { afterTools: composition.afterTools }),
+        });
+    }
+}
+function registerCompositionTools({ base, featurePacks, featureDaemon, callerPacks, callerDaemon, registrations, composed }, _optional = {}) {
+    // Every tool, from every source, before any route mounts.
+    registerPackTools({ registry: base.registry, packs: featurePacks, daemon: featureDaemon });
+    // Host-contributed tools after the features' own, so a collision names the host's id rather
+    // than silently shadowing a built-in.
+    for (const registration of registrations)
+        base.registry.register(registration);
+    registerPackTools({ registry: base.registry, packs: callerPacks, daemon: callerDaemon });
+    // Only now is the registry complete — see `toolCatalog`'s own `afterTools` doc.
+    for (const entry of composed)
+        entry.afterTools?.();
+}
+function mountSecurity({ config, security, env }, _optional = {}) {
+    const { app } = config;
+    // `sidecar-strict`'s bearer gate mounts BEFORE the body parser, unlike `jini-local`'s: a caller
+    // this gate is going to reject with 401 should never have had its body parsed in the first place.
+    // The gate reads only `req.path` and the `Authorization` header, so it needs nothing the parser
+    // provides. Its origin guard still mounts below, alongside `jini-local`'s.
+    if (security.mode === 'sidecar-strict') {
+        app.use(requireStrictBearerToken({
+            tokenEnvVar: security.tokenEnvVar,
+            env,
+        }, security.exemptPaths !== undefined ? { exemptPaths: security.exemptPaths } : {}));
+    }
+    if (config.installJsonBodyParser !== false)
+        app.use(express.json());
+    mountApiSecurity({ config, security, env });
+}
+function mountApiSecurity({ config, security, env }, _optional = {}) {
+    const { app } = config;
+    if (security.mode === 'jini-local') {
+        registerApiBearerAuthMiddleware({ app,
+            tokenConfig: {
+                tokenEnvVar: security.apiToken?.tokenEnvVar ?? 'JINI_API_TOKEN',
+                disableEnvVar: security.apiToken?.disableEnvVar ?? 'JINI_DISABLE_API_AUTH',
+            },
+            env,
+        });
+    }
+    if (security.mode === 'sidecar-strict' || security.mode === 'jini-local') {
+        registerApiOriginGuardMiddleware({ app, deps: {
+                host: security.host,
+                extraAllowedOrigins: configuredAllowedOrigins({ config: originConfig, env }),
+                getResolvedPort: () => config.adapter.resolvedPortRef.current,
+                env,
+                ...originConfig,
+            } });
+    }
+}
+/**
+ * Composes the kernel, the selected feature set, and the caller's own packs onto `config.app`.
+ *
+ * @throws For any activation error (unknown feature id, denied capability under an explicit enable,
+ * unmet `requires`), any missing required feature option, a duplicate tool id, or a failed
+ * rehydration. Every kernel resource opened before the failure is disposed and closed before the
+ * error propagates, so a failed composition never leaks a sqlite file handle or a pty manager.
+ */
+export async function composeJiniKernel(config) {
+    const { security, env, catalog, activation } = prepareComposition({ config });
     const base = await createJiniKernelBase({
         storage: config.storage,
         agentExecutor: { ...config.agentExecutor, hostEnv: config.agentExecutor?.hostEnv ?? env },
@@ -99,68 +165,14 @@ export async function composeJiniKernel(config) {
             .bind({ token: AgentExecutorToken, impl: base.agentExecutor });
         const boundBindings = config.bindings ? config.bindings(kernelBindings) : kernelBindings;
         callerDaemon = createDaemon({ packs: callerPacks, bindings: boundBindings });
-        const featureContext = { kernel: base, adapter: config.adapter, env };
-        const byId = new Map(catalog.map((feature) => [feature.id, feature]));
-        for (const record of activation.active) {
-            const feature = byId.get(record.id);
-            const composition = feature.compose(featureContext);
-            composed.push({
-                feature,
-                pack: composition.pack,
-                ...(composition.afterTools === undefined ? {} : { afterTools: composition.afterTools }),
-            });
-        }
+        composeFeatures({ base, adapter: config.adapter, env, catalog, activation, composed });
         const featurePacks = composed.map((entry) => entry.pack);
         featureDaemon = createDaemon({ packs: featurePacks, bindings: bindings({}) });
-        // Every tool, from every source, before any route mounts.
-        registerPackTools({ registry: base.registry, packs: featurePacks, daemon: featureDaemon });
-        // Host-contributed tools after the features' own, so a collision names the host's id rather
-        // than silently shadowing a built-in.
-        for (const registration of config.toolRegistrations ?? [])
-            base.registry.register(registration);
-        registerPackTools({ registry: base.registry, packs: callerPacks, daemon: callerDaemon });
-        // Only now is the registry complete — see `toolCatalog`'s own `afterTools` doc.
-        for (const entry of composed)
-            entry.afterTools?.();
+        registerCompositionTools({ base, featurePacks, featureDaemon, callerPacks, callerDaemon,
+            registrations: config.toolRegistrations ?? [], composed });
         const { app } = config;
         mountPhase('probe', app, composed, featureDaemon);
-        // `sidecar-strict`'s bearer gate mounts BEFORE the body parser, unlike `jini-local`'s: a caller
-        // this gate is going to reject with 401 should never have had its body parsed in the first place.
-        // The gate reads only `req.path` and the `Authorization` header, so it needs nothing the parser
-        // provides. Its origin guard still mounts below, alongside `jini-local`'s.
-        if (security.mode === 'sidecar-strict') {
-            app.use(requireStrictBearerToken({
-                tokenEnvVar: security.tokenEnvVar,
-                env,
-            }, security.exemptPaths !== undefined ? { exemptPaths: security.exemptPaths } : {}));
-        }
-        if (config.installJsonBodyParser !== false)
-            app.use(express.json());
-        if (security.mode === 'sidecar-strict') {
-            registerApiOriginGuardMiddleware({ app, deps: {
-                    host: security.host,
-                    extraAllowedOrigins: configuredAllowedOrigins({ config: originConfig, env }),
-                    getResolvedPort: () => config.adapter.resolvedPortRef.current,
-                    env,
-                    ...originConfig,
-                } });
-        }
-        if (security.mode === 'jini-local') {
-            registerApiBearerAuthMiddleware({ app,
-                tokenConfig: {
-                    tokenEnvVar: security.apiToken?.tokenEnvVar ?? 'JINI_API_TOKEN',
-                    disableEnvVar: security.apiToken?.disableEnvVar ?? 'JINI_DISABLE_API_AUTH',
-                },
-                env,
-            });
-            registerApiOriginGuardMiddleware({ app, deps: {
-                    host: security.host,
-                    extraAllowedOrigins: configuredAllowedOrigins({ config: originConfig, env }),
-                    getResolvedPort: () => config.adapter.resolvedPortRef.current,
-                    env,
-                    ...originConfig,
-                } });
-        }
+        mountSecurity({ config, security, env });
         mountPhase('api', app, composed, featureDaemon);
         config.onAfterApiRoutes?.(app, callerDaemon, base);
         mountPhase('status', app, composed, featureDaemon);

package/dist/create-local-node-daemon.js

@@ -87,6 +87,56 @@ export function resolveReportHost(bindHost) {
         return `[${bindHost}]`;
     return bindHost;
 }
+function localKernelOptions({ config }, _optional = {}) {
+    return {
+        profile: config.profile ?? 'local-daemon-v1',
+        ...(config.capabilities === undefined ? {} : { capabilities: config.capabilities }),
+        ...(config.features === undefined ? {} : { features: config.features }),
+        packs: config.packs,
+        ...(config.bindings === undefined ? {} : { bindings: config.bindings }),
+        ...(config.toolRegistrations === undefined ? {} : { toolRegistrations: config.toolRegistrations }),
+    };
+}
+function localSecurity({ config, host }, _optional = {}) {
+    return config.security
+        ? { ...config.security, host }
+        : {
+            mode: 'jini-local',
+            host,
+            apiToken: {
+                tokenEnvVar: config.apiToken?.tokenEnvVar ?? DEFAULT_TOKEN_ENV_VAR,
+                disableEnvVar: config.apiToken?.disableEnvVar ?? DEFAULT_DISABLE_ENV_VAR,
+            },
+        };
+}
+function localFeatureOptions({ config, host, resolvedPortRef, xaiListenerRef, isShuttingDown, requestShutdown }, _optional = {}) {
+    return {
+        health: { getVersion: () => packageVersion, isShuttingDown },
+        runs: {
+            ...(config.onRunStarted === undefined ? {} : { onRunStarted: config.onRunStarted }),
+            ...(config.resolveRunInput === undefined ? {} : { resolveRunInput: config.resolveRunInput }),
+        },
+        ...(config.agentDetector === undefined ? {} : { agents: { detector: config.agentDetector } }),
+        hostTools: {
+            ...(config.resolveWorkspaceRoot === undefined ? {} : { resolveWorkspaceRoot: config.resolveWorkspaceRoot }),
+        },
+        terminal: {
+            ...(config.resolveWorkspaceRoot === undefined ? {} : { resolveWorkspaceRoot: config.resolveWorkspaceRoot }),
+        },
+        ...(config.resolveDelegatedPrincipal === undefined
+            ? {}
+            : { delegatedToolCalls: { resolvePrincipal: config.resolveDelegatedPrincipal } }),
+        xai: { listenerRef: xaiListenerRef },
+        daemonStatus: {
+            getVersion: () => packageVersion,
+            host,
+            getPort: () => resolvedPortRef.current,
+            dataDir: config.dataDir,
+            isShuttingDown,
+            requestShutdown,
+        },
+    };
+}
 export async function createLocalNodeDaemon(config) {
     const env = config.env ?? process.env;
     const host = normalizeDaemonBindHost(config.host ?? DEFAULT_HOST);
@@ -108,65 +158,30 @@ export async function createLocalNodeDaemon(config) {
     // Owned here rather than by the xai feature so `stop()` observes the same ref the routes wrote to.
     const xaiListenerRef = { current: null };
     const app = express();
+    app.disable('x-powered-by');
     installRouteRegistrationGuard({ app });
     const kernel = await composeJiniKernel({
         app,
         adapter,
         storage: { kind: 'sqlite', dataDir: config.dataDir, open: config.open },
-        profile: config.profile ?? 'local-daemon-v1',
-        ...(config.capabilities === undefined ? {} : { capabilities: config.capabilities }),
-        ...(config.features === undefined ? {} : { features: config.features }),
-        packs: config.packs,
-        ...(config.bindings === undefined ? {} : { bindings: config.bindings }),
-        ...(config.toolRegistrations === undefined ? {} : { toolRegistrations: config.toolRegistrations }),
-        security: config.security
-            ? { ...config.security, host }
-            : {
-                mode: 'jini-local',
-                host,
-                apiToken: {
-                    tokenEnvVar: config.apiToken?.tokenEnvVar ?? DEFAULT_TOKEN_ENV_VAR,
-                    disableEnvVar: config.apiToken?.disableEnvVar ?? DEFAULT_DISABLE_ENV_VAR,
-                },
-            },
+        ...localKernelOptions({ config }),
+        security: localSecurity({ config, host }),
         env,
         ...(config.agentExecutor ? { agentExecutor: config.agentExecutor } : {}),
-        featureOptions: {
-            health: { getVersion: () => packageVersion, isShuttingDown: () => shuttingDown },
-            runs: {
-                ...(config.onRunStarted === undefined ? {} : { onRunStarted: config.onRunStarted }),
-                ...(config.resolveRunInput === undefined ? {} : { resolveRunInput: config.resolveRunInput }),
-            },
-            ...(config.agentDetector === undefined ? {} : { agents: { detector: config.agentDetector } }),
-            hostTools: {
-                ...(config.resolveWorkspaceRoot === undefined ? {} : { resolveWorkspaceRoot: config.resolveWorkspaceRoot }),
+        featureOptions: localFeatureOptions({ config, host, resolvedPortRef, xaiListenerRef,
+            isShuttingDown: () => shuttingDown,
+            requestShutdown: () => {
+                // `POST /api/daemon/shutdown` answers before shutdown begins, so nothing downstream can
+                // ever await this promise. Dropping it with a bare `void` turned any shutdown failure
+                // into a process-level unhandled rejection — which on Node's default policy terminates
+                // the very process this was trying to shut down gracefully. Reported here instead; the
+                // rejection stays on `stopPromise`, so an explicit `stop()` caller still observes it.
+                void stop().catch((error) => {
+                    // eslint-disable-next-line no-console
+                    console.error('[@jini-ai/server] shutdown requested through POST /api/daemon/shutdown failed', error);
+                });
             },
-            terminal: {
-                ...(config.resolveWorkspaceRoot === undefined ? {} : { resolveWorkspaceRoot: config.resolveWorkspaceRoot }),
-            },
-            ...(config.resolveDelegatedPrincipal === undefined
-                ? {}
-                : { delegatedToolCalls: { resolvePrincipal: config.resolveDelegatedPrincipal } }),
-            xai: { listenerRef: xaiListenerRef },
-            daemonStatus: {
-                getVersion: () => packageVersion,
-                host,
-                getPort: () => resolvedPortRef.current,
-                dataDir: config.dataDir,
-                isShuttingDown: () => shuttingDown,
-                requestShutdown: () => {
-                    // `POST /api/daemon/shutdown` answers before shutdown begins, so nothing downstream can
-                    // ever await this promise. Dropping it with a bare `void` turned any shutdown failure
-                    // into a process-level unhandled rejection — which on Node's default policy terminates
-                    // the very process this was trying to shut down gracefully. Reported here instead; the
-                    // rejection stays on `stopPromise`, so an explicit `stop()` caller still observes it.
-                    void stop().catch((error) => {
-                        // eslint-disable-next-line no-console
-                        console.error('[@jini-ai/server] shutdown requested through POST /api/daemon/shutdown failed', error);
-                    });
-                },
-            },
-        },
+        }),
         // Product extensions, then caller-pack routes — the historical position, between the locked
         // route families and the daemon-status routes.
         onAfterApiRoutes: (mountedApp, daemon, base) => {
@@ -239,7 +254,7 @@ export async function createLocalNodeDaemon(config) {
     return await new Promise((resolve, reject) => {
         const failToBind = (error) => {
             // Best-effort: a failed boot must not leave any resource this call already opened dangling.
-            void kernel.close().finally(() => reject(error));
+            void kernel.close().then(() => reject(error), () => reject(error));
         };
         listen()
             .then((listeningServer) => {

package/dist/feature-activation.js

@@ -11,16 +11,7 @@ function resolveGrants(input) {
     }
     return granted;
 }
-/**
- * Resolves the composition's feature plan.
- *
- * @throws If an override names an unknown feature id, if an explicitly-enabled feature needs a
- * denied capability, if two catalogued features share an id, or if an active feature's `requires`
- * are not satisfied. Every one of these is a composition-time programming/config error that would
- * otherwise surface as a mysteriously missing (or mysteriously present) route at runtime.
- * @complexity O(f · c) in features and their declared capabilities.
- */
-export function resolveFeatureActivation(input) {
+function validateActivationConfig({ input }, _optional = {}) {
     const byId = new Map();
     for (const feature of input.features) {
         if (byId.has(feature.id)) {
@@ -46,48 +37,38 @@ export function resolveFeatureActivation(input) {
             throw new Error(`jini: unknown capability "${capability}" in capabilities config — known capabilities are: ${known}`);
         }
     }
-    const granted = resolveGrants(input);
-    const coreCapabilities = new Set(CORE_CAPABILITIES);
-    const active = [];
-    const inactive = [];
-    const denied = new Set();
-    for (const feature of input.features) {
-        const missing = feature.provides.filter((capability) => !granted.has(capability));
-        for (const capability of missing)
-            denied.add(capability);
-        const permitted = missing.length === 0;
-        const explicit = overrides[feature.id];
-        // Rule 2 — an explicit enable never overrides a denied capability, in either direction.
-        if (explicit === true && !permitted) {
-            throw new Error(`jini: feature "${feature.id}" was explicitly enabled but requires denied ` +
-                `capabilit${missing.length > 1 ? 'ies' : 'y'} [${missing.join(', ')}] under profile ` +
-                `"${input.profile.id}". Grant them via config.capabilities, or remove "${feature.id}" from config.features.`);
-        }
-        if (explicit === false) {
-            inactive.push({ id: feature.id, provides: feature.provides, reason: 'opt-out', deniedCapabilities: [] });
-            continue;
-        }
-        if (explicit === true) {
-            active.push({ id: feature.id, provides: feature.provides, reason: 'opt-in' });
-            continue;
-        }
-        if (!permitted) {
-            inactive.push({
-                id: feature.id,
-                provides: feature.provides,
-                reason: 'capability-denied',
-                deniedCapabilities: missing,
-            });
-            continue;
-        }
-        // Rule 3 — permitted is not active. `core-only` still requires the caller to name it.
-        const defaultOn = input.profile.activation === 'all-permitted' ||
-            feature.provides.every((capability) => coreCapabilities.has(capability));
-        if (defaultOn)
-            active.push({ id: feature.id, provides: feature.provides, reason: 'default' });
-        else
-            inactive.push({ id: feature.id, provides: feature.provides, reason: 'not-default', deniedCapabilities: [] });
+    return byId;
+}
+function selectFeature({ feature, missing, explicit, profile }, _optional = {}) {
+    const permitted = missing.length === 0;
+    // Rule 2 — an explicit enable never overrides a denied capability, in either direction.
+    if (explicit === true && !permitted) {
+        throw new Error(`jini: feature "${feature.id}" was explicitly enabled but requires denied ` +
+            `capabilit${missing.length > 1 ? 'ies' : 'y'} [${missing.join(', ')}] under profile ` +
+            `"${profile.id}". Grant them via config.capabilities, or remove "${feature.id}" from config.features.`);
     }
+    if (explicit === false) {
+        return { id: feature.id, provides: feature.provides, reason: 'opt-out', deniedCapabilities: [] };
+    }
+    if (explicit === true) {
+        return { id: feature.id, provides: feature.provides, reason: 'opt-in' };
+    }
+    if (!permitted) {
+        return {
+            id: feature.id,
+            provides: feature.provides,
+            reason: 'capability-denied',
+            deniedCapabilities: missing,
+        };
+    }
+    // Rule 3 — permitted is not active. `core-only` still requires the caller to name it.
+    const defaultOn = profile.activation === 'all-permitted' ||
+        feature.provides.every((capability) => CORE_CAPABILITIES.includes(capability));
+    if (defaultOn)
+        return { id: feature.id, provides: feature.provides, reason: 'default' };
+    return { id: feature.id, provides: feature.provides, reason: 'not-default', deniedCapabilities: [] };
+}
+function validateFeatureDependencies({ active, byId }, _optional = {}) {
     // Rule 4 — dependencies validated after the full active set is known, so declaration order in the
     // catalog never decides whether a legitimate configuration is accepted.
     const activeIds = new Set(active.map((record) => record.id));
@@ -102,6 +83,34 @@ export function resolveFeatureActivation(input) {
             }
         }
     }
+}
+/**
+ * Resolves the composition's feature plan.
+ *
+ * @throws If an override names an unknown feature id, if an explicitly-enabled feature needs a
+ * denied capability, if two catalogued features share an id, or if an active feature's `requires`
+ * are not satisfied. Every one of these is a composition-time programming/config error that would
+ * otherwise surface as a mysteriously missing (or mysteriously present) route at runtime.
+ * @complexity O(f · c) in features and their declared capabilities.
+ */
+export function resolveFeatureActivation(input) {
+    const byId = validateActivationConfig({ input });
+    const overrides = input.featureOverrides ?? {};
+    const granted = resolveGrants(input);
+    const active = [];
+    const inactive = [];
+    const denied = new Set();
+    for (const feature of input.features) {
+        const missing = feature.provides.filter((capability) => !granted.has(capability));
+        for (const capability of missing)
+            denied.add(capability);
+        const selection = selectFeature({ feature, missing, explicit: overrides[feature.id], profile: input.profile });
+        if ('deniedCapabilities' in selection)
+            inactive.push(selection);
+        else
+            active.push(selection);
+    }
+    validateFeatureDependencies({ active, byId });
     return {
         active,
         inactive,

package/dist/kernel-base.js

@@ -26,6 +26,22 @@ import { openSqliteEventLog } from '@jini-ai/daemon/store/event-log/sqlite';
 export function classifyRunFailureForRetry(context) {
     return resumableFromProcessExit({ code: context.code, signal: context.signal }, context.sideEffects === undefined ? {} : { sideEffects: context.sideEffects });
 }
+async function closeFailedAcquisition({ featureConnection, opened }, _optional = {}) {
+    // Every acquired handle is attempted even if another closer fails. Preserve the boot error.
+    try {
+        featureConnection?.close();
+    }
+    catch { /* Keep the boot failure. */ }
+    await Promise.allSettled(opened.map((log) => log.close?.({})));
+}
+function createKernelAgentRuntime({ options }, _optional = {}) {
+    const agentRuntime = createNativeAgentRuntime({ env: options.agentExecutor?.hostEnv ?? process.env }, {
+        ...(options.agentExecutor?.runtimeState ? { state: options.agentExecutor.runtimeState } : {}),
+        ...(options.agentExecutor?.codexDisablePlugins !== undefined ? { codexDisablePlugins: options.agentExecutor.codexDisablePlugins } : {}),
+        ...(options.agentExecutor?.piGracefulShutdownMs !== undefined ? { piGracefulShutdownMs: options.agentExecutor.piGracefulShutdownMs } : {}),
+    });
+    return agentRuntime;
+}
 /**
  * Opens every kernel-owned resource and rehydrates durable run history.
  *
@@ -82,19 +98,10 @@ export async function createJiniKernelBase(options) {
         await lifecycle.rehydrate({});
     }
     catch (error) {
-        // Every acquired handle is attempted even if another closer fails. Preserve the boot error.
-        try {
-            featureConnection?.close();
-        }
-        catch { /* Keep the boot failure. */ }
-        await Promise.allSettled(opened.map((log) => log.close?.({})));
+        await closeFailedAcquisition({ featureConnection, opened });
         throw error;
     }
-    const agentRuntime = createNativeAgentRuntime({ env: options.agentExecutor?.hostEnv ?? process.env }, {
-        ...(options.agentExecutor?.runtimeState ? { state: options.agentExecutor.runtimeState } : {}),
-        ...(options.agentExecutor?.codexDisablePlugins !== undefined ? { codexDisablePlugins: options.agentExecutor.codexDisablePlugins } : {}),
-        ...(options.agentExecutor?.piGracefulShutdownMs !== undefined ? { piGracefulShutdownMs: options.agentExecutor.piGracefulShutdownMs } : {}),
-    });
+    const agentRuntime = createKernelAgentRuntime({ options });
     const agentExecutor = createAgentExecutor({ lifecycle }, {
         ...options.agentExecutor,
         runtimeState: agentRuntime.state,

package/dist/lifecycle/boot-lifecycle.js

@@ -6,6 +6,39 @@ async function stopInReverse(modules) {
         catch { /* Preserve the original failure and continue cleanup. */ }
     }
 }
+function bootModuleFailure(required, _optional = {}) {
+    const { module, error } = required;
+    return {
+        name: module.name, owner: module.owner, criticality: module.criticality,
+        lifecycle: {
+            status: 'failed', reasonCode: error instanceof Error ? error.message : String(error),
+            remediationHint: 'check the boot log for the underlying error and retry after fixing it',
+        },
+    };
+}
+async function runBootStage(required, _optional = {}) {
+    const { stage, modules, results } = required;
+    const completed = [];
+    for (const module of modules) {
+        try {
+            await module[stage]();
+            completed.push(module);
+            if (stage === 'start')
+                results.set(module.name, {
+                    name: module.name, owner: module.owner, criticality: module.criticality,
+                    lifecycle: { status: 'ready' },
+                });
+        }
+        catch (error) {
+            results.set(module.name, bootModuleFailure({ module, error }));
+            if (module.criticality === 'critical') {
+                await stopInReverse(completed);
+                return { completed, aborted: true };
+            }
+        }
+    }
+    return { completed, aborted: false };
+}
 /**
  * Preserve source rollback semantics: prepare failure unwinds completed preparations;
  * start failure unwinds completed starts only. Failing modules own their partial cleanup.
@@ -22,38 +55,9 @@ export async function runBootLifecycle(required, optional = {}) {
         throw new Error('boot module names must be unique');
     }
     const results = new Map();
-    const prepared = [];
-    const ready = [];
-    let aborted = false;
-    for (const stage of ['prepare', 'start']) {
-        const completed = stage === 'prepare' ? prepared : ready;
-        for (const module of stage === 'prepare' ? modules : prepared) {
-            try {
-                await module[stage]();
-                completed.push(module);
-                if (stage === 'start')
-                    results.set(module.name, {
-                        name: module.name, owner: module.owner, criticality: module.criticality,
-                        lifecycle: { status: 'ready' },
-                    });
-            }
-            catch (error) {
-                results.set(module.name, {
-                    name: module.name, owner: module.owner, criticality: module.criticality,
-                    lifecycle: {
-                        status: 'failed', reasonCode: error instanceof Error ? error.message : String(error),
-                        remediationHint: 'check the boot log for the underlying error and retry after fixing it',
-                    },
-                });
-                if (module.criticality === 'critical') {
-                    await stopInReverse(completed);
-                    aborted = true;
-                    break;
-                }
-            }
-        }
-        if (aborted)
-            break;
+    const prepared = await runBootStage({ stage: 'prepare', modules, results });
+    if (!prepared.aborted) {
+        await runBootStage({ stage: 'start', modules: prepared.completed, results });
     }
     const ordered = modules.flatMap(module => {
         const result = results.get(module.name);

package/dist/storage/backend-config.js

@@ -16,6 +16,27 @@ export class SqliteBackendConfigError extends Error {
         this.name = 'SqliteBackendConfigError';
     }
 }
+function resolvePostgresSslMode(required, _optional = {}) {
+    const e = required.env;
+    return e.JINI_PG_SSL_MODE === 'disable' || e.JINI_PG_SSL_MODE === 'verify-full' ? e.JINI_PG_SSL_MODE : 'require';
+}
+function resolvePostgresConfig(required, _optional = {}) {
+    const e = required.env;
+    const host = e.JINI_PG_HOST ?? '';
+    const portStr = e.JINI_PG_PORT ?? '5432';
+    const database = e.JINI_PG_DATABASE ?? '';
+    const user = e.JINI_PG_USER ?? '';
+    const sslMode = resolvePostgresSslMode({ env: e });
+    if (!host || !database || !user) {
+        throw new SqliteBackendConfigError({ message: 'JINI_SQLITE_BACKEND=postgres requires JINI_PG_HOST, JINI_PG_DATABASE, JINI_PG_USER. ' +
+                'JINI_PG_PORT defaults to 5432; JINI_PG_SSL_MODE defaults to "require".',
+        });
+    }
+    return {
+        kind: 'postgres',
+        postgres: { host, port: Number.parseInt(portStr, 10) || 5432, database, user, sslMode },
+    };
+}
 /**
  * Reads `JINI_SQLITE_BACKEND` (`'sqlite'` default, or `'postgres'`) and, for
  * `postgres`, `JINI_PG_HOST`/`JINI_PG_PORT`/`JINI_PG_DATABASE`/`JINI_PG_USER`/
@@ -32,26 +53,7 @@ export function resolveSqliteBackendConfig(required, optional = {}) {
     const e = optional.env ?? process.env;
     const kind = (e.JINI_SQLITE_BACKEND ?? 'sqlite').trim().toLowerCase();
     if (kind === 'postgres') {
-        const host = e.JINI_PG_HOST ?? '';
-        const portStr = e.JINI_PG_PORT ?? '5432';
-        const database = e.JINI_PG_DATABASE ?? '';
-        const user = e.JINI_PG_USER ?? '';
-        const sslMode = e.JINI_PG_SSL_MODE === 'disable' || e.JINI_PG_SSL_MODE === 'verify-full' ? e.JINI_PG_SSL_MODE : 'require';
-        if (!host || !database || !user) {
-            throw new SqliteBackendConfigError({ message: 'JINI_SQLITE_BACKEND=postgres requires JINI_PG_HOST, JINI_PG_DATABASE, JINI_PG_USER. ' +
-                    'JINI_PG_PORT defaults to 5432; JINI_PG_SSL_MODE defaults to "require".',
-            });
-        }
-        return {
-            kind: 'postgres',
-            postgres: {
-                host,
-                port: Number.parseInt(portStr, 10) || 5432,
-                database,
-                user,
-                sslMode,
-            },
-        };
+        return resolvePostgresConfig({ env: e });
     }
     if (kind !== 'sqlite' && kind !== '') {
         throw new SqliteBackendConfigError({ message: `unknown JINI_SQLITE_BACKEND value '${kind}'. Accepted: 'sqlite' (default), 'postgres'.` });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/server",
-  "version": "0.6.3",
+  "version": "0.6.4",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -65,17 +65,17 @@
     "@vitest/coverage-v8": "^2.1.9",
     "better-sqlite3": "^13.0.0",
     "express": "^4.21.0",
-    "@jini-ai/sidecar": "0.4.3",
-    "@jini-ai/daemon": "0.6.5",
-    "@jini-ai/db": "0.3.4",
-    "@jini-ai/agent-runtime": "0.4.11",
-    "@jini-ai/registry": "0.5.2",
-    "@jini-ai/core": "0.4.6",
-    "@jini-ai/http-kit": "0.4.2",
-    "@jini-ai/chat": "0.6.2"
+    "@jini-ai/core": "0.4.9",
+    "@jini-ai/agent-runtime": "0.4.12",
+    "@jini-ai/http-kit": "0.4.3",
+    "@jini-ai/daemon": "0.6.9",
+    "@jini-ai/sidecar": "0.4.4",
+    "@jini-ai/chat": "0.6.7",
+    "@jini-ai/registry": "0.5.3",
+    "@jini-ai/db": "0.3.6"
   },
   "dependencies": {
-    "@jini-ai/core": "^0.4.6"
+    "@jini-ai/core": "^0.4.9"
   },
   "peerDependencies": {
     "better-sqlite3": "^13.0.0",