Resync lockfile version; document global registries; refresh metadata

- package-lock.json: root version field was stale (1.2.0) from sed-based version
  bumps that skipped npm install. Resynced to 2.8.0. (npm ci still passed — it
  tolerates the root version field as long as the dependency tree matches, which
  it did — so CI was not red; this is a cleanliness fix.)
- Docs: disclose that @secret field names are matched process-globally by
  redact(), and that @tool names are a process-global unique registry (duplicates
  overwrite). README + JSDoc + llms.txt.
- package.json: description + keywords now cover resilience, observability,
  redaction, and AI tools for discoverability.

105 main + 2 dist green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Author: dwivna

README.md

@@ -105,6 +105,10 @@ request.
 > sensitive. It cannot mask a secret passed as a positional **primitive**
 > (e.g. `login(rawToken)`) or one embedded in an error message/stack. Pass
 > secrets as named object fields, and don't put them in error messages.
+>
+> `@Secret` field names are registered **process-globally**, so `redact()` masks
+> that field name everywhere — pick distinctive secret field names (`jwtSecret`,
+> not `id`) to avoid over-masking unrelated fields.
 
 ```ts
 import { redact, redactFormat } from '@master4n/decorators';
@@ -246,6 +250,10 @@ const result = invokeTool(new WeatherService(), call.name, call.arguments);
 `parameters` is an **explicit** JSON Schema — TypeScript parameter types are
 erased at runtime, so the library does not (and cannot honestly) infer it.
 
+> Tool names live in a **process-global** registry and must be unique — a
+> duplicate name overwrites the earlier one (so `invokeTool` would target the
+> wrong method). Give colliding tools an explicit unique `name`.
+
 ## Observability (method decorators)
 
 | Decorator         | Description                                                              |

llms.txt

@@ -133,6 +133,7 @@ class AppConfig {
   (OpenAI `tools`/`parameters`, Anthropic `input_schema`).
 - `invokeTool(instance, name, args)` — dispatch a model tool call to the method on `instance`.
 - `clearTools()` — clear the registry (tests). Types: `ToolOptions`, `ToolManifest`, `ToolParameters`.
+- Tool names are process-global and must be unique (a duplicate overwrites the earlier entry).
 
 ## Observability (method decorators)
 

package-lock.json

@@ -1,7 +1,7 @@
 {
   "name": "@master4n/decorators",
   "version": "2.8.0",
-  "description": "AI-friendly TypeScript decorators for Node/backend apps — Spring-style config & value injection (@Value/@Env/@Config), validation, and boilerplate-reducing utilities. One decorator replaces a block of code.",
+  "description": "AI-friendly TypeScript decorators for Node/backend apps: config & value injection, validation & transforms, resilience (retry, timeout, circuit breaker, rate limit, cache), observability (trace, audit), secret redaction, and LLM @Tool registration. One decorator replaces a block of code.",
   "main": "./dist/commonjs/index.cjs",
   "module": "./dist/esm/index.js",
   "types": "./dist/index.d.ts",
@@ -38,6 +38,19 @@
     "dotenv",
     "yaml",
     "validation",
+    "transform",
+    "retry",
+    "timeout",
+    "circuit-breaker",
+    "rate-limit",
+    "cache",
+    "memoize",
+    "debounce",
+    "observability",
+    "redaction",
+    "llm",
+    "tools",
+    "agent",
     "ai-agents",
     "ai-friendly",
     "boilerplate"

package.json

@@ -43,6 +43,11 @@ const tools = new Map<string, ToolEntry>();
  *
  * The method should accept a single arguments object matching `parameters`.
  *
+ * Tool names are registered in a **process-global** registry and must be unique:
+ * a duplicate name (including two classes relying on the same default method
+ * name) overwrites the earlier entry, so `invokeTool` would dispatch to the
+ * last-registered method. Give colliding tools explicit, unique `name`s.
+ *
  * @example
  * class Weather {
  *   \@Tool({