@adonis-agora/agent 0.7.1 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @adonis-agora/agent
 
+## 0.9.0
+
+### Minor Changes
+
+- [#25](https://github.com/DavideCarvalho/adonis-agent/pull/25) [`e726f1f`](https://github.com/DavideCarvalho/adonis-agent/commit/e726f1fdcc13e479ffc10c150dc4148bc18efdfb) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Novo `BaseTool` (classe base opcional para a forma de classe de um tool) — o análogo do `BaseWorkflow` do durable. Declarar `static tool = { … }` numa subclasse de `BaseTool` é type-checado pela estática herdada (`static tool?: AiToolOptions`), sem precisar de `satisfies AiToolOptions`. `ToolHandler<I, O = unknown>` e `defineTool<I, O>` passam a tipar o retorno do `execute` (antes `Promise<unknown>`), então o compilador confere o corpo contra o que o tool promete. Ambos non-breaking (defaults preservam o comportamento anterior).
+
+## 0.8.0
+
+### Minor Changes
+
+- [#23](https://github.com/DavideCarvalho/adonis-agent/pull/23) [`19c9ffd`](https://github.com/DavideCarvalho/adonis-agent/commit/19c9ffd9c285c7cab4e487c8bda73f7ce668be9e) Thanks [@DavideCarvalho](https://github.com/DavideCarvalho)! - Add `authzActorResolver` (exported from `@adonis-agora/agent/authz`) — resolve the agent `Actor` from the Agora context populated by authkit (`userRef`, `tenantId`) plus authz `effectiveRoles` (the union global ∪ app ∪ store). Structural, zero hard dependency; authkit+authz apps can drop hand-written actor resolvers. Fail-closed: no identity in context → 401.
+
 ## 0.7.1
 
 ### Patch Changes

package/dist/src/ai-sdk/ai-sdk-model.d.ts

@@ -1,11 +1,22 @@
-import { type CallSettings, type LanguageModel } from 'ai';
+import { type CallSettings, type Experimental_DownloadFunction, type LanguageModel } from 'ai';
 import type { ModelProvider } from '../index.js';
 /**
  * Pass-through settings forwarded to the AI SDK `streamText` call (headers, temperature,
  * `maxOutputTokens`, `providerOptions`, …). `model`, `instructions`, `messages`, `tools`, and
  * `abortSignal` are owned by the adapter and always win over anything set here.
  */
-export type AiSdkModelOptions = CallSettings;
+export type AiSdkModelOptions = CallSettings & {
+    /**
+     * Override the AI SDK's file/attachment downloader (`experimental_download` on `streamText`).
+     * The SDK's DEFAULT downloader refuses localhost/private hostnames (SSRF guard), which breaks
+     * attachment parts whose staging presigns against a local object store (e.g. MinIO in dev) —
+     * the model call dies with `AI_DownloadError: URL with hostname localhost is not allowed`.
+     * Attachment URLs come from the host's own staging SPI — never from user input — so relaxing
+     * the guard with a plain fetch is the host's legitimate call. Pair with the ready-made
+     * {@link import('./attachment-fetch-downloader.js').attachmentFetchDownloader}.
+     */
+    experimental_download?: Experimental_DownloadFunction;
+};
 /**
  * Adapt a Vercel AI SDK v7 `LanguageModel` to the core `ModelProvider` SPI so a host app writes
  * zero provider code. Streams text deltas to `args.sink`, returns the assembled text, requested

package/dist/src/ai-sdk/ai-sdk-model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-sdk-model.d.ts","sourceRoot":"","sources":["../../../src/ai-sdk/ai-sdk-model.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,YAAY,EAKjB,KAAK,aAAa,EAYnB,MAAM,IAAI,CAAC;AAEZ,OAAO,KAAK,EAIV,aAAa,EAMd,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE7C;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,aAAa,CA0CxF"}
+{"version":3,"file":"ai-sdk-model.d.ts","sourceRoot":"","sources":["../../../src/ai-sdk/ai-sdk-model.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,6BAA6B,EAKlC,KAAK,aAAa,EAYnB,MAAM,IAAI,CAAC;AAEZ,OAAO,KAAK,EAIV,aAAa,EAMd,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG;IAC7C;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;CACvD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,aAAa,CA0CxF"}

package/dist/src/ai-sdk/ai-sdk-model.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-sdk-model.js","sourceRoot":"","sources":["../../../src/ai-sdk/ai-sdk-model.ts"],"names":[],"mappings":"AACA,OAAO,EAgBL,UAAU,EACV,UAAU,EACV,IAAI,GACL,MAAM,IAAI,CAAC;AAqBZ;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAoB,EAAE,IAAwB;IACvE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAmB;YAC/B,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,GAAG,IAAI;gBACP,KAAK;gBACL,YAAY,EAAE,IAAI,CAAC,MAAM;gBACzB,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACpC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YAEH,+FAA+F;YAC/F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC/B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;oBAClB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YAED,2FAA2F;YAC3F,4FAA4F;YAC5F,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACtD,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,KAAK;gBACZ,MAAM,CAAC,SAAS;aACjB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAE3D,OAAO;gBACL,IAAI;gBACJ,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;gBACrC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;gBACtB,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAwB;IAC3C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CACN,WAAW,CAAC,MAAM,KAAK,CAAC;gBACtB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;gBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CACxF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAmC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,WAAW,CAAC,GAAG,CACtB,CAAC,MAAM,EAAkB,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,aAAa;oBACnB,UAAU,EAAE,MAAM,CAAC,EAAE;oBACrB,QAAQ,EAAE,MAAM,CAAC,IAAI;oBACrB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;iBAC9B,CAAC,CACH;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAS,gBAAgB,CAAC,KAAqC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,IAAY,EACZ,WAAgC;IAEhC,MAAM,KAAK,GAA2C,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,EAAE;YACtF,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC7B,SAAS,EAAE,UAAU,CAAC,WAAW;gBACjC,QAAQ,EAAE,UAAU,CAAC,IAAI;aAC1B,CACN,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,MAAkB;IACvC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAuB;IACvC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC1B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,MAAwB;IAChD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;AAC9C,CAAC;AAED,sGAAsG;AACtG,SAAS,qBAAqB,CAC5B,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;IACtC,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAO,IAAI,SAAS;QACpB,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAA4B;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAyB;IACzC,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB,EAAE,eAAe,CAAC;IACjE,MAAM,gBAAgB,GAAG,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IACnE,MAAM,eAAe,GAAG,KAAK,CAAC,kBAAkB,EAAE,eAAe,CAAC;IAClE,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;QACrC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAAsC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACvC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAA4B;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,KAA4B;IAE5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC"}
+{"version":3,"file":"ai-sdk-model.js","sourceRoot":"","sources":["../../../src/ai-sdk/ai-sdk-model.ts"],"names":[],"mappings":"AACA,OAAO,EAiBL,UAAU,EACV,UAAU,EACV,IAAI,GACL,MAAM,IAAI,CAAC;AAgCZ;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAoB,EAAE,IAAwB;IACvE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAmB;YAC/B,MAAM,MAAM,GAAG,UAAU,CAAC;gBACxB,GAAG,IAAI;gBACP,KAAK;gBACL,YAAY,EAAE,IAAI,CAAC,MAAM;gBACzB,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACpC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC,CAAC;YAEH,+FAA+F;YAC/F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;YAClC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACvC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC/B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC;oBAClB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC;YAED,2FAA2F;YAC3F,4FAA4F;YAC5F,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACtD,MAAM,CAAC,SAAS;gBAChB,MAAM,CAAC,KAAK;gBACZ,MAAM,CAAC,SAAS;aACjB,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAE3D,OAAO;gBACL,IAAI;gBACJ,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC;gBACrC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;gBACtB,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,QAAwB;IAC3C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CACN,WAAW,CAAC,MAAM,KAAK,CAAC;gBACtB,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;gBAC5C,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CACxF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAC1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAmC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,WAAW,CAAC,GAAG,CACtB,CAAC,MAAM,EAAkB,EAAE,CAAC,CAAC;oBAC3B,IAAI,EAAE,aAAa;oBACnB,UAAU,EAAE,MAAM,CAAC,EAAE;oBACrB,QAAQ,EAAE,MAAM,CAAC,IAAI;oBACrB,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC;iBAC9B,CAAC,CACH;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oGAAoG;AACpG,SAAS,gBAAgB,CAAC,KAAqC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CACjC,IAAY,EACZ,WAAgC;IAEhC,MAAM,KAAK,GAA2C,EAAE,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,UAAU,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,WAAW,EAAE;YACtF,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC7B,SAAS,EAAE,UAAU,CAAC,WAAW;gBACjC,QAAQ,EAAE,UAAU,CAAC,IAAI;aAC1B,CACN,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,MAAkB;IACvC,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAuB;IACvC,MAAM,GAAG,GAAY,EAAE,CAAC;IACxB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC1B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,gBAAgB,CAAC,MAAwB;IAChD,IAAI,WAAW,CAAC,MAAM,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAwB;IAC3C,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;AAC9C,CAAC;AAED,sGAAsG;AACtG,SAAS,qBAAqB,CAC5B,MAAwB;IAExB,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,YAAY,IAAI,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC;IACtC,OAAO,CACL,OAAO,SAAS,KAAK,QAAQ;QAC7B,SAAS,KAAK,IAAI;QAClB,OAAO,IAAI,SAAS;QACpB,OAAO,SAAS,CAAC,KAAK,KAAK,UAAU,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAA4B;IAC/C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,KAAyB;IACzC,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB,EAAE,eAAe,CAAC;IACjE,MAAM,gBAAgB,GAAG,KAAK,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;IACnE,MAAM,eAAe,GAAG,KAAK,CAAC,kBAAkB,EAAE,eAAe,CAAC;IAClE,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,CAAC;QACnC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC;QACrC,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAAsC;IAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACvC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAA4B;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,KAA4B;IAE5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC"}

package/dist/src/ai-sdk/attachment-fetch-downloader.d.ts

@@ -0,0 +1,15 @@
+import type { Experimental_DownloadFunction } from 'ai';
+/**
+ * A ready-made `experimental_download` for {@link import('./ai-sdk-model.js').AiSdkModelOptions}:
+ * plain-fetches every URL the model can't consume natively, with NO hostname policy — unlike the
+ * AI SDK's default downloader, which refuses localhost/private hostnames (SSRF guard) and kills
+ * attachment parts staged against a non-public object store (local MinIO in dev, VPC-only S3).
+ *
+ * Only safe because agent attachment URLs come exclusively from the host's own attachment-staging
+ * SPI presigner — never from user input. Do NOT reuse this for URLs a user can influence.
+ *
+ * Mirrors the default's routing otherwise: URLs the model supports natively are left to the
+ * provider (`null`), everything else is fetched and inlined as bytes.
+ */
+export declare function attachmentFetchDownloader(fetchImpl?: typeof fetch): Experimental_DownloadFunction;
+//# sourceMappingURL=attachment-fetch-downloader.d.ts.map

package/dist/src/ai-sdk/attachment-fetch-downloader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-fetch-downloader.d.ts","sourceRoot":"","sources":["../../../src/ai-sdk/attachment-fetch-downloader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,IAAI,CAAC;AAExD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,GAAE,OAAO,KAAa,GAC9B,6BAA6B,CAmB/B"}

package/dist/src/ai-sdk/attachment-fetch-downloader.js

@@ -0,0 +1,28 @@
+/**
+ * A ready-made `experimental_download` for {@link import('./ai-sdk-model.js').AiSdkModelOptions}:
+ * plain-fetches every URL the model can't consume natively, with NO hostname policy — unlike the
+ * AI SDK's default downloader, which refuses localhost/private hostnames (SSRF guard) and kills
+ * attachment parts staged against a non-public object store (local MinIO in dev, VPC-only S3).
+ *
+ * Only safe because agent attachment URLs come exclusively from the host's own attachment-staging
+ * SPI presigner — never from user input. Do NOT reuse this for URLs a user can influence.
+ *
+ * Mirrors the default's routing otherwise: URLs the model supports natively are left to the
+ * provider (`null`), everything else is fetched and inlined as bytes.
+ */
+export function attachmentFetchDownloader(fetchImpl = fetch) {
+    return (requests) => Promise.all(requests.map(async ({ url, isUrlSupportedByModel }) => {
+        if (isUrlSupportedByModel) {
+            return null;
+        }
+        const response = await fetchImpl(url);
+        if (!response.ok) {
+            throw new Error(`attachmentFetchDownloader: ${response.status} fetching attachment from ${url.hostname}`);
+        }
+        return {
+            data: new Uint8Array(await response.arrayBuffer()),
+            mediaType: response.headers.get('content-type') ?? undefined,
+        };
+    }));
+}
+//# sourceMappingURL=attachment-fetch-downloader.js.map

package/dist/src/ai-sdk/attachment-fetch-downloader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-fetch-downloader.js","sourceRoot":"","sources":["../../../src/ai-sdk/attachment-fetch-downloader.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CACvC,YAA0B,KAAK;IAE/B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAClB,OAAO,CAAC,GAAG,CACT,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE;QACpD,IAAI,qBAAqB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,MAAM,6BAA6B,GAAG,CAAC,QAAQ,EAAE,CACzF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;YAClD,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,SAAS;SAC7D,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;AACN,CAAC"}

package/dist/src/ai-sdk/index.d.ts

@@ -1,2 +1,3 @@
 export { aiSdkModel, type AiSdkModelOptions } from './ai-sdk-model.js';
+export { attachmentFetchDownloader } from './attachment-fetch-downloader.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/ai-sdk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai-sdk/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai-sdk/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/src/ai-sdk/index.js

@@ -1,2 +1,3 @@
 export { aiSdkModel } from './ai-sdk-model.js';
+export { attachmentFetchDownloader } from './attachment-fetch-downloader.js';
 //# sourceMappingURL=index.js.map

package/dist/src/ai-sdk/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ai-sdk/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ai-sdk/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAA0B,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/src/ai-tool-ref.d.ts

@@ -85,5 +85,5 @@ export declare function isBrandedFunctionalTool(value: unknown): value is Brande
  * )
  * ```
  */
-export declare function defineTool<I = unknown>(options: AiToolOptions, execute: (input: I, ctx: AiToolCtx) => Promise<unknown> | unknown): BrandedFunctionalTool;
+export declare function defineTool<I = unknown, O = unknown>(options: AiToolOptions, execute: (input: I, ctx: AiToolCtx) => Promise<O> | O): BrandedFunctionalTool;
 //# sourceMappingURL=ai-tool-ref.d.ts.map

package/dist/src/ai-tool-ref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ai-tool-ref.d.ts","sourceRoot":"","sources":["../../src/ai-tool-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAAgD,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAAmD,CAAC;AAE1F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,gBAAgB,CAAC;IACxB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wGAAwG;AACxG,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC;AAEvC,2FAA2F;AAC3F,MAAM,MAAM,SAAS,GAAG,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,WAAW,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,IACnC,CAAC,SAAS,SAAS,EAAE,QAAQ,CAAC,KAAG,CAAC,CAQ3C;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAMtE;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC3D,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACnC;AAED,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAQtF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,CAAC,GAAG,OAAO,EACpC,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,GAChE,qBAAqB,CAcvB"}
+{"version":3,"file":"ai-tool-ref.d.ts","sourceRoot":"","sources":["../../src/ai-tool-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAAgD,CAAC;AAEvF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,OAAO,MAAmD,CAAC;AAE1F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,KAAK,EAAE,gBAAgB,CAAC;IACxB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wGAAwG;AACxG,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC;AAEvC,2FAA2F;AAC3F,MAAM,MAAM,SAAS,GAAG,QAAQ,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,WAAW,CAAC;AAEvE;;;;;;;;;;;GAWG;AACH,wBAAgB,MAAM,CAAC,OAAO,EAAE,aAAa,IACnC,CAAC,SAAS,SAAS,EAAE,QAAQ,CAAC,KAAG,CAAC,CAQ3C;AAyBD;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAMtE;AAED,4FAA4F;AAC5F,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,oGAAoG;AACpG,MAAM,WAAW,qBAAsB,SAAQ,cAAc;IAC3D,QAAQ,CAAC,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;CACnC;AAED,kGAAkG;AAClG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAQtF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,EACjD,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GACpD,qBAAqB,CAcvB"}

package/dist/src/ai-tool-ref.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-tool-ref.js","sourceRoot":"","sources":["../../src/ai-tool-ref.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkB,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkB,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AA8B1F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CAAC,OAAsB;IAC3C,OAAO,CAAsB,MAAS,EAAK,EAAE;QAC3C,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE;YAC9C,KAAK,EAAE,OAAO;YACd,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAQ,MAA8C,CAAC,gBAAgB,CAAC,CAAC;AAC3E,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,MAAM,GAAI,MAAmC,CAAC,IAAI,CAAC;IACzD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kGAAkG;AAClG,SAAS,MAAM,CAAC,MAAe;IAC7B,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAI,MAAoC,CAAC,WAAW,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAaD,kGAAkG;AAClG,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,gBAAgB,IAAI,KAAK;QACzB,MAAM,IAAI,KAAK;QACf,SAAS,IAAI,KAAK,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CACxB,OAAsB,EACtB,OAAiE;IAEjE,MAAM,IAAI,GAAa;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,OAAO;QACL,CAAC,gBAAgB,CAAC,EAAE,IAAI;QACxB,IAAI;QACJ,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAU,EAAE,GAAG,CAAC,CAAC,EAAE;KAChF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ai-tool-ref.js","sourceRoot":"","sources":["../../src/ai-tool-ref.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkB,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAkB,MAAM,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;AA8B1F;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,MAAM,CAAC,OAAsB;IAC3C,OAAO,CAAsB,MAAS,EAAK,EAAE;QAC3C,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,EAAE;YAC9C,KAAK,EAAE,OAAO;YACd,UAAU,EAAE,KAAK;YACjB,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAQ,MAA8C,CAAC,gBAAgB,CAAC,CAAC;AAC3E,CAAC;AAED,6FAA6F;AAC7F,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,SAAS,CAAC;IACnD,MAAM,MAAM,GAAI,MAAmC,CAAC,IAAI,CAAC;IACzD,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kGAAkG;AAClG,SAAS,MAAM,CAAC,MAAe;IAC7B,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,MAAM,KAAK,UAAU,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAI,MAAoC,CAAC,WAAW,CAAC;IAC/D,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAaD,kGAAkG;AAClG,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,gBAAgB,IAAI,KAAK;QACzB,MAAM,IAAI,KAAK;QACf,SAAS,IAAI,KAAK,CACnB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CACxB,OAAsB,EACtB,OAAqD;IAErD,MAAM,IAAI,GAAa;QACrB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,KAAK;QAC1B,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,OAAO;QACL,CAAC,gBAAgB,CAAC,EAAE,IAAI;QACxB,IAAI;QACJ,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAU,EAAE,GAAG,CAAC,CAAC,EAAE;KAChF,CAAC;AACJ,CAAC"}

package/dist/src/authz/agora-context.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Structural, dependency-free reader for the Agora runtime context — mirrors
+ * `@adonis-agora/authz`'s `agora/context.ts`. The Agora context library publishes a READ accessor
+ * on the well-known symbol slot. We never import that package; when the slot is absent (context not
+ * installed) the reader degrades to `undefined` and the caller fails closed.
+ */
+/** The symbol slot the Agora context library writes its read accessor into. */
+export declare const AGORA_CONTEXT_ACCESSOR: unique symbol;
+/**
+ * The slice of the context accessor this package reads. `userRef` and `tenantId` are direct
+ * accessor fields (authkit writes them via the `set` slot); we never read `globalRoles` here —
+ * authz's `effectiveRoles` does that internally.
+ */
+export interface AgoraContextAccessor {
+    tenantId?: string;
+    userRef?: {
+        type?: string;
+        id?: string | number;
+    };
+    get?: () => unknown;
+}
+/** Read the active Agora context accessor from the global slot, if present. */
+export declare function readContextAccessor(): AgoraContextAccessor | undefined;
+//# sourceMappingURL=agora-context.d.ts.map

package/dist/src/authz/agora-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agora-context.d.ts","sourceRoot":"","sources":["../../../src/authz/agora-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,eAAwC,CAAC;AAE5E;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,OAAO,CAAC;CACrB;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,IAAI,oBAAoB,GAAG,SAAS,CAItE"}

package/dist/src/authz/agora-context.js

@@ -0,0 +1,16 @@
+/**
+ * Structural, dependency-free reader for the Agora runtime context — mirrors
+ * `@adonis-agora/authz`'s `agora/context.ts`. The Agora context library publishes a READ accessor
+ * on the well-known symbol slot. We never import that package; when the slot is absent (context not
+ * installed) the reader degrades to `undefined` and the caller fails closed.
+ */
+/** The symbol slot the Agora context library writes its read accessor into. */
+export const AGORA_CONTEXT_ACCESSOR = Symbol.for('@agora/context:accessor');
+/** Read the active Agora context accessor from the global slot, if present. */
+export function readContextAccessor() {
+    const slot = globalThis[AGORA_CONTEXT_ACCESSOR];
+    if (slot == null || typeof slot !== 'object')
+        return undefined;
+    return slot;
+}
+//# sourceMappingURL=agora-context.js.map

package/dist/src/authz/agora-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agora-context.js","sourceRoot":"","sources":["../../../src/authz/agora-context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAa5E,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAI,UAAsC,CAAC,sBAAsB,CAAC,CAAC;IAC7E,IAAI,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/D,OAAO,IAA4B,CAAC;AACtC,CAAC"}

package/dist/src/authz/authz-actor-resolver.d.ts

@@ -0,0 +1,35 @@
+import type { ActorResolver } from '../spi/actor-resolver.js';
+import type { Actor } from '../types.js';
+import type { AuthzTenantScope } from './authz-tool-authorizer.js';
+/**
+ * The structural slice of `@adonis-agora/authz`'s `AuthzService` this resolver needs: the user's
+ * effective roles (authz's union of global (context) ∪ app (`resolveRoles`) ∪ store (DB)). Typed
+ * structurally so `@adonis-agora/authz` stays an OPTIONAL lazy peer — zero import of the package.
+ */
+export interface AuthzRolesSourceLike {
+    effectiveRoles(user: unknown, scope?: AuthzTenantScope): Promise<string[]>;
+}
+/** Options for {@link AuthzActorResolver} / {@link authzActorResolver}. */
+export interface AuthzActorResolverConfig {
+    /** The `@adonis-agora/authz` `AuthzService` (or any structural match) the resolver reads roles from. */
+    authz: AuthzRolesSourceLike;
+}
+/**
+ * An {@link ActorResolver} that reads the caller from the Agora context authkit populates
+ * (`userRef`, `tenantId`) and takes the caller's roles from authz (`effectiveRoles`). It ignores
+ * the transport `req` and reads the active Agora context store, so it needs no `ctx.auth` and is
+ * framework-agnostic.
+ *
+ * Security posture — FAIL-CLOSED: no `userRef.id` in context → throws (the provider replies 401).
+ * An identity is never fabricated. The context `userRef` is passed straight to `effectiveRoles`;
+ * authz reads its `.id`/`.type` and re-reads `globalRoles` from the same context, so global roles
+ * (e.g. `ADMIN`) land in the result with no extra wiring.
+ */
+export declare class AuthzActorResolver implements ActorResolver {
+    #private;
+    constructor(config: AuthzActorResolverConfig);
+    resolve(_req: unknown): Promise<Actor>;
+}
+/** Factory for {@link AuthzActorResolver}. */
+export declare function authzActorResolver(config: AuthzActorResolverConfig): ActorResolver;
+//# sourceMappingURL=authz-actor-resolver.d.ts.map

package/dist/src/authz/authz-actor-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-actor-resolver.d.ts","sourceRoot":"","sources":["../../../src/authz/authz-actor-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEnE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5E;AAED,2EAA2E;AAC3E,MAAM,WAAW,wBAAwB;IACvC,wGAAwG;IACxG,KAAK,EAAE,oBAAoB,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,qBAAa,kBAAmB,YAAW,aAAa;;gBAG1C,MAAM,EAAE,wBAAwB;IAItC,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;CAsB7C;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,aAAa,CAElF"}

package/dist/src/authz/authz-actor-resolver.js

@@ -0,0 +1,41 @@
+import { readContextAccessor } from './agora-context.js';
+/**
+ * An {@link ActorResolver} that reads the caller from the Agora context authkit populates
+ * (`userRef`, `tenantId`) and takes the caller's roles from authz (`effectiveRoles`). It ignores
+ * the transport `req` and reads the active Agora context store, so it needs no `ctx.auth` and is
+ * framework-agnostic.
+ *
+ * Security posture — FAIL-CLOSED: no `userRef.id` in context → throws (the provider replies 401).
+ * An identity is never fabricated. The context `userRef` is passed straight to `effectiveRoles`;
+ * authz reads its `.id`/`.type` and re-reads `globalRoles` from the same context, so global roles
+ * (e.g. `ADMIN`) land in the result with no extra wiring.
+ */
+export class AuthzActorResolver {
+    #authz;
+    constructor(config) {
+        this.#authz = config.authz;
+    }
+    async resolve(_req) {
+        const accessor = readContextAccessor();
+        const ref = accessor?.userRef;
+        if (ref?.id === undefined || ref.id === null || String(ref.id).length === 0) {
+            throw new Error('authzActorResolver: no authenticated identity in @agora/context. The agent route must ' +
+                'sit behind authkit auth middleware (which populates the context), with the ' +
+                '@adonis-agora/context provider registered.');
+        }
+        const scope = accessor?.tenantId
+            ? { tenantId: accessor.tenantId }
+            : undefined;
+        const roles = await this.#authz.effectiveRoles(ref, scope);
+        return {
+            id: String(ref.id),
+            roles,
+            ...(accessor?.tenantId ? { tenantRef: accessor.tenantId } : {}),
+        };
+    }
+}
+/** Factory for {@link AuthzActorResolver}. */
+export function authzActorResolver(config) {
+    return new AuthzActorResolver(config);
+}
+//# sourceMappingURL=authz-actor-resolver.js.map

package/dist/src/authz/authz-actor-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz-actor-resolver.js","sourceRoot":"","sources":["../../../src/authz/authz-actor-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAkBzD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,kBAAkB;IACpB,MAAM,CAAuB;IAEtC,YAAY,MAAgC;QAC1C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAa;QACzB,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,QAAQ,EAAE,OAAO,CAAC;QAC9B,IAAI,GAAG,EAAE,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CACb,wFAAwF;gBACtF,6EAA6E;gBAC7E,4CAA4C,CAC/C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAiC,QAAQ,EAAE,QAAQ;YAC5D,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE;YACjC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAE3D,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,KAAK;YACL,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,CAAC;IACJ,CAAC;CACF;AAED,8CAA8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,MAAgC;IACjE,OAAO,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/authz/index.d.ts

@@ -1,3 +1,5 @@
 export { AuthzToolAuthorizer, authzToolAuthorizer, defaultUserFromActor, } from './authz-tool-authorizer.js';
 export type { AuthzToolAuthorizerConfig, AuthzServiceLike, AuthzTenantScope, } from './authz-tool-authorizer.js';
+export { AuthzActorResolver, authzActorResolver } from './authz-actor-resolver.js';
+export type { AuthzActorResolverConfig, AuthzRolesSourceLike } from './authz-actor-resolver.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/authz/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACnF,YAAY,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/src/authz/index.js

@@ -1,2 +1,3 @@
 export { AuthzToolAuthorizer, authzToolAuthorizer, defaultUserFromActor, } from './authz-tool-authorizer.js';
+export { AuthzActorResolver, authzActorResolver } from './authz-actor-resolver.js';
 //# sourceMappingURL=index.js.map

package/dist/src/authz/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/authz/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAMpC,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/src/base-tool.d.ts

@@ -0,0 +1,31 @@
+import type { AiToolOptions } from './ai-tool-ref.js';
+import type { AiToolCtx, ToolHandler } from './spi/tool.js';
+/**
+ * Optional base class for the class-authoring form of a tool — the counterpart of durable's
+ * `BaseWorkflow`. Declaring `static tool?: AiToolOptions` here means a subclass writes
+ * `static tool = { name, kind, description, input, … }` and gets it type-checked by the inherited
+ * static declaration — no `satisfies AiToolOptions` needed. Implement `execute(input, ctx)`; the
+ * discovery scan reads the static `tool` off the subclass and registers it (the abstract base
+ * carries no `static tool`, so it is never registered itself).
+ *
+ * `I` is the parsed (Zod) input; `O` is the return — both flow into `execute`'s signature, so the
+ * compiler checks the body against what the tool promises.
+ *
+ * ```ts
+ * export default class FilaDeAlocacao extends BaseTool<Input, Row[]> {
+ *   static tool = {
+ *     name: 'fila_de_alocacao',
+ *     kind: 'read',
+ *     description: '…',
+ *     input: z.object({}),
+ *     ability: 'agent.coordenador.fila.ler',
+ *   }
+ *   async execute(_input: Input, ctx: AiToolCtx): Promise<Row[]> { … }
+ * }
+ * ```
+ */
+export declare abstract class BaseTool<I = unknown, O = unknown> implements ToolHandler<I, O> {
+    static tool?: AiToolOptions;
+    abstract execute(input: I, ctx: AiToolCtx): Promise<O> | O;
+}
+//# sourceMappingURL=base-tool.d.ts.map

package/dist/src/base-tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-tool.d.ts","sourceRoot":"","sources":["../../src/base-tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,8BAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC,GAAG,OAAO,CAAE,YAAW,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACnF,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;CAC3D"}

package/dist/src/base-tool.js

@@ -0,0 +1,28 @@
+/**
+ * Optional base class for the class-authoring form of a tool — the counterpart of durable's
+ * `BaseWorkflow`. Declaring `static tool?: AiToolOptions` here means a subclass writes
+ * `static tool = { name, kind, description, input, … }` and gets it type-checked by the inherited
+ * static declaration — no `satisfies AiToolOptions` needed. Implement `execute(input, ctx)`; the
+ * discovery scan reads the static `tool` off the subclass and registers it (the abstract base
+ * carries no `static tool`, so it is never registered itself).
+ *
+ * `I` is the parsed (Zod) input; `O` is the return — both flow into `execute`'s signature, so the
+ * compiler checks the body against what the tool promises.
+ *
+ * ```ts
+ * export default class FilaDeAlocacao extends BaseTool<Input, Row[]> {
+ *   static tool = {
+ *     name: 'fila_de_alocacao',
+ *     kind: 'read',
+ *     description: '…',
+ *     input: z.object({}),
+ *     ability: 'agent.coordenador.fila.ler',
+ *   }
+ *   async execute(_input: Input, ctx: AiToolCtx): Promise<Row[]> { … }
+ * }
+ * ```
+ */
+export class BaseTool {
+    static tool;
+}
+//# sourceMappingURL=base-tool.js.map

package/dist/src/base-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-tool.js","sourceRoot":"","sources":["../../src/base-tool.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAgB,QAAQ;IAC5B,MAAM,CAAC,IAAI,CAAiB;CAE7B"}

package/dist/src/index.d.ts

@@ -1,6 +1,7 @@
-export declare const VERSION = "0.7.1";
+export declare const VERSION = "0.9.0";
 export * from './types.js';
 export * from './spi/tool.js';
+export * from './base-tool.js';
 export * from './spi/model-provider.js';
 export * from './spi/token-stream-sink.js';
 export * from './spi/agent-store.js';

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,qCAAqC,EACrC,uCAAuC,GACxC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,yBAAyB,EACzB,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,iBAAiB,CAAC;AACzB,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,YAAY,EACZ,MAAM,EACN,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,MAAM,EACN,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,UAAU,EACV,SAAS,EACT,cAAc,EACd,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACpG,YAAY,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,YAAY,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAG9E,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACX,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,qCAAqC,EACrC,uCAAuC,GACxC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,yBAAyB,EACzB,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,iBAAiB,CAAC;AACzB,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,YAAY,EACZ,MAAM,EACN,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,0BAA0B,EAC1B,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,EAChB,wBAAwB,EACxB,wBAAwB,EACxB,YAAY,EACZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,MAAM,EACN,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,UAAU,EACV,SAAS,EACT,cAAc,EACd,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACpG,YAAY,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,EACpB,KAAK,2BAA2B,GACjC,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,YAAY,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAG9E,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACX,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,cAAc,EACd,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,MAAM,iBAAiB,CAAC"}

package/dist/src/index.js

@@ -1,6 +1,7 @@
-export const VERSION = '0.7.1';
+export const VERSION = '0.9.0';
 export * from './types.js';
 export * from './spi/tool.js';
+export * from './base-tool.js';
 export * from './spi/model-provider.js';
 export * from './spi/token-stream-sink.js';
 export * from './spi/agent-store.js';

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,qCAAqC,EACrC,uCAAuC,GACxC,MAAM,iBAAiB,CAAC;AAMzB,cAAc,kBAAkB,CAAC;AAEjC,gFAAgF;AAChF,OAAO,EACL,YAAY,EACZ,MAAM,EACN,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgCnD,OAAO,EACL,MAAM,EACN,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEpG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E,gFAAgF;AAChF,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACX,aAAa,GACd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,wBAAwB,CAAC;AACvC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,YAAY,EACZ,kBAAkB,GAGnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,qCAAqC,EACrC,uCAAuC,GACxC,MAAM,iBAAiB,CAAC;AAMzB,cAAc,kBAAkB,CAAC;AAEjC,gFAAgF;AAChF,OAAO,EACL,YAAY,EACZ,MAAM,EACN,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,UAAU,EACV,gBAAgB,EAChB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAgCnD,OAAO,EACL,MAAM,EACN,UAAU,EACV,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEpG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EACL,oBAAoB,GAErB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E,gFAAgF;AAChF,OAAO,EACL,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,WAAW,EACX,aAAa,GACd,MAAM,iBAAiB,CAAC"}

package/dist/src/rag/filter.d.ts

@@ -1,6 +1,15 @@
 /**
- * Exact-match metadata filter (every key in `filter` must equal the record's). Used by the in-memory
- * {@link import('./memory-vector-store.js').MemoryVectorStore}. Pure and dependency-free.
+ * Metadata filter, shared by the in-memory {@link import('./memory-vector-store.js').MemoryVectorStore}
+ * (and any lexical retriever). Every key must match:
+ *
+ * - a **scalar** filter value keeps exact-match — the record's value must equal it;
+ * - an **array** filter value means **match-any** (OR / set membership) — the record matches when its
+ *   value for that key is one of them, or (for a multi-valued record) shares at least one element.
+ *   An empty array matches nothing (no value is a member of the empty set) — the deny primitive.
+ *
+ * Array-valued filters are how a caller expresses capability-style access control over a shared store
+ * (e.g. `{ audience: ['public', 'role:ADMIN', 'base:…'] }`) without the store knowing what a token means.
+ * Pure and dependency-free; backward compatible (scalar filters behave exactly as before).
  */
 export declare function matchesFilter(metadata: Record<string, unknown> | undefined, filter: Record<string, unknown>): boolean;
 //# sourceMappingURL=filter.d.ts.map

package/dist/src/rag/filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../../../src/rag/filter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAKT"}
+{"version":3,"file":"filter.d.ts","sourceRoot":"","sources":["../../../src/rag/filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAcT"}

package/dist/src/rag/filter.js

@@ -1,11 +1,29 @@
 /**
- * Exact-match metadata filter (every key in `filter` must equal the record's). Used by the in-memory
- * {@link import('./memory-vector-store.js').MemoryVectorStore}. Pure and dependency-free.
+ * Metadata filter, shared by the in-memory {@link import('./memory-vector-store.js').MemoryVectorStore}
+ * (and any lexical retriever). Every key must match:
+ *
+ * - a **scalar** filter value keeps exact-match — the record's value must equal it;
+ * - an **array** filter value means **match-any** (OR / set membership) — the record matches when its
+ *   value for that key is one of them, or (for a multi-valued record) shares at least one element.
+ *   An empty array matches nothing (no value is a member of the empty set) — the deny primitive.
+ *
+ * Array-valued filters are how a caller expresses capability-style access control over a shared store
+ * (e.g. `{ audience: ['public', 'role:ADMIN', 'base:…'] }`) without the store knowing what a token means.
+ * Pure and dependency-free; backward compatible (scalar filters behave exactly as before).
  */
 export function matchesFilter(metadata, filter) {
+    const entries = Object.entries(filter);
     if (metadata === undefined) {
-        return Object.keys(filter).length === 0;
+        return entries.length === 0;
     }
-    return Object.entries(filter).every(([key, value]) => metadata[key] === value);
+    return entries.every(([key, expected]) => {
+        if (Array.isArray(expected)) {
+            const actual = metadata[key];
+            return Array.isArray(actual)
+                ? actual.some((value) => expected.includes(value))
+                : expected.includes(actual);
+        }
+        return metadata[key] === expected;
+    });
 }
 //# sourceMappingURL=filter.js.map

package/dist/src/rag/filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../../src/rag/filter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA6C,EAC7C,MAA+B;IAE/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC;AACjF,CAAC"}
+{"version":3,"file":"filter.js","sourceRoot":"","sources":["../../../src/rag/filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA6C,EAC7C,MAA+B;IAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAClD,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/rag/hybrid-retriever.d.ts

@@ -0,0 +1,23 @@
+import type { Passage, RetrieveOptions, Retriever } from '../spi/retriever.js';
+export interface HybridRetrieverOptions {
+    /** RRF constant — larger flattens the rank weighting. Default 60 (the value from the original paper). */
+    k?: number;
+    /** Candidates pulled from each retriever before fusion. Default 20. */
+    fetchTopK?: number;
+    /** Per-retriever multipliers on each RRF contribution (same order as `retrievers`). Default all 1. */
+    weights?: number[];
+}
+/**
+ * Fuses several retrievers with Reciprocal Rank Fusion — the robust way to combine, say, dense vector
+ * search with lexical BM25. RRF scores each passage by `Σ weight / (k + rank)` across the lists it
+ * appears in, so it needs no score normalization between incompatible scales (cosine vs BM25).
+ * Deduplicates by passage id, so aligned chunk ids from the two retrievers reinforce. Itself a
+ * {@link Retriever}. Mirrors the reference `HybridRetriever` exactly.
+ */
+export declare class HybridRetriever implements Retriever {
+    private readonly retrievers;
+    private readonly options;
+    constructor(retrievers: Retriever[], options?: HybridRetrieverOptions);
+    retrieve(query: string, options?: RetrieveOptions): Promise<Passage[]>;
+}
+//# sourceMappingURL=hybrid-retriever.d.ts.map

package/dist/src/rag/hybrid-retriever.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hybrid-retriever.d.ts","sourceRoot":"","sources":["../../../src/rag/hybrid-retriever.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAE/E,MAAM,WAAW,sBAAsB;IACrC,yGAAyG;IACzG,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;GAMG;AACH,qBAAa,eAAgB,YAAW,SAAS;IAE7C,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,UAAU,EAAE,SAAS,EAAE,EACvB,OAAO,GAAE,sBAA2B;IAGjD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAgCjF"}