@buoy-gg/agent-core 7.0.33

package/lib/typescript/catalog/toProviderTools.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Catalog -> provider tool definitions.
+ *
+ * WHY ONE TOOL PER BUOY TOOL, NOT ONE PER ACTION: tool-selection accuracy
+ * degrades past roughly 30-50 tools. Buoy has ~179 actions across 22 tools, so
+ * a 1:1 mapping is far past the point where the model starts picking wrong.
+ * Each Buoy tool therefore becomes ONE provider tool whose `action` property is
+ * an enum, with the per-action summaries folded into that enum's description.
+ *
+ * `params` stays an open object at the provider boundary — a discriminated
+ * union across 179 branches is unusable by any model and unreadable by a human.
+ * The real per-action schema is enforced one layer in, by `validateParams`,
+ * which returns a structured error the model can correct on the next turn.
+ * That is strictly stronger than the MCP server's `z.record(z.unknown())`,
+ * which validates nothing.
+ */
+import type { ToolDescriptor } from "../types";
+/** Provider-agnostic tool definition; the adapters reshape it per protocol. */
+export interface ProviderTool {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: "object";
+        properties: Record<string, unknown>;
+        required: string[];
+        additionalProperties: boolean;
+    };
+}
+export declare function toProviderToolName(toolId: string): string;
+/** Reverse of {@link toProviderToolName}, resolved against the live catalog. */
+export declare function fromProviderToolName(name: string, catalog: ToolDescriptor[]): string | undefined;
+export interface ToProviderToolsOptions {
+    /**
+     * Tool ids actually dispatchable on this device, from `listToolActions()`.
+     * A tool the app didn't install must not be offered — the model will
+     * otherwise spend a turn calling something that can only fail.
+     */
+    availableToolIds?: string[];
+    /** Available action names per tool, when the host can supply them. */
+    availableActions?: Record<string, string[]>;
+    /** `__DEV__ === false`. Drives the release annotations and filtering. */
+    isRelease?: boolean;
+    /**
+     * Drop actions that cannot work in this build instead of annotating them.
+     * Default false: an annotated-but-present action lets the model explain the
+     * limitation to the user, which is more useful than silently having no way
+     * to talk about it.
+     */
+    hideUnavailable?: boolean;
+}
+export declare function toProviderTools(catalog: ToolDescriptor[], opts?: ToProviderToolsOptions): ProviderTool[];
+//# sourceMappingURL=toProviderTools.d.ts.map

package/lib/typescript/catalog/toProviderTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toProviderTools.d.ts","sourceRoot":"","sources":["../../../src/catalog/toProviderTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAoB,cAAc,EAAE,MAAM,UAAU,CAAC;AAEjE,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE;QACX,IAAI,EAAE,QAAQ,CAAC;QACf,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACpC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,oBAAoB,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AASD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,cAAc,EAAE,GACxB,MAAM,GAAG,SAAS,CAEpB;AAmBD,MAAM,WAAW,sBAAsB;IACrC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,cAAc,EAAE,EACzB,IAAI,GAAE,sBAA2B,GAChC,YAAY,EAAE,CAiEhB"}

package/lib/typescript/catalog/validateParams.d.ts

@@ -0,0 +1,33 @@
+/**
+ * A deliberately small JSON Schema validator.
+ *
+ * Buoy's adapters validate nothing — every handler takes `params?: unknown` and
+ * hand-casts (`(params as { id?: string })?.id`), so a wrong shape becomes an
+ * undefined read, and an LLM omitting an optional flag can do real damage:
+ * `zustand.setState` defaults `replace ?? true`, so calling it without
+ * `replace` REPLACES the entire store rather than merging it.
+ *
+ * So the agent validates before it dispatches. The point is not spec
+ * compliance — it is that a rejection comes back to the model as a readable
+ * error naming the expected schema, which it can fix on the next turn. That is
+ * why this covers exactly the subset `JsonSchema` describes and nothing more:
+ * a rule the validator silently skips is a rule that isn't enforced.
+ */
+import type { JsonSchema } from "../types";
+export interface ValidationResult {
+    ok: boolean;
+    errors: string[];
+}
+export declare function validateParams(params: unknown, schema: JsonSchema): ValidationResult;
+/**
+ * Fill in documented defaults the model left out.
+ *
+ * This is the counter-measure to the omitted-flag class of bug. Several Buoy
+ * actions invert the usual assumption — `focus-inspector.setTracking` reads
+ * `params?.enabled !== false`, so calling it with `{}` turns tracking ON — and
+ * the catalog records the real default. Applying it explicitly means the model
+ * omitting a flag produces the documented behaviour rather than the accidental
+ * one.
+ */
+export declare function applyDefaults(params: unknown, schema: JsonSchema): Record<string, unknown>;
+//# sourceMappingURL=validateParams.d.ts.map

package/lib/typescript/catalog/validateParams.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateParams.d.ts","sourceRoot":"","sources":["../../../src/catalog/validateParams.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AA6FD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,UAAU,GACjB,gBAAgB,CAMlB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,UAAU,GACjB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB"}

package/lib/typescript/context/buildContextPack.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The grounding digest — "here is what this app looks like".
+ *
+ * Composed entirely from readers that already exist. Most Buoy adapters ship a
+ * compact action written explicitly for a remote driver (`listQueries`,
+ * `listStores`, `listAtoms`, `getState`, `async.getAllKeys`), and those are
+ * exactly the right size: measured on a live idle device the whole digest is
+ * ~5.7KB (~1.5K tokens) covering routes, env, query keys, redux slices,
+ * zustand stores, jotai atoms, storage keys and API hosts.
+ *
+ * What this does NOT do, and why:
+ * - No `getSnapshot('query')`. It returns the full dehydrated cache — 8.3KB for
+ *   ten queries in that same measurement, growing with every cached payload.
+ *   `listQueries` covers the same ground in 1.8KB.
+ * - No console. It is the fattest payload in the system at ~1.1KB per entry
+ *   with up to 1000 retained; a naive "include recent logs" is a 1MB prompt.
+ * - No values, only shapes and keys. `includeValues`/`includeData` are
+ *   unbounded on the action path — no adapter applies a size guard — and the
+ *   whole point of the digest is to tell the model where to look, not to
+ *   pre-fetch everything it might want.
+ */
+import type { DispatchFn, SnapshotFn } from "../types";
+export interface BuildContextInput {
+    dispatch: DispatchFn;
+    /** Needed by the snapshot-only probes (routes, env). */
+    readSnapshot?: SnapshotFn;
+    /** Tool ids actually present, so we do not probe what cannot answer. */
+    availableToolIds: string[];
+    availableActions?: Record<string, string[]>;
+}
+export declare function buildContextDigest({ dispatch, readSnapshot, availableToolIds, availableActions, }: BuildContextInput): Promise<Record<string, unknown>>;
+//# sourceMappingURL=buildContextPack.d.ts.map

package/lib/typescript/context/buildContextPack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildContextPack.d.ts","sourceRoot":"","sources":["../../../src/context/buildContextPack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAiHvD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,UAAU,CAAC;IACrB,wDAAwD;IACxD,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CAC7C;AAED,wBAAsB,kBAAkB,CAAC,EACvC,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,GACjB,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsCtD"}

package/lib/typescript/effects/ledger.d.ts

@@ -0,0 +1,119 @@
+/**
+ * The effect ledger — what the agent changed, and how to put it back.
+ *
+ * Ask Buoy runs mutations immediately rather than asking first, so "undo" has
+ * to be real. The model is Scenarios' `AppliedEffect` / `revertEffects`
+ * (packages/scenarios/src/engine.ts:238-272), with two deliberate departures,
+ * both fixing gaps that engine documents in itself:
+ *
+ * 1. STORAGE IS ACTUALLY REVERSIBLE HERE. Scenarios classifies storage writes
+ *    as unrecoverable because it never captured the prior value. An agent can:
+ *    it reads the key before it writes, so undo restores the old value exactly,
+ *    and removes the key when it did not exist before.
+ * 2. THE COUNT TELLS THE TRUTH. Scenarios' banner counts transients as
+ *    "changes" and then silently no-ops on them at revert. Here reversible and
+ *    one-shot effects are counted separately and the banner says both, because
+ *    a user who taps Undo and sees "4 changes" become nothing changed learns
+ *    not to trust the banner.
+ *
+ * Undo runs in REVERSE order — a later write to the same key must be undone
+ * before the earlier one, or the earlier value is the one that survives.
+ */
+import type { DispatchFn } from "../types";
+export type AppliedEffect = {
+    kind: "network-override";
+    ruleId: string;
+    label: string;
+} | {
+    kind: "impersonation";
+    label: string;
+} | {
+    kind: "storage-write";
+    toolId: string;
+    action: string;
+    key: string;
+    /**
+     * The MMKV instance the key lives in. Every `mmkv.*` action is scoped to
+     * a registered instance, so an undo that omits it writes nowhere.
+     */
+    instanceId?: string;
+    /** The value before this write; undefined when the key did not exist. */
+    before?: string;
+    /**
+     * The value this write set, so undo can tell whether the key still
+     * holds OUR value. Another writer (an MCP session, the desktop, the app
+     * itself) landing in between must not be silently clobbered by a
+     * restore of the old value.
+     */
+    wrote?: string;
+    /** The action that removes the key, for the did-not-exist case. */
+    removeAction?: string;
+    label: string;
+} | {
+    kind: "state-write";
+    toolId: string;
+    action: string;
+    label: string;
+} | {
+    kind: "transient";
+    label: string;
+};
+/**
+ * Whether Undo can actually put this effect back. THE one place the answer
+ * lives: the bar, the sync snapshot and `revertOne` all agree through it.
+ * `state-write` is a wipe or a store write with no captured prior state —
+ * the ledger records it so the user can see it happened, and it is
+ * PERMANENT. Counting it as undoable made the bar promise "1 undoable" and
+ * then fail with "can't be undone automatically" on tap.
+ */
+export declare function isReversible(effect: AppliedEffect): boolean;
+export interface LedgerEntry {
+    id: string;
+    at: number;
+    toolId: string;
+    action: string;
+    effect: AppliedEffect;
+    /** Set once undone, so the banner can grey the row rather than drop it. */
+    undoneAt?: number;
+    undoError?: string;
+}
+export interface RevertOutcome {
+    reverted: number;
+    failed: {
+        label: string;
+        error: string;
+    }[];
+    /** One-shot effects that were never reversible. Reported, not hidden. */
+    skippedTransients: number;
+}
+export declare class EffectLedger {
+    private entries;
+    private listeners;
+    record(toolId: string, action: string, effect: AppliedEffect): LedgerEntry;
+    list(): LedgerEntry[];
+    /** New array identity for the snapshot after entries were mutated in place. */
+    private touch;
+    /** Not-yet-undone entries that Undo can actually deliver on. Agrees with
+     * `isReversible` — it used to include state-writes, which revertOne refuses,
+     * so the two disagreed about the one fact they both exist to answer. */
+    reversible(): LedgerEntry[];
+    /** Not-yet-undone one-shots. Counted separately so the banner is honest. */
+    transients(): LedgerEntry[];
+    isEmpty(): boolean;
+    subscribe(fn: () => void): () => void;
+    clear(): void;
+    /**
+     * Reconcile the ledger after a change was reverted OUTSIDE `revertOne` —
+     * the model deleting the override it created, a block button's Delete, a
+     * stopImpersonation call. Without this the create entry stays "undoable"
+     * and Undo later fails against a rule that no longer exists, which reads
+     * as the banner lying.
+     */
+    noteExternalRevert(toolId: string, action: string, params: Record<string, unknown>): void;
+    private emit;
+    /** Undo one entry. Returns an error string, or undefined on success. */
+    revertOne(entry: LedgerEntry, dispatch: DispatchFn): Promise<string | undefined>;
+    /** Undo everything still outstanding, newest first. */
+    revertAll(dispatch: DispatchFn): Promise<RevertOutcome>;
+}
+//# sourceMappingURL=ledger.d.ts.map

package/lib/typescript/effects/ledger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../src/effects/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3D;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxC;IACE,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAE3D;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3C,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAID,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,SAAS,CAAyB;IAE1C,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,WAAW;IAiB1E,IAAI,IAAI,WAAW,EAAE;IAIrB,+EAA+E;IAC/E,OAAO,CAAC,KAAK;IAKb;;4EAEwE;IACxE,UAAU,IAAI,WAAW,EAAE;IAI3B,4EAA4E;IAC5E,UAAU,IAAI,WAAW,EAAE;IAI3B,OAAO,IAAI,OAAO;IAIlB,SAAS,CAAC,EAAE,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IAKrC,KAAK,IAAI,IAAI;IAKb;;;;;;OAMG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAyBzF,OAAO,CAAC,IAAI;IAUZ,wEAAwE;IAClE,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAqEtF,uDAAuD;IACjD,SAAS,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC;CAgB9D"}

package/lib/typescript/engine/effectFor.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Turn a completed mutation into a ledger entry.
+ *
+ * The shape is Scenarios' `extractEffect`, but the classification here is much
+ * more conservative, because auditing the catalog's undo claims found almost
+ * all of them unsound: the information needed to reverse a call usually does
+ * not survive the call. So an effect is only marked reversible when THIS
+ * module can point at the exact input the reversal needs.
+ *
+ * Everything else becomes `state-write` (changed something, no automatic
+ * inverse) or `transient` (one-shot). Both are shown to the user as such. A
+ * banner that says "4 changes" and then reverses one of them is worse than a
+ * banner that admits three of them are permanent.
+ */
+import type { ActionDescriptor } from "../types";
+import type { AppliedEffect } from "../effects/ledger";
+export declare function effectFor(toolId: string, descriptor: ActionDescriptor, params: Record<string, unknown>, result: unknown, before: {
+    had: boolean;
+    value?: string;
+} | undefined): AppliedEffect | undefined;
+//# sourceMappingURL=effectFor.d.ts.map

package/lib/typescript/engine/effectFor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effectFor.d.ts","sourceRoot":"","sources":["../../../src/engine/effectFor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,EAAE,OAAO,EACf,MAAM,EAAE;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACnD,aAAa,GAAG,SAAS,CAwD3B"}

package/lib/typescript/engine/runAgentTurn.d.ts

@@ -0,0 +1,140 @@
+/**
+ * One turn: user sentence in, tool calls and an answer out.
+ *
+ * The loop is deliberately explicit rather than clever, because every step of
+ * it encodes something that bites otherwise:
+ *
+ * - Validation happens BEFORE dispatch and a failure comes back as a readable
+ *   tool_result, not an exception. Buoy's adapters validate nothing, so a
+ *   wrong shape becomes an undefined read deep inside a tool — and an LLM
+ *   omitting `replace` on `zustand.setState` replaces the entire store.
+ * - `app.reloadApp` is TERMINAL. It returns before the reload fires and then
+ *   kills the JS realm; anything queued behind it dies with the conversation.
+ * - Results are truncated before they are sent. `dispatchToolAction` bypasses
+ *   the 8MB wire cap that protects the broker path, so an in-app agent can
+ *   receive a 50MB object and then try to feed it to a token-metered model.
+ * - Steps and wall-clock are capped, because a model that misreads a result
+ *   will otherwise retry the same call until the user closes the sheet.
+ */
+import type { DispatchFn, SnapshotFn, ToolDescriptor } from "../types";
+import type { AgentMessage, Provider } from "../providers/types";
+import { EffectLedger } from "../effects/ledger";
+import { type AskBuoyPolicy } from "../policy/policy";
+import { type Block } from "../blocks/types";
+export type TurnEvent = {
+    type: "text";
+    delta: string;
+} | {
+    type: "tool-start";
+    id: string;
+    toolId: string;
+    action: string;
+    /** Short human title — "Open /bag". */
+    label: string;
+    /** The catalog sentence, for a row the user expands. */
+    description: string;
+} | {
+    type: "tool-end";
+    id: string;
+    ok: boolean;
+    summary: string;
+}
+/** A block to render — a receipt from a tool result, or a model-authored block. */
+ | {
+    type: "block";
+    block: Block;
+    forToolCallId?: string;
+}
+/** An Ask block ended the turn; the user's answer will be the next user message. */
+ | {
+    type: "awaiting-user";
+    blockId: string;
+} | {
+    type: "approval-required";
+    id: string;
+    toolId: string;
+    action: string;
+    label: string;
+    description: string;
+    reason: string;
+} | {
+    type: "error";
+    message: string;
+}
+/** Token usage for one provider request, when the provider reports it. */
+ | {
+    type: "usage";
+    input: number;
+    output: number;
+} | {
+    type: "done";
+};
+export interface RunTurnInput {
+    provider: Provider;
+    catalog: ToolDescriptor[];
+    messages: AgentMessage[];
+    system: string;
+    model: string;
+    maxTokens: number;
+    dispatch: DispatchFn;
+    /**
+     * Reads a tool's snapshot for the reserved `getSnapshot` action. Absent on a
+     * host that has no snapshot access; the action then fails with a plain reason
+     * rather than silently returning nothing.
+     */
+    readSnapshot?: SnapshotFn;
+    /** `storage key -> owning live store`, from the grounding. See `annotate`. */
+    storeKeyOwners?: Record<string, string>;
+    ledger: EffectLedger;
+    policy: AskBuoyPolicy;
+    isRelease: boolean;
+    /** Live tool ids from `listToolActions()`, so absent tools are never offered. */
+    availableToolIds?: string[];
+    availableActions?: Record<string, string[]>;
+    /** Resolves once the user taps Approve/Reject on a pending call. */
+    requestApproval?: (input: {
+        id: string;
+        toolId: string;
+        action: string;
+        label: string;
+        description: string;
+        reason: string;
+    }) => Promise<boolean>;
+    signal?: AbortSignal;
+}
+export declare function runAgentTurn(input: RunTurnInput): AsyncGenerator<TurnEvent, AgentMessage[], void>;
+export interface GatedActionInput {
+    toolId: string;
+    action: string;
+    params?: Record<string, unknown>;
+    dispatch: DispatchFn;
+    ledger: EffectLedger;
+    policy: AskBuoyPolicy;
+    isRelease: boolean;
+    /** Defaults to the built-in catalog. */
+    catalog?: ToolDescriptor[];
+}
+export type GatedActionOutcome = {
+    ok: true;
+    result: unknown;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * One human-initiated action through EVERY gate the model's calls go through:
+ * catalog lookup, param validation, policy, pre-read, effect ledger.
+ *
+ * This exists for block buttons. The `buoy_ui` schema promises the model that
+ * a dispatch button runs "with the same policy and undo as if you called it",
+ * and the first implementation called `dispatchToolAction` raw — no deny list,
+ * no release refusal, no ledger entry. One tap on a model-authored button was
+ * an invisible, ungoverned, unundoable mutation. Route every button through
+ * here so the promise is true.
+ *
+ * `needs-approval` is treated as approved: the human's tap on the button IS
+ * the approval. Deny lists, read-only mode and release refusals still stand —
+ * a button must never reach further than the model could.
+ */
+export declare function runGatedAction(input: GatedActionInput): Promise<GatedActionOutcome>;
+//# sourceMappingURL=runAgentTurn.d.ts.map

package/lib/typescript/engine/runAgentTurn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runAgentTurn.d.ts","sourceRoot":"","sources":["../../../src/engine/runAgentTurn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAoB,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAKzF,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAwB,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAK5E,OAAO,EAAc,KAAK,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAOzD,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/B;IACE,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAChE,mFAAmF;GACjF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE;AACzD,oFAAoF;GAClF;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC1C;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACpC,0EAA0E;GACxE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,UAAU,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B,8EAA8E;IAC9E,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,oEAAoE;IACpE,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE;QACxB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAwDD,wBAAuB,YAAY,CACjC,KAAK,EAAE,YAAY,GAClB,cAAc,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,IAAI,CAAC,CA+UjD;AA8BD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,UAAU,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,wCAAwC;IACxC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuCzF"}

package/lib/typescript/engine/systemPrompt.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The system prompt.
+ *
+ * Everything Buoy wants the model to know lives HERE, never in a tool result.
+ * Claude is trained to discount instructions found inside `tool_result` blocks
+ * — that is the prompt-injection defence working as designed — so policy text
+ * smuggled in alongside data may be ignored outright or flagged as an attack.
+ * Instructions belong in the system prompt or a following user turn.
+ *
+ * The prompt is also where the release-build truth is stated. The tool
+ * descriptions carry per-action annotations, but a model reading 22 tool
+ * descriptions benefits from being told the rule once, up front.
+ */
+import type { ToolDescriptor } from "../types";
+export interface ContextPack {
+    /** Plain-English annotations from the app author. The highest-value input. */
+    notes?: string[];
+    /**
+     * Exact shapes of the objects the agent may WRITE, as `name -> shape text`.
+     * Paste the real type; nothing parses it, it is handed to the model as
+     * written.
+     *
+     *   types: { CartLine: "{ lineId: string; itemId: string; qty: number }" }
+     *
+     * WHY THIS EXISTS SEPARATELY FROM `notes`. Reading a live instance is the
+     * better source of a shape — it cannot go stale — and the prompt tells the
+     * model to prefer it. But there is nothing to read when the collection is
+     * EMPTY, which is exactly when someone asks for the first cart line, and no
+     * amount of runtime grounding fixes that: the digest is names-only by
+     * design, and an empty array has no shape. A note saying "item id = 123"
+     * tells the model the id and nothing about the object it belongs in.
+     */
+    types?: Record<string, string>;
+    /** Auto-derived digest of what this app looks like at runtime. */
+    digest?: Record<string, unknown>;
+    /** Anything else the app wants to say to the model. */
+    extra?: string;
+}
+export interface SystemPromptInput {
+    catalog: ToolDescriptor[];
+    context?: ContextPack;
+    isRelease: boolean;
+    readOnly: boolean;
+    requireApproval: string[];
+    appName?: string;
+    platform?: string;
+}
+export declare function buildSystemPrompt(input: SystemPromptInput): string;
+//# sourceMappingURL=systemPrompt.d.ts.map

package/lib/typescript/engine/systemPrompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemPrompt.d.ts","sourceRoot":"","sources":["../../../src/engine/systemPrompt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE/C,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CA2FlE"}

package/lib/typescript/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @buoy-gg/agent-core — the brain behind Ask Buoy.
+ *
+ * Headless on purpose: no React, no react-native, no Node built-ins. The only
+ * thing it needs from a host is a `dispatch(toolId, action, params)` function,
+ * which is why the same core runs on a device (`dispatchToolAction` from
+ * `@buoy-gg/shared-ui`) and in Buoy Desktop (`callDevToolAction` over the
+ * broker) without a rewrite.
+ */
+export type { ActionDescriptor, ActionEffect, DispatchFn, JsonSchema, ReleaseBehavior, SnapshotFn, ToolDescriptor, UndoSpec, } from "./types";
+export { CATALOG, CATALOG_ACTION_COUNT, CATALOG_TOOL_COUNT } from "./catalog/catalog.g";
+export { fromProviderToolName, toProviderToolName, toProviderTools, type ProviderTool, type ToProviderToolsOptions, } from "./catalog/toProviderTools";
+export { applyDefaults, validateParams, type ValidationResult, } from "./catalog/validateParams";
+export { projectSnapshot, SNAPSHOT_ACTION } from "./catalog/snapshotReads";
+export { createAnthropicProvider } from "./providers/anthropic";
+export { createOpenAIProvider } from "./providers/openai";
+export type { AgentMessage, Provider, ProviderConfig, ProviderRequest, StreamEvent, TokenUsage, ToolCall, ToolResult, } from "./providers/types";
+export { runAgentTurn, runGatedAction, type GatedActionInput, type GatedActionOutcome, type RunTurnInput, type TurnEvent, } from "./engine/runAgentTurn";
+export { buildSystemPrompt, type ContextPack, type SystemPromptInput, } from "./engine/systemPrompt";
+export { buildContextDigest, type BuildContextInput } from "./context/buildContextPack";
+export { EffectLedger, isReversible, type AppliedEffect, type LedgerEntry, type RevertOutcome, } from "./effects/ledger";
+export { humanise, titleCall, toolTitle } from "./policy/labels";
+export * from "./blocks/types";
+export { UI_TOOL_NAME, UI_PARAMS, uiProviderTool, buildUiBlock } from "./blocks/uiTool";
+export { projectReceipt, shallowDiff, type ReceiptInput } from "./blocks/receipts";
+export { decide, describeCall, DEFAULT_REQUIRE_APPROVAL, resolveRequireApproval, type AllowRule, type AskBuoyPolicy, type Decision, } from "./policy/policy";
+export { redact, registerSelfEndpoint, isSelfTraffic, stripSelfTraffic, } from "./policy/redact";
+export { createAskBuoySession, type AskBuoySession, type AskBuoySessionConfig } from "./session";
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,YAAY,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,eAAe,EACf,UAAU,EACV,cAAc,EACd,QAAQ,GACT,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,sBAAsB,GAC5B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EACb,cAAc,EACd,KAAK,gBAAgB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,YAAY,EACV,YAAY,EACZ,QAAQ,EACR,cAAc,EACd,eAAe,EACf,WAAW,EACX,UAAU,EACV,QAAQ,EACR,UAAU,GACX,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,YAAY,EACZ,cAAc,EACd,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,KAAK,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAExF,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjE,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EACL,MAAM,EACN,YAAY,EACZ,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,QAAQ,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,MAAM,EACN,oBAAoB,EACpB,aAAa,EACb,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,oBAAoB,EAAE,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,WAAW,CAAC"}

package/lib/typescript/policy/labels.d.ts

@@ -0,0 +1,10 @@
+/** The display name of a tool: "Routes", "Zustand", "React Query". */
+export declare function toolTitle(toolId: string): string;
+/** `getStoreState` → "Get store state"; `async.getItem` → "Get item". */
+export declare function humanise(action: string): string;
+/**
+ * A short, present-tense title for a call — the thing a transcript row, a
+ * ledger row and an approval card all show first.
+ */
+export declare function titleCall(toolId: string, action: string, params: Record<string, unknown>): string;
+//# sourceMappingURL=labels.d.ts.map

package/lib/typescript/policy/labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.d.ts","sourceRoot":"","sources":["../../../src/policy/labels.ts"],"names":[],"mappings":"AA+MA,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAgCD,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAO/C;AAaD;;;GAGG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAoBR"}

package/lib/typescript/policy/policy.d.ts

@@ -0,0 +1,106 @@
+/**
+ * What the agent is allowed to do, decided before dispatch.
+ *
+ * The default: reads and writes auto-run — the banner plus the effect ledger
+ * keep the user in control — but DESTRUCTIVE actions need a human tap unless
+ * the app explicitly passes `requireApproval: []`. Auto-running wipes proved
+ * too sharp in live evals (five destructive calls in one confused turn), and
+ * the approval gate is also the blast-radius control if injected text in a
+ * tool result ever steers the model.
+ *
+ * The one thing the policy layer will not do is let the agent report success
+ * for an action that cannot work in this build. Several Buoy actions return
+ * `{ok:true}` and do nothing once `__DEV__` is false — `upsertOverrideRule`
+ * persists a rule the engine never consults — and a QA tester who files a bug
+ * against data that was never applied is a worse outcome than no agent at all.
+ * So `release !== "works"` is refused BEFORE dispatch, with the reason handed
+ * back to the model as the tool result, and `unknown` fails closed.
+ */
+import type { ActionDescriptor, ActionEffect } from "../types";
+/**
+ * One allow rule. A call is permitted when it matches ANY rule; every field a
+ * rule specifies must match. So a support seat that may impersonate and look
+ * at anything, and nothing else, is two rules:
+ *
+ *   allow: [{ effect: "read" }, { toolId: "impersonate" }]
+ */
+export interface AllowRule {
+    toolId?: string;
+    action?: string;
+    effect?: ActionEffect;
+}
+export interface AskBuoyPolicy {
+    /**
+     * Effect classes that need a human tap before they run. Default
+     * `["destructive"]` — wipes and resets wait for approval. Pass `[]`
+     * explicitly for full auto-run.
+     */
+    requireApproval?: ActionEffect[];
+    /**
+     * Specific calls that ALWAYS need a tap, on top of `requireApproval` —
+     * "impersonation asks first" is `[{ toolId: "impersonate", action:
+     * "startImpersonation" }]` without putting every write behind a card.
+     */
+    requireApprovalFor?: {
+        toolId: string;
+        action?: string;
+    }[];
+    /**
+     * Allow-list. When set, anything matching NO rule is refused — the shape
+     * for a scoped seat, instead of enumerating denials across ~190 actions.
+     * `deny` still wins over `allow`.
+     */
+    allow?: AllowRule[];
+    /** Refuse these outright, whatever the model asks for. */
+    deny?: {
+        toolId: string;
+        action?: string;
+    }[];
+    /** Read-only mode: nothing that changes state, at all. */
+    readOnly?: boolean;
+    /**
+     * Let the model read SecureStore VALUES (`storage.secure.get` /
+     * `secure.snapshot`). Off by default: those values are tokens and secrets
+     * by definition, and they would travel to the configured model endpoint.
+     * Key NAMES are always readable.
+     */
+    secureReads?: boolean;
+    /** Cap on model->tool->model round trips in one turn. */
+    maxSteps?: number;
+}
+/** The one place the approval default lives; `decide` and the system prompt both resolve through it. */
+export declare const DEFAULT_REQUIRE_APPROVAL: ActionEffect[];
+export declare function resolveRequireApproval(policy: AskBuoyPolicy): ActionEffect[];
+export type Decision = {
+    verdict: "allow";
+} | {
+    verdict: "needs-approval";
+    reason: string;
+} | {
+    verdict: "refuse";
+    reason: string;
+};
+export interface DecideInput {
+    descriptor: ActionDescriptor;
+    toolId: string;
+    policy: AskBuoyPolicy;
+    /** `__DEV__ === false` for this bundle. */
+    isRelease: boolean;
+}
+export declare function decide({ descriptor, toolId, policy, isRelease, }: DecideInput): Decision;
+/**
+ * A short, domain-flavoured title for what a call will do — the first line of
+ * a transcript row, a ledger row and an approval card.
+ *
+ * The raw tool payload is deliberately NOT what gets shown. A QA person cannot
+ * evaluate `redux_dispatch({type:'SET_ENTITLEMENTS', payload:{...}})`, and an
+ * approval prompt nobody can read is a rubber stamp, which is worse than no
+ * prompt because it looks like oversight.
+ *
+ * Nor is the catalog `summary`: that sentence is written for the model and
+ * ran to three lines in a phone-width row before it was cut off. The phrasing
+ * lives in ./labels.ts; the catalog sentence travels separately on the event
+ * as `description`, for a row the user chooses to expand.
+ */
+export declare function describeCall(toolId: string, descriptor: ActionDescriptor, params: Record<string, unknown>): string;
+//# sourceMappingURL=policy.d.ts.map

package/lib/typescript/policy/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/policy/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAG/D;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC;IACjC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3D;;;;OAIG;IACH,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC;IACpB,0DAA0D;IAC1D,IAAI,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wGAAwG;AACxG,eAAO,MAAM,wBAAwB,EAAE,YAAY,EAAoB,CAAC;AAExE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,YAAY,EAAE,CAE5E;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACpB;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,gBAAgB,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,aAAa,CAAC;IACtB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAC;CACpB;AAKD,wBAAgB,MAAM,CAAC,EACrB,UAAU,EACV,MAAM,EACN,MAAM,EACN,SAAS,GACV,EAAE,WAAW,GAAG,QAAQ,CAuExB;AAoBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,gBAAgB,EAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,MAAM,CAER"}