@dudousxd/nestjs-agent-core 0.10.0 → 0.12.0

package/dist/index.js

@@ -52,6 +52,22 @@ async function seedModelPrices(store, prices) {
 }
 __name(seedModelPrices, "seedModelPrices");
 
+// src/spi/governance-queries.ts
+var THREAD_DETAIL_CONTENT_CHARS = 2e3;
+function truncateDetailContent(content) {
+  if (content.length <= THREAD_DETAIL_CONTENT_CHARS) {
+    return {
+      content,
+      truncated: false
+    };
+  }
+  return {
+    content: content.slice(0, THREAD_DETAIL_CONTENT_CHARS),
+    truncated: true
+  };
+}
+__name(truncateDetailContent, "truncateDetailContent");
+
 // src/governance/compute.ts
 function estimateCost(usage, price) {
   if (price === void 0) {
@@ -157,6 +173,24 @@ function bucketByThread(rows, prices, threads, options) {
   return result.slice(0, options.limit);
 }
 __name(bucketByThread, "bucketByThread");
+function rollupThreadUsage(rows, prices) {
+  const rollup = {
+    requests: 0,
+    inputTokens: 0,
+    outputTokens: 0,
+    totalTokens: 0,
+    costUsd: 0
+  };
+  for (const row of rows) {
+    rollup.requests += 1;
+    rollup.inputTokens += row.inputTokens;
+    rollup.outputTokens += row.outputTokens;
+    rollup.totalTokens += row.inputTokens + row.outputTokens;
+    rollup.costUsd += rowCost(row, prices);
+  }
+  return rollup;
+}
+__name(rollupThreadUsage, "rollupThreadUsage");
 function bucketUsageTrend(rows, prices) {
   const byDay = /* @__PURE__ */ new Map();
   for (const row of rows) {
@@ -189,6 +223,34 @@ function dayBoundsUtc(range) {
 __name(dayBoundsUtc, "dayBoundsUtc");
 
 // src/tool-filters.ts
+async function isToolEnabled(spec, handler) {
+  const declared = typeof spec.enabled === "function" ? await spec.enabled() : spec.enabled ?? true;
+  if (!declared) {
+    return false;
+  }
+  return handler?.isEnabled === void 0 ? true : await handler.isEnabled();
+}
+__name(isToolEnabled, "isToolEnabled");
+async function filterToolsByEnabled(entries) {
+  const checked = await Promise.all(entries.map(async (entry) => ({
+    entry,
+    enabled: await isToolEnabled(entry.spec, entry.handler)
+  })));
+  return checked.filter((row) => row.enabled).map((row) => row.entry);
+}
+__name(filterToolsByEnabled, "filterToolsByEnabled");
+async function canActorUseTool(actor, handler) {
+  return handler?.canUse === void 0 ? true : await handler.canUse(actor);
+}
+__name(canActorUseTool, "canActorUseTool");
+async function filterToolsByCanUse(entries, actor) {
+  const checked = await Promise.all(entries.map(async (entry) => ({
+    entry,
+    allowed: await canActorUseTool(actor, entry.handler)
+  })));
+  return checked.filter((row) => row.allowed).map((row) => row.entry);
+}
+__name(filterToolsByCanUse, "filterToolsByCanUse");
 async function filterToolsByRole(tools, actor, policy) {
   const checked = await Promise.all(tools.map(async (tool) => ({
     tool,
@@ -239,6 +301,16 @@ var ToolForbiddenError = class extends Error {
     this.name = "ToolForbiddenError";
   }
 };
+var ToolDisabledError = class extends Error {
+  static {
+    __name(this, "ToolDisabledError");
+  }
+  toolName;
+  constructor(toolName) {
+    super(`Tool "${toolName}" is disabled in this deployment`), this.toolName = toolName;
+    this.name = "ToolDisabledError";
+  }
+};
 var ToolNotFoundError = class extends Error {
   static {
     __name(this, "ToolNotFoundError");
@@ -282,10 +354,21 @@ var ToolRegistry = class {
       ...this.entries.values()
     ].map((entry) => entry.spec);
   }
-  /** The tools to offer the model for this actor+agent, after the two filter layers. */
+  /**
+  * The tools to offer the model for this actor+agent, after the four filter layers: what this
+  * deployment has enabled, what this actor's role allows, what each tool's own `canUse` allows
+  * this actor, and finally what this agent pinned.
+  *
+  * Every layer only ever removes tools, so no arrangement of them can widen what a turn reaches.
+  */
   async definitionsFor(actor, policy, allowedTools) {
-    const roleScoped = await filterToolsByRole(this.allSpecs(), actor, policy);
-    const allowScoped = filterToolsByAllowList(roleScoped, allowedTools);
+    const live = await filterToolsByEnabled([
+      ...this.entries.values()
+    ]);
+    const allowedByRole = new Set((await filterToolsByRole(live.map((entry) => entry.spec), actor, policy)).map((spec) => spec.name));
+    const roleScoped = live.filter((entry) => allowedByRole.has(entry.spec.name));
+    const actorScoped = await filterToolsByCanUse(roleScoped, actor);
+    const allowScoped = filterToolsByAllowList(actorScoped.map((entry) => entry.spec), allowedTools);
     return allowScoped.map((spec) => ({
       name: spec.name,
       kind: spec.kind,
@@ -293,15 +376,25 @@ var ToolRegistry = class {
       inputSchema: spec.inputSchema
     }));
   }
-  /** Run a tool. Re-checks the role (defense-in-depth) and re-parses the input via Zod. */
+  /**
+  * Run a tool. Re-checks that the tool is enabled and that the role allows it (defense-in-depth —
+  * a call can reach here from a replayed durable step or an approval granted before the flag
+  * moved, neither of which went through `definitionsFor` again) and re-parses the input via Zod.
+  */
   async invoke(name, input, ctx, policy) {
     const entry = this.entries.get(name);
     if (entry === void 0) {
       throw new ToolNotFoundError(name);
     }
+    if (!await isToolEnabled(entry.spec, entry.handler)) {
+      throw new ToolDisabledError(name);
+    }
     if (!await policy.can(ctx.actor, entry.spec)) {
       throw new ToolForbiddenError(name);
     }
+    if (!await canActorUseTool(ctx.actor, entry.handler)) {
+      throw new ToolForbiddenError(name);
+    }
     const validation = await entry.spec.inputSchema["~standard"].validate(input);
     if (validation.issues !== void 0) {
       throw new ToolInputInvalidError(name, validation.issues);
@@ -1178,6 +1271,8 @@ export {
   DEFAULT_TOOL_TRANSIENT_RETRY_BACKOFF_MS,
   DefaultRolesPolicy,
   QuotaExceededError,
+  THREAD_DETAIL_CONTENT_CHARS,
+  ToolDisabledError,
   ToolForbiddenError,
   ToolInputInvalidError,
   ToolNotFoundError,
@@ -1187,12 +1282,16 @@ export {
   bucketByModel,
   bucketByThread,
   bucketUsageTrend,
+  canActorUseTool,
   dayBoundsUtc,
   encodeStreamEvent,
   estimateCost,
   filterToolsByAllowList,
+  filterToolsByCanUse,
+  filterToolsByEnabled,
   filterToolsByRole,
   invokeWithTransientRetry,
+  isToolEnabled,
   isTransientToolError,
   publishAgentDelegated,
   publishAgentMessage,
@@ -1204,10 +1303,12 @@ export {
   publishAgentToolCall,
   publishAgentToolRetry,
   resolveToolTransientRetryNumbers,
+  rollupThreadUsage,
   runAgentLoop,
   seedModelPrices,
   traceLlmTurn,
   traceToolExecution,
+  truncateDetailContent,
   withToolTimeout
 };
 //# sourceMappingURL=index.js.map