@felspar/sdk 0.1.1 → 0.2.0

package/dist/chunks/{chunk-6EZBI7O6.js → chunk-IY6A2423.js}

@@ -1,6 +1,119 @@
 import {
   createHostedFelsparClient
-} from "./chunk-C2VMKF3S.js";
+} from "./chunk-HACK7D24.js";
+
+// src/draft-action-gate-cases.ts
+var emailRecipientFields = ["to", "cc", "bcc", "replyTo", "reply_to"];
+var emailSubjectFields = ["subject"];
+var foldCase = (text2) => text2.replaceAll(/[A-Z]/gu, (letter) => letter.toLowerCase());
+var caseKeyOf = (rule) => rule.entity === void 0 ? foldCase : (id) => id.trim();
+var sameField = (names) => {
+  const lower = new Set(names.map((name) => name.toLowerCase()));
+  return (field) => lower.has(field.toLowerCase());
+};
+function fieldValues(input, names) {
+  const isWanted = sameField(names);
+  const values = [];
+  const unreadable = [];
+  for (const [field, value] of Object.entries(input)) {
+    if (!isWanted(field)) {
+      continue;
+    }
+    for (const item of [value].flat()) {
+      if (typeof item === "string") {
+        values.push(item.trim());
+      } else if (item !== void 0 && item !== null) {
+        unreadable.push(field);
+      }
+    }
+  }
+  return { values, unreadable };
+}
+var isAscii = (text2) => /^[!-~]+$/u.test(text2);
+var plainAddress = /^[a-z0-9._+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)$/u;
+var isUnder = (domain, entity) => domain === entity || domain.endsWith(`.${entity}`);
+function domainsIn(text2, entities) {
+  return entities.filter((entity) => {
+    const escaped = entity.replaceAll(".", String.raw`\.`);
+    const whole = new RegExp(`(?:^|[^a-z0-9.-])${escaped}(?:$|[^a-z0-9-])`, "u");
+    return whole.test(text2);
+  });
+}
+function offTestList(recipients, rules) {
+  const listed = new Set((rules.testRecipients ?? []).map((address) => address.trim().toLowerCase()));
+  const outside = recipients.filter((address) => !listed.has(address));
+  return outside.length > 0 ? `recipient not on the test list: ${outside.join(", ")}` : null;
+}
+function testCompany(recipients, subject, scope) {
+  const outside = offTestList(recipients, scope.rules);
+  if (outside !== null) {
+    return { reason: outside };
+  }
+  const named = domainsIn(subject.toLowerCase(), scope.entities);
+  return named.length === 1 ? { company: named[0] } : { reason: `the subject names ${named.length} decided companies, not one` };
+}
+function recipientCompany(recipients, entities) {
+  const companies = /* @__PURE__ */ new Set();
+  for (const address of recipients) {
+    const domain = plainAddress.exec(address)?.[1] ?? "";
+    const owners = entities.filter((entity) => isUnder(domain, entity));
+    if (owners.length === 0) {
+      return { reason: `${address} is not at a company Felspar decided on`, missing: true };
+    }
+    for (const owner of owners) {
+      companies.add(owner);
+    }
+  }
+  return companies.size === 1 ? { company: [...companies][0] } : { reason: "the recipients belong to more than one company" };
+}
+function recipientsOf(scope, input) {
+  const { rules, rule } = scope;
+  const recipientFields = rule.recipientFields ?? rules.recipientFields ?? emailRecipientFields;
+  const recipients = fieldValues(input, recipientFields);
+  if (recipients.unreadable.length > 0) {
+    return { reason: `${recipients.unreadable.join(", ")} holds a value that is not an address` };
+  }
+  const malformed = recipients.values.find((address) => !isAscii(address) || !plainAddress.test(address.toLowerCase()));
+  return malformed === void 0 ? { addresses: recipients.values.map((address) => address.toLowerCase()) } : { reason: `"${malformed}" is not one plain address` };
+}
+function companyFor(scope, input) {
+  const { rules, rule } = scope;
+  const { addresses, reason } = recipientsOf(scope, input);
+  if (addresses === void 0) {
+    return { reason };
+  }
+  if (addresses.length === 0) {
+    return { reason: "the call has no recipients" };
+  }
+  if (rules.testRecipients === void 0) {
+    return recipientCompany(addresses, scope.entities);
+  }
+  const subjectFields = rule.subjectFields ?? rules.subjectFields ?? emailSubjectFields;
+  const subject = fieldValues(input, subjectFields).values.join("\n");
+  return testCompany(addresses, subject, scope);
+}
+function fieldEntity(scope, field, input) {
+  const { values, unreadable } = fieldValues(input, [field]);
+  if (unreadable.length > 0 || values.length !== 1) {
+    return { reason: `the call must set ${field} to exactly one ID` };
+  }
+  const [value = ""] = values;
+  if (value.length === 0) {
+    return { reason: `the call's ${field} is empty` };
+  }
+  if (scope.rules.testRecipients !== void 0) {
+    const { addresses, reason } = recipientsOf(scope, input);
+    const outside = addresses === void 0 ? reason : offTestList(addresses, scope.rules);
+    if (outside !== null) {
+      return { reason: outside };
+    }
+  }
+  return { company: value };
+}
+function caseFor(scope, input) {
+  const { entity } = scope.rule;
+  return entity === void 0 ? companyFor(scope, input) : fieldEntity(scope, entity.field, input);
+}
 
 // src/draft-action-gate-outputs.ts
 var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -75,10 +188,10 @@ async function outputCheckProblem(rule, call) {
   let check;
   for (const row of call.checks) {
     const isOutput = rule.output === void 0 || row.output === rule.output;
-    const isText = row.artifactDigest === digest;
+    const isText2 = row.artifactDigest === digest;
     const isDecision = row.decisionReceiptDigest === call.decisionReceiptDigest;
     const isPass = row.status === "pass";
-    if (isPass && isText && isDecision && isOutput) {
+    if (isPass && isText2 && isDecision && isOutput) {
       check = row;
     }
   }
@@ -231,6 +344,64 @@ function createDecisionRecorder(limits = {}) {
   };
 }
 
+// src/draft-action-gate-describe.ts
+function felsparJobDescriber(configuration) {
+  let client;
+  return async (releaseId, jobId) => {
+    client ??= createHostedFelsparClient(configuration);
+    return await client.describeJob(releaseId, jobId);
+  };
+}
+async function describedFor(describe, releaseId, jobId) {
+  const description = await describe(releaseId, jobId);
+  if (description.job !== jobId || description.release.releaseId !== releaseId) {
+    throw new Error("Felspar described a different release or job");
+  }
+  return description;
+}
+function outcomeIn(description, outcome) {
+  const matches = description.outcomes.filter((row) => row.id === outcome);
+  return matches.length === 1 ? matches[0] : void 0;
+}
+async function writesProblem(describe, decided) {
+  if (describe === void 0) {
+    return "no job describer is configured";
+  }
+  if (decided.releaseId === void 0) {
+    return "Felspar's replay names no release";
+  }
+  let description;
+  try {
+    description = await describedFor(describe, decided.releaseId, decided.jobId);
+  } catch (error) {
+    return `Felspar's job description could not be read: ${String(error)}`;
+  }
+  const outputs = outcomeIn(description, decided.outcome)?.outputs ?? [];
+  return outputs.some((row) => row.id === decided.output) ? null : `${decided.outcome} doesn't ask for ${decided.output}`;
+}
+var fixOutputCheck = "Fix what check_output flagged, check it again, then retry.";
+async function quotedStep(step, describe, jobId) {
+  if (step.releaseId === void 0) {
+    return null;
+  }
+  const description = await describedFor(describe, step.releaseId, jobId);
+  const quoted = step.kind === "unresolved" ? description.whenUnresolved : outcomeIn(description, step.outcome)?.nextStep;
+  return typeof quoted?.text === "string" && quoted.text.length > 0 ? quoted.text : null;
+}
+async function escalationFor(step, describe, jobId) {
+  if (step?.kind === "output-check") {
+    return fixOutputCheck;
+  }
+  if (step === void 0 || describe === void 0) {
+    return null;
+  }
+  try {
+    return await quotedStep(step, describe, jobId);
+  } catch {
+    return null;
+  }
+}
+
 // src/draft-action-gate-domains.ts
 var publicSuffixes = [
   "ac.uk",
@@ -341,6 +512,40 @@ function isCompanyDomain(entity, extraShared = []) {
   return domainShape.test(entity) && !builtIn.has(entity) && extraShared.every((domain) => domain.toLowerCase() !== entity);
 }
 
+// src/draft-action-gate-rules.ts
+var isText = (value) => typeof value === "string" && value.trim().length > 0;
+function ruleProblem(rule) {
+  if (rule.outcomes === void 0 === (rule.writes === void 0)) {
+    return "this tool's rule must give exactly one of outcomes or writes";
+  }
+  const { outcomes, writes, entity } = rule;
+  if (outcomes !== void 0 && !(Array.isArray(outcomes) && outcomes.every(isText))) {
+    return "this tool's rule has unreadable outcomes";
+  }
+  if (writes !== void 0 && !isText(writes)) {
+    return "this tool's rule has an unreadable writes";
+  }
+  if (entity !== void 0 && !isText(entity.field)) {
+    return "this tool's rule has an unreadable entity field";
+  }
+  const checked = rule.outputCheck?.output;
+  return writes !== void 0 && checked !== void 0 && checked !== writes ? "this tool's output check is for a different output than it writes" : null;
+}
+function fieldProblem(refuse, rule, input) {
+  const isAllowed = sameField(rule.fields);
+  const isRefused = sameField(refuse);
+  const unknown = Object.keys(input).filter((field) => !isAllowed(field));
+  if (unknown.length > 0) {
+    return `the call sets ${unknown.join(", ")}, which this tool's rule doesn't allow`;
+  }
+  const refused = Object.keys(input).filter((field) => isRefused(field));
+  return refused.length > 0 ? `the call sets ${refused.join(", ")}` : null;
+}
+function checkRuleOf(rule) {
+  const { outputCheck, writes } = rule;
+  return outputCheck !== void 0 && writes !== void 0 && outputCheck.output === void 0 ? { ...outputCheck, output: writes } : outputCheck;
+}
+
 // src/draft-action-gate-verifier.ts
 function felsparVerifier(configuration) {
   let client;
@@ -356,104 +561,19 @@ function felsparVerifier(configuration) {
 }
 
 // src/draft-action-gate.ts
-var emailRecipientFields = ["to", "cc", "bcc", "replyTo", "reply_to"];
-var emailSubjectFields = ["subject"];
+function denialText(verdict) {
+  return verdict.escalate === void 0 ? verdict.reason : `${verdict.reason}. Next step: ${verdict.escalate}`;
+}
 function gatedRule(rules, toolName) {
   return Object.hasOwn(rules.tools, toolName) ? rules.tools[toolName] : void 0;
 }
 var isInput = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var sameField = (names) => {
-  const lower = new Set(names.map((name) => name.toLowerCase()));
-  return (field) => lower.has(field.toLowerCase());
-};
-function fieldProblem(rules, rule, input) {
-  const isAllowed = sameField(rule.fields);
-  const isRefused = sameField(rules.refuse ?? []);
-  const unknown = Object.keys(input).filter((field) => !isAllowed(field));
-  if (unknown.length > 0) {
-    return `the call sets ${unknown.join(", ")}, which this tool's rule doesn't allow`;
-  }
-  const refused = Object.keys(input).filter((field) => isRefused(field));
-  return refused.length > 0 ? `the call sets ${refused.join(", ")}` : null;
-}
-function fieldValues(input, names) {
-  const isWanted = sameField(names);
-  const values = [];
-  const unreadable = [];
-  for (const [field, value] of Object.entries(input)) {
-    if (!isWanted(field)) {
-      continue;
-    }
-    for (const item of [value].flat()) {
-      if (typeof item === "string") {
-        values.push(item.trim());
-      } else if (item !== void 0 && item !== null) {
-        unreadable.push(field);
-      }
-    }
-  }
-  return { values, unreadable };
-}
-var isAscii = (text2) => /^[!-~]+$/u.test(text2);
-var plainAddress = /^[a-z0-9._+-]+@([a-z0-9-]+(?:\.[a-z0-9-]+)+)$/u;
-var isUnder = (domain, entity) => domain === entity || domain.endsWith(`.${entity}`);
-function domainsIn(text2, entities) {
-  return entities.filter((entity) => {
-    const escaped = entity.replaceAll(".", String.raw`\.`);
-    const whole = new RegExp(`(?:^|[^a-z0-9.-])${escaped}(?:$|[^a-z0-9-])`, "u");
-    return whole.test(text2);
-  });
-}
-function testCompany(recipients, subject, scope) {
-  const listed = new Set((scope.rules.testRecipients ?? []).map((address) => address.trim().toLowerCase()));
-  const outside = recipients.filter((address) => !listed.has(address));
-  if (outside.length > 0) {
-    return { reason: `recipient not on the test list: ${outside.join(", ")}` };
-  }
-  const named = domainsIn(subject.toLowerCase(), scope.entities);
-  return named.length === 1 ? { company: named[0] } : { reason: `the subject names ${named.length} decided companies, not one` };
-}
-function recipientCompany(recipients, entities) {
-  const companies = /* @__PURE__ */ new Set();
-  for (const address of recipients) {
-    const domain = plainAddress.exec(address)?.[1] ?? "";
-    const owners = entities.filter((entity) => isUnder(domain, entity));
-    if (owners.length === 0) {
-      return { reason: `${address} is not at a company Felspar decided on` };
-    }
-    for (const owner of owners) {
-      companies.add(owner);
-    }
-  }
-  return companies.size === 1 ? { company: [...companies][0] } : { reason: "the recipients belong to more than one company" };
-}
-function companyFor(scope, input) {
-  const { rules, rule } = scope;
-  const recipientFields = rule.recipientFields ?? rules.recipientFields ?? emailRecipientFields;
-  const recipients = fieldValues(input, recipientFields);
-  if (recipients.unreadable.length > 0) {
-    return { reason: `${recipients.unreadable.join(", ")} holds a value that is not an address` };
-  }
-  if (recipients.values.length === 0) {
-    return { reason: "the call has no recipients" };
-  }
-  const malformed = recipients.values.find((address) => !isAscii(address) || !plainAddress.test(address.toLowerCase()));
-  if (malformed !== void 0) {
-    return { reason: `"${malformed}" is not one plain address` };
-  }
-  const addresses = recipients.values.map((address) => address.toLowerCase());
-  if (rules.testRecipients === void 0) {
-    return recipientCompany(addresses, scope.entities);
-  }
-  const subjectFields = rule.subjectFields ?? rules.subjectFields ?? emailSubjectFields;
-  const subject = fieldValues(input, subjectFields).values.join("\n");
-  return testCompany(addresses, subject, scope);
-}
-function replayProblem(rules, company, verified) {
+function replayProblem(scope, company, verified) {
+  const { rules } = scope;
   if (verified.jobId !== rules.job) {
     return `the receipt is for job ${verified.jobId}, not ${rules.job}`;
   }
-  if (verified.entityId.toLowerCase() !== company) {
+  if (caseKeyOf(scope.rule)(verified.entityId) !== company) {
     return `the receipt is for ${verified.entityId}, not ${company}`;
   }
   const { releases } = rules;
@@ -467,8 +587,22 @@ function staleness(decision, now) {
   }
   return Date.parse(until) > now ? null : `the decision's evidence went stale at ${until}`;
 }
-async function verifiedFor(scope, found, request) {
-  const { rules, rule } = scope;
+async function permitProblem(rule, verified, request) {
+  const { releaseId, outcome } = verified;
+  let problem = null;
+  if (rule.writes !== void 0) {
+    problem = await writesProblem(request.describe, {
+      releaseId,
+      jobId: request.rules.job,
+      outcome,
+      output: rule.writes
+    });
+  } else if (rule.outcomes?.includes(outcome) !== true) {
+    problem = `${verified.entityId} is ${outcome}, which doesn't allow this`;
+  }
+  return problem === null ? null : { allow: false, reason: problem, step: { kind: "outcome", releaseId, outcome } };
+}
+async function verifiedFor(rule, found, request) {
   const { company, decision } = found;
   const stale = staleness(decision, (request.now ?? Date.now)());
   if (stale !== null) {
@@ -478,29 +612,35 @@ async function verifiedFor(scope, found, request) {
   if (verified === null) {
     return { allow: false, reason: `Felspar did not reproduce ${company}'s receipt` };
   }
-  const problem = replayProblem(rules, company, verified);
+  const problem = replayProblem({ rules: request.rules, rule }, company, verified);
   if (problem !== null) {
     return { allow: false, reason: problem };
   }
-  if (verified.outcome === null || !rule.outcomes.includes(verified.outcome)) {
-    const decided = verified.outcome ?? "undecided";
-    return { allow: false, reason: `${verified.entityId} is ${decided}, which doesn't allow this` };
+  const { outcome } = verified;
+  if (outcome === null) {
+    const reason = `${verified.entityId} is undecided, which doesn't allow this`;
+    return { allow: false, reason, step: { kind: "unresolved", releaseId: verified.releaseId } };
   }
-  if (rule.outputCheck !== void 0) {
-    const checked = await outputCheckProblem(rule.outputCheck, {
+  const denied = await permitProblem(rule, { ...verified, outcome }, request);
+  if (denied !== null) {
+    return denied;
+  }
+  const checkRule = checkRuleOf(rule);
+  if (checkRule !== void 0) {
+    const checked = await outputCheckProblem(checkRule, {
       input: found.input,
       decisionReceiptDigest: decision.receipt.receiptDigest,
       checks: request.outputChecks ?? [],
       verify: request.verifyOutputCheck
     });
     if (checked !== null) {
-      return { allow: false, reason: checked };
+      return { allow: false, reason: checked, step: { kind: "output-check" } };
     }
   }
   return {
     allow: true,
-    reason: `${company} is ${verified.outcome}; Felspar reproduced the receipt`,
-    decision: { ...decision, outcome: verified.outcome }
+    reason: `${company} is ${outcome}; Felspar reproduced the receipt`,
+    decision: { ...decision, outcome }
   };
 }
 async function decide(request) {
@@ -509,26 +649,43 @@ async function decide(request) {
   if (rule === void 0) {
     return { allow: false, reason: "not a gated tool" };
   }
+  const invalid = ruleProblem(rule);
+  if (invalid !== null) {
+    return { allow: false, reason: invalid };
+  }
   const input = isInput(request.input) ? request.input : {};
-  const problem = fieldProblem(rules, rule, input);
+  const problem = fieldProblem(rules.refuse ?? [], rule, input);
   if (problem !== null) {
     return { allow: false, reason: problem };
   }
-  const entities = [...new Set(decisions.map((row) => row.entity.toLowerCase()))].filter((entity) => isCompanyDomain(entity, rules.sharedDomains));
-  const scope = { rules, rule, entities };
-  const { company, reason } = companyFor(scope, input);
+  const keyOf = caseKeyOf(rule);
+  const entities = rule.entity === void 0 ? [...new Set(decisions.map((row) => keyOf(row.entity)))].filter((entity) => isCompanyDomain(entity, rules.sharedDomains)) : [];
+  const pinned = rules.releases?.length === 1 ? rules.releases[0] : void 0;
+  const unresolved = { kind: "unresolved", releaseId: pinned };
+  const { company, reason, missing } = caseFor({ rules, rule, entities }, input);
   if (company === void 0) {
-    return { allow: false, reason: reason ?? "no company" };
+    return {
+      allow: false,
+      reason: reason ?? "no case",
+      ...missing === true && { step: unresolved }
+    };
   }
-  const decision = decisions.filter((row) => row.entity.toLowerCase() === company).at(-1);
-  return decision === void 0 ? { allow: false, reason: `no decision for ${company}` } : await verifiedFor(scope, { company, decision, input }, request);
+  const decision = decisions.filter((row) => keyOf(row.entity) === company).at(-1);
+  return decision === void 0 ? { allow: false, reason: `no decision for ${company}`, step: unresolved } : await verifiedFor(rule, { company, decision, input }, request);
 }
 async function checkAction(request) {
+  let decided;
   try {
-    return await decide(request);
+    decided = await decide(request);
   } catch (error) {
     return { allow: false, reason: `gate error: ${String(error)}` };
   }
+  if (decided.allow) {
+    return decided;
+  }
+  const { step, ...denied } = decided;
+  const escalate = await escalationFor(step, request.describe, request.rules.job);
+  return escalate === null ? denied : { ...denied, escalate };
 }
 function report(onVerdict, toolName, verdict) {
   if (onVerdict === void 0) {
@@ -540,7 +697,7 @@ function report(onVerdict, toolName, verdict) {
   }
 }
 function createActionGate(config) {
-  const { verify, decisions = createDecisionRecorder(), decisionTool, outputCheckTool, verifyOutputCheck, now, onVerdict, ...rules } = config;
+  const { verify, decisions = createDecisionRecorder(), decisionTool, outputCheckTool, verifyOutputCheck, describe, now, onVerdict, ...rules } = config;
   return {
     rules,
     decisions,
@@ -556,6 +713,7 @@ function createActionGate(config) {
         verify,
         outputChecks: decisions.outputChecksIn(sessionId),
         ...verifyOutputCheck !== void 0 && { verifyOutputCheck },
+        ...describe !== void 0 && { describe },
         ...now !== void 0 && { now }
       });
       report(onVerdict, toolName, verdict);
@@ -565,6 +723,8 @@ function createActionGate(config) {
 }
 
 export {
+  emailRecipientFields,
+  emailSubjectFields,
   outputCheckFromResult,
   outputTextDigest,
   felsparOutputCheckVerifier,
@@ -572,11 +732,11 @@ export {
   entityIdOf,
   decisionFromResult,
   createDecisionRecorder,
+  felsparJobDescriber,
   sharedDomains,
   isCompanyDomain,
   felsparVerifier,
-  emailRecipientFields,
-  emailSubjectFields,
+  denialText,
   gatedRule,
   checkAction,
   createActionGate

package/dist/draft-action-gate-claude.js

@@ -1,8 +1,9 @@
 import {
+  denialText,
   entityIdOf,
   jobOf
-} from "./chunks/chunk-6EZBI7O6.js";
-import "./chunks/chunk-C2VMKF3S.js";
+} from "./chunks/chunk-IY6A2423.js";
+import "./chunks/chunk-HACK7D24.js";
 
 // src/draft-action-gate-claude.ts
 function felsparPreToolUse(gate) {
@@ -19,7 +20,7 @@ function felsparPreToolUse(gate) {
       hookSpecificOutput: {
         hookEventName: "PreToolUse",
         permissionDecision: "deny",
-        permissionDecisionReason: `Felspar's gate: ${verdict.reason}`
+        permissionDecisionReason: `Felspar's gate: ${denialText(verdict)}`
       }
     };
   };

package/dist/draft-action-gate-eve.js

@@ -1,52 +1,9 @@
 import {
-  entityIdOf,
-  jobOf
-} from "./chunks/chunk-6EZBI7O6.js";
-import "./chunks/chunk-C2VMKF3S.js";
-
-// src/draft-action-gate-eve.ts
-function felsparGate(gate) {
-  return async (call) => {
-    if (!gate.isGated(call.toolName)) {
-      return "not-applicable";
-    }
-    const verdict = await gate.check(call.session.id, call.toolName, call.toolInput);
-    return { type: verdict.allow ? "approved" : "denied", reason: verdict.reason };
-  };
-}
-function felsparDecisionEvents(gate) {
-  const checks = /* @__PURE__ */ new Map();
-  function requested(event) {
-    const { actions } = event.data;
-    if (actions === void 0) {
-      return;
-    }
-    for (const action of actions) {
-      const entity = entityIdOf(action.input);
-      if (entity !== void 0 && gate.isDecisionTool(action.toolName ?? "")) {
-        gate.decisions.noteRequest(action.callId, entity);
-      }
-      const job = jobOf(action.input);
-      if (job !== void 0 && gate.isOutputCheckTool(action.toolName ?? "")) {
-        checks.set(action.callId, job);
-      }
-    }
-  }
-  function result(event, context) {
-    const action = event.data.result;
-    const job = action?.callId === void 0 ? void 0 : checks.get(action.callId);
-    if (job !== void 0 && action?.callId !== void 0) {
-      checks.delete(action.callId);
-      if (action.isError !== true) {
-        gate.decisions.recordOutputCheck(context.session.id, job, action.output);
-      }
-    }
-    if (action?.callId !== void 0 && gate.isDecisionTool(action.toolName ?? "") && action.isError !== true) {
-      gate.decisions.noteResult(context.session.id, action.callId, action.output);
-    }
-  }
-  return { "actions.requested": requested, "action.result": result };
-}
+  felsparDecisionEvents,
+  felsparGate
+} from "./chunks/chunk-247XZ6IY.js";
+import "./chunks/chunk-IY6A2423.js";
+import "./chunks/chunk-HACK7D24.js";
 export {
   felsparDecisionEvents,
   felsparGate

package/dist/draft-action-gate-openai.js

@@ -1,8 +1,9 @@
 import {
+  denialText,
   entityIdOf,
   jobOf
-} from "./chunks/chunk-6EZBI7O6.js";
-import "./chunks/chunk-C2VMKF3S.js";
+} from "./chunks/chunk-IY6A2423.js";
+import "./chunks/chunk-HACK7D24.js";
 
 // src/draft-action-gate-openai.ts
 function argumentsOf(text) {
@@ -30,7 +31,7 @@ function felsparToolInputGuardrail(gate, options) {
       return verdict.allow ? { behavior: { type: "allow" }, outputInfo: { reason: verdict.reason } } : {
         behavior: {
           type: "rejectContent",
-          message: `Felspar's gate denied this call: ${verdict.reason}`
+          message: `Felspar's gate denied this call: ${denialText(verdict)}`
         }
       };
     }

package/dist/draft-action-gate.js

@@ -3,9 +3,11 @@ import {
   createActionGate,
   createDecisionRecorder,
   decisionFromResult,
+  denialText,
   emailRecipientFields,
   emailSubjectFields,
   entityIdOf,
+  felsparJobDescriber,
   felsparOutputCheckVerifier,
   felsparVerifier,
   gatedRule,
@@ -14,16 +16,18 @@ import {
   outputCheckFromResult,
   outputTextDigest,
   sharedDomains
-} from "./chunks/chunk-6EZBI7O6.js";
-import "./chunks/chunk-C2VMKF3S.js";
+} from "./chunks/chunk-IY6A2423.js";
+import "./chunks/chunk-HACK7D24.js";
 export {
   checkAction,
   createActionGate,
   createDecisionRecorder,
   decisionFromResult,
+  denialText,
   emailRecipientFields,
   emailSubjectFields,
   entityIdOf,
+  felsparJobDescriber,
   felsparOutputCheckVerifier,
   felsparVerifier,
   gatedRule,

package/dist/draft-hosted-client.js

@@ -1,7 +1,7 @@
 import {
   FelsparRequestError,
   createHostedFelsparClient
-} from "./chunks/chunk-C2VMKF3S.js";
+} from "./chunks/chunk-HACK7D24.js";
 export {
   FelsparRequestError,
   createHostedFelsparClient