@graphrefly/ts 0.0.1 → 0.0.3

package/dist/chunk-MTELVIYR.js

@@ -0,0 +1,1421 @@
+import {
+  outcomeIssues
+} from "./chunk-7GOTIIQ7.js";
+import {
+  dataIssue,
+  forEachDepBatch,
+  forbiddenAdapterInputMaterialIssues,
+  forbiddenDataKeys,
+  forbiddenGraphVisibleMaterialIssues,
+  forbiddenProviderRawMaterialKeys,
+  isRecord,
+  projectRuntimeFact,
+  ref,
+  sanitizeAdapterInputIssue,
+  sanitizeAdapterInputSourceRefs,
+  sanitizeProviderGraphVisibleRecord,
+  stableJsonStringify,
+  uniqueSourceRefs,
+  unlockedToolProviderPolicyOverrides
+} from "./chunk-TQPCAIQI.js";
+import {
+  depBatch
+} from "./chunk-WQIA3GFB.js";
+
+// src/orchestration/agent-runtime-outcome-view.ts
+function executorOutcomeViewProjector(graph, opts) {
+  const name = opts.name ?? "executorOutcomeViews";
+  const policy = {
+    audience: opts.policy?.audience ?? "agent-observation",
+    maxSummaryChars: opts.policy?.maxSummaryChars ?? 512,
+    includeIssues: opts.policy?.includeIssues ?? true,
+    includeUsage: opts.policy?.includeUsage ?? false,
+    includeMetadata: opts.policy?.includeMetadata ?? false
+  };
+  const runtime = graph.node(
+    [opts.outcomes],
+    (ctx) => {
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const outcome = raw;
+        const projection = executorOutcomeViewProjectionFromOutcome(outcome, policy);
+        ctx.down([
+          ["DATA", { kind: "view", view: projection.view }],
+          [
+            "DATA",
+            {
+              kind: "audit",
+              audit: {
+                id: `${outcome.outcomeId}:outcome-view:${policy.audience}`,
+                kind: "executor-outcome-view-projected",
+                subjectId: outcome.requestId,
+                sourceRefs: [ref("executor-outcome", outcome.outcomeId)],
+                metadata: { audience: policy.audience, status: outcome.kind }
+              }
+            }
+          ]
+        ]);
+        for (const issue of projection.issues) {
+          ctx.down([["DATA", { kind: "issue", issue }]]);
+        }
+      }
+    },
+    { name: `${name}/runtime`, factory: "executorOutcomeViewProjector" }
+  );
+  return {
+    views: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/views`,
+      "executorOutcomeViews",
+      (fact) => fact.kind === "view" ? fact.view : void 0
+    ),
+    issues: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "executorOutcomeViewIssues",
+      (fact) => fact.kind === "issue" ? fact.issue : void 0
+    ),
+    audit: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "executorOutcomeViewAudit",
+      (fact) => fact.kind === "audit" ? fact.audit : void 0
+    )
+  };
+}
+function executorOutcomeViewProjectionFromOutcome(outcome, policy) {
+  const sourceRefs = uniqueSourceRefs([
+    ref("executor-outcome", outcome.outcomeId),
+    ...outcome.evidenceRefs ?? []
+  ]);
+  const summary = projectOutcomeSummary(outcome, policy.maxSummaryChars);
+  const issues = Object.freeze([
+    ...outcomeIssues(outcome),
+    ...summary.truncated ? [outcomeSummaryTruncationIssue(outcome, summary, policy)] : []
+  ]);
+  const metadata = policy.includeMetadata ? sanitizeProviderGraphVisibleRecord(outcome.metadata) : void 0;
+  const view = Object.freeze({
+    kind: "executor-outcome-view",
+    viewId: `${outcome.outcomeId}:${policy.audience}`,
+    audience: policy.audience,
+    outcomeId: outcome.outcomeId,
+    requestId: outcome.requestId,
+    operationId: outcome.operationId,
+    routeId: outcome.routeId,
+    executorId: outcome.executorId,
+    profileId: outcome.profileId,
+    status: outcome.kind,
+    summary: summary.summary,
+    summaryTruncated: summary.truncated,
+    summaryChars: summary.originalChars,
+    summaryLimitChars: summary.limitChars,
+    errorKind: outcomeErrorKind(outcome),
+    retryable: outcomeRetryable(outcome),
+    nextActions: outcomeNextActions(outcome),
+    sourceRefs,
+    materialRefs: outcomeMaterialRefs(outcome),
+    issues: policy.includeIssues && issues.length > 0 ? issues : void 0,
+    usage: policy.includeUsage ? outcome.usage : void 0,
+    ...metadata === void 0 ? {} : { metadata }
+  });
+  return Object.freeze({ view, issues });
+}
+function projectOutcomeSummary(outcome, maxChars) {
+  const summary = outcomeSummary(outcome);
+  const limitChars = Math.max(0, maxChars);
+  if (summary.length <= limitChars) {
+    return Object.freeze({
+      summary,
+      truncated: false,
+      originalChars: summary.length,
+      limitChars
+    });
+  }
+  const bounded = limitChars <= 1 ? summary.slice(0, limitChars) : limitChars <= 3 ? summary.slice(0, limitChars) : `${summary.slice(0, limitChars - 3)}...`;
+  return Object.freeze({
+    summary: bounded,
+    truncated: true,
+    originalChars: summary.length,
+    limitChars
+  });
+}
+function outcomeSummaryTruncationIssue(outcome, summary, policy) {
+  return dataIssue(
+    "executor-outcome-view-summary-truncated",
+    "ExecutorOutcome view summary was truncated; inspect material refs or the source outcome for full detail",
+    {
+      subjectId: outcome.requestId,
+      refs: [ref("executor-outcome", outcome.outcomeId)],
+      severity: "warning",
+      details: {
+        audience: policy.audience,
+        outcomeId: outcome.outcomeId,
+        originalChars: summary.originalChars,
+        limitChars: summary.limitChars
+      }
+    }
+  );
+}
+function outcomeSummary(outcome) {
+  if (outcome.kind === "result") {
+    if (outcome.result.summary !== void 0 && outcome.result.summary.length > 0)
+      return outcome.result.summary;
+    return `Executor result '${outcome.result.kind}' is available via source refs`;
+  }
+  if (outcome.kind === "failure") return outcome.error.message;
+  if (outcome.kind === "blocked") {
+    const needKinds = outcome.needs.map((need) => need.kind).join(", ");
+    return needKinds.length > 0 ? `Executor blocked: ${needKinds}` : "Executor blocked";
+  }
+  if (outcome.kind === "timeout") {
+    return outcome.timeoutMs === void 0 ? "Executor timed out" : `Executor timed out after ${outcome.timeoutMs}ms`;
+  }
+  return outcome.reason ?? "Executor canceled";
+}
+function outcomeErrorKind(outcome) {
+  if (outcome.kind === "failure") return outcome.error.code;
+  if (outcome.kind === "timeout") return "timeout";
+  if (outcome.kind === "blocked") return outcome.needs[0]?.kind ?? "blocked";
+  if (outcome.kind === "canceled") return "canceled";
+  return void 0;
+}
+function outcomeRetryable(outcome) {
+  if (outcome.kind === "failure" || outcome.kind === "timeout") return outcome.retryable;
+  return void 0;
+}
+function outcomeNextActions(outcome) {
+  if (outcome.kind === "blocked") return Object.freeze(outcome.needs.map((need) => need.kind));
+  if ((outcome.kind === "failure" || outcome.kind === "timeout") && outcome.retryable === true) {
+    return Object.freeze(["retry-or-route"]);
+  }
+  return void 0;
+}
+function outcomeMaterialRefs(outcome) {
+  const refs = outcome.kind === "result" ? [...outcome.result.refs ?? []] : outcome.kind === "blocked" ? outcome.needs.flatMap((need) => [...need.refs ?? []]) : [];
+  return refs.length === 0 ? void 0 : uniqueSourceRefs(refs);
+}
+
+// src/orchestration/agent-runtime-tool-provider-policy.ts
+function localBuiltinToolProviderCatalog(opts = {}) {
+  const providerId = opts.providerId ?? "local-builtin";
+  const executorId = opts.executorId ?? `${providerId}:tool-executor`;
+  const profileId = opts.profileId ?? `${providerId}:tool-profile`;
+  const tools = opts.tools ?? [
+    { toolName: "document/read-doc", operation: "read" },
+    { toolName: "file.read", operation: "read" },
+    { toolName: "file.edit/apply-patch", operation: "edit" },
+    { toolName: "bash.run", operation: "run" },
+    { toolName: "url.fetch", operation: "fetch" },
+    { toolName: "date.now", operation: "read" },
+    { toolName: "weather.fetch", operation: "fetch" },
+    { toolName: "calculator/eval", operation: "eval" }
+  ];
+  const candidatePolicies = opts.policies?.map(
+    (policy) => Object.freeze(policy)
+  ) ?? [
+    defaultLocalBuiltinToolProviderExecutionPolicy({
+      providerId,
+      profileId,
+      tools,
+      overrides: opts.policyOverrides
+    })
+  ];
+  const policyIssues = Object.freeze(
+    candidatePolicies.flatMap((policy) => [
+      ...validateToolProviderExecutionPolicy(policy),
+      ...validateToolProviderPolicyProviderScope(policy, providerId)
+    ])
+  );
+  const policies = Object.freeze(
+    candidatePolicies.filter((policy) => isPublishableToolProviderExecutionPolicy(policy, providerId)).map((policy) => Object.freeze(policy))
+  );
+  const policyRefs = Object.freeze(
+    policies.map((policy) => ref("tool-provider-execution-policy", policy.policyId))
+  );
+  const catalogInputIssues = Object.freeze([
+    ...forbiddenGraphVisibleMaterialIssues(
+      opts.metadata,
+      ref("tool-provider-catalog", providerId),
+      "catalog-metadata"
+    ),
+    ...forbiddenGraphVisibleMaterialIssues(
+      opts.capabilities,
+      ref("executor-profile", profileId),
+      "profile-capabilities"
+    ),
+    ...forbiddenGraphVisibleMaterialIssues(
+      opts.limits,
+      ref("executor-profile", profileId),
+      "profile-limits"
+    ),
+    ...tools.flatMap((tool) => [
+      ...forbiddenGraphVisibleMaterialIssues(
+        tool.metadata,
+        ref("tool", tool.toolName),
+        "tool-metadata"
+      ),
+      ...forbiddenGraphVisibleMaterialIssues(
+        tool.capabilities,
+        ref("tool", tool.toolName),
+        "tool-capabilities"
+      ),
+      ...forbiddenGraphVisibleMaterialIssues(
+        tool.limits,
+        ref("tool", tool.toolName),
+        "tool-limits"
+      )
+    ])
+  ]);
+  const toolEntries = tools.map((tool) => {
+    const toolPolicyRefs = policyRefsForTool(policies, profileId, tool);
+    return Object.freeze({
+      ...tool,
+      kind: "tool-catalog-entry",
+      providerId,
+      inputKind: "tool-call",
+      profileId,
+      executorId,
+      capabilities: sanitizeProviderGraphVisibleRecord(tool.capabilities),
+      limits: sanitizeProviderGraphVisibleRecord(tool.limits),
+      policyRefs: toolPolicyRefs,
+      metadata: sanitizeProviderGraphVisibleRecord(tool.metadata)
+    });
+  });
+  const profilePolicyRefs = policyRefsForProfile(policies, profileId);
+  const issues = Object.freeze([...policyIssues, ...catalogInputIssues]);
+  return Object.freeze({
+    kind: "tool-provider-catalog",
+    providerId,
+    providerKind: "local-builtin",
+    status: issues.length === 0 ? "ready" : "misconfigured",
+    profiles: Object.freeze([
+      Object.freeze({
+        profileId,
+        executorId,
+        kind: "tool",
+        acceptedInputKinds: Object.freeze(["tool-call"]),
+        acceptedResultKinds: Object.freeze(
+          Array.from(new Set(toolEntries.flatMap((tool) => tool.resultKinds ?? [])))
+        ),
+        capabilities: Object.freeze({
+          toolNames: Object.freeze(toolEntries.map((tool) => tool.toolName)),
+          ...sanitizeProviderGraphVisibleRecord(opts.capabilities) ?? {}
+        }),
+        limits: sanitizeProviderGraphVisibleRecord(opts.limits),
+        policyRefs: profilePolicyRefs,
+        metadata: sanitizeProviderGraphVisibleRecord(opts.metadata)
+      })
+    ]),
+    tools: Object.freeze(toolEntries),
+    policies,
+    policyRefs,
+    issues: issues.length === 0 ? void 0 : issues,
+    metadata: sanitizeProviderGraphVisibleRecord(opts.metadata)
+  });
+}
+function validateToolProviderExecutionPolicy(policy) {
+  const issues = [];
+  if (!isRecord(policy)) {
+    return Object.freeze([
+      dataIssue(
+        "tool-provider-policy-invalid-shape",
+        "Tool provider policy must be a data object.",
+        { refs: [ref("tool-provider-execution-policy", "<invalid>")] }
+      )
+    ]);
+  }
+  const policyId = typeof policy.policyId === "string" ? policy.policyId : "";
+  const providerId = typeof policy.providerId === "string" ? policy.providerId : "";
+  const policyRef = ref("tool-provider-execution-policy", policyId || "<missing>");
+  if (policy.kind !== "tool-provider-execution-policy") {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-invalid-kind",
+        "ToolProviderExecutionPolicy.kind must be tool-provider-execution-policy.",
+        { subjectId: policyId, refs: [policyRef] }
+      )
+    );
+  }
+  if (!policyId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-missing-policy-id",
+        "Tool provider policy is missing policyId.",
+        {
+          refs: [policyRef]
+        }
+      )
+    );
+  }
+  if (!providerId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-missing-provider-id",
+        "Tool provider policy is missing providerId.",
+        { subjectId: policyId, refs: [policyRef] }
+      )
+    );
+  }
+  if (policy.sizeCapacity === void 0 && policy.timeout === void 0 && policy.redaction === void 0 && policy.filesystem === void 0 && policy.approval === void 0 && policy.artifacts === void 0 && policy.network === void 0) {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-missing-material",
+        "Tool provider policy has no D360 policy material sections.",
+        { subjectId: policyId, refs: [policyRef] }
+      )
+    );
+  }
+  if (policy.sizeCapacity !== void 0 && !isRecord(policy.sizeCapacity)) {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-invalid-size-capacity",
+        "Tool provider size-capacity policy must be a data object.",
+        { subjectId: policyId, refs: [policyRef] }
+      )
+    );
+  }
+  const limits = isRecord(policy.sizeCapacity) ? policy.sizeCapacity.limits : void 0;
+  if (isRecord(policy.sizeCapacity) && !Array.isArray(limits)) {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-invalid-size-capacity",
+        "Tool provider size-capacity limits must be an array.",
+        { subjectId: policyId, refs: [policyRef] }
+      )
+    );
+  }
+  for (const [index, rawLimit] of (Array.isArray(limits) ? limits : []).entries()) {
+    if (!isRecord(rawLimit)) {
+      issues.push(
+        dataIssue(
+          "tool-provider-policy-invalid-size-limit",
+          "Tool provider size-capacity limit must be a data object.",
+          { subjectId: policyId, refs: [policyRef], details: { index } }
+        )
+      );
+      continue;
+    }
+    const limit = rawLimit;
+    if (typeof limit.unit !== "string" || limit.unit.length === 0) {
+      issues.push(
+        dataIssue(
+          "tool-provider-policy-invalid-size-limit",
+          "Tool provider size-capacity limit unit must be a non-empty string.",
+          { subjectId: policyId, refs: [policyRef], details: { index } }
+        )
+      );
+    }
+    if (limit.softLimit !== void 0 && (typeof limit.softLimit !== "number" || !Number.isFinite(limit.softLimit) || limit.softLimit < 0)) {
+      issues.push(
+        dataIssue(
+          "tool-provider-policy-invalid-size-limit",
+          "Tool provider size-capacity softLimit must be a finite non-negative number.",
+          { subjectId: policyId, refs: [policyRef], details: { index, unit: limit.unit } }
+        )
+      );
+    }
+    if (limit.hardLimit !== void 0 && (typeof limit.hardLimit !== "number" || !Number.isFinite(limit.hardLimit) || limit.hardLimit < 0)) {
+      issues.push(
+        dataIssue(
+          "tool-provider-policy-invalid-size-limit",
+          "Tool provider size-capacity hardLimit must be a finite non-negative number.",
+          { subjectId: policyId, refs: [policyRef], details: { index, unit: limit.unit } }
+        )
+      );
+    }
+    if (typeof limit.softLimit === "number" && Number.isFinite(limit.softLimit) && typeof limit.hardLimit === "number" && Number.isFinite(limit.hardLimit) && limit.softLimit > limit.hardLimit) {
+      issues.push(
+        dataIssue(
+          "tool-provider-policy-invalid-size-limit",
+          "Tool provider size-capacity softLimit must not exceed hardLimit.",
+          { subjectId: policyId, refs: [policyRef], details: { index, unit: limit.unit } }
+        )
+      );
+    }
+  }
+  if (policy.timeout !== void 0 && !isRecord(policy.timeout)) {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-invalid-timeout",
+        "Tool provider timeout policy must be a data object.",
+        { subjectId: policyId, refs: [policyRef] }
+      )
+    );
+  }
+  for (const [field, value] of Object.entries(isRecord(policy.timeout) ? policy.timeout : {})) {
+    if (field.endsWith("TimeoutMs") || field === "timeoutMs") {
+      if (typeof value !== "number" || !Number.isFinite(value) || value < 0) {
+        issues.push(
+          dataIssue(
+            "tool-provider-policy-invalid-timeout",
+            "Tool provider timeout values must be finite non-negative numbers.",
+            { subjectId: policyId, refs: [policyRef], details: { field } }
+          )
+        );
+      }
+    }
+  }
+  for (const forbidden of [
+    ...forbiddenDataKeys(policy),
+    ...forbiddenProviderRawMaterialKeys(policy)
+  ]) {
+    issues.push(
+      dataIssue(
+        "tool-provider-policy-forbidden-runtime-material",
+        "Tool provider policy must not contain runtime-private adapter material.",
+        { subjectId: policyId, refs: [policyRef], details: { reason: forbidden.reason } }
+      )
+    );
+  }
+  return Object.freeze(issues);
+}
+function resolveToolProviderExecutionPolicies(opts) {
+  const request = opts.request;
+  const toolCall = toolCallFromRequest(request);
+  const baseSourceRefs = Object.freeze([ref("agent-request", request.requestId)]);
+  if (toolCall === void 0) {
+    return Object.freeze([
+      Object.freeze({
+        kind: "tool-provider-policy-resolution",
+        resolutionId: `${request.requestId}:${request.operationId}:tool-policy:missing-tool-call`,
+        status: "missing-tool-call",
+        requestId: request.requestId,
+        operationId: request.operationId,
+        issues: Object.freeze([
+          dataIssue(
+            "tool-provider-policy-missing-tool-call",
+            "Tool provider policy resolution requires AgentRequest input.value to be a ToolCallInput.",
+            { subjectId: request.requestId, refs: baseSourceRefs }
+          )
+        ]),
+        sourceRefs: baseSourceRefs
+      })
+    ]);
+  }
+  const routes = (opts.routes ?? []).filter(
+    (route) => route.requestId === request.requestId && route.operationId === request.operationId
+  );
+  if (routes.length === 0) {
+    return Object.freeze([
+      Object.freeze({
+        kind: "tool-provider-policy-resolution",
+        resolutionId: `${request.requestId}:${request.operationId}:tool-policy:pending-route`,
+        status: "pending-route",
+        requestId: request.requestId,
+        operationId: request.operationId,
+        toolName: toolCall.toolName,
+        operation: toolCall.operation,
+        sourceRefs: baseSourceRefs
+      })
+    ]);
+  }
+  return Object.freeze(
+    routes.map(
+      (route) => Object.freeze(
+        resolveToolProviderPolicyForRoute(request, route, toolCall, opts.catalogs ?? [])
+      )
+    )
+  );
+}
+function toolProviderPolicyResolutionProjector(graph, opts) {
+  const name = opts.name ?? "toolProviderPolicyResolution";
+  const routeDeps = opts.executorRoutes ?? [];
+  const catalogDeps = opts.toolProviderCatalogs ?? [];
+  const routeStart = 1;
+  const catalogStart = routeStart + routeDeps.length;
+  const runtime = graph.node(
+    [opts.requestFacts, ...routeDeps, ...catalogDeps],
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        requests: /* @__PURE__ */ new Map(),
+        routes: /* @__PURE__ */ new Map(),
+        catalogs: /* @__PURE__ */ new Map(),
+        emittedKeys: /* @__PURE__ */ new Set(),
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const fact = raw;
+        if (fact.kind === "issued" && fact.input?.inputKind === "tool-call") {
+          state.requests.set(fact.requestId, fact);
+        }
+      }
+      forEachDepBatch(ctx, routeStart, routeDeps.length, (raw) => {
+        const route = raw;
+        state.routes.set(route.routeId, route);
+      });
+      forEachDepBatch(ctx, catalogStart, catalogDeps.length, (raw) => {
+        const catalog = raw;
+        state.catalogs.set(catalog.providerId, catalog);
+      });
+      for (const request of state.requests.values()) {
+        const resolutions2 = resolveToolProviderExecutionPolicies({
+          request,
+          routes: Array.from(state.routes.values()),
+          catalogs: Array.from(state.catalogs.values())
+        });
+        for (const resolution of resolutions2) {
+          const key = stableToolProviderPolicyResolutionKey(resolution);
+          if (state.emittedKeys.has(key)) continue;
+          state.emittedKeys.add(key);
+          ctx.down([
+            ["DATA", { kind: "resolution", resolution }]
+          ]);
+          for (const issue of resolution.issues ?? []) {
+            ctx.down([
+              ["DATA", { kind: "issue", issue }]
+            ]);
+          }
+          state.auditSeq += 1;
+          ctx.down([
+            [
+              "DATA",
+              {
+                kind: "audit",
+                audit: {
+                  id: `${name}:audit:${state.auditSeq}`,
+                  kind: "tool-provider-policy-resolution",
+                  subjectId: request.requestId,
+                  sourceRefs: resolution.sourceRefs,
+                  metadata: {
+                    status: resolution.status,
+                    routeId: resolution.routeId,
+                    providerId: resolution.providerId,
+                    profileId: resolution.profileId,
+                    toolName: resolution.toolName
+                  }
+                }
+              }
+            ]
+          ]);
+        }
+      }
+      ctx.state.set(state);
+    },
+    { name: `${name}/runtime`, factory: "toolProviderPolicyResolutionProjector", partial: true }
+  );
+  const resolutions = projectRuntimeFact(
+    graph,
+    runtime,
+    `${name}/resolutions`,
+    "toolProviderPolicyResolutions",
+    (fact) => fact.kind === "resolution" ? fact.resolution : void 0
+  );
+  const issues = projectRuntimeFact(
+    graph,
+    runtime,
+    `${name}/issues`,
+    "toolProviderPolicyResolutionIssues",
+    (fact) => fact.kind === "issue" ? fact.issue : void 0
+  );
+  const audit = projectRuntimeFact(
+    graph,
+    runtime,
+    `${name}/audit`,
+    "toolProviderPolicyResolutionAudit",
+    (fact) => fact.kind === "audit" ? fact.audit : void 0
+  );
+  return { resolutions, issues, audit };
+}
+function isPublishableToolProviderExecutionPolicy(policy, providerId) {
+  return isRecord(policy) && policy.kind === "tool-provider-execution-policy" && typeof policy.policyId === "string" && policy.policyId.length > 0 && typeof policy.providerId === "string" && policy.providerId.length > 0 && (providerId === void 0 || policy.providerId === providerId) && validateToolProviderExecutionPolicy(policy).length === 0;
+}
+function validateToolProviderPolicyProviderScope(policy, providerId) {
+  if (!isRecord(policy)) return [];
+  if (policy.providerId === void 0 || policy.providerId === providerId) return [];
+  return Object.freeze([
+    dataIssue(
+      "tool-provider-policy-provider-mismatch",
+      "Tool provider policy providerId must match the catalog providerId.",
+      {
+        subjectId: typeof policy.policyId === "string" ? policy.policyId : void 0,
+        refs: [
+          ref(
+            "tool-provider-execution-policy",
+            typeof policy.policyId === "string" && policy.policyId.length > 0 ? policy.policyId : "<missing>"
+          ),
+          ref("tool-provider-catalog", providerId)
+        ]
+      }
+    )
+  ]);
+}
+function policyRefsForProfile(policies, profileId) {
+  return Object.freeze(
+    policies.filter((policy) => policyAppliesToProfile(policy, profileId)).map((policy) => ref("tool-provider-execution-policy", policy.policyId))
+  );
+}
+function policyRefsForTool(policies, profileId, tool) {
+  return Object.freeze(
+    policies.filter((policy) => policyAppliesToProfile(policy, profileId)).filter((policy) => policyAppliesToOptionalScope(policy.toolNames, tool.toolName)).filter((policy) => policyAppliesToOptionalScope(policy.operations, tool.operation)).map((policy) => ref("tool-provider-execution-policy", policy.policyId))
+  );
+}
+function policyAppliesToProfile(policy, profileId) {
+  return policyAppliesToOptionalScope(policy.profileIds, profileId);
+}
+function policyAppliesToOptionalScope(scope, value) {
+  return scope === void 0 || scope.length === 0 || value !== void 0 && scope.includes(value);
+}
+function toolCallFromRequest(request) {
+  const value = request.input?.value;
+  if (request.input?.inputKind !== "tool-call" || !isRecord(value)) return void 0;
+  if (value.kind !== "tool-call" || typeof value.toolName !== "string" || value.toolName.length === 0) {
+    return void 0;
+  }
+  return value;
+}
+function resolveToolProviderPolicyForRoute(request, route, toolCall, catalogs) {
+  const sourceRefs = Object.freeze([
+    ref("agent-request", request.requestId),
+    ref("executor-route", route.routeId)
+  ]);
+  const matchingCatalogs = catalogs.filter((catalog2) => catalogHasRouteProfile(catalog2, route));
+  if (matchingCatalogs.length === 0) {
+    return policyResolutionWithIssue({
+      request,
+      route,
+      toolCall,
+      status: "missing-catalog",
+      sourceRefs,
+      issue: dataIssue(
+        "tool-provider-policy-missing-catalog",
+        `No tool provider catalog exposes route profile '${route.profileId}'.`,
+        { subjectId: request.requestId, refs: sourceRefs }
+      )
+    });
+  }
+  if (matchingCatalogs.length > 1) {
+    return policyResolutionWithIssue({
+      request,
+      route,
+      toolCall,
+      status: "ambiguous-catalog",
+      sourceRefs,
+      issue: dataIssue(
+        "tool-provider-policy-ambiguous-catalog",
+        `Multiple tool provider catalogs expose route profile '${route.profileId}'.`,
+        {
+          subjectId: request.requestId,
+          refs: [
+            ...sourceRefs,
+            ...matchingCatalogs.map((catalog2) => ref("tool-provider-catalog", catalog2.providerId))
+          ]
+        }
+      )
+    });
+  }
+  const catalog = matchingCatalogs[0];
+  if (catalog === void 0) throw new Error("unreachable catalog match");
+  const tool = catalog.tools.find(
+    (entry) => entry.profileId === route.profileId && entry.executorId === route.executorId && entry.toolName === toolCall.toolName && (entry.operation === void 0 || toolCall.operation === void 0 || entry.operation === toolCall.operation)
+  );
+  if (tool === void 0) {
+    return policyResolutionWithIssue({
+      request,
+      route,
+      toolCall,
+      status: "missing-tool",
+      sourceRefs,
+      providerId: catalog.providerId,
+      issue: dataIssue(
+        "tool-provider-policy-missing-tool",
+        `Tool provider catalog '${catalog.providerId}' does not expose requested tool '${toolCall.toolName}'.`,
+        {
+          subjectId: request.requestId,
+          refs: [...sourceRefs, ref("tool-provider-catalog", catalog.providerId)]
+        }
+      )
+    });
+  }
+  const policyRefs = policyRefsForResolution(catalog, route, tool);
+  if (policyRefs.length === 0) {
+    return policyResolutionWithIssue({
+      request,
+      route,
+      toolCall,
+      status: "missing-policy",
+      sourceRefs,
+      providerId: catalog.providerId,
+      issue: dataIssue(
+        "tool-provider-policy-missing-policy-ref",
+        `Tool '${tool.toolName}' has no D360 policy refs on its entry, profile, or catalog.`,
+        {
+          subjectId: request.requestId,
+          refs: [...sourceRefs, ref("tool-provider-catalog", catalog.providerId)]
+        }
+      )
+    });
+  }
+  const issues = policyIssuesForRefs(catalog, policyRefs, request, sourceRefs);
+  const status = issues.length === 0 ? "resolved" : "invalid-policy";
+  return Object.freeze({
+    kind: "tool-provider-policy-resolution",
+    resolutionId: `${request.requestId}:${request.operationId}:${route.routeId}:tool-policy`,
+    status,
+    requestId: request.requestId,
+    operationId: request.operationId,
+    routeId: route.routeId,
+    providerId: catalog.providerId,
+    executorId: route.executorId,
+    profileId: route.profileId,
+    toolName: toolCall.toolName,
+    operation: toolCall.operation,
+    policyRefs,
+    issues: issues.length === 0 ? void 0 : Object.freeze(issues),
+    sourceRefs: Object.freeze([...sourceRefs, ref("tool-provider-catalog", catalog.providerId)])
+  });
+}
+function catalogHasRouteProfile(catalog, route) {
+  return catalog.profiles.some(
+    (profile) => profile.profileId === route.profileId && profile.executorId === route.executorId
+  );
+}
+function policyRefsForResolution(catalog, route, tool) {
+  const profile = catalog.profiles.find(
+    (candidate) => candidate.profileId === route.profileId && candidate.executorId === route.executorId
+  );
+  return Object.freeze([
+    ...tool.policyRefs ?? [],
+    ...(tool.policyRefs?.length ?? 0) === 0 ? profile?.policyRefs ?? [] : [],
+    ...(tool.policyRefs?.length ?? 0) === 0 && (profile?.policyRefs?.length ?? 0) === 0 ? catalog.policyRefs ?? [] : []
+  ]);
+}
+function policyIssuesForRefs(catalog, policyRefs, request, sourceRefs) {
+  const policiesById = new Map((catalog.policies ?? []).map((policy) => [policy.policyId, policy]));
+  const issues = [];
+  for (const policyRef of policyRefs) {
+    if (policyRef.kind !== "tool-provider-execution-policy") {
+      issues.push(
+        dataIssue(
+          "tool-provider-policy-invalid-ref-kind",
+          "Tool provider policy refs must point at ToolProviderExecutionPolicy facts.",
+          { subjectId: request.requestId, refs: [...sourceRefs, policyRef] }
+        )
+      );
+      continue;
+    }
+    const policy = policiesById.get(policyRef.id);
+    if (policy === void 0) {
+      issues.push(
+        dataIssue(
+          "tool-provider-policy-ref-missing-material",
+          `Tool provider policy ref '${policyRef.id}' has no policy material in catalog '${catalog.providerId}'.`,
+          { subjectId: request.requestId, refs: [...sourceRefs, policyRef] }
+        )
+      );
+      continue;
+    }
+    issues.push(...validateToolProviderExecutionPolicy(policy));
+    issues.push(...validateToolProviderPolicyProviderScope(policy, catalog.providerId));
+  }
+  return Object.freeze(issues);
+}
+function policyResolutionWithIssue(opts) {
+  return Object.freeze({
+    kind: "tool-provider-policy-resolution",
+    resolutionId: `${opts.request.requestId}:${opts.request.operationId}:${opts.route.routeId}:tool-policy:${opts.status}`,
+    status: opts.status,
+    requestId: opts.request.requestId,
+    operationId: opts.request.operationId,
+    routeId: opts.route.routeId,
+    providerId: opts.providerId,
+    executorId: opts.route.executorId,
+    profileId: opts.route.profileId,
+    toolName: opts.toolCall.toolName,
+    operation: opts.toolCall.operation,
+    issues: Object.freeze([opts.issue]),
+    sourceRefs: opts.sourceRefs
+  });
+}
+function stableToolProviderPolicyResolutionKey(resolution) {
+  return JSON.stringify({
+    id: resolution.resolutionId,
+    status: resolution.status,
+    policyRefs: resolution.policyRefs?.map((policyRef) => `${policyRef.kind}:${policyRef.id}`) ?? [],
+    issues: resolution.issues?.map((issue) => issue.code) ?? []
+  });
+}
+function defaultLocalBuiltinToolProviderExecutionPolicy(opts) {
+  const toolNames = Object.freeze(Array.from(new Set(opts.tools.map((tool) => tool.toolName))));
+  const operations = Object.freeze(
+    Array.from(new Set(opts.tools.map((tool) => tool.operation).filter((op) => op !== void 0)))
+  );
+  const hasUrlFetch = toolNames.includes("url.fetch");
+  const filesystemToolNames = toolNames.filter(
+    (toolName) => toolName.startsWith("file.") || toolName.startsWith("document/") || toolName === "bash.run"
+  );
+  const approvalToolNames = toolNames.filter(
+    (toolName) => toolName === "file.edit/apply-patch" || toolName === "bash.run"
+  );
+  const approvalOperations = operations.filter(
+    (operation) => operation === "edit" || operation === "run"
+  );
+  const policy = {
+    kind: "tool-provider-execution-policy",
+    policyId: `${opts.providerId}:policy:default`,
+    providerId: opts.providerId,
+    profileIds: Object.freeze([opts.profileId]),
+    toolNames,
+    operations,
+    sizeCapacity: Object.freeze({
+      limits: Object.freeze([
+        Object.freeze({
+          unit: "chars",
+          softLimit: 16384,
+          hardLimit: 65536,
+          perRequest: true,
+          measurementSource: "adapter-estimated"
+        }),
+        Object.freeze({
+          unit: "bytes",
+          softLimit: 1048576,
+          hardLimit: 8388608,
+          perArtifact: true,
+          measurementSource: "adapter-measured"
+        }),
+        Object.freeze({
+          unit: "lines",
+          softLimit: 2e3,
+          hardLimit: 1e4,
+          perStream: true,
+          measurementSource: "adapter-measured"
+        })
+      ])
+    }),
+    timeout: Object.freeze({
+      timeoutMs: 3e4,
+      idleTimeoutMs: 5e3
+    }),
+    redaction: Object.freeze({
+      mode: "summary",
+      sensitivity: Object.freeze(["private-material", "auth-material", "personal-data"]),
+      summaryMaxChars: 512
+    }),
+    ...filesystemToolNames.length > 0 ? {
+      filesystem: Object.freeze({
+        cwd: ".",
+        allowRead: true,
+        allowWrite: false,
+        followSymlinks: false,
+        sourceRefs: Object.freeze(filesystemToolNames.map((toolName) => ref("tool", toolName))),
+        pathRules: Object.freeze([
+          Object.freeze({
+            effect: "allow",
+            path: ".",
+            operation: "read",
+            reason: "Default local builtin catalog is workspace-relative data material."
+          }),
+          Object.freeze({
+            effect: "deny",
+            glob: "**/.env*",
+            reason: "D360 policies keep private material outside catalog DATA."
+          })
+        ])
+      })
+    } : {},
+    ...hasUrlFetch ? {
+      network: Object.freeze({
+        mode: "custom",
+        protocols: Object.freeze(["https:"]),
+        allowedHosts: Object.freeze(["*"]),
+        sourceRefs: Object.freeze([ref("tool", "url.fetch")])
+      })
+    } : {},
+    approval: Object.freeze({
+      mode: approvalToolNames.length > 0 ? "require" : "auto",
+      ...approvalToolNames.length > 0 ? { requiredForToolNames: Object.freeze(approvalToolNames) } : {},
+      ...approvalOperations.length > 0 ? { requiredForOperations: Object.freeze(approvalOperations) } : {}
+    }),
+    artifacts: Object.freeze({
+      defaultDataMode: "summary",
+      artifactKinds: Object.freeze([
+        "text",
+        "markdown",
+        "file",
+        "stdout",
+        "stderr",
+        "tool-output",
+        "provider-raw"
+      ]),
+      inlineLimits: Object.freeze([
+        Object.freeze({
+          unit: "chars",
+          hardLimit: 4096,
+          perArtifact: true,
+          measurementSource: "adapter-estimated"
+        })
+      ]),
+      requireDigest: false
+    }),
+    sourceRefs: Object.freeze([ref("decision", "D360"), ref("tool-provider", opts.providerId)]),
+    metadata: Object.freeze({
+      description: "Default data-only policy material for local builtin tools."
+    }),
+    ...unlockedToolProviderPolicyOverrides(opts.overrides)
+  };
+  return Object.freeze(policy);
+}
+
+// src/orchestration/agent-runtime-tool-provider-input.ts
+function buildToolProviderAdapterInputs(opts) {
+  const requestsById = new Map(opts.requests.map((request) => [request.requestId, request]));
+  const routesById = new Map((opts.routes ?? []).map((route) => [route.routeId, route]));
+  const catalogsById = new Map(
+    (opts.catalogs ?? []).map((catalog) => [catalog.providerId, catalog])
+  );
+  return Object.freeze(
+    opts.resolutions.map(
+      (resolution) => buildToolProviderAdapterInput({
+        resolution,
+        request: requestsById.get(resolution.requestId),
+        route: resolution.routeId === void 0 ? void 0 : routesById.get(resolution.routeId),
+        catalog: resolution.providerId === void 0 ? void 0 : catalogsById.get(resolution.providerId)
+      })
+    )
+  );
+}
+function toolProviderAdapterInputProjector(graph, opts) {
+  const name = opts.name ?? "toolProviderAdapterInput";
+  const routeDeps = opts.executorRoutes ?? [];
+  const catalogDeps = opts.toolProviderCatalogs ?? [];
+  const routeStart = 1;
+  const catalogStart = routeStart + routeDeps.length;
+  const resolutionStart = catalogStart + catalogDeps.length;
+  const runtime = graph.node(
+    [opts.requestFacts, ...routeDeps, ...catalogDeps, ...opts.policyResolutions],
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        requests: /* @__PURE__ */ new Map(),
+        routes: /* @__PURE__ */ new Map(),
+        catalogs: /* @__PURE__ */ new Map(),
+        resolutions: /* @__PURE__ */ new Map(),
+        emittedKeys: /* @__PURE__ */ new Set(),
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const fact = raw;
+        if (fact.kind === "issued" && fact.input?.inputKind === "tool-call") {
+          state.requests.set(fact.requestId, fact);
+        }
+      }
+      forEachDepBatch(ctx, routeStart, routeDeps.length, (raw) => {
+        const route = raw;
+        state.routes.set(route.routeId, route);
+      });
+      forEachDepBatch(ctx, catalogStart, catalogDeps.length, (raw) => {
+        const catalog = raw;
+        state.catalogs.set(catalog.providerId, catalog);
+      });
+      forEachDepBatch(ctx, resolutionStart, opts.policyResolutions.length, (raw) => {
+        const resolution = raw;
+        state.resolutions.set(resolution.resolutionId, resolution);
+      });
+      const inputs2 = buildToolProviderAdapterInputs({
+        requests: Array.from(state.requests.values()),
+        routes: Array.from(state.routes.values()),
+        catalogs: Array.from(state.catalogs.values()),
+        resolutions: Array.from(state.resolutions.values())
+      });
+      for (const input of inputs2) {
+        const key = stableToolProviderAdapterInputKey(input);
+        if (state.emittedKeys.has(key)) continue;
+        state.emittedKeys.add(key);
+        ctx.down([["DATA", { kind: "input", input }]]);
+        for (const issue of input.issues ?? []) {
+          ctx.down([["DATA", { kind: "issue", issue }]]);
+        }
+        state.auditSeq += 1;
+        ctx.down([
+          [
+            "DATA",
+            {
+              kind: "audit",
+              audit: {
+                id: `${name}:audit:${state.auditSeq}`,
+                kind: "tool-provider-adapter-input",
+                subjectId: input.requestId,
+                sourceRefs: input.sourceRefs,
+                metadata: {
+                  status: input.status,
+                  routeId: input.routeId,
+                  providerId: input.providerId,
+                  profileId: input.profileId,
+                  toolName: input.toolName
+                }
+              }
+            }
+          ]
+        ]);
+      }
+      ctx.state.set(state);
+    },
+    { name: `${name}/runtime`, factory: "toolProviderAdapterInputProjector", partial: true }
+  );
+  const inputs = projectRuntimeFact(
+    graph,
+    runtime,
+    `${name}/inputs`,
+    "toolProviderAdapterInputs",
+    (fact) => fact.kind === "input" ? fact.input : void 0
+  );
+  const issues = projectRuntimeFact(
+    graph,
+    runtime,
+    `${name}/issues`,
+    "toolProviderAdapterInputIssues",
+    (fact) => fact.kind === "issue" ? fact.issue : void 0
+  );
+  const audit = projectRuntimeFact(
+    graph,
+    runtime,
+    `${name}/audit`,
+    "toolProviderAdapterInputAudit",
+    (fact) => fact.kind === "audit" ? fact.audit : void 0
+  );
+  return { inputs, issues, audit };
+}
+function buildToolProviderAdapterInput(opts) {
+  const { resolution, request, route, catalog } = opts;
+  const sourceRefs = sanitizeAdapterInputSourceRefs([
+    ref("tool-provider-policy-resolution", resolution.resolutionId),
+    ...resolution.sourceRefs ?? [],
+    ...resolution.routeId === void 0 ? [] : [ref("executor-route", resolution.routeId)],
+    ...resolution.providerId === void 0 ? [] : [ref("tool-provider-catalog", resolution.providerId)],
+    ...resolution.policyRefs ?? []
+  ]);
+  const issues = (resolution.issues ?? []).map(
+    (issue) => sanitizeAdapterInputIssue(issue)
+  );
+  let statusOverride;
+  if (request === void 0) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-missing-request",
+        "Tool provider adapter input requires the issued AgentRequest fact.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  if (request !== void 0 && request.requestId !== resolution.requestId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-request",
+        "Tool provider adapter input request identity does not match its policy resolution.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  if (request !== void 0 && request.operationId !== resolution.operationId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-request-operation",
+        "Tool provider adapter input request operationId does not match its policy resolution.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  if (resolution.routeId !== void 0 && route === void 0) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-missing-route",
+        "Tool provider adapter input requires the selected ExecutorRoute fact.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  if (route !== void 0) {
+    issues.push(...routeIdentityIssuesForAdapterInput(route, resolution, request, sourceRefs));
+  }
+  if (resolution.providerId !== void 0 && catalog === void 0) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-missing-catalog",
+        "Tool provider adapter input requires the selected ToolProviderCatalog fact.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  if (catalog !== void 0 && catalog.status !== void 0 && catalog.status !== "ready") {
+    statusOverride = "invalid-policy";
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-catalog-unavailable",
+        "Tool provider adapter input requires a ready ToolProviderCatalog.",
+        {
+          subjectId: resolution.requestId,
+          refs: [...sourceRefs, ref("tool-provider-catalog", catalog.providerId)],
+          details: { status: catalog.status }
+        }
+      )
+    );
+    issues.push(...(catalog.issues ?? []).map((issue) => sanitizeAdapterInputIssue(issue)));
+  }
+  const toolCall = request === void 0 ? void 0 : toolCallFromRequest(request);
+  if (request !== void 0 && toolCall === void 0) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-missing-tool-call",
+        "Tool provider adapter input requires AgentRequest input.value to be a ToolCallInput.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  const tool = catalog === void 0 || route === void 0 || toolCall === void 0 ? void 0 : selectedToolForAdapterInput(catalog, route, toolCall);
+  if (resolution.status === "resolved" && tool === void 0) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-missing-tool",
+        "Tool provider adapter input requires the selected catalog tool entry.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  const policies = catalog === void 0 ? [] : selectedPoliciesForAdapterInput(catalog, resolution.policyRefs ?? []);
+  if (resolution.status === "resolved" && (resolution.policyRefs?.length ?? 0) === 0) {
+    statusOverride = "missing-policy";
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-missing-policy-ref",
+        "Ready tool provider adapter input requires at least one D360 policy ref.",
+        { subjectId: resolution.requestId, refs: sourceRefs }
+      )
+    );
+  }
+  if (catalog !== void 0) {
+    for (const issue of policyMaterialIssuesForAdapterInput(catalog, resolution, sourceRefs)) {
+      statusOverride ??= "invalid-policy";
+      issues.push(issue);
+    }
+  }
+  for (const policy of policies) {
+    issues.push(...validateToolProviderExecutionPolicy(policy));
+    if (catalog !== void 0)
+      issues.push(...validateToolProviderPolicyProviderScope(policy, catalog.providerId));
+  }
+  if (request?.input !== void 0) {
+    issues.push(
+      ...forbiddenAdapterInputMaterialIssues(
+        request.input,
+        ref("agent-request", request.requestId),
+        "request-input"
+      )
+    );
+  }
+  if (route !== void 0) {
+    issues.push(
+      ...forbiddenAdapterInputMaterialIssues(
+        route.allowedParams,
+        ref("executor-route", route.routeId),
+        "route-allowed-params"
+      ),
+      ...forbiddenAdapterInputMaterialIssues(
+        route.metadata,
+        ref("executor-route", route.routeId),
+        "route-metadata"
+      )
+    );
+  }
+  if (tool !== void 0) {
+    const toolRef = ref("tool", tool.toolName);
+    issues.push(
+      ...forbiddenAdapterInputMaterialIssues(tool.capabilities, toolRef, "tool-capabilities"),
+      ...forbiddenAdapterInputMaterialIssues(tool.limits, toolRef, "tool-limits"),
+      ...forbiddenAdapterInputMaterialIssues(tool.metadata, toolRef, "tool-metadata")
+    );
+  }
+  for (const policy of policies) {
+    issues.push(
+      ...forbiddenAdapterInputMaterialIssues(
+        policy,
+        ref("tool-provider-execution-policy", policy.policyId),
+        "policy-material"
+      )
+    );
+  }
+  const status = resolution.status === "resolved" ? issues.length === 0 ? "ready" : statusOverride ?? "invalid-policy" : resolution.status;
+  const ready = status === "ready";
+  const candidate = {
+    kind: "tool-provider-adapter-input",
+    adapterInputId: `${resolution.requestId}:${resolution.operationId}:${resolution.routeId ?? resolution.resolutionId}:adapter-input`,
+    status,
+    requestId: resolution.requestId,
+    operationId: resolution.operationId,
+    effectRunId: request?.effectRunId,
+    agentRunId: request?.agentRunId,
+    routeId: resolution.routeId,
+    providerId: resolution.providerId,
+    executorId: resolution.executorId,
+    profileId: resolution.profileId,
+    toolName: resolution.toolName,
+    operation: resolution.operation,
+    input: ready ? request?.input : void 0,
+    toolCall: ready ? toolCall : void 0,
+    route: ready ? route : void 0,
+    tool: ready ? tool : void 0,
+    policies: ready ? Object.freeze(policies) : void 0,
+    policyRefs: sanitizeAdapterInputSourceRefs(resolution.policyRefs ?? []),
+    sourceRefs,
+    issues: issues.length === 0 ? void 0 : Object.freeze(issues),
+    metadata: { resolutionId: resolution.resolutionId }
+  };
+  if (ready) {
+    const candidateIssues = forbiddenAdapterInputMaterialIssues(
+      candidate,
+      ref("tool-provider-adapter-input", candidate.adapterInputId),
+      "adapter-input"
+    );
+    if (candidateIssues.length > 0) {
+      const blockedIssues = Object.freeze([...issues, ...candidateIssues]);
+      return Object.freeze({
+        ...candidate,
+        status: "invalid-policy",
+        input: void 0,
+        toolCall: void 0,
+        route: void 0,
+        tool: void 0,
+        policies: void 0,
+        issues: blockedIssues
+      });
+    }
+  }
+  return Object.freeze(candidate);
+}
+function selectedToolForAdapterInput(catalog, route, toolCall) {
+  return catalog.tools.find(
+    (entry) => entry.profileId === route.profileId && entry.executorId === route.executorId && entry.toolName === toolCall.toolName && (entry.operation === void 0 || toolCall.operation === void 0 || entry.operation === toolCall.operation)
+  );
+}
+function selectedPoliciesForAdapterInput(catalog, policyRefs) {
+  const policiesById = new Map((catalog.policies ?? []).map((policy) => [policy.policyId, policy]));
+  const policies = [];
+  for (const policyRef of policyRefs) {
+    if (policyRef.kind !== "tool-provider-execution-policy") continue;
+    const policy = policiesById.get(policyRef.id);
+    if (policy !== void 0) policies.push(policy);
+  }
+  return policies;
+}
+function routeIdentityIssuesForAdapterInput(route, resolution, request, sourceRefs) {
+  const issues = [];
+  const refs = [...sourceRefs, ref("executor-route", route.routeId)];
+  if (route.requestId !== resolution.requestId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-route-request",
+        "ExecutorRoute requestId does not match the tool provider policy resolution.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  if (route.operationId !== resolution.operationId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-route-operation",
+        "ExecutorRoute operationId does not match the tool provider policy resolution.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  if (resolution.routeId !== void 0 && route.routeId !== resolution.routeId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-route-id",
+        "ExecutorRoute routeId does not match the tool provider policy resolution.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  if (resolution.executorId !== void 0 && route.executorId !== resolution.executorId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-route-executor",
+        "ExecutorRoute executorId does not match the tool provider policy resolution.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  if (resolution.profileId !== void 0 && route.profileId !== resolution.profileId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-route-profile",
+        "ExecutorRoute profileId does not match the tool provider policy resolution.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  if (request !== void 0 && route.inputId !== void 0 && route.inputId !== request.input?.inputId) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-route-input",
+        "ExecutorRoute inputId does not match the issued AgentRequest input.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  if (route.inputKind !== void 0 && route.inputKind !== "tool-call") {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-invalid-route-input-kind",
+        "Tool provider adapter input requires ExecutorRoute.inputKind to be tool-call when present.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  if (request !== void 0 && route.inputKind !== void 0 && request.input?.inputKind !== void 0 && route.inputKind !== request.input.inputKind) {
+    issues.push(
+      dataIssue(
+        "tool-provider-adapter-input-stale-route-input-kind",
+        "ExecutorRoute inputKind does not match the issued AgentRequest input.",
+        { subjectId: resolution.requestId, refs }
+      )
+    );
+  }
+  return Object.freeze(issues);
+}
+function policyMaterialIssuesForAdapterInput(catalog, resolution, sourceRefs) {
+  const policiesById = new Map((catalog.policies ?? []).map((policy) => [policy.policyId, policy]));
+  const issues = [];
+  for (const policyRef of resolution.policyRefs ?? []) {
+    if (policyRef.kind !== "tool-provider-execution-policy") {
+      issues.push(
+        dataIssue(
+          "tool-provider-adapter-input-invalid-policy-ref-kind",
+          "Tool provider adapter input policy refs must point at ToolProviderExecutionPolicy facts.",
+          { subjectId: resolution.requestId, refs: [...sourceRefs, policyRef] }
+        )
+      );
+      continue;
+    }
+    if (!policiesById.has(policyRef.id)) {
+      issues.push(
+        dataIssue(
+          "tool-provider-adapter-input-policy-ref-missing-material",
+          "Tool provider adapter input policy ref has no selected policy material.",
+          { subjectId: resolution.requestId, refs: [...sourceRefs, policyRef] }
+        )
+      );
+    }
+  }
+  return Object.freeze(issues);
+}
+function stableToolProviderAdapterInputKey(input) {
+  return stableJsonStringify({
+    id: input.adapterInputId,
+    status: input.status,
+    policyRefs: input.policyRefs?.map((policyRef) => `${policyRef.kind}:${policyRef.id}`) ?? [],
+    issues: input.issues?.map((issue) => issue.code) ?? [],
+    input
+  });
+}
+
+export {
+  executorOutcomeViewProjector,
+  localBuiltinToolProviderCatalog,
+  validateToolProviderExecutionPolicy,
+  resolveToolProviderExecutionPolicies,
+  toolProviderPolicyResolutionProjector,
+  buildToolProviderAdapterInputs,
+  toolProviderAdapterInputProjector
+};
+//# sourceMappingURL=chunk-MTELVIYR.js.map