@graphrefly/ts 0.0.1 → 0.0.3

package/dist/executors/tool-provider-adapters.js

@@ -0,0 +1,1336 @@
+import "../chunk-MCOFHMUU.js";
+import {
+  localBuiltinToolProviderCatalog
+} from "../chunk-MTELVIYR.js";
+import {
+  buildToolProviderExecutorOutcome,
+  toolProviderAdapterRunProjector
+} from "../chunk-7GOTIIQ7.js";
+import "../chunk-TQPCAIQI.js";
+import "../chunk-PUSRRALM.js";
+import "../chunk-OOEN33FB.js";
+import "../chunk-DKFWDTVY.js";
+import "../chunk-54WPEODM.js";
+import "../chunk-GXU6WFEJ.js";
+import "../chunk-WQIA3GFB.js";
+import "../chunk-S6HXABGL.js";
+import "../chunk-K7FB3JTD.js";
+import "../chunk-DGUM43GV.js";
+
+// src/executors/tool-provider-adapters.ts
+import { spawnSync } from "child_process";
+import { realpathSync } from "fs";
+import { isAbsolute, relative, resolve } from "path";
+var LOCAL_BUILTIN_TOOLS = Object.freeze([
+  Object.freeze({
+    toolName: "date.now",
+    operation: "read",
+    resultKinds: Object.freeze(["json"]),
+    capabilities: Object.freeze({ deterministicWithInjectedClock: true })
+  }),
+  Object.freeze({
+    toolName: "json.parse",
+    operation: "parse",
+    resultKinds: Object.freeze(["json"]),
+    capabilities: Object.freeze({ externalSideEffects: false })
+  }),
+  Object.freeze({
+    toolName: "text.concat",
+    operation: "transform",
+    resultKinds: Object.freeze(["text"]),
+    capabilities: Object.freeze({ externalSideEffects: false })
+  })
+]);
+function localBuiltinToolProviderBinding(opts = {}) {
+  const providerId = opts.providerId ?? "local-builtin";
+  const maxTextChars = nonNegativeFinite(opts.maxTextChars, 16384);
+  return Object.freeze({
+    providerId,
+    run(input, ctx) {
+      const toolName = input.toolName;
+      switch (toolName) {
+        case "date.now":
+          return localDateNow(input, ctx, opts.now);
+        case "json.parse":
+          return localJsonParse(input, maxTextChars);
+        case "text.concat":
+          return localTextConcat(input, maxTextChars);
+        default:
+          return blocked(
+            input,
+            "local-builtin-unsupported-tool",
+            "Local builtin tool is not supported."
+          );
+      }
+    }
+  });
+}
+function localBuiltinToolProviderAdapterPack(opts = {}) {
+  const providerId = opts.providerId ?? "local-builtin";
+  const catalog = localBuiltinToolProviderCatalog({
+    providerId,
+    executorId: opts.executorId ?? `${providerId}:tool-executor`,
+    profileId: opts.profileId ?? `${providerId}:tool-profile`,
+    tools: LOCAL_BUILTIN_TOOLS,
+    policyOverrides: {
+      operations: Object.freeze(["read", "parse", "transform"]),
+      redaction: Object.freeze({
+        mode: "summary",
+        summaryMaxChars: opts.publicText?.maxSummaryChars ?? 512
+      })
+    },
+    metadata: Object.freeze({ adapterPack: "local-builtin-v0" })
+  });
+  return Object.freeze({
+    catalogs: Object.freeze([catalog]),
+    bindings: Object.freeze([
+      localBuiltinToolProviderBinding({
+        providerId,
+        now: opts.now,
+        maxTextChars: opts.maxTextChars ?? opts.publicText?.maxSummaryChars
+      })
+    ])
+  });
+}
+function processToolProviderBinding(opts = {}) {
+  const providerId = opts.providerId ?? "process";
+  const config = processConfig(opts);
+  return Object.freeze({
+    providerId,
+    run(input) {
+      const args = processArguments(input);
+      if (args === void 0) {
+        return blocked(input, "process-invalid-arguments", "Process tool requires argv arguments.");
+      }
+      const allowed = config.allowedCommands.get(args.command);
+      if (allowed === void 0) {
+        if (config.duplicateCommands.has(args.command)) {
+          return blocked(
+            input,
+            "process-command-duplicate-allowlist",
+            "Process command has duplicate allowlist entries."
+          );
+        }
+        if (config.invalidCommands.has(args.command)) {
+          return blocked(
+            input,
+            "process-command-invalid-allowlist",
+            "Process command has an invalid allowlist entry."
+          );
+        }
+        return blocked(input, "process-command-not-allowed", "Process command is not allowlisted.");
+      }
+      if (!argsAllowed(allowed, args.args)) {
+        return blocked(input, "process-argv-not-allowed", "Process argv is not allowlisted.");
+      }
+      const cwd = resolveProcessCwd(args.cwd, allowed, config);
+      if (cwd === void 0) {
+        return blocked(
+          input,
+          "process-cwd-not-allowed",
+          "Process cwd is outside the allowed policy."
+        );
+      }
+      const env = processEnv(args.env, config);
+      if (env === void 0) {
+        return blocked(
+          input,
+          "process-env-not-allowed",
+          "Process env contains non-allowlisted keys."
+        );
+      }
+      return runProcessTool(input, allowed, args, cwd, env, config);
+    }
+  });
+}
+function processToolProviderAdapterPack(opts = {}) {
+  const providerId = opts.providerId ?? "process";
+  const executorId = opts.executorId ?? `${providerId}:tool-executor`;
+  const profileId = opts.profileId ?? `${providerId}:tool-profile`;
+  return Object.freeze({
+    catalogs: Object.freeze([
+      processToolProviderCatalog({ ...opts, providerId, executorId, profileId })
+    ]),
+    bindings: Object.freeze([processToolProviderBinding({ ...opts, providerId })])
+  });
+}
+function processToolProviderCatalog(opts = {}) {
+  const providerId = opts.providerId ?? "process";
+  const executorId = opts.executorId ?? `${providerId}:tool-executor`;
+  const profileId = opts.profileId ?? `${providerId}:tool-profile`;
+  const normalized = normalizeAllowedCommands(opts.allowedCommands ?? []);
+  const allowedCommands = Object.freeze([...normalized.commands.values()]);
+  const issueList = [
+    ...allowedCommands.length === 0 ? [
+      issue(
+        "process-tool-provider-empty-allowlist",
+        "Process tool provider has no allowlisted commands and will deny execution.",
+        "warning"
+      )
+    ] : [],
+    ...[...normalized.duplicates].map(
+      (command) => issue(
+        "process-tool-provider-duplicate-allowlist",
+        "Process tool provider has duplicate command allowlist entries.",
+        "error",
+        { command }
+      )
+    ),
+    ...[...normalized.invalids].map(
+      (command) => issue(
+        "process-tool-provider-invalid-allowlist",
+        "Process tool provider has invalid command allowlist entries.",
+        "error",
+        { command }
+      )
+    )
+  ];
+  const issues = issueList.length === 0 ? void 0 : Object.freeze(issueList);
+  const policy = processToolProviderExecutionPolicy(providerId, profileId, opts);
+  const tool = Object.freeze({
+    kind: "tool-catalog-entry",
+    providerId,
+    toolName: "process.execFile",
+    operation: "run",
+    inputKind: "tool-call",
+    profileId,
+    executorId,
+    resultKinds: Object.freeze(["process-result"]),
+    capabilities: Object.freeze({
+      argv: true,
+      shell: false,
+      commands: Object.freeze(allowedCommands.map((cmd) => cmd.command)),
+      env: Object.freeze({ allowedKeys: Object.freeze([...opts.allowedEnvKeys ?? []]) })
+    }),
+    policyRefs: Object.freeze([{ kind: "tool-provider-execution-policy", id: policy.policyId }])
+  });
+  return Object.freeze({
+    kind: "tool-provider-catalog",
+    providerId,
+    providerKind: "process",
+    status: issues === void 0 ? "ready" : "misconfigured",
+    profiles: Object.freeze([
+      Object.freeze({
+        profileId,
+        executorId,
+        kind: "tool",
+        acceptedInputKinds: Object.freeze(["tool-call"]),
+        acceptedResultKinds: Object.freeze(["process-result"]),
+        capabilities: Object.freeze({
+          toolNames: Object.freeze([tool.toolName]),
+          argv: true,
+          shell: false
+        }),
+        policyRefs: Object.freeze([
+          { kind: "tool-provider-execution-policy", id: policy.policyId }
+        ])
+      })
+    ]),
+    tools: Object.freeze([tool]),
+    policies: Object.freeze([policy]),
+    policyRefs: Object.freeze([{ kind: "tool-provider-execution-policy", id: policy.policyId }]),
+    issues,
+    metadata: Object.freeze({ adapterPack: "process-v0" })
+  });
+}
+function httpToolProviderCatalog(opts = {}) {
+  const providerId = opts.providerId ?? "http";
+  const executorId = opts.executorId ?? `${providerId}:tool-executor`;
+  const profileId = opts.profileId ?? `${providerId}:tool-profile`;
+  const allowedOrigins = Object.freeze([...opts.allowedOrigins ?? []]);
+  const allowedMethods = Object.freeze(normalizeMethods(opts.allowedMethods ?? ["GET"]));
+  const maxResponseBytes = Math.max(1, nonNegativeFinite(opts.maxResponseBytes, 64 * 1024));
+  const policy = httpToolProviderExecutionPolicy(providerId, profileId, opts);
+  const issues = Object.freeze([
+    ...allowedOrigins.length === 0 ? [
+      issue(
+        "http-tool-provider-empty-origin-allowlist",
+        "HTTP tool provider has no allowlisted origins and will deny execution.",
+        "warning"
+      )
+    ] : [],
+    ...allowedMethods.length === 0 ? [
+      issue(
+        "http-tool-provider-empty-method-allowlist",
+        "HTTP tool provider has no allowlisted methods and will deny execution."
+      )
+    ] : []
+  ]);
+  const tool = Object.freeze({
+    kind: "tool-catalog-entry",
+    providerId,
+    toolName: "http.fetch",
+    operation: "fetch",
+    inputKind: "tool-call",
+    profileId,
+    executorId,
+    resultKinds: Object.freeze(["http-result"]),
+    capabilities: Object.freeze({
+      origins: allowedOrigins,
+      methods: allowedMethods,
+      maxResponseBytes,
+      asyncRuntime: true
+    }),
+    policyRefs: Object.freeze([{ kind: "tool-provider-execution-policy", id: policy.policyId }])
+  });
+  return Object.freeze({
+    kind: "tool-provider-catalog",
+    providerId,
+    providerKind: "http",
+    status: issues.length === 0 ? "ready" : "misconfigured",
+    profiles: Object.freeze([
+      Object.freeze({
+        profileId,
+        executorId,
+        kind: "tool",
+        acceptedInputKinds: Object.freeze(["tool-call"]),
+        acceptedResultKinds: Object.freeze(["http-result"]),
+        capabilities: Object.freeze({
+          toolNames: Object.freeze([tool.toolName]),
+          asyncRuntime: true
+        }),
+        policyRefs: Object.freeze([
+          { kind: "tool-provider-execution-policy", id: policy.policyId }
+        ])
+      })
+    ]),
+    tools: Object.freeze([tool]),
+    policies: Object.freeze([policy]),
+    policyRefs: Object.freeze([{ kind: "tool-provider-execution-policy", id: policy.policyId }]),
+    issues: issues.length === 0 ? void 0 : issues,
+    metadata: Object.freeze({ adapterPack: "http-v0", asyncRuntime: true })
+  });
+}
+function httpToolProviderRuntime(graph, opts) {
+  const name = opts.name ?? "httpToolProviderRuntime";
+  const providerId = opts.providerId ?? "http";
+  const catalog = httpToolProviderCatalog(opts);
+  const outcomes = graph.node([], null, {
+    name: `${name}/outcomes`
+  });
+  const runStatus = graph.node([], null, {
+    name: `${name}/runStatus`
+  });
+  const status = graph.node([], null, { name: `${name}/status` });
+  const issues = graph.node([], null, { name: `${name}/issues` });
+  const audit = graph.node([], null, { name: `${name}/audit` });
+  const inputs = /* @__PURE__ */ new Map();
+  const executions = /* @__PURE__ */ new Set();
+  const active = /* @__PURE__ */ new Set();
+  const config = httpRuntimeConfig(opts);
+  const driver = opts.driver ?? defaultHttpToolProviderDriver(config.maxResponseBytes);
+  const forwardedRunStatusKeys = /* @__PURE__ */ new Set();
+  let auditSeq = 0;
+  let disposed = false;
+  function nowMs() {
+    return opts.now?.();
+  }
+  function publishIssue(nextIssue) {
+    issues.down([["DATA", nextIssue]]);
+  }
+  function publishAudit(kind, subjectId, metadata, issueCode) {
+    auditSeq += 1;
+    audit.down([
+      [
+        "DATA",
+        {
+          id: `${name}:audit:${auditSeq}`,
+          kind,
+          subjectId,
+          ...issueCode === void 0 ? {} : { issueCode },
+          ...metadata === void 0 ? {} : { metadata }
+        }
+      ]
+    ]);
+  }
+  function publishRunStatus(request, nextStatus, statusIssues, outcomeId) {
+    forwardedRunStatusKeys.add(`${request.runId}:${nextStatus}`);
+    runStatus.down([
+      [
+        "DATA",
+        {
+          kind: "tool-provider-adapter-run-status",
+          runId: request.runId,
+          adapterInputId: request.adapterInputId,
+          requestId: request.requestId,
+          operationId: request.operationId,
+          status: nextStatus,
+          attempt: request.attempt,
+          ...outcomeId === void 0 ? {} : { outcomeId },
+          ...statusIssues === void 0 ? {} : { issues: statusIssues },
+          sourceRefs: request.sourceRefs,
+          metadata: Object.freeze({ providerId, reason: request.reason })
+        }
+      ]
+    ]);
+  }
+  function publishRequestStatus(input, nextStatus, statusIssues) {
+    if (input.effectRunId === void 0) return;
+    status.down([
+      [
+        "DATA",
+        {
+          kind: "status",
+          requestId: input.requestId,
+          operationId: input.operationId,
+          effectRunId: input.effectRunId,
+          status: nextStatus,
+          sourceRefs: defaultEvidenceRefs(input),
+          ...statusIssues === void 0 ? {} : { issues: statusIssues },
+          metadata: Object.freeze({
+            adapterInputId: input.adapterInputId,
+            providerId: input.providerId,
+            toolName: input.toolName
+          })
+        }
+      ]
+    ]);
+  }
+  function publishOutcome(input, request, result) {
+    const outcome = buildToolProviderExecutorOutcome(input, result, {
+      runId: request.runId,
+      attempt: request.attempt,
+      occurredAtMs: nowMs(),
+      publicText: opts.publicText
+    });
+    outcomes.down([["DATA", outcome]]);
+    const statusIssues = outcomeIssues(outcome);
+    for (const statusIssue of statusIssues) publishIssue(statusIssue);
+    publishRequestStatus(input, agentStatusForOutcome(outcome), statusIssues);
+    publishRunStatus(request, outcome.kind, statusIssues, outcome.outcomeId);
+    publishAudit("http-tool-provider-runtime-finished", input.requestId, {
+      runId: request.runId,
+      attempt: request.attempt,
+      status: outcome.kind,
+      outcomeId: outcome.outcomeId
+    });
+  }
+  function execute(request) {
+    if (disposed || request.providerId !== void 0 && request.providerId !== providerId) return;
+    const input = inputs.get(request.adapterInputId);
+    if (input === void 0 || input.providerId !== providerId) return;
+    const coordinate = `${request.runId}:${request.adapterInputId}:${request.attempt}`;
+    if (executions.has(coordinate)) return;
+    executions.add(coordinate);
+    publishRunStatus(request, "requested");
+    if (input.status !== "ready") {
+      const inputIssue = issue(
+        "http-tool-provider-input-not-ready",
+        "HTTP tool provider runtime requires a ready adapter input."
+      );
+      publishIssue(inputIssue);
+      publishRunStatus(request, "stale-request", [inputIssue]);
+      publishRequestStatus(input, "blocked", [inputIssue]);
+      return;
+    }
+    if (!requestMatchesInput(request, input)) {
+      const mismatch = issue(
+        "http-tool-provider-run-request-mismatched-input",
+        "HTTP tool provider run request does not match its adapter input."
+      );
+      publishIssue(mismatch);
+      publishRunStatus(request, "mismatched-request", [mismatch]);
+      publishRequestStatus(input, "blocked", [mismatch]);
+      return;
+    }
+    const prepared = prepareHttpRequest(input, config);
+    if (prepared.kind === "blocked") {
+      publishOutcome(input, request, {
+        kind: "blocked",
+        needs: Object.freeze([
+          Object.freeze({
+            kind: prepared.issue.code,
+            message: prepared.issue.message
+          })
+        ]),
+        issues: Object.freeze([prepared.issue]),
+        evidenceRefs: defaultEvidenceRefs(input)
+      });
+      return;
+    }
+    if (config.approvalMode === "never") {
+      publishOutcome(input, request, {
+        kind: "blocked",
+        needs: Object.freeze([
+          Object.freeze({
+            kind: "tool-provider-approval-disabled",
+            message: "HTTP tool provider policy disallows execution."
+          })
+        ]),
+        issues: Object.freeze([
+          issue("http-tool-provider-approval-never", "HTTP tool provider execution is disabled.")
+        ]),
+        evidenceRefs: defaultEvidenceRefs(input)
+      });
+      return;
+    }
+    if (config.approvalMode === "require" && !requestApproved(request)) {
+      publishOutcome(input, request, {
+        kind: "blocked",
+        needs: Object.freeze([
+          Object.freeze({
+            kind: "tool-provider-approval",
+            message: "HTTP tool provider execution requires a visible approval run request."
+          })
+        ]),
+        issues: Object.freeze([
+          issue(
+            "http-tool-provider-approval-required",
+            "HTTP tool provider execution requires approval."
+          )
+        ]),
+        evidenceRefs: defaultEvidenceRefs(input)
+      });
+      return;
+    }
+    const controller = new AbortController();
+    active.add(controller);
+    publishRunStatus(request, "started");
+    publishRequestStatus(input, "in-flight");
+    publishAudit("http-tool-provider-runtime-started", input.requestId, {
+      runId: request.runId,
+      attempt: request.attempt,
+      method: prepared.request.method,
+      origin: new URL(prepared.request.url).origin
+    });
+    const timeout = setTimeout(() => controller.abort(), config.timeoutMs);
+    Promise.resolve(driver.fetch({ ...prepared.request, signal: controller.signal })).then(
+      (response) => {
+        clearTimeout(timeout);
+        active.delete(controller);
+        if (disposed) return;
+        publishOutcome(input, request, httpResponseResult(prepared.request, response, config));
+      },
+      (error) => {
+        clearTimeout(timeout);
+        active.delete(controller);
+        if (disposed) return;
+        publishOutcome(input, request, httpErrorResult(error, config));
+      }
+    );
+  }
+  const unsubscribeInputs = opts.inputs.subscribe((msg) => {
+    if (msg[0] !== "DATA") return;
+    const input = msg[1];
+    if (input.providerId === providerId) inputs.set(input.adapterInputId, input);
+  });
+  const autoRunReadyInputs = opts.autoRunReadyInputs ?? (opts.runRequests === void 0 || opts.runRequests.length === 0);
+  const runProjector = toolProviderAdapterRunProjector(graph, {
+    name: `${name}/runs`,
+    inputs: opts.inputs,
+    runRequests: opts.runRequests,
+    autoRunReadyInputs,
+    now: opts.now
+  });
+  const unsubscribeRunStatus = runProjector.status.subscribe((msg) => {
+    if (msg[0] !== "DATA") return;
+    const nextStatus = msg[1];
+    const statusKey = `${nextStatus.runId}:${nextStatus.status}`;
+    if (forwardedRunStatusKeys.has(statusKey)) return;
+    forwardedRunStatusKeys.add(statusKey);
+    runStatus.down([["DATA", nextStatus]]);
+  });
+  const unsubscribeRunIssues = runProjector.issues.subscribe((msg) => {
+    if (msg[0] === "DATA") publishIssue(msg[1]);
+  });
+  const unsubscribeRunAudit = runProjector.audit.subscribe((msg) => {
+    if (msg[0] === "DATA") audit.down([["DATA", msg[1]]]);
+  });
+  const unsubscribeRunRequests = runProjector.requests.subscribe((msg) => {
+    if (msg[0] === "DATA") execute(msg[1]);
+  });
+  return Object.freeze({
+    catalogs: Object.freeze([catalog]),
+    runRequests: runProjector.requests,
+    runStatus,
+    outcomes,
+    status,
+    issues,
+    audit,
+    dispose() {
+      if (disposed) return;
+      disposed = true;
+      unsubscribeInputs();
+      unsubscribeRunStatus();
+      unsubscribeRunIssues();
+      unsubscribeRunAudit();
+      unsubscribeRunRequests();
+      for (const controller of active) controller.abort();
+      active.clear();
+    }
+  });
+}
+function localDateNow(input, ctx, now) {
+  const epochMs = now?.() ?? ctx.now?.() ?? Date.now();
+  return Object.freeze({
+    kind: "result",
+    result: Object.freeze({
+      kind: "json",
+      value: Object.freeze({
+        toolName: "date.now",
+        epochMs,
+        iso: new Date(epochMs).toISOString()
+      }),
+      summary: String(epochMs)
+    }),
+    occurredAtMs: epochMs,
+    evidenceRefs: input.sourceRefs
+  });
+}
+function localJsonParse(input, maxTextChars) {
+  const text = input.toolCall?.arguments?.text;
+  if (typeof text !== "string") {
+    return failure(
+      input,
+      "local-json-parse-missing-text",
+      "json.parse requires a string text argument."
+    );
+  }
+  if (text.length > maxTextChars) {
+    return failure(
+      input,
+      "local-json-parse-text-too-large",
+      "json.parse text exceeds maxTextChars."
+    );
+  }
+  try {
+    const value = JSON.parse(text);
+    return Object.freeze({
+      kind: "result",
+      result: Object.freeze({
+        kind: "json",
+        value: Object.freeze({ toolName: "json.parse", value }),
+        summary: "parsed JSON"
+      }),
+      evidenceRefs: input.sourceRefs
+    });
+  } catch {
+    return failure(input, "local-json-parse-invalid-json", "json.parse received invalid JSON.");
+  }
+}
+function localTextConcat(input, maxTextChars) {
+  const parts = input.toolCall?.arguments?.parts;
+  if (!Array.isArray(parts)) {
+    return failure(input, "local-text-concat-missing-parts", "text.concat requires a parts array.");
+  }
+  const separator = input.toolCall?.arguments?.separator ?? "";
+  if (typeof separator !== "string") {
+    return failure(
+      input,
+      "local-text-concat-invalid-separator",
+      "text.concat separator must be a string."
+    );
+  }
+  const text = parts.map((part) => String(part)).join(separator);
+  if (text.length > maxTextChars) {
+    return failure(
+      input,
+      "local-text-concat-too-large",
+      "text.concat result exceeds maxTextChars."
+    );
+  }
+  return Object.freeze({
+    kind: "result",
+    result: Object.freeze({
+      kind: "text",
+      value: Object.freeze({ toolName: "text.concat", text }),
+      summary: text
+    }),
+    evidenceRefs: input.sourceRefs
+  });
+}
+function processConfig(opts) {
+  const workingDirectory = resolve(opts.workingDirectory ?? ".");
+  const allowedWorkingDirectories = Object.freeze(
+    (opts.allowedWorkingDirectories ?? [workingDirectory]).map((dir) => resolve(dir))
+  );
+  const allowed = normalizeAllowedCommands(opts.allowedCommands ?? []);
+  return {
+    allowedCommands: allowed.commands,
+    duplicateCommands: allowed.duplicates,
+    invalidCommands: allowed.invalids,
+    workingDirectory,
+    allowedWorkingDirectories,
+    baseEnv: Object.freeze({ ...opts.baseEnv ?? {} }),
+    allowedEnvKeys: new Set(opts.allowedEnvKeys ?? []),
+    timeoutMs: positiveFinite(opts.timeoutMs, 1e4),
+    maxOutputBytes: Math.max(1, nonNegativeFinite(opts.maxOutputBytes, 64 * 1024)),
+    maxSummaryChars: Math.max(1, nonNegativeFinite(opts.maxSummaryChars, 512))
+  };
+}
+function processArguments(input) {
+  const raw = input.toolCall?.arguments;
+  if (!isRecord(raw) || typeof raw.command !== "string" || raw.command.length === 0) {
+    return void 0;
+  }
+  const rawArgs = raw.args === void 0 ? Object.freeze([]) : stringArray(raw.args);
+  if (rawArgs === void 0) return void 0;
+  if (raw.cwd !== void 0 && typeof raw.cwd !== "string") return void 0;
+  if (raw.input !== void 0 && typeof raw.input !== "string") return void 0;
+  const rawEnv = raw.env === void 0 ? void 0 : processArgumentEnv(raw.env);
+  if (raw.env !== void 0 && rawEnv === void 0) return void 0;
+  return {
+    command: raw.command,
+    args: rawArgs,
+    ...raw.cwd === void 0 ? {} : { cwd: raw.cwd },
+    ...rawEnv === void 0 ? {} : { env: rawEnv },
+    ...raw.input === void 0 ? {} : { input: raw.input }
+  };
+}
+function argsAllowed(command, args) {
+  if (command.allowArgs === true) return true;
+  if (typeof command.allowArgs === "function") return command.allowArgs(args);
+  if (command.allowArgs === void 0) return args.length === 0;
+  return arraysEqual(command.allowArgs, args);
+}
+function resolveProcessCwd(requestedCwd, command, config) {
+  const rawCwd = command.cwd ?? requestedCwd;
+  const cwd = rawCwd === void 0 ? config.workingDirectory : isAbsolute(rawCwd) ? resolve(rawCwd) : resolve(config.workingDirectory, rawCwd);
+  const realCwd = realpath(cwd);
+  if (realCwd === void 0) return void 0;
+  return config.allowedWorkingDirectories.some((allowed) => {
+    const realAllowed = realpath(allowed);
+    return realAllowed !== void 0 && isPathInside(realCwd, realAllowed);
+  }) ? cwd : void 0;
+}
+function processEnv(inputEnv, config) {
+  const env = { ...config.baseEnv };
+  for (const [key, value] of Object.entries(inputEnv ?? {})) {
+    if (!config.allowedEnvKeys.has(key)) return void 0;
+    if (value !== void 0) env[key] = String(value);
+  }
+  return Object.freeze(env);
+}
+function processArgumentEnv(value) {
+  if (!isRecord(value)) return void 0;
+  const env = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (entry !== void 0 && typeof entry !== "string" && typeof entry !== "number" && typeof entry !== "boolean") {
+      return void 0;
+    }
+    env[key] = entry;
+  }
+  return Object.freeze(env);
+}
+function runProcessTool(input, allowed, args, cwd, env, config) {
+  const executable = allowed.executable ?? args.command;
+  const argv = Object.freeze([...allowed.fixedArgs ?? [], ...args.args]);
+  const result = spawnSync(executable, argv, {
+    cwd,
+    env,
+    input: args.input,
+    encoding: "buffer",
+    shell: false,
+    timeout: config.timeoutMs,
+    maxBuffer: config.maxOutputBytes + 1
+  });
+  const stdout = result.stdout ?? Buffer.alloc(0);
+  const stderr = result.stderr ?? Buffer.alloc(0);
+  const truncated = stdout.length + stderr.length > config.maxOutputBytes;
+  if (result.error !== void 0 && isTimeoutError(result.error)) {
+    return Object.freeze({
+      kind: "timeout",
+      timeoutMs: config.timeoutMs,
+      retryable: true,
+      evidenceRefs: input.sourceRefs
+    });
+  }
+  if (result.error !== void 0 || truncated) {
+    return failure(
+      input,
+      truncated || isOutputLimitError(result.error) ? "process-output-limit-exceeded" : "process-spawn-failed",
+      truncated || isOutputLimitError(result.error) ? "Process output exceeded maxOutputBytes." : "Process execution failed before producing an exit result."
+    );
+  }
+  const value = processResult(
+    args.command,
+    argv,
+    cwd,
+    result.status,
+    result.signal,
+    stdout,
+    stderr,
+    config
+  );
+  if ((result.status ?? 1) !== 0) {
+    return Object.freeze({
+      kind: "failure",
+      error: issue("process-exit-nonzero", "Process exited with a non-zero status.", "error", {
+        exitCode: result.status,
+        signal: result.signal ?? void 0
+      }),
+      retryable: false,
+      evidenceRefs: input.sourceRefs,
+      metadata: Object.freeze({
+        command: args.command,
+        exitCode: result.status,
+        signal: result.signal ?? void 0,
+        outputBytes: value.outputBytes,
+        errorOutputBytes: value.errorOutputBytes
+      })
+    });
+  }
+  return Object.freeze({
+    kind: "result",
+    result: Object.freeze({
+      kind: "process-result",
+      value,
+      summary: value.outputPreview ?? `process exited ${value.exitCode ?? 0}`,
+      artifacts: processArtifacts(stdout, stderr, config, input.sourceRefs)
+    }),
+    evidenceRefs: input.sourceRefs
+  });
+}
+function processResult(command, args, cwd, exitCode, signal, stdout, stderr, config) {
+  return Object.freeze({
+    command,
+    args,
+    cwd,
+    exitCode,
+    ...signal === null ? {} : { signal },
+    outputPreview: preview(stdout, config.maxSummaryChars),
+    errorPreview: preview(stderr, config.maxSummaryChars),
+    outputBytes: stdout.length,
+    errorOutputBytes: stderr.length,
+    truncated: false
+  });
+}
+function processArtifacts(stdout, stderr, config, sourceRefs) {
+  const artifacts = [
+    processTextArtifact("process-stdout", stdout, config, sourceRefs),
+    processTextArtifact("process-stderr", stderr, config, sourceRefs)
+  ].filter((artifact) => artifact !== void 0);
+  return artifacts.length === 0 ? void 0 : Object.freeze(artifacts);
+}
+function processTextArtifact(kind, bytes, config, sourceRefs) {
+  if (bytes.length === 0) return void 0;
+  const text = bytes.toString("utf8");
+  const inline = text.length <= config.maxSummaryChars;
+  return Object.freeze({
+    kind,
+    format: "text",
+    mediaType: "text/plain",
+    encoding: "utf8",
+    byteLength: bytes.length,
+    dataMode: inline ? "inline" : "summary",
+    summary: preview(bytes, config.maxSummaryChars),
+    ...inline ? { value: text } : {},
+    ...sourceRefs === void 0 ? {} : { sourceRefs },
+    sizeEvidence: Object.freeze([
+      sizeEvidence(bytes.length, "adapter-measured-process-output", sourceRefs)
+    ])
+  });
+}
+function processToolProviderExecutionPolicy(providerId, profileId, opts) {
+  const maxOutputBytes = Math.max(1, nonNegativeFinite(opts.maxOutputBytes, 64 * 1024));
+  return Object.freeze({
+    kind: "tool-provider-execution-policy",
+    policyId: `${providerId}:policy:process-v0`,
+    providerId,
+    profileIds: Object.freeze([profileId]),
+    toolNames: Object.freeze(["process.execFile"]),
+    operations: Object.freeze(["run"]),
+    sizeCapacity: Object.freeze({
+      limits: Object.freeze([
+        Object.freeze({
+          unit: "bytes",
+          hardLimit: maxOutputBytes,
+          perRequest: true,
+          measurementSource: "adapter-measured"
+        })
+      ])
+    }),
+    timeout: Object.freeze({ timeoutMs: positiveFinite(opts.timeoutMs, 1e4) }),
+    redaction: Object.freeze({
+      mode: "summary",
+      summaryMaxChars: nonNegativeFinite(opts.maxSummaryChars, 512)
+    }),
+    filesystem: Object.freeze({
+      cwd: opts.workingDirectory ?? ".",
+      allowRead: false,
+      allowWrite: false,
+      followSymlinks: false,
+      pathRules: Object.freeze(
+        (opts.allowedWorkingDirectories ?? [opts.workingDirectory ?? "."]).map(
+          (path) => Object.freeze({
+            effect: "allow",
+            path,
+            operation: "run",
+            reason: "Process adapter cwd allowlist."
+          })
+        )
+      )
+    }),
+    approval: Object.freeze({ mode: "auto" }),
+    metadata: Object.freeze({
+      argv: true,
+      shell: false,
+      allowedEnvKeys: Object.freeze([...opts.allowedEnvKeys ?? []])
+    })
+  });
+}
+function httpRuntimeConfig(opts) {
+  return {
+    allowedOrigins: new Set(opts.allowedOrigins ?? []),
+    allowedMethods: new Set(normalizeMethods(opts.allowedMethods ?? ["GET"])),
+    allowedRequestHeaders: new Set(normalizeHeaderNames(opts.allowedRequestHeaders ?? [])),
+    exposedResponseHeaders: new Set(normalizeHeaderNames(opts.exposedResponseHeaders ?? [])),
+    timeoutMs: positiveFinite(opts.timeoutMs, 1e4),
+    maxResponseBytes: Math.max(1, nonNegativeFinite(opts.maxResponseBytes, 64 * 1024)),
+    maxInlineBodyChars: Math.max(1, nonNegativeFinite(opts.maxInlineBodyChars, 4096)),
+    approvalMode: opts.approvalMode ?? "auto"
+  };
+}
+function httpToolProviderExecutionPolicy(providerId, profileId, opts) {
+  const allowedOrigins = Object.freeze([...opts.allowedOrigins ?? []]);
+  const allowedMethods = Object.freeze(normalizeMethods(opts.allowedMethods ?? ["GET"]));
+  const maxResponseBytes = Math.max(1, nonNegativeFinite(opts.maxResponseBytes, 64 * 1024));
+  return Object.freeze({
+    kind: "tool-provider-execution-policy",
+    policyId: `${providerId}:policy:http-v0`,
+    providerId,
+    profileIds: Object.freeze([profileId]),
+    toolNames: Object.freeze(["http.fetch"]),
+    operations: Object.freeze(["fetch"]),
+    sizeCapacity: Object.freeze({
+      limits: Object.freeze([
+        Object.freeze({
+          unit: "bytes",
+          hardLimit: maxResponseBytes,
+          perRequest: true,
+          measurementSource: "adapter-measured-response-body"
+        })
+      ])
+    }),
+    timeout: Object.freeze({ timeoutMs: positiveFinite(opts.timeoutMs, 1e4) }),
+    redaction: Object.freeze({
+      mode: "summary",
+      summaryMaxChars: nonNegativeFinite(opts.maxInlineBodyChars, 4096)
+    }),
+    network: Object.freeze({
+      mode: "allowlist",
+      protocols: Object.freeze(["http:", "https:"]),
+      allowedHosts: allowedOrigins,
+      metadata: Object.freeze({ allowlistKind: "origin" })
+    }),
+    approval: Object.freeze({ mode: opts.approvalMode ?? "auto" }),
+    artifacts: Object.freeze({
+      defaultDataMode: "summary",
+      inlineLimits: Object.freeze([
+        Object.freeze({
+          unit: "chars",
+          hardLimit: Math.max(1, nonNegativeFinite(opts.maxInlineBodyChars, 4096)),
+          perArtifact: true,
+          measurementSource: "js-string-length"
+        })
+      ]),
+      artifactKinds: Object.freeze(["http-response-body"])
+    }),
+    metadata: Object.freeze({
+      allowedOrigins,
+      allowedMethods,
+      allowedRequestHeaders: Object.freeze([...opts.allowedRequestHeaders ?? []]),
+      exposedResponseHeaders: Object.freeze([...opts.exposedResponseHeaders ?? []]),
+      asyncRuntime: true
+    })
+  });
+}
+function prepareHttpRequest(input, config) {
+  const raw = input.toolCall?.arguments;
+  if (!isRecord(raw) || typeof raw.url !== "string") {
+    return {
+      kind: "blocked",
+      issue: issue("http-invalid-arguments", "http.fetch requires a string url argument.")
+    };
+  }
+  let url;
+  try {
+    url = new URL(raw.url);
+  } catch {
+    return { kind: "blocked", issue: issue("http-invalid-url", "http.fetch url is invalid.") };
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return {
+      kind: "blocked",
+      issue: issue("http-protocol-not-allowed", "http.fetch only allows http and https URLs.")
+    };
+  }
+  if (!config.allowedOrigins.has(url.origin)) {
+    return {
+      kind: "blocked",
+      issue: issue("http-origin-not-allowed", "http.fetch origin is not allowlisted.")
+    };
+  }
+  const method = normalizeMethod(raw.method ?? "GET");
+  if (method === void 0 || !config.allowedMethods.has(method)) {
+    return {
+      kind: "blocked",
+      issue: issue("http-method-not-allowed", "http.fetch method is not allowlisted.")
+    };
+  }
+  if (raw.body !== void 0 && typeof raw.body !== "string") {
+    return {
+      kind: "blocked",
+      issue: issue("http-invalid-body", "http.fetch body must be a string when provided.")
+    };
+  }
+  const headers = httpArgumentHeaders(raw.headers, config);
+  if (headers === void 0) {
+    return {
+      kind: "blocked",
+      issue: issue("http-request-header-not-allowed", "http.fetch header is not allowlisted.")
+    };
+  }
+  return {
+    kind: "ready",
+    request: Object.freeze({
+      url: url.toString(),
+      method,
+      headers,
+      ...raw.body === void 0 ? {} : { body: raw.body }
+    })
+  };
+}
+function httpArgumentHeaders(value, config) {
+  if (value === void 0) return Object.freeze({});
+  if (!isRecord(value)) return void 0;
+  const headers = {};
+  for (const [key, entry] of Object.entries(value)) {
+    const normalized = key.toLowerCase();
+    if (!config.allowedRequestHeaders.has(normalized)) return void 0;
+    if (entry !== void 0 && typeof entry !== "string" && typeof entry !== "number" && typeof entry !== "boolean") {
+      return void 0;
+    }
+    if (entry !== void 0) headers[key] = String(entry);
+  }
+  return Object.freeze(headers);
+}
+function httpResponseResult(request, response, config) {
+  const hasInlineBody = response.bodyText !== void 0;
+  const bodyText = response.bodyText ?? "";
+  const bodyBytes = response.bodyBytes ?? textBytes(bodyText);
+  const hasBodyRef = response.bodyRef !== void 0;
+  if (bodyBytes > config.maxResponseBytes && !hasBodyRef) {
+    return {
+      kind: "failure",
+      error: issue("http-response-too-large", "HTTP response body exceeded maxResponseBytes."),
+      retryable: false,
+      metadata: Object.freeze({ bodyBytes, maxResponseBytes: config.maxResponseBytes })
+    };
+  }
+  const inline = hasInlineBody && bodyBytes <= config.maxResponseBytes && bodyText.length <= config.maxInlineBodyChars;
+  const result = Object.freeze({
+    url: response.url ?? request.url,
+    method: request.method,
+    status: response.status,
+    statusText: response.statusText ?? "",
+    headers: filterResponseHeaders(response.headers, config.exposedResponseHeaders),
+    bodyPreview: hasInlineBody ? previewText(bodyText, config.maxInlineBodyChars) : void 0,
+    ...inline ? { bodyText } : {},
+    bodyBytes,
+    bodyTruncated: bodyBytes > config.maxResponseBytes || bodyText.length > config.maxInlineBodyChars,
+    dataMode: inline ? "inline" : hasBodyRef ? "ref" : "summary",
+    ...response.bodyRef === void 0 ? {} : { bodyRef: response.bodyRef }
+  });
+  return {
+    kind: "result",
+    result: Object.freeze({
+      kind: "http-result",
+      value: result,
+      summary: `${request.method} ${response.status} ${response.url ?? request.url}`,
+      refs: response.bodyRef === void 0 ? void 0 : Object.freeze([response.bodyRef]),
+      artifacts: Object.freeze([httpBodyArtifact(result, response.bodyRef)])
+    }),
+    issues: !inline && !hasBodyRef ? Object.freeze([
+      issue(
+        "http-response-body-summary-only",
+        "HTTP response body was summarized without a durable body ref.",
+        "warning"
+      )
+    ]) : void 0,
+    metadata: Object.freeze({ status: response.status, bodyBytes })
+  };
+}
+function httpBodyArtifact(result, bodyRef) {
+  return Object.freeze({
+    kind: "http-response-body",
+    format: "text",
+    byteLength: result.bodyBytes,
+    dataMode: result.dataMode,
+    ...result.bodyPreview === void 0 ? {} : { summary: result.bodyPreview },
+    ...result.dataMode === "inline" && result.bodyText !== void 0 ? { value: result.bodyText } : {},
+    ...bodyRef === void 0 ? {} : { ref: bodyRef, refs: Object.freeze([bodyRef]) },
+    sizeEvidence: Object.freeze([
+      sizeEvidence(result.bodyBytes, "adapter-measured-http-response-body", void 0)
+    ])
+  });
+}
+function httpErrorResult(error, config) {
+  const aborted = error instanceof Error && error.name === "AbortError";
+  if (aborted) {
+    return { kind: "timeout", timeoutMs: config.timeoutMs, retryable: true };
+  }
+  return {
+    kind: "failure",
+    error: issue("http-fetch-failed", "HTTP fetch failed before producing a response."),
+    retryable: true,
+    metadata: Object.freeze({ errorType: error instanceof Error ? error.name : typeof error })
+  };
+}
+function defaultHttpToolProviderDriver(maxResponseBytes) {
+  return Object.freeze({
+    fetch(request) {
+      const fetchImpl = globalThis.fetch;
+      if (typeof fetchImpl !== "function") {
+        throw new Error("global fetch is unavailable");
+      }
+      return fetchImpl(request.url, {
+        method: request.method,
+        headers: request.headers,
+        body: request.body,
+        redirect: "manual",
+        signal: request.signal
+      }).then(
+        (response) => readResponseBody(response, maxResponseBytes).then(
+          (body) => Object.freeze({
+            url: response.url,
+            status: response.status,
+            statusText: response.statusText,
+            headers: responseHeaders(response.headers),
+            bodyText: body.text,
+            bodyBytes: body.bytes
+          })
+        )
+      );
+    }
+  });
+}
+function readResponseBody(response, maxBytes) {
+  const body = response.body;
+  if (body === null) return Promise.resolve({ text: "", bytes: 0 });
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  const chunks = [];
+  let bytes = 0;
+  function pump() {
+    return reader.read().then((next) => {
+      if (next.done) {
+        chunks.push(decoder.decode());
+        return { text: chunks.join(""), bytes };
+      }
+      bytes += next.value.byteLength;
+      if (bytes > maxBytes) {
+        reader.cancel().catch(() => {
+        });
+        return { text: chunks.join(""), bytes };
+      }
+      chunks.push(decoder.decode(next.value, { stream: true }));
+      return pump();
+    });
+  }
+  return pump();
+}
+function responseHeaders(headers) {
+  const out = {};
+  headers.forEach((value, key) => {
+    out[key] = value;
+  });
+  return Object.freeze(out);
+}
+function filterResponseHeaders(headers, exposed) {
+  if (headers === void 0 || exposed.size === 0) return void 0;
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (exposed.has(key.toLowerCase())) out[key] = value;
+  }
+  return Object.keys(out).length === 0 ? void 0 : Object.freeze(out);
+}
+function requestMatchesInput(request, input) {
+  return request.adapterInputId === input.adapterInputId && request.requestId === input.requestId && request.operationId === input.operationId && (request.routeId === void 0 || request.routeId === input.routeId) && (request.executorId === void 0 || request.executorId === input.executorId) && (request.profileId === void 0 || request.profileId === input.profileId);
+}
+function requestApproved(request) {
+  const metadata = request.metadata;
+  return isRecord(metadata) && (metadata.approval === "granted" || metadata.approvalGranted === true || isAdmissionApprovedMetadata(metadata) && hasAdmissionSourceRef(request.sourceRefs));
+}
+function isAdmissionApprovedMetadata(metadata) {
+  return typeof metadata.admissionId === "string" && metadata.admissionId.length > 0 && typeof metadata.proposalId === "string" && metadata.proposalId.length > 0 && typeof metadata.approvedFromRunId === "string" && metadata.approvedFromRunId.length > 0;
+}
+function hasAdmissionSourceRef(sourceRefs) {
+  return (sourceRefs ?? []).some(
+    (sourceRef) => sourceRef.kind === "tool-provider-run-admission" || sourceRef.kind === "tool-provider-run-admission-decision"
+  );
+}
+function defaultEvidenceRefs(input) {
+  return Object.freeze([
+    { kind: "tool-provider-adapter-input", id: input.adapterInputId },
+    ...input.sourceRefs ?? []
+  ]);
+}
+function outcomeIssues(outcome) {
+  if (outcome.kind === "failure") return Object.freeze([outcome.error, ...outcome.issues ?? []]);
+  return outcome.issues ?? [];
+}
+function agentStatusForOutcome(outcome) {
+  switch (outcome.kind) {
+    case "result":
+      return "completed";
+    case "failure":
+      return "failed";
+    case "blocked":
+      return "blocked";
+    case "canceled":
+      return "canceled";
+    case "timeout":
+      return "timeout";
+  }
+}
+function normalizeMethods(methods) {
+  return Object.freeze(
+    methods.map((method) => normalizeMethod(method)).filter((method) => method !== void 0)
+  );
+}
+function normalizeMethod(method) {
+  return typeof method === "string" && method.length > 0 ? method.toUpperCase() : void 0;
+}
+function normalizeHeaderNames(headers) {
+  return Object.freeze(
+    headers.filter((header) => typeof header === "string" && header.length > 0).map((header) => header.toLowerCase())
+  );
+}
+function textBytes(text) {
+  return new TextEncoder().encode(text).byteLength;
+}
+function previewText(text, maxChars) {
+  if (text.length === 0) return void 0;
+  return text.length <= maxChars ? text : text.slice(0, maxChars);
+}
+function blocked(input, code, message) {
+  return Object.freeze({
+    kind: "blocked",
+    needs: Object.freeze([
+      Object.freeze({
+        kind: code,
+        message,
+        refs: input.providerId === void 0 ? void 0 : Object.freeze([{ kind: "tool-provider", id: input.providerId }])
+      })
+    ]),
+    issues: Object.freeze([issue(code, message, "error")]),
+    evidenceRefs: input.sourceRefs
+  });
+}
+function failure(input, code, message) {
+  return Object.freeze({
+    kind: "failure",
+    error: issue(code, message, "error"),
+    retryable: false,
+    evidenceRefs: input.sourceRefs
+  });
+}
+function issue(code, message, severity = "error", details) {
+  return Object.freeze({
+    kind: "issue",
+    code,
+    message,
+    severity,
+    ...details === void 0 ? {} : { details }
+  });
+}
+function sizeEvidence(quantity, measurementSource, sourceRefs) {
+  return Object.freeze({
+    kind: "size-capacity-evidence",
+    unit: "bytes",
+    quantity,
+    measurementSource,
+    ...sourceRefs === void 0 ? {} : { sourceRefs }
+  });
+}
+function nonNegativeFinite(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+function positiveFinite(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringArray(value) {
+  if (!Array.isArray(value)) return void 0;
+  const entries = Array.from(value);
+  if (!entries.every((entry) => typeof entry === "string")) return void 0;
+  return Object.freeze(entries);
+}
+function arraysEqual(a, b) {
+  return a.length === b.length && a.every((value, index) => value === b[index]);
+}
+function normalizeAllowedCommands(commands) {
+  const out = /* @__PURE__ */ new Map();
+  const duplicates = /* @__PURE__ */ new Set();
+  const invalids = /* @__PURE__ */ new Set();
+  for (const command of commands) {
+    if (typeof command.command !== "string" || command.command.length === 0) {
+      invalids.add("<invalid-command>");
+      continue;
+    }
+    const frozen = freezeAllowedCommand(command);
+    if (frozen === void 0) {
+      out.delete(command.command);
+      invalids.add(command.command);
+      continue;
+    }
+    if (out.has(command.command)) {
+      out.delete(command.command);
+      duplicates.add(command.command);
+      continue;
+    }
+    if (duplicates.has(command.command) || invalids.has(command.command)) continue;
+    out.set(command.command, frozen);
+  }
+  return { commands: out, duplicates, invalids };
+}
+function freezeAllowedCommand(command) {
+  const fixedArgs = command.fixedArgs === void 0 ? void 0 : stringArray(command.fixedArgs);
+  if (command.fixedArgs !== void 0 && fixedArgs === void 0) return void 0;
+  const allowArgs = Array.isArray(command.allowArgs) ? stringArray(command.allowArgs) : command.allowArgs;
+  if (Array.isArray(command.allowArgs) && allowArgs === void 0) return void 0;
+  return Object.freeze({
+    command: command.command,
+    ...command.executable === void 0 ? {} : { executable: command.executable },
+    ...fixedArgs === void 0 ? {} : { fixedArgs },
+    ...allowArgs === void 0 ? {} : { allowArgs },
+    ...command.cwd === void 0 ? {} : { cwd: command.cwd }
+  });
+}
+function realpath(path) {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return void 0;
+  }
+}
+function isPathInside(path, root) {
+  const normalizedPath = resolve(path);
+  const normalizedRoot = resolve(root);
+  const rel = relative(normalizedRoot, normalizedPath);
+  return rel === "" || rel.length > 0 && !rel.startsWith("..") && !isAbsolute(rel);
+}
+function isTimeoutError(error) {
+  return error.code === "ETIMEDOUT";
+}
+function isOutputLimitError(error) {
+  return error?.code === "ENOBUFS";
+}
+function preview(buffer, maxChars) {
+  if (buffer.length === 0) return void 0;
+  const text = buffer.toString("utf8");
+  return text.length <= maxChars ? text : text.slice(0, maxChars);
+}
+export {
+  httpToolProviderCatalog,
+  httpToolProviderRuntime,
+  localBuiltinToolProviderAdapterPack,
+  localBuiltinToolProviderBinding,
+  processToolProviderAdapterPack,
+  processToolProviderBinding,
+  processToolProviderCatalog
+};
+//# sourceMappingURL=tool-provider-adapters.js.map