@intutic/gate 1.10.1 → 2.1.0

package/dist/workflow.d.ts

@@ -1,6 +1,7 @@
 /**
- * `@ai-sdk/workflow` adapter: `intuticNeedsApproval()`, `withIntuticApproval()`,
- * `wrapWorkflowTools()`, and the FatalError-compatible `IntuticWorkflowRefusal`.
+ * `@ai-sdk/workflow` adapter: `withIntuticApproval()`, `intuticNeedsApproval()`,
+ * `intuticApprovalStep()`, `wrapWorkflowTools()`, and the FatalError-compatible
+ * `IntuticWorkflowRefusal`.
  *
  * `@intutic/gate/workflow` — the same idea `vercel.ts` implements for the base
  * `ai` package (wrap the framework's own veto point around this package's
@@ -9,10 +10,11 @@
  *
  * ## 1. The veto surface is per-tool `needsApproval`, not an agent option
  *
- * Confirmed against a real install (`@ai-sdk/workflow@1.0.69`):
- * `WorkflowAgent`/`WorkflowAgentOptions` carry ZERO approval fields — the
- * string `toolApproval` does not appear anywhere in the package's shipped
- * `.d.ts`. The veto surface is `needsApproval` (boolean | function) on the
+ * Confirmed against a real install (`@ai-sdk/workflow@1.0.69`, re-read on
+ * 2.0.58): `WorkflowAgent`/`WorkflowAgentOptions` carry NO approval-policy
+ * field — 1.x's shipped `.d.ts` never mentions `toolApproval`, and 2.x adds
+ * only `experimental_toolApprovalSecret`, an HMAC secret that signs approval
+ * requests so a replayed approval can be verified, not a veto. The veto surface is `needsApproval` (boolean | function) on the
  * TOOL definition, exactly as the framework's own workflow-agent docs
  * describe under "Tool Approval". The compiled agent loop confirms the
  * semantics (dist/index.js): `needsApproval == null` → no approval; a
@@ -22,9 +24,9 @@
  * later — so this framework, uniquely in this package, has a real
  * human-in-the-loop lane for the gate to route into.
  *
- * (`ai@7.0.68` marks tool-level `needsApproval` `@deprecated` in favour of
- * generateText-level `toolApproval` — but `@ai-sdk/workflow`'s OWN agent loop
- * reads the tool-level field and exposes no other veto surface, so it is the
+ * (`ai@7` — still in 7.0.127 — marks tool-level `needsApproval` `@deprecated`
+ * in favour of generateText-level `toolApproval` — but `@ai-sdk/workflow`'s
+ * OWN agent loop (1.x and 2.0.58 alike) reads the tool-level field and exposes no other veto surface, so it is the
  * correct — indeed the only — integration point here. Noted in the TD entry
  * this phase filed, so a future @ai-sdk/workflow release moving to the
  * generateText-shaped surface gets caught rather than silently ungated.)
@@ -33,11 +35,13 @@
  *
  * A durable workflow retries failed steps. Confirmed against real installs
  * (`workflow@4.8.3` re-exporting `@workflow/errors@4.2.1` via
- * `@workflow/core`): the runtime's retry/abort decision consults
- * `FatalError.is(err)` (`@workflow/core`'s `runtime/step-handler.js` — a
- * fatal error "bubbl[es] up to parent workflow"; anything else is retried
- * toward `maxAttempts`), and `FatalError.is()` DUCK-TYPES: it checks
- * `err.name === 'FatalError'` on any Error-shaped object, precisely because
+ * `@workflow/core`; re-read on `workflow@5.0.1` / `@workflow/errors@5.0.1`):
+ * the runtime's retry/abort decision consults `FatalError.is(err)`
+ * (`@workflow/core`'s `runtime/step-handler.js` in 4.x,
+ * `runtime/step-executor.js` in 5.x — a fatal error "bubbl[es] up to parent
+ * workflow"; anything else is retried toward `maxAttempts`), and
+ * `FatalError.is()` DUCK-TYPES: it checks `err.name === 'FatalError'` (5.x
+ * also accepts `err.fatal === true`) on any Error-shaped object, precisely because
  * workflows execute in a separate `vm` realm where `instanceof` fails across
  * the boundary. A plain `IntuticGateRefusal` thrown from `needsApproval` or a
  * tool body would therefore be RETRIED — a governance denial replayed on a
@@ -56,9 +60,44 @@
  * "no gate configured" case, which is deterministic and would fail every
  * retry identically) is made fatal.
  *
+ * ## 3. `needsApproval` runs in the workflow VM — the gate must run in a step
+ *
+ * Observed in a live run on the Workflow DevKit's local world (TD-498):
+ * `WorkflowAgent`'s loop runs inside the `"use workflow"` function, so it
+ * calls `needsApproval` in the workflow VM, which has no Node.js modules.
+ * `Gate` reads its policy snapshot with `node:fs`, so evaluating it there
+ * fails with `require is not defined` — and when the workflow bundle pulls
+ * `node:fs` in at module level, EVERY workflow sharing that bundle fails at
+ * load (observed with `workflow/nitro`).
+ *
+ * So the gate runs in a STEP, which has full Node.js and is durable. The
+ * caller declares one `"use step"` function in their own module — the
+ * directive must sit in a module the workflow bundler transforms, and the
+ * step's body must build/receive the `Gate` itself, because step arguments
+ * are serialized and a `Gate` instance is not serializable — whose body is
+ * {@link intuticApprovalStep}, and passes it as `{ step }`:
+ *
+ * ```ts
+ * export async function intuticGate(toolName: string, input: unknown) {
+ *   'use step'
+ *   return intuticApprovalStep(toolName, input, { gate: new Gate({ ... }) })
+ * }
+ * // in the workflow: tools: withIntuticApproval(tools, { step: intuticGate })
+ * ```
+ *
+ * With `{ step }`, the `needsApproval` this module builds only calls the step
+ * (a durable step invocation from the VM's point of view) and maps its
+ * boolean; nothing Node-only runs in the VM. This module itself is safe to
+ * import into workflow code: it imports nothing that touches Node.js
+ * (`errors.ts`, `registry.ts`, `wrapTools.ts`; `Gate` is a type-only
+ * import). Without `{ step }`, the gate is evaluated in-process, which still
+ * works wherever Node.js is available (inside a step, or any plain `ai`
+ * loop); called in the workflow VM it throws an {@link IntuticWorkflowRefusal}
+ * naming this fix instead of failing with `require is not defined`.
+ *
  * @module
  */
-import { type Gate } from './gate.js';
+import type { Gate } from './gate.js';
 import { IntuticGateRefusal } from './errors.js';
 import { type AnyFn, type ExecutableTool } from './wrapTools.js';
 /**
@@ -99,9 +138,15 @@ export interface WorkflowNeedsApprovalOptions {
  *  `ai`'s tool-level `needsApproval` (the surface `@ai-sdk/workflow`'s agent
  *  loop actually consults). */
 export type WorkflowNeedsApproval = (input: unknown, options: WorkflowNeedsApprovalOptions) => Promise<boolean>;
-export interface IntuticNeedsApprovalOptions {
-    /** Overrides the process-wide installed gate (`install(new Gate(...))`). */
-    gate?: Gate;
+/**
+ * The `"use step"` function the caller declares to run the gate (see module
+ * doc, section 3): called with the tool name and the call's input — both
+ * serializable — it resolves `true` when a human should approve the call and
+ * throws {@link IntuticWorkflowRefusal} when the gate blocks it. Its body is
+ * {@link intuticApprovalStep}.
+ */
+export type IntuticGateStep = (toolName: string, input: unknown) => Promise<boolean>;
+interface OnAllowOption {
     /**
      * What an ALLOWED call maps to. `needsApproval` answers "does a human need
      * to approve this?", which is a different question from "may this run?" —
@@ -119,30 +164,74 @@ export interface IntuticNeedsApprovalOptions {
      * the decision to a human approver as though the gate had no verdict, and
      * returning `false` would RUN the tool — the one thing a block must never
      * do.
+     *
+     * With `{ step }`, `'human'` here and the step's own answer are OR-ed:
+     * either one asking for a human is enough.
      */
     onAllow?: 'auto' | 'human';
 }
+export type IntuticNeedsApprovalOptions = (OnAllowOption & {
+    /**
+     * Evaluate the gate in this `"use step"` function — required when the
+     * `needsApproval` runs in the workflow VM, i.e. on a `WorkflowAgent`
+     * (see module doc, section 3). The step builds or receives its own
+     * `Gate`; a `gate` cannot be passed here, since the VM cannot hold one.
+     */
+    step: IntuticGateStep;
+    gate?: never;
+}) | (OnAllowOption & {
+    /** Evaluate in-process, Node.js only. Overrides the process-wide
+     *  installed gate (`install(new Gate(...))`). */
+    gate?: Gate;
+    step?: undefined;
+});
+/** Options for {@link intuticApprovalStep} — the in-process evaluation, so no
+ *  `step`. */
+export type IntuticApprovalStepOptions = OnAllowOption & {
+    gate?: Gate;
+};
 /**
- * Build an async `needsApproval` function for ONE workflow tool:
+ * The gate evaluation for ONE call, written to be the body of the caller's
+ * `"use step"` function (see module doc, section 3):
  *
  * ```ts
- * import { WorkflowAgent } from '@ai-sdk/workflow'
- * import { Gate, install } from '@intutic/gate'
- * import { intuticNeedsApproval } from '@intutic/gate/workflow'
- *
- * install(new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }))
- *
- * const agent = new WorkflowAgent({
- *   model,
- *   tools: {
- *     deployService: {
- *       description: '...',
- *       inputSchema,
- *       execute: deployStep,
- *       needsApproval: intuticNeedsApproval('deployService'),
- *     },
- *   },
- * })
+ * // workflows/intutic-gate.ts
+ * import { Gate } from '@intutic/gate'
+ * import { intuticApprovalStep } from '@intutic/gate/workflow'
+ *
+ * export async function intuticGate(toolName: string, input: unknown): Promise<boolean> {
+ *   'use step'
+ *   return intuticApprovalStep(toolName, input, {
+ *     gate: new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }),
+ *   })
+ * }
+ * ```
+ *
+ * Reference `@intutic/gate` only inside step bodies in that module: the
+ * workflow bundler also bundles it into the VM with the step bodies
+ * replaced, and a module-level use would keep the Node-only gate there.
+ *
+ * Verdict mapping: BLOCK → throws {@link IntuticWorkflowRefusal} (fatal — the
+ * step runs once and the run fails instead of retry-looping; see module doc);
+ * ALLOW → `false`, or `true` with `onAllow: 'human'`. A non-refusal crash in
+ * the gate is re-thrown untouched (the step retries — correct for
+ * transients). Requires a gate (`{ gate }` or `install()` in the process
+ * that runs steps); called in the workflow VM itself, it throws naming the
+ * fix.
+ */
+export declare function intuticApprovalStep(toolName: string, input: unknown, opts?: IntuticApprovalStepOptions): Promise<boolean>;
+/**
+ * Build an async `needsApproval` function for ONE workflow tool. On a
+ * `WorkflowAgent`, pass the caller's gate step (see
+ * {@link intuticApprovalStep}):
+ *
+ * ```ts
+ * deployService: {
+ *   description: '...',
+ *   inputSchema,
+ *   execute: deployStep,
+ *   needsApproval: intuticNeedsApproval('deployService', { step: intuticGate }),
+ * },
  * ```
  *
  * The tool name is a parameter because the framework's `needsApproval`
@@ -151,6 +240,12 @@ export interface IntuticNeedsApprovalOptions {
  * {@link withIntuticApproval} to attach this to a whole tools record without
  * hand-repeating each name.
  *
+ * With `{ step }`, the returned function only calls the step and maps its
+ * answer — safe in the workflow VM. Without it, the gate is evaluated
+ * in-process (`{ gate }` or the installed gate), which needs Node.js: fine in
+ * a plain `ai` loop or inside a step, and in the workflow VM it throws an
+ * {@link IntuticWorkflowRefusal} naming the `{ step }` fix.
+ *
  * Verdict mapping: BLOCK → throws {@link IntuticWorkflowRefusal} (fatal —
  * aborts instead of retry-looping; see module doc); ALLOW → `false` or `true`
  * per `onAllow`. A non-refusal crash in the gate is re-thrown untouched
@@ -169,13 +264,29 @@ export interface WorkflowToolLike {
  * `needsApproval` the tool already declares:
  *
  * ```ts
- * const agent = new WorkflowAgent({ model, tools: withIntuticApproval(tools) })
+ * import { WorkflowAgent } from '@ai-sdk/workflow'
+ * import { withIntuticApproval } from '@intutic/gate/workflow'
+ * import { intuticGate } from './intutic-gate' // the "use step" function
+ *
+ * export async function deployAgent(messages: ModelMessage[]) {
+ *   'use workflow'
+ *   const agent = new WorkflowAgent({
+ *     model,
+ *     tools: withIntuticApproval(tools, { step: intuticGate }),
+ *   })
+ *   // ...
+ * }
  * ```
  *
+ * (`{ step }` is what makes this work on a `WorkflowAgent`, whose
+ * `needsApproval` runs in the workflow VM — see {@link intuticApprovalStep}
+ * and the module doc, section 3. Without it the gate is evaluated
+ * in-process, which needs Node.js.)
+ *
  * For each tool (the record KEY is the tool name reported to the gate — the
  * same identity the framework itself dispatches on):
  *
- *   1. `Gate.guard()` runs first. BLOCK throws {@link IntuticWorkflowRefusal}.
+ *   1. The gate runs first. BLOCK throws {@link IntuticWorkflowRefusal}.
  *   2. On allow, the tool's OWN prior `needsApproval` still applies: a
  *      boolean is returned as-is; a function is awaited with the original
  *      arguments; a tool with none falls back to `onAllow` ('auto' → false).
@@ -198,7 +309,9 @@ export declare function withIntuticApproval<T extends Record<string, WorkflowToo
  * "no gate configured" handling and the record-key-is-tool-name convention —
  * is `wrapTools`'s own behaviour, reused rather than reimplemented.
  *
- * Prefer {@link withIntuticApproval} as the primary integration: it uses the
+ * Call it inside the tool's `"use step"` body (it evaluates the gate
+ * in-process, so it needs Node.js). Prefer {@link withIntuticApproval} as the
+ * primary integration: it uses the
  * framework's own pre-execution veto surface, refuses BEFORE the durable
  * step ever starts, and keeps the human-approval lane available. This
  * execute-level wrapper is defense in depth (or the option for callers whose
@@ -206,4 +319,5 @@ export declare function withIntuticApproval<T extends Record<string, WorkflowToo
  * the call, which is harmless but emits duplicate gate telemetry.
  */
 export declare function wrapWorkflowTools<T extends AnyFn | ExecutableTool>(tools: Record<string, T>, gate?: Gate): Record<string, T>;
+export {};
 //# sourceMappingURL=workflow.d.ts.map

package/dist/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAkB,MAAM,WAAW,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAa,KAAK,KAAK,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,SAAgB,KAAK,EAAG,IAAI,CAAS;gBACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;IAK7D,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,sBAAsB;IAIhE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CASnC;AAED;;;;qEAIqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;+BAE+B;AAC/B,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB,MAAM,WAAW,2BAA2B;IAC1C,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,2BAAgC,GACrC,qBAAqB,CAcvB;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,CAAA;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE,2BAAgC,GACrC,CAAC,CAiBH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAWnB"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAa,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAa,KAAK,KAAK,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,SAAgB,KAAK,EAAG,IAAI,CAAS;gBACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;IAK7D,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,sBAAsB;IAIhE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CASnC;AAED;;;;qEAIqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;+BAE+B;AAC/B,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAEpF,UAAU,aAAa;IACrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAED,MAAM,MAAM,2BAA2B,GACnC,CAAC,aAAa,GAAG;IACf;;;;;OAKG;IACH,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAC,GACF,CAAC,aAAa,GAAG;IACf;qDACiD;IACjD,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,CAAC,CAAA;AAEN;cACc;AACd,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG;IAAE,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAiDxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,2BAAgC,GACrC,qBAAqB,CAYvB;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,CAAA;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE,2BAAgC,GACrC,CAAC,CAiBH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAWnB"}

package/dist/workflow.js

@@ -1,6 +1,7 @@
 /**
- * `@ai-sdk/workflow` adapter: `intuticNeedsApproval()`, `withIntuticApproval()`,
- * `wrapWorkflowTools()`, and the FatalError-compatible `IntuticWorkflowRefusal`.
+ * `@ai-sdk/workflow` adapter: `withIntuticApproval()`, `intuticNeedsApproval()`,
+ * `intuticApprovalStep()`, `wrapWorkflowTools()`, and the FatalError-compatible
+ * `IntuticWorkflowRefusal`.
  *
  * `@intutic/gate/workflow` — the same idea `vercel.ts` implements for the base
  * `ai` package (wrap the framework's own veto point around this package's
@@ -9,10 +10,11 @@
  *
  * ## 1. The veto surface is per-tool `needsApproval`, not an agent option
  *
- * Confirmed against a real install (`@ai-sdk/workflow@1.0.69`):
- * `WorkflowAgent`/`WorkflowAgentOptions` carry ZERO approval fields — the
- * string `toolApproval` does not appear anywhere in the package's shipped
- * `.d.ts`. The veto surface is `needsApproval` (boolean | function) on the
+ * Confirmed against a real install (`@ai-sdk/workflow@1.0.69`, re-read on
+ * 2.0.58): `WorkflowAgent`/`WorkflowAgentOptions` carry NO approval-policy
+ * field — 1.x's shipped `.d.ts` never mentions `toolApproval`, and 2.x adds
+ * only `experimental_toolApprovalSecret`, an HMAC secret that signs approval
+ * requests so a replayed approval can be verified, not a veto. The veto surface is `needsApproval` (boolean | function) on the
  * TOOL definition, exactly as the framework's own workflow-agent docs
  * describe under "Tool Approval". The compiled agent loop confirms the
  * semantics (dist/index.js): `needsApproval == null` → no approval; a
@@ -22,9 +24,9 @@
  * later — so this framework, uniquely in this package, has a real
  * human-in-the-loop lane for the gate to route into.
  *
- * (`ai@7.0.68` marks tool-level `needsApproval` `@deprecated` in favour of
- * generateText-level `toolApproval` — but `@ai-sdk/workflow`'s OWN agent loop
- * reads the tool-level field and exposes no other veto surface, so it is the
+ * (`ai@7` — still in 7.0.127 — marks tool-level `needsApproval` `@deprecated`
+ * in favour of generateText-level `toolApproval` — but `@ai-sdk/workflow`'s
+ * OWN agent loop (1.x and 2.0.58 alike) reads the tool-level field and exposes no other veto surface, so it is the
  * correct — indeed the only — integration point here. Noted in the TD entry
  * this phase filed, so a future @ai-sdk/workflow release moving to the
  * generateText-shaped surface gets caught rather than silently ungated.)
@@ -33,11 +35,13 @@
  *
  * A durable workflow retries failed steps. Confirmed against real installs
  * (`workflow@4.8.3` re-exporting `@workflow/errors@4.2.1` via
- * `@workflow/core`): the runtime's retry/abort decision consults
- * `FatalError.is(err)` (`@workflow/core`'s `runtime/step-handler.js` — a
- * fatal error "bubbl[es] up to parent workflow"; anything else is retried
- * toward `maxAttempts`), and `FatalError.is()` DUCK-TYPES: it checks
- * `err.name === 'FatalError'` on any Error-shaped object, precisely because
+ * `@workflow/core`; re-read on `workflow@5.0.1` / `@workflow/errors@5.0.1`):
+ * the runtime's retry/abort decision consults `FatalError.is(err)`
+ * (`@workflow/core`'s `runtime/step-handler.js` in 4.x,
+ * `runtime/step-executor.js` in 5.x — a fatal error "bubbl[es] up to parent
+ * workflow"; anything else is retried toward `maxAttempts`), and
+ * `FatalError.is()` DUCK-TYPES: it checks `err.name === 'FatalError'` (5.x
+ * also accepts `err.fatal === true`) on any Error-shaped object, precisely because
  * workflows execute in a separate `vm` realm where `instanceof` fails across
  * the boundary. A plain `IntuticGateRefusal` thrown from `needsApproval` or a
  * tool body would therefore be RETRIED — a governance denial replayed on a
@@ -56,10 +60,45 @@
  * "no gate configured" case, which is deterministic and would fail every
  * retry identically) is made fatal.
  *
+ * ## 3. `needsApproval` runs in the workflow VM — the gate must run in a step
+ *
+ * Observed in a live run on the Workflow DevKit's local world (TD-498):
+ * `WorkflowAgent`'s loop runs inside the `"use workflow"` function, so it
+ * calls `needsApproval` in the workflow VM, which has no Node.js modules.
+ * `Gate` reads its policy snapshot with `node:fs`, so evaluating it there
+ * fails with `require is not defined` — and when the workflow bundle pulls
+ * `node:fs` in at module level, EVERY workflow sharing that bundle fails at
+ * load (observed with `workflow/nitro`).
+ *
+ * So the gate runs in a STEP, which has full Node.js and is durable. The
+ * caller declares one `"use step"` function in their own module — the
+ * directive must sit in a module the workflow bundler transforms, and the
+ * step's body must build/receive the `Gate` itself, because step arguments
+ * are serialized and a `Gate` instance is not serializable — whose body is
+ * {@link intuticApprovalStep}, and passes it as `{ step }`:
+ *
+ * ```ts
+ * export async function intuticGate(toolName: string, input: unknown) {
+ *   'use step'
+ *   return intuticApprovalStep(toolName, input, { gate: new Gate({ ... }) })
+ * }
+ * // in the workflow: tools: withIntuticApproval(tools, { step: intuticGate })
+ * ```
+ *
+ * With `{ step }`, the `needsApproval` this module builds only calls the step
+ * (a durable step invocation from the VM's point of view) and maps its
+ * boolean; nothing Node-only runs in the VM. This module itself is safe to
+ * import into workflow code: it imports nothing that touches Node.js
+ * (`errors.ts`, `registry.ts`, `wrapTools.ts`; `Gate` is a type-only
+ * import). Without `{ step }`, the gate is evaluated in-process, which still
+ * works wherever Node.js is available (inside a step, or any plain `ai`
+ * loop); called in the workflow VM it throws an {@link IntuticWorkflowRefusal}
+ * naming this fix instead of failing with `require is not defined`.
+ *
  * @module
  */
-import { active as activeGate } from './gate.js';
 import { IntuticGateRefusal } from './errors.js';
+import { active as activeGate } from './registry.js';
 import { wrapTools } from './wrapTools.js';
 /**
  * A refused call inside a durable workflow.
@@ -97,6 +136,25 @@ export class IntuticWorkflowRefusal extends IntuticGateRefusal {
             (value.message.startsWith('[Intutic Governance] BLOCKED:')));
     }
 }
+// Set on the workflow VM's global object by the Workflow DevKit runtime
+// (`@workflow/core`'s `workflow.js`: `vmGlobalThis[WORKFLOW_USE_STEP] =
+// useStep`); never set in the Node.js realm where steps execute.
+const WORKFLOW_USE_STEP = Symbol.for('WORKFLOW_USE_STEP');
+function inWorkflowSandbox() {
+    return typeof globalThis[WORKFLOW_USE_STEP] === 'function';
+}
+function refuseInWorkflowSandbox(helper) {
+    if (!inWorkflowSandbox())
+        return;
+    // Fail closed, FatalError-shaped, and NAME THE FIX: the gate needs
+    // Node.js, which the workflow VM does not have, and retrying cannot
+    // change that.
+    throw new IntuticWorkflowRefusal(`${helper} ran inside the workflow sandbox, which has no Node.js, so the gate cannot evaluate ` +
+        'the call there. Run it in a "use step" function: declare ' +
+        "`async function intuticGate(toolName, input) { 'use step'; return intuticApprovalStep(toolName, input, { gate }) }` " +
+        'and pass { step: intuticGate } to withIntuticApproval()/intuticNeedsApproval(). ' +
+        'Refusing to run the tool unguarded.', 'WORKFLOW_SANDBOX');
+}
 function requireGate(gate, helper) {
     const g = gate ?? activeGate();
     if (g === null) {
@@ -116,26 +174,60 @@ function renderWorkflowToolInput(input) {
     return { args: [input] };
 }
 /**
- * Build an async `needsApproval` function for ONE workflow tool:
+ * The gate evaluation for ONE call, written to be the body of the caller's
+ * `"use step"` function (see module doc, section 3):
  *
  * ```ts
- * import { WorkflowAgent } from '@ai-sdk/workflow'
- * import { Gate, install } from '@intutic/gate'
- * import { intuticNeedsApproval } from '@intutic/gate/workflow'
- *
- * install(new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }))
- *
- * const agent = new WorkflowAgent({
- *   model,
- *   tools: {
- *     deployService: {
- *       description: '...',
- *       inputSchema,
- *       execute: deployStep,
- *       needsApproval: intuticNeedsApproval('deployService'),
- *     },
- *   },
- * })
+ * // workflows/intutic-gate.ts
+ * import { Gate } from '@intutic/gate'
+ * import { intuticApprovalStep } from '@intutic/gate/workflow'
+ *
+ * export async function intuticGate(toolName: string, input: unknown): Promise<boolean> {
+ *   'use step'
+ *   return intuticApprovalStep(toolName, input, {
+ *     gate: new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }),
+ *   })
+ * }
+ * ```
+ *
+ * Reference `@intutic/gate` only inside step bodies in that module: the
+ * workflow bundler also bundles it into the VM with the step bodies
+ * replaced, and a module-level use would keep the Node-only gate there.
+ *
+ * Verdict mapping: BLOCK → throws {@link IntuticWorkflowRefusal} (fatal — the
+ * step runs once and the run fails instead of retry-looping; see module doc);
+ * ALLOW → `false`, or `true` with `onAllow: 'human'`. A non-refusal crash in
+ * the gate is re-thrown untouched (the step retries — correct for
+ * transients). Requires a gate (`{ gate }` or `install()` in the process
+ * that runs steps); called in the workflow VM itself, it throws naming the
+ * fix.
+ */
+export async function intuticApprovalStep(toolName, input, opts = {}) {
+    refuseInWorkflowSandbox('intuticApprovalStep()');
+    const g = requireGate(opts.gate, 'intuticApprovalStep()');
+    try {
+        await g.guard(toolName, renderWorkflowToolInput(input));
+    }
+    catch (exc) {
+        if (exc instanceof IntuticGateRefusal && !(exc instanceof IntuticWorkflowRefusal)) {
+            throw IntuticWorkflowRefusal.from(exc);
+        }
+        throw exc;
+    }
+    return opts.onAllow === 'human';
+}
+/**
+ * Build an async `needsApproval` function for ONE workflow tool. On a
+ * `WorkflowAgent`, pass the caller's gate step (see
+ * {@link intuticApprovalStep}):
+ *
+ * ```ts
+ * deployService: {
+ *   description: '...',
+ *   inputSchema,
+ *   execute: deployStep,
+ *   needsApproval: intuticNeedsApproval('deployService', { step: intuticGate }),
+ * },
  * ```
  *
  * The tool name is a parameter because the framework's `needsApproval`
@@ -144,25 +236,28 @@ function renderWorkflowToolInput(input) {
  * {@link withIntuticApproval} to attach this to a whole tools record without
  * hand-repeating each name.
  *
+ * With `{ step }`, the returned function only calls the step and maps its
+ * answer — safe in the workflow VM. Without it, the gate is evaluated
+ * in-process (`{ gate }` or the installed gate), which needs Node.js: fine in
+ * a plain `ai` loop or inside a step, and in the workflow VM it throws an
+ * {@link IntuticWorkflowRefusal} naming the `{ step }` fix.
+ *
  * Verdict mapping: BLOCK → throws {@link IntuticWorkflowRefusal} (fatal —
  * aborts instead of retry-looping; see module doc); ALLOW → `false` or `true`
  * per `onAllow`. A non-refusal crash in the gate is re-thrown untouched
  * (retryable — correct for transients).
  */
 export function intuticNeedsApproval(toolName, opts = {}) {
-    const onAllow = opts.onAllow ?? 'auto';
-    return async (input, _options) => {
-        const g = requireGate(opts.gate, 'intuticNeedsApproval()');
-        try {
-            await g.guard(toolName, renderWorkflowToolInput(input));
-        }
-        catch (exc) {
-            if (exc instanceof IntuticGateRefusal && !(exc instanceof IntuticWorkflowRefusal)) {
-                throw IntuticWorkflowRefusal.from(exc);
-            }
-            throw exc;
-        }
-        return onAllow === 'human';
+    const human = (opts.onAllow ?? 'auto') === 'human';
+    const step = opts.step;
+    if (step !== undefined) {
+        // A refusal thrown by the step reaches here already FatalError-shaped
+        // (it crossed the step boundary as one) and is rethrown untouched.
+        return async (input) => (await step(toolName, input)) || human;
+    }
+    return async (input) => {
+        refuseInWorkflowSandbox('intuticNeedsApproval()');
+        return intuticApprovalStep(toolName, input, { gate: opts.gate, onAllow: opts.onAllow });
     };
 }
 /**
@@ -170,13 +265,29 @@ export function intuticNeedsApproval(toolName, opts = {}) {
  * `needsApproval` the tool already declares:
  *
  * ```ts
- * const agent = new WorkflowAgent({ model, tools: withIntuticApproval(tools) })
+ * import { WorkflowAgent } from '@ai-sdk/workflow'
+ * import { withIntuticApproval } from '@intutic/gate/workflow'
+ * import { intuticGate } from './intutic-gate' // the "use step" function
+ *
+ * export async function deployAgent(messages: ModelMessage[]) {
+ *   'use workflow'
+ *   const agent = new WorkflowAgent({
+ *     model,
+ *     tools: withIntuticApproval(tools, { step: intuticGate }),
+ *   })
+ *   // ...
+ * }
  * ```
  *
+ * (`{ step }` is what makes this work on a `WorkflowAgent`, whose
+ * `needsApproval` runs in the workflow VM — see {@link intuticApprovalStep}
+ * and the module doc, section 3. Without it the gate is evaluated
+ * in-process, which needs Node.js.)
+ *
  * For each tool (the record KEY is the tool name reported to the gate — the
  * same identity the framework itself dispatches on):
  *
- *   1. `Gate.guard()` runs first. BLOCK throws {@link IntuticWorkflowRefusal}.
+ *   1. The gate runs first. BLOCK throws {@link IntuticWorkflowRefusal}.
  *   2. On allow, the tool's OWN prior `needsApproval` still applies: a
  *      boolean is returned as-is; a function is awaited with the original
  *      arguments; a tool with none falls back to `onAllow` ('auto' → false).
@@ -217,7 +328,9 @@ export function withIntuticApproval(tools, opts = {}) {
  * "no gate configured" handling and the record-key-is-tool-name convention —
  * is `wrapTools`'s own behaviour, reused rather than reimplemented.
  *
- * Prefer {@link withIntuticApproval} as the primary integration: it uses the
+ * Call it inside the tool's `"use step"` body (it evaluates the gate
+ * in-process, so it needs Node.js). Prefer {@link withIntuticApproval} as the
+ * primary integration: it uses the
  * framework's own pre-execution veto surface, refuses BEFORE the durable
  * step ever starts, and keeps the human-approval lane available. This
  * execute-level wrapper is defense in depth (or the option for callers whose

package/dist/workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAA6B,MAAM,WAAW,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,SAAS,EAAmC,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5C,KAAK,GAAG,IAAa,CAAA;IACrC,YAAY,MAAc,EAAE,IAAY,EAAE,UAAmB;QAC3D,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;IAC1B,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAA2B;QACrC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACrF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAc;QACtB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,IAAI,KAAK,YAAY;YACnD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;YAC5D,CAAE,KAA6B,CAAC,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,CACrF,CAAA;IACH,CAAC;CACF;AA4CD,SAAS,WAAW,CAAC,IAAsB,EAAE,MAAc;IACzD,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,4DAA4D;QAC5D,wEAAwE;QACxE,sEAAsE;QACtE,gBAAgB;QAChB,MAAM,IAAI,sBAAsB,CAC9B,2FAA2F,MAAM,IAAI;YACnG,qCAAqC,EACvC,SAAS,CACV,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAoC,EAAE;IAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAA;IACtC,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,OAAO,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAA;AACH,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAQ,EACR,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAqC,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAA;QAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,QAAQ,GAA0B,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/D,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACxD,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,IAAI,aAAa,CAAA;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,MAAO,KAA6C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;gBACxF,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,aAAa,CAAA;YAC9C,CAAC;YACD,OAAO,aAAa,CAAA;QACtB,CAAC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,IAAW;IAEX,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAM,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAI,IAAuB,EAAE,OAAO,EAAE,QAAQ,CAAE,IAAuB,CAAC,OAAO,CAAC,EAAO,CAAA;QACvG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAS;IACzB,8DAA8D;IAC9D,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAMH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,SAAS,EAAmC,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5C,KAAK,GAAG,IAAa,CAAA;IACrC,YAAY,MAAc,EAAE,IAAY,EAAE,UAAmB;QAC3D,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;IAC1B,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAA2B;QACrC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACrF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAc;QACtB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,IAAI,KAAK,YAAY;YACnD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;YAC5D,CAAE,KAA6B,CAAC,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,CACrF,CAAA;IACH,CAAC;CACF;AA4ED,wEAAwE;AACxE,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;AAEzD,SAAS,iBAAiB;IACxB,OAAO,OAAQ,UAAsC,CAAC,iBAAiB,CAAC,KAAK,UAAU,CAAA;AACzF,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAc;IAC7C,IAAI,CAAC,iBAAiB,EAAE;QAAE,OAAM;IAChC,mEAAmE;IACnE,oEAAoE;IACpE,eAAe;IACf,MAAM,IAAI,sBAAsB,CAC9B,GAAG,MAAM,sFAAsF;QAC7F,2DAA2D;QAC3D,sHAAsH;QACtH,kFAAkF;QAClF,qCAAqC,EACvC,kBAAkB,CACnB,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAsB,EAAE,MAAc;IACzD,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,4DAA4D;QAC5D,wEAAwE;QACxE,sEAAsE;QACtE,gBAAgB;QAChB,MAAM,IAAI,sBAAsB,CAC9B,2FAA2F,MAAM,IAAI;YACnG,qCAAqC,EACvC,SAAS,CACV,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,KAAc,EACd,OAAmC,EAAE;IAErC,uBAAuB,CAAC,uBAAuB,CAAC,CAAA;IAChD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAA;IACzD,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;YAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACxC,CAAC;QACD,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,KAAK,OAAO,CAAA;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAoC,EAAE;IAEtC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,OAAO,CAAA;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACtB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sEAAsE;QACtE,mEAAmE;QACnE,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,IAAI,KAAK,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,uBAAuB,CAAC,wBAAwB,CAAC,CAAA;QACjD,OAAO,mBAAmB,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;IACzF,CAAC,CAAA;AACH,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAQ,EACR,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAqC,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAA;QAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,QAAQ,GAA0B,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/D,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACxD,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,IAAI,aAAa,CAAA;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,MAAO,KAA6C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;gBACxF,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,aAAa,CAAA;YAC9C,CAAC;YACD,OAAO,aAAa,CAAA;QACtB,CAAC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,IAAW;IAEX,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAM,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAI,IAAuB,EAAE,OAAO,EAAE,QAAQ,CAAE,IAAuB,CAAC,OAAO,CAAC,EAAO,CAAA;QACvG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAS;IACzB,8DAA8D;IAC9D,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/wrapTools.d.ts

@@ -28,7 +28,7 @@
  * wrapped tool with neither throws, refusing to run the tool unguarded
  * rather than silently skipping enforcement.
  */
-import { type Gate } from './gate.js';
+import type { Gate } from './gate.js';
 export type AnyFn = (...args: any[]) => any;
 export interface ExecutableTool {
     execute: AnyFn;

package/dist/wrapTools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wrapTools.d.ts","sourceRoot":"","sources":["../src/wrapTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAG3D,MAAM,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AAE3C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B;uEACmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAgDD;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAA;AAC3E,wBAAgB,QAAQ,CAAC,CAAC,SAAS,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAA;AAgBtF;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,CAAA;AAClG,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EACxD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA"}
+{"version":3,"file":"wrapTools.d.ts","sourceRoot":"","sources":["../src/wrapTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAIrC,MAAM,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AAE3C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B;uEACmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAgDD;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAA;AAC3E,wBAAgB,QAAQ,CAAC,CAAC,SAAS,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAA;AAgBtF;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,CAAA;AAClG,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EACxD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA"}

package/dist/wrapTools.js

@@ -28,7 +28,7 @@
  * wrapped tool with neither throws, refusing to run the tool unguarded
  * rather than silently skipping enforcement.
  */
-import { active as activeGate } from './gate.js';
+import { active as activeGate } from './registry.js';
 const GUARDED = Symbol.for('intutic.gate.guarded');
 function isGuarded(fn) {
     return fn[GUARDED] === true;