@intutic/gate 1.10.1

package/dist/managedAgents.js

@@ -0,0 +1,446 @@
+/**
+ * Anthropic Managed Agents (public beta since 2026-04-08) — a session
+ * confirmation responder, plus guidance for the two execution surfaces this
+ * adapter does NOT cover the same way.
+ *
+ * `@intutic/gate/managed-agents` — the TypeScript twin of the Python SDK's
+ * `intutic_clawde.gate.adapters.managed_agents`. See that module's doc for
+ * the full research trail; this header covers only what differs for the
+ * TypeScript SDK.
+ *
+ * Managed Agents is architecturally different from every other adapter in
+ * this package: the customer's process does not run the tool-call loop.
+ * Anthropic hosts a "session" that emits an event stream, and the customer's
+ * backend answers it. There is no local function call to wrap the way
+ * `wrapTools()` wraps a Mastra tool.
+ *
+ * ## The veto mechanism — CONFIRMED against a real install
+ *
+ * `@anthropic-ai/sdk@0.117.1` (the latest published release at the time this
+ * adapter was built) was installed as a devDependency of this package and its
+ * shipped `.d.ts` read directly (not inferred from docs alone; the Python
+ * twin was checked the same way against `anthropic==0.122.0`, its own
+ * latest):
+ *
+ *   * `resources/beta/sessions/events.d.ts` — every request this module
+ *     issues (`.list()`, `.send()`, `.stream()`) carries
+ *     `anthropic-beta: managed-agents-2026-04-01` automatically (the real
+ *     client sets it); {@link MANAGED_AGENTS_BETA} documents the value for a
+ *     caller building a raw request.
+ *   * `BetaManagedAgentsUserToolConfirmationEventParams` — the wire shape
+ *     this module builds: `{ type: 'user.tool_confirmation', tool_use_id,
+ *     result: 'allow' | 'deny', deny_message?, session_thread_id? }`.
+ *   * `BetaManagedAgentsAgentToolUseEvent` and
+ *     `BetaManagedAgentsAgentMCPToolUseEvent` both carry
+ *     `evaluated_permission?: 'allow' | 'ask' | 'deny'`. A call the server
+ *     evaluated to `'ask'` (e.g. because its `permission_policy` is
+ *     `always_ask` — Anthropic's docs mark MCP toolsets as `always_ask` by
+ *     default; the SDK types do not encode a default for built-in
+ *     agent-toolset tools, so check current docs) PAUSES the session —
+ *     Anthropic's own docs: "Denied tools do not run." A `'deny'` verdict
+ *     means the SERVER already denied the call (no confirmation is expected
+ *     or accepted); `'allow'` or unset means the call never paused at all.
+ *     **This is the real, documented pre-execution veto this module answers
+ *     — it is not observe-only.**
+ *   * `lib/tools/SessionToolRunner.d.ts` is Anthropic's OWN reference
+ *     dispatcher: it executes `agent.tool_use` / `agent.custom_tool_use`
+ *     calls and posts results, but it does **not** decide `allow`/`deny` for
+ *     an `ask`-gated call itself — it holds until *something* sends the
+ *     matching `user.tool_confirmation` event. That "something" is what this
+ *     module provides: {@link confirmationForEvent} /
+ *     {@link IntuticSessionConfirmer} turn a paused `agent.tool_use` /
+ *     `agent.mcp_tool_use` event into a `Gate.guard()`-driven verdict.
+ *   * `lib/environments/worker.d.ts`'s `EnvironmentWorker` (the self-hosted
+ *     sandbox driver) is built on `SessionToolRunner` for built-in
+ *     agent-toolset tools (bash, edit, read, write, glob, grep, web_fetch,
+ *     web_search). **Self-hosted built-in tools therefore pause and resolve
+ *     through the IDENTICAL `agent.tool_use` / `evaluated_permission` /
+ *     `user.tool_confirmation` mechanism as hosted ones** — this adapter
+ *     covers them the same way. What differs for self-hosted is only WHERE
+ *     the tool body executes (the customer's own worker process), not how
+ *     the pre-execution veto works.
+ *   * `agent.mcp_tool_use` is explicitly excluded from `SessionToolRunner`'s
+ *     own dispatch (its own doc comment: "Server-side `agent.mcp_tool_use`
+ *     calls are intentionally excluded — the runner does not handle them" —
+ *     MCP tools run server-side at Anthropic). But the confirmation gate is a
+ *     SEPARATE mechanism from execution: `BetaManagedAgentsAgentMCPToolUseEvent`
+ *     carries `evaluated_permission` exactly like the built-in event does, so
+ *     this module answers MCP pauses too, even though nothing in the official
+ *     SDK dispatches their execution locally.
+ *
+ * ## What this module does NOT cover the same way — custom tools
+ *
+ * `BetaManagedAgentsAgentCustomToolUseEvent` has **no** `evaluated_permission`
+ * field and no `permission_policy` concept at all: a custom tool always
+ * executes wherever the client that owns its name is listening, with no
+ * pause. It is answered with `user.custom_tool_result`
+ * (`custom_tool_use_id` + `content` + `is_error`), not
+ * `user.tool_confirmation`. This is the "customer's own process runs the
+ * call" surface the phase brief anticipated — the natural integration point
+ * IS this package's `wrapTools()`/`wrapTool()`, exactly as the brief
+ * guessed. BUT verify the shape, because the generic helper does not apply
+ * as-is: `BetaRunnableTool` (`lib/tools/BetaRunnableTool.d.ts`, what
+ * `SessionToolRunner` dispatches against) exposes a `run(args, context)`
+ * method, not the `execute(input)` method `wrapTools()`'s object branch looks
+ * for (`wrapTools.ts` only recognises `.execute`) — handing it a
+ * `BetaRunnableTool` throws a `TypeError` rather than silently skipping
+ * governance, but it still means the generic helper needs a `.run`-aware
+ * sibling rather than "just works". {@link wrapManagedAgentsCustomTool} /
+ * {@link wrapManagedAgentsCustomTools} are that sibling — same throw-based
+ * refusal contract, applied to `.run` instead of `.execute`.
+ *
+ * ## What this module does NOT cover at all — the sandbox tool BODY
+ *
+ * The self-hosted `EnvironmentWorker` gates tool PAUSES exactly like the
+ * hosted path (see above) — but the tool's actual execution runs inside the
+ * customer's own worker process, outside this adapter's reach, same as every
+ * other Intutic adapter's posture toward a framework's built-in tool bodies
+ * (see openai.ts's module doc for the precedent). This module governs
+ * WHETHER the call runs; it does not — and cannot — inspect or modify what
+ * the tool body does once allowed.
+ *
+ * ## Webhook vs. streamed/polled delivery — both are real, verified live
+ *
+ * `resources/beta/webhooks.d.ts`: `client.beta.webhooks.unwrap(body, {
+ * headers, key })` verifies the HMAC signature and returns a typed event
+ * (synchronously — no network call); for a pause it is
+ * `session.requires_action`, which carries only `id` (the session id),
+ * `organization_id`, `workspace_id` — NOT the tool call itself. A webhook is
+ * therefore a NOTIFICATION to re-poll, not a self-contained payload —
+ * {@link IntuticSessionConfirmer.handleWebhook} does exactly that: re-lists
+ * the session's unanswered events and answers them. `events.stream()` /
+ * `events.list()` are the poll/stream alternative this module also supports
+ * directly via {@link IntuticSessionConfirmer.poll} /
+ * {@link IntuticSessionConfirmer.watch}.
+ *
+ * ## Fail-closed posture
+ *
+ * Matches every other adapter in this package: no gate configured, or an
+ * unexpected exception out of `Gate.guard()`, both produce a `'deny'` verdict
+ * — never a silently-allowed, unevaluated call. Only `IntuticGateRefusal` is
+ * distinguished (its own message becomes `deny_message`); anything else is
+ * wrapped in a generic "gate crashed" `deny_message`.
+ *
+ * ## What this module does NOT import
+ *
+ * Deliberately no runtime dependency on `@anthropic-ai/sdk` — the types below
+ * are narrow structural copies of only the shapes this adapter touches, same
+ * policy as openai.ts / mastra.ts / vercel.ts (see openai.ts's module doc for
+ * the full rationale). The real package is a devDependency used by
+ * `__tests__/managedAgents.test.ts` to type-check these structural types
+ * against the real shipped ones.
+ *
+ * @module
+ */
+import { active as activeGate } from './gate.js';
+import { IntuticGateRefusal } from './errors.js';
+// ---------------------------------------------------------------------------
+// Structural copies of the @anthropic-ai/sdk shapes this adapter touches.
+// Confirmed field-for-field against @anthropic-ai/sdk@0.117.1's shipped
+// resources/beta/sessions/events.d.ts (see module doc). This package does
+// not depend on the SDK at runtime, so the shapes are declared here rather
+// than imported.
+// ---------------------------------------------------------------------------
+/** The beta header every Sessions-API request needs. The real SDK sets this
+ *  on every `.list()`/`.send()`/`.stream()` call automatically — this
+ *  constant exists for callers building their own request against the
+ *  endpoint directly. */
+export const MANAGED_AGENTS_BETA = 'managed-agents-2026-04-01';
+const CONFIRMABLE_EVENT_TYPES = new Set(['agent.tool_use', 'agent.mcp_tool_use']);
+const TERMINAL_EVENT_TYPES = new Set(['session.status_terminated', 'session.deleted']);
+/** Read a field off any session event by key, regardless of which member of
+ *  {@link ManagedAgentsSessionEventLike} it structurally is — e.g.
+ *  `tool_use_id`, which only `user.tool_confirmation` events carry. Mirrors
+ *  the Python adapter's `_field` helper. */
+function eventField(event, key) {
+    return event[key];
+}
+function resolveGate(explicit, what) {
+    const g = explicit ?? activeGate();
+    if (g === null) {
+        throw new Error('No gate configured: call install(new Gate(...)) from @intutic/gate, or pass ' +
+            `{ gate } to ${what}. Refusing to run the tool unguarded.`);
+    }
+    return g;
+}
+function crashMessage(err) {
+    const detail = err instanceof Error ? err.message : String(err);
+    return `[Intutic Governance] BLOCKED: gate crashed (${detail}) — failing closed rather than allowing an unevaluated call.`;
+}
+/**
+ * Build the `user.tool_confirmation` params answering `event`, or `null` if
+ * `event` needs no answer from this module.
+ *
+ * `null` covers three cases, all correct to send nothing for: the event
+ * isn't `agent.tool_use`/`agent.mcp_tool_use` (including
+ * `agent.custom_tool_use` — see the module doc); its `evaluated_permission`
+ * is `'allow'` or unset (the call never paused); or it is already `'deny'`
+ * (the SERVER already resolved it — sending a confirmation for an id the
+ * server considers closed would just error).
+ *
+ * Anything else — `'ask'`, or a permission value this module doesn't
+ * recognise — is treated as a pause needing a verdict, matching
+ * `SessionToolRunner`'s own fail-closed handling of unrecognised wire values
+ * (hold/deny rather than dispatch).
+ *
+ * ASYNC: `Gate.guard()` is async in this package (unlike the Python SDK's
+ * synchronous twin) — every caller must `await` this.
+ */
+export async function confirmationForEvent(event, opts = {}) {
+    if (!CONFIRMABLE_EVENT_TYPES.has(event.type))
+        return null;
+    const typed = event;
+    const permission = typed.evaluated_permission ?? null;
+    if (permission === null || permission === 'allow' || permission === 'deny')
+        return null;
+    const eventId = typed.id;
+    if (!eventId)
+        return null;
+    const toolName = typed.name || 'tool';
+    const toolInput = { ...typed.input };
+    if (typed.type === 'agent.mcp_tool_use' && typed.mcp_server_name) {
+        if (!('mcp_server_name' in toolInput)) {
+            toolInput.mcp_server_name = typed.mcp_server_name;
+        }
+    }
+    const result = {
+        type: 'user.tool_confirmation',
+        tool_use_id: eventId,
+        result: 'allow',
+    };
+    if (typed.session_thread_id) {
+        result.session_thread_id = typed.session_thread_id;
+    }
+    let g;
+    try {
+        g = resolveGate(opts.gate, 'confirmationForEvent()');
+    }
+    catch (err) {
+        result.result = 'deny';
+        result.deny_message = err instanceof Error ? `[Intutic Governance] BLOCKED: ${err.message}` : String(err);
+        return result;
+    }
+    try {
+        await g.guard(toolName, toolInput);
+    }
+    catch (err) {
+        result.result = 'deny';
+        result.deny_message = err instanceof IntuticGateRefusal ? err.message : crashMessage(err);
+    }
+    return result;
+}
+class IdleTimeout extends Error {
+    constructor() { super('watch(): stream idle'); }
+}
+/** 400–499 except 408 (timeout) and 429 (rate limit): a retry cannot help. */
+export function isFatal4xx(err) {
+    const status = err?.status;
+    return typeof status === 'number' && status >= 400 && status < 500 && status !== 408 && status !== 429;
+}
+function sleep(ms, signal) {
+    return new Promise((resolve) => {
+        const t = setTimeout(done, ms);
+        function done() { signal?.removeEventListener('abort', done); resolve(); }
+        signal?.addEventListener('abort', done, { once: true });
+    });
+}
+/** Yields the stream's events; throws IdleTimeout when none arrives within `ms`. */
+async function* withIdleTimeout(stream, ms, signal) {
+    const it = stream[Symbol.asyncIterator]();
+    try {
+        while (true) {
+            if (signal?.aborted)
+                return;
+            const next = it.next();
+            const result = ms === undefined
+                ? await next
+                : await Promise.race([
+                    next,
+                    new Promise((_, reject) => { const t = setTimeout(() => reject(new IdleTimeout()), ms); void next.finally(() => clearTimeout(t)); }),
+                ]);
+            if (result.done)
+                return;
+            yield result.value;
+        }
+    }
+    finally {
+        // Not awaited: after an idle timeout the generator is still suspended
+        // inside its own pending `next()`, and `return()` queues behind it — an
+        // await here would hang exactly as long as the dead stream does.
+        void Promise.resolve(it.return?.()).catch(() => undefined);
+    }
+}
+export class IntuticSessionConfirmer {
+    sessionId;
+    client;
+    gate;
+    /** Tool-call event ids already answered (by this instance), so a `poll()`
+     *  that overlaps a live `watch()` — or a re-delivered webhook — never
+     *  double-sends a confirmation for the same id. */
+    answered = new Set();
+    constructor(client, sessionId, opts = {}) {
+        this.client = client;
+        this.sessionId = sessionId;
+        this.gate = opts.gate;
+    }
+    noteConfirmationEvent(event) {
+        const toolUseId = eventField(event, 'tool_use_id');
+        if (typeof toolUseId === 'string' && toolUseId)
+            this.answered.add(toolUseId);
+    }
+    /** Answer one event if it needs an answer; returns the sent params, or
+     *  `null` if nothing was sent (already answered, or
+     *  {@link confirmationForEvent} returned `null` — see its doc). */
+    async handleEvent(event) {
+        const eventId = event.id;
+        if (!eventId || this.answered.has(eventId))
+            return null;
+        const confirmation = await confirmationForEvent(event, { gate: this.gate });
+        if (confirmation === null)
+            return null;
+        await this.client.beta.sessions.events.send(this.sessionId, { events: [confirmation] });
+        this.answered.add(eventId);
+        return confirmation;
+    }
+    /**
+     * List recent events and answer every unanswered
+     * `agent.tool_use`/`agent.mcp_tool_use` pause found. Returns the sent
+     * confirmations, in event order.
+     */
+    async poll(opts = {}) {
+        const sent = [];
+        const events = this.client.beta.sessions.events.list(this.sessionId, {
+            limit: opts.limit ?? 1000,
+            types: ['agent.tool_use', 'agent.mcp_tool_use', 'user.tool_confirmation'],
+        });
+        for await (const event of events) {
+            if (event.type === 'user.tool_confirmation') {
+                this.noteConfirmationEvent(event);
+                continue;
+            }
+            const confirmation = await this.handleEvent(event);
+            if (confirmation !== null)
+                sent.push(confirmation);
+        }
+        return sent;
+    }
+    /**
+     * Answer the pause a `session.requires_action` webhook signalled.
+     *
+     * `unwrapped` is what `client.beta.webhooks.unwrap(rawBody, { headers })`
+     * returns (or its `.data`, or a plain object of the same shape). Anything
+     * other than a `session.requires_action` payload is a no-op (`[]`): this
+     * module only ever answers tool-confirmation pauses, so every other
+     * webhook event type is intentionally ignored here.
+     *
+     * The webhook payload carries only the session id — it does NOT carry the
+     * tool call itself — so this always falls through to a {@link poll}.
+     */
+    async handleWebhook(unwrapped) {
+        const data = unwrapped.data ?? unwrapped;
+        if (data.type !== 'session.requires_action')
+            return [];
+        if (data.id !== undefined && data.id !== this.sessionId) {
+            throw new Error(`webhook session id ${JSON.stringify(data.id)} does not match this confirmer's ` +
+                `sessionId ${JSON.stringify(this.sessionId)}; construct a confirmer per session ` +
+                'rather than reusing one across sessions');
+        }
+        return this.poll();
+    }
+    /**
+     * Catch up on anything already pending, then follow the live event
+     * stream, yielding each confirmation as it is sent, reconnecting when the
+     * stream drops (TD-428).
+     *
+     * Modelled on the SDK's own `SessionToolRunner#streamLoop`: open the
+     * stream FIRST, then reconcile with `poll()` — an event emitted in the gap
+     * is buffered on the stream rather than lost, and `answered` dedups
+     * anything that shows up on both. On end or error the loop sleeps
+     * (backoff doubling from `backoffStartMs` to `backoffCapMs`, reset on any
+     * received event) and reopens. A fatal 4xx (anything 400–499 other than
+     * 408 and 429) rethrows: the session is gone or the key is wrong, and
+     * retrying would loop forever. `idleTimeoutMs` drops a stream that has
+     * gone silent and reopens it, which re-polls. Ends only on a terminal
+     * event, `signal` abort, or `maxReconnects` exhausted (unbounded by
+     * default, the SDK's own choice).
+     */
+    async *watch(opts = {}) {
+        const backoffStart = opts.backoffStartMs ?? 500;
+        const backoffCap = opts.backoffCapMs ?? 10_000;
+        const maxReconnects = opts.maxReconnects ?? Number.POSITIVE_INFINITY;
+        let backoff = backoffStart;
+        let reconnects = 0;
+        while (!opts.signal?.aborted) {
+            let terminal = false;
+            try {
+                const stream = await this.client.beta.sessions.events.stream(this.sessionId);
+                for (const confirmation of await this.poll())
+                    yield confirmation;
+                for await (const event of withIdleTimeout(stream, opts.idleTimeoutMs, opts.signal)) {
+                    backoff = backoffStart;
+                    if (TERMINAL_EVENT_TYPES.has(event.type)) {
+                        terminal = true;
+                        break;
+                    }
+                    if (event.type === 'user.tool_confirmation') {
+                        this.noteConfirmationEvent(event);
+                        continue;
+                    }
+                    const confirmation = await this.handleEvent(event);
+                    if (confirmation)
+                        yield confirmation;
+                }
+            }
+            catch (err) {
+                if (opts.signal?.aborted)
+                    return;
+                if (err instanceof IdleTimeout) {
+                    // fall through: reconnect and re-poll
+                }
+                else if (isFatal4xx(err)) {
+                    throw err;
+                }
+            }
+            if (terminal || opts.signal?.aborted)
+                return;
+            if (reconnects >= maxReconnects) {
+                throw new Error(`watch(): stream ended ${reconnects + 1} time(s) and maxReconnects (${maxReconnects}) is exhausted`);
+            }
+            reconnects += 1;
+            await sleep(backoff, opts.signal);
+            backoff = Math.min(backoff * 2, backoffCap);
+        }
+    }
+}
+const CUSTOM_TOOL_GUARDED = Symbol.for('intutic.gate.managedAgents.customToolGuarded');
+/**
+ * Wrap one Managed Agents custom tool (`BetaRunnableTool` shape) so
+ * `Gate.guard()` runs before `run()` executes.
+ *
+ * Returns a NEW object (a shallow copy with `run` replaced); does not mutate
+ * the one passed in. On refusal the wrapped `run()` THROWS
+ * `IntuticGateRefusal` before the real implementation ever runs — the same
+ * throw-based contract `wrapTool()` uses. Already-wrapped tools pass through
+ * unchanged.
+ */
+export function wrapManagedAgentsCustomTool(tool, opts = {}) {
+    const marked = tool;
+    if (marked[CUSTOM_TOOL_GUARDED] === true)
+        return tool;
+    const originalRun = tool.run;
+    const toolName = tool.name || 'tool';
+    const guardedRun = async (args, context) => {
+        const g = resolveGate(opts.gate, 'wrapManagedAgentsCustomTool()');
+        await g.guard(toolName, args ?? {});
+        return originalRun.call(tool, args, context);
+    };
+    const wrapped = { ...tool, run: guardedRun };
+    Object.defineProperty(wrapped, CUSTOM_TOOL_GUARDED, { value: true, enumerable: false });
+    return wrapped;
+}
+/** Wrap a collection of Managed Agents custom tools in one call — see
+ *  {@link wrapManagedAgentsCustomTool}. */
+export function wrapManagedAgentsCustomTools(tools, opts = {}) {
+    return tools.map((t) => wrapManagedAgentsCustomTool(t, opts));
+}
+//# sourceMappingURL=managedAgents.js.map

package/dist/managedAgents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managedAgents.js","sourceRoot":"","sources":["../src/managedAgents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqIG;AAEH,OAAO,EAAQ,MAAM,IAAI,UAAU,EAAE,MAAM,WAAW,CAAA;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,8EAA8E;AAC9E,0EAA0E;AAC1E,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,iBAAiB;AACjB,8EAA8E;AAE9E;;;yBAGyB;AACzB,MAAM,CAAC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AA8E9D,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC,CAAA;AACtG,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,2BAA2B,EAAE,iBAAiB,CAAC,CAAC,CAAA;AAE3G;;;4CAG4C;AAC5C,SAAS,UAAU,CAAC,KAAoC,EAAE,GAAW;IACnE,OAAQ,KAA4C,CAAC,GAAG,CAAC,CAAA;AAC3D,CAAC;AAOD,SAAS,WAAW,CAAC,QAA0B,EAAE,IAAY;IAC3D,MAAM,CAAC,GAAG,QAAQ,IAAI,UAAU,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,eAAe,IAAI,uCAAuC,CAC7D,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAC/D,OAAO,+CAA+C,MAAM,8DAA8D,CAAA;AAC5H,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAoC,EACpC,OAAiC,EAAE;IAEnC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAEzD,MAAM,KAAK,GAAG,KAAyD,CAAA;IACvE,MAAM,UAAU,GAAG,KAAK,CAAC,oBAAoB,IAAI,IAAI,CAAA;IACrD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IAEvF,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAA;IACxB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAA;IACrC,MAAM,SAAS,GAAc,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;IAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACjE,IAAI,CAAC,CAAC,iBAAiB,IAAI,SAAS,CAAC,EAAE,CAAC;YACtC,SAAS,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAA;QACnD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA+B;QACzC,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,OAAO;QACpB,MAAM,EAAE,OAAO;KAChB,CAAA;IACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,CAAC,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,CAAA;IACpD,CAAC;IAED,IAAI,CAAO,CAAA;IACX,IAAI,CAAC;QACH,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;QACtB,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,iCAAiC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACzG,OAAO,MAAM,CAAA;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,GAAG,MAAM,CAAA;QACtB,MAAM,CAAC,YAAY,GAAG,GAAG,YAAY,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;IAC3F,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AA0DD,MAAM,WAAY,SAAQ,KAAK;IAC7B,gBAAgB,KAAK,CAAC,sBAAsB,CAAC,CAAA,CAAC,CAAC;CAChD;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,MAAM,MAAM,GAAI,GAAmC,EAAE,MAAM,CAAA;IAC3D,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAA;AACxG,CAAC;AAED,SAAS,KAAK,CAAC,EAAU,EAAE,MAAoB;IAC7C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAC9B,SAAS,IAAI,KAAK,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAA,CAAC,CAAC;QACzE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,oFAAoF;AACpF,KAAK,SAAS,CAAC,CAAC,eAAe,CAAI,MAAwB,EAAE,EAAsB,EAAE,MAAoB;IACvG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAA;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAM;YAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAA;YACtB,MAAM,MAAM,GAAG,EAAE,KAAK,SAAS;gBAC7B,CAAC,CAAC,MAAM,IAAI;gBACZ,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC;oBACjB,IAAI;oBACJ,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;iBAC3I,CAAC,CAAA;YACN,IAAI,MAAM,CAAC,IAAI;gBAAE,OAAM;YACvB,MAAM,MAAM,CAAC,KAAK,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,sEAAsE;QACtE,wEAAwE;QACxE,iEAAiE;QACjE,KAAK,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,MAAM,OAAO,uBAAuB;IACzB,SAAS,CAAQ;IACT,MAAM,CAAyB;IAC/B,IAAI,CAAkB;IACvC;;uDAEmD;IAClC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAE7C,YAAY,MAA+B,EAAE,SAAiB,EAAE,OAAiC,EAAE;QACjG,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;IACvB,CAAC;IAEO,qBAAqB,CAAC,KAAoC;QAChE,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;QAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC9E,CAAC;IAED;;uEAEmE;IACnE,KAAK,CAAC,WAAW,CAAC,KAAoC;QACpD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAA;QACxB,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAA;QACvD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC3E,IAAI,YAAY,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACtC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;QACvF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC1B,OAAO,YAAY,CAAA;IACrB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,OAA2B,EAAE;QACtC,MAAM,IAAI,GAAiC,EAAE,CAAA;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;YACnE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YACzB,KAAK,EAAE,CAAC,gBAAgB,EAAE,oBAAoB,EAAE,wBAAwB,CAAC;SAC1E,CAAC,CAAA;QACF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;gBAC5C,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;gBACjC,SAAQ;YACV,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAClD,IAAI,YAAY,KAAK,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,SAAgF;QAGlG,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAA;QACxC,IAAI,IAAI,CAAC,IAAI,KAAK,yBAAyB;YAAE,OAAO,EAAE,CAAA;QACtD,IAAI,IAAI,CAAC,EAAE,KAAK,SAAS,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,mCAAmC;gBAC9E,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,sCAAsC;gBACjF,yCAAyC,CAC5C,CAAA;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,EAAE,CAAA;IACpB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,CAAC,KAAK,CAAC,OAAqB,EAAE;QAClC,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,IAAI,GAAG,CAAA;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAA;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,CAAA;QACpE,IAAI,OAAO,GAAG,YAAY,CAAA;QAC1B,IAAI,UAAU,GAAG,CAAC,CAAA;QAClB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,IAAI,QAAQ,GAAG,KAAK,CAAA;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAC5E,KAAK,MAAM,YAAY,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE;oBAAE,MAAM,YAAY,CAAA;gBAChE,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnF,OAAO,GAAG,YAAY,CAAA;oBACtB,IAAI,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBAAC,QAAQ,GAAG,IAAI,CAAC;wBAAC,MAAK;oBAAC,CAAC;oBACpE,IAAI,KAAK,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;wBAC5C,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAA;wBACjC,SAAQ;oBACV,CAAC;oBACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBAClD,IAAI,YAAY;wBAAE,MAAM,YAAY,CAAA;gBACtC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;oBAAE,OAAM;gBAChC,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;oBAC/B,sCAAsC;gBACxC,CAAC;qBAAM,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,GAAG,CAAA;gBACX,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAM;YAC5C,IAAI,UAAU,IAAI,aAAa,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,yBAAyB,UAAU,GAAG,CAAC,+BAA+B,aAAa,gBAAgB,CAAC,CAAA;YACtH,CAAC;YACD,UAAU,IAAI,CAAC,CAAA;YACf,MAAM,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACjC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,UAAU,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;CACF;AAeD,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAA;AAEtF;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAO,EACP,OAAiC,EAAE;IAEnC,MAAM,MAAM,GAAG,IAAmC,CAAA;IAClD,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAErD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAA;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAA;IACpC,MAAM,UAAU,GAAG,KAAK,EAAE,IAA6B,EAAE,OAAiB,EAAE,EAAE;QAC5E,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,CAAC,CAAA;QACjE,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAA;QACnC,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC,CAAA;IAED,MAAM,OAAO,GAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,CAAA;IAC/C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,mBAAmB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;2CAC2C;AAC3C,MAAM,UAAU,4BAA4B,CAC1C,KAAmB,EACnB,OAAiC,EAAE;IAEnC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AAC/D,CAAC"}

package/dist/mastra.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Mastra adapter: `intuticHooks()`.
+ *
+ * `@intutic/gate/mastra` — a framework-specific specialization of the same
+ * idea `wrapTools.ts` implements generically (see that file's module doc):
+ * wrap the framework's own veto point around this package's `Gate.guard()`,
+ * throwing/vetoing before the real tool body ever runs.
+ *
+ * Mastra (`@mastra/core`) exposes a documented pre-execution veto point: an
+ * `Agent`'s `hooks.beforeToolCall`. It runs for every tool in the agent's
+ * assembled tool dictionary — natively defined tools AND MCP-sourced tools
+ * registered through `@mastra/mcp`, since both are merged into the same
+ * `CoreTool` record before hook-wrapping happens (`wrapToolsWithHooks`
+ * operates generically over `Object.entries(tools)`, with no source-specific
+ * branch). Returning `{ proceed: false, output }` from `beforeToolCall` skips
+ * the tool's real `execute` entirely and hands `output` back to the model IN
+ * PLACE OF the tool's result.
+ *
+ * ## Confirmed against a real install
+ *
+ * `@mastra/core@1.59.0` was installed in a scratch directory and its shipped
+ * `.d.ts`/compiled source read directly (not inferred from docs alone):
+ *
+ * `dist/tools/types.d.ts`:
+ * ```ts
+ * export interface ToolHookContext<TInput, TContext, TMetadata> {
+ *   toolName: string
+ *   input: TInput
+ *   context: TContext
+ *   metadata?: TMetadata
+ * }
+ * export interface ToolBeforeHookResult<TOutput> {
+ *   proceed: false
+ *   output: TOutput
+ * }
+ * export interface ToolHooks<TInput, TOutput, TContext, TMetadata> {
+ *   beforeToolCall?: (context: ToolHookContext<TInput, TContext, TMetadata>) =>
+ *     void | ToolBeforeHookResult<TOutput> | Promise<void | ToolBeforeHookResult<TOutput>>
+ *   afterToolCall?: (context: ToolAfterHookContext<...>) => void | Promise<void>
+ * }
+ * ```
+ * `void`/`undefined` means "proceed" (allow); only an explicit
+ * `{ proceed: false, output }` vetoes — this adapter's `beforeToolCall`
+ * therefore returns `undefined` on allow, matching the framework's own
+ * "no opinion" contract rather than a synthetic allow value.
+ *
+ * `dist/agent-CKAVuxKN.js`'s `wrapToolWithHooks` (the actual wrapping the
+ * `.d.ts` above only declares the shape of) confirms the consumption side:
+ * ```js
+ * const beforeResult = await hooks.beforeToolCall?.(hookContext)
+ * if (beforeResult?.proceed === false) return beforeResult.output
+ * ```
+ * `output` is returned AS the tool's own `execute` return value at this
+ * layer, with no schema check performed by the hook wrapper itself — but a
+ * tool with a strict Zod `outputSchema` may still validate/reject that value
+ * further downstream, and `beforeToolCall` is never told what that schema
+ * is (the hook context carries no `outputSchema`/tool-definition reference).
+ * This adapter therefore cannot GUARANTEE a schema-conformant denial payload
+ * for an arbitrary tool; see {@link IntuticHooksOptions.denialOutput} to
+ * shape it per your own tools when the generic default will not validate.
+ *
+ * ## TAMPER NOTE — per-call hooks OVERRIDE agent-level hooks, they do not merge
+ *
+ * Also confirmed against the same install — `dist/agent.d.ts`'s
+ * `getConfiguredToolHooks()` doc comment:
+ *
+ * > Run-level hooks override these via {@link resolveToolHooks}, so callers
+ * > that need to preserve the configured hooks must read and compose them
+ * > explicitly.
+ *
+ * Concretely: `new Agent({ hooks: intuticHooks() })` installs this gate at
+ * the agent level, but ANY caller of `.generate()`/`.stream()` who passes
+ * their own `hooks` option — even `{}`, or a `hooks` object with no
+ * `beforeToolCall` — REPLACES the agent-level hooks wholesale for that call.
+ * This gate silently does not run: no error, no warning, just an unguarded
+ * tool call. This is Mastra's own documented behaviour, not a defect this
+ * package can work around from outside the framework — there is no hook
+ * inheritance or merge to opt into. See `gateRegistry.ts`'s `mastra` row for
+ * the same note surfaced to the registry, and
+ * `apps/docs/integrations/mastra.md` for the operator-facing version.
+ *
+ * If your application passes call-level `hooks` anywhere, compose this
+ * gate's `beforeToolCall` into that call's hooks yourself:
+ *
+ * ```ts
+ * const intutic = intuticHooks()
+ * await agent.generate(prompt, {
+ *   hooks: {
+ *     beforeToolCall: async (ctx) => {
+ *       const denied = await intutic.beforeToolCall(ctx)
+ *       if (denied) return denied
+ *       return myOwnBeforeToolCall(ctx)
+ *     },
+ *   },
+ * })
+ * ```
+ */
+import { type Gate } from './gate.js';
+import { IntuticGateRefusal } from './errors.js';
+/** Structural copy of `@mastra/core`'s `ToolHookContext` — this package does
+ *  not depend on `@mastra/core` at runtime, so the shape is declared here
+ *  rather than imported. Confirmed field-for-field against
+ *  `@mastra/core@1.59.0`'s `dist/tools/types.d.ts` (see module doc). */
+export interface MastraToolHookContext {
+    /** The name exposed to the model for this tool call. */
+    toolName: string;
+    /** Input passed to the tool — this is what `Gate.guard()` evaluates. */
+    input: unknown;
+    /** Execution context passed to the tool. Not read by this adapter. */
+    context?: unknown;
+    /** Optional adapter-specific metadata (e.g. `agentId`/`agentName`). */
+    metadata?: Record<string, unknown>;
+}
+/** Structural copy of `@mastra/core`'s `ToolBeforeHookResult`. */
+export interface MastraToolBeforeHookResult {
+    proceed: false;
+    output: unknown;
+}
+/** Structural copy of `@mastra/core`'s `ToolHooks['beforeToolCall']` — the
+ *  slice of the real type this adapter implements. Assignable directly to
+ *  `Agent`'s `hooks` constructor option. */
+export type MastraBeforeToolCall = (context: MastraToolHookContext) => Promise<void | MastraToolBeforeHookResult>;
+export interface IntuticHooksOptions {
+    /** Overrides the process-wide installed gate (`install(new Gate(...))`). */
+    gate?: Gate;
+    /**
+     * Shapes the `output` handed back to the model on a refusal. The default
+     * produces `{ error: true, message, code, incidentId? }` — reasonable for
+     * an unstructured/text-ish tool output, but NOT guaranteed to satisfy an
+     * arbitrary tool's own Zod `outputSchema` (this hook is never told what
+     * that schema is — see the module doc's "Confirmed against a real
+     * install" section). Supply this when your tools declare strict output
+     * schemas the default shape would fail.
+     */
+    denialOutput?: (ctx: {
+        toolName: string;
+        refusal: IntuticGateRefusal;
+    }) => unknown;
+}
+/**
+ * Builds a `{ beforeToolCall }` object shaped for direct use in `@mastra/core`'s
+ * `Agent` constructor's `hooks` option:
+ *
+ * ```ts
+ * import { Agent } from '@mastra/core/agent'
+ * import { Gate, install } from '@intutic/gate'
+ * import { intuticHooks } from '@intutic/gate/mastra'
+ *
+ * install(new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }))
+ *
+ * const agent = new Agent({
+ *   id: 'my-agent',
+ *   name: 'My Agent',
+ *   model: 'openai/gpt-5-mini',
+ *   tools: { deleteTool },
+ *   hooks: intuticHooks(),
+ * })
+ * ```
+ *
+ * On refusal, returns `{ proceed: false, output }` — the real tool body
+ * never runs. On allow, returns `undefined`, Mastra's own "no opinion"
+ * value, so the real `execute` runs untouched.
+ *
+ * Requires a `Gate` — either passed via `{ gate }` here, or installed
+ * process-wide with `install(new Gate(...))`. A call with neither throws
+ * (via the underlying `beforeToolCall`), refusing to run tools unguarded
+ * rather than silently skipping enforcement — same posture as `wrapTool`.
+ *
+ * See the module doc's TAMPER NOTE: this only governs calls that do not
+ * override `hooks` at the `.generate()`/`.stream()` call site.
+ */
+export declare function intuticHooks(opts?: IntuticHooksOptions): {
+    beforeToolCall: MastraBeforeToolCall;
+};
+//# sourceMappingURL=mastra.d.ts.map

package/dist/mastra.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mastra.d.ts","sourceRoot":"","sources":["../src/mastra.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgGG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD;;;wEAGwE;AACxE,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAA;IAChB,wEAAwE;IACxE,KAAK,EAAE,OAAO,CAAA;IACd,sEAAsE;IACtE,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAED,kEAAkE;AAClE,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,KAAK,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;CAChB;AAED;;4CAE4C;AAC5C,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,qBAAqB,KAC3B,OAAO,CAAC,IAAI,GAAG,0BAA0B,CAAC,CAAA;AAE/C,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;;;;;;;OAQG;IACH,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,kBAAkB,CAAA;KAAE,KAAK,OAAO,CAAA;CACnF;AAWD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG;IAAE,cAAc,EAAE,oBAAoB,CAAA;CAAE,CAuBrG"}