@intutic/gate 1.10.1

package/dist/workflow.js

@@ -0,0 +1,254 @@
+/**
+ * `@ai-sdk/workflow` adapter: `intuticNeedsApproval()`, `withIntuticApproval()`,
+ * `wrapWorkflowTools()`, and the FatalError-compatible `IntuticWorkflowRefusal`.
+ *
+ * `@intutic/gate/workflow` — the same idea `vercel.ts` implements for the base
+ * `ai` package (wrap the framework's own veto point around this package's
+ * `Gate.guard()`), reshaped for Vercel's DURABLE workflow-agent runtime, where
+ * two facts change the adapter's whole design:
+ *
+ * ## 1. The veto surface is per-tool `needsApproval`, not an agent option
+ *
+ * Confirmed against a real install (`@ai-sdk/workflow@1.0.69`):
+ * `WorkflowAgent`/`WorkflowAgentOptions` carry ZERO approval fields — the
+ * string `toolApproval` does not appear anywhere in the package's shipped
+ * `.d.ts`. The veto surface is `needsApproval` (boolean | function) on the
+ * TOOL definition, exactly as the framework's own workflow-agent docs
+ * describe under "Tool Approval". The compiled agent loop confirms the
+ * semantics (dist/index.js): `needsApproval == null` → no approval; a
+ * boolean is used directly; a function is awaited as
+ * `needsApproval(input, { toolCallId, messages, context })`. A call needing
+ * approval pauses DURABLY — the run suspends and a human can approve hours
+ * later — so this framework, uniquely in this package, has a real
+ * human-in-the-loop lane for the gate to route into.
+ *
+ * (`ai@7.0.68` marks tool-level `needsApproval` `@deprecated` in favour of
+ * generateText-level `toolApproval` — but `@ai-sdk/workflow`'s OWN agent loop
+ * reads the tool-level field and exposes no other veto surface, so it is the
+ * correct — indeed the only — integration point here. Noted in the TD entry
+ * this phase filed, so a future @ai-sdk/workflow release moving to the
+ * generateText-shaped surface gets caught rather than silently ungated.)
+ *
+ * ## 2. Denials must not be retried — refusals here are FatalError-compatible
+ *
+ * A durable workflow retries failed steps. Confirmed against real installs
+ * (`workflow@4.8.3` re-exporting `@workflow/errors@4.2.1` via
+ * `@workflow/core`): the runtime's retry/abort decision consults
+ * `FatalError.is(err)` (`@workflow/core`'s `runtime/step-handler.js` — a
+ * fatal error "bubbl[es] up to parent workflow"; anything else is retried
+ * toward `maxAttempts`), and `FatalError.is()` DUCK-TYPES: it checks
+ * `err.name === 'FatalError'` on any Error-shaped object, precisely because
+ * workflows execute in a separate `vm` realm where `instanceof` fails across
+ * the boundary. A plain `IntuticGateRefusal` thrown from `needsApproval` or a
+ * tool body would therefore be RETRIED — a governance denial replayed on a
+ * timer until max attempts, burning the run to reach the same refusal. So
+ * this adapter's refusals are {@link IntuticWorkflowRefusal}: still an
+ * `IntuticGateRefusal` (`instanceof` works in-realm, `.reason`/`.code`/
+ * `.incidentId` intact, message still `[Intutic Governance] BLOCKED: ...`)
+ * but with `name = 'FatalError'` so the real runtime's duck-check aborts
+ * instead of retry-looping. `__tests__/workflow.test.ts` pins this against
+ * the REAL `FatalError.is` from the `workflow` package, not a re-derivation.
+ *
+ * Deliberately asymmetric: a NON-refusal crash inside `Gate.guard()` (a
+ * transient network failure in a remote tier, an unexpected bug) is re-thrown
+ * UNTOUCHED — retryable, which is the durable runtime's correct response to a
+ * transient failure. Only a real governance verdict (and the fail-closed
+ * "no gate configured" case, which is deterministic and would fail every
+ * retry identically) is made fatal.
+ *
+ * @module
+ */
+import { active as activeGate } from './gate.js';
+import { IntuticGateRefusal } from './errors.js';
+import { wrapTools } from './wrapTools.js';
+/**
+ * A refused call inside a durable workflow.
+ *
+ * `name` is `'FatalError'` — NOT `'IntuticGateRefusal'` — on purpose: the
+ * workflow runtime's `FatalError.is()` duck-types on that exact string (see
+ * module doc), and it is the only cross-VM-realm-safe way to tell the runtime
+ * "abort, do not retry". Everything else about the refusal contract is
+ * preserved: `instanceof IntuticGateRefusal` still holds (same realm),
+ * `.message` still carries the `[Intutic Governance] BLOCKED:` prefix, and
+ * `.reason`/`.code`/`.incidentId` carry the structured verdict. `fatal: true`
+ * mirrors the property the real `FatalError` class sets, for code that
+ * checks the flag rather than the name.
+ */
+export class IntuticWorkflowRefusal extends IntuticGateRefusal {
+    fatal = true;
+    constructor(reason, code, incidentId) {
+        super(reason, code, incidentId);
+        this.name = 'FatalError';
+    }
+    /** Rewrap a core refusal so the durable runtime treats it as fatal. */
+    static from(refusal) {
+        return new IntuticWorkflowRefusal(refusal.reason, refusal.code, refusal.incidentId);
+    }
+    /**
+     * Cross-realm-safe detection (the same trick `FatalError.is` itself uses):
+     * `instanceof` fails across the workflow `vm` boundary, so this checks the
+     * duck-typed name plus this package's own message prefix.
+     */
+    static is(value) {
+        return (typeof value === 'object' &&
+            value !== null &&
+            value.name === 'FatalError' &&
+            typeof value.message === 'string' &&
+            (value.message.startsWith('[Intutic Governance] BLOCKED:')));
+    }
+}
+function requireGate(gate, helper) {
+    const g = gate ?? activeGate();
+    if (g === null) {
+        // FatalError-compatible on purpose: "no gate configured" is
+        // deterministic — a durable retry would fail identically every attempt,
+        // so burning the step's retry budget on it helps nobody. Fail closed,
+        // once, loudly.
+        throw new IntuticWorkflowRefusal(`No gate configured: call install(new Gate(...)) from @intutic/gate, or pass { gate } to ${helper}. ` +
+            'Refusing to run the tool unguarded.', 'NO_GATE');
+    }
+    return g;
+}
+function renderWorkflowToolInput(input) {
+    if (input !== null && typeof input === 'object' && !Array.isArray(input)) {
+        return input;
+    }
+    return { args: [input] };
+}
+/**
+ * Build an async `needsApproval` function for ONE workflow tool:
+ *
+ * ```ts
+ * import { WorkflowAgent } from '@ai-sdk/workflow'
+ * import { Gate, install } from '@intutic/gate'
+ * import { intuticNeedsApproval } from '@intutic/gate/workflow'
+ *
+ * install(new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }))
+ *
+ * const agent = new WorkflowAgent({
+ *   model,
+ *   tools: {
+ *     deployService: {
+ *       description: '...',
+ *       inputSchema,
+ *       execute: deployStep,
+ *       needsApproval: intuticNeedsApproval('deployService'),
+ *     },
+ *   },
+ * })
+ * ```
+ *
+ * The tool name is a parameter because the framework's `needsApproval`
+ * signature does not carry it — `(input, { toolCallId, messages, context })`
+ * has no `toolName` field (confirmed against the shipped types). Use
+ * {@link withIntuticApproval} to attach this to a whole tools record without
+ * hand-repeating each name.
+ *
+ * Verdict mapping: BLOCK → throws {@link IntuticWorkflowRefusal} (fatal —
+ * aborts instead of retry-looping; see module doc); ALLOW → `false` or `true`
+ * per `onAllow`. A non-refusal crash in the gate is re-thrown untouched
+ * (retryable — correct for transients).
+ */
+export function intuticNeedsApproval(toolName, opts = {}) {
+    const onAllow = opts.onAllow ?? 'auto';
+    return async (input, _options) => {
+        const g = requireGate(opts.gate, 'intuticNeedsApproval()');
+        try {
+            await g.guard(toolName, renderWorkflowToolInput(input));
+        }
+        catch (exc) {
+            if (exc instanceof IntuticGateRefusal && !(exc instanceof IntuticWorkflowRefusal)) {
+                throw IntuticWorkflowRefusal.from(exc);
+            }
+            throw exc;
+        }
+        return onAllow === 'human';
+    };
+}
+/**
+ * Attach the Intutic gate to every tool in a record, composing with any
+ * `needsApproval` the tool already declares:
+ *
+ * ```ts
+ * const agent = new WorkflowAgent({ model, tools: withIntuticApproval(tools) })
+ * ```
+ *
+ * For each tool (the record KEY is the tool name reported to the gate — the
+ * same identity the framework itself dispatches on):
+ *
+ *   1. `Gate.guard()` runs first. BLOCK throws {@link IntuticWorkflowRefusal}.
+ *   2. On allow, the tool's OWN prior `needsApproval` still applies: a
+ *      boolean is returned as-is; a function is awaited with the original
+ *      arguments; a tool with none falls back to `onAllow` ('auto' → false).
+ *
+ * So a tool that already said "always ask a human" (`needsApproval: true`)
+ * keeps asking a human — this gate only ADDS the ability to refuse outright,
+ * it never removes an approval pause the caller had configured.
+ *
+ * Returns a NEW record of NEW tool objects (shallow copies); the input record
+ * and its tools are not mutated.
+ */
+export function withIntuticApproval(tools, opts = {}) {
+    const out = {};
+    for (const [name, tool] of Object.entries(tools)) {
+        const prior = tool.needsApproval;
+        const gateApproval = intuticNeedsApproval(name, opts);
+        const composed = async (input, options) => {
+            const gateSaysHuman = await gateApproval(input, options);
+            if (typeof prior === 'boolean')
+                return prior || gateSaysHuman;
+            if (typeof prior === 'function') {
+                const priorResult = await prior(input, options);
+                return Boolean(priorResult) || gateSaysHuman;
+            }
+            return gateSaysHuman;
+        };
+        out[name] = { ...tool, needsApproval: composed };
+    }
+    return out;
+}
+/**
+ * `wrapTools` for durable workflow tool definitions — the same generic
+ * execute-wrapping `wrapTools.ts` provides (gate first, then the real body),
+ * with ONE workflow-specific change: a refusal thrown out of the wrapped
+ * `execute` is rewrapped as {@link IntuticWorkflowRefusal}, because a
+ * workflow tool's `execute` is a durable STEP and a step that throws a
+ * non-fatal error is retried (see module doc). Everything else — including
+ * "no gate configured" handling and the record-key-is-tool-name convention —
+ * is `wrapTools`'s own behaviour, reused rather than reimplemented.
+ *
+ * Prefer {@link withIntuticApproval} as the primary integration: it uses the
+ * framework's own pre-execution veto surface, refuses BEFORE the durable
+ * step ever starts, and keeps the human-approval lane available. This
+ * execute-level wrapper is defense in depth (or the option for callers whose
+ * tools are shared with non-workflow code paths); running both double-guards
+ * the call, which is harmless but emits duplicate gate telemetry.
+ */
+export function wrapWorkflowTools(tools, gate) {
+    const wrapped = wrapTools(tools, gate);
+    const out = {};
+    for (const [name, tool] of Object.entries(wrapped)) {
+        if (typeof tool === 'function') {
+            out[name] = fatalize(tool);
+        }
+        else {
+            out[name] = { ...tool, execute: fatalize(tool.execute) };
+        }
+    }
+    return out;
+}
+function fatalize(fn) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return async (...args) => {
+        try {
+            return await fn(...args);
+        }
+        catch (exc) {
+            if (exc instanceof IntuticGateRefusal && !(exc instanceof IntuticWorkflowRefusal)) {
+                throw IntuticWorkflowRefusal.from(exc);
+            }
+            throw exc;
+        }
+    };
+}
+//# sourceMappingURL=workflow.js.map

package/dist/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAA6B,MAAM,WAAW,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAE,SAAS,EAAmC,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,sBAAuB,SAAQ,kBAAkB;IAC5C,KAAK,GAAG,IAAa,CAAA;IACrC,YAAY,MAAc,EAAE,IAAY,EAAE,UAAmB;QAC3D,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAA;IAC1B,CAAC;IAED,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAA2B;QACrC,OAAO,IAAI,sBAAsB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACrF,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAc;QACtB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACb,KAA4B,CAAC,IAAI,KAAK,YAAY;YACnD,OAAQ,KAA+B,CAAC,OAAO,KAAK,QAAQ;YAC5D,CAAE,KAA6B,CAAC,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC,CAAC,CACrF,CAAA;IACH,CAAC;CACF;AA4CD,SAAS,WAAW,CAAC,IAAsB,EAAE,MAAc;IACzD,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAA;IAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,4DAA4D;QAC5D,wEAAwE;QACxE,sEAAsE;QACtE,gBAAgB;QAChB,MAAM,IAAI,sBAAsB,CAC9B,2FAA2F,MAAM,IAAI;YACnG,qCAAqC,EACvC,SAAS,CACV,CAAA;IACH,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAkB,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,OAAoC,EAAE;IAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAA;IACtC,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAC/B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAA;QAC1D,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QACD,OAAO,OAAO,KAAK,OAAO,CAAA;IAC5B,CAAC,CAAA;AACH,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAQ,EACR,OAAoC,EAAE;IAEtC,MAAM,GAAG,GAAqC,EAAE,CAAA;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAA;QAChC,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACrD,MAAM,QAAQ,GAA0B,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/D,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;YACxD,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,OAAO,KAAK,IAAI,aAAa,CAAA;YAC7D,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,MAAO,KAA6C,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;gBACxF,OAAO,OAAO,CAAC,WAAW,CAAC,IAAI,aAAa,CAAA;YAC9C,CAAC;YACD,OAAO,aAAa,CAAA;QACtB,CAAC,CAAA;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAwB,EACxB,IAAW;IAEX,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IACtC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAM,CAAA;QACjC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAI,IAAuB,EAAE,OAAO,EAAE,QAAQ,CAAE,IAAuB,CAAC,OAAO,CAAC,EAAO,CAAA;QACvG,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAS;IACzB,8DAA8D;IAC9D,OAAO,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC,EAAE,CAAC;gBAClF,MAAM,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACxC,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/wrapTools.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Generic tool-wrapping helper.
+ *
+ * The JS/TS analogue of `guard`/`guard_tools` in
+ * `packages/intutic-clawde/intutic_clawde/gate/framework.py`, reshaped for
+ * how JS agent frameworks actually define a "tool": either
+ *
+ *   * a plain async function `(input) => result`, or
+ *   * an object carrying an `execute(input) => result` method alongside
+ *     framework metadata (`{ description, parameters, execute }` — the
+ *     Vercel AI SDK / Mastra shape; LangChain.js `DynamicStructuredTool`
+ *     and `tool()`-created tools carry the same `execute`/`func` contract
+ *     closely enough that this shape covers them too).
+ *
+ * This is the helper any JS framework WITHOUT a dedicated `@intutic/gate/*`
+ * adapter (notably LangChain.js, until a sibling phase ships one) uses to get
+ * gated: wrap each tool with {@link wrapTool} (or a whole collection with
+ * {@link wrapTools}) before handing it to the framework's agent/executor.
+ *
+ * On deny, the wrapped tool's `execute`/call THROWS `IntuticGateRefusal`
+ * (see `errors.ts`) before the real implementation ever runs — this
+ * package's throw-based refusal contract, not a return-value one. On allow,
+ * the real implementation runs and its return value passes through
+ * untouched.
+ *
+ * Requires a `Gate` — either passed explicitly via `{ gate }`, or installed
+ * process-wide with `install(new Gate(...))` from `gate.ts`. Calling a
+ * wrapped tool with neither throws, refusing to run the tool unguarded
+ * rather than silently skipping enforcement.
+ */
+import { type Gate } from './gate.js';
+export type AnyFn = (...args: any[]) => any;
+export interface ExecutableTool {
+    execute: AnyFn;
+    name?: string;
+    [key: string]: unknown;
+}
+export interface WrapToolOptions {
+    /** Tool name reported to the gate. Defaults to the function's own `.name`
+     *  (or the tool object's `.name`), then falls back to `"tool"`. */
+    name?: string;
+    /** Overrides the process-wide installed gate for this tool only. */
+    gate?: Gate;
+}
+/**
+ * Wrap a single tool — a plain async function, or a `{ execute, ... }`
+ * object — so `Gate.guard()` runs before the real implementation.
+ *
+ * The object form returns a NEW object (a shallow copy with `execute`
+ * replaced); it does not mutate the one passed in, since the frameworks this
+ * targets tend to hand out tool definitions that are re-used or frozen.
+ * Already-wrapped functions/objects pass through unchanged, so wrapping the
+ * same tool twice does not double-gate it.
+ */
+export declare function wrapTool<T extends AnyFn>(fn: T, opts?: WrapToolOptions): T;
+export declare function wrapTool<T extends ExecutableTool>(tool: T, opts?: WrapToolOptions): T;
+/**
+ * Wrap a collection of tools in one call.
+ *
+ * Accepts either an array (tool name comes from each tool's own `.name`/
+ * function name) or a record keyed by tool name (the Vercel AI SDK / Mastra
+ * `tools: { myTool: {...} }` shape) — in the record form the KEY is always
+ * the name reported to the gate, since that is the identity the framework
+ * itself uses to invoke the tool.
+ */
+export declare function wrapTools<T extends AnyFn | ExecutableTool>(tools: readonly T[], gate?: Gate): T[];
+export declare function wrapTools<T extends AnyFn | ExecutableTool>(tools: Record<string, T>, gate?: Gate): Record<string, T>;
+//# sourceMappingURL=wrapTools.d.ts.map

package/dist/wrapTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapTools.d.ts","sourceRoot":"","sources":["../src/wrapTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAG3D,MAAM,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;AAE3C,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,KAAK,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B;uEACmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oEAAoE;IACpE,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAgDD;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAA;AAC3E,wBAAgB,QAAQ,CAAC,CAAC,SAAS,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,eAAe,GAAG,CAAC,CAAA;AAgBtF;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,CAAA;AAClG,wBAAgB,SAAS,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EACxD,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA"}

package/dist/wrapTools.js

@@ -0,0 +1,95 @@
+/**
+ * Generic tool-wrapping helper.
+ *
+ * The JS/TS analogue of `guard`/`guard_tools` in
+ * `packages/intutic-clawde/intutic_clawde/gate/framework.py`, reshaped for
+ * how JS agent frameworks actually define a "tool": either
+ *
+ *   * a plain async function `(input) => result`, or
+ *   * an object carrying an `execute(input) => result` method alongside
+ *     framework metadata (`{ description, parameters, execute }` — the
+ *     Vercel AI SDK / Mastra shape; LangChain.js `DynamicStructuredTool`
+ *     and `tool()`-created tools carry the same `execute`/`func` contract
+ *     closely enough that this shape covers them too).
+ *
+ * This is the helper any JS framework WITHOUT a dedicated `@intutic/gate/*`
+ * adapter (notably LangChain.js, until a sibling phase ships one) uses to get
+ * gated: wrap each tool with {@link wrapTool} (or a whole collection with
+ * {@link wrapTools}) before handing it to the framework's agent/executor.
+ *
+ * On deny, the wrapped tool's `execute`/call THROWS `IntuticGateRefusal`
+ * (see `errors.ts`) before the real implementation ever runs — this
+ * package's throw-based refusal contract, not a return-value one. On allow,
+ * the real implementation runs and its return value passes through
+ * untouched.
+ *
+ * Requires a `Gate` — either passed explicitly via `{ gate }`, or installed
+ * process-wide with `install(new Gate(...))` from `gate.ts`. Calling a
+ * wrapped tool with neither throws, refusing to run the tool unguarded
+ * rather than silently skipping enforcement.
+ */
+import { active as activeGate } from './gate.js';
+const GUARDED = Symbol.for('intutic.gate.guarded');
+function isGuarded(fn) {
+    return fn[GUARDED] === true;
+}
+/**
+ * Render a call's arguments as the `tool_input` object the gate evaluates.
+ *
+ * Every JS agent-framework tool signature this package targets calls
+ * `execute` with the arguments object as the first positional parameter
+ * (`execute(input)`, `execute(input, context)`, `_call(input)`, `func(input)`
+ * ...), so the first argument — when it is a plain object — IS the tool
+ * input. A call shaped some other way (positional scalars, no arguments)
+ * falls back to `{ args: [...] }` so the gate still sees something to
+ * evaluate rather than throwing on a signature it does not recognise.
+ */
+function renderToolInput(args) {
+    const [first] = args;
+    if (first !== null && typeof first === 'object' && !Array.isArray(first)) {
+        return first;
+    }
+    return { args };
+}
+function wrapFn(fn, toolName, gate) {
+    if (isGuarded(fn))
+        return fn;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const wrapped = async (...args) => {
+        const g = gate ?? activeGate();
+        if (g === null) {
+            throw new Error('No gate configured: call install(new Gate(...)) from @intutic/gate, or pass ' +
+                '{ gate } to wrapTool()/wrapTools(). Refusing to run the tool unguarded.');
+        }
+        await g.guard(toolName, renderToolInput(args));
+        return fn(...args);
+    };
+    Object.defineProperty(wrapped, GUARDED, { value: true, enumerable: false });
+    Object.defineProperty(wrapped, 'name', { value: toolName, configurable: true });
+    return wrapped;
+}
+export function wrapTool(toolOrFn, opts = {}) {
+    if (typeof toolOrFn === 'function') {
+        const name = opts.name ?? (toolOrFn.name || 'tool');
+        return wrapFn(toolOrFn, name, opts.gate);
+    }
+    if (toolOrFn !== null && typeof toolOrFn === 'object' && typeof toolOrFn.execute === 'function') {
+        const name = opts.name ?? toolOrFn.name ?? 'tool';
+        return { ...toolOrFn, execute: wrapFn(toolOrFn.execute, name, opts.gate) };
+    }
+    throw new TypeError('wrapTool: expected an async function or a tool object with an execute() method, got ' +
+        `${typeof toolOrFn}`);
+}
+export function wrapTools(tools, gate) {
+    if (Array.isArray(tools)) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        return tools.map((t) => wrapTool(t, { gate }));
+    }
+    const out = {};
+    for (const [key, t] of Object.entries(tools)) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        out[key] = wrapTool(t, { name: key, gate });
+    }
+    return out;
+}
+//# sourceMappingURL=wrapTools.js.map

package/dist/wrapTools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapTools.js","sourceRoot":"","sources":["../src/wrapTools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAa,MAAM,WAAW,CAAA;AAmB3D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAA;AAElD,SAAS,SAAS,CAAC,EAAS;IAC1B,OAAQ,EAAyC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,IAAe;IACtC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;IACpB,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAAgC,CAAA;IACzC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAA;AACjB,CAAC;AAED,SAAS,MAAM,CAAC,EAAS,EAAE,QAAgB,EAAE,IAAsB;IACjE,IAAI,SAAS,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,CAAA;IAE5B,8DAA8D;IAC9D,MAAM,OAAO,GAAG,KAAK,EAAE,GAAG,IAAW,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAA;QAC9B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,yEAAyE,CAC5E,CAAA;QACH,CAAC;QACD,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9C,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;IACpB,CAAC,CAAA;IAED,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3E,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/E,OAAO,OAAO,CAAA;AAChB,CAAC;AAcD,MAAM,UAAU,QAAQ,CAAC,QAAgC,EAAE,OAAwB,EAAE;IACnF,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC,CAAA;QACnD,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAA;QACjD,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;IAC5E,CAAC;IACD,MAAM,IAAI,SAAS,CACjB,sFAAsF;QACpF,GAAG,OAAO,QAAQ,EAAE,CACvB,CAAA;AACH,CAAC;AAgBD,MAAM,UAAU,SAAS,CACvB,KAAuC,EACvC,IAAW;IAEX,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,8DAA8D;QAC9D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAQ,CAAA;IAC9D,CAAC;IACD,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,8DAA8D;QAC9D,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -0,0 +1,123 @@
+{
+  "name": "@intutic/gate",
+  "version": "1.10.1",
+  "description": "Intutic pre-execution tool gate for JS/TS agent frameworks without a shipped Intutic harness (Mastra, the Vercel AI SDK, LangChain.js, dsh, and hand-rolled agent loops)",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/intutic/intutic",
+    "directory": "packages/gate-js"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./mastra": {
+      "import": "./dist/mastra.js",
+      "types": "./dist/mastra.d.ts"
+    },
+    "./vercel": {
+      "import": "./dist/vercel.js",
+      "types": "./dist/vercel.d.ts"
+    },
+    "./dsh": {
+      "import": "./dist/dsh.js",
+      "types": "./dist/dsh.d.ts"
+    },
+    "./openai": {
+      "import": "./dist/openai.js",
+      "types": "./dist/openai.d.ts"
+    },
+    "./eve": {
+      "import": "./dist/eve.js",
+      "types": "./dist/eve.d.ts"
+    },
+    "./harness": {
+      "import": "./dist/harness.js",
+      "types": "./dist/harness.d.ts"
+    },
+    "./workflow": {
+      "import": "./dist/workflow.js",
+      "types": "./dist/workflow.d.ts"
+    },
+    "./managed-agents": {
+      "import": "./dist/managedAgents.js",
+      "types": "./dist/managedAgents.d.ts"
+    },
+    "./trueforge": {
+      "import": "./dist/trueforge.js",
+      "types": "./dist/trueforge.d.ts"
+    }
+  },
+  "typesVersions": {
+    "*": {
+      "mastra": [
+        "src/mastra.ts"
+      ],
+      "vercel": [
+        "src/vercel.ts"
+      ],
+      "dsh": [
+        "src/dsh.ts"
+      ],
+      "openai": [
+        "src/openai.ts"
+      ],
+      "eve": [
+        "src/eve.ts"
+      ],
+      "harness": [
+        "src/harness.ts"
+      ],
+      "workflow": [
+        "src/workflow.ts"
+      ],
+      "managed-agents": [
+        "src/managedAgents.ts"
+      ],
+      "trueforge": [
+        "src/trueforge.ts"
+      ]
+    }
+  },
+  "files": [
+    "dist/",
+    "README.md"
+  ],
+  "dependencies": {
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@ai-sdk/harness": "^1.0.75",
+    "@anthropic-ai/sdk": "^0.117.1",
+    "@ai-sdk/openai": "^4.0.43",
+    "@ai-sdk/workflow": "^1.0.69",
+    "@mastra/core": "^1.59.0",
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@openai/agents": "0.16.1",
+    "@truefoundry/trueforge-core": "^0.1.4",
+    "@types/node": "^22",
+    "ai": "^7.0.68",
+    "eve": "^0.39.1",
+    "typescript": "^5.5",
+    "vitest": "^4",
+    "workflow": "^4.8.3",
+    "zod": "^4.2.0"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "lint": "eslint src",
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  }
+}