@kamilio/wire 0.1.8 → 0.1.10

package/node_modules/toolcraft/dist/http.js

@@ -0,0 +1,161 @@
+import "./node-require-shim.js";
+import { createHttpServer } from "tiny-http-mcp-server/server";
+import { createMCPServerForTransport } from "./mcp.js";
+import { enableSourceMaps } from "./stack-trim.js";
+import { isHostedOAuthConfiguration, prepareHostedOAuthRuntime } from "./http-hosted-oauth.js";
+function toVerifiedAccessToken(token, issuer, verified) {
+    return {
+        token,
+        issuer,
+        audience: [verified.resource],
+        scopes: [...verified.scopes],
+        expiresAt: verified.expiresAt,
+        claims: {
+            sub: verified.subject,
+            client_id: verified.clientId,
+            aud: verified.resource,
+            jti: verified.tokenId
+        },
+        subject: verified.subject,
+        clientId: verified.clientId
+    };
+}
+export function createHTTPMCPAuthorization(options) {
+    const issuer = options.authorizationServer.issuer;
+    const resource = new URL(options.resource).href;
+    return {
+        resource,
+        authorizationServers: [issuer],
+        requiredScopes: options.requiredScopes,
+        scopesSupported: options.scopesSupported ?? options.requiredScopes,
+        verifier: {
+            async verify(input) {
+                if (input.authorizationServers.length !== 1 || input.authorizationServers[0] !== issuer) {
+                    throw new Error("authorization server issuer does not match");
+                }
+                if (new URL(input.resource).href !== resource) {
+                    throw new Error("protected resource does not match");
+                }
+                const verified = await options.authorizationServer.verifyAccessToken(input.token, resource);
+                return toVerifiedAccessToken(input.token, issuer, verified);
+            }
+        }
+    };
+}
+function createTransportOptions(options, serverOptions) {
+    return {
+        ...serverOptions,
+        toolCallTimeoutMs: options.toolCallTimeoutMs,
+        ...(Object.prototype.hasOwnProperty.call(options, "sessionIdGenerator")
+            ? { sessionIdGenerator: options.sessionIdGenerator }
+            : {}),
+        enableJsonResponse: options.enableJsonResponse,
+        allowedOrigins: options.allowedOrigins,
+        allowedHosts: options.allowedHosts,
+        maxRequestBytes: options.maxRequestBytes,
+        maxResponseBytes: options.maxResponseBytes,
+        maxBatchSize: options.maxBatchSize,
+        maxSessions: options.maxSessions,
+        maxSessionsPerSubject: options.maxSessionsPerSubject,
+        sessionTtlMs: options.sessionTtlMs,
+        maxStreamsPerSession: options.maxStreamsPerSession,
+        maxStreamBufferBytes: options.maxStreamBufferBytes,
+        maxSseEventHistory: options.maxSseEventHistory,
+        sseKeepAliveMs: options.sseKeepAliveMs,
+        maxConcurrentToolCalls: options.maxConcurrentToolCalls,
+        maxQueuedToolCalls: options.maxQueuedToolCalls,
+        sessionStore: options.sessionStore,
+        requestIdGenerator: options.requestIdGenerator,
+        observability: options.observability,
+        trustedProxy: options.trustedProxy,
+        oauth: options.oauth,
+        requestHandler: options.requestHandler
+    };
+}
+function createListenOptions(options) {
+    return {
+        hostname: options.hostname,
+        port: options.port,
+        path: options.path,
+        signal: options.signal,
+        requestTimeoutMs: options.requestTimeoutMs,
+        headersTimeoutMs: options.headersTimeoutMs,
+        keepAliveTimeoutMs: options.keepAliveTimeoutMs
+    };
+}
+export async function createHTTPMCPServer(roots, options) {
+    let resolvedOptions = options;
+    let hostedMcpPath;
+    if (isHostedOAuthConfiguration(options.oauth)) {
+        const runtime = await prepareHostedOAuthRuntime(options.oauth);
+        const applicationServices = options.requestServices;
+        hostedMcpPath = runtime.mcpPath;
+        resolvedOptions = {
+            ...options,
+            oauth: runtime.oauth,
+            sessionIdGenerator: undefined,
+            enableJsonResponse: true,
+            requestServices: async (context) => {
+                const auth = context.auth;
+                const subject = auth?.subject;
+                if (auth === undefined || subject === undefined)
+                    throw new Error("Hosted OAuth request is missing a verified subject.");
+                return {
+                    ...(applicationServices === undefined ? {} : await applicationServices(context)),
+                    ...(await runtime.requestServices({
+                        issuer: auth.issuer,
+                        subject,
+                        clientId: auth.clientId,
+                        scopes: auth.scopes,
+                        resource: auth.resource.href
+                    }))
+                };
+            },
+            requestHandler: runtime.requestHandler
+        };
+    }
+    let server;
+    await createMCPServerForTransport(roots, resolvedOptions, {
+        supportsStreaming: !Object.prototype.hasOwnProperty.call(resolvedOptions, "sessionIdGenerator") ||
+            resolvedOptions.sessionIdGenerator !== undefined,
+        createServer(serverOptions) {
+            server = createHttpServer(createTransportOptions(resolvedOptions, serverOptions));
+            return server;
+        },
+        getRequestContext() {
+            return server?.getRequestContext();
+        },
+        requestServices: resolvedOptions.requestServices
+    });
+    if (server === undefined) {
+        throw new Error("Toolcraft HTTP MCP server was not created.");
+    }
+    if (hostedMcpPath !== undefined) {
+        const listenHttp = server.listenHttp.bind(server);
+        server.listenHttp = async (listenOptions = {}) => {
+            if (listenOptions.path !== undefined) {
+                const withLeadingSlash = listenOptions.path.startsWith("/")
+                    ? listenOptions.path
+                    : `/${listenOptions.path}`;
+                const requestedPath = withLeadingSlash.length > 1 && withLeadingSlash.endsWith("/")
+                    ? withLeadingSlash.slice(0, -1)
+                    : withLeadingSlash;
+                if (requestedPath !== hostedMcpPath) {
+                    throw new Error(`Hosted OAuth MCP path ${JSON.stringify(requestedPath)} conflicts with publicUrl path ${JSON.stringify(hostedMcpPath)}.`);
+                }
+            }
+            return listenHttp({
+                ...listenOptions,
+                path: hostedMcpPath
+            });
+        };
+    }
+    return server;
+}
+export async function runHTTPMCP(roots, options) {
+    enableSourceMaps();
+    const server = await createHTTPMCPServer(roots, options);
+    return server.listenHttp(createListenOptions(options));
+}
+export { createJwksTokenVerifier, TokenVerificationError } from "tiny-http-mcp-server/server";
+export { createAuthorizationInteractionSecurity, createInMemoryAuthorizationServerStore, createOAuthAuthorizationServer, verifyAuthorizationInteractionCsrf } from "mcp-oauth-server";

package/node_modules/toolcraft/dist/human-in-loop/approval-tasks.d.ts

@@ -1,17 +1,22 @@
 import type { OpenTaskListOptions, TaskList, Tasks } from "@poe-code/task-list";
-import type { HumanInLoopPending, HumanInLoopRuntimeOptions } from "./types.js";
+import type { HumanInLoopPending } from "./types.js";
+import type { HumanInLoopRuntimeOptions } from "./runtime-options.js";
+type ApprovalListOptions = Pick<HumanInLoopRuntimeOptions, "taskList" | "listName">;
+import { type ApprovalPlanValue } from "./plan-hash.js";
 export interface ApprovalPayload {
     approvalId?: string;
     commandPath: string;
     params: Record<string, unknown>;
     message: string;
     declineInputPrompt?: string | null;
+    plan?: ApprovalPlanValue;
+    planHash?: string;
     enqueuedAt?: string;
     pid?: number | null;
     result?: unknown;
     error?: unknown;
 }
-export declare function ensureApprovalList(runtimeOptions: HumanInLoopRuntimeOptions | undefined, deps?: {
+export declare function ensureApprovalList(runtimeOptions: ApprovalListOptions | undefined, deps?: {
     create?: boolean;
     openTaskList?: (options: OpenTaskListOptions) => Promise<TaskList>;
 }): Promise<{
@@ -30,3 +35,4 @@ export declare function loadApproval(ctx: {
     tasks: Tasks;
     approvalId: string;
 }): Promise<ApprovalPayload | undefined>;
+export {};

package/node_modules/toolcraft/dist/human-in-loop/approval-tasks.js

@@ -2,6 +2,7 @@ import { TaskAlreadyExistsError, TaskNotFoundError, openTaskList } from "@poe-co
 import { randomBytes } from "node:crypto";
 import { UserError } from "../user-error.js";
 import { approvalStateMachine } from "./state-machine.js";
+import { isApprovalPlanValue } from "./plan-hash.js";
 const DEFAULT_LIST_NAME = "approvals";
 const openedTaskListsByRuntime = new WeakMap();
 const validatedListsByRuntime = new WeakMap();
@@ -84,28 +85,36 @@ function isListValidated(runtimeOptions, listName) {
 }
 function createApprovalRecord(payload, enqueuedAt) {
     const approvalId = `${enqueuedAt.slice(0, 19).replaceAll(":", "-")}-${randomBytes(3).toString("hex")}`;
-    return {
+    const metadata = {
+        schemaVersion: 1,
+        approvalId,
+        commandPath: payload.commandPath,
+        params: payload.params,
+        message: payload.message,
+        declineInputPrompt: payload.declineInputPrompt ?? null,
+        enqueuedAt,
+        pid: null,
+        result: null,
+        error: null
+    };
+    const pending = {
+        status: "pending-approval",
+        approvalId,
+        message: payload.message,
+        enqueuedAt
+    };
+    const approval = {
         approvalId,
         name: `${payload.commandPath} (${enqueuedAt})`,
-        metadata: {
-            schemaVersion: 1,
-            approvalId,
-            commandPath: payload.commandPath,
-            params: payload.params,
-            message: payload.message,
-            declineInputPrompt: payload.declineInputPrompt ?? null,
-            enqueuedAt,
-            pid: null,
-            result: null,
-            error: null
-        },
-        pending: {
-            status: "pending-approval",
-            approvalId,
-            message: payload.message,
-            enqueuedAt
-        }
+        metadata,
+        pending
     };
+    if (payload.plan !== undefined && payload.planHash !== undefined) {
+        approval.metadata.plan = payload.plan;
+        approval.metadata.planHash = payload.planHash;
+        approval.pending.planHash = payload.planHash;
+    }
+    return approval;
 }
 async function createApprovalTask(tasks, approval) {
     await tasks.create({
@@ -127,6 +136,9 @@ function getTaskListDirectory(taskList) {
     return isTaskListConfig(taskList) ? taskList.dir : "unknown";
 }
 function isDeepEqualStateMachine(left, right) {
+    if (left.initial !== right.initial) {
+        return false;
+    }
     if (!areEqualStrings(left.states, right.states)) {
         return false;
     }
@@ -198,6 +210,8 @@ function approvalPayloadFromTask(task) {
         declineInputPrompt: typeof metadata.declineInputPrompt === "string" || metadata.declineInputPrompt === null
             ? metadata.declineInputPrompt
             : undefined,
+        plan: isApprovalPlanValue(metadata.plan) ? metadata.plan : undefined,
+        planHash: typeof metadata.planHash === "string" ? metadata.planHash : undefined,
         enqueuedAt: metadata.enqueuedAt,
         pid: typeof metadata.pid === "number" || metadata.pid === null ? metadata.pid : undefined,
         result: metadata.result,

package/node_modules/toolcraft/dist/human-in-loop/approvals-commands.d.ts

@@ -1,11 +1,11 @@
 import type { CommandNode, Group } from "../index.js";
-import type { HumanInLoopRuntimeOptions } from "./types.js";
+import type { HumanInLoopRuntimeInstance } from "./runtime-options.js";
 interface ApprovalBuiltInServices {
-    runtimeOptions: HumanInLoopRuntimeOptions;
+    humanInLoop: HumanInLoopRuntimeInstance;
     root: CommandNode<any>;
 }
 export declare const approvalsGroup: Group<ApprovalBuiltInServices> & {
-    readonly __agentKitGroupTypeInfo: import("../index.js").GroupTypeInfo<ApprovalBuiltInServices, string, readonly CommandNode<ApprovalBuiltInServices>[], undefined, undefined>;
+    readonly __agentKitGroupTypeInfo: import("../runtime.js").GroupTypeInfo<ApprovalBuiltInServices, string, readonly CommandNode<ApprovalBuiltInServices>[], undefined, undefined>;
 };
 export declare function mergeApprovalsGroup<TServices extends object>(root: Group<TServices>): Group<TServices>;
 export {};

package/node_modules/toolcraft/dist/human-in-loop/approvals-commands.js

@@ -3,12 +3,14 @@ import { S } from "toolcraft-schema";
 import { hasOwnErrorCode } from "../error-codes.js";
 import { UserError, defineCommand, defineGroup } from "../index.js";
 import { ensureApprovalList } from "./approval-tasks.js";
+import { approvalStateMachine } from "./state-machine.js";
 import { runApproval } from "./runner.js";
 const approvalsGroupSymbol = Symbol("toolcraft.humanInLoop.approvalsBuiltIn");
 const listScope = ["cli", "mcp", "sdk"];
 const runScope = ["cli"];
+const approvalStateValues = approvalStateMachine.states;
 const listParams = S.Object({
-    state: S.Optional(S.String())
+    state: S.Optional(S.Array(S.Enum(approvalStateValues)))
 });
 const showParams = S.Object({
     approvalId: S.String()
@@ -25,9 +27,11 @@ export const approvalsGroup = markApprovalsBuiltIn(defineGroup({
             description: "List queued approvals.",
             scope: listScope,
             params: listParams,
-            handler: async ({ params, runtimeOptions }) => {
+            handler: async ({ params, humanInLoop }) => {
                 try {
-                    const { tasks } = await ensureApprovalList(runtimeOptions, { create: false });
+                    const { tasks } = await ensureApprovalList(humanInLoop.runtimeOptions, {
+                        create: false
+                    });
                     return loadApprovals(tasks, params.state);
                 }
                 catch (error) {
@@ -48,17 +52,13 @@ export const approvalsGroup = markApprovalsBuiltIn(defineGroup({
             description: "Show one approval.",
             scope: listScope,
             params: showParams,
-            handler: async ({ params, runtimeOptions }) => {
-                try {
-                    const { tasks } = await ensureApprovalList(runtimeOptions, { create: false });
+            handler: async ({ params, humanInLoop }) => {
+                return withMissingApprovalError(params.approvalId, async () => {
+                    const { tasks } = await ensureApprovalList(humanInLoop.runtimeOptions, {
+                        create: false
+                    });
                     return tasks.get(params.approvalId);
-                }
-                catch (error) {
-                    if (isMissingStateError(error)) {
-                        throw new TaskNotFoundError(`Task "approvals/${params.approvalId}" not found.`);
-                    }
-                    throw error;
-                }
+                });
             },
             render: {
                 rich: (result, primitives) => renderApprovalDetails(result, primitives),
@@ -71,8 +71,8 @@ export const approvalsGroup = markApprovalsBuiltIn(defineGroup({
             description: "Run one queued approval.",
             scope: runScope,
             params: runParams,
-            handler: async ({ params, runtimeOptions, root }) => {
-                return runApproval(params.approvalId, runtimeOptions, root);
+            handler: async ({ params, humanInLoop, root }) => {
+                return withMissingApprovalError(params.approvalId, async () => runApproval(params.approvalId, humanInLoop.runtimeOptions, root));
             },
             render: {
                 rich: (result, primitives) => {
@@ -111,8 +111,7 @@ function isApprovalsBuiltIn(node) {
     return (node.kind === "group" &&
         node[approvalsGroupSymbol] === true);
 }
-async function loadApprovals(tasks, stateFilter) {
-    const states = splitStateFilter(stateFilter);
+async function loadApprovals(tasks, states = []) {
     if (states.length === 0) {
         return tasks.all();
     }
@@ -132,22 +131,6 @@ async function loadApprovals(tasks, stateFilter) {
     }
     return approvals;
 }
-function splitStateFilter(stateFilter) {
-    if (stateFilter === undefined) {
-        return [];
-    }
-    const seen = new Set();
-    const states = [];
-    for (const value of stateFilter.split(",")) {
-        const trimmed = value.trim();
-        if (trimmed.length === 0 || seen.has(trimmed)) {
-            continue;
-        }
-        seen.add(trimmed);
-        states.push(trimmed);
-    }
-    return states;
-}
 function renderApprovalList(result, { logger, renderTable, getTheme }) {
     if (result.length === 0) {
         logger.message("No approvals found.");
@@ -223,6 +206,17 @@ function stringifyValue(value) {
 function escapeMarkdownCell(value) {
     return value.replaceAll("|", "\\|");
 }
+async function withMissingApprovalError(approvalId, run) {
+    try {
+        return await run();
+    }
+    catch (error) {
+        if (error instanceof TaskNotFoundError || isMissingStateError(error)) {
+            throw new UserError(`Approval "${approvalId}" not found. Run approvals list to see queued approvals.`);
+        }
+        throw error;
+    }
+}
 function isMissingStateError(error) {
     return hasOwnErrorCode(error, "ENOENT");
 }

package/node_modules/toolcraft/dist/human-in-loop/config.js

@@ -12,6 +12,9 @@ export function validateHumanInLoopOnDefine(config) {
     if (typeof config.humanInLoop.message !== "function") {
         throw new Error(`${label} '${config.name}': humanInLoop.message must be a function`);
     }
+    if (config.humanInLoop.plan !== undefined && typeof config.humanInLoop.plan !== "function") {
+        throw new Error(`${label} '${config.name}': humanInLoop.plan must be a function`);
+    }
 }
 export function mergeHumanInLoopFromGroup(groupHumanInLoop, childHumanInLoop) {
     if (childHumanInLoop !== undefined) {

package/node_modules/toolcraft/dist/human-in-loop/gate.d.ts

@@ -1,4 +1,8 @@
 import type { Command, HandlerContext } from "../index.js";
-import type { HumanInLoopPending, HumanInLoopProvider, HumanInLoopRuntimeOptions } from "./types.js";
-export declare function resolveProvider(runtimeOptions: HumanInLoopRuntimeOptions | undefined): HumanInLoopProvider;
-export declare function invokeWithHumanInLoop<T>(node: Command<any, any, any, T>, ctx: HandlerContext<any, any, any>, runtimeOptions: HumanInLoopRuntimeOptions | undefined, commandPath: string): Promise<T | HumanInLoopPending>;
+import { enqueueApproval } from "./approval-tasks.js";
+import type { HumanInLoopPending } from "./types.js";
+import type { HumanInLoopRuntimeOptions } from "./runtime-options.js";
+export declare function invokeWithHumanInLoop<T>(node: Command<any, any, any, T>, ctx: HandlerContext<any, any, any>, runtimeOptions: HumanInLoopRuntimeOptions, commandPath: string, options?: {
+    enqueueApproval?: typeof enqueueApproval;
+    spawnRunner?: boolean;
+}): Promise<T | HumanInLoopPending>;

package/node_modules/toolcraft/dist/human-in-loop/gate.js

@@ -1,57 +1,59 @@
 import { enqueueApproval, ensureApprovalList } from "./approval-tasks.js";
-import { defaultProviderForPlatform } from "./default-provider.js";
 import { spawnApprovalRunner } from "./spawn.js";
 import { ApprovalDeclinedError } from "./types.js";
-const providersByRuntime = new WeakMap();
-let providerWithoutRuntime;
-export function resolveProvider(runtimeOptions) {
-    if (runtimeOptions?.provider !== undefined) {
-        return runtimeOptions.provider;
-    }
-    if (runtimeOptions === undefined) {
-        providerWithoutRuntime ??= defaultProviderForPlatform();
-        return providerWithoutRuntime;
-    }
-    const cachedProvider = providersByRuntime.get(runtimeOptions);
-    if (cachedProvider !== undefined) {
-        return cachedProvider;
-    }
-    const provider = defaultProviderForPlatform();
-    providersByRuntime.set(runtimeOptions, provider);
-    return provider;
-}
-export async function invokeWithHumanInLoop(node, ctx, runtimeOptions, commandPath) {
+import { assertApprovalPlanHash, createApprovalPlan, formatApprovalMessage } from "./plan-hash.js";
+export async function invokeWithHumanInLoop(node, ctx, runtimeOptions, commandPath, options = {}) {
+    ctx.signal?.throwIfAborted();
     if (!node.humanInLoop) {
         return node.handler(ctx);
     }
-    const message = node.humanInLoop.message({
+    const planContext = {
         params: ctx.params,
-        commandPath,
-    });
+        commandPath
+    };
+    const baseMessage = node.humanInLoop.message(planContext);
+    const approvalPlan = node.humanInLoop.plan === undefined
+        ? undefined
+        : createApprovalPlan(await node.humanInLoop.plan(planContext));
+    ctx.signal?.throwIfAborted();
+    const message = approvalPlan === undefined
+        ? baseMessage
+        : formatApprovalMessage(baseMessage, approvalPlan);
     if (node.humanInLoop.mode === "async") {
         const { tasks } = await ensureApprovalList(runtimeOptions);
-        const { approvalId, pending } = await enqueueApproval({
+        ctx.signal?.throwIfAborted();
+        const { approvalId, pending } = await (options.enqueueApproval ?? enqueueApproval)({
             tasks,
             payload: {
                 commandPath,
                 params: ctx.params,
                 message,
-                declineInputPrompt: node.humanInLoop.declineInputPrompt,
-            },
+                plan: approvalPlan?.value,
+                planHash: approvalPlan?.hash,
+                declineInputPrompt: node.humanInLoop.declineInputPrompt
+            }
         });
-        spawnApprovalRunner(approvalId, runtimeOptions);
+        ctx.signal?.throwIfAborted();
+        if (options.spawnRunner !== false) {
+            spawnApprovalRunner(approvalId, runtimeOptions);
+        }
         return pending;
     }
-    const provider = resolveProvider(runtimeOptions);
-    const result = await provider.requestApproval({
+    const result = await runtimeOptions.provider.requestApproval({
         message,
-        declineInputPrompt: node.humanInLoop.declineInputPrompt,
+        declineInputPrompt: node.humanInLoop.declineInputPrompt
     });
+    ctx.signal?.throwIfAborted();
     if (result.outcome === "declined") {
         throw new ApprovalDeclinedError({
             reason: result.reason,
-            commandPath,
+            commandPath
         });
     }
+    if (approvalPlan !== undefined && node.humanInLoop.plan !== undefined) {
+        const executionPlan = createApprovalPlan(await node.humanInLoop.plan(planContext));
+        ctx.signal?.throwIfAborted();
+        assertApprovalPlanHash(approvalPlan.hash, executionPlan.hash);
+    }
     return node.handler(ctx);
 }

package/node_modules/toolcraft/dist/human-in-loop/index.d.ts

@@ -1,7 +1,10 @@
+export { createHumanInLoop } from "./runtime.js";
 export { defaultProviderForPlatform } from "./default-provider.js";
+export { osascriptProvider } from "@poe-code/agent-human-in-loop";
 export { invokeWithHumanInLoop } from "./gate.js";
 export { approvalStateMachine } from "./state-machine.js";
 export { ApprovalDeclinedError } from "./types.js";
 export type { ApprovalEvent, ApprovalState } from "./state-machine.js";
-export type { HumanInLoopConfig, HumanInLoopPending, HumanInLoopRuntimeOptions } from "./types.js";
+export type { HumanInLoopConfig, HumanInLoopPending, HumanInLoopRuntime } from "./types.js";
+export type { HumanInLoopRuntimeInstance, HumanInLoopRuntimeOptions } from "./runtime-options.js";
 export type { HumanInLoopProvider } from "@poe-code/agent-human-in-loop";

package/node_modules/toolcraft/dist/human-in-loop/index.js

@@ -1,4 +1,6 @@
+export { createHumanInLoop } from "./runtime.js";
 export { defaultProviderForPlatform } from "./default-provider.js";
+export { osascriptProvider } from "@poe-code/agent-human-in-loop";
 export { invokeWithHumanInLoop } from "./gate.js";
 export { approvalStateMachine } from "./state-machine.js";
 export { ApprovalDeclinedError } from "./types.js";

package/node_modules/toolcraft/dist/human-in-loop/plan-hash.d.ts

@@ -0,0 +1,13 @@
+export type ApprovalPlanValue = null | boolean | number | string | ApprovalPlanValue[] | {
+    [key: string]: ApprovalPlanValue;
+};
+export interface ApprovalPlan {
+    value: ApprovalPlanValue;
+    canonical: string;
+    display: string;
+    hash: string;
+}
+export declare function isApprovalPlanValue(value: unknown): value is ApprovalPlanValue;
+export declare function createApprovalPlan(value: unknown): ApprovalPlan;
+export declare function formatApprovalMessage(message: string, plan: ApprovalPlan): string;
+export declare function assertApprovalPlanHash(expectedHash: string, actualHash: string): void;

package/node_modules/toolcraft/dist/human-in-loop/plan-hash.js

@@ -0,0 +1,78 @@
+import { createHash } from "node:crypto";
+import { UserError } from "../user-error.js";
+export function isApprovalPlanValue(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean") {
+        return true;
+    }
+    if (typeof value === "number") {
+        return Number.isFinite(value);
+    }
+    if (Array.isArray(value)) {
+        return value.every(isApprovalPlanValue);
+    }
+    if (typeof value !== "object") {
+        return false;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    return ((prototype === Object.prototype || prototype === null) &&
+        Object.values(value).every(isApprovalPlanValue));
+}
+function normalizePlan(value, seen) {
+    if (value === null || typeof value === "string" || typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new UserError("Approval plan numbers must be finite.");
+        }
+        return value;
+    }
+    if (typeof value !== "object") {
+        throw new UserError("Approval plan must contain only JSON values.");
+    }
+    if (seen.has(value)) {
+        throw new UserError("Approval plan must not contain circular references.");
+    }
+    seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            return value.map((item) => normalizePlan(item, seen));
+        }
+        const prototype = Object.getPrototypeOf(value);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw new UserError("Approval plan must contain only JSON values.");
+        }
+        const normalized = {};
+        for (const key of Object.keys(value).sort()) {
+            Object.defineProperty(normalized, key, {
+                value: normalizePlan(value[key], seen),
+                enumerable: true,
+                writable: true,
+                configurable: true
+            });
+        }
+        return normalized;
+    }
+    finally {
+        seen.delete(value);
+    }
+}
+export function createApprovalPlan(value) {
+    const normalized = normalizePlan(value, new Set());
+    const canonical = JSON.stringify(normalized);
+    const digest = createHash("sha256").update(canonical).digest("hex");
+    return {
+        value: normalized,
+        canonical,
+        display: JSON.stringify(normalized, null, 2),
+        hash: `sha256:${digest}`
+    };
+}
+export function formatApprovalMessage(message, plan) {
+    return `${message}\n\nPlan:\n${plan.display}\n\nPlan hash: ${plan.hash}`;
+}
+export function assertApprovalPlanHash(expectedHash, actualHash) {
+    if (expectedHash !== actualHash) {
+        throw new UserError(`Approval plan changed after approval. Expected ${expectedHash}, received ${actualHash}.`);
+    }
+}

package/node_modules/toolcraft/dist/human-in-loop/runner.d.ts

@@ -1,3 +1,3 @@
 import type { CommandNode } from "../index.js";
-import type { HumanInLoopRuntimeOptions } from "./types.js";
+import type { HumanInLoopRuntimeOptions } from "./runtime-options.js";
 export declare function runApproval(approvalId: string, runtimeOptions: HumanInLoopRuntimeOptions, root: CommandNode<any>): Promise<void>;