@lloyal-labs/lloyal-agents 2.1.0 → 3.0.1

package/dist/AgentPolicy.d.ts

@@ -1,20 +1,42 @@
 import type { Agent, ToolHistoryEntry } from './Agent';
+import type { ToolRetryError } from './Tool';
 import { ContextPressure } from './agent-pool';
 import type { ParsedToolCall } from '@lloyal-labs/sdk';
 import type { PressureThresholds } from './types';
 /**
- * A declarative guard that rejects tool calls based on agent lineage.
+ * A declarative guard that rejects tool calls based on agent state.
  * Guards are checked in order before any tool is dispatched.
  *
+ * `tools` selects which tool calls this guard sees: a `string[]` matches
+ * by exact name; the literal `'*'` matches every call (used by the
+ * framework-injected authGuard — guards that need to
+ * inspect *every* call regardless of tool name).
+ *
+ * `reject` returns `true` to reject the call with `message`. It receives
+ * the parsed args, the full agent lineage's tool history, the agent
+ * itself, `toolName` (so `tools: '*'` guards know which tool they're
+ * gating), and the pool-level `config` (so guards can consult
+ * pool-resolved state such as the protected-tool set and the session's
+ * grants — see {@link PolicyConfig}). Guards that don't need `config`
+ * simply omit the parameter.
+ *
+ * `name` is the optional guard identifier surfaced via
+ * `ProduceAction.nudge.guard` so the pool can emit per-guard trace
+ * events (e.g., `tool:authReject` for `name: 'auth_reject'`). Omit it
+ * for guards whose only observable footprint is the resulting
+ * `pool:agentNudge` event.
+ *
  * @category Agents
  */
 export interface ToolGuard {
-    /** Tool names this guard applies to */
-    tools: string[];
-    /** Return true to reject the call. Receives parsed args, full lineage history, and the agent itself. */
-    reject: (args: Record<string, unknown>, lineageHistory: ToolHistoryEntry[], agent: Agent) => boolean;
-    /** Error message sent back to the agent as a tool result */
+    /** Tool names this guard applies to; `'*'` matches every call. */
+    tools: string[] | '*';
+    /** Return true to reject the call. */
+    reject: (args: Record<string, unknown>, lineageHistory: ToolHistoryEntry[], agent: Agent, toolName: string, config: PolicyConfig) => boolean;
+    /** Error message sent back to the agent as a tool result. */
     message: string;
+    /** Optional identifier surfaced via `ProduceAction.nudge.guard`. */
+    name?: string;
 }
 export declare const defaultToolGuards: ToolGuard[];
 /**
@@ -32,9 +54,14 @@ export type ProduceAction = {
 } | {
     type: 'return';
     result: string;
-} | {
+}
+/** `guard` carries the identifier of the rejecting `ToolGuard` — used to
+ *  route `auth_reject` rejections to the `tool:authReject` trace event.
+ *  Absent for nudges not produced by a guard. */
+ | {
     type: 'nudge';
     message: string;
+    guard?: string;
 } | {
     type: 'idle';
     reason: IdleReason;
@@ -67,6 +94,25 @@ export type RecoveryAction = {
 } | {
     type: 'skip';
 };
+/**
+ * Action returned by policy.onToolRetry — what to do when a tool throws
+ * {@link ToolRetryError} (transient failure, e.g. provider rate-limited).
+ *
+ * `retry` parks the agent (`awaiting_tool`, skipped by PRODUCE at zero
+ * cost — no turns, no tokens, no KV) and re-executes the same call after
+ * `afterMs` (defaults to the error's own `retryAfterMs` estimate).
+ * `fail` settles `message` (or the pool's directive default) as the tool
+ * result so the model can pivot.
+ *
+ * @category Agents
+ */
+export type ToolRetryAction = {
+    type: 'retry';
+    afterMs?: number;
+} | {
+    type: 'fail';
+    message?: string;
+};
 /**
  * Agent lifecycle policy — injected strategy for pressure, nudge,
  * recursion, report timing, and result quality decisions.
@@ -154,6 +200,18 @@ export interface AgentPolicy {
      * Optional — defaults to skip when absent.
      */
     onRecovery?(agent: Agent, pressure: ContextPressure): RecoveryAction;
+    /**
+     * Transient tool failure (the tool threw {@link ToolRetryError}).
+     * Decide whether to park-and-retry or settle a failure result. The tool
+     * supplies a `retryAfterMs` estimate on the error; the policy may override
+     * it (`afterMs`) or refuse to wait at all — e.g. when the time budget
+     * can't afford a park.
+     *
+     * Absent → pool default: one retry at the error's own delay, then fail.
+     *
+     * @param attempt - 1 on the first failure of a call, 2 after one retry, …
+     */
+    onToolRetry?(agent: Agent, tool: string, error: ToolRetryError, attempt: number): ToolRetryAction;
 }
 /**
  * Pool-level configuration passed to policy methods.
@@ -163,6 +221,20 @@ export interface PolicyConfig {
     maxTurns: number;
     terminalToolName?: string;
     hasNonTerminalTools: boolean;
+    /**
+     * Tool names this pool declares `protected` (gathered from each
+     * {@link Tool.protected} flag). The authGuard gates only these; every
+     * other tool is open. Resolved once at pool setup. Undefined/empty when
+     * no tool in the pool is protected (the common case).
+     */
+    protectedTools?: ReadonlySet<string>;
+    /**
+     * Protected tool names the session currently holds a grant for — read
+     * from {@link GrantStoreCtx} at pool setup. The authGuard allows a
+     * protected tool iff its name is in this set. Undefined/empty = no
+     * grants (fail-closed: every protected tool denied).
+     */
+    grants?: ReadonlySet<string>;
 }
 /**
  * Default policy replicating the current inline if-logic from agent-pool.ts.
@@ -232,6 +304,9 @@ export interface DefaultAgentPolicyOpts {
      *  protected from shouldExit — the hard limit is deferred until the tool
      *  call completes naturally or KV pressure forces a kill. */
     terminalToolName?: string;
+    /** Max park-and-retry attempts per tool call on {@link ToolRetryError}
+     *  before failing the call with a directive result. @default 1 */
+    maxToolRetries?: number;
 }
 export declare class DefaultAgentPolicy implements AgentPolicy {
     private _minToolCalls;
@@ -242,8 +317,10 @@ export declare class DefaultAgentPolicy implements AgentPolicy {
     private _recovery;
     private _budget;
     private _terminalToolName;
+    private _maxToolRetries;
     private _startTime;
     constructor(opts?: DefaultAgentPolicyOpts);
+    onToolRetry(_agent: Agent, _tool: string, _error: ToolRetryError, attempt: number): ToolRetryAction;
     /**
      * Elapsed wall time for *this agent* (since its first idle→active transition),
      * falling back to the policy's own construction time when the agent hasn't

package/dist/AgentPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AgentPolicy.d.ts","sourceRoot":"","sources":["../src/AgentPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAuBlD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,wGAAwG;IACxG,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,EAAE,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACrG,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,eAAO,MAAM,iBAAiB,EAAE,SAAS,EAsBxC,CAAC;AAIF;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,mBAAmB,GACnB,kBAAkB,GAClB,wBAAwB,GACxB,oBAAoB,GACpB,WAAW,GACX,gBAAgB,GAChB,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,cAAc,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAIrB;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,UAAU,CACR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,cAAc,EAAE,CAAA;KAAE,EAC/D,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,aAAa,CAAC;IAEjB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CACZ,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,YAAY,CAAC;IAEhB;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC;IAEjE;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAEjD;;;;OAIG;IACH,SAAS,CAAC,IAAI,IAAI,CAAC;IAEnB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,cAAc,CAAC;CACtE;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;CAC9B;AAID;;;;;;;;GAQG;AACH;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4CAA4C;IAC5C,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,gDAAgD;IAChD,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE;QACd;;4DAEoD;QACpD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;wEAGgE;QAChE,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF;uEACmE;IACnE,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,2EAA2E;QAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,6EAA6E;QAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF;;kFAE8E;IAC9E,MAAM,CAAC,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACrD,mDAAmD;QACnD,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACnD,CAAC;IACF;;iEAE6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,OAAO,CAA0C;IACzD,OAAO,CAAC,iBAAiB,CAAgB;IACzC,OAAO,CAAC,UAAU,CAAS;gBAEf,IAAI,CAAC,EAAE,sBAAsB;IAczC;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ;IAKhB;yCACqC;IACrC,IAAI,kBAAkB,IAAI,kBAAkB,CAO3C;IAED,UAAU,CACR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,cAAc,EAAE,CAAA;KAAE,EAC/D,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,aAAa;IAqBhB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,YAAY;IAYpB,cAAc,CACZ,KAAK,EAAE,KAAK,EACZ,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,YAAY;IAUf;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAEpC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO;IAiB5D,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO;IAY/D;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,eAAe,CAAS;IAEhC,SAAS,IAAI,IAAI;IAKjB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,cAAc;CAuBpE"}
+{"version":3,"file":"AgentPolicy.d.ts","sourceRoot":"","sources":["../src/AgentPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAuBlD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,SAAS;IACxB,kEAAkE;IAClE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACtB,sCAAsC;IACtC,MAAM,EAAE,CACN,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,cAAc,EAAE,gBAAgB,EAAE,EAClC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,YAAY,KACjB,OAAO,CAAC;IACb,6DAA6D;IAC7D,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAOD,eAAO,MAAM,iBAAiB,EAAE,SAAS,EA0CxC,CAAC;AAIF;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB,UAAU,GACV,mBAAmB,GACnB,kBAAkB,GAClB,wBAAwB,GACxB,oBAAoB,GACpB,WAAW,GACX,gBAAgB,GAChB,YAAY,CAAC;AAEjB;;;GAGG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,cAAc,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AACpC;;iDAEiD;GAC/C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;GAGG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC;AAEzC;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC7D;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAIvC;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;;;OAMG;IACH,UAAU,CACR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,cAAc,EAAE,CAAA;KAAE,EAC/D,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,aAAa,CAAC;IAEjB;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CACZ,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,YAAY,CAAC;IAEhB;;;;;;;OAOG;IACH,aAAa,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC;IAEjE;;;;;;;;;;;;OAYG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAEjD;;;;OAIG;IACH,SAAS,CAAC,IAAI,IAAI,CAAC;IAEnB;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,cAAc,CAAC;IAErE;;;;;;;;;;OAUG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe,CAAC;CACnG;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC9B;AAID;;;;;;;;GAQG;AACH;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4CAA4C;IAC5C,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC;IACrB,gDAAgD;IAChD,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;IAC1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE;QACd;;4DAEoD;QACpD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB;;;wEAGgE;QAChE,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF;uEACmE;IACnE,QAAQ,CAAC,EAAE;QACT,MAAM,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC;QACzC,2EAA2E;QAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,6EAA6E;QAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF;;kFAE8E;IAC9E,MAAM,CAAC,EAAE;QACP,4CAA4C;QAC5C,OAAO,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACrD,mDAAmD;QACnD,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACnD,CAAC;IACF;;iEAE6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sEACkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,kBAAmB,YAAW,WAAW;IACpD,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,OAAO,CAAc;IAC7B,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,OAAO,CAA0C;IACzD,OAAO,CAAC,iBAAiB,CAAgB;IACzC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAS;gBAEf,IAAI,CAAC,EAAE,sBAAsB;IAezC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,GAAG,eAAe;IAInG;;;;;;;;OAQG;IACH,OAAO,CAAC,QAAQ;IAKhB;yCACqC;IACrC,IAAI,kBAAkB,IAAI,kBAAkB,CAO3C;IAED,UAAU,CACR,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,cAAc,EAAE,CAAA;KAAE,EAC/D,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,aAAa;IAqBhB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,iBAAiB;IA2BzB,OAAO,CAAC,YAAY;IAcpB,cAAc,CACZ,KAAK,EAAE,KAAK,EACZ,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,GACnB,YAAY;IAUf;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAEpC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO;IAiB5D,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO;IAY/D;;;;;OAKG;IACH,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,eAAe,CAAS;IAEhC,SAAS,IAAI,IAAI;IAKjB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,GAAG,cAAc;CAuBpE"}

package/dist/AgentPolicy.js

@@ -29,6 +29,26 @@ function parseHistoryArgs(argsStr) {
     }
 }
 exports.defaultToolGuards = [
+    // Framework-injected authGuard. Runs FIRST so a
+    // protected-tool rejection fires before any dedup guard — the pool
+    // emits a structured `tool:authReject` event keyed off
+    // `ProduceAction.nudge.guard === 'auth_reject'` for security
+    // observability. Reads/gather tools are OPEN: the guard only fires for
+    // a `protected` tool (in `config.protectedTools`) the session has not
+    // been granted (`config.grants`). When no tools are protected — the
+    // common case — this is a no-op.
+    {
+        name: 'auth_reject',
+        tools: '*',
+        reject: (_args, _history, _agent, toolName, config) => {
+            if (!config.protectedTools?.has(toolName))
+                return false; // open by default
+            return !config.grants?.has(toolName); // protected → deny unless granted
+        },
+        message: 'This action is protected and requires authorization that has not been ' +
+            'granted for this session. Use the available read tools to gather what ' +
+            'you can, and report what blocks completion.',
+    },
     {
         tools: ['fetch_page'],
         reject: (args, history) => {
@@ -58,6 +78,7 @@ class DefaultAgentPolicy {
     _recovery;
     _budget;
     _terminalToolName;
+    _maxToolRetries;
     _startTime;
     constructor(opts) {
         this._minToolCalls = opts?.minToolCallsBeforeReturn ?? 2;
@@ -70,8 +91,12 @@ class DefaultAgentPolicy {
         this._recovery = opts?.recovery ?? null;
         this._budget = opts?.budget ?? null;
         this._terminalToolName = opts?.terminalToolName ?? null;
+        this._maxToolRetries = opts?.maxToolRetries ?? 1;
         this._startTime = performance.now();
     }
+    onToolRetry(_agent, _tool, _error, attempt) {
+        return attempt <= this._maxToolRetries ? { type: 'retry' } : { type: 'fail' };
+    }
     /**
      * Elapsed wall time for *this agent* (since its first idle→active transition),
      * falling back to the policy's own construction time when the agent hasn't
@@ -109,7 +134,7 @@ class DefaultAgentPolicy {
         // guard — stuck agents (same query repeated past maxTurns) saw only
         // turn-limit nudges instead of the dedup message that named the
         // actual problem (see trace-1776819196054 agent 65539).
-        const guardRejection = this._checkGuards(tc, agent);
+        const guardRejection = this._checkGuards(tc, agent, config);
         if (guardRejection)
             return guardRejection;
         if (this._isOverBudget(agent, tc, pressure, config))
@@ -173,7 +198,7 @@ class DefaultAgentPolicy {
         }
         return { type: 'idle', reason: agent.turns >= config.maxTurns ? 'max_turns' : 'pressure_softcut' };
     }
-    _checkGuards(tc, agent) {
+    _checkGuards(tc, agent, config) {
         const lineageHistory = agent.walkAncestors(a => a.toolHistory);
         let toolArgs;
         try {
@@ -183,8 +208,11 @@ class DefaultAgentPolicy {
             toolArgs = {};
         }
         for (const guard of this._guards) {
-            if (guard.tools.includes(tc.name) && guard.reject(toolArgs, lineageHistory, agent)) {
-                return { type: 'nudge', message: guard.message };
+            const applies = guard.tools === '*' || guard.tools.includes(tc.name);
+            if (!applies)
+                continue;
+            if (guard.reject(toolArgs, lineageHistory, agent, tc.name, config)) {
+                return { type: 'nudge', message: guard.message, guard: guard.name };
             }
         }
         return null;

package/dist/AgentPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"AgentPolicy.js","sourceRoot":"","sources":["../src/AgentPolicy.ts"],"names":[],"mappings":";;;AACA,6CAA+C;AAG/C,qCAA0C;AAE1C,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,oDAAoD;AACpD,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC;AAmBD,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC1D,CAAC;AAEY,QAAA,iBAAiB,GAAgB;IAC5C;QACE,KAAK,EAAE,CAAC,YAAY,CAAC;QACrB,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAyB,CAAC;YAC3C,OAAO,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/B,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,uDAAuD;KACjE;IACD;QACE,KAAK,EAAE,CAAC,YAAY,CAAC;QACrB,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,KAAK,GAAI,IAAI,CAAC,KAA4B,EAAE,WAAW,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACjC,MAAM,IAAI,GAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAA4B,EAAE,WAAW,EAAE,CAAC;gBACnF,OAAO,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,KAAK,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,yEAAyE;KACnF;CACF,CAAC;AA+NF,MAAa,kBAAkB;IACrB,aAAa,CAAS;IACtB,OAAO,CAAc;IACrB,eAAe,CAAS;IACxB,YAAY,CAAS;IACrB,aAAa,GAAG,KAAK,CAAC;IACtB,SAAS,CAA4C;IACrD,OAAO,CAA0C;IACjD,iBAAiB,CAAgB;IACjC,UAAU,CAAS;IAE3B,YAAY,IAA6B;QACvC,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,wBAAwB,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,IAAI,GAAG,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,GAAG,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,IAAI;YAC7B,GAAG,yBAAiB;YACpB,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;SAC7B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,iBAAiB,GAAG,IAAI,EAAE,gBAAgB,IAAI,IAAI,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CAAC,KAAa;QAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QACpD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,CAAC;IAED;yCACqC;IACrC,IAAI,kBAAkB;QACpB,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS;mBACtC,4BAAe,CAAC,kBAAkB;YACvC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS;mBACtC,4BAAe,CAAC,kBAAkB;SACxC,CAAC;IACJ,CAAC;IAED,UAAU,CACR,KAAY,EACZ,MAA+D,EAC/D,QAAyB,EACzB,MAAoB;QAEpB,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnG,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,wDAAwD;QACxD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChH,mBAAmB;QACnB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,0DAA0D;IAElD,iBAAiB,CACvB,KAAY,EAAE,MAAkC;QAEhD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpD,CAAC;IAEO,eAAe,CAAC,EAAkB,EAAE,MAAoB;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5E,CAAC;IAEO,mBAAmB,CACzB,EAAkB,EAAE,KAAY,EAAE,MAAoB,EAAE,QAAyB;QAEjF,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC;QAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAEO,gBAAgB,CAAC,KAAY,EAAE,QAAyB,EAAE,MAAoB;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;QACvE,OAAO,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,SAAS,CAAC;IAC9E,CAAC;IAEO,aAAa,CAAC,KAAY,EAAE,EAAkB,EAAE,QAAyB,EAAE,MAAoB;QACrG,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,aAAa,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAEO,iBAAiB,CACvB,KAAY,EAAE,EAAkB,EAAE,QAAyB,EAAE,MAAoB;QAEjF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;QAEvE,IAAI,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC5B,iEAAiE;gBACjE,wEAAwE;gBACxE,iEAAiE;gBACjE,kEAAkE;gBAClE,yCAAyC;gBACzC,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC1E,MAAM,GAAG,GAAG,SAAS;oBACnB,CAAC,CAAC,wDAAwD,KAAK,SAAS;oBACxE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ;wBAC9B,CAAC,CAAC,wDAAwD,KAAK,SAAS;wBACxE,CAAC,CAAC,wDAAwD,KAAK,SAAS,CAAC;gBAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACrG,CAAC;IAEO,YAAY,CAAC,EAAkB,EAAE,KAAY;QACnD,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,QAAQ,GAAG,EAAE,CAAC;QAAC,CAAC;QACrE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CACZ,KAAY,EACZ,aAAqB,EACrB,QAAyB,EACzB,MAAoB;QAEpB,wDAAwD;QACxD,IAAI,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2EAA2E,KAAK,SAAS,EAAE,CAAC;QAC/H,CAAC;QACD,yBAAyB;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAsC,EAAE,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,KAAc,IAAU,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC;IAEpE,UAAU,CAAC,KAAY,EAAE,QAAyB;QAChD,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE/G,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;YAC/C,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAY,EAAE,QAAyB;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,SAAS,GACb,QAAQ,CAAC,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;QACpD,MAAM,MAAM,GACV,aAAa,IAAI,IAAI;YACnB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/D,OAAO,SAAS,IAAI,MAAM,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACK,eAAe,GAAG,KAAK,CAAC;IACxB,eAAe,GAAG,KAAK,CAAC;IAEhC,SAAS;QACP,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,KAAY,EAAE,QAAyB;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS,IAAI,KAAK,CAAC,aAAa,GAAG,YAAY,EAAE,CAAC;YACvE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,yBAAyB,GAAG,YAAY,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE;gBACN,MAAM,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;gBAC1D,IAAI,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;aACvD;SACF,CAAC;IACJ,CAAC;CACF;AA9OD,gDA8OC"}
+{"version":3,"file":"AgentPolicy.js","sourceRoot":"","sources":["../src/AgentPolicy.ts"],"names":[],"mappings":";;;AAEA,6CAA+C;AAG/C,qCAA0C;AAE1C,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,oDAAoD;AACpD,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,YAAoB;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAChE,CAAC;AA8CD,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC1D,CAAC;AAEY,QAAA,iBAAiB,GAAgB;IAC5C,gDAAgD;IAChD,mEAAmE;IACnE,uDAAuD;IACvD,6DAA6D;IAC7D,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,iCAAiC;IACjC;QACE,IAAI,EAAE,aAAa;QACnB,KAAK,EAAE,GAAG;QACV,MAAM,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE;YACpD,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;YAC3E,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,kCAAkC;QAC1E,CAAC;QACD,OAAO,EACL,wEAAwE;YACxE,wEAAwE;YACxE,6CAA6C;KAChD;IACD;QACE,KAAK,EAAE,CAAC,YAAY,CAAC;QACrB,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAyB,CAAC;YAC3C,OAAO,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/B,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,CAChE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,uDAAuD;KACjE;IACD;QACE,KAAK,EAAE,CAAC,YAAY,CAAC;QACrB,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE;YACxB,MAAM,KAAK,GAAI,IAAI,CAAC,KAA4B,EAAE,WAAW,EAAE,CAAC;YAChE,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;gBACjC,MAAM,IAAI,GAAI,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAA4B,EAAE,WAAW,EAAE,CAAC;gBACnF,OAAO,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,KAAK,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,yEAAyE;KACnF;CACF,CAAC;AAgRF,MAAa,kBAAkB;IACrB,aAAa,CAAS;IACtB,OAAO,CAAc;IACrB,eAAe,CAAS;IACxB,YAAY,CAAS;IACrB,aAAa,GAAG,KAAK,CAAC;IACtB,SAAS,CAA4C;IACrD,OAAO,CAA0C;IACjD,iBAAiB,CAAgB;IACjC,eAAe,CAAS;IACxB,UAAU,CAAS;IAE3B,YAAY,IAA6B;QACvC,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,wBAAwB,IAAI,CAAC,CAAC;QACzD,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,aAAa,EAAE,OAAO,IAAI,GAAG,CAAC;QAC3D,IAAI,CAAC,YAAY,GAAG,IAAI,EAAE,aAAa,EAAE,IAAI,IAAI,GAAG,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,IAAI;YAC7B,GAAG,yBAAiB;YACpB,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,EAAE,CAAC;SAC7B,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;QACpC,IAAI,CAAC,iBAAiB,GAAG,IAAI,EAAE,gBAAgB,IAAI,IAAI,CAAC;QACxD,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,cAAc,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;IAED,WAAW,CAAC,MAAa,EAAE,KAAa,EAAE,MAAsB,EAAE,OAAe;QAC/E,OAAO,OAAO,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChF,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CAAC,KAAa;QAC5B,MAAM,OAAO,GAAG,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC;QACpD,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACrC,CAAC;IAED;yCACqC;IACrC,IAAI,kBAAkB;QACpB,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS;mBACtC,4BAAe,CAAC,kBAAkB;YACvC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS;mBACtC,4BAAe,CAAC,kBAAkB;SACxC,CAAC;IACJ,CAAC;IAED,UAAU,CACR,KAAY,EACZ,MAA+D,EAC/D,QAAyB,EACzB,MAAoB;QAEpB,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnG,kEAAkE;QAClE,kEAAkE;QAClE,qEAAqE;QACrE,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,gEAAgE;QAChE,wDAAwD;QACxD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,cAAc;YAAE,OAAO,cAAc,CAAC;QAC1C,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChH,mBAAmB;QACnB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,0DAA0D;IAElD,iBAAiB,CACvB,KAAY,EAAE,MAAkC;QAEhD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACpD,CAAC;IAEO,eAAe,CAAC,EAAkB,EAAE,MAAoB;QAC9D,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5E,CAAC;IAEO,mBAAmB,CACzB,EAAkB,EAAE,KAAY,EAAE,MAAoB,EAAE,QAAyB;QAEjF,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,MAAM,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,EAAE,CAAC,SAAS,CAAC;QAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAEO,gBAAgB,CAAC,KAAY,EAAE,QAAyB,EAAE,MAAoB;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;QACvE,OAAO,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC,IAAI,SAAS,CAAC;IAC9E,CAAC;IAEO,aAAa,CAAC,KAAY,EAAE,EAAkB,EAAE,QAAyB,EAAE,MAAoB;QACrG,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACrE,OAAO,aAAa,IAAI,CAAC,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC5F,CAAC;IAEO,iBAAiB,CACvB,KAAY,EAAE,EAAkB,EAAE,QAAyB,EAAE,MAAoB;QAEjF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;QAC/C,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC;QAEvE,IAAI,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC7E,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC5B,iEAAiE;gBACjE,wEAAwE;gBACxE,iEAAiE;gBACjE,kEAAkE;gBAClE,yCAAyC;gBACzC,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;gBAC1E,MAAM,GAAG,GAAG,SAAS;oBACnB,CAAC,CAAC,wDAAwD,KAAK,SAAS;oBACxE,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ;wBAC9B,CAAC,CAAC,wDAAwD,KAAK,SAAS;wBACxE,CAAC,CAAC,wDAAwD,KAAK,SAAS,CAAC;gBAC7E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;IACrG,CAAC;IAEO,YAAY,CAAC,EAAkB,EAAE,KAAY,EAAE,MAAoB;QACzE,MAAM,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC/D,IAAI,QAAiC,CAAC;QACtC,IAAI,CAAC;YAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,QAAQ,GAAG,EAAE,CAAC;QAAC,CAAC;QACrE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YACtE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CACZ,KAAY,EACZ,aAAqB,EACrB,QAAyB,EACzB,MAAoB;QAEpB,wDAAwD;QACxD,IAAI,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,2EAA2E,KAAK,SAAS,EAAE,CAAC;QAC/H,CAAC;QACD,yBAAyB;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,wBAAsC,EAAE,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,cAAc,CAAC,KAAc,IAAU,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC;IAEpE,UAAU,CAAC,KAAY,EAAE,QAAyB;QAChD,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,IAAI,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,iBAAiB,IAAI,CAAC,QAAQ,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAE/G,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;YAC/C,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACtE,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QACvC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAY,EAAE,QAAyB;QACnD,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,SAAS,GACb,QAAQ,CAAC,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC;QACpD,MAAM,MAAM,GACV,aAAa,IAAI,IAAI;YACnB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC;QAC/D,OAAO,SAAS,IAAI,MAAM,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACK,eAAe,GAAG,KAAK,CAAC;IACxB,eAAe,GAAG,KAAK,CAAC;IAEhC,SAAS;QACP,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED,UAAU,CAAC,KAAY,EAAE,QAAyB;QAChD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,GAAG,CAAC;QAClD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS,IAAI,KAAK,CAAC,aAAa,GAAG,YAAY,EAAE,CAAC;YACvE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,GAAG,yBAAyB,GAAG,YAAY,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE;gBACN,MAAM,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC;gBAC1D,IAAI,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;aACvD;SACF,CAAC;IACJ,CAAC;CACF;AAtPD,gDAsPC"}

package/dist/Tool.d.ts

@@ -47,6 +47,28 @@ export declare abstract class Tool<TArgs = Record<string, unknown>> {
     abstract readonly description: string;
     /** JSON Schema describing the tool's expected arguments */
     abstract readonly parameters: JsonSchema;
+    /**
+     * Whether invoking this tool requires authorization.
+     *
+     * **Open by default** (`false`/unset): any agent may call the tool. This
+     * is the right setting for read/gather tools — search, fetch, grep — where
+     * agents discover an app's coverage by *trying*, the frontier-agentic
+     * pattern. The spine loads every app's tools for KV amortization; an open
+     * tool is callable regardless of which app a spawn nominally belongs to.
+     *
+     * **Protected** (`true`): the tool mutates state or takes a consequential
+     * action (transfer funds, file a ticket, send a message). The framework's
+     * authGuard denies the call unless the session holds a **grant** for it
+     * (held in {@link GrantStoreCtx}, acquired via consent — the model never
+     * sees the credential). A denied attempt rejects at dispatch time and
+     * emits `tool:authReject`.
+     *
+     * Trust changes *which grants a session holds*, never tool behaviour:
+     * execution is identical for trusted and untrusted apps. An app MAY mark
+     * an exfiltration-capable "read" (one that fetches arbitrary URLs) as
+     * protected — the binary flag delegates that judgment to the app.
+     */
+    readonly protected?: boolean;
     /**
      * Execute the tool with parsed arguments
      *
@@ -86,4 +108,26 @@ export declare abstract class Tool<TArgs = Record<string, unknown>> {
      */
     get schema(): ToolSchema;
 }
+/**
+ * Thrown by a tool (or its backend provider) when the operation failed
+ * transiently and should be retried after a delay — rate limiting being the
+ * canonical case.
+ *
+ * The pool's DISPATCH phase catches this BEFORE the generic tool-error
+ * handler: instead of settling an error into the agent's KV, it parks the
+ * agent (`awaiting_tool` — skipped by PRODUCE at zero cost) and re-executes
+ * the same call after `retryAfterMs`. The model never sees transient
+ * infrastructure weather in its context; from its side the tool call just
+ * took longer. One retry is budgeted — a second ToolRetryError settles an
+ * honest "unavailable, use other sources" result, because at that point the
+ * outage is a fact the model needs in order to pivot.
+ *
+ * Observability: the pool emits `agent:tool_retry` (TUI) and `tool:retry`
+ * (trace) when parking, so a waiting agent is never mistaken for a hung one.
+ */
+export declare class ToolRetryError extends Error {
+    readonly retryAfterMs: number;
+    readonly name = "ToolRetryError";
+    constructor(message: string, retryAfterMs: number);
+}
 //# sourceMappingURL=Tool.d.ts.map

package/dist/Tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Tool.d.ts","sourceRoot":"","sources":["../src/Tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,8BAAsB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxD,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEzC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;IAExE;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAEtC;;;;;;OAMG;IACH,IAAI,MAAM,IAAI,UAAU,CASvB;CACF"}
+{"version":3,"file":"Tool.d.ts","sourceRoot":"","sources":["../src/Tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,8BAAsB,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACxD,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEzC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;IAExE;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAEtC;;;;;;OAMG;IACH,IAAI,MAAM,IAAI,UAAU,CASvB;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,cAAe,SAAQ,KAAK;IAEV,QAAQ,CAAC,YAAY,EAAE,MAAM;IAD1D,SAAkB,IAAI,oBAAoB;gBAC9B,OAAO,EAAE,MAAM,EAAW,YAAY,EAAE,MAAM;CAG3D"}

package/dist/Tool.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Tool = void 0;
+exports.ToolRetryError = exports.Tool = void 0;
 /**
  * Abstract base class for tools usable by agents in the runtime
  *
@@ -42,6 +42,28 @@ exports.Tool = void 0;
  * @category Agents
  */
 class Tool {
+    /**
+     * Whether invoking this tool requires authorization.
+     *
+     * **Open by default** (`false`/unset): any agent may call the tool. This
+     * is the right setting for read/gather tools — search, fetch, grep — where
+     * agents discover an app's coverage by *trying*, the frontier-agentic
+     * pattern. The spine loads every app's tools for KV amortization; an open
+     * tool is callable regardless of which app a spawn nominally belongs to.
+     *
+     * **Protected** (`true`): the tool mutates state or takes a consequential
+     * action (transfer funds, file a ticket, send a message). The framework's
+     * authGuard denies the call unless the session holds a **grant** for it
+     * (held in {@link GrantStoreCtx}, acquired via consent — the model never
+     * sees the credential). A denied attempt rejects at dispatch time and
+     * emits `tool:authReject`.
+     *
+     * Trust changes *which grants a session holds*, never tool behaviour:
+     * execution is identical for trusted and untrusted apps. An app MAY mark
+     * an exfiltration-capable "read" (one that fetches arbitrary URLs) as
+     * protected — the binary flag delegates that judgment to the app.
+     */
+    protected;
     /**
      * Optional reasoning probe prefilled after this tool's result settles.
      *
@@ -75,4 +97,30 @@ class Tool {
     }
 }
 exports.Tool = Tool;
+/**
+ * Thrown by a tool (or its backend provider) when the operation failed
+ * transiently and should be retried after a delay — rate limiting being the
+ * canonical case.
+ *
+ * The pool's DISPATCH phase catches this BEFORE the generic tool-error
+ * handler: instead of settling an error into the agent's KV, it parks the
+ * agent (`awaiting_tool` — skipped by PRODUCE at zero cost) and re-executes
+ * the same call after `retryAfterMs`. The model never sees transient
+ * infrastructure weather in its context; from its side the tool call just
+ * took longer. One retry is budgeted — a second ToolRetryError settles an
+ * honest "unavailable, use other sources" result, because at that point the
+ * outage is a fact the model needs in order to pivot.
+ *
+ * Observability: the pool emits `agent:tool_retry` (TUI) and `tool:retry`
+ * (trace) when parking, so a waiting agent is never mistaken for a hung one.
+ */
+class ToolRetryError extends Error {
+    retryAfterMs;
+    name = 'ToolRetryError';
+    constructor(message, retryAfterMs) {
+        super(message);
+        this.retryAfterMs = retryAfterMs;
+    }
+}
+exports.ToolRetryError = ToolRetryError;
 //# sourceMappingURL=Tool.js.map

package/dist/Tool.js.map

@@ -1 +1 @@
-{"version":3,"file":"Tool.js","sourceRoot":"","sources":["../src/Tool.ts"],"names":[],"mappings":";;;AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAsB,IAAI;IAyBxB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAgB,IAAmB,OAAO,IAAI,CAAC,CAAC,CAAC;IAEvD;;;;;;OAMG;IACH,IAAI,MAAM;QACR,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC;IACJ,CAAC;CACF;AAzDD,oBAyDC"}
+{"version":3,"file":"Tool.js","sourceRoot":"","sources":["../src/Tool.ts"],"names":[],"mappings":";;;AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAsB,IAAI;IAQxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACM,SAAS,CAAW;IAmB7B;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAgB,IAAmB,OAAO,IAAI,CAAC,CAAC,CAAC;IAEvD;;;;;;OAMG;IACH,IAAI,MAAM;QACR,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC;IACJ,CAAC;CACF;AAhFD,oBAgFC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAa,cAAe,SAAQ,KAAK;IAED;IADpB,IAAI,GAAG,gBAAgB,CAAC;IAC1C,YAAY,OAAe,EAAW,YAAoB;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QADqB,iBAAY,GAAZ,YAAY,CAAQ;IAE1D,CAAC;CACF;AALD,wCAKC"}

package/dist/agent-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-pool.d.ts","sourceRoot":"","sources":["../src/agent-pool.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAA+G,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAYpK,OAAO,KAAK,EACV,kBAAkB,EAElB,gBAAgB,EAChB,eAAe,EACf,UAAU,EAEX,MAAM,SAAS,CAAC;AAsBjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBAAa,eAAe;IAC1B,kEAAkE;IAClE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,QAAQ;IAC1C;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,OAAO;IACzC;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,eAAe,OAAO;IAEtC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,kBAAkB;IAS1D;;;;OAIG;IACH,IAAI,QAAQ,IAAI,MAAM,CAA4C;IAElE,qEAAqE;IACrE,IAAI,QAAQ,IAAI,OAAO,CAA4C;IAEnE,iEAAiE;IACjE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAEnC;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,MAAM,CAI7B;CACF;AAoRD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CA2uBzG"}
+{"version":3,"file":"agent-pool.d.ts","sourceRoot":"","sources":["../src/agent-pool.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAA0F,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAY/I,OAAO,KAAK,EACV,kBAAkB,EAElB,gBAAgB,EAChB,eAAe,EACf,UAAU,EAEX,MAAM,SAAS,CAAC;AAsBjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,qBAAa,eAAe;IAC1B,kEAAkE;IAClE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,QAAQ;IAC1C;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,kBAAkB,OAAO;IACzC;;;;;OAKG;IACH,MAAM,CAAC,QAAQ,CAAC,eAAe,OAAO;IAEtC,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,EAAE,kBAAkB;IAS1D;;;;OAIG;IACH,IAAI,QAAQ,IAAI,MAAM,CAA4C;IAElE,qEAAqE;IACrE,IAAI,QAAQ,IAAI,OAAO,CAA4C;IAEnE,iEAAiE;IACjE,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAEnC;;;;;OAKG;IACH,IAAI,gBAAgB,IAAI,MAAM,CAI7B;CACF;AA6SD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAs4BzG"}