@meantjs/tools 0.0.0-stage → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog: @meantjs/tools
+
+The five Candid Profile library packages (`@meantjs/profile`, `/format`, `/consent`, `/tools`, `/reconcile`) release together under one version and pin each other exactly; a version appears here even when this package did not change. Release steps: `docs/releasing.md` in the repository.
+
+## 0.2.0 — 2026-10-28
+
+- One tool per case (D-053): a method whose single argument is a variant with an `intent` or an `effect` on any case
+  gets `<method>_<Case>` (a read) or `prepare_<method>_<Case>` for each case, instead of one tool for the method. The
+  plan carries `case`; `caseToolName` is exported. Resolved forms without case tags give the same tools as before.
+- An EVM contract's resolved form (`"chain": "evm"`, spec §15) is refused with a `TypeError`: its tools need nonces
+  and receipts, a later phase.
+- Types: `ToolDefinition.inputSchema.properties` is `Record<string, JsonSchemaInput>`, not strings only. Since
+  0.1.0 (D-050) a record, variant or vec input is one JSON input whose schema is an object, a `oneOf` of
+  `{ tag, value }` cases or an array; the new exported types `JsonSchemaObject`, `JsonSchemaVariant`,
+  `JsonSchemaCase`, `JsonSchemaArray` and `JsonSchemaNull` say so. The generated schemas do not change.
+
+## 0.1.0 — 2026-10-28
+
+First published version.
+
+Published under the `@meantjs` scope (D-051). Before any release, this package was `@candid-core/profile-tools`.
+
+- Named inputs (spec §5.3, D-045): where a profile tags a position `named`, a tool takes a name of that set as well as
+  a value. The layer reads the set from the canister when the call is prepared (once per intent), resolves the name
+  by `resolveName` (`E_NAME_NOT_FOUND`, `E_NAME_AMBIGUOUS`, `E_NAMES_UNREAD`), treats a name and the value it stands
+  for as one intent, and shows the name beside the value in previews. `nameEntries` reads a set's entries from a reply of the method
+  that lists it, as the layer does.
+- Agent tools from any resolved form: one tool per query method, `prepare_<method>` per update method and `commit`,
+  with MCP tool definitions (`toolDefinitions`) and exact input reading in human units (`readToolInput`).
+- `createToolLayer`: a confirmation hook awaited before every send, an injected encoder, call and clock, idempotent
+  commits, classified outcomes and an optional reconcile hook after an unknown outcome.
+- No Node built-in: runs in browsers. `displayValue` shows bytes from another realm as it shows this realm's.
+- A `principal` position with no value tag is an input in its textual form (checksum checked, canonical text out),
+  so a method that takes a principal gets a tool instead of being skipped.
+- Interfaces beyond the ICRC packs (B2 of `docs/proposals/w9-b3wallet-gaps.md`; the packs' tools do not change): an
+  integer position with a `describe` and no value tag is an input of decimal digits; a read-only update
+  (`replicated: true`) is a read tool sent as an update call; an update without `idempotency` gets a prepare tool and
+  is never sent again after an unknown outcome; outcome keys may pass through record fields; a method with more than
+  one argument takes each as an input (`arg0`, `arg1`, ...).
+- `encode` gets a third argument and `call` a field, `args`: the whole argument tuple. Encode it; `value` stays the
+  single argument (for a method with more than one, the tuple).
+- A query or read-only update with no answer, or refused, says that nothing was read (it said to commit a preview).
+- More readers (D-050, proposal `docs/proposals/w6-adoption.md` items 2 and 3): a `text` position is an input of the
+  text as given, within its `text` tag (`max_len`, `pattern`, `format`) and `range` lengths, and at most 1024
+  characters without a tag; a pattern the layer will not run (over 256 characters, not valid with the `u` flag, a
+  back reference, a lookaround, a repeated repeating group) skips the method with that reason. A `bool` position is
+  `"true"` or `"false"`. A record, variant or `vec` that no value tag reads is one JSON input whose leaves are read by
+  their own rules (`{ "tag": …, "value": … }` for a variant case; at most 256 elements in a `vec` and 4096 values in
+  one input), with issue paths into it (`$args[0].command.Follow.followees[1].id`) and a matching JSON Schema. A lone
+  `null` or `reserved` argument takes no input. An `outcome` with `default` alone classifies every reply of a method
+  with any result. Methods skipped before may now get tools; the packs' tools do not change.
+- TypeScript declarations.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,77 @@
-# Temporary Holding Version
+# @meantjs/tools
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Agent tools from any Candid Profile resolved form, for an app or an agent host: MCP tool definitions, input reading in human units, a preview that a person confirms before every send, and the retry and reconcile rules of spec section 7.3. The design and the readings it takes on open questions are in `docs/proposals/w3b-tools-package.md` in the repository; the eval's own tool arm (arm C) is a separate, frozen copy.
+
+```sh
+npm install @meantjs/tools
+```
+
+- **Runs on:** Node 22 or later and browsers: no `node:*` import, no `Buffer`, no `process` (a test bundles it for the
+  browser with esbuild).
+- **Module format:** ES modules only, with hand-written TypeScript declarations for every entry.
+- **Spec:** [Candid Profile v0](https://github.com/B3Pay/Meant/blob/main/profile/docs/profile-v0.md). **Licence:** Apache-2.0.
+- **Versions:** the five Candid Profile packages (`@meantjs/profile`, `/format`, `/consent`, `/tools`,
+  `/reconcile`) release together under one version and pin each other exactly; in 0.x a minor is breaking,
+  and so is any change to generated text ([releasing](https://github.com/B3Pay/Meant/blob/main/profile/docs/releasing.md)).
+
+## API
+
+```js
+import { createToolLayer, toolDefinitions, readToolInput, buildToolPlans } from "@meantjs/tools";
+
+const canisters = [{ id: "ryjl3-tyaaa-aaaaa-aaaba-cai", label: "TKA", refs: { "query:icrc1_decimals": 8, "query:icrc1_symbol": "TKA" } }];
+
+toolDefinitions([icrc1Resolved, icrc2Resolved], { canisters }); // MCP tool definitions, sorted by name
+
+const layer = createToolLayer({
+  resolved: [icrc1Resolved, icrc2Resolved],
+  canisters,
+  encode: (method, value, args) => encodeArgs(methods.get(method).args, args).bytes, // candid-core's encoder
+  call: async ({ canister, method, mode, arg, value, args }) => ({ status: "replied", reply }), // or rejected / unknown
+  now: async ({ canister }) => canisterTimeNs,           // that canister's clock, bigint ns
+  confirm: async (preview) => askThePerson(preview),     // awaited before every send
+  reconcile: async ({ canister, method, value, stamp }) => ({ status: "absent" }), // optional, consumer rule 1
+});
+await layer.callTool("prepare_icrc1_transfer", { canister_id: canisters[0].id, to: "…", amount: "1.5 TKA" });
+await layer.callTool("commit", { preview_id: "p1" });
+```
+
+- **Tools.** One per query method (named as the method), one `prepare_<method>` per update method, and `commit`, with arm C's rules for which positions are inputs (a value-tagged position is a text input in human units; the idempotency stamp, `auto` defaults and `ui.hidden` positions are filled by the layer). On the pack fixtures the tools, their inputs and their required sets equal `armCToolDefinitions()` (tested). Beyond arm C, for interfaces the packs do not cover (the last five are items 1, 2, 4, 5 and 6 of B2 in `docs/proposals/w9-b3wallet-gaps.md`; the packs meet none of them, so their tools do not change):
+  - **A principal.** A `principal` position with no value tag is a text input in the principal's textual form. It has exactly one, with a checksum, so it is read exactly without a profile tag (spec 5.3 has none for it): the input is trimmed, its case ignored, its checksum checked (`E_PRINCIPAL`), and the value is the canonical text. Its schema gives the grammar, two examples and a `pattern`, and a `describe` label goes in front as for any input.
+  - **An integer the profile describes.** An integer position (`nat`, `int` and their sized forms) with no value tag but a `describe` is a text input of decimal digits, read as they are: trimmed, no unit, separators, exponent, `+` or leading zeros (`E_SYNTAX`), within the Candid type's bounds (`E_RANGE`); a whole argument of this kind is the input `integer`. The words say what the number is (an action id, a page size), so an integer without a `describe` still has no rule.
+  - **A read-only update** (`effect: { kind: "read", irreversible: false, replicated: true }`, D-038) is a read tool named as the method, sent once as an update call (`call` gets `mode: "update"`), so that the answer is certified; no preview, no confirmation. With an idempotency stamp it is skipped.
+  - **An update without `idempotency`** gets a prepare tool too, whose description says it has no stamp. Its first send is like any other; after an unknown outcome it is never sent again (spec 5.3: without the tag, an update with unknown outcome is not retried automatically), see `reconcile` below. With an outcome class `retry_new`, which renews a stamp, it is skipped.
+  - **Outcome keys through record fields.** A key may pass through a record field to a case (`Ok.state.Failed`). The classifier follows the reply's cases and, at a record, the field the keys read there; a key that names no case or field, ends on a field, or reads another field of a record than an earlier key does (one reply could match both) skips the method.
+  - **More than one argument.** Each argument is an input of its own, `arg0`, `arg1` and so on, read by the rules above; an idempotency stamp skips the method.
+  - **Text and bool** (D-050). A `text` position is a text input taken as given (not trimmed), checked against its `text` tag: `max_len` and `range` lengths in code points (1024 without either), `pattern` (unanchored, with the `u` flag) and `format` (`url`: an http or https URL; `email`); lone surrogates are refused. A pattern the layer will not run skips the method with the reason: over 256 characters, not valid with the `u` flag, a back reference, a lookaround, or a group that repeats inside a group that repeats (exponential backtracking). A `bool` position is `"true"` or `"false"`.
+  - **Nested arguments** (D-050). A record, variant or `vec` that no value tag reads (an account record is still one text input) is one input in JSON: an object for a record (unknown keys refused), `{ "tag": "Case", "value": … }` for a variant case (no `value` for a `null` case), an array for a `vec` (`null` for an element that is none), and each leaf read by its own rule above, as text. At most 256 elements in a `vec` and 4096 values in one input. An issue names its place (`$args[0].command.Follow.followees[1].id`). The input's JSON Schema mirrors the shape (`oneOf` per case, `maxItems`) with each leaf's own schema. A `null` or `reserved` field takes no input, and neither does a lone `null` or `reserved` argument. A recursive position, or a field or case named by a number, still skips the method.
+  - **An outcome with `default` alone** (D-049): every reply of the method is that class, whatever its result; outcome keys still need a method with one result.
+  - **One tool per case** (D-053, rule 3 of B2). A method whose single argument is a variant with an `intent` or an `effect` on any of its cases gets one tool for each case instead of one for the method: `<method>_<Case>` when the case's effect is a read (every case of a query, or a read-only update case), else `prepare_<method>_<Case>`. Its inputs are the case's payload, read as a single argument is (a record's fields, one value-tagged input, none for a `null` case, else one JSON input), and it sends `{ tag: Case, value }` (a bare `{ tag }` for a `null` case). Its title is the case's intent, else its `describe`, else `<method> <Case>`; its effect the case's, else the method's; the method's `outcome` applies, and a prepare tool needs an intent, the case's or the method's. The case is part of the intent's identity, so two cases with the same inputs are two previews. A case without a rule, or without a name (`#3`), is skipped alone, with `case <Case>:` in front of the reason; a method with an idempotency stamp gets no case tools yet (the stamp would sit inside a case). A tagged variant deeper in the argument (inside a record) stays one JSON input.
+
+  A method with no rule (including a query with more than one result) is skipped and reported in `buildToolPlans(resolved).skipped`, not thrown on; so is every method whose tool name is `commit` or is another method's tool name, every method with an argument field named `canister_id` (the canister selector's input), and every update whose stamp is the whole argument rather than a field (a required stamp field is filled like an optional one). The stamp and the outcome keys are relpaths, matched by the position they resolve to: `(0).Ok`, `.Ok` and `Ok` are one key.
+- **Input words.** Each input's description is the format library's `Formatter.describe()`, with the canisters' decimals and symbol filled in when they agree (and its regular-expression `pattern` for amounts and subaccounts). When the canisters disagree the words give the grammar without the numbers.
+- **Reading.** `readToolInput(plan, input, { refs, now })` returns `{ value, identity }` or `{ issues: [{ param, path, code, message }] }`, every issue at once, with the format library's codes. `value` is candid-core's domain shape (`T | null` opts, `bigint` for nat/int/nat64/int64, `Uint8Array` blobs, principals as text), so `encodeArgs` takes it: the single argument, or for a method with more than one the argument tuple.
+- **Sending.** `encode(method, value, args)` is injected, so the bytes are the host's encoder's (candid-core's `encodeArgs`, as ic-reactor sends; a test checks every send against it). `args` is the whole argument tuple (empty, one argument, or several); encode it. `value` is the single argument, kept for hosts that encode `[value]`; for a method with more than one argument it is the tuple again, so such a host's `encodeArgs(types, [value])` is refused (`invalid_length`, observed with candid-core) rather than encoded wrongly. `call` receives the bytes, `mode` (`"query"`, or `"update"` for a commit and for a read-only update), and the `value` and `args` they encode. Results are `{ content, structuredContent, isError? }`: structured data with a short text beside it.
+- **Confirmation.** `confirm(preview)` is awaited before every send, including a re-send. There is no auto-approve default: a form with an update method needs it. A decline sends nothing and answers `declined`.
+
+## Outcomes
+
+| Outcome | When | The intent |
+|---|---|---|
+| `declined` | `confirm` said no | settled if it had no attempt, else unchanged; after an unknown outcome the result also carries `earlier_outcome: "unknown"` (the earlier attempt may have executed). A stamp declined before any send sets no floor for later stamps of the same arguments, and is never handed out again |
+| `success`, `already_done` | the class of the reply | done: a later commit answers `already_done` without sending |
+| `retry_same` | the class of the reply | unchanged: handed back, nothing sleeps here. The third one stops the intent (consumer rule 3): `reconcile` after an unknown outcome, else `fail` with `retries_spent`, settled |
+| `retry_new` | the class of the reply | a new preview with a new stamp, relative times resolved again; the old preview is retired. A `CreatedInFuture` re-stamp is capped by its `ledger_time` (only that case, matched by its name) |
+| `fix_input`, `fail` | the class of the reply | settled |
+| `not_executed` | reject code 1, 2 or 3 | unchanged |
+| `unknown` | for an update with an idempotency stamp: no answer, or any reject code other than 1 to 3 (4, 5, 6 and any unlisted code; or any reject from `aaaaa-aa`); a `call` that throws is answered the same (`message` is the error's) | unknown: commit again sends the same bytes; preparing it again returns the same preview with outcome `unknown`, as does any later preparation of an intent that had one |
+| `reconcile` | after an unknown outcome, any answer but success, already_done or retry_same (retry_same resends the same bytes and stamp, so the ledger's deduplication answers Duplicate within the window and TooOld after it); or a third reject 4/5 of the intent. For an update without an idempotency stamp, at once, in place of `unknown`: the finding is `unreadable` with the reason, and the `reconcile` hook is not called, since there is no stamp to match | held until `reconcile` finds the original (then done) or reports it absent (then settled); without a stamp, held: no commit or preparation of it sends again |
+
+## Tests
+
+`npm test -w packages/tools`: definitions against arm C's, input reading against candid-core's encoder, every outcome row above against a scripted ledger, concurrent preparations and commits, a `call` that throws, the hand-written types against the runtime exports, and the browser bundle. **Observed (2026-10-14, while writing them):** each guard in `src/layer.mjs` was removed once and its test failed; the four regression tests from the review fail on the earlier code. `test/interface-rules.test.mjs` runs the B2 rules on a wallet-like form; **observed (2026-10-24):** each of its ten guards (the update call for a read-only update, the hold after an unknown outcome, a reject 4 and the hook's skip without a stamp, the `describe` requirement, the two record-key checks, the argument tuple, the `retry_new` and stamped-read skips) was removed once and a test failed. `test/readers.test.mjs` runs the D-050 readers, and every value they prepare is encoded by candid-core; **observed (2026-10-27):** removing the bare `{ tag }` for a `null` case, the repeat check on patterns, or the lone-surrogate check made a test fail.
+
+## Not here
+
+- The demo's agent tools are not switched to this package yet: its tools also read address-book names and choose the calling identity per call (the payer question of #10), and its write engine is the app's.
+- Arm C keeps its own code; rebuilding it on this package before the freeze, with re-pinned hashes, is recommended in the proposal (D-015 reruns nothing while no run has started).

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "@meantjs/tools",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Agent tools from any Candid Profile resolved form: tool definitions, exact input reading, and a tool layer with a confirmation hook, an injected encoder, call and clock. Browser-safe.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/B3Pay/Meant.git",
+    "directory": "profile/packages/tools"
+  },
+  "homepage": "https://github.com/B3Pay/Meant/tree/main/profile/packages/tools#readme",
+  "bugs": {
+    "url": "https://github.com/B3Pay/Meant/issues"
+  },
+  "keywords": [
+    "candid",
+    "internet-computer",
+    "icp",
+    "agent",
+    "mcp",
+    "tools",
+    "wallet"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./src/index.mjs",
+  "types": "./src/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./src/index.d.mts",
+      "default": "./src/index.mjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "src",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test \"test/*.test.mjs\""
+  },
+  "dependencies": {
+    "@meantjs/format": "0.2.0"
+  },
+  "devDependencies": {
+    "@candid-core/schema": "0.5.0",
+    "esbuild": "0.28.2"
+  }
+}

package/src/index.d.mts

@@ -0,0 +1,205 @@
+// Types for @meantjs/tools. Hand-written; the source is plain ES modules (src/*.mjs).
+
+import type { NameEntry } from "@meantjs/format";
+
+/** A candid-profile-resolved v0 document (docs/profile-v0.md section 10). */
+export interface ResolvedForm {
+  format: "candid-profile-resolved";
+  format_version: 0;
+  methods: Record<string, unknown>;
+  [key: string]: unknown;
+}
+
+export interface Canister {
+  /** Principal text of the canister. */
+  id: string;
+  /** A short name for people and models, such as the token's symbol. */
+  label?: string;
+  /** The canister's dynamic tag values, keyed by their `from`: `{ "query:icrc1_decimals": 8 }`. */
+  refs?: Record<string, unknown>;
+}
+
+export interface JsonSchemaString {
+  type: "string";
+  description: string;
+  enum?: string[];
+  pattern?: string;
+}
+
+/** The schema of one input: text read by its own rules, or the JSON shape of a record, variant or vec (D-050). */
+export type JsonSchemaInput = JsonSchemaString | JsonSchemaObject | JsonSchemaVariant | JsonSchemaArray;
+
+/** A record: one property per field that is an input. */
+export interface JsonSchemaObject {
+  type: "object";
+  description: string;
+  properties: Record<string, JsonSchemaInput>;
+  required: string[];
+  additionalProperties: false;
+}
+
+/** A variant: one `{ tag, value }` object per case; a case without a value has `tag` alone. */
+export interface JsonSchemaVariant {
+  oneOf: JsonSchemaCase[];
+  description: string;
+}
+
+export interface JsonSchemaCase {
+  type: "object";
+  properties: { tag: { const: string }; value?: JsonSchemaInput };
+  required: ["tag"] | ["tag", "value"];
+  additionalProperties: false;
+}
+
+export interface JsonSchemaNull {
+  type: "null";
+}
+
+/** A vec: an element that is none is a JSON null, so an opt element is its schema or null. */
+export interface JsonSchemaArray {
+  type: "array";
+  description: string;
+  items: JsonSchemaInput | JsonSchemaNull | { anyOf: [JsonSchemaInput, JsonSchemaNull] };
+  maxItems: number;
+}
+
+export interface ToolDefinition {
+  name: string;
+  description: string;
+  inputSchema: {
+    $schema: string;
+    type: "object";
+    properties: Record<string, JsonSchemaInput>;
+    required: string[];
+    additionalProperties: false;
+  };
+  annotations: { destructiveHint: boolean; openWorldHint: boolean; readOnlyHint: boolean; title: string };
+}
+
+export interface ToolParam {
+  name: string;
+  node: unknown;
+  optional: boolean;
+  /** `$args[0].amount`, or `$args[0]` for a whole argument (`$args[1]` for the second of several). */
+  path: string;
+}
+// A param whose node is a record, variant or vec with no value tag is one JSON input (D-050): an object, a
+// `{ tag, value }` object, or an array, whose leaves are text read by their own rules.
+
+export interface ToolPlan {
+  name: string;
+  kind: "read" | "prepare";
+  method: string;
+  /** The method's mode in the resolved form; a read-only update is `"update"` with `kind: "read"`. */
+  mode: string;
+  /** A read sent as an update call, so that its answer is certified (`effect.replicated`, D-038). */
+  replicated: boolean;
+  title: string;
+  effect: { kind: string; irreversible: boolean; replicated?: boolean };
+  /** For a tool per case of the method's variant argument (D-053): the case it sends. */
+  case?: string;
+  /** The method's arguments, in order. */
+  argNodes: unknown[];
+  params: ToolParam[];
+  /** The argument record's fields, or with more than one argument the arguments (`arg0`, `arg1`, ...). */
+  /** `none`: a `null` or `reserved` position, filled with null and never asked for. */
+  fields: { name: string; node: unknown; role: "param" | "auto" | "stamp" | "hidden" | "none"; optional: boolean }[];
+  [key: string]: unknown;
+}
+
+export interface InputIssue {
+  param: string;
+  path: string;
+  /** The format library's codes, plus E_INPUT, E_UNKNOWN_PARAM, E_MISSING and E_TYPE. Inside a JSON input, `path`
+   *  names the place (`$args[0].command.Follow.followees[1].id`). */
+  code: string;
+  message: string;
+}
+
+export const COMMIT_TOOL: "commit";
+export function prepareToolName(method: string): string;
+/** The tool of one case of a method's variant argument (D-053): `<method>_<Case>` for a read, else `prepare_<method>_<Case>`. */
+export function caseToolName(method: string, label: string, read: boolean): string;
+export function resolvedMethods(resolved: ResolvedForm | ResolvedForm[]): [string, unknown][];
+export function buildToolPlans(resolved: ResolvedForm | ResolvedForm[]): { plans: Map<string, ToolPlan>; skipped: { method: string; reason: string }[] };
+export function toolDefinitions(resolved: ResolvedForm | ResolvedForm[], options?: { canisters?: Canister[] }): ToolDefinition[];
+
+export function readToolInput(
+  plan: ToolPlan,
+  input: unknown,
+  context?: { refs?: Record<string, unknown>; now?: bigint; names?: Record<string, NameEntry[]> },
+): { value: unknown; identity: [string, unknown][] } | { issues: InputIssue[] };
+export function toCandid(node: unknown, value: unknown): unknown;
+export function displayValue(node: unknown, value: unknown, refs?: Record<string, unknown>, names?: Record<string, NameEntry[]>): unknown;
+/** The entries of a names set (spec 5.3, D-045) in a reply of the method that lists it; undefined without the set or a list. */
+export function nameEntries(resolved: unknown, set: string, reply: unknown): NameEntry[] | undefined;
+export function classifyReply(plan: ToolPlan, reply: unknown): { cls: string; path: string[]; node: unknown; value: unknown };
+
+export type CallResult =
+  | { status: "replied"; reply: unknown }
+  | { status: "rejected"; reject_code: number; message: string }
+  | { status: "unknown"; message: string };
+
+export interface Preview {
+  preview_id: string;
+  method: string;
+  canister: string;
+  title: string;
+  effect: { kind: string; irreversible: boolean; replicated?: boolean };
+  /** The arguments as `displayValue` shows them; an array for a method with more than one. */
+  arguments: unknown;
+  arg_hex: string;
+}
+
+export type ReconcileFinding =
+  | { status: "found"; block?: bigint | string }
+  | { status: "absent" | "not_yet" }
+  | { status: "unreadable"; reason?: string };
+
+export type Outcome =
+  | "declined"
+  | "success"
+  | "already_done"
+  | "retry_same"
+  | "retry_new"
+  | "fix_input"
+  | "fail"
+  | "not_executed"
+  | "unknown"
+  | "reconcile";
+
+export interface ToolResult {
+  content: { type: "text"; text: string }[];
+  /** `preview` is there when a prepare tool answers `prepared` (and when an intent is handed back). */
+  structuredContent: { status?: string; outcome?: Outcome; earlier_outcome?: "unknown"; preview?: Preview; [key: string]: unknown };
+  isError?: true;
+}
+
+export interface ToolLayerConfig {
+  resolved: ResolvedForm | ResolvedForm[];
+  canisters: Canister[];
+  /**
+   * The method's arguments, in candid-core domain shapes, to the bytes sent: candid-core's `encodeArgs` of `args`, the
+   * whole argument tuple. `value` is the single argument (for a method with more than one, the tuple again).
+   */
+  encode(method: string, value: unknown, args: unknown[]): Uint8Array | Promise<Uint8Array>;
+  /**
+   * Sends `arg` exactly, as a query or an update call (`mode`; a read-only update is `"update"`); `reply` is the
+   * decoded first result value in candid-core's domain shape (a variant is `{ tag, value }`).
+   */
+  call(req: { canister: string; method: string; mode: string; arg: Uint8Array; value: unknown; args: unknown[] }): Promise<CallResult>;
+  /** The clock of the canister named, ns since the Unix epoch (canisters on different subnets keep different times). */
+  now(o: { canister: string }): Promise<bigint>;
+  /** Awaited before every send. Required when the form has an update method. */
+  confirm?(preview: Preview): Promise<boolean | { approved: boolean }>;
+  /** Consumer rule 1: look for the original in the canister's history. */
+  reconcile?(o: { canister: string; method: string; value: unknown; stamp: bigint; preview: Preview }): Promise<ReconcileFinding>;
+}
+
+export interface ToolLayer {
+  listTools(): ToolDefinition[];
+  skipped: { method: string; reason: string }[];
+  callTool(name: string, input: unknown): Promise<ToolResult>;
+}
+
+export function createToolLayer(config: ToolLayerConfig): ToolLayer;

package/src/index.mjs

@@ -0,0 +1,6 @@
+// @meantjs/tools: agent tools from any resolved form, browser-safe (#16).
+// Arm C (packages/mcp-adapters) stays the eval arm with its frozen texts; this is the product tool layer.
+
+export { COMMIT_TOOL, buildToolPlans, caseToolName, prepareToolName, resolvedMethods, toolDefinitions } from "./plan.mjs";
+export { displayValue, readToolInput, toCandid } from "./input.mjs";
+export { classifyReply, createToolLayer, nameEntries } from "./layer.mjs";