@mondaydotcomorg/atp-server 0.20.7 → 0.21.0

package/dist/index.cjs

@@ -10385,371 +10385,635 @@ var ExecutionStateManager = class {
     };
   }
 };
-
-// src/explorer/index.ts
-var ExplorerService = class {
+var APIAggregator = class {
   static {
-    __name(this, "ExplorerService");
+    __name(this, "APIAggregator");
   }
-  root;
   apiGroups;
-  apiGroupMap;
+  /**
+  * Creates a new APIAggregator instance.
+  * @param apiGroups - Array of API group configurations
+  */
   constructor(apiGroups) {
     this.apiGroups = apiGroups;
-    this.apiGroupMap = new Map(apiGroups.map((group) => [
-      group.name,
-      group
-    ]));
-    this.root = {
-      type: "directory",
-      name: "/",
-      children: /* @__PURE__ */ new Map()
-    };
-    this.buildTree(apiGroups);
   }
   /**
-  * Get filtering context based on current request's tool rules.
-  * Returns sets for allowed items and all known items (for filtering).
+  * Generates TypeScript type definitions for selected API groups.
+  * @param selectedGroups - Optional array of group names to include
+  * @returns TypeScript definition string
   */
-  getFilterContext() {
-    const allowedGroups = filterApiGroups(this.apiGroups);
-    const context = {
-      allowedTypes: /* @__PURE__ */ new Set(),
-      allowedGroups: /* @__PURE__ */ new Set(),
-      allowedTools: /* @__PURE__ */ new Set(),
-      allGroups: new Set(this.apiGroups.map((g) => g.name))
-    };
-    for (const group of allowedGroups) {
-      if (group.type !== "graphql") {
-        context.allowedTypes.add(group.type);
-      }
-      context.allowedGroups.add(group.name);
-    }
-    for (const group of this.apiGroups) {
-      if (!context.allowedGroups.has(group.name)) continue;
+  async generateTypeScript(selectedGroups) {
+    const groups = selectedGroups ? this.apiGroups.filter((g) => selectedGroups.includes(g.name)) : this.apiGroups;
+    let typescript = `// Agent Tool Protocol Runtime SDK v1.0.0
+
+`;
+    typescript += this.generateRuntimeTypes();
+    for (const group of groups) {
+      typescript += `
+// API Group: ${group.name}
+`;
       if (group.functions) {
         for (const func of group.functions) {
-          context.allowedTools.add(`${group.name}:${func.name}`);
+          typescript += this.generateFunctionTypes(func, group.name);
         }
       }
     }
-    return context;
+    typescript += this.generateAPINamespace(groups);
+    return typescript;
   }
   /**
-  * Check if a directory should be visible based on filter context.
+  * Generates TypeScript definitions for the runtime SDK.
+  * @param options - Optional filtering options
+  * @returns TypeScript definition string
   */
-  isDirectoryAllowed(name, currentPath, ctx) {
-    const API_TYPES = [
-      "openapi",
-      "mcp",
-      "custom",
-      "graphql"
-    ];
-    if (currentPath === "/" && API_TYPES.includes(name)) {
-      return ctx.allowedTypes.has(name) || ctx.allowedGroups.has(name);
-    }
-    if (ctx.allGroups.has(name)) {
-      return ctx.allowedGroups.has(name);
-    }
-    return true;
+  generateRuntimeTypes(options) {
+    return atpRuntime.generateRuntimeTypes(atpRuntime.GENERATED_METADATA, options);
   }
   /**
-  * Builds the virtual filesystem tree from API groups
+  * Generates TypeScript types for a single function.
+  * @param func - Function definition
+  * @param groupName - API group name
+  * @returns TypeScript definition string
   */
-  buildTree(apiGroups) {
-    for (const group of apiGroups) {
-      if (!group.functions || group.functions.length === 0) continue;
-      let groupFolder;
-      if (group.type === "graphql") {
-        groupFolder = this.ensureDirectory(this.root, group.name, group.description);
-      } else {
-        groupFolder = this.ensureDirectory(this.ensureDirectory(this.root, group.type), group.name, group.description);
-      }
-      groupFolder.apiGroupName = group.name;
-      for (const func of group.functions) {
-        const segments = this.extractSegments(func, group);
-        if (segments.length > 1) {
-          let current = groupFolder;
-          for (let i = 0; i < segments.length - 1; i++) {
-            current = this.ensureDirectory(current, segments[i]);
-          }
-          this.addFunction(current, segments[segments.length - 1], func, group.name);
-        } else {
-          this.addFunction(groupFolder, func.name, func, group.name);
-        }
+  generateFunctionTypes(func, groupName) {
+    const inputTypeName = `${func.name}_Input`;
+    const outputTypeName = `${func.name}_Output`;
+    let typescript = `
+interface ${inputTypeName} {
+`;
+    if (func.inputSchema?.properties) {
+      const required = func.inputSchema.required || [];
+      for (const [key, value] of Object.entries(func.inputSchema.properties)) {
+        const prop = value;
+        const tsType = this.jsonSchemaTypeToTS(prop.type ?? "any");
+        const comment = prop.description ? ` // ${prop.description}` : "";
+        const optional = required.includes(key) ? "" : "?";
+        typescript += `  ${key}${optional}: ${tsType};${comment}
+`;
       }
     }
+    typescript += `}
+`;
+    typescript += `
+interface ${outputTypeName} {
+`;
+    if (func.outputSchema) {
+      const outputType = this.jsonSchemaToTSInterface(func.outputSchema);
+      typescript += outputType;
+    } else {
+      typescript += `  [key: string]: unknown;
+`;
+    }
+    typescript += `}
+`;
+    return typescript;
   }
   /**
-  * Extract path segments for organizing functions
+  * Converts JSON Schema type to TypeScript type.
+  * @param type - JSON Schema type string
+  * @returns TypeScript type string
   */
-  extractSegments(func, group) {
-    if (group.type === "graphql") {
-      const name = func.name;
-      if (name.startsWith("query_")) {
-        return [
-          "query",
-          name.replace("query_", "")
-        ];
-      }
-      if (name.startsWith("mutation_")) {
-        return [
-          "mutation",
-          name.replace("mutation_", "")
-        ];
-      }
-    }
-    if (group.type === "openapi") {
-      const name = func.name;
-      const camelSplit = name.match(/[A-Z]?[a-z]+|[A-Z]+(?=[A-Z][a-z]|\b)/g);
-      if (camelSplit && camelSplit.length > 2) {
-        const verb = camelSplit[0].toLowerCase();
-        const isVerb = [
-          "get",
-          "list",
-          "create",
-          "update",
-          "delete",
-          "post",
-          "put",
-          "patch"
-        ].includes(verb);
-        if (isVerb) {
-          const resource = camelSplit.slice(1).join("_").toLowerCase();
-          return [
-            resource,
-            name
-          ];
-        }
-      }
-      if (name.includes("_")) {
-        const parts = name.split("_");
-        if (parts.length > 1 && parts[0]) {
-          return [
-            parts[0],
-            name
-          ];
-        }
-      }
-      if (name.includes("-")) {
-        const parts = name.split("-");
-        if (parts.length > 1 && parts[0]) {
-          return [
-            parts[0],
-            name
-          ];
-        }
-      }
+  jsonSchemaTypeToTS(type) {
+    switch (type) {
+      case "string":
+        return "string";
+      case "number":
+      case "integer":
+        return "number";
+      case "boolean":
+        return "boolean";
+      case "array":
+        return "unknown[]";
+      case "object":
+        return "Record<string, unknown>";
+      default:
+        return "unknown";
     }
-    return [
-      func.name
-    ];
   }
   /**
-  * Ensures a directory exists at the given path
+  * Converts a full JSON Schema to TypeScript interface properties
+  * @param schema - JSON Schema object
+  * @param depth - Current recursion depth (prevents infinite recursion)
+  * @returns TypeScript interface properties string
   */
-  ensureDirectory(parent, name, description) {
-    if (!parent.children) {
-      parent.children = /* @__PURE__ */ new Map();
+  jsonSchemaToTSInterface(schema, depth = 0) {
+    if (depth > 3) {
+      return "  [key: string]: unknown;\n";
     }
-    let child = parent.children.get(name);
-    if (!child) {
-      child = {
-        type: "directory",
-        name,
-        description,
-        children: /* @__PURE__ */ new Map()
-      };
-      parent.children.set(name, child);
-    } else if (description && !child.description) {
-      child.description = description;
+    if (schema.type === "array" && schema.items) {
+      const itemType = this.schemaToTSType(schema.items, depth + 1);
+      return `  [index: number]: ${itemType};
+  length: number;
+`;
     }
-    return child;
+    if (schema.type === "object" && schema.properties) {
+      const required = schema.required || [];
+      let result = "";
+      for (const [key, value] of Object.entries(schema.properties)) {
+        const prop = value;
+        const optional = required.includes(key) ? "" : "?";
+        const tsType = this.schemaToTSType(prop, depth + 1);
+        result += `  ${key}${optional}: ${tsType};
+`;
+      }
+      return result || "  [key: string]: unknown;\n";
+    }
+    return "  [key: string]: unknown;\n";
   }
   /**
-  * Adds a function to the tree
-  */
-  addFunction(parent, name, func, group) {
-    if (!parent.children) {
-      parent.children = /* @__PURE__ */ new Map();
+  * Converts any JSON Schema to a TypeScript type expression
+  * @param schema - JSON Schema object
+  * @param depth - Current recursion depth
+  * @returns TypeScript type expression
+  */
+  schemaToTSType(schema, depth = 0) {
+    if (!schema) return "unknown";
+    if (depth > 3) {
+      return "unknown";
     }
-    parent.children.set(name, {
-      type: "function",
-      name,
-      functionDef: {
-        func,
-        group
+    if (schema.type === "array") {
+      if (schema.items) {
+        const itemType = this.schemaToTSType(schema.items, depth + 1);
+        return `${itemType}[]`;
       }
-    });
+      return "unknown[]";
+    }
+    if (schema.enum) {
+      return schema.enum.map((v) => `"${v}"`).join(" | ") || "string";
+    }
+    if (schema.type === "object" && schema.properties) {
+      const required = schema.required || [];
+      const props = [];
+      for (const [key, value] of Object.entries(schema.properties)) {
+        const prop = value;
+        const optional = required.includes(key) ? "" : "?";
+        const tsType = this.schemaToTSType(prop, depth + 1);
+        props.push(`${key}${optional}: ${tsType}`);
+      }
+      if (props.length > 0) {
+        return `{ ${props.join("; ")} }`;
+      }
+      return "Record<string, unknown>";
+    }
+    if (schema.type) {
+      return this.jsonSchemaTypeToTS(schema.type);
+    }
+    return "unknown";
   }
   /**
-  * Explores the filesystem at the given path.
-  * Tool rules are automatically applied from the request scope.
-  * @param path - The path to explore
+  * Helper to check if a string is a valid JavaScript identifier
   */
-  explore(path) {
-    const ctx = this.getFilterContext();
-    const normalizedPath = this.normalizePath(path);
-    const segments = normalizedPath === "/" ? [] : normalizedPath.split("/").filter((s) => s);
-    let current = this.root;
-    let currentPath = "/";
-    for (const segment of segments) {
-      if (!current.children || !current.children.has(segment)) {
-        return null;
-      }
-      current = current.children.get(segment);
-      currentPath = currentPath === "/" ? `/${segment}` : `${currentPath}/${segment}`;
+  isValidIdentifier(name) {
+    return /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(name);
+  }
+  /**
+  * Helper to safely format a property name for TypeScript type definitions
+  * Returns the property name with quotes if needed, or just the name if valid
+  */
+  formatPropertyName(name) {
+    if (!this.isValidIdentifier(name)) {
+      return `'${name}'`;
     }
-    if (current.type === "directory") {
-      const items = [];
-      if (current.children) {
-        for (const [name, node] of current.children) {
-          if (node.type === "directory") {
-            if (!this.isDirectoryAllowed(name, currentPath, ctx)) continue;
-          } else if (node.type === "function" && node.functionDef) {
-            if (!ctx.allowedTools.has(`${node.functionDef.group}:${node.functionDef.func.name}`)) continue;
-          }
-          const item = {
-            name,
-            type: node.type
-          };
-          if (node.description) {
-            item.description = node.description;
-          } else if (node.type === "function" && node.functionDef?.func.description) {
-            item.description = node.functionDef.func.description;
-          }
-          items.push(item);
+    return name;
+  }
+  /**
+  * Generates the API namespace with all function declarations.
+  * Handles hierarchical group names (e.g., "github/readOnly" -> api.github.readOnly)
+  * @param groups - API groups to include
+  * @returns TypeScript definition string
+  */
+  generateAPINamespace(groups) {
+    const rootGroups = /* @__PURE__ */ new Map();
+    for (const group of groups) {
+      if (!group.functions || group.functions.length === 0) continue;
+      const parts = group.name.split("/");
+      let current = rootGroups;
+      for (let i = 0; i < parts.length; i++) {
+        const part = parts[i];
+        if (!current.has(part)) {
+          current.set(part, {
+            functions: [],
+            subgroups: /* @__PURE__ */ new Map()
+          });
         }
+        const node = current.get(part);
+        if (i === parts.length - 1) {
+          node.functions.push(...group.functions);
+        }
+        current = node.subgroups;
       }
-      items.sort((a, b) => {
-        if (a.type === b.type) {
-          return a.name.localeCompare(b.name);
+    }
+    const generateLevel = /* @__PURE__ */ __name((groups2, indent2) => {
+      let ts = "";
+      for (const [name, node] of groups2.entries()) {
+        if (!name) continue;
+        const formattedName = this.formatPropertyName(name);
+        ts += `${indent2}${formattedName}: {
+`;
+        for (const func of node.functions) {
+          if (!func.name) continue;
+          const funcName = this.formatPropertyName(func.name);
+          const description = func.description && typeof func.description === "string" ? func.description.replace(/\n/g, " ").substring(0, 200) : "";
+          ts += `${indent2}  /**
+${indent2}   * ${description}
+${indent2}   */
+`;
+          ts += `${indent2}  ${funcName}(params: ${func.name}_Input): Promise<${func.name}_Output>;
+`;
         }
-        return a.type === "directory" ? -1 : 1;
-      });
-      const result = {
-        type: "directory",
-        path: currentPath,
-        items
-      };
-      if (current.apiGroupName) {
-        const apiGroup = this.apiGroupMap.get(current.apiGroupName);
-        if (apiGroup?.documentation) {
-          result.documentation = apiGroup.documentation;
+        if (node.subgroups.size > 0) {
+          ts += generateLevel(node.subgroups, indent2 + "  ");
         }
+        ts += `${indent2}};
+`;
       }
-      return result;
-    } else {
-      if (!current.functionDef) {
-        return null;
-      }
-      const { func, group } = current.functionDef;
-      if (!ctx.allowedTools.has(`${group}:${func.name}`)) {
-        return null;
-      }
-      const definition = this.generateFunctionDefinition(func, group);
-      return {
-        type: "function",
-        path: currentPath,
-        name: func.name,
-        description: func.description,
-        definition,
-        group,
-        inputSchema: func.inputSchema,
-        outputSchema: func.outputSchema
-      };
-    }
+      return ts;
+    }, "generateLevel");
+    let typescript = `
+declare const api: {
+`;
+    typescript += generateLevel(rootGroups, "  ");
+    typescript += `};
+`;
+    typescript += `
+export { api };
+`;
+    return typescript;
   }
   /**
-  * Normalizes a path (removes trailing slashes, ensures leading slash)
+  * Gets the list of available API group names.
+  * @returns Array of API group names
   */
-  normalizePath(path) {
-    if (!path || path === "") return "/";
-    if (!path.startsWith("/")) {
-      path = "/" + path;
-    }
-    if (path !== "/" && path.endsWith("/")) {
-      path = path.slice(0, -1);
-    }
-    return path;
+  getApiGroups() {
+    return this.apiGroups.map((g) => g.name);
   }
   /**
-  * Generates TypeScript function signature showing how to call the function.
+  * Generates a compact TypeScript definition for a single function.
+  * Includes input types with inline descriptions and compact output type.
+  * @param func - Function definition
+  * @param groupName - API group name
+  * @returns Compact TypeScript definition string
   */
-  generateFunctionDefinition(func, group) {
-    const inputType = this.generateInputType(func.inputSchema);
-    const groupPath = group.replace(/\//g, ".");
-    const outputType = func.outputSchema ? this.generateOutputType(func.outputSchema) : "unknown";
+  generateCompactFunctionDefinition(func, groupName) {
+    const groupPath = groupName.replace(/\//g, ".");
+    const inputType = this.generateCompactInputType(func.inputSchema);
+    const outputType = func.outputSchema ? this.generateCompactOutputType(func.outputSchema) : "unknown";
     return `async function api.${groupPath}.${func.name}(${inputType}): Promise<${outputType}>`;
   }
   /**
-  * Generates TypeScript type from JSON schema
+  * Generates compact input type with inline descriptions
   */
-  generateInputType(schema) {
+  generateCompactInputType(schema) {
     if (!schema || !schema.properties) {
       return "{}";
     }
     const props = [];
     const required = schema.required || [];
     for (const [key, value] of Object.entries(schema.properties)) {
-      const isRequired = required.includes(key);
       const prop = value;
-      const tsType = this.jsonSchemaTypeToTS(prop.type ?? "any");
+      const isRequired = required.includes(key);
+      const tsType = prop.enum ? prop.enum.map((v) => `"${v}"`).join(" | ") : this.jsonSchemaTypeToTS(prop.type ?? "unknown");
       const optional = isRequired ? "" : "?";
-      props.push(`${key}${optional}: ${tsType}`);
+      if (prop.description) {
+        const desc = prop.description.replace(/\n/g, " ").substring(0, 100);
+        props.push(`/* ${desc} */ ${key}${optional}: ${tsType}`);
+      } else {
+        props.push(`${key}${optional}: ${tsType}`);
+      }
     }
     return `{ ${props.join("; ")} }`;
   }
   /**
-  * Generates output type from JSON schema
+  * Generates compact output type with inline descriptions (top-level fields only, limited count)
   */
-  generateOutputType(schema) {
+  generateCompactOutputType(schema) {
     if (!schema.properties) {
       return "unknown";
     }
-    const props = [];
-    for (const [key, value] of Object.entries(schema.properties)) {
-      const prop = value;
-      const tsType = this.jsonSchemaTypeToTS(prop.type ?? "any");
-      props.push(`${key}: ${tsType}`);
+    const keys = Object.keys(schema.properties);
+    if (keys.length === 0) {
+      return "unknown";
     }
-    return `{ ${props.join("; ")} }`;
-  }
-  /**
-  * Converts JSON Schema type to TypeScript type
-  */
-  jsonSchemaTypeToTS(type) {
-    switch (type) {
-      case "string":
-        return "string";
-      case "number":
-      case "integer":
-        return "number";
-      case "boolean":
-        return "boolean";
-      case "array":
-        return "any[]";
-      case "object":
-        return "Record<string, any>";
-      default:
-        return "any";
+    const maxFields = 6;
+    const displayKeys = keys.slice(0, maxFields);
+    const props = displayKeys.map((key) => {
+      const prop = schema.properties[key];
+      const tsType = this.jsonSchemaTypeToTS(prop.type ?? "unknown");
+      if (prop.description) {
+        const desc = prop.description.replace(/\n/g, " ").substring(0, 80);
+        return `/* ${desc} */ ${key}: ${tsType}`;
+      }
+      return `${key}: ${tsType}`;
+    });
+    if (keys.length > maxFields) {
+      return `{ ${props.join("; ")}; /* +${keys.length - maxFields} more */ }`;
     }
+    return `{ ${props.join("; ")} }`;
   }
 };
 
-// src/utils/schema.ts
-function toJSONSchema(types) {
-  const properties = {};
-  const required = [];
-  for (const [key, type] of Object.entries(types)) {
-    properties[key] = {
-      type
+// src/explorer/index.ts
+var ExplorerService = class {
+  static {
+    __name(this, "ExplorerService");
+  }
+  root;
+  apiGroups;
+  apiGroupMap;
+  aggregator;
+  constructor(apiGroups) {
+    this.apiGroups = apiGroups;
+    this.apiGroupMap = new Map(apiGroups.map((group) => [
+      group.name,
+      group
+    ]));
+    this.aggregator = new APIAggregator(apiGroups);
+    this.root = {
+      type: "directory",
+      name: "/",
+      children: /* @__PURE__ */ new Map()
     };
-    required.push(key);
+    this.buildTree(apiGroups);
   }
-  return {
-    type: "object",
-    properties,
+  /**
+  * Get filtering context based on current request's tool rules.
+  * Returns sets for allowed items and all known items (for filtering).
+  */
+  getFilterContext() {
+    const allowedGroups = filterApiGroups(this.apiGroups);
+    const context = {
+      allowedTypes: /* @__PURE__ */ new Set(),
+      allowedGroups: /* @__PURE__ */ new Set(),
+      allowedTools: /* @__PURE__ */ new Set(),
+      allGroups: new Set(this.apiGroups.map((g) => g.name))
+    };
+    for (const group of allowedGroups) {
+      if (group.type !== "graphql") {
+        context.allowedTypes.add(group.type);
+      }
+      context.allowedGroups.add(group.name);
+    }
+    for (const group of this.apiGroups) {
+      if (!context.allowedGroups.has(group.name)) continue;
+      if (group.functions) {
+        for (const func of group.functions) {
+          context.allowedTools.add(`${group.name}:${func.name}`);
+        }
+      }
+    }
+    return context;
+  }
+  /**
+  * Check if a directory should be visible based on filter context.
+  */
+  isDirectoryAllowed(name, currentPath, ctx) {
+    const API_TYPES = [
+      "openapi",
+      "mcp",
+      "custom",
+      "graphql"
+    ];
+    if (currentPath === "/" && API_TYPES.includes(name)) {
+      return ctx.allowedTypes.has(name) || ctx.allowedGroups.has(name);
+    }
+    if (ctx.allGroups.has(name)) {
+      return ctx.allowedGroups.has(name);
+    }
+    return true;
+  }
+  /**
+  * Builds the virtual filesystem tree from API groups
+  */
+  buildTree(apiGroups) {
+    for (const group of apiGroups) {
+      if (!group.functions || group.functions.length === 0) continue;
+      let groupFolder;
+      if (group.type === "graphql") {
+        groupFolder = this.ensureDirectory(this.root, group.name, group.description);
+      } else {
+        groupFolder = this.ensureDirectory(this.ensureDirectory(this.root, group.type), group.name, group.description);
+      }
+      groupFolder.apiGroupName = group.name;
+      for (const func of group.functions) {
+        const segments = this.extractSegments(func, group);
+        if (segments.length > 1) {
+          let current = groupFolder;
+          for (let i = 0; i < segments.length - 1; i++) {
+            current = this.ensureDirectory(current, segments[i]);
+          }
+          this.addFunction(current, segments[segments.length - 1], func, group.name);
+        } else {
+          this.addFunction(groupFolder, func.name, func, group.name);
+        }
+      }
+    }
+  }
+  /**
+  * Extract path segments for organizing functions
+  */
+  extractSegments(func, group) {
+    if (group.type === "graphql") {
+      const name = func.name;
+      if (name.startsWith("query_")) {
+        return [
+          "query",
+          name.replace("query_", "")
+        ];
+      }
+      if (name.startsWith("mutation_")) {
+        return [
+          "mutation",
+          name.replace("mutation_", "")
+        ];
+      }
+    }
+    if (group.type === "openapi") {
+      const name = func.name;
+      const camelSplit = name.match(/[A-Z]?[a-z]+|[A-Z]+(?=[A-Z][a-z]|\b)/g);
+      if (camelSplit && camelSplit.length > 2) {
+        const verb = camelSplit[0].toLowerCase();
+        const isVerb = [
+          "get",
+          "list",
+          "create",
+          "update",
+          "delete",
+          "post",
+          "put",
+          "patch"
+        ].includes(verb);
+        if (isVerb) {
+          const resource = camelSplit.slice(1).join("_").toLowerCase();
+          return [
+            resource,
+            name
+          ];
+        }
+      }
+      if (name.includes("_")) {
+        const parts = name.split("_");
+        if (parts.length > 1 && parts[0]) {
+          return [
+            parts[0],
+            name
+          ];
+        }
+      }
+      if (name.includes("-")) {
+        const parts = name.split("-");
+        if (parts.length > 1 && parts[0]) {
+          return [
+            parts[0],
+            name
+          ];
+        }
+      }
+    }
+    return [
+      func.name
+    ];
+  }
+  /**
+  * Ensures a directory exists at the given path
+  */
+  ensureDirectory(parent, name, description) {
+    if (!parent.children) {
+      parent.children = /* @__PURE__ */ new Map();
+    }
+    let child = parent.children.get(name);
+    if (!child) {
+      child = {
+        type: "directory",
+        name,
+        description,
+        children: /* @__PURE__ */ new Map()
+      };
+      parent.children.set(name, child);
+    } else if (description && !child.description) {
+      child.description = description;
+    }
+    return child;
+  }
+  /**
+  * Adds a function to the tree
+  */
+  addFunction(parent, name, func, group) {
+    if (!parent.children) {
+      parent.children = /* @__PURE__ */ new Map();
+    }
+    parent.children.set(name, {
+      type: "function",
+      name,
+      functionDef: {
+        func,
+        group
+      }
+    });
+  }
+  /**
+  * Explores the filesystem at the given path.
+  * Tool rules are automatically applied from the request scope.
+  * @param path - The path to explore
+  */
+  explore(path) {
+    const ctx = this.getFilterContext();
+    const normalizedPath = this.normalizePath(path);
+    const segments = normalizedPath === "/" ? [] : normalizedPath.split("/").filter((s) => s);
+    let current = this.root;
+    let currentPath = "/";
+    for (const segment of segments) {
+      if (!current.children || !current.children.has(segment)) {
+        return null;
+      }
+      current = current.children.get(segment);
+      currentPath = currentPath === "/" ? `/${segment}` : `${currentPath}/${segment}`;
+    }
+    if (current.type === "directory") {
+      const items = [];
+      if (current.children) {
+        for (const [name, node] of current.children) {
+          if (node.type === "directory") {
+            if (!this.isDirectoryAllowed(name, currentPath, ctx)) continue;
+          } else if (node.type === "function" && node.functionDef) {
+            if (!ctx.allowedTools.has(`${node.functionDef.group}:${node.functionDef.func.name}`)) continue;
+          }
+          const item = {
+            name,
+            type: node.type
+          };
+          if (node.description) {
+            item.description = node.description;
+          } else if (node.type === "function" && node.functionDef?.func.description) {
+            item.description = node.functionDef.func.description;
+          }
+          items.push(item);
+        }
+      }
+      items.sort((a, b) => {
+        if (a.type === b.type) {
+          return a.name.localeCompare(b.name);
+        }
+        return a.type === "directory" ? -1 : 1;
+      });
+      const result = {
+        type: "directory",
+        path: currentPath,
+        items
+      };
+      if (current.apiGroupName) {
+        const apiGroup = this.apiGroupMap.get(current.apiGroupName);
+        if (apiGroup?.documentation) {
+          result.documentation = apiGroup.documentation;
+        }
+      }
+      return result;
+    } else {
+      if (!current.functionDef) {
+        return null;
+      }
+      const { func, group } = current.functionDef;
+      if (!ctx.allowedTools.has(`${group}:${func.name}`)) {
+        return null;
+      }
+      const definition = this.aggregator.generateCompactFunctionDefinition(func, group);
+      return {
+        type: "function",
+        path: currentPath,
+        name: func.name,
+        description: func.description,
+        definition,
+        group
+      };
+    }
+  }
+  /**
+  * Normalizes a path (removes trailing slashes, ensures leading slash)
+  */
+  normalizePath(path) {
+    if (!path || path === "") return "/";
+    if (!path.startsWith("/")) {
+      path = "/" + path;
+    }
+    if (path !== "/" && path.endsWith("/")) {
+      path = path.slice(0, -1);
+    }
+    return path;
+  }
+};
+
+// src/utils/schema.ts
+function toJSONSchema(types) {
+  const properties = {};
+  const required = [];
+  for (const [key, type] of Object.entries(types)) {
+    properties[key] = {
+      type
+    };
+    required.push(key);
+  }
+  return {
+    type: "object",
+    properties,
     required
   };
 }
@@ -11396,640 +11660,377 @@ async function handleExecute(ctx, executor, stateManager, config, auditSink, ses
         executionId: prelimExecutionId
       });
     } catch (error) {
-      atpRuntime.log.error("Failed to verify provenance hints", {
-        error
-      });
-    }
-  }
-  const startTime = Date.now();
-  if (auditSink) {
-    const startEvent = {
-      eventId: crypto__default.default.randomUUID(),
-      timestamp: startTime,
-      clientId: ctx.clientId || "anonymous",
-      eventType: "execution",
-      action: "start",
-      code,
-      status: "success"
-    };
-    await auditSink.write(startEvent).catch(() => {
-    });
-  }
-  const result = await executor.execute(code, executionConfig, ctx.clientId, {
-    callbackHistory: [],
-    newCallbackResult: void 0,
-    executionId: prelimExecutionId
-  });
-  if (result.status === atpProtocol.ExecutionStatus.COMPLETED && executionConfig.provenanceMode && executionConfig.provenanceMode !== atpProtocol.ProvenanceMode.NONE && ctx.cache && result.provenanceSnapshot) {
-    try {
-      atpRuntime.log.info("Attempting to emit provenance tokens from snapshot", {
-        executionId: result.executionId,
-        provenanceMode: executionConfig.provenanceMode,
-        hasCache: !!ctx.cache,
-        hasSnapshot: !!result.provenanceSnapshot,
-        resultType: typeof result.result
-      });
-      const tokens = await emitProvenanceTokens(
-        result.result,
-        ctx.clientId || "anonymous",
-        result.executionId,
-        executionConfig.provenanceMode,
-        ctx.cache,
-        atpRuntime.log.child({
-          executionId: result.executionId
-        }),
-        5e3,
-        3600,
-        result.provenanceSnapshot
-        // Pass snapshot
-      );
-      atpRuntime.log.info("Provenance tokens emitted", {
-        executionId: result.executionId,
-        tokenCount: tokens.length
-      });
-      if (tokens.length > 0) {
-        result.provenanceTokens = tokens;
-      }
-    } catch (error) {
-      atpRuntime.log.error("Failed to emit provenance tokens", {
-        error,
-        executionId: result.executionId
-      });
-    }
-  }
-  delete result.provenanceSnapshot;
-  if (result.result && typeof result.result === "object") {
-    const hasProv = "__prov_id__" in result.result;
-    result.result = cleanProvenanceIds(result.result);
-    const stillHasProv = result.result && typeof result.result === "object" && "__prov_id__" in result.result;
-    if (hasProv && !stillHasProv) {
-      atpRuntime.log.debug("Successfully cleaned __prov_id__ from result");
-    } else if (hasProv && stillHasProv) {
-      atpRuntime.log.warn("Failed to clean __prov_id__ from result!");
-    }
-  }
-  if (auditSink) {
-    const endEvent = {
-      eventId: crypto__default.default.randomUUID(),
-      timestamp: Date.now(),
-      clientId: ctx.clientId || "anonymous",
-      eventType: "execution",
-      action: result.status === atpProtocol.ExecutionStatus.PAUSED ? "pause" : "complete",
-      resourceId: result.executionId,
-      status: result.status === atpProtocol.ExecutionStatus.COMPLETED ? "success" : result.status === atpProtocol.ExecutionStatus.FAILED ? "failed" : "paused",
-      duration: Date.now() - startTime,
-      memoryUsed: result.stats?.memoryUsed,
-      llmCallsCount: result.stats?.llmCallsCount,
-      error: result.error ? {
-        message: result.error.message,
-        code: result.error.code,
-        stack: result.error.stack
-      } : void 0
-    };
-    await auditSink.write(endEvent).catch(() => {
-    });
-  }
-  if (result.status === "paused" && (result.needsCallback || result.needsCallbacks) && result.callbackHistory) {
-    if (!ctx.clientId) {
-      ctx.throw(400, "Client ID required for paused executions");
-    }
-    const provenanceSnap = executionConfig.provenanceMode && executionConfig.provenanceMode !== atpProtocol.ProvenanceMode.NONE ? atpProvenance.captureProvenanceSnapshot(result.executionId) : void 0;
-    const callbackRequest = result.needsCallback || result.needsCallbacks && result.needsCallbacks[0];
-    if (!callbackRequest) {
-      ctx.throw(500, "Invalid paused state: no callback request");
-    }
-    const transformedCodeToSave = result.transformedCode || code;
-    await stateManager.pause({
-      executionId: result.executionId,
-      code: transformedCodeToSave,
-      config: executionConfig,
-      clientId: ctx.clientId,
-      callbackRequest,
-      pausedAt: Date.now(),
-      callbackHistory: result.callbackHistory,
-      currentCallbackIndex: result.callbackHistory.length - 1,
-      context: {
-        codeTransformed: !!result.transformedCode
-      },
-      provenanceState: provenanceSnap
-    });
-  }
-  if (hintMap && hintMap.size > 0) {
-    clearHintMap(prelimExecutionId);
-  }
-  return result;
-}
-__name(handleExecute, "handleExecute");
-function tagCallbackResult(callbackRecord, result, provenanceMode) {
-  if (!provenanceMode || provenanceMode === atpProtocol.ProvenanceMode.NONE) {
-    return result;
-  }
-  if (result === null || result === void 0) {
-    return result;
-  }
-  const tagValue = /* @__PURE__ */ __name((value, source) => {
-    if (value === null || value === void 0) {
-      return value;
-    }
-    if (typeof value === "string" || typeof value === "number") {
-      const metadata = {
-        id: crypto.randomUUID(),
-        source,
-        readers: {
-          type: "public"
-        },
-        dependencies: [],
-        context: {}
-      };
-      atpProvenance.markPrimitiveTainted(value, metadata);
-      return value;
-    }
-    if (typeof value === "object") {
-      return atpProvenance.createProvenanceProxy(value, source, {
-        type: "public"
+      atpRuntime.log.error("Failed to verify provenance hints", {
+        error
       });
     }
-    return value;
-  }, "tagValue");
-  if (callbackRecord.type === "llm") {
-    const source = {
-      type: atpProvenance.ProvenanceSource.LLM,
-      operation: callbackRecord.operation || "call",
-      timestamp: Date.now()
-    };
-    return Array.isArray(result) ? result.map((r) => tagValue(r, source)) : tagValue(result, source);
   }
-  if (callbackRecord.type === "tool") {
-    const source = {
-      type: atpProvenance.ProvenanceSource.TOOL,
-      toolName: callbackRecord.payload?.toolName || "clientTool",
-      apiGroup: callbackRecord.payload?.namespace || "client",
-      timestamp: Date.now()
+  const startTime = Date.now();
+  if (auditSink) {
+    const startEvent = {
+      eventId: crypto__default.default.randomUUID(),
+      timestamp: startTime,
+      clientId: ctx.clientId || "anonymous",
+      eventType: "execution",
+      action: "start",
+      code,
+      status: "success"
     };
-    return Array.isArray(result) ? result.map((r) => tagValue(r, source)) : tagValue(result, source);
-  }
-  return result;
-}
-__name(tagCallbackResult, "tagCallbackResult");
-async function handleResume(ctx, executionId, executor, stateManager, serverConfig, sessionManager) {
-  const requestClientId = ctx.headers["x-client-id"] || ctx.clientId;
-  const requestToken = ctx.headers["authorization"]?.replace("Bearer ", "");
-  if (!requestClientId || !requestToken) {
-    atpRuntime.log.warn("Resume attempt without authentication", {
-      executionId
-    });
-    ctx.throw(401, "Authentication required");
-  }
-  ctx.clientId = requestClientId;
-  if (sessionManager) {
-    const isValid = await sessionManager.verifyClient(requestClientId, requestToken);
-    if (!isValid) {
-      atpRuntime.log.warn("Resume attempt with invalid token", {
-        executionId,
-        clientId: requestClientId
-      });
-      ctx.throw(403, "Invalid client credentials");
-    }
-  }
-  const pausedState = await stateManager.get(executionId);
-  if (!pausedState) {
-    ctx.throw(404, "Not found");
-  }
-  if (pausedState.clientId !== requestClientId) {
-    atpRuntime.log.warn("Resume attempt by unauthorized client", {
-      executionId,
-      requestClientId,
-      ownerClientId: pausedState.clientId
+    await auditSink.write(startEvent).catch(() => {
     });
-    ctx.throw(403, "Unauthorized: execution belongs to different client");
   }
-  atpRuntime.log.info("Resume authorized", {
-    executionId,
-    clientId: requestClientId
+  const result = await executor.execute(code, executionConfig, ctx.clientId, {
+    callbackHistory: [],
+    newCallbackResult: void 0,
+    executionId: prelimExecutionId
   });
-  if (pausedState.provenanceState && pausedState.config.provenanceMode && pausedState.config.provenanceMode !== atpProtocol.ProvenanceMode.NONE) {
-    const state = pausedState.provenanceState;
-    if ("primitives" in state) {
-      atpProvenance.restoreProvenanceSnapshot(executionId, state);
-      atpRuntime.log.info("Provenance snapshot restored", {
-        executionId,
-        registryEntries: state.registry.length,
-        primitiveEntries: state.primitives.length
+  if (result.status === atpProtocol.ExecutionStatus.COMPLETED && executionConfig.provenanceMode && executionConfig.provenanceMode !== atpProtocol.ProvenanceMode.NONE && ctx.cache && result.provenanceSnapshot) {
+    try {
+      atpRuntime.log.info("Attempting to emit provenance tokens from snapshot", {
+        executionId: result.executionId,
+        provenanceMode: executionConfig.provenanceMode,
+        hasCache: !!ctx.cache,
+        hasSnapshot: !!result.provenanceSnapshot,
+        resultType: typeof result.result
       });
-    } else {
-      const provenanceMap = new Map(state.registry);
-      atpProvenance.restoreProvenanceSnapshot(executionId, {
-        registry: state.registry,
-        primitives: []
+      const tokens = await emitProvenanceTokens(
+        result.result,
+        ctx.clientId || "anonymous",
+        result.executionId,
+        executionConfig.provenanceMode,
+        ctx.cache,
+        atpRuntime.log.child({
+          executionId: result.executionId
+        }),
+        5e3,
+        3600,
+        result.provenanceSnapshot
+        // Pass snapshot
+      );
+      atpRuntime.log.info("Provenance tokens emitted", {
+        executionId: result.executionId,
+        tokenCount: tokens.length
       });
-      atpRuntime.log.info("Provenance state restored (legacy format)", {
-        executionId,
-        entries: provenanceMap.size
+      if (tokens.length > 0) {
+        result.provenanceTokens = tokens;
+      }
+    } catch (error) {
+      atpRuntime.log.error("Failed to emit provenance tokens", {
+        error,
+        executionId: result.executionId
       });
     }
   }
-  const request = ctx.body;
-  let updatedHistory;
-  let callbackResult;
-  const lastRecord = pausedState.callbackHistory[pausedState.currentCallbackIndex];
-  if (!lastRecord) {
-    atpRuntime.log.error("No callback record found at current index", {
-      executionId,
-      currentIndex: pausedState.currentCallbackIndex
-    });
-    ctx.throw(500, "Invalid paused state: no callback record");
-  }
-  if (request.results) {
-    const batchResults = request.results;
-    atpRuntime.log.info("Processing batch callback results", {
-      executionId,
-      batchCount: batchResults.length
-    });
-    for (const br of batchResults) {
-      if (br.result && typeof br.result === "object" && "__error" in br.result) {
-        const errorObj = br.result;
-        if (errorObj.message && errorObj.message.includes("service not provided")) {
-          atpRuntime.log.error("Service provider error in batch", {
-            executionId,
-            error: errorObj.message
-          });
-          await stateManager.delete(executionId);
-          return {
-            executionId,
-            status: atpProtocol.ExecutionStatus.FAILED,
-            error: {
-              message: errorObj.message || "Service not available",
-              code: "SERVICE_NOT_PROVIDED"
-            },
-            stats: {
-              duration: 0,
-              memoryUsed: 0,
-              llmCallsCount: 0,
-              approvalCallsCount: 0
-            }
-          };
-        }
-      }
-    }
-    const taggedBatchResults = batchResults.map((br) => ({
-      ...br,
-      result: tagCallbackResult(lastRecord, br.result, pausedState.config.provenanceMode)
-    }));
-    callbackResult = taggedBatchResults.map((br) => br.result);
-    updatedHistory = pausedState.callbackHistory.map((record, index) => {
-      if (index === pausedState.currentCallbackIndex) {
-        return {
-          ...record,
-          result: callbackResult
-        };
-      }
-      return record;
-    });
-  } else {
-    const rawResult = request.result;
-    if (rawResult && typeof rawResult === "object" && "__error" in rawResult) {
-      const errorObj = rawResult;
-      if (errorObj.message && errorObj.message.includes("service not provided")) {
-        atpRuntime.log.error("Service provider error", {
-          executionId,
-          error: errorObj.message
-        });
-        await stateManager.delete(executionId);
-        return {
-          executionId,
-          status: atpProtocol.ExecutionStatus.FAILED,
-          error: {
-            message: errorObj.message || "Service not available",
-            code: "SERVICE_NOT_PROVIDED"
-          },
-          stats: {
-            duration: 0,
-            memoryUsed: 0,
-            llmCallsCount: 0,
-            approvalCallsCount: 0
-          }
-        };
-      }
+  delete result.provenanceSnapshot;
+  if (result.result && typeof result.result === "object") {
+    const hasProv = "__prov_id__" in result.result;
+    result.result = cleanProvenanceIds(result.result);
+    const stillHasProv = result.result && typeof result.result === "object" && "__prov_id__" in result.result;
+    if (hasProv && !stillHasProv) {
+      atpRuntime.log.debug("Successfully cleaned __prov_id__ from result");
+    } else if (hasProv && stillHasProv) {
+      atpRuntime.log.warn("Failed to clean __prov_id__ from result!");
     }
-    callbackResult = tagCallbackResult(lastRecord, rawResult, pausedState.config.provenanceMode);
-    updatedHistory = pausedState.callbackHistory.map((record, index) => {
-      if (index === pausedState.currentCallbackIndex) {
-        return {
-          ...record,
-          result: callbackResult
-        };
-      }
-      return record;
-    });
   }
-  const restoredConfig = {
-    ...pausedState.config,
-    securityPolicies: serverConfig.execution.securityPolicies || []
-  };
-  const result = await executor.execute(pausedState.code, restoredConfig, pausedState.clientId, {
-    callbackHistory: updatedHistory,
-    newCallbackResult: callbackResult,
-    executionId
-  });
-  if (result.status === atpProtocol.ExecutionStatus.PAUSED && result.needsCallbacks && result.callbackHistory) {
-    const provenanceState = pausedState.config.provenanceMode && pausedState.config.provenanceMode !== atpProtocol.ProvenanceMode.NONE ? atpProvenance.captureProvenanceSnapshot(result.executionId) : void 0;
-    const codeToSave = result.transformedCode || pausedState.code;
-    await stateManager.pause({
-      executionId: result.executionId,
-      code: codeToSave,
-      config: pausedState.config,
-      clientId: pausedState.clientId,
-      callbackRequest: result.needsCallbacks[0],
-      pausedAt: Date.now(),
-      callbackHistory: result.callbackHistory,
-      currentCallbackIndex: result.callbackHistory.length - 1,
-      context: {},
-      provenanceState
+  if (auditSink) {
+    const endEvent = {
+      eventId: crypto__default.default.randomUUID(),
+      timestamp: Date.now(),
+      clientId: ctx.clientId || "anonymous",
+      eventType: "execution",
+      action: result.status === atpProtocol.ExecutionStatus.PAUSED ? "pause" : "complete",
+      resourceId: result.executionId,
+      status: result.status === atpProtocol.ExecutionStatus.COMPLETED ? "success" : result.status === atpProtocol.ExecutionStatus.FAILED ? "failed" : "paused",
+      duration: Date.now() - startTime,
+      memoryUsed: result.stats?.memoryUsed,
+      llmCallsCount: result.stats?.llmCallsCount,
+      error: result.error ? {
+        message: result.error.message,
+        code: result.error.code,
+        stack: result.error.stack
+      } : void 0
+    };
+    await auditSink.write(endEvent).catch(() => {
     });
-  } else if (result.status === atpProtocol.ExecutionStatus.PAUSED && result.needsCallback && result.callbackHistory) {
-    const provenanceState = pausedState.config.provenanceMode && pausedState.config.provenanceMode !== atpProtocol.ProvenanceMode.NONE ? atpProvenance.captureProvenanceSnapshot(result.executionId) : void 0;
-    const codeToSave = result.transformedCode || pausedState.code;
+  }
+  if (result.status === "paused" && (result.needsCallback || result.needsCallbacks) && result.callbackHistory) {
+    if (!ctx.clientId) {
+      ctx.throw(400, "Client ID required for paused executions");
+    }
+    const provenanceSnap = executionConfig.provenanceMode && executionConfig.provenanceMode !== atpProtocol.ProvenanceMode.NONE ? atpProvenance.captureProvenanceSnapshot(result.executionId) : void 0;
+    const callbackRequest = result.needsCallback || result.needsCallbacks && result.needsCallbacks[0];
+    if (!callbackRequest) {
+      ctx.throw(500, "Invalid paused state: no callback request");
+    }
+    const transformedCodeToSave = result.transformedCode || code;
     await stateManager.pause({
       executionId: result.executionId,
-      code: codeToSave,
-      config: pausedState.config,
-      clientId: pausedState.clientId,
-      callbackRequest: result.needsCallback,
+      code: transformedCodeToSave,
+      config: executionConfig,
+      clientId: ctx.clientId,
+      callbackRequest,
       pausedAt: Date.now(),
       callbackHistory: result.callbackHistory,
       currentCallbackIndex: result.callbackHistory.length - 1,
-      context: {},
-      provenanceState
+      context: {
+        codeTransformed: !!result.transformedCode
+      },
+      provenanceState: provenanceSnap
     });
-  } else {
-    await stateManager.delete(executionId);
+  }
+  if (hintMap && hintMap.size > 0) {
+    clearHintMap(prelimExecutionId);
   }
   return result;
 }
-__name(handleResume, "handleResume");
-var APIAggregator = class {
-  static {
-    __name(this, "APIAggregator");
-  }
-  apiGroups;
-  /**
-  * Creates a new APIAggregator instance.
-  * @param apiGroups - Array of API group configurations
-  */
-  constructor(apiGroups) {
-    this.apiGroups = apiGroups;
-  }
-  /**
-  * Generates TypeScript type definitions for selected API groups.
-  * @param selectedGroups - Optional array of group names to include
-  * @returns TypeScript definition string
-  */
-  async generateTypeScript(selectedGroups) {
-    const groups = selectedGroups ? this.apiGroups.filter((g) => selectedGroups.includes(g.name)) : this.apiGroups;
-    let typescript = `// Agent Tool Protocol Runtime SDK v1.0.0
-
-`;
-    typescript += this.generateRuntimeTypes();
-    for (const group of groups) {
-      typescript += `
-// API Group: ${group.name}
-`;
-      if (group.functions) {
-        for (const func of group.functions) {
-          typescript += this.generateFunctionTypes(func, group.name);
-        }
-      }
-    }
-    typescript += this.generateAPINamespace(groups);
-    return typescript;
+__name(handleExecute, "handleExecute");
+function tagCallbackResult(callbackRecord, result, provenanceMode) {
+  if (!provenanceMode || provenanceMode === atpProtocol.ProvenanceMode.NONE) {
+    return result;
   }
-  /**
-  * Generates TypeScript definitions for the runtime SDK.
-  * @param options - Optional filtering options
-  * @returns TypeScript definition string
-  */
-  generateRuntimeTypes(options) {
-    return atpRuntime.generateRuntimeTypes(atpRuntime.GENERATED_METADATA, options);
+  if (result === null || result === void 0) {
+    return result;
   }
-  /**
-  * Generates TypeScript types for a single function.
-  * @param func - Function definition
-  * @param groupName - API group name
-  * @returns TypeScript definition string
-  */
-  generateFunctionTypes(func, groupName) {
-    const inputTypeName = `${func.name}_Input`;
-    const outputTypeName = `${func.name}_Output`;
-    let typescript = `
-interface ${inputTypeName} {
-`;
-    if (func.inputSchema?.properties) {
-      const required = func.inputSchema.required || [];
-      for (const [key, value] of Object.entries(func.inputSchema.properties)) {
-        const prop = value;
-        const tsType = this.jsonSchemaTypeToTS(prop.type ?? "any");
-        const comment = prop.description ? ` // ${prop.description}` : "";
-        const optional = required.includes(key) ? "" : "?";
-        typescript += `  ${key}${optional}: ${tsType};${comment}
-`;
-      }
+  const tagValue = /* @__PURE__ */ __name((value, source) => {
+    if (value === null || value === void 0) {
+      return value;
     }
-    typescript += `}
-`;
-    typescript += `
-interface ${outputTypeName} {
-`;
-    if (func.outputSchema) {
-      const outputType = this.jsonSchemaToTSInterface(func.outputSchema);
-      typescript += outputType;
-    } else {
-      typescript += `  [key: string]: unknown;
-`;
+    if (typeof value === "string" || typeof value === "number") {
+      const metadata = {
+        id: crypto.randomUUID(),
+        source,
+        readers: {
+          type: "public"
+        },
+        dependencies: [],
+        context: {}
+      };
+      atpProvenance.markPrimitiveTainted(value, metadata);
+      return value;
     }
-    typescript += `}
-`;
-    return typescript;
-  }
-  /**
-  * Converts JSON Schema type to TypeScript type.
-  * @param type - JSON Schema type string
-  * @returns TypeScript type string
-  */
-  jsonSchemaTypeToTS(type) {
-    switch (type) {
-      case "string":
-        return "string";
-      case "number":
-      case "integer":
-        return "number";
-      case "boolean":
-        return "boolean";
-      case "array":
-        return "unknown[]";
-      case "object":
-        return "Record<string, unknown>";
-      default:
-        return "unknown";
+    if (typeof value === "object") {
+      return atpProvenance.createProvenanceProxy(value, source, {
+        type: "public"
+      });
     }
+    return value;
+  }, "tagValue");
+  if (callbackRecord.type === "llm") {
+    const source = {
+      type: atpProvenance.ProvenanceSource.LLM,
+      operation: callbackRecord.operation || "call",
+      timestamp: Date.now()
+    };
+    return Array.isArray(result) ? result.map((r) => tagValue(r, source)) : tagValue(result, source);
   }
-  /**
-  * Converts a full JSON Schema to TypeScript interface properties
-  * @param schema - JSON Schema object
-  * @param depth - Current recursion depth (prevents infinite recursion)
-  * @returns TypeScript interface properties string
-  */
-  jsonSchemaToTSInterface(schema, depth = 0) {
-    if (depth > 3) {
-      return "  [key: string]: unknown;\n";
-    }
-    if (schema.type === "array" && schema.items) {
-      const itemType = this.schemaToTSType(schema.items, depth + 1);
-      return `  [index: number]: ${itemType};
-  length: number;
-`;
-    }
-    if (schema.type === "object" && schema.properties) {
-      const required = schema.required || [];
-      let result = "";
-      for (const [key, value] of Object.entries(schema.properties)) {
-        const prop = value;
-        const optional = required.includes(key) ? "" : "?";
-        const tsType = this.schemaToTSType(prop, depth + 1);
-        result += `  ${key}${optional}: ${tsType};
-`;
-      }
-      return result || "  [key: string]: unknown;\n";
-    }
-    return "  [key: string]: unknown;\n";
+  if (callbackRecord.type === "tool") {
+    const source = {
+      type: atpProvenance.ProvenanceSource.TOOL,
+      toolName: callbackRecord.payload?.toolName || "clientTool",
+      apiGroup: callbackRecord.payload?.namespace || "client",
+      timestamp: Date.now()
+    };
+    return Array.isArray(result) ? result.map((r) => tagValue(r, source)) : tagValue(result, source);
   }
-  /**
-  * Converts any JSON Schema to a TypeScript type expression
-  * @param schema - JSON Schema object
-  * @param depth - Current recursion depth
-  * @returns TypeScript type expression
-  */
-  schemaToTSType(schema, depth = 0) {
-    if (!schema) return "unknown";
-    if (depth > 3) {
-      return "unknown";
-    }
-    if (schema.type === "array") {
-      if (schema.items) {
-        const itemType = this.schemaToTSType(schema.items, depth + 1);
-        return `${itemType}[]`;
-      }
-      return "unknown[]";
-    }
-    if (schema.enum) {
-      return schema.enum.map((v) => `"${v}"`).join(" | ") || "string";
-    }
-    if (schema.type === "object" && schema.properties) {
-      const required = schema.required || [];
-      const props = [];
-      for (const [key, value] of Object.entries(schema.properties)) {
-        const prop = value;
-        const optional = required.includes(key) ? "" : "?";
-        const tsType = this.schemaToTSType(prop, depth + 1);
-        props.push(`${key}${optional}: ${tsType}`);
-      }
-      if (props.length > 0) {
-        return `{ ${props.join("; ")} }`;
-      }
-      return "Record<string, unknown>";
-    }
-    if (schema.type) {
-      return this.jsonSchemaTypeToTS(schema.type);
+  return result;
+}
+__name(tagCallbackResult, "tagCallbackResult");
+async function handleResume(ctx, executionId, executor, stateManager, serverConfig, sessionManager) {
+  const requestClientId = ctx.headers["x-client-id"] || ctx.clientId;
+  const requestToken = ctx.headers["authorization"]?.replace("Bearer ", "");
+  if (!requestClientId || !requestToken) {
+    atpRuntime.log.warn("Resume attempt without authentication", {
+      executionId
+    });
+    ctx.throw(401, "Authentication required");
+  }
+  ctx.clientId = requestClientId;
+  if (sessionManager) {
+    const isValid = await sessionManager.verifyClient(requestClientId, requestToken);
+    if (!isValid) {
+      atpRuntime.log.warn("Resume attempt with invalid token", {
+        executionId,
+        clientId: requestClientId
+      });
+      ctx.throw(403, "Invalid client credentials");
     }
-    return "unknown";
   }
-  /**
-  * Helper to check if a string is a valid JavaScript identifier
-  */
-  isValidIdentifier(name) {
-    return /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(name);
+  const pausedState = await stateManager.get(executionId);
+  if (!pausedState) {
+    ctx.throw(404, "Not found");
   }
-  /**
-  * Helper to safely format a property name for TypeScript type definitions
-  * Returns the property name with quotes if needed, or just the name if valid
-  */
-  formatPropertyName(name) {
-    if (!this.isValidIdentifier(name)) {
-      return `'${name}'`;
+  if (pausedState.clientId !== requestClientId) {
+    atpRuntime.log.warn("Resume attempt by unauthorized client", {
+      executionId,
+      requestClientId,
+      ownerClientId: pausedState.clientId
+    });
+    ctx.throw(403, "Unauthorized: execution belongs to different client");
+  }
+  atpRuntime.log.info("Resume authorized", {
+    executionId,
+    clientId: requestClientId
+  });
+  if (pausedState.provenanceState && pausedState.config.provenanceMode && pausedState.config.provenanceMode !== atpProtocol.ProvenanceMode.NONE) {
+    const state = pausedState.provenanceState;
+    if ("primitives" in state) {
+      atpProvenance.restoreProvenanceSnapshot(executionId, state);
+      atpRuntime.log.info("Provenance snapshot restored", {
+        executionId,
+        registryEntries: state.registry.length,
+        primitiveEntries: state.primitives.length
+      });
+    } else {
+      const provenanceMap = new Map(state.registry);
+      atpProvenance.restoreProvenanceSnapshot(executionId, {
+        registry: state.registry,
+        primitives: []
+      });
+      atpRuntime.log.info("Provenance state restored (legacy format)", {
+        executionId,
+        entries: provenanceMap.size
+      });
     }
-    return name;
   }
-  /**
-  * Generates the API namespace with all function declarations.
-  * Handles hierarchical group names (e.g., "github/readOnly" -> api.github.readOnly)
-  * @param groups - API groups to include
-  * @returns TypeScript definition string
-  */
-  generateAPINamespace(groups) {
-    const rootGroups = /* @__PURE__ */ new Map();
-    for (const group of groups) {
-      if (!group.functions || group.functions.length === 0) continue;
-      const parts = group.name.split("/");
-      let current = rootGroups;
-      for (let i = 0; i < parts.length; i++) {
-        const part = parts[i];
-        if (!current.has(part)) {
-          current.set(part, {
-            functions: [],
-            subgroups: /* @__PURE__ */ new Map()
+  const request = ctx.body;
+  let updatedHistory;
+  let callbackResult;
+  const lastRecord = pausedState.callbackHistory[pausedState.currentCallbackIndex];
+  if (!lastRecord) {
+    atpRuntime.log.error("No callback record found at current index", {
+      executionId,
+      currentIndex: pausedState.currentCallbackIndex
+    });
+    ctx.throw(500, "Invalid paused state: no callback record");
+  }
+  if (request.results) {
+    const batchResults = request.results;
+    atpRuntime.log.info("Processing batch callback results", {
+      executionId,
+      batchCount: batchResults.length
+    });
+    for (const br of batchResults) {
+      if (br.result && typeof br.result === "object" && "__error" in br.result) {
+        const errorObj = br.result;
+        if (errorObj.message && errorObj.message.includes("service not provided")) {
+          atpRuntime.log.error("Service provider error in batch", {
+            executionId,
+            error: errorObj.message
           });
+          await stateManager.delete(executionId);
+          return {
+            executionId,
+            status: atpProtocol.ExecutionStatus.FAILED,
+            error: {
+              message: errorObj.message || "Service not available",
+              code: "SERVICE_NOT_PROVIDED"
+            },
+            stats: {
+              duration: 0,
+              memoryUsed: 0,
+              llmCallsCount: 0,
+              approvalCallsCount: 0
+            }
+          };
         }
-        const node = current.get(part);
-        if (i === parts.length - 1) {
-          node.functions.push(...group.functions);
-        }
-        current = node.subgroups;
       }
     }
-    const generateLevel = /* @__PURE__ */ __name((groups2, indent2) => {
-      let ts = "";
-      for (const [name, node] of groups2.entries()) {
-        if (!name) continue;
-        const formattedName = this.formatPropertyName(name);
-        ts += `${indent2}${formattedName}: {
-`;
-        for (const func of node.functions) {
-          if (!func.name) continue;
-          const funcName = this.formatPropertyName(func.name);
-          const description = func.description && typeof func.description === "string" ? func.description.replace(/\n/g, " ").substring(0, 200) : "";
-          ts += `${indent2}  /**
-${indent2}   * ${description}
-${indent2}   */
-`;
-          ts += `${indent2}  ${funcName}(params: ${func.name}_Input): Promise<${func.name}_Output>;
-`;
-        }
-        if (node.subgroups.size > 0) {
-          ts += generateLevel(node.subgroups, indent2 + "  ");
-        }
-        ts += `${indent2}};
-`;
+    const taggedBatchResults = batchResults.map((br) => ({
+      ...br,
+      result: tagCallbackResult(lastRecord, br.result, pausedState.config.provenanceMode)
+    }));
+    callbackResult = taggedBatchResults.map((br) => br.result);
+    updatedHistory = pausedState.callbackHistory.map((record, index) => {
+      if (index === pausedState.currentCallbackIndex) {
+        return {
+          ...record,
+          result: callbackResult
+        };
       }
-      return ts;
-    }, "generateLevel");
-    let typescript = `
-declare const api: {
-`;
-    typescript += generateLevel(rootGroups, "  ");
-    typescript += `};
-`;
-    typescript += `
-export { api };
-`;
-    return typescript;
+      return record;
+    });
+  } else {
+    const rawResult = request.result;
+    if (rawResult && typeof rawResult === "object" && "__error" in rawResult) {
+      const errorObj = rawResult;
+      if (errorObj.message && errorObj.message.includes("service not provided")) {
+        atpRuntime.log.error("Service provider error", {
+          executionId,
+          error: errorObj.message
+        });
+        await stateManager.delete(executionId);
+        return {
+          executionId,
+          status: atpProtocol.ExecutionStatus.FAILED,
+          error: {
+            message: errorObj.message || "Service not available",
+            code: "SERVICE_NOT_PROVIDED"
+          },
+          stats: {
+            duration: 0,
+            memoryUsed: 0,
+            llmCallsCount: 0,
+            approvalCallsCount: 0
+          }
+        };
+      }
+    }
+    callbackResult = tagCallbackResult(lastRecord, rawResult, pausedState.config.provenanceMode);
+    updatedHistory = pausedState.callbackHistory.map((record, index) => {
+      if (index === pausedState.currentCallbackIndex) {
+        return {
+          ...record,
+          result: callbackResult
+        };
+      }
+      return record;
+    });
   }
-  /**
-  * Gets the list of available API group names.
-  * @returns Array of API group names
-  */
-  getApiGroups() {
-    return this.apiGroups.map((g) => g.name);
+  const restoredConfig = {
+    ...pausedState.config,
+    securityPolicies: serverConfig.execution.securityPolicies || []
+  };
+  const result = await executor.execute(pausedState.code, restoredConfig, pausedState.clientId, {
+    callbackHistory: updatedHistory,
+    newCallbackResult: callbackResult,
+    executionId
+  });
+  if (result.status === atpProtocol.ExecutionStatus.PAUSED && result.needsCallbacks && result.callbackHistory) {
+    const provenanceState = pausedState.config.provenanceMode && pausedState.config.provenanceMode !== atpProtocol.ProvenanceMode.NONE ? atpProvenance.captureProvenanceSnapshot(result.executionId) : void 0;
+    const codeToSave = result.transformedCode || pausedState.code;
+    await stateManager.pause({
+      executionId: result.executionId,
+      code: codeToSave,
+      config: pausedState.config,
+      clientId: pausedState.clientId,
+      callbackRequest: result.needsCallbacks[0],
+      pausedAt: Date.now(),
+      callbackHistory: result.callbackHistory,
+      currentCallbackIndex: result.callbackHistory.length - 1,
+      context: {},
+      provenanceState
+    });
+  } else if (result.status === atpProtocol.ExecutionStatus.PAUSED && result.needsCallback && result.callbackHistory) {
+    const provenanceState = pausedState.config.provenanceMode && pausedState.config.provenanceMode !== atpProtocol.ProvenanceMode.NONE ? atpProvenance.captureProvenanceSnapshot(result.executionId) : void 0;
+    const codeToSave = result.transformedCode || pausedState.code;
+    await stateManager.pause({
+      executionId: result.executionId,
+      code: codeToSave,
+      config: pausedState.config,
+      clientId: pausedState.clientId,
+      callbackRequest: result.needsCallback,
+      pausedAt: Date.now(),
+      callbackHistory: result.callbackHistory,
+      currentCallbackIndex: result.callbackHistory.length - 1,
+      context: {},
+      provenanceState
+    });
+  } else {
+    await stateManager.delete(executionId);
   }
-};
+  return result;
+}
+__name(handleResume, "handleResume");
 
 // src/handlers/definitions.handler.ts
 async function getDefinitions(apiGroups) {