@nebutra/agent-runtime 0.2.0

package/dist/rollout-store-persistent.d.ts

@@ -0,0 +1,48 @@
+import { RolloutStore, RolloutLine } from './rollout.js';
+import './model.js';
+
+/**
+ * Production-grade, tenant-scoped {@link RolloutStore} backed by an injectable
+ * persistence port. This package depends on NO datastore: a Postgres /
+ * ClickHouse / `@nebutra/db` / `@nebutra/audit` adapter satisfies
+ * {@link RolloutPersistencePort} from the outside, so the "no infra change"
+ * promise stays honest — swap the adapter, keep the interface.
+ *
+ * Tenancy is structural: `tenantId` is part of the storage key AND Zod-validated
+ * on every read and write. Cross-tenant access is impossible by construction.
+ * The store fails closed — empty identifiers and malformed stored payloads
+ * raise typed errors; records are never silently dropped.
+ */
+
+/**
+ * Minimal append-only persistence seam. Implementations MUST persist records
+ * durably and return them ascending by `seq` for a given (tenant, thread).
+ */
+interface RolloutPersistencePort {
+    put(record: {
+        tenantId: string;
+        threadId: string;
+        seq: number;
+        at: string;
+        payload: string;
+    }): Promise<void>;
+    /** Records for one (tenant, thread), ascending by seq. */
+    list(tenantId: string, threadId: string): Promise<{
+        seq: number;
+        payload: string;
+    }[]>;
+}
+/** Raised when a stored payload cannot be faithfully reconstructed. */
+declare class RoundTripError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+declare class PersistentRolloutStore implements RolloutStore {
+    #private;
+    constructor(port: RolloutPersistencePort);
+    append(line: RolloutLine): Promise<void>;
+    read(tenantIdArg: string, threadIdArg: string): Promise<readonly RolloutLine[]>;
+}
+
+export { PersistentRolloutStore, type RolloutPersistencePort, RoundTripError };

package/dist/rollout-store-persistent.js

@@ -0,0 +1,9 @@
+import {
+  PersistentRolloutStore,
+  RoundTripError
+} from "./chunk-2DA6Q6TN.js";
+export {
+  PersistentRolloutStore,
+  RoundTripError
+};
+//# sourceMappingURL=rollout-store-persistent.js.map

package/dist/rollout-store-persistent.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/rollout.d.ts

@@ -0,0 +1,82 @@
+import { TurnConfig, ThreadEvent, ThreadItem } from './model.js';
+
+/**
+ * Event-sourced rollout / session trace (WRAP — capability #7).
+ *
+ * Faithful re-expression of the upstream rollout model: an append-only typed
+ * event log, state derived by replay, a first-class context-compaction marker
+ * (so replay stays bounded), and a per-item persistence policy that sanitizes
+ * and size-caps outputs before they are durable.
+ *
+ * Multi-tenant adaptation: every rollout line carries `tenantId`; the store
+ * interface is tenant-scoped so a Postgres/ClickHouse-backed implementation
+ * (via `@nebutra/audit` providers / `@nebutra/db`) replaces the upstream
+ * single-host jsonl + embedded-SQLite assumptions. Only an in-memory
+ * reference store ships here.
+ */
+
+/** Cap mirrors the upstream persisted-output ceiling. */
+declare const PERSISTED_OUTPUT_MAX_BYTES = 10000;
+type EventPersistenceMode = "limited" | "extended";
+/** One durable line in a thread's append-only log. */
+type RolloutLine = {
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly type: "session_meta";
+    readonly config: TurnConfig;
+    readonly at: string;
+} | {
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly type: "event";
+    readonly event: ThreadEvent;
+    readonly at: string;
+} | {
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly type: "turn_context";
+    readonly config: TurnConfig;
+    readonly at: string;
+} | {
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly type: "compacted";
+    readonly summary: string;
+    readonly droppedThrough: string;
+    readonly at: string;
+};
+/**
+ * Persistence policy: decide per item whether it is durable, and sanitize +
+ * size-cap its output first. Executive markers are always persisted.
+ */
+declare function isPersisted(item: ThreadItem, mode: EventPersistenceMode): boolean;
+/** Truncate aggregated command output to the persisted ceiling. */
+declare function sanitizeForPersist(item: ThreadItem): ThreadItem;
+/** Tenant-scoped append-only store. Replace the impl, keep the interface. */
+interface RolloutStore {
+    append(line: RolloutLine): Promise<void>;
+    /** Lines for a thread, in append order. */
+    read(tenantId: string, threadId: string): Promise<readonly RolloutLine[]>;
+}
+/** In-memory reference store (dev/test only — never multi-instance safe). */
+declare class InMemoryRolloutStore implements RolloutStore {
+    #private;
+    append(line: RolloutLine): Promise<void>;
+    read(tenantId: string, threadId: string): Promise<readonly RolloutLine[]>;
+}
+/** Derived thread state — the projection rebuilt by replaying the log. */
+interface ThreadProjection {
+    readonly tenantId: string;
+    readonly threadId: string;
+    config?: TurnConfig;
+    readonly items: ThreadItem[];
+    /** Marks where a compaction summary replaced earlier history. */
+    compactionSummary?: string;
+}
+/**
+ * Replay an append-only log into derived state. A `compacted` line bounds
+ * replay: items prior to it are represented by the summary, not re-applied.
+ */
+declare function replay(lines: readonly RolloutLine[]): ThreadProjection | null;
+
+export { type EventPersistenceMode, InMemoryRolloutStore, PERSISTED_OUTPUT_MAX_BYTES, type RolloutLine, type RolloutStore, type ThreadProjection, isPersisted, replay, sanitizeForPersist };

package/dist/rollout.js

@@ -0,0 +1,15 @@
+import {
+  InMemoryRolloutStore,
+  PERSISTED_OUTPUT_MAX_BYTES,
+  isPersisted,
+  replay,
+  sanitizeForPersist
+} from "./chunk-37BBB2P2.js";
+export {
+  InMemoryRolloutStore,
+  PERSISTED_OUTPUT_MAX_BYTES,
+  isPersisted,
+  replay,
+  sanitizeForPersist
+};
+//# sourceMappingURL=rollout.js.map

package/dist/rollout.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/sandbox.d.ts

@@ -0,0 +1,65 @@
+import { CapabilityPolicy } from './policy.js';
+import 'zod';
+
+/**
+ * External-sandbox delegation seam (PORT — capability #11).
+ *
+ * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant
+ * web runtime NEVER executes untrusted code itself and introduces no isolation
+ * infrastructure. It only:
+ *   1. carries the capability policy (see ./policy),
+ *   2. delegates execution to an external isolator behind this interface
+ *      (a self-hosted kernel sidecar — Track B — or any other executor),
+ *   3. records the outcome as a `command_execution` item (see ./model).
+ *
+ * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows
+ * restricted token) are deliberately NOT ported — they are single-host and
+ * out of scope for a multi-tenant web product.
+ */
+
+interface SandboxExecRequest {
+    /** Mandatory tenant scope — every delegated exec is tenant-bound. */
+    readonly tenantId: string;
+    readonly threadId: string;
+    readonly command: string;
+    /** The capabilities the external isolator must honor. */
+    readonly capabilityPolicy: CapabilityPolicy;
+    /** Optional inputs the executor should materialize before running. */
+    readonly inputs?: Readonly<Record<string, string>>;
+}
+interface SandboxExecResult {
+    readonly exitCode: number;
+    readonly aggregatedOutput: string;
+    /** Identifier of the isolator that actually ran the command. */
+    readonly executedOn: string;
+}
+/**
+ * The only thing Track A depends on for execution. Implemented by a decoupled
+ * isolator over the ./protocol contract; never implemented in-process here.
+ */
+interface ExternalSandbox {
+    exec(request: SandboxExecRequest): Promise<SandboxExecResult>;
+}
+/**
+ * Fail-closed default. Wiring this in production requires a real
+ * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.
+ */
+declare class NoExecutorConfiguredError extends Error {
+    constructor();
+}
+declare const REFUSING_SANDBOX: ExternalSandbox;
+declare class SandboxDelegationError extends Error {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/**
+ * The concrete Track-B coupling: delegate execution over HTTP to the decoupled
+ * Rust isolator (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`). The
+ * isolator is fail-closed; a non-2xx (e.g. 403 refusal) is surfaced as an
+ * error and never coerced into a fabricated result.
+ */
+declare function createHttpSandbox(baseUrl: string, fetchImpl?: typeof fetch): ExternalSandbox;
+/** Guard: reject the most dangerous posture unless explicitly opted in. */
+declare function assertSafePosture(policy: CapabilityPolicy, allowDanger?: boolean): void;
+
+export { type ExternalSandbox, NoExecutorConfiguredError, REFUSING_SANDBOX, SandboxDelegationError, type SandboxExecRequest, type SandboxExecResult, assertSafePosture, createHttpSandbox };

package/dist/sandbox.js

@@ -0,0 +1,15 @@
+import {
+  NoExecutorConfiguredError,
+  REFUSING_SANDBOX,
+  SandboxDelegationError,
+  assertSafePosture,
+  createHttpSandbox
+} from "./chunk-MUF7ZZTO.js";
+export {
+  NoExecutorConfiguredError,
+  REFUSING_SANDBOX,
+  SandboxDelegationError,
+  assertSafePosture,
+  createHttpSandbox
+};
+//# sourceMappingURL=sandbox.js.map

package/dist/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/skills.d.ts

@@ -0,0 +1,93 @@
+import { z } from 'zod';
+import { Definition, DefinitionResolver, ResolveContext } from './definitions.js';
+
+/**
+ * Skills system (WRAP — progressive-disclosure capability).
+ *
+ * Faithful re-expression of the source harness's two-phase skill model:
+ *
+ *   Phase 1 — Listing (cheap, always in context): a budget-bounded catalog
+ *     exposing only {name, description, whenToUse} per skill. First-party
+ *     skills (bundled/builtin tier) are never truncated and never dropped;
+ *     lower-tier skills degrade to names-only, then drop, as the context
+ *     budget is exhausted. Path-activated skills stay hidden until a touched
+ *     file matches one of their globs.
+ *
+ *   Phase 2 — Invocation (lazy, on demand): expand the chosen skill's body
+ *     into turn messages, with arg/var substitution and a merged tool
+ *     allowlist contributed to the permission context.
+ *
+ * A skill IS a `Definition` — the same tenant-scoped layered resolver backs
+ * the command registry and the subagent registry (see ./definitions).
+ *
+ * SECURITY: this re-expression intentionally drops the source's body-side
+ * command-substitution (the upstream "!`…`" inline-shell facility). Skill
+ * bodies are inert text; they NEVER trigger host shell execution here. All
+ * entry points require a non-empty `tenantId` and fail closed; cross-tenant
+ * inputs are rejected by the underlying `DefinitionResolver`. Pure data/logic
+ * — no host filesystem access (resource base is an injected indirection).
+ */
+
+/** A skill is just a resolvable `Definition`. */
+type SkillRecord = Definition;
+/** One catalog entry — only the cheap, always-in-context surface. */
+interface SkillListingEntry {
+    readonly name: string;
+    readonly description: string;
+    readonly whenToUse?: string | undefined;
+    /** True when this entry was degraded to names-only by the budget. */
+    readonly degraded: boolean;
+    readonly firstParty: boolean;
+}
+interface SkillListing {
+    readonly entries: readonly SkillListingEntry[];
+    readonly text: string;
+}
+declare const listingOptionsSchema: z.ZodObject<{
+    maxListingDescChars: z.ZodDefault<z.ZodNumber>;
+    contextWindowTokens: z.ZodDefault<z.ZodNumber>;
+    budgetPercent: z.ZodDefault<z.ZodNumber>;
+    touchedPaths: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type SkillListingOptions = z.input<typeof listingOptionsSchema>;
+/**
+ * Phase 1 — build the always-in-context skill catalog. Pure & deterministic.
+ *
+ * Budget = `contextWindowTokens * budgetPercent`. First-party skills are
+ * emitted in full and do NOT consume budget against being dropped. Each
+ * remaining skill is tried at full description; if it would overflow it is
+ * degraded to names-only; if even that overflows it is dropped. Skills in
+ * `ctx.loadedSlugs` and unactivated path-gated skills are suppressed.
+ */
+declare function buildSkillListing(resolver: DefinitionResolver<SkillRecord>, ctx: ResolveContext, options?: SkillListingOptions): SkillListing;
+interface SkillMessage {
+    readonly role: "system" | "user";
+    readonly content: string;
+}
+interface ExpandedSkill {
+    readonly messages: readonly SkillMessage[];
+    readonly allowedTools: readonly string[];
+    readonly modelOverride?: string | undefined;
+    readonly effort?: "low" | "medium" | "high" | undefined;
+    readonly executionMode: "inline" | "fork";
+}
+interface ExpandContext {
+    readonly tenantId: string;
+    readonly args: Record<string, string>;
+    readonly vars: Record<string, string>;
+    /** Lazy body fetch — host supplies; called only here, only once. */
+    readonly bodyLoader: (bodyRef: string) => Promise<string>;
+    /** Host-injected resource-base indirection (NO host FS access here). */
+    readonly skillResourceBase: (slug: string) => string;
+}
+/**
+ * Phase 2 — expand a skill into turn messages. Body is loaded lazily via the
+ * injected `bodyLoader` (never during listing). A `Base directory…` line is
+ * prepended via the injected `skillResourceBase` indirection. Args + vars are
+ * substituted with `substituteArguments`. The skill's `allowedTools` are
+ * returned for the caller to merge into the permission context — this never
+ * mutates global state and never executes anything from the body.
+ */
+declare function expandSkill(skill: SkillRecord, ctx: ExpandContext): Promise<ExpandedSkill>;
+
+export { type ExpandContext, type ExpandedSkill, type SkillListing, type SkillListingEntry, type SkillListingOptions, type SkillMessage, type SkillRecord, buildSkillListing, expandSkill };

package/dist/skills.js

@@ -0,0 +1,10 @@
+import {
+  buildSkillListing,
+  expandSkill
+} from "./chunk-ZMYX5VBU.js";
+import "./chunk-7BUOF367.js";
+export {
+  buildSkillListing,
+  expandSkill
+};
+//# sourceMappingURL=skills.js.map

package/dist/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/subagents.d.ts

@@ -0,0 +1,129 @@
+import { Definition, Frontmatter } from './definitions.js';
+import { ThreadItem, TurnUsage } from './model.js';
+import 'zod';
+
+/**
+ * Subagent / task dispatch (WRAP — isolated-child-agent model, the delta).
+ *
+ * Faithful re-expression of the source harness's child-agent dispatch grammar:
+ * a registry decides WHICH definition runs, a context-boundary contract decides
+ * WITH WHAT inherited context it starts, and a typed terminal envelope decides
+ * HOW its result re-enters the parent. The child loop, child policy, and
+ * rollout store live elsewhere in agent-runtime and are intentionally NOT
+ * reimplemented here — this layer is pure decision + data + state machine.
+ *
+ * Multi-tenant: every task operation is keyed by `tenantId` and fails closed.
+ * Pure data/logic — no FS scan, no shell, no network.
+ *
+ * NOTE on dropped task kinds: the source harness models several local execution
+ * task kinds (local_bash / monitor_mcp / worktree). Those are deliberately NOT
+ * represented here: this package never executes locally — execution is delegated
+ * via the external-sandbox seam — so only the agent-facing `subagent` kind (and
+ * its `deferred` sibling) is modelled.
+ */
+
+/** A subagent definition is just a `Definition` (same loader as skills/commands). */
+type SubagentRecord = Definition;
+/**
+ * Effective tool set for a subagent: `allowedTools` minus `disallowedTools`,
+ * intersected with the runtime tool universe so a definition can never widen
+ * its scope past what the host exposes. When `allowedTools` is empty the
+ * contract is "all tools except the denied ones" (all-except-deny).
+ *
+ * Pure — order follows `allTools` for determinism.
+ */
+declare function resolveSubagentTools(fm: Frontmatter, allTools: readonly string[]): string[];
+type DispatchMode = "spawn" | "fork";
+interface DispatchCtx {
+    readonly tenantId: string;
+}
+interface PrepareDispatchInput {
+    readonly definition: SubagentRecord;
+    readonly mode: DispatchMode;
+    readonly parentItems?: readonly ThreadItem[];
+    /** Caller's directive. Mandatory & non-empty in `spawn` mode. */
+    readonly brief: string;
+    readonly ctx: DispatchCtx;
+    /** Runtime tool universe; defaults to the definition's own allow list. */
+    readonly allTools?: readonly string[];
+}
+interface PreparedDispatch {
+    readonly initialContext: readonly ThreadItem[];
+    readonly toolScope: readonly string[];
+    /** Opaque reference to the system prompt body (resolved by the child loop). */
+    readonly systemPromptRef: string;
+    readonly modelOverride?: string;
+}
+/**
+ * Decide the child's starting context boundary.
+ *
+ * - `spawn`: zero inherited context. The caller MUST fully brief the child;
+ *   an empty brief is a programming error and throws.
+ * - `fork`: inherit a defensive copy of `parentItems` with incomplete tool
+ *   calls filtered out, then append the brief as a directive.
+ *
+ * `parentItems` is never mutated. Cross-tenant dispatch fails closed.
+ */
+declare function prepareDispatch(input: PrepareDispatchInput): PreparedDispatch;
+declare const TASK_KINDS: readonly ["subagent", "deferred"];
+type TaskKind = (typeof TASK_KINDS)[number];
+declare const TASK_STATUSES: readonly ["pending", "running", "completed", "failed", "killed"];
+type TaskStatus = (typeof TASK_STATUSES)[number];
+interface TaskRecord {
+    readonly taskId: string;
+    readonly tenantId: string;
+    readonly status: TaskStatus;
+    readonly notified: boolean;
+    readonly kind: TaskKind;
+    readonly createdAtMs: number;
+}
+/**
+ * Tenant-scoped task registry. Every mutating op verifies the caller's
+ * tenant against the stored record; a mismatch is treated as "not found"
+ * for reads and throws for mutations — cross-tenant access is impossible.
+ */
+declare class TaskRegistry {
+    #private;
+    create(tenantId: string, kind: TaskKind): string;
+    /** Tenant-checked read. Returns undefined for unknown or cross-tenant ids. */
+    get(taskId: string, tenantId: string): TaskRecord | undefined;
+    transition(taskId: string, to: TaskStatus, tenantId: string): TaskRecord;
+    /** Unified kill — drives any non-terminal task to `killed`. */
+    stop(taskId: string, tenantId: string): TaskRecord;
+    markNotified(taskId: string, tenantId: string): TaskRecord;
+}
+/**
+ * No-peek / no-race guard. Throws if a parent tries to read an in-flight
+ * deferred task's transcript before it has settled.
+ */
+declare function assertNotPeeking(task: TaskRecord): void;
+interface SyncEnvelope {
+    readonly kind: "sync";
+    readonly content: readonly ThreadItem[];
+    readonly usage: TurnUsage;
+    readonly agentId: string;
+    readonly toolUses: number;
+    readonly durationMs: number;
+}
+interface DeferredEnvelope {
+    readonly kind: "deferred";
+    readonly taskId: string;
+    readonly channel: string;
+}
+type DispatchEnvelope = SyncEnvelope | DeferredEnvelope;
+/** Build a fire-and-forget deferred envelope for a registered task. */
+declare function makeDeferred(taskId: string, channel: string): DeferredEnvelope;
+interface SettleDeferredTarget {
+    readonly taskId: string;
+    readonly channel: string;
+    readonly tenantId: string;
+    readonly registry: TaskRegistry;
+}
+/**
+ * Settle a previously-deferred task: drive it to `completed` (tenant-checked)
+ * and produce the eventual sync-shaped result. Empty content is normalized to
+ * the explicit no-output marker.
+ */
+declare function settleDeferred(target: SettleDeferredTarget, content: readonly ThreadItem[], usage: TurnUsage): SyncEnvelope;
+
+export { type DeferredEnvelope, type DispatchCtx, type DispatchEnvelope, type DispatchMode, type PrepareDispatchInput, type PreparedDispatch, type SettleDeferredTarget, type SubagentRecord, type SyncEnvelope, TASK_KINDS, TASK_STATUSES, type TaskKind, type TaskRecord, TaskRegistry, type TaskStatus, assertNotPeeking, makeDeferred, prepareDispatch, resolveSubagentTools, settleDeferred };

package/dist/subagents.js

@@ -0,0 +1,21 @@
+import {
+  TASK_KINDS,
+  TASK_STATUSES,
+  TaskRegistry,
+  assertNotPeeking,
+  makeDeferred,
+  prepareDispatch,
+  resolveSubagentTools,
+  settleDeferred
+} from "./chunk-5YS7WAPS.js";
+export {
+  TASK_KINDS,
+  TASK_STATUSES,
+  TaskRegistry,
+  assertNotPeeking,
+  makeDeferred,
+  prepareDispatch,
+  resolveSubagentTools,
+  settleDeferred
+};
+//# sourceMappingURL=subagents.js.map

package/dist/subagents.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/tools.d.ts

@@ -0,0 +1,77 @@
+import { z } from 'zod';
+
+/**
+ * Tool / MCP abstraction (WRAP — capability #9).
+ *
+ * Faithful re-expression of the upstream uniform tool model: one
+ * `ToolDefinition` interface, JSON-schema in/out, a deferred-load flag, and
+ * MCP-as-adapter behind the same interface (MCP tools and native tools are
+ * indistinguishable at dispatch). Activates `@nebutra/mcp` primitives rather
+ * than re-porting them.
+ */
+
+/** A tool definition — pure data; transport-agnostic. */
+interface ToolDefinition<I = unknown, O = unknown> {
+    readonly name: string;
+    readonly description: string;
+    readonly inputSchema: z.ZodType<I>;
+    readonly outputSchema?: z.ZodType<O>;
+    /**
+     * When true, the full schema is withheld until a `tool_search` discovery
+     * step lazily loads it (parity with the upstream deferred-tool pattern).
+     */
+    readonly deferLoading?: boolean;
+}
+/** Source provenance — native vs. adapted from an MCP server. */
+type ToolOrigin = {
+    readonly kind: "native";
+} | {
+    readonly kind: "mcp";
+    readonly server: string;
+};
+interface RegisteredTool {
+    readonly definition: ToolDefinition;
+    readonly origin: ToolOrigin;
+}
+/** A tool invocation routed through the registry. */
+interface ToolDispatchContext {
+    /** Mandatory tenant scope — every dispatch is tenant-bound. */
+    readonly tenantId: string;
+    readonly threadId: string;
+}
+type ToolHandler<I = unknown, O = unknown> = (input: I, ctx: ToolDispatchContext) => Promise<O>;
+/** Pre/post dispatch hooks (parity with upstream orchestrator hooks). */
+interface ToolHooks {
+    readonly preToolUse?: (name: string, input: unknown, ctx: ToolDispatchContext) => Promise<void>;
+    readonly postToolUse?: (name: string, output: unknown, ctx: ToolDispatchContext) => Promise<void>;
+}
+/**
+ * registry -> router -> orchestrator pipeline. MCP tools register via
+ * {@link adaptMcpTool} and are dispatched identically to native tools.
+ */
+declare class ToolRegistry {
+    #private;
+    constructor(hooks?: ToolHooks);
+    register<I, O>(definition: ToolDefinition<I, O>, handler: ToolHandler<I, O>, origin?: ToolOrigin): void;
+    list(): readonly RegisteredTool[];
+    dispatch(name: string, rawInput: unknown, ctx: ToolDispatchContext): Promise<unknown>;
+}
+/** Minimal shape of an MCP client (satisfied by `@nebutra/mcp`'s `mcpClient`). */
+interface McpClientLike {
+    executeTool(name: string, args: unknown, ctx: {
+        requestId: string;
+        tenantId: string;
+    }): Promise<unknown>;
+}
+/**
+ * Adapt an external MCP tool into the uniform tool model. The resulting
+ * handler delegates to the MCP client; callers cannot tell it apart from a
+ * native tool.
+ */
+declare function adaptMcpTool(server: string, definition: ToolDefinition, client: McpClientLike): {
+    definition: ToolDefinition;
+    handler: ToolHandler;
+    origin: ToolOrigin;
+};
+
+export { type McpClientLike, type RegisteredTool, type ToolDefinition, type ToolDispatchContext, type ToolHandler, type ToolHooks, type ToolOrigin, ToolRegistry, adaptMcpTool };

package/dist/tools.js

@@ -0,0 +1,9 @@
+import {
+  ToolRegistry,
+  adaptMcpTool
+} from "./chunk-NN7DATXA.js";
+export {
+  ToolRegistry,
+  adaptMcpTool
+};
+//# sourceMappingURL=tools.js.map

package/dist/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}