@praesidias/sdk 0.0.0-stage → 0.1.1

package/dist/index.cjs

@@ -0,0 +1,2027 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  BUILT_IN_INPUTS: () => BUILT_IN_INPUTS,
+  MAX_ACTION_LENGTH: () => MAX_ACTION_LENGTH,
+  MappingError: () => MappingError,
+  Praesidias: () => Praesidias,
+  PraesidiasAuthError: () => PraesidiasAuthError,
+  PraesidiasConfigError: () => PraesidiasConfigError,
+  PraesidiasError: () => PraesidiasError,
+  PraesidiasRequestError: () => PraesidiasRequestError,
+  PraesidiasUnavailableError: () => PraesidiasUnavailableError,
+  TOOLS_PER_REPORT: () => TOOLS_PER_REPORT,
+  ToolGate: () => ToolGate,
+  UNPARSED: () => UNPARSED,
+  WORKLOAD_TOKEN_HEADER: () => WORKLOAD_TOKEN_HEADER,
+  agentToolActions: () => agentToolActions,
+  checkMapping: () => checkMapping,
+  createToolGate: () => createToolGate,
+  fitActionName: () => fitActionName,
+  inputsOfSchema: () => inputsOfSchema,
+  isSensitivePath: () => isSensitivePath,
+  loadMapping: () => loadMapping,
+  mapToolCall: () => mapToolCall,
+  matches: () => matches,
+  mcpAction: () => mcpAction,
+  otherAction: () => otherAction,
+  parseShellCommand: () => parseShellCommand,
+  patchPaths: () => patchPaths,
+  sentenceFor: () => sentenceFor,
+  shellActions: () => shellActions,
+  subjectIdFor: () => subjectIdFor,
+  toolAction: () => toolAction,
+  toolsForReport: () => toolsForReport
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/client.ts
+var import_node_crypto3 = require("crypto");
+var import_promises = require("fs/promises");
+
+// src/errors.ts
+var PraesidiasError = class extends Error {
+  /** A stable, machine-readable code. */
+  code;
+  status;
+  correlationId;
+  constructor(message, details) {
+    super(message);
+    this.name = new.target.name;
+    this.code = details.code;
+    this.status = details.status ?? null;
+    this.correlationId = details.correlationId ?? null;
+  }
+};
+var PraesidiasUnavailableError = class extends PraesidiasError {
+};
+var PraesidiasAuthError = class extends PraesidiasError {
+};
+var PraesidiasConfigError = class extends PraesidiasError {
+};
+var PraesidiasRequestError = class extends PraesidiasError {
+};
+function errorClassOf(thrown) {
+  const name = thrown instanceof Error ? thrown.name || thrown.constructor?.name || "Error" : typeof thrown;
+  const clean = String(name).replace(/[^A-Za-z0-9_.]/g, "").slice(0, 120);
+  return /^[A-Za-z]/.test(clean) ? clean : "Error";
+}
+
+// src/http.ts
+var import_node_crypto = require("crypto");
+var WORKLOAD_TOKEN_HEADER = "x-praesidias-workload-token";
+var RETRY_STATUS = /* @__PURE__ */ new Set([429, 502, 503, 504]);
+var sleep = (ms, signal) => new Promise((resolve, reject) => {
+  if (signal?.aborted) return reject(signal.reason);
+  const timer = setTimeout(resolve, ms);
+  signal?.addEventListener("abort", () => (clearTimeout(timer), reject(signal.reason)), {
+    once: true
+  });
+});
+function checkedBaseUrl(raw, allowInsecure) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new PraesidiasConfigError("The Praesidias address is not a valid URL.", {
+      code: "BASE_URL_INVALID"
+    });
+  }
+  const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && (local || allowInsecure))) {
+    throw new PraesidiasConfigError(
+      "The Praesidias address must use https (http is accepted for localhost only).",
+      { code: "BASE_URL_INSECURE" }
+    );
+  }
+  return url.origin + url.pathname.replace(/\/+$/, "");
+}
+async function readWorkloadToken(http) {
+  if (!http.workloadToken) return null;
+  let token;
+  try {
+    const value = await http.workloadToken();
+    if (value === null || value === void 0) return null;
+    token = String(value).trim();
+  } catch {
+    throw new PraesidiasConfigError("The workload identity token could not be read.", {
+      code: "WORKLOAD_TOKEN_UNREADABLE"
+    });
+  }
+  if (!token) {
+    throw new PraesidiasConfigError("The workload identity token is empty.", {
+      code: "WORKLOAD_TOKEN_UNREADABLE"
+    });
+  }
+  return token;
+}
+async function call(http, method, path, options = {}) {
+  const correlationId = options.correlationId ?? (0, import_node_crypto.randomUUID)();
+  const attempts = 1 + Math.max(0, options.retries ?? http.retries);
+  const payload = options.body === void 0 ? void 0 : JSON.stringify(options.body);
+  let last = { status: null, code: "NETWORK" };
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    if (attempt > 1) {
+      http.log({ event: "retry", method, path, attempt, correlationId, code: last.code });
+      await sleep(http.retryDelayMs * 2 ** (attempt - 2) * (0.5 + Math.random()), options.signal);
+    }
+    const started = Date.now();
+    const timeout = new AbortController();
+    const timer = setTimeout(() => timeout.abort(), http.timeoutMs);
+    const onAbort = () => timeout.abort();
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    const workload = await readWorkloadToken(http);
+    let res;
+    try {
+      http.log({ event: "request", method, path, attempt, correlationId });
+      res = await http.fetch(`${http.baseUrl}${path}`, {
+        method,
+        headers: {
+          "x-api-key": http.apiKey,
+          ...workload ? { [WORKLOAD_TOKEN_HEADER]: workload } : {},
+          "x-correlation-id": correlationId,
+          accept: "application/json",
+          ...payload === void 0 ? {} : { "content-type": "application/json" }
+        },
+        ...payload === void 0 ? {} : { body: payload },
+        signal: timeout.signal
+      });
+    } catch {
+      if (options.signal?.aborted) throw options.signal.reason;
+      last = { status: null, code: timeout.signal.aborted ? "TIMEOUT" : "NETWORK" };
+      http.log({ event: "failure", method, path, attempt, correlationId, code: last.code });
+      continue;
+    } finally {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+    }
+    const durationMs = Date.now() - started;
+    let body = null;
+    let readable = true;
+    try {
+      const text = await res.text();
+      body = text ? JSON.parse(text) : null;
+    } catch {
+      readable = false;
+    }
+    const rawCode = body?.code;
+    const code = typeof rawCode === "string" && /^[A-Z][A-Z0-9_]{1,63}$/.test(rawCode) ? rawCode : "";
+    http.log({
+      event: "response",
+      method,
+      path,
+      attempt,
+      status: res.status,
+      correlationId,
+      durationMs,
+      ...code ? { code } : {}
+    });
+    if (res.status >= 200 && res.status < 300) {
+      if (!readable) {
+        throw new PraesidiasUnavailableError("Praesidias answered in a way that cannot be read.", {
+          code: "BAD_REPLY",
+          status: res.status,
+          correlationId
+        });
+      }
+      return { status: res.status, body, correlationId };
+    }
+    if (res.status === 401 || res.status === 403) {
+      throw new PraesidiasAuthError(
+        code.startsWith("WORKLOAD_") ? "Praesidias did not accept this agent's workload identity." : res.status === 401 ? "Praesidias did not accept this key." : "This key is not allowed to do that.",
+        {
+          code: code || (res.status === 401 ? "KEY_REFUSED" : "FORBIDDEN"),
+          status: res.status,
+          correlationId
+        }
+      );
+    }
+    if (RETRY_STATUS.has(res.status) || res.status >= 500) {
+      last = { status: res.status, code: code || `HTTP_${res.status}` };
+      if (RETRY_STATUS.has(res.status)) continue;
+      break;
+    }
+    throw new PraesidiasRequestError("Praesidias refused this request.", {
+      code: code || `HTTP_${res.status}`,
+      status: res.status,
+      correlationId
+    });
+  }
+  throw new PraesidiasUnavailableError(
+    last.code === "TIMEOUT" ? "Praesidias did not answer in time." : last.status === null ? "Praesidias could not be reached." : "Praesidias is not available right now.",
+    { code: last.code, status: last.status, correlationId }
+  );
+}
+
+// src/reasons.ts
+var SENTENCES = {
+  ALLOW_POLICY_RULE: "A rule allows this.",
+  DENY_POLICY_DEFAULT: "No rule allows this action, so it is blocked.",
+  DENY_POLICY_RULE: "A rule blocks this action.",
+  DENY_POLICY_NO_CASE_MATCHED: "None of the rule\u2019s cases covers this request, so it is blocked.",
+  DENY_POLICY_LIMIT_EXCEEDED: "This action has reached its limit for now.",
+  DENY_POLICY_BUDGET_EXCEEDED: "This would go over a budget, so it is blocked.",
+  DENY_CONTEXT_INVALID: "The details sent with this request do not match what the rule expects (a field is missing, of the wrong type or out of range).",
+  DENY_CONDITION_EVALUATION_FAILED: "A rule could not be checked for this request, so it is blocked.",
+  DENY_BUDGETS_EVALUATION_FAILED: "A budget could not be checked for this request, so it is blocked.",
+  DENY_LIMITS_EVALUATION_FAILED: "A limit could not be checked for this request, so it is blocked.",
+  DENY_APPROVAL_REQUIRED: "This action needs approval from a person first.",
+  DENY_APPROVAL_ARTIFACT_IDS_REQUIRED: "This action needs approval from a person first.",
+  DENY_APPROVAL_QUORUM_UNMET: "This action needs more approvals before it can go ahead.",
+  DENY_APPROVALS_INVALID: "The approvals given for this action are not valid.",
+  DENY_APPROVAL_ARTIFACT_INVALID: "An approval given for this action does not cover it: it was for another request, has been used, has expired or was given by someone who may not approve it.",
+  DENY_APPROVAL_ARTIFACT_NOT_FOUND: "An approval given for this action does not exist.",
+  DENY_APPROVAL_ALREADY_USED: "The approval for this action has already been used.",
+  DENY_AUTHORITY_INVALID: "This agent's access is not valid: it was revoked, has expired, or does not cover this.",
+  DENY_AUTHORITY_REVOKED_DURING_DECISION: "This agent's access was revoked while it was being checked.",
+  DENY_POLICY_MISSING_REQUIRED_AUTHORITY_SCOPE: "This agent's access does not cover what the rule requires.",
+  DENY_POLICY_AUTHORITY_SCOPE_REQUIREMENTS_UNMET: "This agent's access does not cover what the rule requires.",
+  DENY_POLICY_AUTHORITY_PATH_REQUIREMENTS_UNMET: "This agent's access was not given the way the rule requires.",
+  DENY_POLICY_CHANGED_DURING_DECISION: "The rules changed while this was being decided. Ask again.",
+  DENY_GROUPS_CHANGED_DURING_DECISION: "This agent's groups changed while this was being decided. Ask again.",
+  ALLOW_POLICY_REPORT_ONLY: "A rule allows this.",
+  DENY_PRINCIPAL_NOT_BOUND: "This key may not act as that agent.",
+  DENY_WORKLOAD_NOT_VERIFIED: "This agent must run from its own workload, and this request did not prove that.",
+  DENY_DOMAIN_NO_MATCH: "This action is outside every area, so it is blocked.",
+  DENY_POLICY_DOMAIN_MISMATCH: "This action does not belong to the area its rule names.",
+  DENY_DOMAIN_MODE_NOT_ALLOWED: "This way of running the action is not allowed in its area.",
+  DENY_POLICY_MODE_NOT_ALLOWED: "This way of running the action is not allowed by its rule.",
+  DENY_STAKE_INSUFFICIENT: "There is not enough stake for this action.",
+  PAYLOAD_DECISION_MISMATCH: "What was to be authorized differs from what was decided.",
+  EXECUTION_BOUND_VALUE_MISMATCH: "What was to be run differs from what was decided."
+};
+var WAITING = /* @__PURE__ */ new Set([
+  "DENY_APPROVAL_REQUIRED",
+  "DENY_APPROVAL_ARTIFACT_IDS_REQUIRED",
+  "DENY_APPROVAL_QUORUM_UNMET"
+]);
+var isWaitingCode = (code) => WAITING.has(code);
+function sentenceFor(code) {
+  return SENTENCES[code] ?? (code.startsWith("DENY_") ? "Praesidias blocked this action." : code);
+}
+function messageOf(reasons, code) {
+  const own = reasons?.caseMessage;
+  return typeof own === "string" && own.trim() ? own.slice(0, 500) : sentenceFor(code);
+}
+
+// src/report.ts
+var ACTION_NAME = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
+var FIELD_NAME = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}$/;
+var TYPES = /* @__PURE__ */ new Set(["string", "number", "boolean", "array", "object"]);
+var TOOLS_PER_REPORT = 500;
+function toolsForReport(tools) {
+  const byAction = /* @__PURE__ */ new Map();
+  for (const tool of tools) {
+    const name = typeof tool?.name === "string" ? tool.name.trim().slice(0, 200) : "";
+    const action = typeof tool?.action === "string" ? tool.action : "";
+    if (!name || !ACTION_NAME.test(action)) continue;
+    const inputs = {};
+    for (const [field, spec] of Object.entries(tool.inputs ?? {})) {
+      if (Object.keys(inputs).length >= 50) break;
+      if (!FIELD_NAME.test(field) || !spec || !TYPES.has(spec.type)) continue;
+      inputs[field] = typeof spec.description === "string" && spec.description ? { type: spec.type, description: spec.description.slice(0, 200) } : { type: spec.type };
+    }
+    const description = typeof tool.description === "string" && tool.description.trim() ? tool.description.trim().slice(0, 500) : null;
+    byAction.set(action, { name, action, ...description ? { description } : {}, inputs });
+  }
+  return [...byAction.values()];
+}
+function inputsOfSchema(schema) {
+  const props = schema?.properties;
+  const out = {};
+  if (!props || typeof props !== "object") return out;
+  for (const [field, spec] of Object.entries(props)) {
+    const raw = spec?.type;
+    const type = Array.isArray(raw) ? raw.find((t) => t !== "null") : raw;
+    const mapped = type === "integer" ? "number" : TYPES.has(type) ? type : null;
+    if (!mapped) continue;
+    const description = spec.description;
+    out[field] = typeof description === "string" && description ? { type: mapped, description: description.slice(0, 200) } : { type: mapped };
+  }
+  return out;
+}
+
+// src/subject.ts
+var import_node_crypto2 = require("crypto");
+var NAMESPACE = "8f1c9a52-6b7e-5d3f-9c41-2e7a0b6d4f10";
+var bytes = (uuid) => Buffer.from(uuid.replace(/-/g, ""), "hex");
+function subjectIdFor(organizationId, resource) {
+  const name = `${organizationId}
+${resource.type}
+${resource.id ?? ""}`;
+  const hash = (0, import_node_crypto2.createHash)("sha1").update(bytes(NAMESPACE)).update(name, "utf8").digest();
+  hash[6] = hash[6] & 15 | 80;
+  hash[8] = hash[8] & 63 | 128;
+  const hex = hash.subarray(0, 16).toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+
+// src/client.ts
+var DEFAULT_TIMING = {
+  retryDelayMs: 250,
+  meCacheMs: 3e4,
+  pollStartMs: 2e3,
+  pollMaxMs: 15e3,
+  authorizationTtlMs: 5 * 6e4
+};
+function detailsOf(body) {
+  const problems = Array.isArray(body.reasons?.rule?.problems) ? body.reasons.rule.problems.filter((p) => !!p && typeof p === "object").map((p) => ({ path: String(p.path), problem: String(p.problem) })) : [];
+  const b = body.reasons?.budget;
+  const budget = b && typeof b.budgetId === "string" ? {
+    budgetId: b.budgetId,
+    spent: String(b.spent),
+    amount: String(b.amount),
+    cap: String(b.cap)
+  } : null;
+  const failures = Array.isArray(body.reasons?.approvals?.failures) ? body.reasons.approvals.failures.map(
+    (f) => f && typeof f === "object" && "code" in f ? String(f.code) : String(f)
+  ) : [];
+  return { problems, budget, approvalFailures: failures };
+}
+function workloadTokenSource(options) {
+  const given = options.workloadToken;
+  if (typeof given === "string") return async () => given;
+  if (typeof given === "function")
+    return async () => {
+      const value = await given();
+      return value === null || value === void 0 ? null : String(value);
+    };
+  const file2 = (options.workloadTokenFile ?? env("PRAESIDIAS_WORKLOAD_TOKEN_FILE")).trim();
+  return file2 ? () => (0, import_promises.readFile)(file2, "utf8") : null;
+}
+var env = (name) => typeof process !== "undefined" ? (process.env[name] ?? "").trim() : "";
+var Praesidias = class {
+  http;
+  timing;
+  system;
+  consoleUrl;
+  onApproval;
+  approvalTimeoutMs;
+  cachedMe = null;
+  /** The last "who am I" ever read, however old: only to know, offline, if Audit mode was on. */
+  lastMe = null;
+  /** Requests run offline under Audit mode, oldest first, to record once Praesidias answers. */
+  offline = [];
+  flushing = false;
+  constructor(options = {}) {
+    const apiKey = (options.apiKey ?? env("PRAESIDIAS_API_KEY")).trim();
+    if (!apiKey) {
+      throw new PraesidiasConfigError(
+        "No Praesidias key. Set the PRAESIDIAS_API_KEY environment variable.",
+        { code: "API_KEY_MISSING" }
+      );
+    }
+    const baseUrl = (options.baseUrl ?? env("PRAESIDIAS_URL")).trim();
+    if (!baseUrl) {
+      throw new PraesidiasConfigError(
+        "No Praesidias address. Set the PRAESIDIAS_URL environment variable.",
+        { code: "BASE_URL_MISSING" }
+      );
+    }
+    if (options.workloadToken !== void 0 && options.workloadTokenFile !== void 0) {
+      throw new PraesidiasConfigError(
+        "Give the workload token either as a file (workloadTokenFile) or directly (workloadToken), not both.",
+        { code: "WORKLOAD_TOKEN_CONFLICT" }
+      );
+    }
+    this.timing = { ...DEFAULT_TIMING, ...options.timing };
+    this.http = {
+      baseUrl: checkedBaseUrl(baseUrl, options.allowInsecure === true),
+      apiKey,
+      timeoutMs: options.timeoutMs ?? 1e4,
+      retries: options.retries ?? 2,
+      fetch: options.fetch ?? fetch,
+      log: options.logger ?? (() => {
+      }),
+      retryDelayMs: this.timing.retryDelayMs,
+      workloadToken: workloadTokenSource(options)
+    };
+    this.system = (options.system ?? env("PRAESIDIAS_SYSTEM")) || null;
+    const consoleUrl = (options.consoleUrl ?? env("PRAESIDIAS_CONSOLE_URL")).replace(/\/+$/, "");
+    this.consoleUrl = consoleUrl || null;
+    this.onApproval = options.onApproval ?? "wait";
+    this.approvalTimeoutMs = options.approvalTimeoutMs ?? 15 * 6e4;
+    Object.defineProperty(this, "http", { enumerable: false });
+  }
+  toJSON() {
+    return { praesidias: this.http.baseUrl };
+  }
+  /**
+   * Who this key is. Cached briefly. If it cannot be read, this throws: the SDK never guesses
+   * who the agent is or whether it is in Audit mode.
+   */
+  async me(options = {}) {
+    const now = Date.now();
+    if (!options.fresh && this.cachedMe && now - this.cachedMe.at < this.timing.meCacheMs) {
+      return this.cachedMe.value;
+    }
+    const reply = await call(this.http, "GET", "/agent/me", {
+      ...options.signal ? { signal: options.signal } : {}
+    });
+    const me = reply.body;
+    if (!me || typeof me.principalId !== "string" || !Array.isArray(me.grantIds)) {
+      throw new PraesidiasUnavailableError("Praesidias answered in a way that cannot be read.", {
+        code: "BAD_REPLY",
+        correlationId: reply.correlationId
+      });
+    }
+    this.cachedMe = { at: now, value: me };
+    this.lastMe = me;
+    if (this.offline.length > 0) void this.flushOffline();
+    return me;
+  }
+  /** How many requests that ran offline, under Audit mode, are still to be recorded. */
+  get offlinePending() {
+    return this.offline.length;
+  }
+  /**
+   * Sends the requests that ran offline under Audit mode as ordinary decisions, oldest first, so
+   * they are in the record. Stops at the first that cannot be sent; the rest wait for next time.
+   */
+  async flushOffline() {
+    if (this.flushing) return 0;
+    this.flushing = true;
+    let sent = 0;
+    try {
+      while (this.offline.length > 0) {
+        const item = this.offline[0];
+        try {
+          await this.decide(item.action, item.resource, {
+            system: item.system,
+            context: item.context,
+            correlationId: item.correlationId,
+            idempotencyKey: `offline:${item.correlationId}`
+          });
+        } catch (err) {
+          if (err instanceof PraesidiasUnavailableError || !(err instanceof PraesidiasError)) break;
+        }
+        this.offline.shift();
+        sent += 1;
+      }
+    } finally {
+      this.flushing = false;
+    }
+    return sent;
+  }
+  /**
+   * Tells Praesidias which tools this agent has, so the Console can list them and say which have
+   * a rule. Names and input types only. Never throws and never holds the agent up: false when it
+   * could not be sent (an older Praesidias without this, or one that cannot be reached).
+   */
+  async reportTools(source, tools) {
+    const clean = toolsForReport(tools);
+    try {
+      for (let i = 0; i < clean.length; i += TOOLS_PER_REPORT) {
+        await call(this.http, "POST", "/agent/tools", {
+          body: { source, tools: clean.slice(i, i + TOOLS_PER_REPORT) },
+          retries: 1
+        });
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  linkTo(page) {
+    return this.consoleUrl ? `${this.consoleUrl}/${page}` : null;
+  }
+  systemFor(options) {
+    const system = options.system ?? this.system;
+    if (!system) {
+      throw new PraesidiasConfigError(
+        'Say which system this agent acts on: the "system" option, or PRAESIDIAS_SYSTEM.',
+        { code: "SYSTEM_MISSING" }
+      );
+    }
+    return system;
+  }
+  /** Asks Praesidias whether this agent may do this action on this resource. Nothing is run. */
+  async decide(action, resource, options = {}) {
+    const me = await this.me(options.signal ? { signal: options.signal } : {});
+    const system = this.systemFor(options);
+    const correlationId = options.correlationId ?? (0, import_node_crypto3.randomUUID)();
+    const context = options.context ?? {};
+    const reply = await call(this.http, "POST", "/control/decide", {
+      correlationId,
+      ...options.signal ? { signal: options.signal } : {},
+      body: {
+        systemId: system,
+        executionMode: "pre_gate",
+        actionType: action,
+        resourceType: resource.type,
+        resourceId: resource.id ?? null,
+        actingPrincipalId: me.principalId,
+        assertedGrantIds: me.grantIds,
+        ...options.approvalArtifactIds?.length ? { approvalArtifactIds: options.approvalArtifactIds } : {},
+        idempotencyKey: options.idempotencyKey ?? (0, import_node_crypto3.randomUUID)(),
+        correlationId,
+        context
+      }
+    });
+    const body = reply.body;
+    const result = body?.result;
+    if (!body || typeof body.decisionId !== "string" || result !== "ALLOW" && result !== "DENY") {
+      throw new PraesidiasUnavailableError("Praesidias answered in a way that cannot be read.", {
+        code: "BAD_REPLY",
+        correlationId
+      });
+    }
+    const code = typeof body.reasons?.code === "string" ? body.reasons.code : result === "ALLOW" ? "ALLOW" : "DENY_UNSPECIFIED";
+    const paths = body.constraints?.bound?.paths;
+    const caseId = body.constraints?.rule?.caseId;
+    return {
+      decisionId: body.decisionId,
+      allowed: result === "ALLOW",
+      reason: { code, message: messageOf(body.reasons, code) },
+      context,
+      caseId: typeof caseId === "string" ? caseId : null,
+      boundPaths: Array.isArray(paths) ? paths.map(String) : [],
+      details: detailsOf(body),
+      needsApproval: result === "DENY" && isWaitingCode(code),
+      expiresAt: body.expiresAt ?? null,
+      action,
+      resource,
+      system,
+      rulesVersion: body.policy?.version ?? null,
+      correlationId
+    };
+  }
+  /**
+   * Gets Praesidias's signed authorization for an allowed decision. Call it straight after an
+   * ALLOW and before running the action; a decision can be authorized once.
+   */
+  async commit(decision, options = {}) {
+    if (!decision.allowed) {
+      throw new PraesidiasRequestError("Only an allowed decision can be authorized.", {
+        code: "DECISION_NOT_ALLOW",
+        correlationId: decision.correlationId
+      });
+    }
+    const me = await this.me(options.signal ? { signal: options.signal } : {});
+    const payload = {
+      v: 1,
+      action: decision.action,
+      resource: { type: decision.resource.type, id: decision.resource.id ?? null },
+      system: decision.system,
+      expiresAt: new Date(Date.now() + this.timing.authorizationTtlMs).toISOString(),
+      // A decision locked to some of its values is authorized only for those same values.
+      ...decision.boundPaths.length > 0 ? { context: decision.context } : {}
+    };
+    const reply = await call(this.http, "POST", "/control/commit", {
+      correlationId: decision.correlationId,
+      ...options.signal ? { signal: options.signal } : {},
+      body: {
+        decisionId: decision.decisionId,
+        subjectId: subjectIdFor(me.organizationId, decision.resource),
+        kind: me.authorizationKind || "ACTION_AUTHORIZED",
+        payload,
+        idempotencyKey: options.idempotencyKey ?? `authorize:${decision.decisionId}`,
+        correlationId: decision.correlationId
+      }
+    });
+    const raw = reply.body;
+    if (!raw || typeof raw.id !== "string" || typeof raw.signature !== "string" || raw.decisionId !== decision.decisionId) {
+      throw new PraesidiasUnavailableError("Praesidias answered in a way that cannot be read.", {
+        code: "BAD_REPLY",
+        correlationId: decision.correlationId
+      });
+    }
+    return {
+      id: raw.id,
+      decisionId: decision.decisionId,
+      kind: String(raw.kind),
+      subjectId: String(raw.subjectId),
+      hash: String(raw.hash),
+      signature: raw.signature,
+      signingKeyId: typeof raw.signingKeyId === "string" ? raw.signingKeyId : null,
+      issuedAt: String(raw.issuedAt),
+      payload: raw.payload ?? {},
+      raw
+    };
+  }
+  /** Whether a decision that needs approval has been approved yet. */
+  async approvalStatus(decisionId, options = {}) {
+    const reply = await call(
+      this.http,
+      "GET",
+      `/agent/decisions/${encodeURIComponent(decisionId)}/approval`,
+      options.signal ? { signal: options.signal } : {}
+    );
+    const body = reply.body;
+    if (!body || !["waiting", "approved", "rules_changed", "not_waiting"].includes(body.state)) {
+      throw new PraesidiasUnavailableError("Praesidias answered in a way that cannot be read.", {
+        code: "BAD_REPLY",
+        correlationId: reply.correlationId
+      });
+    }
+    return body;
+  }
+  /** Reports what happened after an authorized action ran. */
+  async reportOutcome(proof, outcome) {
+    await call(this.http, "POST", "/agent/outcomes", {
+      body: {
+        decisionId: proof.decisionId,
+        proofId: proof.id,
+        status: outcome.status,
+        ...outcome.status === "failed" ? { errorClass: errorClassOf(outcome.error) } : {}
+      }
+    });
+  }
+  /**
+   * Runs `fn` only if Praesidias allows this action on this resource.
+   *
+   *   decide → (wait for approval if needed) → get the signed authorization → run fn → report
+   *
+   * Returns `executed`, `blocked` or `needs_approval`. Throws a PraesidiasError when Praesidias
+   * could not give a clear answer; in that case `fn` has not run. If `fn` itself throws, its
+   * error is reported as a failed outcome and thrown on unchanged.
+   */
+  async guard(action, resource, fn, options = {}) {
+    const correlationId = options.correlationId ?? (0, import_node_crypto3.randomUUID)();
+    const base = options.idempotencyKey ?? (0, import_node_crypto3.randomUUID)();
+    const onApproval = options.onApproval ?? this.onApproval;
+    const signal = options.signal;
+    let round = 0;
+    const offlineUnderAudit = async (err) => {
+      const last = this.lastMe;
+      const unreachable = err instanceof PraesidiasUnavailableError && err.code !== "BAD_REPLY";
+      const auditUntil = last?.mode === "audit" && last.audit ? Date.parse(last.audit.endsAt) : NaN;
+      if (!unreachable || !last?.agentKitEnabled || !(auditUntil > Date.now())) throw err;
+      const system = this.systemFor(options);
+      this.offline.push({
+        action,
+        resource,
+        system,
+        context: options.context ?? {},
+        correlationId
+      });
+      if (this.offline.length > 1e3) this.offline.splice(0, this.offline.length - 1e3);
+      const value = await fn({
+        decisionId: `offline:${correlationId}`,
+        correlationId,
+        proof: null,
+        auditMode: true
+      });
+      return {
+        ...common(null, "activity"),
+        status: "executed",
+        value,
+        proof: null,
+        audit: { wouldHave: "unknown", level: last.audit.level, offline: true },
+        outcomeRecorded: false
+      };
+    };
+    const common = (decisionId, page) => ({
+      decisionId,
+      correlationId,
+      consoleUrl: this.linkTo(page)
+    });
+    let me;
+    try {
+      me = await this.me(signal ? { signal } : {});
+    } catch (err) {
+      return offlineUnderAudit(err);
+    }
+    if (!me.agentKitEnabled) {
+      throw new PraesidiasConfigError(
+        "The Praesidias agent kit is not enabled for this organization yet. An Admin enables it in the Console, under Settings.",
+        { code: "AGENT_KIT_NOT_ENABLED", correlationId }
+      );
+    }
+    const ask = (approvalArtifactIds) => {
+      round += 1;
+      return this.decide(action, resource, {
+        ...options.system ? { system: options.system } : {},
+        ...options.context ? { context: options.context } : {},
+        ...signal ? { signal } : {},
+        ...approvalArtifactIds ? { approvalArtifactIds } : {},
+        correlationId,
+        idempotencyKey: `${base}:decide:${round}`
+      });
+    };
+    const run = async (decision) => {
+      const proof = await this.commit(decision, {
+        idempotencyKey: `${base}:authorize:${decision.decisionId}`,
+        ...signal ? { signal } : {}
+      });
+      let value;
+      try {
+        value = await fn({
+          decisionId: decision.decisionId,
+          correlationId,
+          proof,
+          auditMode: false
+        });
+      } catch (thrown) {
+        await this.reportOutcome(proof, { status: "failed", error: thrown }).catch(() => void 0);
+        throw thrown;
+      }
+      const outcomeRecorded = await this.reportOutcome(proof, { status: "succeeded" }).then(
+        () => true,
+        () => false
+      );
+      return {
+        ...common(decision.decisionId, "activity"),
+        status: "executed",
+        value,
+        proof,
+        audit: null,
+        outcomeRecorded
+      };
+    };
+    const underAudit = async (decision) => {
+      if (me.mode !== "audit") return null;
+      let permit;
+      try {
+        permit = (await call(this.http, "POST", "/agent/audit/permit", {
+          body: { decisionId: decision.decisionId },
+          correlationId,
+          retries: 0,
+          ...signal ? { signal } : {}
+        })).body;
+      } catch {
+        return null;
+      }
+      if (permit?.proceed !== true || typeof permit.permitId !== "string") return null;
+      const permitId = permit.permitId;
+      const report = (status, error) => call(this.http, "POST", "/agent/audit/outcome", {
+        body: {
+          permitId,
+          status,
+          ...status === "failed" ? { errorClass: errorClassOf(error) } : {}
+        },
+        correlationId
+      }).then(
+        () => true,
+        () => false
+      );
+      let value;
+      try {
+        value = await fn({
+          decisionId: decision.decisionId,
+          correlationId,
+          proof: null,
+          auditMode: true
+        });
+      } catch (thrown) {
+        await report("failed", thrown);
+        throw thrown;
+      }
+      return {
+        ...common(decision.decisionId, "activity"),
+        status: "executed",
+        value,
+        proof: null,
+        audit: {
+          wouldHave: permit.wouldHave === "waited" ? "waited" : "blocked",
+          level: permit.level === "everything" ? "everything" : "new_actions"
+        },
+        outcomeRecorded: await report("succeeded")
+      };
+    };
+    const settle = async (decision) => {
+      if (decision.allowed) return run(decision);
+      const audited = await underAudit(decision);
+      if (audited) return audited;
+      if (!decision.needsApproval) {
+        return {
+          ...common(decision.decisionId, "activity"),
+          status: "blocked",
+          reason: decision.reason
+        };
+      }
+      return waitForApproval(
+        decision,
+        onApproval === "wait" ? options.approvalTimeoutMs ?? this.approvalTimeoutMs : 0,
+        signal
+      );
+    };
+    const waitForApproval = async (first2, timeoutMs, waitSignal) => {
+      let decision = first2;
+      let status = {
+        decisionId: decision.decisionId,
+        state: "waiting",
+        approvalsHave: 0,
+        approvalsNeeded: null,
+        approvalArtifactIds: []
+      };
+      const deadline = Date.now() + timeoutMs;
+      let delay = this.timing.pollStartMs;
+      for (; ; ) {
+        status = await this.approvalStatus(
+          decision.decisionId,
+          waitSignal ? { signal: waitSignal } : {}
+        );
+        if (status.state === "approved" || status.state === "rules_changed") {
+          const next = await ask(
+            status.state === "approved" ? status.approvalArtifactIds : void 0
+          );
+          if (next.allowed) return run(next);
+          if (!next.needsApproval) {
+            return {
+              ...common(next.decisionId, "activity"),
+              status: "blocked",
+              reason: next.reason
+            };
+          }
+          decision = next;
+        } else if (status.state === "not_waiting") {
+          return {
+            ...common(decision.decisionId, "activity"),
+            status: "blocked",
+            reason: decision.reason
+          };
+        }
+        const left = deadline - Date.now();
+        if (left <= 0) break;
+        await new Promise((resolve, reject) => {
+          const timer = setTimeout(resolve, Math.min(delay, left));
+          waitSignal?.addEventListener(
+            "abort",
+            () => (clearTimeout(timer), reject(waitSignal.reason)),
+            { once: true }
+          );
+        });
+        delay = Math.min(this.timing.pollMaxMs, Math.round(delay * 1.5));
+      }
+      const waiting = decision;
+      return {
+        ...common(waiting.decisionId, "approvals"),
+        status: "needs_approval",
+        reason: waiting.reason,
+        approvalsHave: status.approvalsHave,
+        approvalsNeeded: status.approvalsNeeded,
+        resume: (again = {}) => waitForApproval(
+          waiting,
+          again.approvalTimeoutMs ?? this.approvalTimeoutMs,
+          again.signal ?? waitSignal
+        )
+      };
+    };
+    let first;
+    try {
+      first = await ask();
+    } catch (err) {
+      return offlineUnderAudit(err);
+    }
+    return settle(first);
+  }
+};
+
+// src/mapping.ts
+var import_node_fs = require("fs");
+var DEFAULT_ID_ARGS = ["id", "path", "uri", "url", "name", "key"];
+var ACTION_NAME2 = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
+var MappingError = class extends Error {
+};
+function fail(message) {
+  throw new MappingError(`Mapping: ${message}`);
+}
+var CONDITION_OPS = [
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "eq",
+  "ne",
+  "in",
+  "startsWith",
+  "contains",
+  "exists"
+];
+function checkCondition(condition, where) {
+  const c = condition;
+  if (!c || typeof c !== "object" || typeof c.arg !== "string" || !c.arg)
+    fail(`${where} needs an "arg".`);
+  const ops = Object.keys(c).filter((k) => k !== "arg");
+  if (ops.length !== 1 || !CONDITION_OPS.includes(ops[0])) {
+    fail(`${where} needs exactly one of: ${CONDITION_OPS.join(", ")}.`);
+  }
+}
+var FIELD_NAME2 = /^[A-Za-z_][A-Za-z0-9_]{0,63}$/;
+function checkFields(fields, where) {
+  if (fields === void 0) return;
+  if (!fields || typeof fields !== "object" || Array.isArray(fields))
+    fail(`${where} must be an object.`);
+  for (const [field, source] of Object.entries(fields)) {
+    if (!FIELD_NAME2.test(field)) fail(`${where}: "${field}" is not a field name.`);
+    const arg = typeof source === "string" ? source : source?.arg;
+    if (typeof arg !== "string" || !arg) fail(`${where}.${field} needs an argument name.`);
+    const as = typeof source === "object" ? source.as : void 0;
+    if (as !== void 0 && as !== "integer" && as !== "string" && as !== "boolean") {
+      fail(`${where}.${field}.as must be integer, string or boolean.`);
+    }
+  }
+}
+function checkTool(name, tool) {
+  if (!tool || typeof tool !== "object") fail(`tools.${name} must be an object.`);
+  checkFields(tool.fields, `tools.${name}.fields`);
+  for (const [index, rule] of (tool.when ?? []).entries()) {
+    const where = `tools.${name}.when[${index}]`;
+    if (typeof rule?.action !== "string" || !rule.action) fail(`${where} needs an "action".`);
+    for (const condition of Array.isArray(rule.if) ? rule.if : [rule.if])
+      checkCondition(condition, `${where}.if`);
+  }
+}
+function checkMapping(raw) {
+  const file2 = raw;
+  if (!file2 || typeof file2 !== "object") fail("must be a JSON object.");
+  if (typeof file2.system !== "string" || !file2.system) fail('"system" is required.');
+  if (typeof file2.server !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_-]{0,47}$/.test(file2.server)) {
+    fail('"server" is required: a short name of letters, digits, - and _.');
+  }
+  checkFields(file2.defaults?.fields, "defaults.fields");
+  for (const [name, tool] of Object.entries(file2.tools ?? {})) checkTool(name, tool);
+  return file2;
+}
+function loadMapping(path) {
+  let text;
+  try {
+    text = (0, import_node_fs.readFileSync)(path, "utf8");
+  } catch {
+    return fail(`cannot read ${path}.`);
+  }
+  try {
+    return checkMapping(JSON.parse(text));
+  } catch (err) {
+    if (err instanceof MappingError) throw err;
+    return fail(`${path} is not valid JSON.`);
+  }
+}
+function argAt(args, path) {
+  let value = args;
+  for (const part2 of path.split(".")) {
+    if (value === null || typeof value !== "object" || !Object.prototype.hasOwnProperty.call(value, part2)) {
+      return void 0;
+    }
+    value = value[part2];
+  }
+  return value;
+}
+function matches(condition, args) {
+  const value = argAt(args, condition.arg);
+  const number = typeof value === "number" ? value : typeof value === "string" && value.trim() !== "" ? Number(value) : NaN;
+  if ("exists" in condition) return (value !== void 0 && value !== null) === condition.exists;
+  if ("gt" in condition) return number > condition.gt;
+  if ("gte" in condition) return number >= condition.gte;
+  if ("lt" in condition) return number < condition.lt;
+  if ("lte" in condition) return number <= condition.lte;
+  if ("eq" in condition) return value === condition.eq;
+  if ("ne" in condition) return value !== condition.ne;
+  if ("in" in condition) return condition.in.includes(value);
+  if ("startsWith" in condition)
+    return typeof value === "string" && value.startsWith(condition.startsWith);
+  if ("contains" in condition)
+    return typeof value === "string" && value.includes(condition.contains);
+  return false;
+}
+function toolEntry(file2, tool) {
+  const tools = file2.tools ?? {};
+  if (Object.prototype.hasOwnProperty.call(tools, tool)) return tools[tool];
+  const family = Object.keys(tools).filter((name) => name.endsWith("*") && tool.startsWith(name.slice(0, -1))).sort((a, b) => b.length - a.length)[0];
+  return family ? tools[family] : {};
+}
+var scalar = (value) => typeof value === "string" || typeof value === "number" ? String(value).slice(0, 256) : null;
+function readAs(value, as) {
+  if (value === void 0 || value === null) return void 0;
+  if (as === void 0) return value;
+  if (as === "integer") {
+    if (typeof value === "number") return Number.isSafeInteger(value) ? value : void 0;
+    if (typeof value === "string" && /^-?\d+$/.test(value.trim())) {
+      const n = Number(value.trim());
+      return Number.isSafeInteger(n) ? n : void 0;
+    }
+    return void 0;
+  }
+  if (as === "string")
+    return typeof value === "string" ? value : typeof value === "number" ? String(value) : void 0;
+  if (typeof value === "boolean") return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  return void 0;
+}
+function fieldsOf(fields, args) {
+  const out = {};
+  for (const [field, source] of Object.entries(fields)) {
+    const arg = typeof source === "string" ? source : source.arg;
+    const as = typeof source === "string" ? void 0 : source.as;
+    const value = readAs(argAt(args, arg), as);
+    if (value !== void 0) out[field] = value;
+  }
+  return out;
+}
+function toolAction(file2, tool) {
+  const entry = toolEntry(file2, tool);
+  if (entry.ungoverned === true) return null;
+  const template = entry.action ?? file2.defaults?.action ?? "{server}.{tool}";
+  const action = template.replaceAll("{server}", file2.server).replaceAll("{tool}", tool);
+  return ACTION_NAME2.test(action) ? action : null;
+}
+function mapToolCall(file2, tool, args) {
+  const entry = toolEntry(file2, tool);
+  if (entry.ungoverned === true) return { governed: false };
+  const matched = (entry.when ?? []).find(
+    (rule) => (Array.isArray(rule.if) ? rule.if : [rule.if]).every((condition) => matches(condition, args))
+  );
+  const template = matched?.action ?? entry.action ?? file2.defaults?.action ?? "{server}.{tool}";
+  const fill = (text) => text.replaceAll("{server}", file2.server).replaceAll("{tool}", tool);
+  const action = fill(template);
+  if (!ACTION_NAME2.test(action)) {
+    throw new MappingError(`The tool "${tool}" maps to an action name Praesidias does not accept.`);
+  }
+  const resource = { ...file2.defaults?.resource, ...entry.resource, ...matched?.resource };
+  const idFrom = resource.idFrom === void 0 ? DEFAULT_ID_ARGS : [resource.idFrom].flat();
+  const id = idFrom.map((name) => scalar(argAt(args, name))).find((value) => value !== null) ?? null;
+  const fields = entry.fields ?? file2.defaults?.fields;
+  if (fields) {
+    return {
+      governed: true,
+      action,
+      resource: { type: fill(resource.type ?? "{tool}").slice(0, 64), id },
+      system: entry.system ?? file2.system,
+      context: fieldsOf(fields, args)
+    };
+  }
+  const context = {
+    tool,
+    server: file2.server,
+    argumentNames: args && typeof args === "object" ? Object.keys(args).slice(0, 50) : []
+  };
+  for (const name of entry.context ?? file2.defaults?.context ?? []) {
+    const value = argAt(args, name);
+    if (["string", "number", "boolean"].includes(typeof value)) {
+      context[name] = typeof value === "string" ? value.slice(0, 256) : value;
+    }
+  }
+  return {
+    governed: true,
+    action,
+    resource: { type: fill(resource.type ?? "{tool}").slice(0, 64), id },
+    system: entry.system ?? file2.system,
+    context
+  };
+}
+
+// src/tools.ts
+var WAITING_TTL_MS = 24 * 60 * 60 * 1e3;
+var ToolGate = class {
+  constructor(praesidias, mapping, options = {}) {
+    this.praesidias = praesidias;
+    this.mapping = checkMapping(mapping);
+    this.onApproval = options.onApproval ?? "return";
+    this.approvalTimeoutMs = options.approvalTimeoutMs;
+    this.log = options.log ?? (() => {
+    });
+  }
+  praesidias;
+  mapping;
+  onApproval;
+  approvalTimeoutMs;
+  log;
+  waiting = /* @__PURE__ */ new Map();
+  /** Every tool this gate has been given, by action, as last sent to Praesidias. */
+  known = /* @__PURE__ */ new Map();
+  reportTimer = null;
+  lastReport = "";
+  /**
+   * Tells Praesidias about tools this agent has (the adapters call it with the tools they are
+   * given), so the Console lists them and says which have a rule. Tools given together, or one
+   * at a time in a row, go in one report, sent shortly after; a list that has not changed is not
+   * sent again. Never throws and never holds anything up.
+   */
+  reportTools(tools) {
+    for (const tool of tools) {
+      if (typeof tool?.name !== "string" || !tool.name) continue;
+      const action = toolAction(this.mapping, tool.name);
+      if (!action) continue;
+      this.known.set(action, {
+        name: tool.name,
+        action,
+        ...typeof tool.description === "string" ? { description: tool.description } : {},
+        inputs: inputsOfSchema(tool.schema)
+      });
+    }
+    if (this.reportTimer) return;
+    this.reportTimer = setTimeout(() => {
+      this.reportTimer = null;
+      const list = [...this.known.values()];
+      const key = JSON.stringify(list);
+      if (key === this.lastReport || list.length === 0) return;
+      this.lastReport = key;
+      void this.praesidias.reportTools("adapter", list).then((sent) => {
+        if (!sent) this.lastReport = "";
+      });
+    }, 50);
+    this.reportTimer.unref?.();
+  }
+  /** Runs `fn` if Praesidias allows this tool call, and says what happened either way. */
+  async run(tool, args, fn) {
+    let mapped;
+    try {
+      mapped = mapToolCall(this.mapping, tool, args ?? {});
+    } catch (err) {
+      this.log(`${tool}: not run (mapping)`);
+      return {
+        status: "unavailable",
+        ran: false,
+        decisionId: null,
+        code: "MAPPING_INVALID",
+        message: err instanceof MappingError ? `Not run. ${err.message}` : "Not run: this tool could not be mapped to an action."
+      };
+    }
+    if (!mapped.governed) {
+      this.log(`${tool}: passed through (marked ungoverned in the mapping)`);
+      return {
+        status: "passed_through",
+        ran: true,
+        value: await fn(),
+        message: "Ran. This tool is not governed.",
+        decisionId: null,
+        audit: false
+      };
+    }
+    const key = JSON.stringify([
+      mapped.action,
+      mapped.resource.type,
+      mapped.resource.id,
+      args ?? null
+    ]);
+    for (const [k, entry] of this.waiting)
+      if (Date.now() - entry.at > WAITING_TTL_MS) this.waiting.delete(k);
+    const remembered = this.waiting.get(key);
+    const latest = remembered?.latest ?? { run: fn };
+    latest.run = fn;
+    let result;
+    try {
+      result = remembered ? await remembered.resume() : await this.praesidias.guard(
+        mapped.action,
+        mapped.resource,
+        () => latest.run(),
+        {
+          system: mapped.system,
+          context: mapped.context,
+          onApproval: this.onApproval,
+          ...this.approvalTimeoutMs !== void 0 ? { approvalTimeoutMs: this.approvalTimeoutMs } : {}
+        }
+      );
+    } catch (err) {
+      this.waiting.delete(key);
+      if (err instanceof PraesidiasError) {
+        this.log(`${tool} \u2192 ${mapped.action}: not run (${err.code})`);
+        return {
+          status: "unavailable",
+          ran: false,
+          decisionId: null,
+          code: err.code,
+          message: err.code === "AGENT_KIT_NOT_ENABLED" ? `Not run. ${err.message}` : "Not run. Praesidias could not confirm this action is allowed, so it was not carried out. Try again shortly."
+        };
+      }
+      this.log(`${tool} \u2192 ${mapped.action}: ran, and the tool failed`);
+      throw err;
+    }
+    if (result.status === "executed") {
+      this.waiting.delete(key);
+      this.log(`${tool} \u2192 ${mapped.action}: allowed${result.audit ? " (Audit mode)" : ""}`);
+      return {
+        status: "executed",
+        ran: true,
+        value: result.value,
+        message: "Ran.",
+        decisionId: result.decisionId,
+        audit: result.audit !== null
+      };
+    }
+    if (result.status === "blocked") {
+      this.waiting.delete(key);
+      this.log(`${tool} \u2192 ${mapped.action}: blocked (${result.reason.code})`);
+      return {
+        status: "blocked",
+        ran: false,
+        decisionId: result.decisionId,
+        code: result.reason.code,
+        consoleUrl: result.consoleUrl,
+        message: `Blocked by Praesidias. ${result.reason.message}${result.consoleUrl ? ` Details: ${result.consoleUrl}` : ""}`
+      };
+    }
+    const resume = result.resume;
+    this.waiting.set(key, {
+      at: Date.now(),
+      latest,
+      resume: () => resume(
+        this.approvalTimeoutMs !== void 0 ? { approvalTimeoutMs: this.approvalTimeoutMs } : { approvalTimeoutMs: 0 }
+      )
+    });
+    this.log(`${tool} \u2192 ${mapped.action}: needs approval`);
+    const have = result.approvalsNeeded ? ` (${result.approvalsHave} of ${result.approvalsNeeded} so far)` : "";
+    return {
+      status: "needs_approval",
+      ran: false,
+      decisionId: result.decisionId,
+      approvalsHave: result.approvalsHave,
+      approvalsNeeded: result.approvalsNeeded,
+      consoleUrl: result.consoleUrl,
+      message: `Needs approval. This action was not run: a person has to approve it first${have}.${result.consoleUrl ? ` They can approve it here: ${result.consoleUrl}.` : ""} Once it is approved, make the same request again.`
+    };
+  }
+  /**
+   * A tool function that governs itself. When the action is not allowed it does not throw: it
+   * returns the sentence saying why, which is what a model needs to read in order to tell the
+   * user or to try again later. Pass `refuse` to turn that sentence into your framework's shape.
+   */
+  wrap(tool, fn, refuse) {
+    return async (args) => {
+      const outcome = await this.run(tool, args, () => fn(args));
+      if (outcome.ran) return outcome.value;
+      return refuse ? refuse(outcome) : outcome.message;
+    };
+  }
+};
+function createToolGate(praesidias, mapping, options) {
+  return new ToolGate(praesidias, mapping, options);
+}
+
+// src/agent-actions.ts
+var import_node_crypto4 = require("crypto");
+var import_node_path = require("path");
+
+// src/shell.ts
+var UNPARSED = "__unparsed__";
+var MAX_PARTS = 20;
+var MAX_COMMAND = 2e3;
+var MAX_INPUT = 1e5;
+var MAX_FLAGS = 50;
+var MAX_FLAG_LENGTH = 100;
+var MAX_SUBCOMMAND = 200;
+var Unparsed = class extends Error {
+};
+var unparsed = () => {
+  throw new Unparsed();
+};
+function split(command, dialect) {
+  const posix2 = dialect === "posix";
+  const parts = [];
+  let words = [];
+  let word = "";
+  let inWord = false;
+  let dynamic = false;
+  let quoted = false;
+  let nextIsRedirect = false;
+  let heredocNext = null;
+  const heredocs = [];
+  let partStart = 0;
+  let commentAt = -1;
+  const n = command.length;
+  const endWord = () => {
+    if (!inWord) return;
+    if (heredocNext) {
+      heredocs.push({ delimiter: word, quoted, strip: heredocNext.strip });
+      heredocNext = null;
+    } else {
+      words.push({ text: word, dynamic, redirect: nextIsRedirect });
+    }
+    nextIsRedirect = false;
+    word = "";
+    inWord = false;
+    dynamic = false;
+    quoted = false;
+  };
+  const endPart = (end) => {
+    endWord();
+    if (nextIsRedirect || heredocNext) unparsed();
+    const text = command.slice(partStart, commentAt === -1 ? end : Math.min(end, commentAt)).trim();
+    if (words.length > 0) parts.push({ words, text });
+    words = [];
+    commentAt = -1;
+  };
+  const readHeredocs = (from) => {
+    let i2 = from;
+    for (const doc of heredocs) {
+      for (; ; ) {
+        if (i2 >= n) break;
+        let end = command.indexOf("\n", i2);
+        if (end === -1) end = n;
+        const line = command.slice(i2, end);
+        i2 = end + 1;
+        const compare = doc.strip ? line.replace(/^\t+/, "") : line;
+        if (compare === doc.delimiter) break;
+        if (!doc.quoted && (line.includes("$(") || line.includes("`"))) unparsed();
+      }
+    }
+    heredocs.length = 0;
+    return Math.min(i2, n);
+  };
+  let i = 0;
+  while (i < n) {
+    const c = command[i];
+    const next = command[i + 1];
+    if (c === "'") {
+      let close = command.indexOf("'", i + 1);
+      if (close === -1) unparsed();
+      word += command.slice(i + 1, close);
+      while (!posix2 && command[close + 1] === "'") {
+        const again = command.indexOf("'", close + 2);
+        if (again === -1) unparsed();
+        word += `'${command.slice(close + 2, again)}`;
+        close = again;
+      }
+      inWord = true;
+      quoted = true;
+      i = close + 1;
+      continue;
+    }
+    if (c === '"') {
+      let j = i + 1;
+      for (; ; ) {
+        if (j >= n) unparsed();
+        const d = command[j];
+        if (d === '"') break;
+        if (posix2 && d === "\\" && j + 1 < n) {
+          const e = command[j + 1];
+          if (e === "\n") {
+            j += 2;
+            continue;
+          }
+          if ('"\\$`'.includes(e)) {
+            word += e;
+            j += 2;
+            continue;
+          }
+          word += d;
+          j += 1;
+          continue;
+        }
+        if (d === "`" || d === "$" && command[j + 1] === "(") unparsed();
+        if (d === "$") dynamic = true;
+        word += d;
+        j += 1;
+      }
+      inWord = true;
+      quoted = true;
+      i = j + 1;
+      continue;
+    }
+    if (c === "\\" && posix2) {
+      if (next === "\n") {
+        i += 2;
+        continue;
+      }
+      if (next !== void 0) word += next;
+      inWord = true;
+      quoted = true;
+      i += 2;
+      continue;
+    }
+    if (c === "`") unparsed();
+    if (c === "$" && next === "(") unparsed();
+    if (!posix2 && c === "@" && next === "(") unparsed();
+    if ((c === "<" || c === ">") && next === "(") unparsed();
+    if (c === "#" && !inWord) {
+      commentAt = i;
+      const end = command.indexOf("\n", i);
+      i = end === -1 ? n : end;
+      continue;
+    }
+    if (c === " " || c === "	" || c === "\r") {
+      endWord();
+      i += 1;
+      continue;
+    }
+    if (c === "\n" || c === ";") {
+      endPart(i);
+      i += 1;
+      if (c === "\n" && posix2 && heredocs.length > 0) i = readHeredocs(i);
+      partStart = i;
+      continue;
+    }
+    if (c === "&") {
+      if (next === ">") {
+        endWord();
+        i += command[i + 2] === ">" ? 3 : 2;
+        nextIsRedirect = true;
+        continue;
+      }
+      endPart(i);
+      i += next === "&" ? 2 : 1;
+      partStart = i;
+      continue;
+    }
+    if (c === "|") {
+      endPart(i);
+      i += next === "|" || next === "&" ? 2 : 1;
+      partStart = i;
+      continue;
+    }
+    if (c === "(" || c === ")") {
+      endPart(i);
+      i += 1;
+      partStart = i;
+      continue;
+    }
+    if (c === "<" || c === ">") {
+      if (inWord && !quoted && /^[0-9]+$/.test(word)) {
+        word = "";
+        inWord = false;
+      }
+      endWord();
+      if (c === "<" && next === "<") {
+        if (command[i + 2] === "<") {
+          i += 3;
+          nextIsRedirect = true;
+          continue;
+        }
+        const strip = command[i + 2] === "-";
+        i += strip ? 3 : 2;
+        heredocNext = { strip };
+        continue;
+      }
+      i += 1;
+      if (command[i] === ">" || command[i] === "|" || command[i] === "&" || command[i] === "<") {
+        if (command[i] === "&") {
+          i += 1;
+          const m = /^([0-9]+|-)/.exec(command.slice(i));
+          if (m) {
+            i += m[0].length;
+            continue;
+          }
+        } else {
+          i += 1;
+        }
+      }
+      nextIsRedirect = true;
+      continue;
+    }
+    if (c === "$" || c === "*" || c === "?") dynamic = true;
+    word += c;
+    inWord = true;
+    i += 1;
+  }
+  endPart(n);
+  return parts;
+}
+var KEYWORDS = /* @__PURE__ */ new Set([
+  "if",
+  "then",
+  "else",
+  "elif",
+  "fi",
+  "do",
+  "done",
+  "while",
+  "until",
+  "!",
+  "{",
+  "}",
+  "esac"
+]);
+var KEEP_KEYWORDS = /* @__PURE__ */ new Set(["for", "case", "select", "function", "coproc"]);
+var SHELLS = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "dash",
+  "ksh",
+  "mksh",
+  "ash",
+  "fish",
+  "csh",
+  "tcsh",
+  "busybox"
+]);
+var POWERSHELLS = /* @__PURE__ */ new Set(["powershell", "pwsh"]);
+var EVALUATORS = /* @__PURE__ */ new Set(["eval", "iex", "invoke-expression"]);
+var VALUE_FLAGS = {
+  git: ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--config-env", "--exec-path"],
+  docker: ["-H", "--host", "--context", "-c", "--config", "-l", "--log-level"],
+  kubectl: [
+    "-n",
+    "--namespace",
+    "--context",
+    "--cluster",
+    "--user",
+    "-s",
+    "--server",
+    "--kubeconfig"
+  ],
+  helm: ["-n", "--namespace", "--kube-context", "--kubeconfig"],
+  npm: ["-C", "--prefix", "-w", "--workspace"],
+  pnpm: ["-C", "--dir", "--filter", "-F"],
+  yarn: ["--cwd"],
+  gh: ["-R", "--repo"],
+  cargo: ["-C", "--manifest-path"],
+  terraform: []
+};
+var lastSegment = (text) => {
+  const parts = text.split(/[\\/]/);
+  return parts[parts.length - 1] ?? text;
+};
+function programName(word) {
+  return lastSegment(word.replace(/^\\+/, "")).toLowerCase().replace(/\.(exe|cmd|bat|com)$/, "");
+}
+var isFlag = (text) => text.length > 1 && text.startsWith("-");
+function skipFlags(words, from, valued) {
+  let i = from;
+  while (i < words.length) {
+    const text = words[i].text;
+    if (text === "--") return i + 1;
+    if (!isFlag(text)) return i;
+    i += valued.has(text) ? 2 : 1;
+  }
+  return i;
+}
+var ASSIGNMENT = /^[A-Za-z_][A-Za-z0-9_]*\+?=/;
+function unwrap(words) {
+  let rest = words;
+  for (let depth = 0; depth < 8 && rest.length > 0; depth += 1) {
+    const name = programName(rest[0].text);
+    let from;
+    switch (name) {
+      case "sudo":
+        from = skipFlags(
+          rest,
+          1,
+          /* @__PURE__ */ new Set([
+            "-u",
+            "-g",
+            "-h",
+            "-p",
+            "-C",
+            "-D",
+            "-r",
+            "-t",
+            "-U",
+            "-T",
+            "--user",
+            "--group",
+            "--host",
+            "--prompt",
+            "--chdir"
+          ])
+        );
+        break;
+      case "doas":
+        from = skipFlags(rest, 1, /* @__PURE__ */ new Set(["-u", "-C"]));
+        break;
+      case "env": {
+        let i = 1;
+        while (i < rest.length) {
+          const text = rest[i].text;
+          if (text === "-S" || text.startsWith("--split-string") || /^-[a-zA-Z]*S/.test(text))
+            unparsed();
+          if (text === "--") {
+            i += 1;
+            break;
+          }
+          if (text === "-u" || text === "--unset" || text === "-C" || text === "--chdir") i += 2;
+          else if (isFlag(text) || ASSIGNMENT.test(text)) i += 1;
+          else break;
+        }
+        from = i;
+        break;
+      }
+      case "command":
+      case "builtin":
+      case "nohup":
+      case "time":
+        from = skipFlags(rest, 1, /* @__PURE__ */ new Set());
+        break;
+      case "exec":
+        from = skipFlags(rest, 1, /* @__PURE__ */ new Set(["-a"]));
+        break;
+      case "nice":
+        from = skipFlags(rest, 1, /* @__PURE__ */ new Set(["-n", "--adjustment"]));
+        break;
+      case "ionice":
+        from = skipFlags(rest, 1, /* @__PURE__ */ new Set(["-c", "-n", "-p", "--class", "--classdata"]));
+        break;
+      case "stdbuf":
+        from = skipFlags(rest, 1, /* @__PURE__ */ new Set(["-i", "-o", "-e", "--input", "--output", "--error"]));
+        break;
+      case "timeout":
+        from = skipFlags(rest, 1, /* @__PURE__ */ new Set(["-s", "-k", "--signal", "--kill-after"]));
+        from += 1;
+        break;
+      case "xargs":
+        from = skipFlags(
+          rest,
+          1,
+          /* @__PURE__ */ new Set([
+            "-n",
+            "-I",
+            "-L",
+            "-P",
+            "-s",
+            "-d",
+            "-E",
+            "-a",
+            "--max-args",
+            "--max-lines",
+            "--max-procs",
+            "--max-chars",
+            "--delimiter",
+            "--eof",
+            "--arg-file",
+            "--replace"
+          ])
+        );
+        if (from >= rest.length) return rest;
+        break;
+      default:
+        return rest;
+    }
+    if (from >= rest.length) return rest.slice(0, 1);
+    rest = rest.slice(from);
+    while (rest.length > 1 && ASSIGNMENT.test(rest[0].text)) rest = rest.slice(1);
+  }
+  return rest;
+}
+function flagsOf(args, dialect) {
+  const out = [];
+  const add = (flag) => {
+    const cut = clipText(flag, MAX_FLAG_LENGTH);
+    if (!out.includes(cut) && out.length < MAX_FLAGS) out.push(cut);
+  };
+  for (const arg of args) {
+    if (arg === "--") break;
+    if (!isFlag(arg)) continue;
+    add(arg);
+    if (arg.startsWith("--")) {
+      const eq = arg.indexOf("=");
+      if (eq > 2) add(arg.slice(0, eq));
+    } else if (dialect === "posix" && /^-[A-Za-z]{2,}$/.test(arg)) {
+      for (const letter of arg.slice(1)) add(`-${letter}`);
+    }
+  }
+  return out;
+}
+function subcommandOf(program, args) {
+  const valued = new Set(VALUE_FLAGS[program] ?? []);
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--") return clipText(args[i + 1] ?? "", MAX_SUBCOMMAND);
+    if (isFlag(arg)) {
+      if (valued.has(arg)) i += 1;
+      continue;
+    }
+    return clipText(arg, MAX_SUBCOMMAND);
+  }
+  return "";
+}
+function clipText(text, max) {
+  if (text.length <= max) return text;
+  let end = max;
+  const last = text.charCodeAt(end - 1);
+  if (last >= 55296 && last <= 56319) end -= 1;
+  return text.slice(0, end);
+}
+var clip = (text) => clipText(text, MAX_COMMAND);
+function analyse(raw, out, dialect, nested = false) {
+  let words = raw.words.filter((w) => !w.redirect);
+  while (words.length > 0 && ASSIGNMENT.test(words[0].text)) words = words.slice(1);
+  while (words.length > 0 && KEYWORDS.has(words[0].text)) words = words.slice(1);
+  if (words.length === 0) return;
+  if (KEEP_KEYWORDS.has(words[0].text)) {
+    out.push({ program: words[0].text, subcommand: "", flags: [], command: clip(raw.text) });
+    return;
+  }
+  words = unwrap(words);
+  const first = words[0];
+  if (first.dynamic) unparsed();
+  const program = programName(first.text);
+  if (!program) unparsed();
+  const args = words.slice(1).map((w) => w.text);
+  if (EVALUATORS.has(program)) unparsed();
+  if (SHELLS.has(program) && args.some((a) => /^-[a-zA-Z]*c[a-zA-Z]*$/.test(a))) unparsed();
+  if (POWERSHELLS.has(program) && args.some((a) => /^[-/](c|command|e|ec|enc|encodedcommand)$/i.test(a)))
+    unparsed();
+  if (program === "cmd" && args.some((a) => /^\/[ckr]$/i.test(a))) unparsed();
+  const execAt = program === "find" ? args.findIndex((a) => ["-exec", "-execdir", "-ok", "-okdir"].includes(a)) : -1;
+  out.push({
+    program,
+    subcommand: subcommandOf(program, args),
+    flags: flagsOf(execAt === -1 ? args : args.slice(0, execAt + 1), dialect),
+    command: clip(nested ? words.map((w) => w.text).join(" ") : raw.text)
+  });
+  if (program === "find") {
+    for (let i = 0; i < args.length; i += 1) {
+      if (!["-exec", "-execdir", "-ok", "-okdir"].includes(args[i])) continue;
+      const inner = [];
+      let j = i + 1;
+      for (; j < args.length && args[j] !== ";" && args[j] !== "+"; j += 1) {
+        inner.push(words[j + 1]);
+      }
+      if (inner.length > 0) analyse({ words: inner, text: "" }, out, dialect, true);
+      i = j;
+    }
+  }
+}
+function parseShellCommand(command, dialect = "posix") {
+  if (typeof command !== "string" || command.length > MAX_INPUT) return { parsed: false };
+  try {
+    const parts = [];
+    for (const raw of split(command, dialect)) {
+      analyse(raw, parts, dialect);
+      if (parts.length > MAX_PARTS) return { parsed: false };
+    }
+    return { parsed: true, parts };
+  } catch (err) {
+    if (err instanceof Unparsed) return { parsed: false };
+    throw err;
+  }
+}
+function unparsedPart(command) {
+  return { program: UNPARSED, subcommand: "", flags: [], command: clip(String(command ?? "")) };
+}
+
+// src/agent-actions.ts
+var MAX_ACTION_LENGTH = 64;
+var MAX_TEXT = 2e3;
+var MAX_INPUT_TEXT = 1024;
+var MAX_QUERY = 200;
+var MAX_DESCRIPTION = 500;
+var MAX_RESOURCE_ID = 128;
+var SENSITIVE = [
+  /^\.env$/,
+  /^\.env\..+$/,
+  /^.*\.pem$/,
+  /^.*\.key$/,
+  /^id_rsa.*$/,
+  /^id_ed25519.*$/,
+  /^\.npmrc$/,
+  /^\.pypirc$/,
+  /^\.netrc$/,
+  /^credentials.*$/,
+  /^.*\.p12$/,
+  /^.*\.pfx$/,
+  /^\.aws$/,
+  /^\.ssh$/,
+  /^\.gnupg$/,
+  /^secrets\..+$/
+];
+var sensitiveName = (segment) => {
+  const name = segment.toLowerCase();
+  return name.length > 0 && SENSITIVE.some((pattern) => pattern.test(name));
+};
+function isSensitivePath(path) {
+  return String(path ?? "").split(/[\\/]+/).some((segment) => sensitiveName(segment) || sensitiveName(segment.replace(/[*?]/g, "")));
+}
+var clip2 = clipText;
+var str = (value) => typeof value === "string" ? value : "";
+function fitActionName(name) {
+  if (name.length <= MAX_ACTION_LENGTH) return name;
+  const hash = (0, import_node_crypto4.createHash)("sha256").update(name).digest("hex").slice(0, 8);
+  return `${name.slice(0, MAX_ACTION_LENGTH - 9)}-${hash}`;
+}
+var part = (text) => text.toLowerCase().replace(/[^a-z0-9_-]/g, "_") || "_";
+function mcpAction(tool) {
+  const match = /^mcp__(.+?)__(.+)$/.exec(tool);
+  if (!match) return null;
+  const server = part(match[1]);
+  const name = part(match[2]);
+  return { action: fitActionName(`mcp.${server}.${name}`), server, tool: name };
+}
+function otherAction(agent, tool) {
+  return fitActionName(`${agent}.${part(tool)}`);
+}
+function pathFacts(raw, call2) {
+  const platform = call2.platform ?? (process.platform === "win32" ? "win32" : "posix");
+  const lib = platform === "win32" ? import_node_path.win32 : import_node_path.posix;
+  const cwd = call2.cwd || lib.resolve(".");
+  const project = call2.projectDir || cwd;
+  const home = call2.home ? lib.resolve(call2.home) : "";
+  const expanded = home && /^~([\\/]|$)/.test(raw) ? lib.join(home, raw.slice(1)) : raw;
+  const absolute = lib.resolve(cwd, expanded || ".");
+  const inside = lib.relative(project, absolute);
+  const inProject = inside === "" || !inside.startsWith("..") && !lib.isAbsolute(inside) && inside !== "..";
+  const fromHome = home ? lib.relative(home, absolute) : "..";
+  let shown;
+  if (inProject) shown = inside === "" ? "." : inside;
+  else if (home && (fromHome === "" || !fromHome.startsWith("..") && !lib.isAbsolute(fromHome)))
+    shown = fromHome === "" ? "~" : `~/${fromHome}`;
+  else shown = absolute;
+  shown = shown.split("\\").join("/");
+  return {
+    path: clip2(shown, MAX_TEXT),
+    sensitive: isSensitivePath(absolute) || isSensitivePath(raw),
+    in_project: inProject
+  };
+}
+var file = (action, facts, extra) => ({
+  action,
+  resourceType: "file",
+  resourceId: clip2(facts.path, MAX_RESOURCE_ID),
+  context: action === "files.read" ? { path: facts.path, sensitive: facts.sensitive || (extra ? isSensitivePath(extra) : false) } : { path: facts.path, sensitive: facts.sensitive, in_project: facts.in_project }
+});
+var shellAction = (p) => ({
+  action: "shell.run",
+  resourceType: "command",
+  resourceId: clip2(p.program, MAX_RESOURCE_ID) || null,
+  context: { program: p.program, subcommand: p.subcommand, flags: p.flags, command: p.command }
+});
+function shellActions(command, dialect = "posix") {
+  const parsed = parseShellCommand(command, dialect);
+  if (!parsed.parsed) return [shellAction(unparsedPart(command))];
+  if (parsed.parts.length === 0)
+    return [shellAction({ program: "", subcommand: "", flags: [], command: "" })];
+  return parsed.parts.map(shellAction);
+}
+function patchPaths(patch) {
+  const paths = [];
+  for (const line of String(patch ?? "").split(/\r?\n/)) {
+    const match = /^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/.exec(line);
+    if (match) {
+      const path = match[1].trim();
+      if (path && !paths.includes(path)) paths.push(path);
+    }
+  }
+  return paths;
+}
+function mcpContext(input, declared) {
+  const out = {};
+  if (!input || typeof input !== "object" || Array.isArray(input)) return out;
+  const allowed = declared ? new Set(declared) : null;
+  for (const [name, value] of Object.entries(input)) {
+    if (allowed && !allowed.has(name)) continue;
+    if (name.length > 64) continue;
+    if (typeof value === "string") out[name] = clip2(value, MAX_INPUT_TEXT);
+    else if (typeof value === "number" || typeof value === "boolean" || value === null)
+      out[name] = value;
+    else if (typeof value === "object") {
+      const text = JSON.stringify(value);
+      if (text !== void 0 && text.length <= MAX_TEXT) out[name] = value;
+    }
+  }
+  return out;
+}
+var shellQuote = (arg) => /^[A-Za-z0-9_@%+=:,./-]+$/.test(arg) ? arg : `'${arg.split("'").join("'\\''")}'`;
+var READ_TOOLS = /* @__PURE__ */ new Set(["Read", "Grep", "Glob", "LS"]);
+var WRITE_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
+var DELEGATE_TOOLS = /* @__PURE__ */ new Set(["Task", "Agent", "spawn_agent"]);
+function agentToolActions(call2) {
+  const tool = String(call2.tool ?? "");
+  const input = call2.input && typeof call2.input === "object" ? call2.input : {};
+  if (tool === "Bash" || tool === "shell" || tool === "exec_command" || tool === "local_shell") {
+    const command = Array.isArray(input.command) ? input.command.map((arg) => shellQuote(String(arg))).join(" ") : str(input.command) || str(input.cmd);
+    return shellActions(command);
+  }
+  if (tool === "PowerShell") return shellActions(str(input.command), "powershell");
+  if (tool === "write_stdin") return [shellAction(unparsedPart(str(input.chars)))];
+  if (READ_TOOLS.has(tool)) {
+    const raw = str(input.file_path) || str(input.path) || ".";
+    const pattern = tool === "Glob" ? str(input.pattern) : tool === "Grep" ? str(input.glob) : "";
+    return [file("files.read", pathFacts(raw, call2), pattern)];
+  }
+  if (WRITE_TOOLS.has(tool)) {
+    const raw = str(input.file_path) || str(input.notebook_path) || str(input.path);
+    return [file("files.write", pathFacts(raw, call2))];
+  }
+  if (tool === "apply_patch") {
+    const paths = patchPaths(str(input.command) || str(input.patch) || str(input.input));
+    if (paths.length === 0) {
+      return [
+        {
+          action: "files.write",
+          resourceType: "file",
+          resourceId: null,
+          context: { path: "", sensitive: true, in_project: false }
+        }
+      ];
+    }
+    return paths.map((path) => file("files.write", pathFacts(path, call2)));
+  }
+  if (tool === "WebFetch") {
+    const url = str(input.url);
+    let host = "";
+    try {
+      host = new URL(url).hostname.toLowerCase();
+    } catch {
+      host = "";
+    }
+    return [
+      {
+        action: "web.fetch",
+        resourceType: "url",
+        resourceId: clip2(host, MAX_RESOURCE_ID) || null,
+        context: { host, url: clip2(url, MAX_TEXT) }
+      }
+    ];
+  }
+  if (tool === "WebSearch") {
+    return [
+      {
+        action: "web.search",
+        resourceType: "web_search",
+        resourceId: null,
+        context: { query: clip2(str(input.query), MAX_QUERY) }
+      }
+    ];
+  }
+  if (DELEGATE_TOOLS.has(tool)) {
+    const description = str(input.description) || str(input.prompt) || str(input.message) || str(input.task);
+    const kind = str(input.subagent_type) || str(input.agent_type);
+    return [
+      {
+        action: "agent.delegate",
+        resourceType: "agent",
+        resourceId: kind ? clip2(kind, MAX_RESOURCE_ID) : null,
+        context: { description: clip2(description, MAX_DESCRIPTION) }
+      }
+    ];
+  }
+  const mcp = mcpAction(tool);
+  if (mcp) {
+    return [
+      {
+        action: mcp.action,
+        resourceType: "mcp_tool",
+        resourceId: clip2(`${mcp.server}.${mcp.tool}`, MAX_RESOURCE_ID),
+        context: mcpContext(call2.input, call2.declaredInputs)
+      }
+    ];
+  }
+  return [
+    {
+      action: otherAction(call2.agent, tool),
+      resourceType: "tool",
+      resourceId: clip2(tool, MAX_RESOURCE_ID) || null,
+      context: { tool: clip2(tool, MAX_TEXT) }
+    }
+  ];
+}
+var BUILT_IN_INPUTS = {
+  "shell.run": {
+    program: { type: "string", description: "The program run, without its folder" },
+    subcommand: { type: "string", description: "Its first argument that is not a flag" },
+    flags: { type: "array", description: "Its flags" },
+    command: { type: "string", description: "The command as written (up to 2,000 characters)" }
+  },
+  "files.read": {
+    path: { type: "string", description: "The file or folder" },
+    sensitive: { type: "boolean", description: "A secret file: .env, keys, credentials" }
+  },
+  "files.write": {
+    path: { type: "string", description: "The file" },
+    sensitive: { type: "boolean", description: "A secret file: .env, keys, credentials" },
+    in_project: { type: "boolean", description: "Inside this project" }
+  },
+  "web.fetch": {
+    host: { type: "string", description: "The web address\u2019s host" },
+    url: { type: "string", description: "The web address" }
+  },
+  "web.search": { query: { type: "string", description: "What is searched for" } },
+  "agent.delegate": {
+    description: { type: "string", description: "What the helper agent is asked to do" }
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BUILT_IN_INPUTS,
+  MAX_ACTION_LENGTH,
+  MappingError,
+  Praesidias,
+  PraesidiasAuthError,
+  PraesidiasConfigError,
+  PraesidiasError,
+  PraesidiasRequestError,
+  PraesidiasUnavailableError,
+  TOOLS_PER_REPORT,
+  ToolGate,
+  UNPARSED,
+  WORKLOAD_TOKEN_HEADER,
+  agentToolActions,
+  checkMapping,
+  createToolGate,
+  fitActionName,
+  inputsOfSchema,
+  isSensitivePath,
+  loadMapping,
+  mapToolCall,
+  matches,
+  mcpAction,
+  otherAction,
+  parseShellCommand,
+  patchPaths,
+  sentenceFor,
+  shellActions,
+  subjectIdFor,
+  toolAction,
+  toolsForReport
+});