@relkit/inspector-api 0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 rel-kit
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,5 @@
+# @relkit/inspector-api
+
+Unsupported internal API for the RELKIT inspector; use @relkit/cli.
+
+See [@relkit/app](https://github.com/rel-kit/relkit) for supported application APIs.

package/dist/actions-dispatch.d.ts

@@ -0,0 +1,4 @@
+import { type ResolvedActiveGeneration } from "./shared.js";
+import type { InspectorActionRequest, InspectorActionServices } from "./actions.js";
+export declare function dispatchInspectorAction(request: InspectorActionRequest, generation: ResolvedActiveGeneration, actions: InspectorActionServices): Promise<Record<string, unknown>>;
+//# sourceMappingURL=actions-dispatch.d.ts.map

package/dist/actions-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-dispatch.d.ts","sourceRoot":"","sources":["../src/actions-dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAItE,OAAO,KAAK,EACV,sBAAsB,EACtB,uBAAuB,EAKxB,MAAM,cAAc,CAAC;AAEtB,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,sBAAsB,EAC/B,UAAU,EAAE,wBAAwB,EACpC,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAuDlC"}

package/dist/actions-dispatch.js

@@ -0,0 +1,80 @@
+import { PROTOCOL_VERSION } from "@relkit/contracts";
+import { safeJson } from "./shared.js";
+import { InspectorActionError } from "./actions-errors.js";
+import { ACTION_REDACTION, projectAdmin, projectApproval } from "./actions-projection.js";
+import { assertActionState, assertProtocol, bounded, reason } from "./actions-utils.js";
+export async function dispatchInspectorAction(request, generation, actions) {
+    if (request.action === "function.invoke") {
+        const service = actions.functions;
+        const invoke = service?.invoke ?? actions.invokeFunction;
+        if (invoke === undefined)
+            throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_UNSUPPORTED", 501);
+        if (service?.exists !== undefined && !(await service.exists(request.targetId)))
+            throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_NOT_FOUND", 404);
+        const value = await invoke({
+            generationId: generation.generationId,
+            graphHash: generation.graphHash,
+            functionId: request.targetId,
+            input: request.body.input,
+            idempotencyKey: request.idempotencyKey,
+            ...(request.signal === undefined ? {} : { signal: request.signal }),
+        });
+        return { output: safeJson(value, ACTION_REDACTION) };
+    }
+    if (request.action.startsWith("job.")) {
+        const service = actions.jobs;
+        assertProtocol(service, "relkit.jobs.admin");
+        const method = request.action === "job.retry" ? service?.retry : service?.cancel;
+        if (method === undefined)
+            throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_UNSUPPORTED", 501);
+        if (service?.status !== undefined)
+            assertActionState(request.action, await service.status(request.targetId));
+        const actionReason = reason(request.body.reason);
+        return projectAdmin(await method({
+            protocol: "relkit.jobs.admin",
+            version: PROTOCOL_VERSION,
+            instanceId: request.targetId,
+            ...(actionReason === undefined ? {} : { reason: actionReason }),
+        }));
+    }
+    if (request.action.startsWith("event.")) {
+        const service = actions.events;
+        assertProtocol(service, "relkit.events.admin");
+        const method = request.action === "event.retry" ? service?.retry : service?.cancel;
+        if (method === undefined)
+            throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_UNSUPPORTED", 501);
+        if (service?.status !== undefined)
+            assertActionState(request.action, await service.status(request.targetId));
+        const actionReason = reason(request.body.reason);
+        return projectAdmin(await method({
+            protocol: "relkit.events.admin",
+            version: PROTOCOL_VERSION,
+            deliveryId: request.targetId,
+            ...(actionReason === undefined ? {} : { reason: actionReason }),
+        }));
+    }
+    return approveTool(request, actions);
+}
+async function approveTool(request, actions) {
+    const service = actions.approvals ?? actions.tools?.approvals;
+    if (service === undefined)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_UNSUPPORTED", 501);
+    const approvalRequest = {
+        invocationId: bounded(request.body.invocationId),
+        toolCallId: bounded(request.body.toolCallId),
+        toolId: request.targetId,
+        idempotencyKey: request.idempotencyKey,
+    };
+    const current = await service.get({
+        invocationId: approvalRequest.invocationId,
+        toolCallId: approvalRequest.toolCallId,
+        toolId: approvalRequest.toolId,
+    });
+    if (!current || current.state !== "pending")
+        throw new InspectorActionError("RELKIT_INSPECTOR_APPROVAL_STATE_INELIGIBLE", 409);
+    const method = request.action === "tool.deny" ? service.deny : service.approve;
+    if (method === undefined)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_UNSUPPORTED", 501);
+    return { approval: projectApproval(await method(approvalRequest)) };
+}
+//# sourceMappingURL=actions-dispatch.js.map

package/dist/actions-dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-dispatch.js","sourceRoot":"","sources":["../src/actions-dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAiC,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAUxF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA+B,EAC/B,UAAoC,EACpC,OAAgC;IAEhC,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC;QACzD,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC5E,MAAM,IAAI,oBAAoB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC;YACzB,YAAY,EAAE,UAAU,CAAC,YAAY;YACrC,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK;YACzB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;SAC3B,CAAC,CAAC;QAC5C,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QAC7B,cAAc,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;QACjF,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;YAC/B,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,YAAY,CACjB,MAAM,MAAM,CAAC;YACX,QAAQ,EAAE,mBAAmB;YAC7B,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC5B,CAAC,CACvC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/B,cAAc,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC;QACnF,IAAI,MAAM,KAAK,SAAS;YACtB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;QAC7E,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS;YAC/B,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,YAAY,CACjB,MAAM,MAAM,CAAC;YACX,QAAQ,EAAE,qBAAqB;YAC/B,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,OAAO,CAAC,QAAQ;YAC5B,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC1B,CAAC,CACzC,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAA+B,EAC/B,OAAgC;IAEhC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,SAAS,CAAC;IAC9D,IAAI,OAAO,KAAK,SAAS;QACvB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC7E,MAAM,eAAe,GAAG;QACtB,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAChD,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC,QAAQ;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;KACA,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChC,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,UAAU,EAAE,eAAe,CAAC,UAAU;QACtC,MAAM,EAAE,eAAe,CAAC,MAAM;KAC/B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QACzC,MAAM,IAAI,oBAAoB,CAAC,4CAA4C,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/E,IAAI,MAAM,KAAK,SAAS;QACtB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAC7E,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC"}

package/dist/actions-errors.d.ts

@@ -0,0 +1,7 @@
+export declare class InspectorActionError extends Error {
+    readonly code: string;
+    readonly status: number;
+    readonly body: Record<string, unknown> | undefined;
+    constructor(code: string, status: number, body?: Record<string, unknown>);
+}
+//# sourceMappingURL=actions-errors.d.ts.map

package/dist/actions-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-errors.d.ts","sourceRoot":"","sources":["../src/actions-errors.ts"],"names":[],"mappings":"AAAA,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;gBAEvC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAOzE"}

package/dist/actions-errors.js

@@ -0,0 +1,13 @@
+export class InspectorActionError extends Error {
+    code;
+    status;
+    body;
+    constructor(code, status, body) {
+        super(code);
+        this.name = "InspectorActionError";
+        this.code = code;
+        this.status = status;
+        this.body = body;
+    }
+}
+//# sourceMappingURL=actions-errors.js.map

package/dist/actions-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-errors.js","sourceRoot":"","sources":["../src/actions-errors.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,CAAS;IACb,MAAM,CAAS;IACf,IAAI,CAAsC;IAEnD,YAAY,IAAY,EAAE,MAAc,EAAE,IAA8B;QACtE,KAAK,CAAC,IAAI,CAAC,CAAC;QACZ,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/actions-projection.d.ts

@@ -0,0 +1,7 @@
+import { type JsonValue } from "@relkit/contracts";
+export declare const ACTION_REDACTION: Readonly<{
+    redactKeys: string[];
+}>;
+export declare function projectAdmin(value: unknown): Record<string, unknown>;
+export declare function projectApproval(value: unknown): JsonValue;
+//# sourceMappingURL=actions-projection.d.ts.map

package/dist/actions-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-projection.d.ts","sourceRoot":"","sources":["../src/actions-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,eAAO,MAAM,gBAAgB;;EAW3B,CAAC;AAEH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkDpE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAczD"}

package/dist/actions-projection.js

@@ -0,0 +1,79 @@
+import {} from "@relkit/contracts";
+import { isRecord, pick, safeJson } from "./shared.js";
+export const ACTION_REDACTION = Object.freeze({
+    redactKeys: [
+        "handler",
+        "handlerObject",
+        "providerFile",
+        "providerRoot",
+        "stateRoot",
+        "registry",
+        "raw",
+        "object",
+    ],
+});
+export function projectAdmin(value) {
+    if (!isRecord(value))
+        return {};
+    const status = isRecord(value.status)
+        ? pick(value.status, [
+            "protocol",
+            "version",
+            "instanceId",
+            "deliveryId",
+            "eventInstanceId",
+            "eventId",
+            "triggerId",
+            "cursor",
+            "sequence",
+            "state",
+            "profile",
+            "attempt",
+            "acceptedAt",
+            "order",
+            "availableAt",
+            "leaseExpiresAt",
+            "idempotencyExpiresAt",
+            "duplicate",
+            "timestamp",
+            "failure",
+        ])
+        : undefined;
+    const record = isRecord(value.record)
+        ? pick(value.record, [
+            "protocol",
+            "version",
+            "actionId",
+            "action",
+            "instanceId",
+            "deliveryId",
+            "eventInstanceId",
+            "triggerId",
+            "mode",
+            "outcome",
+            "requestedAt",
+            "fromState",
+            "toState",
+            "errorCode",
+            "reason",
+        ])
+        : undefined;
+    return {
+        ...(status === undefined ? {} : { status: safeJson(status, ACTION_REDACTION) }),
+        ...(record === undefined ? {} : { record: safeJson(record, ACTION_REDACTION) }),
+        ...(typeof value.action === "string" ? { action: value.action } : {}),
+    };
+}
+export function projectApproval(value) {
+    const approval = isRecord(value) ? value : {};
+    return safeJson(pick(approval, [
+        "invocationId",
+        "toolCallId",
+        "toolId",
+        "state",
+        "sideEffect",
+        "policy",
+        "required",
+    ]), ACTION_REDACTION);
+}
+//# sourceMappingURL=actions-projection.js.map

package/dist/actions-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-projection.js","sourceRoot":"","sources":["../src/actions-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,UAAU,EAAE;QACV,SAAS;QACT,eAAe;QACf,cAAc;QACd,cAAc;QACd,WAAW;QACX,UAAU;QACV,KAAK;QACL,QAAQ;KACT;CACF,CAAC,CAAC;AAEH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YACjB,UAAU;YACV,SAAS;YACT,YAAY;YACZ,YAAY;YACZ,iBAAiB;YACjB,SAAS;YACT,WAAW;YACX,QAAQ;YACR,UAAU;YACV,OAAO;YACP,SAAS;YACT,SAAS;YACT,YAAY;YACZ,OAAO;YACP,aAAa;YACb,gBAAgB;YAChB,sBAAsB;YACtB,WAAW;YACX,WAAW;YACX,SAAS;SACV,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YACjB,UAAU;YACV,SAAS;YACT,UAAU;YACV,QAAQ;YACR,YAAY;YACZ,YAAY;YACZ,iBAAiB;YACjB,WAAW;YACX,MAAM;YACN,SAAS;YACT,aAAa;YACb,WAAW;YACX,SAAS;YACT,WAAW;YACX,QAAQ;SACT,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9C,OAAO,QAAQ,CACb,IAAI,CAAC,QAAQ,EAAE;QACb,cAAc;QACd,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,UAAU;KACX,CAAC,EACF,gBAAgB,CACjB,CAAC;AACJ,CAAC"}

package/dist/actions-runtime.d.ts

@@ -0,0 +1,15 @@
+import { type ResolvedActiveGeneration } from "./shared.js";
+import type { InspectorActionName, InspectorActionRequest } from "./actions.js";
+import type { InspectorMode } from "./shared.js";
+export interface InspectorActionResult {
+    readonly status: number;
+    readonly body: Record<string, unknown>;
+    readonly fingerprint: string;
+}
+export declare function parseInspectorAction(action: InspectorActionName, target: string | undefined, body: Record<string, unknown>, headers?: Headers, signal?: AbortSignal, decision?: "approve" | "deny"): InspectorActionRequest;
+export declare function executeInspectorAction(request: InspectorActionRequest, options: {
+    readonly mode: InspectorMode;
+    readonly getGeneration: () => Promise<ResolvedActiveGeneration | undefined>;
+    readonly idempotency?: Map<string, Promise<InspectorActionResult>>;
+}): Promise<InspectorActionResult>;
+//# sourceMappingURL=actions-runtime.d.ts.map

package/dist/actions-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-runtime.d.ts","sourceRoot":"","sources":["../src/actions-runtime.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAWtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAID,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,mBAAmB,EAC3B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,OAAO,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,SAAS,GAAG,MAAM,GAC5B,sBAAsB,CA4BxB;AAED,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,sBAAsB,EAC/B,OAAO,EAAE;IACP,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC;CACpE,GACA,OAAO,CAAC,qBAAqB,CAAC,CAmChC"}

package/dist/actions-runtime.js

@@ -0,0 +1,96 @@
+import { PROTOCOL_VERSION, normalizeId } from "@relkit/contracts";
+import { identity } from "./shared.js";
+import { InspectorActionError } from "./actions-errors.js";
+import { bounded, makeAudit, requestFingerprint, toActionError, validateIdentity, writeAudit, } from "./actions-utils.js";
+import { dispatchInspectorAction } from "./actions-dispatch.js";
+const defaultIdempotency = new Map();
+export function parseInspectorAction(action, target, body, headers, signal, decision) {
+    let targetId;
+    try {
+        targetId = normalizeId(target).toString();
+    }
+    catch {
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_TARGET_INVALID", 400);
+    }
+    const generationId = bounded(body.generationId ?? headers?.get("x-relkit-generation-id"), 128);
+    const graphHash = bounded(body.graphHash ?? headers?.get("x-relkit-graph-hash"), 256);
+    const idempotencyKey = bounded(body.idempotencyKey ?? headers?.get("idempotency-key"), 128);
+    if (body.reason !== undefined)
+        bounded(body.reason, 256);
+    const resolvedDecision = decision ?? readDecision(body.decision);
+    const resolvedAction = resolvedDecision === "deny" ? "tool.deny" : action;
+    if (resolvedAction === "tool.approve" || resolvedAction === "tool.deny") {
+        bounded(body.invocationId, 128);
+        bounded(body.toolCallId, 128);
+        if (resolvedDecision === undefined)
+            throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_REQUEST_INVALID", 400);
+    }
+    return {
+        action: resolvedAction,
+        targetId,
+        generationId,
+        graphHash,
+        idempotencyKey,
+        body,
+        ...(signal === undefined ? {} : { signal }),
+    };
+}
+export async function executeInspectorAction(request, options) {
+    const generation = await options.getGeneration();
+    if (generation === undefined)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_GENERATION_UNAVAILABLE", 503);
+    try {
+        validateIdentity(request, generation, options.mode);
+    }
+    catch (error) {
+        return await rejectAction(error, request, generation, options.mode);
+    }
+    const key = generation.generationId +
+        ":" +
+        request.action +
+        ":" +
+        request.targetId +
+        ":" +
+        request.idempotencyKey;
+    const fingerprint = requestFingerprint(request, generation);
+    const store = options.idempotency ?? defaultIdempotency;
+    const existing = store.get(key);
+    if (existing !== undefined) {
+        if ((await existing).fingerprint !== fingerprint)
+            return await rejectAction(new InspectorActionError("RELKIT_INSPECTOR_IDEMPOTENCY_CONFLICT", 409), request, generation, options.mode);
+        return await existing;
+    }
+    const pending = perform(request, generation, options.mode, fingerprint).catch((error) => rejectAction(error, request, generation, options.mode));
+    store.set(key, pending);
+    return await pending;
+}
+async function rejectAction(error, request, generation, mode) {
+    const failure = toActionError(error);
+    const record = makeAudit(generation, request, mode, "rejected", failure.code);
+    await writeAudit(generation, record);
+    throw new InspectorActionError(failure.code, failure.status, {
+        ...identity(generation),
+        action: record,
+        error: failure.code,
+    });
+}
+async function perform(request, generation, mode, fingerprint) {
+    if (generation.actions === undefined)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTIONS_UNAVAILABLE", 503);
+    const result = await dispatchInspectorAction(request, generation, generation.actions);
+    const record = makeAudit(generation, request, mode, "applied");
+    await writeAudit(generation, record);
+    return {
+        status: 200,
+        fingerprint,
+        body: { ...identity(generation), action: record, ...result },
+    };
+}
+function readDecision(value) {
+    if (value === "approve" || value === "deny")
+        return value;
+    if (value === undefined)
+        return undefined;
+    throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_REQUEST_INVALID", 400);
+}
+//# sourceMappingURL=actions-runtime.js.map

package/dist/actions-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-runtime.js","sourceRoot":"","sources":["../src/actions-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAiC,MAAM,aAAa,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EACL,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,UAAU,GACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAUhE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0C,CAAC;AAE7E,MAAM,UAAU,oBAAoB,CAClC,MAA2B,EAC3B,MAA0B,EAC1B,IAA6B,EAC7B,OAAiB,EACjB,MAAoB,EACpB,QAA6B;IAE7B,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,EAAE,GAAG,CAAC,wBAAwB,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,GAAG,CAAC,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,OAAO,EAAE,GAAG,CAAC,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5F,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,QAAQ,IAAI,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1E,IAAI,cAAc,KAAK,cAAc,IAAI,cAAc,KAAK,WAAW,EAAE,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,gBAAgB,KAAK,SAAS;YAChC,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,cAAc;QACd,IAAI;QACJ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA+B,EAC/B,OAIC;IAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;IACjD,IAAI,UAAU,KAAK,SAAS;QAC1B,MAAM,IAAI,oBAAoB,CAAC,gDAAgD,EAAE,GAAG,CAAC,CAAC;IACxF,IAAI,CAAC;QACH,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GACP,UAAU,CAAC,YAAY;QACvB,GAAG;QACH,OAAO,CAAC,MAAM;QACd,GAAG;QACH,OAAO,CAAC,QAAQ;QAChB,GAAG;QACH,OAAO,CAAC,cAAc,CAAC;IACzB,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,WAAW,KAAK,WAAW;YAC9C,OAAO,MAAM,YAAY,CACvB,IAAI,oBAAoB,CAAC,uCAAuC,EAAE,GAAG,CAAC,EACtE,OAAO,EACP,UAAU,EACV,OAAO,CAAC,IAAI,CACb,CAAC;QACJ,OAAO,MAAM,QAAQ,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACtF,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CACvD,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,OAAO,MAAM,OAAO,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAc,EACd,OAA+B,EAC/B,UAAoC,EACpC,IAAmB;IAEnB,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE;QAC3D,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,OAAO,CAAC,IAAI;KACpB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,OAA+B,EAC/B,UAAoC,EACpC,IAAmB,EACnB,WAAmB;IAEnB,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;QAClC,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO;QACL,MAAM,EAAE,GAAG;QACX,WAAW;QACX,IAAI,EAAE,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;AACjF,CAAC"}

package/dist/actions-utils.d.ts

@@ -0,0 +1,17 @@
+import { type ResolvedActiveGeneration } from "./shared.js";
+import { InspectorActionError } from "./actions-errors.js";
+import type { InspectorActionRequest, InspectorAuditRecord } from "./actions.js";
+import type { InspectorMode } from "./shared.js";
+export declare function bounded(value: unknown, max?: number): string;
+export declare function reason(value: unknown): string | undefined;
+export declare function assertProtocol(service: {
+    readonly protocol?: string;
+    readonly version?: number;
+} | undefined, protocol: string): void;
+export declare function assertActionState(action: string, value: unknown): void;
+export declare function requestFingerprint(request: InspectorActionRequest, generation: ResolvedActiveGeneration): string;
+export declare function validateIdentity(request: InspectorActionRequest, generation: ResolvedActiveGeneration, mode: InspectorMode): void;
+export declare function makeAudit(generation: ResolvedActiveGeneration, request: InspectorActionRequest, mode: InspectorMode, outcome: "applied" | "rejected", errorCode?: string): InspectorAuditRecord;
+export declare function writeAudit(generation: ResolvedActiveGeneration, record: InspectorAuditRecord): Promise<void>;
+export declare function toActionError(error: unknown): InspectorActionError;
+//# sourceMappingURL=actions-utils.d.ts.map

package/dist/actions-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-utils.d.ts","sourceRoot":"","sources":["../src/actions-utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAsB,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAE3D,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,wBAAgB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,SAAM,GAAG,MAAM,CAKzD;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAC9E,QAAQ,EAAE,MAAM,GACf,IAAI,CAQN;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAUtE;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,EAC/B,UAAU,EAAE,wBAAwB,GACnC,MAAM,CAcR;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,sBAAsB,EAC/B,UAAU,EAAE,wBAAwB,EACpC,IAAI,EAAE,aAAa,GAClB,IAAI,CAWN;AAED,wBAAgB,SAAS,CACvB,UAAU,EAAE,wBAAwB,EACpC,OAAO,EAAE,sBAAsB,EAC/B,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,SAAS,GAAG,UAAU,EAC/B,SAAS,CAAC,EAAE,MAAM,GACjB,oBAAoB,CAsBtB;AAED,wBAAsB,UAAU,CAC9B,UAAU,EAAE,wBAAwB,EACpC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAiBlE"}

package/dist/actions-utils.js

@@ -0,0 +1,103 @@
+import { createHash, randomUUID } from "node:crypto";
+import { API_VERSION, PROTOCOL_VERSION, canonicalJson } from "@relkit/contracts";
+import { isRecord, safeJson } from "./shared.js";
+import { InspectorActionError } from "./actions-errors.js";
+import { ACTION_REDACTION } from "./actions-projection.js";
+export function bounded(value, max = 128) {
+    const text = typeof value === "string" ? value.trim() : undefined;
+    if (!text || text.length > max)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_REQUEST_INVALID", 400);
+    return text;
+}
+export function reason(value) {
+    return value === undefined ? undefined : bounded(value, 256);
+}
+export function assertProtocol(service, protocol) {
+    if (service === undefined)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTIONS_UNAVAILABLE", 503);
+    if ((service.protocol !== undefined && service.protocol !== protocol) ||
+        (service.version !== undefined && service.version !== PROTOCOL_VERSION))
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_PROTOCOL_MISMATCH", 400);
+}
+export function assertActionState(action, value) {
+    if (value === undefined)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_NOT_FOUND", 404);
+    if (!isRecord(value) || typeof value.state !== "string")
+        return;
+    if (action.endsWith(".retry") && value.state !== "dead-lettered")
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_STATE_INELIGIBLE", 409);
+    if (action.endsWith(".cancel") &&
+        ["completed", "dead-lettered", "cancelled"].includes(value.state))
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTION_STATE_INELIGIBLE", 409);
+}
+export function requestFingerprint(request, generation) {
+    const input = request.body.input === undefined ? null : safeJson(request.body.input);
+    const value = canonicalJson({
+        action: request.action,
+        targetId: request.targetId,
+        generationId: generation.generationId,
+        graphHash: generation.graphHash,
+        idempotencyKey: request.idempotencyKey,
+        input,
+        invocationId: request.body.invocationId ?? null,
+        toolCallId: request.body.toolCallId ?? null,
+        reason: request.body.reason ?? null,
+    });
+    return createHash("sha256").update(value).digest("hex");
+}
+export function validateIdentity(request, generation, mode) {
+    if (mode === "production")
+        throw new InspectorActionError("RELKIT_INSPECTOR_ACTIONS_DISABLED", 403);
+    const requestedMode = request.body.environment ?? request.body.mode;
+    if (requestedMode !== undefined && requestedMode !== mode)
+        throw new InspectorActionError("RELKIT_INSPECTOR_ENVIRONMENT_MISMATCH", 400);
+    if (request.generationId !== generation.generationId ||
+        request.graphHash !== generation.graphHash)
+        throw new InspectorActionError("RELKIT_INSPECTOR_GENERATION_NOT_ACTIVE", 409);
+}
+export function makeAudit(generation, request, mode, outcome, errorCode) {
+    const actionReason = reason(request.body.reason);
+    const redactedReason = safeJson({ reason: actionReason }, ACTION_REDACTION);
+    const safeReason = isRecord(redactedReason) && typeof redactedReason.reason === "string"
+        ? redactedReason.reason
+        : undefined;
+    return {
+        protocol: "relkit.inspector.actions",
+        version: API_VERSION,
+        actionId: randomUUID(),
+        action: request.action,
+        targetId: request.targetId,
+        generationId: generation.generationId,
+        graphHash: generation.graphHash,
+        environment: mode,
+        idempotencyKey: request.idempotencyKey,
+        outcome,
+        requestedAt: new Date().toISOString(),
+        ...(errorCode === undefined ? {} : { errorCode }),
+        ...(safeReason === undefined ? {} : { reason: safeReason }),
+    };
+}
+export async function writeAudit(generation, record) {
+    try {
+        await generation.actions?.audit?.(record);
+    }
+    catch {
+        // Audit sinks cannot turn a safe action response into an unsafe provider error.
+    }
+}
+export function toActionError(error) {
+    if (error instanceof InspectorActionError)
+        return error;
+    const code = isRecord(error) && typeof error.code === "string"
+        ? error.code
+        : "RELKIT_INSPECTOR_ACTION_FAILED";
+    const status = code.includes("NOT_FOUND")
+        ? 404
+        : code.includes("MUTATION_DISABLED")
+            ? 403
+            : code.includes("PROTOCOL") || code.includes("REQUEST")
+                ? 400
+                : 409;
+    return new InspectorActionError(code.startsWith("RELKIT_") ? code : "RELKIT_INSPECTOR_ACTION_FAILED", status);
+}
+//# sourceMappingURL=actions-utils.js.map

package/dist/actions-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-utils.js","sourceRoot":"","sources":["../src/actions-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAiC,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAI3D,MAAM,UAAU,OAAO,CAAC,KAAc,EAAE,GAAG,GAAG,GAAG;IAC/C,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAC5B,MAAM,IAAI,oBAAoB,CAAC,yCAAyC,EAAE,GAAG,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,OAA8E,EAC9E,QAAgB;IAEhB,IAAI,OAAO,KAAK,SAAS;QACvB,MAAM,IAAI,oBAAoB,CAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC9E,IACE,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACjE,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,gBAAgB,CAAC;QAEvE,MAAM,IAAI,oBAAoB,CAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,KAAc;IAC9D,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,oBAAoB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAAE,OAAO;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;QAC9D,MAAM,IAAI,oBAAoB,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;IAClF,IACE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1B,CAAC,WAAW,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;QAEjE,MAAM,IAAI,oBAAoB,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,OAA+B,EAC/B,UAAoC;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,aAAa,CAAC;QAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK;QACL,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI;QAC/C,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI;QAC3C,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;KACpC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAA+B,EAC/B,UAAoC,EACpC,IAAmB;IAEnB,IAAI,IAAI,KAAK,YAAY;QACvB,MAAM,IAAI,oBAAoB,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,IAAI;QACvD,MAAM,IAAI,oBAAoB,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAC;IAC/E,IACE,OAAO,CAAC,YAAY,KAAK,UAAU,CAAC,YAAY;QAChD,OAAO,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS;QAE1C,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,UAAoC,EACpC,OAA+B,EAC/B,IAAmB,EACnB,OAA+B,EAC/B,SAAkB;IAElB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,UAAU,GACd,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,cAAc,CAAC,MAAM,KAAK,QAAQ;QACnE,CAAC,CAAC,cAAc,CAAC,MAAM;QACvB,CAAC,CAAC,SAAS,CAAC;IAChB,OAAO;QACL,QAAQ,EAAE,0BAA0B;QACpC,OAAO,EAAE,WAAW;QACpB,QAAQ,EAAE,UAAU,EAAE;QACtB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,OAAO;QACP,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QACjD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAoC,EACpC,MAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,IAAI,GACR,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC/C,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,gCAAgC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvC,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAClC,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;gBACrD,CAAC,CAAC,GAAG;gBACL,CAAC,CAAC,GAAG,CAAC;IACZ,OAAO,IAAI,oBAAoB,CAC7B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC,EACpE,MAAM,CACP,CAAC;AACJ,CAAC"}

package/dist/actions.d.ts

@@ -0,0 +1,107 @@
+import { API_VERSION, PROTOCOL_VERSION, type MaybePromise } from "@relkit/contracts";
+import type { InspectorMode, ResolvedActiveGeneration } from "./shared.js";
+import type { Hono } from "hono";
+export type InspectorActionName = "function.invoke" | "job.retry" | "job.cancel" | "event.retry" | "event.cancel" | "tool.approve" | "tool.deny";
+export interface InspectorFunctionActionRequest {
+    readonly generationId: string;
+    readonly graphHash: string;
+    readonly functionId: string;
+    readonly input: unknown;
+    readonly idempotencyKey: string;
+    readonly signal?: AbortSignal;
+}
+export interface InspectorFunctionActionService {
+    readonly invoke: (request: InspectorFunctionActionRequest) => MaybePromise<unknown>;
+    readonly exists?: (functionId: string) => MaybePromise<boolean>;
+}
+export interface InspectorJobActionRequest {
+    readonly protocol: "relkit.jobs.admin";
+    readonly version: typeof PROTOCOL_VERSION;
+    readonly instanceId: string;
+    readonly reason?: string;
+}
+export interface InspectorJobActionService {
+    readonly protocol?: string;
+    readonly version?: number;
+    readonly status?: (instanceId: string) => MaybePromise<unknown>;
+    readonly retry?: (request: InspectorJobActionRequest) => MaybePromise<unknown>;
+    readonly cancel?: (request: InspectorJobActionRequest) => MaybePromise<unknown>;
+}
+export interface InspectorEventActionRequest {
+    readonly protocol: "relkit.events.admin";
+    readonly version: typeof PROTOCOL_VERSION;
+    readonly deliveryId: string;
+    readonly reason?: string;
+}
+export interface InspectorEventActionService {
+    readonly protocol?: string;
+    readonly version?: number;
+    readonly status?: (deliveryId: string) => MaybePromise<unknown>;
+    readonly retry?: (request: InspectorEventActionRequest) => MaybePromise<unknown>;
+    readonly cancel?: (request: InspectorEventActionRequest) => MaybePromise<unknown>;
+}
+export type InspectorToolApprovalState = "pending" | "approved" | "denied";
+export interface InspectorToolApprovalRecord {
+    readonly invocationId: string;
+    readonly toolCallId: string;
+    readonly toolId: string;
+    readonly state: InspectorToolApprovalState;
+    readonly sideEffect?: string;
+    readonly policy?: string;
+    readonly required?: boolean;
+}
+export interface InspectorToolApprovalRequest {
+    readonly invocationId: string;
+    readonly toolCallId: string;
+    readonly toolId: string;
+    readonly idempotencyKey: string;
+}
+export interface InspectorToolApprovalService {
+    readonly get: (request: Omit<InspectorToolApprovalRequest, "idempotencyKey">) => MaybePromise<InspectorToolApprovalRecord | undefined>;
+    readonly approve?: (request: InspectorToolApprovalRequest) => MaybePromise<unknown>;
+    readonly deny?: (request: InspectorToolApprovalRequest) => MaybePromise<unknown>;
+}
+export interface InspectorAuditRecord {
+    readonly protocol: "relkit.inspector.actions";
+    readonly version: typeof API_VERSION;
+    readonly actionId: string;
+    readonly action: InspectorActionName;
+    readonly targetId: string;
+    readonly generationId: string;
+    readonly graphHash: string;
+    readonly environment: InspectorMode;
+    readonly idempotencyKey: string;
+    readonly outcome: "applied" | "rejected";
+    readonly requestedAt: string;
+    readonly errorCode?: string;
+    readonly reason?: string;
+}
+export interface InspectorActionServices {
+    readonly functions?: InspectorFunctionActionService;
+    readonly invokeFunction?: InspectorFunctionActionService["invoke"];
+    readonly jobs?: InspectorJobActionService;
+    readonly events?: InspectorEventActionService;
+    readonly approvals?: InspectorToolApprovalService;
+    readonly tools?: {
+        readonly approvals?: InspectorToolApprovalService;
+    };
+    readonly audit?: (record: InspectorAuditRecord) => MaybePromise<void>;
+}
+export interface InspectorActionEndpointOptions {
+    readonly mode: InspectorMode;
+    readonly enabled: boolean;
+    readonly authorize: (request: Request) => MaybePromise<boolean>;
+    readonly getGeneration: () => Promise<ResolvedActiveGeneration | undefined>;
+}
+export interface InspectorActionRequest {
+    readonly action: InspectorActionName;
+    readonly targetId: string;
+    readonly generationId: string;
+    readonly graphHash: string;
+    readonly idempotencyKey: string;
+    readonly body: Record<string, unknown>;
+    readonly signal?: AbortSignal;
+}
+export declare const INSPECTOR_ACTION_PATHS: readonly ["/_relkit/v1/actions/functions/:id/invoke", "/_relkit/v1/actions/jobs/:id/retry", "/_relkit/v1/actions/jobs/:id/cancel", "/_relkit/v1/actions/events/:id/retry", "/_relkit/v1/actions/events/:id/cancel", "/_relkit/v1/actions/tools/:id/approval", "/_relkit/v1/actions/tools/:id/approve", "/_relkit/v1/actions/tools/:id/deny"];
+export declare function installInspectorActionEndpoints(app: Hono, options: InspectorActionEndpointOptions): void;
+//# sourceMappingURL=actions.d.ts.map