@rivus/agent 0.13.2 → 0.14.1

package/dist/chunks/pi-skill-tool.js

@@ -0,0 +1,460 @@
+import { b as restrictMemoryScopesForAudience } from "./api.js";
+import { n as createRandomId, t as createSha256Digest } from "./sha256-digest.js";
+import { Effect } from "effect";
+import { Unsafe } from "typebox";
+//#region src/modules/tool-execution/domain/authority/invocation-authority.ts
+var InvalidInvocationAuthority = class extends Error {
+	name = "InvalidInvocationAuthority";
+};
+function normalizeInvocationAuthority(authority) {
+	if (!authority.sourceMessageId.trim()) throw new InvalidInvocationAuthority("invocation authority requires a trusted source message id");
+	if (authority.endpointId !== void 0 && !authority.endpointId.trim()) throw new InvalidInvocationAuthority("invocation authority requires a trusted endpoint id");
+	const memory = authority.memory ? Object.freeze({
+		...authority.memory,
+		scopes: Object.freeze(restrictMemoryScopesForAudience(authority.memory.scopes, authority.memory.audience))
+	}) : void 0;
+	return Object.freeze({
+		...authority,
+		...authority.allowedActorOpenIds ? { allowedActorOpenIds: Object.freeze([...authority.allowedActorOpenIds]) } : {},
+		toolGrantSet: Object.freeze({
+			revision: authority.toolGrantSet.revision,
+			toolIds: Object.freeze([...authority.toolGrantSet.toolIds])
+		}),
+		...memory ? { memory } : {}
+	});
+}
+//#endregion
+//#region src/modules/tool-execution/domain/authority/tool-risk.ts
+function requiresToolApproval(risk) {
+	return risk === "irreversible" || risk === "host-control";
+}
+//#endregion
+//#region src/modules/tool-execution/application/authority/invocation-authority-registry.ts
+const authorities = /* @__PURE__ */ new WeakMap();
+function createInvocationAuthority(authority) {
+	const reference = Object.freeze({ id: `authority:${createRandomId()}` });
+	authorities.set(reference, normalizeInvocationAuthority(authority));
+	return reference;
+}
+function resolveInvocationAuthority(reference) {
+	const authority = authorities.get(reference);
+	if (!authority) throw new InvalidInvocationAuthority("invocation authority was not issued by this host");
+	return authority;
+}
+//#endregion
+//#region src/modules/tool-execution/domain/input/stable-tool-input.ts
+var InvalidStableJson = class extends Error {
+	name = "InvalidStableJson";
+};
+var InvalidToolInput = class extends InvalidStableJson {
+	name = "InvalidToolInput";
+};
+function createStableToolInputDigest(input, digest) {
+	let canonical;
+	try {
+		canonical = normalizeStableJson(input);
+	} catch (error) {
+		if (error instanceof InvalidStableJson) throw new InvalidToolInput(error.message);
+		throw error;
+	}
+	return digest(JSON.stringify(canonical));
+}
+function normalizeStableJson(value) {
+	return canonicalize(value, /* @__PURE__ */ new Set());
+}
+function canonicalize(value, ancestors) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new InvalidStableJson("stable JSON numbers must be finite");
+		return Object.is(value, -0) ? 0 : value;
+	}
+	if (typeof value !== "object") throw new InvalidStableJson("value must contain only stable JSON values");
+	if (ancestors.has(value)) throw new InvalidStableJson("stable JSON must not contain cycles");
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) return Array.from({ length: value.length }, (_, index) => {
+			if (!Object.hasOwn(value, index)) throw new InvalidStableJson("stable JSON arrays must not contain holes");
+			return canonicalize(value[index], ancestors);
+		});
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null) throw new InvalidStableJson("stable JSON objects must be plain objects");
+		return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, entry]) => [key, canonicalize(entry, ancestors)]));
+	} finally {
+		ancestors.delete(value);
+	}
+}
+//#endregion
+//#region src/modules/tool-execution/domain/operation/tool-operation.ts
+var ToolOperationTransitionDenied = class extends Error {
+	name = "ToolOperationTransitionDenied";
+};
+function beginToolOperation(current, operationId, binding) {
+	if (!current) return {
+		record: {
+			binding,
+			operationId,
+			revision: 1,
+			state: { status: "pending" }
+		},
+		status: "acquired"
+	};
+	if (!isSameToolOperationBinding(current.binding, binding)) return {
+		reason: "operation id is bound to another invocation",
+		status: "blocked"
+	};
+	switch (current.state.status) {
+		case "completed": return {
+			result: structuredClone(current.state.result),
+			status: "completed"
+		};
+		case "aborted": return {
+			record: {
+				binding: current.binding,
+				operationId: current.operationId,
+				revision: current.revision + 1,
+				state: { status: "pending" }
+			},
+			status: "acquired"
+		};
+		case "pending": return {
+			reason: "operation is already in progress",
+			status: "blocked"
+		};
+		case "reconciliation-required": return {
+			reason: current.state.reason,
+			status: "blocked"
+		};
+	}
+}
+function inspectToolOperation(current, binding) {
+	if (!current || current.state.status === "aborted" && isSameToolOperationBinding(current.binding, binding)) return { status: "missing" };
+	if (!isSameToolOperationBinding(current.binding, binding)) return {
+		reason: "operation id is bound to another invocation",
+		status: "blocked"
+	};
+	return current.state.status === "completed" ? {
+		result: structuredClone(current.state.result),
+		status: "completed"
+	} : {
+		reason: current.state.status === "reconciliation-required" ? current.state.reason : "operation is already in progress",
+		status: "blocked"
+	};
+}
+function completeToolOperation(current, operationId, binding, result) {
+	return transitionPending(current, operationId, binding, {
+		result: normalizeStableJson(result),
+		status: "completed"
+	});
+}
+function abortToolOperation(current, operationId, binding) {
+	return transitionPending(current, operationId, binding, { status: "aborted" });
+}
+function requireToolOperationReconciliation(current, operationId, binding, reason) {
+	return transitionPending(current, operationId, binding, {
+		reason,
+		status: "reconciliation-required"
+	});
+}
+function reconcileToolOperation(current, input) {
+	if (!current || current.state.status !== "reconciliation-required" || current.revision !== input.expectedRevision) throw new ToolOperationTransitionDenied(`tool operation is not the expected reconciliation revision: ${input.operationId}`);
+	const action = normalizeReconciliationAction(input.action);
+	const result = input.outcome.status === "applied" ? normalizeStableJson(input.outcome.result) : void 0;
+	return {
+		...current,
+		reconciliation: {
+			...action,
+			outcome: input.outcome.status
+		},
+		revision: current.revision + 1,
+		state: input.outcome.status === "applied" ? {
+			result,
+			status: "completed"
+		} : { status: "aborted" }
+	};
+}
+function recoverInterruptedToolOperation(record) {
+	if (record.state.status !== "pending") return record;
+	return {
+		...record,
+		revision: record.revision + 1,
+		state: {
+			reason: "process exited before the tool outcome was durably recorded",
+			status: "reconciliation-required"
+		}
+	};
+}
+function isSameToolOperationBinding(left, right) {
+	return left.agentId === right.agentId && left.inputDigest === right.inputDigest && left.instanceId === right.instanceId && left.sourceMessageId === right.sourceMessageId && left.toolId === right.toolId && left.toolVersion === right.toolVersion;
+}
+function isValidToolOperationTransition(previous, next) {
+	if (!isSameToolOperationBinding(previous.binding, next.binding)) return false;
+	switch (previous.state.status) {
+		case "pending": return [
+			"completed",
+			"reconciliation-required",
+			"aborted"
+		].includes(next.state.status) && isSameReconciliation(previous.reconciliation, next.reconciliation);
+		case "aborted": return next.state.status === "pending" && next.reconciliation === void 0;
+		case "completed": return false;
+		case "reconciliation-required": return (next.state.status === "completed" || next.state.status === "aborted") && next.reconciliation !== void 0 && isValidReconciliation(next.reconciliation) && next.reconciliation.outcome === (next.state.status === "completed" ? "applied" : "not-applied") && !isSameReconciliation(previous.reconciliation, next.reconciliation);
+	}
+}
+function transitionPending(current, operationId, binding, state) {
+	if (!current || current.state.status !== "pending" || !isSameToolOperationBinding(current.binding, binding)) throw new ToolOperationTransitionDenied(`tool operation is not held by this invocation: ${operationId}`);
+	return {
+		...current,
+		revision: current.revision + 1,
+		state
+	};
+}
+function normalizeReconciliationAction(action) {
+	const actorId = action.actorId.trim();
+	const note = action.note.trim();
+	if (!actorId) throw new ToolOperationTransitionDenied("recovery actor must not be empty");
+	if (!note) throw new ToolOperationTransitionDenied("recovery note must not be empty");
+	if (!Number.isFinite(Date.parse(action.at))) throw new ToolOperationTransitionDenied("recovery timestamp must be an ISO timestamp");
+	return Object.freeze({
+		actorId,
+		at: action.at,
+		note
+	});
+}
+function isValidReconciliation(value) {
+	return value.actorId.trim().length > 0 && Number.isFinite(Date.parse(value.at)) && value.note.trim().length > 0 && (value.outcome === "applied" || value.outcome === "not-applied");
+}
+function isSameReconciliation(left, right) {
+	if (left === void 0 || right === void 0) return left === right;
+	return left.actorId === right.actorId && left.at === right.at && left.note === right.note && left.outcome === right.outcome;
+}
+//#endregion
+//#region src/modules/tool-execution/application/operation/tool-operation-ledger.ts
+function createToolOperationLedger(options = {}) {
+	const records = new Map(options.initial?.map((record) => [record.operationId, structuredClone(record)]) ?? []);
+	const exclusive = Effect.unsafeMakeSemaphore(1).withPermits(1);
+	const save = (record) => {
+		const snapshot = structuredClone(record);
+		return (options.persist ? options.persist(snapshot) : Effect.void).pipe(Effect.tap(() => Effect.sync(() => {
+			records.set(snapshot.operationId, structuredClone(snapshot));
+		})));
+	};
+	const transition = (operationId, next) => exclusive(Effect.gen(function* () {
+		const record = yield* Effect.try({
+			catch: (error) => error,
+			try: () => next(records.get(operationId))
+		});
+		yield* save(record);
+	}));
+	return {
+		abort: (operationId, binding) => transition(operationId, (current) => abortToolOperation(current, operationId, binding)),
+		begin: (operationId, binding) => exclusive(Effect.gen(function* () {
+			const decision = beginToolOperation(records.get(operationId), operationId, binding);
+			if (decision.status !== "acquired") return decision;
+			yield* save(decision.record);
+			return { status: "acquired" };
+		})),
+		complete: (operationId, binding, result) => transition(operationId, (current) => completeToolOperation(current, operationId, binding, result)),
+		inspect: (operationId, binding) => exclusive(Effect.sync(() => inspectToolOperation(records.get(operationId), binding))),
+		reconciliationRequired: () => [...records.values()].filter((record) => record.state.status === "reconciliation-required").map((record) => structuredClone(record)),
+		reconcile: (input) => exclusive(Effect.gen(function* () {
+			const record = yield* Effect.try({
+				catch: (error) => error,
+				try: () => reconcileToolOperation(records.get(input.operationId), input)
+			});
+			yield* save(record);
+			return structuredClone(record);
+		})),
+		requireReconciliation: (operationId, binding, reason) => transition(operationId, (current) => requireToolOperationReconciliation(current, operationId, binding, reason)),
+		unresolvedForSource: (sourceMessageId) => [...records.values()].filter((record) => record.binding.sourceMessageId === sourceMessageId && (record.state.status === "pending" || record.state.status === "reconciliation-required")).map((record) => structuredClone(record))
+	};
+}
+//#endregion
+//#region src/modules/tool-execution/application/brokerage/tool-input-digest.ts
+function createToolInputDigest(input) {
+	return createStableToolInputDigest(input, createSha256Digest);
+}
+//#endregion
+//#region src/modules/tool-execution/application/brokerage/tool-broker-ports.ts
+var ToolExecutorInputRejected = class extends Error {
+	name = "ToolExecutorInputRejected";
+};
+//#endregion
+//#region src/modules/tool-execution/application/brokerage/tool-broker.ts
+var ToolInvocationDenied = class extends Error {
+	name = "ToolInvocationDenied";
+};
+function createToolBroker(options) {
+	const operations = options.operations ?? createToolOperationLedger();
+	const hostTools = new Map(options.hostTools?.map((tool) => [tool.id, tool]) ?? []);
+	if (hostTools.size !== (options.hostTools?.length ?? 0)) throw new ToolInvocationDenied("duplicate Host Tool id");
+	return { execute: (request) => Effect.gen(function* () {
+		const prepared = yield* Effect.try({
+			catch: (error) => error,
+			try: () => prepareInvocation(options.catalog, hostTools, request)
+		});
+		const policy = yield* options.policy.current();
+		if (policy.revokedToolIds.includes(request.toolId)) return yield* Effect.fail(new ToolInvocationDenied(`tool has been revoked: ${request.toolId}`));
+		if (prepared.tool.idempotency === "required" && !request.operationId) return yield* Effect.fail(new ToolInvocationDenied(`tool requires a stable operation id: ${request.toolId}`));
+		if (requiresToolApproval(prepared.tool.risk) && !request.operationId) return yield* Effect.fail(new ToolInvocationDenied(`tool approval requires a stable operation id: ${request.toolId}`));
+		if (requiresToolApproval(prepared.tool.risk) && !request.approvalId) return yield* Effect.fail(new ToolInvocationDenied(`tool requires trusted approval: ${request.toolId}`));
+		const binding = yield* Effect.try({
+			catch: (error) => error,
+			try: () => createOperationBinding(prepared.authority, prepared.tool, request)
+		});
+		const context = createExecutionContext(prepared.authority, request, policy.epoch, prepared.tool);
+		const replayCompleted = (result) => replay(prepared.tool, request.input, result, context);
+		if (request.operationId) {
+			const inspected = yield* operations.inspect(request.operationId, binding);
+			if (inspected.status === "completed") return yield* replayCompleted(inspected.result);
+			if (inspected.status === "blocked") return yield* Effect.fail(new ToolInvocationDenied(`tool operation is fenced: ${inspected.reason}`));
+		}
+		if (requiresToolApproval(prepared.tool.risk)) {
+			if (!(yield* options.approvals.consume({
+				agentId: prepared.authority.agentId,
+				approvalId: request.approvalId,
+				callId: request.callId,
+				inputDigest: binding.inputDigest,
+				instanceId: prepared.authority.instanceId,
+				operationId: request.operationId,
+				risk: prepared.tool.risk,
+				runId: prepared.authority.runId,
+				sessionKey: prepared.authority.sessionKey,
+				tenantKey: prepared.authority.tenantKey,
+				toolId: request.toolId,
+				toolVersion: prepared.tool.version
+			}))) return yield* Effect.fail(new ToolInvocationDenied(`tool approval is invalid or already consumed: ${request.toolId}`));
+		}
+		if (request.operationId) {
+			const reservation = yield* operations.begin(request.operationId, binding);
+			if (reservation.status === "completed") return yield* replayCompleted(reservation.result);
+			if (reservation.status === "blocked") return yield* Effect.fail(new ToolInvocationDenied(`tool operation is fenced: ${reservation.reason}`));
+		}
+		return yield* Effect.gen(function* () {
+			const result = yield* (yield* Effect.try({
+				catch: (error) => error,
+				try: () => prepared.tool.createExecutor({
+					toolId: prepared.tool.id,
+					toolVersion: prepared.tool.version
+				})
+			})).execute(request.input, context);
+			if (request.operationId) yield* operations.complete(request.operationId, binding, result);
+			return result;
+		}).pipe(Effect.catchAll((error) => {
+			if (!request.operationId) return Effect.fail(error);
+			return (prepared.tool.risk === "observe" || error instanceof ToolExecutorInputRejected ? operations.abort(request.operationId, binding) : operations.requireReconciliation(request.operationId, binding, error instanceof Error ? error.message : String(error))).pipe(Effect.zipRight(Effect.fail(error)));
+		}));
+	}) };
+}
+function prepareInvocation(catalog, hostTools, request) {
+	const authority = resolveInvocationAuthority(request.authority);
+	if (!authority.toolGrantSet.toolIds.includes(request.toolId)) throw new ToolInvocationDenied(`tool is not granted for this run: ${request.toolId}`);
+	const tool = hostTools.get(request.toolId) ?? catalog.snapshot().tools.find(({ id }) => id === request.toolId);
+	if (!tool) throw new ToolInvocationDenied(`tool is not present in the trusted catalog: ${request.toolId}`);
+	if (tool.version !== request.version) throw new ToolInvocationDenied(`tool version mismatch for ${request.toolId}: expected ${tool.version}`);
+	return {
+		authority,
+		tool
+	};
+}
+function createOperationBinding(authority, tool, request) {
+	let inputDigest;
+	try {
+		inputDigest = createToolInputDigest(request.input);
+	} catch (error) {
+		if (error instanceof InvalidToolInput) throw new ToolInvocationDenied(`tool input is not stable JSON: ${request.toolId}`);
+		throw error;
+	}
+	return {
+		agentId: authority.agentId,
+		inputDigest,
+		instanceId: authority.instanceId,
+		sourceMessageId: authority.sourceMessageId,
+		toolId: tool.id,
+		toolVersion: tool.version
+	};
+}
+function createExecutionContext(authority, request, policyEpoch, tool) {
+	return Object.freeze({
+		agentId: authority.agentId,
+		callId: request.callId,
+		instanceId: authority.instanceId,
+		...authority.memory ? { memory: authority.memory } : {},
+		...request.operationId ? { operationId: request.operationId } : {},
+		policyEpoch,
+		runId: authority.runId,
+		sessionKey: authority.sessionKey,
+		toolId: tool.id,
+		toolVersion: tool.version,
+		...authority.endpointId ? { origin: Object.freeze({
+			...authority.allowedActorOpenIds ? { allowedActorOpenIds: authority.allowedActorOpenIds } : { allowedActorOpenIds: Object.freeze([]) },
+			endpointId: authority.endpointId,
+			tenantKey: authority.tenantKey,
+			...authority.conversationId ? { conversationId: authority.conversationId } : {}
+		}) } : {},
+		...authority.sourceMessageId ? { sourceMessageId: authority.sourceMessageId } : {}
+	});
+}
+function replay(tool, input, result, context) {
+	if (!tool.replayCompleted) return Effect.succeed(result);
+	return Effect.try({
+		catch: (error) => error,
+		try: () => tool.replayCompleted(input, result, context)
+	}).pipe(Effect.flatMap((effect) => effect));
+}
+//#endregion
+//#region src/adapters/pi/skills/pi-skill-tool.ts
+const PI_SKILL_READER_TOOL_NAME = "rivus_read_skill";
+function createPiSkillRuntime(skills) {
+	if (skills.length === 0) return Object.freeze({ prompt: "" });
+	const skillsById = new Map(skills.map((skill) => [skill.id, skill]));
+	const prompt = [
+		"Granted Skills are versioned instructions loaded on demand.",
+		`Before following a Skill, call ${PI_SKILL_READER_TOOL_NAME} with its exact ID and follow the returned content.`,
+		"Granted Skill catalog:",
+		...skills.map((skill) => `- ${skill.id} | ${skill.title} | v${skill.version} | ${skill.digest}`)
+	].join("\n");
+	const tool = {
+		description: "Read the full versioned instructions for one Skill granted to this Agent Runtime.",
+		execute: async (_callId, input) => {
+			const skillId = readSkillId(input);
+			const skill = skillsById.get(skillId);
+			if (!skill) throw new Error(`Skill is not granted: ${skillId}`);
+			const details = {
+				contentLength: skill.content.length,
+				digest: skill.digest,
+				skillId: skill.id,
+				title: skill.title,
+				version: skill.version
+			};
+			return {
+				content: [{
+					text: skill.content,
+					type: "text"
+				}],
+				details
+			};
+		},
+		executionMode: "sequential",
+		label: "Read granted Skill",
+		name: PI_SKILL_READER_TOOL_NAME,
+		parameters: Unsafe({
+			additionalProperties: false,
+			properties: { skillId: {
+				description: "Exact Skill ID from the granted Skill catalog.",
+				type: "string"
+			} },
+			required: ["skillId"],
+			type: "object"
+		}),
+		promptSnippet: `${PI_SKILL_READER_TOOL_NAME}: read one granted Skill by exact ID`
+	};
+	return Object.freeze({
+		prompt,
+		tool
+	});
+}
+function readSkillId(input) {
+	if (input === null || typeof input !== "object" || Array.isArray(input) || typeof input.skillId !== "string") throw new Error("Skill reader input requires a string skillId");
+	return input.skillId;
+}
+//#endregion
+export { ToolExecutorInputRejected as a, isValidToolOperationTransition as c, InvalidToolInput as d, normalizeStableJson as f, InvalidInvocationAuthority as g, requiresToolApproval as h, createToolBroker as i, recoverInterruptedToolOperation as l, resolveInvocationAuthority as m, createPiSkillRuntime as n, createToolInputDigest as o, createInvocationAuthority as p, ToolInvocationDenied as r, createToolOperationLedger as s, PI_SKILL_READER_TOOL_NAME as t, InvalidStableJson as u };

package/dist/chunks/pi-tool-proxy.d.ts

@@ -0,0 +1,188 @@
+import { o as AgentMemoryAuthority } from "./api.js";
+import { ot as RivusToolRisk, rt as RivusToolGrantSet } from "./api2.js";
+import { Effect } from "effect";
+import { TSchema } from "typebox";
+
+//#region src/modules/tool-execution/domain/authority/invocation-authority.d.ts
+interface InvocationAuthorityRef {
+  readonly id: string;
+}
+interface InvocationAuthority {
+  readonly agentId: string;
+  readonly allowedActorOpenIds?: ReadonlyArray<string>;
+  readonly conversationId?: string;
+  readonly endpointId?: string;
+  readonly instanceId: string;
+  readonly memory?: AgentMemoryAuthority;
+  readonly runId: string;
+  readonly sessionKey: string;
+  readonly sourceMessageId: string;
+  readonly tenantKey: string;
+  readonly toolGrantSet: RivusToolGrantSet;
+}
+declare class InvalidInvocationAuthority extends Error {
+  readonly name = "InvalidInvocationAuthority";
+}
+//#endregion
+//#region src/modules/tool-execution/domain/authority/tool-risk.d.ts
+declare function requiresToolApproval(risk: RivusToolRisk): boolean;
+//#endregion
+//#region src/modules/tool-execution/domain/operation/tool-operation.d.ts
+interface ToolOperationBinding {
+  readonly agentId: string;
+  readonly inputDigest: string;
+  readonly instanceId: string;
+  readonly sourceMessageId: string;
+  readonly toolId: string;
+  readonly toolVersion: string;
+}
+type ToolOperationState = {
+  readonly status: "pending";
+} | {
+  readonly result: unknown;
+  readonly status: "completed";
+} | {
+  readonly reason: string;
+  readonly status: "reconciliation-required";
+} | {
+  readonly status: "aborted";
+};
+interface ToolOperationReconciliationAction {
+  readonly actorId: string;
+  readonly at: string;
+  readonly note: string;
+}
+interface ToolOperationReconciliation extends ToolOperationReconciliationAction {
+  readonly outcome: "applied" | "not-applied";
+}
+interface ToolOperationRecord {
+  readonly binding: ToolOperationBinding;
+  readonly operationId: string;
+  readonly reconciliation?: ToolOperationReconciliation;
+  readonly revision: number;
+  readonly state: ToolOperationState;
+}
+type ToolOperationReconciliationOutcome = {
+  readonly result: unknown;
+  readonly status: "applied";
+} | {
+  readonly status: "not-applied";
+};
+type ToolOperationBeginResult = {
+  readonly status: "acquired";
+} | {
+  readonly result: unknown;
+  readonly status: "completed";
+} | {
+  readonly status: "blocked";
+  readonly reason: string;
+};
+type ToolOperationInspectResult = {
+  readonly status: "missing";
+} | {
+  readonly result: unknown;
+  readonly status: "completed";
+} | {
+  readonly status: "blocked";
+  readonly reason: string;
+};
+//#endregion
+//#region src/modules/tool-execution/application/authority/invocation-authority-registry.d.ts
+declare function createInvocationAuthority(authority: InvocationAuthority): InvocationAuthorityRef;
+//#endregion
+//#region src/modules/tool-execution/application/brokerage/tool-broker-ports.d.ts
+interface AuthorizationPolicyState {
+  readonly epoch: number;
+  readonly revokedToolIds: ReadonlyArray<string>;
+}
+interface ToolApprovalRequest {
+  readonly approvalId: string;
+  readonly agentId: string;
+  readonly instanceId: string;
+  readonly inputDigest: string;
+  readonly operationId: string;
+  readonly runId: string;
+  readonly sessionKey: string;
+  readonly tenantKey: string;
+  readonly callId: string;
+  readonly toolId: string;
+  readonly toolVersion: string;
+  readonly risk: RivusToolRisk;
+}
+//#endregion
+//#region src/modules/tool-execution/application/brokerage/tool-broker.d.ts
+interface ToolExecutionRequest {
+  readonly approvalId?: string;
+  readonly authority: InvocationAuthorityRef;
+  readonly callId: string;
+  readonly input: unknown;
+  readonly operationId?: string;
+  readonly toolId: string;
+  readonly version: string;
+}
+declare class ToolInvocationDenied extends Error {
+  readonly name = "ToolInvocationDenied";
+}
+//#endregion
+//#region src/modules/tool-execution/domain/input/stable-tool-input.d.ts
+declare class InvalidStableJson extends Error {
+  readonly name: string;
+}
+declare class InvalidToolInput extends InvalidStableJson {
+  readonly name = "InvalidToolInput";
+}
+declare function normalizeStableJson(value: unknown): unknown;
+//#endregion
+//#region src/modules/tool-execution/application/brokerage/tool-input-digest.d.ts
+declare function createToolInputDigest(input: unknown): string;
+//#endregion
+//#region src/adapters/pi/tool-execution/pi-tool-definition.d.ts
+type PiToolContent = {
+  readonly text: string;
+  readonly textSignature?: string;
+  readonly type: "text";
+} | {
+  readonly data: string;
+  readonly mimeType: string;
+  readonly type: "image";
+};
+interface PiToolResult<TDetails = unknown> {
+  readonly content: PiToolContent[];
+  readonly details: TDetails;
+  readonly terminate?: boolean;
+}
+interface PiToolDefinition<TDetails = unknown> {
+  readonly description: string;
+  readonly execute: (toolCallId: string, params: unknown, signal?: AbortSignal, onUpdate?: (result: PiToolResult<TDetails>) => void, context?: unknown) => Promise<PiToolResult<TDetails>>;
+  readonly executionMode?: "parallel" | "sequential";
+  readonly label: string;
+  readonly name: string;
+  readonly parameters: TSchema;
+  readonly promptGuidelines?: string[];
+  readonly promptSnippet?: string;
+}
+//#endregion
+//#region src/adapters/pi/tool-execution/pi-tool-proxy.d.ts
+interface PiToolApprovalRequest {
+  readonly agentId: string;
+  readonly allowedActorOpenIds: ReadonlyArray<string>;
+  readonly approvalId: string;
+  readonly callId: string;
+  readonly endpointId: string;
+  readonly inputDigest: string;
+  readonly instanceId: string;
+  readonly operationId: string;
+  readonly risk: RivusToolRisk;
+  readonly runId: string;
+  readonly sessionKey: string;
+  readonly signal?: AbortSignal;
+  readonly sourceMessageId: string;
+  readonly tenantKey: string;
+  readonly toolId: string;
+  readonly toolVersion: string;
+}
+interface PiToolApprovalGateway {
+  requestApproval(request: PiToolApprovalRequest): Promise<void>;
+}
+//#endregion
+export { InvalidInvocationAuthority as C, requiresToolApproval as S, InvocationAuthorityRef as T, ToolOperationInspectResult as _, PiToolResult as a, ToolOperationRecord as b, InvalidToolInput as c, ToolInvocationDenied as d, AuthorizationPolicyState as f, ToolOperationBinding as g, ToolOperationBeginResult as h, PiToolDefinition as i, normalizeStableJson as l, createInvocationAuthority as m, PiToolApprovalRequest as n, createToolInputDigest as o, ToolApprovalRequest as p, PiToolContent as r, InvalidStableJson as s, PiToolApprovalGateway as t, ToolExecutionRequest as u, ToolOperationReconciliation as v, InvocationAuthority as w, ToolOperationState as x, ToolOperationReconciliationOutcome as y };