@salesforce/sfdx-agent-harness-openai 0.0.1 → 0.2.0

package/dist/openai-skill-tools.js

@@ -0,0 +1,209 @@
+/*
+ * Copyright 2026, Salesforce, Inc. All rights reserved.
+ * See LICENSE.txt for license terms.
+ */
+import { readFile } from 'node:fs/promises';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { tool } from '@openai/agents';
+import { getErrorMessage } from '@salesforce/agentic-common';
+/**
+ * Build the `@openai/agents` function tools that expose an agent's configured
+ * skills to the model. Returns an empty array when the agent declares no skills
+ * so `buildAgent` adds nothing to the tool surface for a skill-less agent.
+ *
+ * Two tools:
+ *
+ * - **`load_skill({ skill })`** — returns the requested skill's `SKILL.md` body,
+ *   prefixed with a `<skill-location>` anchor carrying the skill's directory.
+ *   The tool description enumerates the catalog (one `- name: description` line
+ *   per skill, alphabetical) so the model can scan-and-pick. Eager shape: the
+ *   descriptor rides in the prompt at rest, but the body loads on demand.
+ * - **`read_skill_file({ skill, path })`** — reads a file the loaded `SKILL.md`
+ *   references relative to its own directory (`references/...`, `assets/...`).
+ *   This is the OpenAI harness's answer to multi-file skill reachability
+ *   (W-23231661 / #626): Claude reaches siblings via the subprocess's built-in
+ *   `Read` tool plus a granted directory, and Mastra via a `Workspace`
+ *   filesystem with allowed paths — neither affordance exists here (the
+ *   `@openai/agents` run loop has no built-in file reader and runs in-process),
+ *   so the harness supplies the read affordance itself, scoped to the named
+ *   skill's directory.
+ *
+ * Both tools are `needsApproval: false`. Skills read the consumer's OWN
+ * configured paths — a consumer-supplied capability, the same category as
+ * consumer-executed tools (`AgentConfig.tools`), never approval-gated. They
+ * carry no `serverName`, so they are not `skill_bridge`-identity tools and the
+ * SDK's `mcp:skill_bridge:*` auto-allow rules don't apply — harmless, because a
+ * `needsApproval: false` tool can never raise an interruption to gate.
+ *
+ * Called fresh inside `buildAgent` on every `stream()` reading `state.skillMap`
+ * live — never cached on state — so a mid-turn `updateAgent` that changes the
+ * configured skills lands on the next turn.
+ */
+export function buildSkillTools(skillMap) {
+    if (skillMap.size === 0)
+        return [];
+    return [buildLoadSkillTool(skillMap), buildReadSkillFileTool(skillMap)];
+}
+const LOAD_SKILL_TOOL_NAME = 'load_skill';
+const READ_SKILL_FILE_TOOL_NAME = 'read_skill_file';
+function buildLoadSkillTool(skillMap) {
+    const execute = async (input) => {
+        const requested = readStringArg(input, 'skill');
+        if (requested.length === 0)
+            return errorPayload("Missing required 'skill' field.", skillMap);
+        const entry = skillMap.get(requested);
+        if (entry === undefined)
+            return errorPayload(`Unknown skill "${requested}".`, skillMap);
+        let body;
+        try {
+            body = await readFile(entry.path, 'utf8');
+        }
+        catch (err) {
+            return errorPayload(`Failed to read skill "${requested}": ${getErrorMessage(err)}`);
+        }
+        return prependSkillLocation(body, entry.path);
+    };
+    return tool({
+        name: LOAD_SKILL_TOOL_NAME,
+        description: buildLoadSkillDescription(skillMap),
+        parameters: {
+            type: 'object',
+            properties: {
+                skill: { type: 'string', description: 'Exact name of the skill to load (required).' },
+            },
+            required: ['skill'],
+            additionalProperties: false,
+        },
+        strict: false,
+        needsApproval: false,
+        execute,
+        // A JSON-schema `parameters` + `strict: false` selects the non-strict
+        // tool branch (the harness does not import zod). The options are cast as
+        // one object because a hand-written JSON schema won't structurally match
+        // the SDK's `JsonObjectSchemaNonStrict` generic and the execute arg is
+        // `unknown` on the non-strict branch — same pattern as `mapConsumerTools`.
+    });
+}
+function buildReadSkillFileTool(skillMap) {
+    const execute = async (input) => {
+        const skillName = readStringArg(input, 'skill');
+        const requestedPath = readStringArg(input, 'path');
+        if (skillName.length === 0)
+            return errorPayload("Missing required 'skill' field.", skillMap);
+        if (requestedPath.length === 0)
+            return errorPayload("Missing required 'path' field.");
+        const entry = skillMap.get(skillName);
+        if (entry === undefined)
+            return errorPayload(`Unknown skill "${skillName}".`, skillMap);
+        const skillDir = dirname(entry.path);
+        const resolved = resolve(skillDir, requestedPath);
+        // Containment: the resolved path must be the skill directory itself or a
+        // descendant of it. `relative(skillDir, resolved)` escapes the directory
+        // iff it starts with `..` or is absolute (a different drive on Windows),
+        // which rejects `../`, an absolute `requestedPath`, and any traversal that
+        // climbs out. Symlink-escape hardening (realpath) is a deliberate
+        // non-goal: the files are consumer-configured, not adversarial input, and
+        // the harness runs in-process with no sandbox to breach.
+        const rel = relative(skillDir, resolved);
+        if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+            return errorPayload(`Path "${requestedPath}" escapes skill "${skillName}"'s directory. ` +
+                'Reference files inside the skill directory only (e.g. `references/format.md`).');
+        }
+        try {
+            return await readFile(resolved, 'utf8');
+        }
+        catch (err) {
+            return errorPayload(`Failed to read "${requestedPath}" for skill "${skillName}": ${getErrorMessage(err)}`);
+        }
+    };
+    return tool({
+        name: READ_SKILL_FILE_TOOL_NAME,
+        description: 'Read a file that a loaded skill references relative to its own directory (e.g. `references/format.md`, ' +
+            '`assets/template.txt`). Pass the skill name and the relative path exactly as the skill body wrote it, ' +
+            'resolved against the skill directory the `load_skill` `<skill-location>` anchor reported. Use this after ' +
+            '`load_skill` whenever the loaded skill instructs you to read a referenced file before answering.',
+        parameters: {
+            type: 'object',
+            properties: {
+                skill: {
+                    type: 'string',
+                    description: 'Exact name of the skill whose directory the path is relative to.',
+                },
+                path: {
+                    type: 'string',
+                    description: 'Path to the file, relative to the skill directory (e.g. `references/format.md`).',
+                },
+            },
+            required: ['skill', 'path'],
+            additionalProperties: false,
+        },
+        strict: false,
+        needsApproval: false,
+        execute,
+    });
+}
+function buildLoadSkillDescription(skillMap) {
+    // Keep the catalog deterministic — alphabetical names regardless of
+    // insertion order means a consumer who reorders `config.skills` doesn't
+    // churn the model's prompt.
+    const names = [...skillMap.keys()].sort();
+    const lines = [
+        "Load a project-specific skill's full instructions on demand. Returns the SKILL.md body, prefixed with the " +
+            "skill's on-disk location so you can resolve any relative file references it mentions (e.g. " +
+            '`references/...`) via the `read_skill_file` tool. Pick the relevant skill from the catalog below before ' +
+            'answering questions that depend on project conventions, internal procedures, or company-specific ' +
+            'protocols.',
+        '',
+        'Available skills:',
+    ];
+    for (const name of names) {
+        const description = skillMap.get(name)?.description ?? '';
+        lines.push(description.length > 0 ? `- ${name}: ${description}` : `- ${name}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Prefix the SKILL.md body with an absolute-path anchor so the model can resolve
+ * relative references inside a multi-file skill (W-23231661 / #626). The
+ * `load_skill` result on its own gives the model no way to turn a relative
+ * mention like `references/api-guide.md` into a read the harness can serve —
+ * configured skills routinely live outside the project root. Surfacing the
+ * skill's directory plus naming the `read_skill_file` tool gives the model the
+ * exact call to make. Mirrors the Claude harness's `prependSkillLocation`, with
+ * the tool name adapted to this harness's sibling-reader (Claude points the
+ * model at its built-in `Read`; here the model must call `read_skill_file`).
+ *
+ * The preamble is a tag-delimited (`<skill-location>…</skill-location>`) block
+ * ahead of the verbatim body so it reads as harness-provided metadata rather
+ * than part of the skill author's instructions.
+ */
+function prependSkillLocation(body, skillMdPath) {
+    const skillDir = dirname(skillMdPath);
+    const preamble = [
+        '<skill-location>',
+        `This skill's files live in: ${skillDir}`,
+        `Its SKILL.md is at: ${skillMdPath}`,
+        'To read any file this skill references by a relative path (e.g. `references/...`, `assets/...`), call the',
+        "`read_skill_file` tool with this skill's name and that relative path. Do NOT guess file contents — read them.",
+        '</skill-location>',
+        '',
+    ].join('\n');
+    return `${preamble}${body}`;
+}
+/** Read a required string field off the tool's parsed (non-strict) input. */
+function readStringArg(input, field) {
+    const value = input?.[field];
+    return typeof value === 'string' ? value.trim() : '';
+}
+/**
+ * Shape a recoverable tool error as a JSON string the model reads and can act
+ * on. `load_skill`'s errors include the available skill names so the model can
+ * retry with a valid one; `read_skill_file`'s path errors omit them.
+ */
+function errorPayload(message, skillMap) {
+    const payload = { error: message };
+    if (skillMap !== undefined)
+        payload.availableSkills = [...skillMap.keys()].sort();
+    return JSON.stringify(payload);
+}
+//# sourceMappingURL=openai-skill-tools.js.map

package/dist/openai-skill-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-skill-tools.js","sourceRoot":"","sources":["../src/openai-skill-tools.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,IAAI,EAAa,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB;IAC9C,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,MAAM,yBAAyB,GAAG,iBAAiB,CAAC;AAEpD,SAAS,kBAAkB,CAAC,QAAkB;IAC1C,MAAM,OAAO,GAAG,KAAK,EAAE,KAAc,EAAmB,EAAE;QACtD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,iCAAiC,EAAE,QAAQ,CAAC,CAAC;QAC7F,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,kBAAkB,SAAS,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,yBAAyB,SAAS,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC;QACR,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,yBAAyB,CAAC,QAAQ,CAAC;QAChD,UAAU,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,6CAA6C,EAAE;aACxF;YACD,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,oBAAoB,EAAE,KAAK;SAC9B;QACD,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK;QACpB,OAAO;QACP,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,2EAA2E;KACrC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAkB;IAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,KAAc,EAAmB,EAAE;QACtD,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,MAAM,aAAa,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,iCAAiC,EAAE,QAAQ,CAAC,CAAC;QAC7F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC,gCAAgC,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,YAAY,CAAC,kBAAkB,SAAS,IAAI,EAAE,QAAQ,CAAC,CAAC;QAExF,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAClD,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,kEAAkE;QAClE,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,YAAY,CACf,SAAS,aAAa,oBAAoB,SAAS,iBAAiB;gBAChE,gFAAgF,CACvF,CAAC;QACN,CAAC;QAED,IAAI,CAAC;YACD,OAAO,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,YAAY,CAAC,mBAAmB,aAAa,gBAAgB,SAAS,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,IAAI,CAAC;QACR,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EACP,yGAAyG;YACzG,wGAAwG;YACxG,2GAA2G;YAC3G,kGAAkG;QACtG,UAAU,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,KAAK,EAAE;oBACH,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kEAAkE;iBAClF;gBACD,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,kFAAkF;iBAClG;aACJ;YACD,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;YAC3B,oBAAoB,EAAE,KAAK;SAC9B;QACD,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,KAAK;QACpB,OAAO;KAC+B,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAkB;IACjD,oEAAoE;IACpE,wEAAwE;IACxE,4BAA4B;IAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG;QACV,4GAA4G;YACxG,6FAA6F;YAC7F,0GAA0G;YAC1G,mGAAmG;YACnG,YAAY;QAChB,EAAE;QACF,mBAAmB;KACtB,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,WAAmB;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG;QACb,kBAAkB;QAClB,+BAA+B,QAAQ,EAAE;QACzC,uBAAuB,WAAW,EAAE;QACpC,2GAA2G;QAC3G,+GAA+G;QAC/G,mBAAmB;QACnB,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAChD,MAAM,KAAK,GAAI,KAAoD,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7E,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,OAAe,EAAE,QAAmB;IACtD,MAAM,OAAO,GAAkD,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,CAAC,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}

package/dist/openai-tool-redaction.d.ts

@@ -1,5 +1,5 @@
 import { type MCPServer, type Tool } from '@openai/agents';
-import type { ToolResultRedactor } from '@salesforce/sfdx-agent-sdk';
+import type { Decision, ToolInvocation, ToolResultRedactor } from '@salesforce/sfdx-agent-sdk';
 import type { McpCatalogEntry } from './openai-mcp-state.js';
 /**
  * Everything a redaction seam needs to call the consumer's
@@ -16,6 +16,33 @@ export type RedactionContext = {
     /** Bare-tool-name → `{ serverName, annotations }`; supplies `serverName` for MCP tools. */
     readonly mcpCatalog: ReadonlyMap<string, McpCatalogEntry>;
 };
+/**
+ * The policy decider the coordinator consults per interruption, plus the MCP
+ * catalog needed to lift a bare tool name to the full {@link ToolInvocation}
+ * (`serverName` + `annotations`) the `mcp` / `mcp-annotation` matchers require.
+ * Built per-turn in `stream()` when the tool-approval gate is active AND the
+ * agent has MCP servers, and threaded into `buildManagedMcpTools` so each
+ * materialized MCP tool carries a `needsApproval` predicate. `undefined` when
+ * gating is off — MCP tools then carry no predicate and never suspend.
+ */
+export type McpApprovalContext = {
+    /** Resolves a tool invocation to `allow` / `deny` / `require-approval`. */
+    readonly policy: (invocation: ToolInvocation) => Decision;
+    /** Bare-tool-name → `{ serverName, annotations }` — the enrichment source. */
+    readonly mcpCatalog: ReadonlyMap<string, McpCatalogEntry>;
+};
+/**
+ * Lift a tool's **display name** (the `@openai/agents`-sanitized name carried on
+ * interruptions and materialized tools) to the {@link ToolInvocation} the policy
+ * resolver matches on. The catalog (keyed by display name) supplies `serverName`
+ * (required for the `mcp` / `mcp-annotation` matchers — a `builtin` matcher only
+ * fires when `serverName` is absent), the ORIGINAL un-sanitized `toolName` (so a
+ * rule pinning `{ toolName: 'get-sum' }` matches even though the display name is
+ * `get_sum`), and any declared `annotations`. A name missing from the catalog
+ * (a consumer / built-in tool) yields a bare `{ toolName }` from the display
+ * name, matching the event-adapter enrichment contract (`serverName` absent).
+ */
+export declare function toToolInvocation(displayName: string, mcpCatalog: ReadonlyMap<string, McpCatalogEntry>): ToolInvocation;
 /**
  * Run the consumer's redactor over one tool result and return the value the
  * model should see. `{ output }` replaces; `undefined` (or a malformed return)
@@ -36,15 +63,19 @@ export declare function applyRedaction(ctx: RedactionContext, args: {
 /**
  * Materialize an agent's MCP tools as function tools (via {@link getAllMcpTools},
  * the same call the SDK makes internally for a native `Agent({ mcpServers })`
- * attach) and wrap each one's `invoke` with a redaction shim. Used only when the
- * agent has an `onToolResult` hook — otherwise the harness keeps the native
- * `mcpServers` attach unchanged (the #541-proven path).
+ * attach) so the harness can attach per-tool hooks the native attach doesn't
+ * expose: a **redaction** shim on each tool's `invoke` (when `redaction` is set)
+ * and a **`needsApproval` predicate** driven by the tool-approval policy (when
+ * `approval` is set). Used whenever EITHER hook is active; otherwise the harness
+ * keeps the native `mcpServers` attach unchanged (the #541-proven path).
  *
- * The `@openai/agents` MCP attach exposes no per-result rewrite hook, so owning
- * the function-tool `invoke` is the only model-visible seam that also carries
- * the `toolCallId` (`details.toolCall.callId`). The shim closure-captures the
- * {@link RedactionContext}, so `threadId` / `agentId` need no `RunContext`
- * plumbing.
+ * The `@openai/agents` MCP attach exposes neither a per-result rewrite hook nor
+ * a per-tool `needsApproval` seam, so owning the materialized function tool is
+ * the only place to attach both. The redaction shim closure-captures the
+ * {@link RedactionContext} (so `threadId` / `agentId` need no `RunContext`
+ * plumbing) and reads `toolCallId` from `details.toolCall.callId`; the approval
+ * predicate closure-captures the {@link McpApprovalContext} and resolves the
+ * live policy per call.
  *
  * **#541 is preserved:** `getAllMcpTools` calls `listTools()` per server, which
  * returns the warm instance cache (`cacheToolsList: true`) with no network
@@ -52,4 +83,7 @@ export declare function applyRedaction(ctx: RedactionContext, args: {
  * model-visible string output, not the SDK's internal error flag, so MCP
  * `isError` is best-effort (duck-typed) — matching Claude's `PostToolUse`.
  */
-export declare function buildRedactedMcpTools(servers: MCPServer[], ctx: RedactionContext): Promise<Tool[]>;
+export declare function buildManagedMcpTools(servers: MCPServer[], ctx: {
+    redaction?: RedactionContext;
+    approval?: McpApprovalContext;
+}): Promise<Tool[]>;

package/dist/openai-tool-redaction.js

@@ -3,6 +3,27 @@
  * See LICENSE.txt for license terms.
  */
 import { getAllMcpTools } from '@openai/agents';
+/**
+ * Lift a tool's **display name** (the `@openai/agents`-sanitized name carried on
+ * interruptions and materialized tools) to the {@link ToolInvocation} the policy
+ * resolver matches on. The catalog (keyed by display name) supplies `serverName`
+ * (required for the `mcp` / `mcp-annotation` matchers — a `builtin` matcher only
+ * fires when `serverName` is absent), the ORIGINAL un-sanitized `toolName` (so a
+ * rule pinning `{ toolName: 'get-sum' }` matches even though the display name is
+ * `get_sum`), and any declared `annotations`. A name missing from the catalog
+ * (a consumer / built-in tool) yields a bare `{ toolName }` from the display
+ * name, matching the event-adapter enrichment contract (`serverName` absent).
+ */
+export function toToolInvocation(displayName, mcpCatalog) {
+    const entry = mcpCatalog.get(displayName);
+    if (entry === undefined)
+        return { toolName: displayName };
+    return {
+        toolName: entry.toolName,
+        serverName: entry.serverName,
+        ...(entry.annotations !== undefined ? { annotations: entry.annotations } : {}),
+    };
+}
 /**
  * Run the consumer's redactor over one tool result and return the value the
  * model should see. `{ output }` replaces; `undefined` (or a malformed return)
@@ -31,15 +52,19 @@ export async function applyRedaction(ctx, args) {
 /**
  * Materialize an agent's MCP tools as function tools (via {@link getAllMcpTools},
  * the same call the SDK makes internally for a native `Agent({ mcpServers })`
- * attach) and wrap each one's `invoke` with a redaction shim. Used only when the
- * agent has an `onToolResult` hook — otherwise the harness keeps the native
- * `mcpServers` attach unchanged (the #541-proven path).
+ * attach) so the harness can attach per-tool hooks the native attach doesn't
+ * expose: a **redaction** shim on each tool's `invoke` (when `redaction` is set)
+ * and a **`needsApproval` predicate** driven by the tool-approval policy (when
+ * `approval` is set). Used whenever EITHER hook is active; otherwise the harness
+ * keeps the native `mcpServers` attach unchanged (the #541-proven path).
  *
- * The `@openai/agents` MCP attach exposes no per-result rewrite hook, so owning
- * the function-tool `invoke` is the only model-visible seam that also carries
- * the `toolCallId` (`details.toolCall.callId`). The shim closure-captures the
- * {@link RedactionContext}, so `threadId` / `agentId` need no `RunContext`
- * plumbing.
+ * The `@openai/agents` MCP attach exposes neither a per-result rewrite hook nor
+ * a per-tool `needsApproval` seam, so owning the materialized function tool is
+ * the only place to attach both. The redaction shim closure-captures the
+ * {@link RedactionContext} (so `threadId` / `agentId` need no `RunContext`
+ * plumbing) and reads `toolCallId` from `details.toolCall.callId`; the approval
+ * predicate closure-captures the {@link McpApprovalContext} and resolves the
+ * live policy per call.
  *
  * **#541 is preserved:** `getAllMcpTools` calls `listTools()` per server, which
  * returns the warm instance cache (`cacheToolsList: true`) with no network
@@ -47,32 +72,55 @@ export async function applyRedaction(ctx, args) {
  * model-visible string output, not the SDK's internal error flag, so MCP
  * `isError` is best-effort (duck-typed) — matching Claude's `PostToolUse`.
  */
-export async function buildRedactedMcpTools(servers, ctx) {
+export async function buildManagedMcpTools(servers, ctx) {
     const tools = await getAllMcpTools({ mcpServers: servers });
-    return tools.map((tool) => (tool.type === 'function' ? wrapFunctionToolInvoke(tool, ctx) : tool));
+    return tools.map((tool) => (tool.type === 'function' ? manageFunctionTool(tool, ctx) : tool));
 }
-/** Wrap a function tool's `invoke` so its result passes through the redactor before the model sees it. */
-function wrapFunctionToolInvoke(tool, ctx) {
+/**
+ * Rebuild a materialized MCP function tool with the active per-tool hooks:
+ * wrap `invoke` with the redactor (when set) and stamp a `needsApproval`
+ * predicate from the policy (when set). The single site that rebuilds the
+ * tool descriptor before it attaches to the turn's `Agent`.
+ */
+function manageFunctionTool(tool, ctx) {
     const originalInvoke = tool.invoke.bind(tool);
+    const redaction = ctx.redaction;
+    const approval = ctx.approval;
     return {
         ...tool,
-        invoke: async (runContext, input, details) => {
-            const output = await originalInvoke(runContext, input, details);
-            const toolCallId = details?.toolCall?.callId;
-            // Without a callId the redaction input can't be faithfully attributed;
-            // still redact (the redactor keys on toolName/output), passing an empty
-            // id rather than dropping the hook.
-            const redacted = await applyRedaction(ctx, {
-                toolCallId: toolCallId ?? '',
-                toolName: tool.name,
-                output,
-                isError: isErrorOutput(output),
-            });
-            // `invoke` must return `string | Result`; a redactor may return any
-            // shape (the consumer owns matching the tool's expected shape, per the
-            // ToolResultRedactor contract — the harness does not validate it).
-            return redacted;
-        },
+        // Gate the tool when the policy resolves its invocation to anything but
+        // `allow`. `require-approval` / `deny` return `true` so the run loop
+        // raises a `RunToolApprovalItem` interruption the coordinator settles
+        // (deny is auto-rejected there, so it never prompts the consumer);
+        // `allow` returns `false` so the tool executes inline with no round-trip.
+        // Without an approval context the tool keeps `getAllMcpTools`' default
+        // (never gated).
+        ...(approval !== undefined
+            ? {
+                needsApproval: async () => approval.policy(toToolInvocation(tool.name, approval.mcpCatalog)) !== 'allow',
+            }
+            : {}),
+        invoke: redaction === undefined
+            ? originalInvoke
+            : async (runContext, input, details) => {
+                const output = await originalInvoke(runContext, input, details);
+                const toolCallId = details?.toolCall?.callId;
+                // Without a callId the redaction input can't be faithfully
+                // attributed; still redact (the redactor keys on
+                // toolName/output), passing an empty id rather than
+                // dropping the hook.
+                const redacted = await applyRedaction(redaction, {
+                    toolCallId: toolCallId ?? '',
+                    toolName: tool.name,
+                    output,
+                    isError: isErrorOutput(output),
+                });
+                // `invoke` must return `string | Result`; a redactor may
+                // return any shape (the consumer owns matching the tool's
+                // expected shape, per the ToolResultRedactor contract — the
+                // harness does not validate it).
+                return redacted;
+            },
     };
 }
 /** Best-effort MCP error detection: the model-visible output carries no structured flag, so duck-type it. */

package/dist/openai-tool-redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai-tool-redaction.js","sourceRoot":"","sources":["../src/openai-tool-redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAA6B,MAAM,gBAAgB,CAAC;AAoB3E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,GAAqB,EACrB,IAAiF;IAEjF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;QAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,2EAA2E;IAC3E,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAoB,EAAE,GAAqB;IACnF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,0GAA0G;AAC1G,SAAS,sBAAsB,CAAC,IAAyC,EAAE,GAAqB;IAC5F,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO;QACH,GAAG,IAAI;QACP,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAChE,MAAM,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;YAC7C,uEAAuE;YACvE,wEAAwE;YACxE,oCAAoC;YACpC,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACvC,UAAU,EAAE,UAAU,IAAI,EAAE;gBAC5B,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,MAAM;gBACN,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;aACjC,CAAC,CAAC;YACH,oEAAoE;YACpE,uEAAuE;YACvE,mEAAmE;YACnE,OAAO,QAAkB,CAAC;QAC9B,CAAC;KACJ,CAAC;AACN,CAAC;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,MAAe;IAClC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAgC,CAAC,OAAO,KAAK,IAAI,CAAC;AAC/G,CAAC"}
+{"version":3,"file":"openai-tool-redaction.js","sourceRoot":"","sources":["../src/openai-tool-redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAA6B,MAAM,gBAAgB,CAAC;AAoC3E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC5B,WAAmB,EACnB,UAAgD;IAEhD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;IAC1D,OAAO;QACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;AACN,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,GAAqB,EACrB,IAAiF;IAEjF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;QAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,2EAA2E;IAC3E,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACpG,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,OAAoB,EACpB,GAAoE;IAEpE,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CACvB,IAAyC,EACzC,GAAoE;IAEpE,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,OAAO;QACH,GAAG,IAAI;QACP,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,0EAA0E;QAC1E,uEAAuE;QACvE,iBAAiB;QACjB,GAAG,CAAC,QAAQ,KAAK,SAAS;YACtB,CAAC,CAAC;gBACI,aAAa,EAAE,KAAK,IAAsB,EAAE,CACxC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,OAAO;aACpF;YACH,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,EACF,SAAS,KAAK,SAAS;YACnB,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;gBAC7C,2DAA2D;gBAC3D,iDAAiD;gBACjD,oDAAoD;gBACpD,qBAAqB;gBACrB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,SAAS,EAAE;oBAC7C,UAAU,EAAE,UAAU,IAAI,EAAE;oBAC5B,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM;oBACN,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;iBACjC,CAAC,CAAC;gBACH,yDAAyD;gBACzD,0DAA0D;gBAC1D,4DAA4D;gBAC5D,iCAAiC;gBACjC,OAAO,QAAkB,CAAC;YAC9B,CAAC;KACd,CAAC;AACN,CAAC;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,MAAe;IAClC,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAK,MAAgC,CAAC,OAAO,KAAK,IAAI,CAAC;AAC/G,CAAC"}

package/dist/rule-composer.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Loads `config.rules` and concatenates the rule-file bodies into a single
+ * string. Mirrors the Mastra and Claude loaders (same fs walk, frontmatter
+ * strip, alphabetical sort, blank-line join), so the returned string is
+ * byte-identical to the rules portion of Mastra's composed `instructions` and
+ * the Claude harness's `rulesAppend`. The cross-harness `AgentConfig.rules`
+ * e2e (#493) compares the composed system-prompt body across harnesses, so
+ * this loader MUST stay in lockstep with the sibling copies.
+ *
+ * Each entry in `rulePaths` is `stat`ed:
+ * - File entry (`.md`): read directly.
+ * - Directory entry: scanned one level deep for `*.md` files (alphabetical,
+ *   subdirectories ignored, non-`.md` skipped).
+ *
+ * For each loaded file, optional YAML frontmatter is stripped via
+ * `splitFrontmatterAndBody` and the trimmed body is concatenated verbatim,
+ * separated by blank lines — no envelope, no per-rule heading. Returns the
+ * empty string when no rules contribute content. A missing or unreadable
+ * rule entry rejects.
+ *
+ * The result is stored on `OpenAIAgentState.rulesAppend` and folded onto
+ * `config.instructions` in `buildAgent` when the per-turn `Agent` is
+ * constructed — see ARCHITECTURE.md → "Rule Composition". A cross-harness
+ * import of the sibling loaders is lint-blocked by `harnessIsolationPack`, so
+ * this is a deliberate copy (the same posture as `mcp-error-classifier.ts`).
+ */
+export declare function composeRulesAppend(rulePaths: readonly string[] | undefined): Promise<string>;
+/**
+ * Fold the composed rule bodies onto the base instructions, matching Mastra's
+ * `composeInstructionsWithRules` join (`base` + blank line + `rulesBlock`) so
+ * the effective system prompt is byte-identical across harnesses. Returns the
+ * base unchanged when there are no rules, and the rules block alone when there
+ * are no base instructions.
+ */
+export declare function composeSystemPrompt(instructions: string | undefined, rulesAppend: string): string;

package/dist/rule-composer.js

@@ -0,0 +1,88 @@
+/*
+ * Copyright 2026, Salesforce, Inc. All rights reserved.
+ * See LICENSE.txt for license terms.
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { getErrorMessage, splitFrontmatterAndBody } from '@salesforce/agentic-common';
+/**
+ * Loads `config.rules` and concatenates the rule-file bodies into a single
+ * string. Mirrors the Mastra and Claude loaders (same fs walk, frontmatter
+ * strip, alphabetical sort, blank-line join), so the returned string is
+ * byte-identical to the rules portion of Mastra's composed `instructions` and
+ * the Claude harness's `rulesAppend`. The cross-harness `AgentConfig.rules`
+ * e2e (#493) compares the composed system-prompt body across harnesses, so
+ * this loader MUST stay in lockstep with the sibling copies.
+ *
+ * Each entry in `rulePaths` is `stat`ed:
+ * - File entry (`.md`): read directly.
+ * - Directory entry: scanned one level deep for `*.md` files (alphabetical,
+ *   subdirectories ignored, non-`.md` skipped).
+ *
+ * For each loaded file, optional YAML frontmatter is stripped via
+ * `splitFrontmatterAndBody` and the trimmed body is concatenated verbatim,
+ * separated by blank lines — no envelope, no per-rule heading. Returns the
+ * empty string when no rules contribute content. A missing or unreadable
+ * rule entry rejects.
+ *
+ * The result is stored on `OpenAIAgentState.rulesAppend` and folded onto
+ * `config.instructions` in `buildAgent` when the per-turn `Agent` is
+ * constructed — see ARCHITECTURE.md → "Rule Composition". A cross-harness
+ * import of the sibling loaders is lint-blocked by `harnessIsolationPack`, so
+ * this is a deliberate copy (the same posture as `mcp-error-classifier.ts`).
+ */
+export async function composeRulesAppend(rulePaths) {
+    if (!rulePaths || rulePaths.length === 0)
+        return '';
+    const sections = [];
+    for (const entry of rulePaths) {
+        let stats;
+        try {
+            stats = await fs.stat(entry);
+        }
+        catch (err) {
+            throw new Error(`Failed to load rules from "${entry}": ${getErrorMessage(err)}`, { cause: err });
+        }
+        const filesToRead = stats.isDirectory() ? await listMarkdownFilesInDirectory(entry) : [entry];
+        for (const ruleFile of filesToRead) {
+            let raw;
+            try {
+                raw = await fs.readFile(ruleFile, 'utf8');
+            }
+            catch (err) {
+                throw new Error(`Failed to load rule from "${ruleFile}": ${getErrorMessage(err)}`, { cause: err });
+            }
+            const { body } = splitFrontmatterAndBody(raw);
+            const trimmed = body.trim();
+            if (trimmed.length === 0)
+                continue;
+            sections.push(trimmed);
+        }
+    }
+    return sections.join('\n\n');
+}
+/**
+ * Fold the composed rule bodies onto the base instructions, matching Mastra's
+ * `composeInstructionsWithRules` join (`base` + blank line + `rulesBlock`) so
+ * the effective system prompt is byte-identical across harnesses. Returns the
+ * base unchanged when there are no rules, and the rules block alone when there
+ * are no base instructions.
+ */
+export function composeSystemPrompt(instructions, rulesAppend) {
+    const base = instructions ?? '';
+    if (rulesAppend.length === 0)
+        return base;
+    return base.length > 0 ? `${base}\n\n${rulesAppend}` : rulesAppend;
+}
+async function listMarkdownFilesInDirectory(dir) {
+    let names;
+    try {
+        const entries = await fs.readdir(dir, { withFileTypes: true });
+        names = entries.filter((e) => e.isFile() && e.name.toLowerCase().endsWith('.md')).map((e) => e.name);
+    }
+    catch (err) {
+        throw new Error(`Failed to load rules from "${dir}": ${getErrorMessage(err)}`, { cause: err });
+    }
+    return names.sort().map((name) => path.join(dir, name));
+}
+//# sourceMappingURL=rule-composer.js.map

package/dist/rule-composer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rule-composer.js","sourceRoot":"","sources":["../src/rule-composer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAwC;IAC7E,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACD,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,4BAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9F,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,CAAC;YACjC,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACD,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACnC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,YAAgC,EAAE,WAAmB;IACrF,MAAM,IAAI,GAAG,YAAY,IAAI,EAAE,CAAC;IAChC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,GAAW;IACnD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC"}