@vibesdotdev/tools 0.0.0-stage → 1.0.0-rc.3

package/dist/agents/agents.storage.schema.js

@@ -0,0 +1,3 @@
+import { AIAgentInstanceDescriptorSchema } from "./schemas/index.js";
+export const AgentConfigurationsSchema = AIAgentInstanceDescriptorSchema.array();
+//# sourceMappingURL=agents.storage.schema.js.map

package/dist/agents/agents.storage.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.storage.schema.js","sourceRoot":"","sources":["../../src/agents/agents.storage.schema.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC,KAAK,EAAE,CAAC"}

package/dist/agents/approval/approval-client.d.ts

@@ -0,0 +1,147 @@
+/**
+ * The tools approval runtime, exposed as `ToolsClient.approval`.
+ *
+ * Everything an agent loop needs to gate a tool call lives here, behind the
+ * tools runtime client — callers resolve it through the runtime
+ * (`getVibesToolsClient(runtime)`) rather than importing loose policy functions:
+ *
+ *   - the approval POLICY (the default mode plus the signals a decision reads:
+ *     the descriptor-declared `requiresApproval` flag, a call-level approval
+ *     request, and an unresolved descriptor, which gates fail-closed);
+ *   - GATE RESOLUTION: a request's pure-data approval channel is reconstructed
+ *     into a live `ToolApprovalRuntime` from the `tools/approval-channel` kind of
+ *     the runtime that is EXECUTING the run — the exact sibling of
+ *     `resolveRequestToolProvider` for `request.toolIds`. FAIL-CLOSED: a named
+ *     channel that cannot be resolved here yields a deny-all gate that says why;
+ *   - the typed decisions: the durable workspace grant a decision selects, and
+ *     the deferred-approval error the loop throws after its required checkpoint.
+ */
+import { PendingApprovalStore } from './store.ts';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type ToolApprovalDecision, type WorkspaceAccessChoice } from '@vibesdotdev/ai-schemas/agents/approval/types';
+import type { ToolApprovalMode } from '@vibesdotdev/ai-schemas/agents/schemas/tool-approval';
+import type { ToolApprovalRuntime } from './types.ts';
+import type { ApprovalDescriptorSignal, ToolApprovalGateOptions } from '../contracts/approval-types.ts';
+export type { ApprovalDescriptorSignal } from '../contracts/approval-types.ts';
+/**
+ * Tool-call approval policy.
+ *
+ * Decides whether a tool call must pause for an explicit user decision before
+ * it executes, given the effective {@link ToolApprovalMode}. Under
+ * `'auto-approve-safe'` (the default) a tool gates when its descriptor declares
+ * `requiresApproval: true` (surfaced to the loop as
+ * {@link ApprovalDescriptorSignal.descriptorRequiresApproval}), when the call
+ * itself sets {@link ApprovalDescriptorSignal.callRequiresApproval}, or when
+ * the call's descriptor could not be resolved
+ * ({@link ApprovalDescriptorSignal.descriptorResolved} === false) — an
+ * unresolved descriptor gates fail-closed. No tool-name list is consulted.
+ *
+ * ## Rubric — what descriptors declare `requiresApproval` (work `5b6dbf60`)
+ *
+ * A descriptor declares `requiresApproval: true` when a single auto-approved
+ * call can cause an effect the user would want to authorize first:
+ *
+ *   - **Executes code / shell** (arbitrary command or code runs): `run-command`,
+ *     `sandbox-execute`, `execute-code`, `code-execution-submit`.
+ *   - **Writes / deletes files or source** in a real workspace: `file-write`,
+ *     `file-patch`, `git`, `codemod` (bulk rewrite). `workspace-fs` declares no
+ *     flag: in-scope reads/writes of a bound workspace run without a prompt;
+ *     the loop sets {@link ApprovalDescriptorSignal.callRequiresApproval}
+ *     when the call leaves granted workspace access.
+ *   - **Pushes to / acts on an external system** irreversibly: `forge-pr-create*`,
+ *     `forge-issue-create`, `forge-issue-comment`, `forge-pr-review-comment`,
+ *     `email`, `send_email` (alias `send-email`), `browser` / `desktop` (drives real UIs),
+ *     `api-request` / `fetch` (arbitrary outbound calls), `runbook`.
+ *   - **Spends money** (paid inference, sandbox minutes, billed API): sandbox /
+ *     billed external APIs declare `requiresApproval`. Core generation
+ *     primitives (`ai-generate`, `generate-image`, OCR) are reviewed auto-safe —
+ *     inference *is* the turn and is credit-bounded
+ *     (see studio `policy-coverage` REVIEWED_AUTO_SAFE).
+ *   - **Delegates** (re-enters the model in a child loop that can do all of the
+ *     above): `spawn-subagent`.
+ *
+ * A tool STAYS auto-safe when its writes are internal, reversible platform state
+ * with no money or external side effect — agent memory (`brain`, `awareness`,
+ * `presence`), session/scratchpad/todo state, search-index writes, knowledge
+ * items, and work-item CRUD (`vibes-work`). These are recorded, not gated. See
+ * `docs/audits/tui-followon/lane-b/LEDGER.md` for the per-tool decisions.
+ *
+ * The self-declared `requiresApproval: true` flag makes the rubric a STANDING
+ * contract: a new externally-mutating tool that sets the flag gates
+ * automatically, and the coverage test (`__tests__/policy-coverage.test.ts`)
+ * fails if an execute/destructive or `requiresApproval` tool is registered
+ * neither gated nor documented as a reviewed exception.
+ */
+/**
+ * The fail-closed gate. Denies every request, and SAYS WHY.
+ *
+ * Installed whenever a run SIGNALLED gating intent (it carried a channel
+ * descriptor) but the channel could not be resolved in this scope. A broken
+ * approval channel must never degrade into an open one.
+ *
+ * The `cause` is not decoration. Four very different failures — the kind isn't
+ * registered, the channel id doesn't resolve here, the channel declined the
+ * correlation, the channel threw — used to collapse into one sentence that said
+ * only "unavailable". That sentence reaches the model, which relays it to the
+ * person as though a human had refused: a user was told the approval "was
+ * denied on this side" when nothing had been denied and no approval had ever
+ * been requested. An opaque fail-closed gate is still a
+ * correct gate and a useless diagnostic. Name the cause here and it travels the
+ * whole way out — tool result, card, and log.
+ */
+export declare function denyingApprovalRuntime(cause: string): ToolApprovalRuntime;
+/** The causeless fail-closed gate. Prefer {@link denyingApprovalRuntime}. */
+export declare const denyAllApprovalRuntime: ToolApprovalRuntime;
+/** Whether `value` is a live approval gate: it can be asked for a decision. */
+export declare function isToolApprovalRuntime<Value>(value: Value): value is Value & ToolApprovalRuntime;
+export declare class ToolApprovalClient {
+    private readonly runtime;
+    readonly pending: PendingApprovalStore;
+    /** The mode assumed when a run carries no explicit `toolApprovalMode`. */
+    readonly defaultMode: ToolApprovalMode;
+    constructor(runtime: RuntimeRef);
+    dispose(): void;
+    /**
+     * True when executing `toolName` under `mode` must first obtain approval.
+     *
+     * - `'always-approve'` → never ask (auto-approve everything).
+     * - `'always-ask'` → ask for every tool call.
+     * - `'batch-approve'` → ask (no batch UI exists yet; fail toward asking).
+     * - `'auto-approve-safe'` (default) → ask when the descriptor self-declares
+     *   `requiresApproval: true`, when the call sets
+     *   {@link ApprovalDescriptorSignal.callRequiresApproval}, or when the call's
+     *   descriptor could not be resolved
+     *   ({@link ApprovalDescriptorSignal.descriptorResolved} === false,
+     *   fail-closed). A resolved tool with no flag runs without asking.
+     * - `'ask-when-declared'` → ask only for a tool whose descriptor self-declares
+     *   `requiresApproval: true` (the agent's own `request-approval`) OR a call that
+     *   sets `callRequiresApproval` (access outside the workspace). Unresolved
+     *   descriptors run without asking: the agent decides what to ask about.
+     */
+    requiresApproval(toolName: string, mode?: ToolApprovalMode, signal?: ApprovalDescriptorSignal): boolean;
+    /**
+     * Reconstruct the live approval gate for a run.
+     *
+     * @param channel  The request's `approval` descriptor. Absent → ungated run
+     *                 (no gating intent was signalled), so `undefined` is returned.
+     *                 Anything else is gating intent: a malformed descriptor, an
+     *                 unregistered kind, an unresolvable or declining channel, or a
+     *                 throwing one all yield the fail-closed deny gate.
+     */
+    resolveGate<Channel>(channel: Channel, options?: ToolApprovalGateOptions): Promise<ToolApprovalRuntime | undefined>;
+    /** Build the channel's gate, or carry the failure of a channel that threw while building it. */
+    private attemptGate;
+    /** The channel's gate, or the fail-closed deny gate when the channel is absent or declines. */
+    private buildGate;
+    /** Map a decision onto a durable grant: `always` or this-workspace `from`. */
+    workspaceAccessChoice(decision: ToolApprovalDecision): Exclude<WorkspaceAccessChoice, 'deny'>;
+    /** The typed error an agent loop throws once a deferred approval is durably checkpointed. */
+    deferred(requestId: string, toolCallId?: string): Error;
+    /**
+     * True when `error` carries the typed deferred-approval signal, by either
+     * shape (the typed `code`, or the `CapabilityError` reason a message-only
+     * boundary restores). Never throws, whatever `error` is.
+     */
+    isDeferred(error: unknown): boolean;
+}
+//# sourceMappingURL=approval-client.d.ts.map

package/dist/agents/approval/approval-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-client.d.ts","sourceRoot":"","sources":["../../../src/agents/approval/approval-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAMN,KAAK,UAAU,EAEf,MAAM,qBAAqB,CAAC;AAO7B,OAAO,EAIN,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC7F,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,wBAAwB,EAAgC,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAEtI,YAAY,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,CAUzE;AAED,6EAA6E;AAC7E,eAAO,MAAM,sBAAsB,EAAE,mBAEpC,CAAC;AA8BF,+EAA+E;AAC/E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,IAAI,KAAK,GAAG,mBAAmB,CAE/F;AAMD,qBAAa,kBAAkB;IAKlB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJpC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAuB;gBAEhC,OAAO,EAAE,UAAU;IAIhD,OAAO,IAAI,IAAI;IAIf;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,gBAAmC,EACzC,MAAM,GAAE,wBAA6B,GACnC,OAAO;IAqBV;;;;;;;;OAQG;IACG,WAAW,CAAC,OAAO,EACxB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,uBAAuB,GAC/B,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC;IA2B3C,gGAAgG;YAClF,WAAW;IAYzB,+FAA+F;YACjF,SAAS;IA+CvB,8EAA8E;IAC9E,qBAAqB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAQ7F,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,KAAK;IAIvD;;;;OAIG;IACH,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CAGnC"}

package/dist/agents/approval/approval-client.js

@@ -0,0 +1,284 @@
+/**
+ * The tools approval runtime, exposed as `ToolsClient.approval`.
+ *
+ * Everything an agent loop needs to gate a tool call lives here, behind the
+ * tools runtime client — callers resolve it through the runtime
+ * (`getVibesToolsClient(runtime)`) rather than importing loose policy functions:
+ *
+ *   - the approval POLICY (the default mode plus the signals a decision reads:
+ *     the descriptor-declared `requiresApproval` flag, a call-level approval
+ *     request, and an unresolved descriptor, which gates fail-closed);
+ *   - GATE RESOLUTION: a request's pure-data approval channel is reconstructed
+ *     into a live `ToolApprovalRuntime` from the `tools/approval-channel` kind of
+ *     the runtime that is EXECUTING the run — the exact sibling of
+ *     `resolveRequestToolProvider` for `request.toolIds`. FAIL-CLOSED: a named
+ *     channel that cannot be resolved here yields a deny-all gate that says why;
+ *   - the typed decisions: the durable workspace grant a decision selects, and
+ *     the deferred-approval error the loop throws after its required checkpoint.
+ */
+import { PendingApprovalStore } from "./store.js";
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { TOOL_APPROVAL_CHANNEL_KIND, ToolApprovalChannelDescriptorSchema } from '@vibesdotdev/ai-schemas/agents/approval/channel';
+import { TOOL_APPROVAL_DEFERRED_CODE, TOOL_APPROVAL_DEFERRED_REASON, ToolApprovalDeferredSignalSchema } from '@vibesdotdev/ai-schemas/agents/approval/types';
+/**
+ * Tool-call approval policy.
+ *
+ * Decides whether a tool call must pause for an explicit user decision before
+ * it executes, given the effective {@link ToolApprovalMode}. Under
+ * `'auto-approve-safe'` (the default) a tool gates when its descriptor declares
+ * `requiresApproval: true` (surfaced to the loop as
+ * {@link ApprovalDescriptorSignal.descriptorRequiresApproval}), when the call
+ * itself sets {@link ApprovalDescriptorSignal.callRequiresApproval}, or when
+ * the call's descriptor could not be resolved
+ * ({@link ApprovalDescriptorSignal.descriptorResolved} === false) — an
+ * unresolved descriptor gates fail-closed. No tool-name list is consulted.
+ *
+ * ## Rubric — what descriptors declare `requiresApproval` (work `5b6dbf60`)
+ *
+ * A descriptor declares `requiresApproval: true` when a single auto-approved
+ * call can cause an effect the user would want to authorize first:
+ *
+ *   - **Executes code / shell** (arbitrary command or code runs): `run-command`,
+ *     `sandbox-execute`, `execute-code`, `code-execution-submit`.
+ *   - **Writes / deletes files or source** in a real workspace: `file-write`,
+ *     `file-patch`, `git`, `codemod` (bulk rewrite). `workspace-fs` declares no
+ *     flag: in-scope reads/writes of a bound workspace run without a prompt;
+ *     the loop sets {@link ApprovalDescriptorSignal.callRequiresApproval}
+ *     when the call leaves granted workspace access.
+ *   - **Pushes to / acts on an external system** irreversibly: `forge-pr-create*`,
+ *     `forge-issue-create`, `forge-issue-comment`, `forge-pr-review-comment`,
+ *     `email`, `send_email` (alias `send-email`), `browser` / `desktop` (drives real UIs),
+ *     `api-request` / `fetch` (arbitrary outbound calls), `runbook`.
+ *   - **Spends money** (paid inference, sandbox minutes, billed API): sandbox /
+ *     billed external APIs declare `requiresApproval`. Core generation
+ *     primitives (`ai-generate`, `generate-image`, OCR) are reviewed auto-safe —
+ *     inference *is* the turn and is credit-bounded
+ *     (see studio `policy-coverage` REVIEWED_AUTO_SAFE).
+ *   - **Delegates** (re-enters the model in a child loop that can do all of the
+ *     above): `spawn-subagent`.
+ *
+ * A tool STAYS auto-safe when its writes are internal, reversible platform state
+ * with no money or external side effect — agent memory (`brain`, `awareness`,
+ * `presence`), session/scratchpad/todo state, search-index writes, knowledge
+ * items, and work-item CRUD (`vibes-work`). These are recorded, not gated. See
+ * `docs/audits/tui-followon/lane-b/LEDGER.md` for the per-tool decisions.
+ *
+ * The self-declared `requiresApproval: true` flag makes the rubric a STANDING
+ * contract: a new externally-mutating tool that sets the flag gates
+ * automatically, and the coverage test (`__tests__/policy-coverage.test.ts`)
+ * fails if an execute/destructive or `requiresApproval` tool is registered
+ * neither gated nor documented as a reviewed exception.
+ */
+/**
+ * The fail-closed gate. Denies every request, and SAYS WHY.
+ *
+ * Installed whenever a run SIGNALLED gating intent (it carried a channel
+ * descriptor) but the channel could not be resolved in this scope. A broken
+ * approval channel must never degrade into an open one.
+ *
+ * The `cause` is not decoration. Four very different failures — the kind isn't
+ * registered, the channel id doesn't resolve here, the channel declined the
+ * correlation, the channel threw — used to collapse into one sentence that said
+ * only "unavailable". That sentence reaches the model, which relays it to the
+ * person as though a human had refused: a user was told the approval "was
+ * denied on this side" when nothing had been denied and no approval had ever
+ * been requested. An opaque fail-closed gate is still a
+ * correct gate and a useless diagnostic. Name the cause here and it travels the
+ * whole way out — tool result, card, and log.
+ */
+export function denyingApprovalRuntime(cause) {
+    return {
+        async requestApproval(request) {
+            return {
+                approved: false,
+                origin: 'unavailable',
+                reason: `Approval channel unavailable for '${request.toolName}' — denied (fail-closed): ${cause}`
+            };
+        }
+    };
+}
+/** The causeless fail-closed gate. Prefer {@link denyingApprovalRuntime}. */
+export const denyAllApprovalRuntime = denyingApprovalRuntime('no cause recorded');
+/**
+ * Thrown by an agent loop after it durably checkpointed a run whose approval was
+ * DEFERRED. Carries the typed `code` that `ToolApprovalDeferredSignalSchema`
+ * recognises, so a surface detects it by type — in-process, or on the error it
+ * rebuilds from a wire frame that forwarded the code.
+ */
+class ToolApprovalDeferredError extends CapabilityError {
+    requestId;
+    toolCallId;
+    constructor(requestId, toolCallId) {
+        // The same typed reason a message-only boundary restores (worker executor);
+        // the message keeps the `TOOL_APPROVAL_DEFERRED:<requestId>` wire form.
+        super(`${TOOL_APPROVAL_DEFERRED_CODE}:${requestId}`, 'CONFLICT', {
+            reason: TOOL_APPROVAL_DEFERRED_REASON,
+            retryable: false,
+            details: { legacyCode: TOOL_APPROVAL_DEFERRED_CODE }
+        });
+        this.requestId = requestId;
+        this.toolCallId = toolCallId;
+        this.name = 'ToolApprovalDeferredError';
+    }
+}
+const ApprovalGateMethodsSchema = z.looseObject({ requestApproval: z.function() });
+const ApprovalChannelMethodsSchema = z.looseObject({ createRuntime: z.function() });
+/** Whether `value` is a live approval gate: it can be asked for a decision. */
+export function isToolApprovalRuntime(value) {
+    return ApprovalGateMethodsSchema.safeParse(value).success;
+}
+function isApprovalChannel(value) {
+    return ApprovalChannelMethodsSchema.safeParse(value).success;
+}
+export class ToolApprovalClient {
+    runtime;
+    pending;
+    /** The mode assumed when a run carries no explicit `toolApprovalMode`. */
+    defaultMode = 'auto-approve-safe';
+    constructor(runtime) {
+        this.runtime = runtime;
+        this.pending = new PendingApprovalStore(runtime);
+    }
+    dispose() {
+        this.pending.dispose();
+    }
+    /**
+     * True when executing `toolName` under `mode` must first obtain approval.
+     *
+     * - `'always-approve'` → never ask (auto-approve everything).
+     * - `'always-ask'` → ask for every tool call.
+     * - `'batch-approve'` → ask (no batch UI exists yet; fail toward asking).
+     * - `'auto-approve-safe'` (default) → ask when the descriptor self-declares
+     *   `requiresApproval: true`, when the call sets
+     *   {@link ApprovalDescriptorSignal.callRequiresApproval}, or when the call's
+     *   descriptor could not be resolved
+     *   ({@link ApprovalDescriptorSignal.descriptorResolved} === false,
+     *   fail-closed). A resolved tool with no flag runs without asking.
+     * - `'ask-when-declared'` → ask only for a tool whose descriptor self-declares
+     *   `requiresApproval: true` (the agent's own `request-approval`) OR a call that
+     *   sets `callRequiresApproval` (access outside the workspace). Unresolved
+     *   descriptors run without asking: the agent decides what to ask about.
+     */
+    requiresApproval(toolName, mode = this.defaultMode, signal = {}) {
+        switch (mode) {
+            case 'always-approve':
+                return false;
+            case 'always-ask':
+            case 'batch-approve':
+                return true;
+            case 'ask-on-request':
+                return toolName === 'request-approval' || signal.callRequiresApproval === true;
+            case 'ask-when-declared':
+                return signal.descriptorRequiresApproval === true || signal.callRequiresApproval === true;
+            case 'auto-approve-safe':
+            default:
+                return (signal.descriptorRequiresApproval === true ||
+                    signal.callRequiresApproval === true ||
+                    signal.descriptorResolved === false);
+        }
+    }
+    /**
+     * Reconstruct the live approval gate for a run.
+     *
+     * @param channel  The request's `approval` descriptor. Absent → ungated run
+     *                 (no gating intent was signalled), so `undefined` is returned.
+     *                 Anything else is gating intent: a malformed descriptor, an
+     *                 unregistered kind, an unresolvable or declining channel, or a
+     *                 throwing one all yield the fail-closed deny gate.
+     */
+    async resolveGate(channel, options) {
+        // No channel → no gating intent → ungated. This is the ONLY ungated path,
+        // and it is explicit at the call site rather than a silently-dropped function.
+        if (channel === undefined)
+            return undefined;
+        const runtime = this.runtime;
+        const logger = getLogger('tools.agents.approval-runtime', runtime);
+        // A malformed channel is gating intent we cannot honour → deny, never ignore.
+        const parsed = ToolApprovalChannelDescriptorSchema.safeParse(channel);
+        if (!parsed.success) {
+            logger.warn('malformed approval channel descriptor — denying (fail-closed)', { channel });
+            return denyingApprovalRuntime('the request carried a malformed approval channel descriptor');
+        }
+        const descriptor = parsed.data;
+        const attempt = await this.attemptGate(descriptor, options);
+        if ('gate' in attempt)
+            return attempt.gate;
+        // A channel that THROWS is a broken gate, not an absent one.
+        logger.warn('approval channel resolution failed — denying (fail-closed)', {
+            channel: descriptor.channel,
+            failure: attempt.failure
+        });
+        return denyingApprovalRuntime(`channel '${descriptor.channel}' threw while building (${attempt.failure.code ?? attempt.failure.name})`);
+    }
+    /** Build the channel's gate, or carry the failure of a channel that threw while building it. */
+    async attemptGate(descriptor, options) {
+        try {
+            return { gate: await this.buildGate(descriptor, options) };
+        }
+        catch (error) {
+            const failed = { failure: valueFreeFailure(CaughtFailureSchema.parse(error)) };
+            return failed;
+        }
+    }
+    /** The channel's gate, or the fail-closed deny gate when the channel is absent or declines. */
+    async buildGate(descriptor, options) {
+        const runtime = this.runtime;
+        const logger = getLogger('tools.agents.approval-runtime', runtime);
+        if (!runtime.hasKind(TOOL_APPROVAL_CHANNEL_KIND)) {
+            logger.warn(`approval channel '${descriptor.channel}' requested but the ${TOOL_APPROVAL_CHANNEL_KIND} ` +
+                `kind is not registered in this scope — denying (fail-closed). Compose the tools plugin ` +
+                `and register a channel impl for this surface.`);
+            return denyingApprovalRuntime(`the '${TOOL_APPROVAL_CHANNEL_KIND}' kind is not registered in this scope (compose the tools plugin)`);
+        }
+        const impl = await runtime
+            .query(TOOL_APPROVAL_CHANNEL_KIND)
+            .withId(descriptor.channel)
+            .enabled()
+            .resolve();
+        if (!isApprovalChannel(impl)) {
+            logger.warn(`approval channel '${descriptor.channel}' does not resolve in this scope — denying (fail-closed)`);
+            return denyingApprovalRuntime(`no impl for channel '${descriptor.channel}' resolves in this scope`);
+        }
+        const correlation = descriptor.correlation ?? {};
+        const gate = await impl.createRuntime(correlation, options);
+        if (!isToolApprovalRuntime(gate)) {
+            logger.warn(`approval channel '${descriptor.channel}' declined this run — denying (fail-closed)`, { correlationKeys: Object.keys(correlation).sort() });
+            return denyingApprovalRuntime(`channel '${descriptor.channel}' declined this run (correlation keys: ` +
+                `${Object.keys(correlation).sort().join(', ') || 'none'})`);
+        }
+        return gate;
+    }
+    /** Map a decision onto a durable grant: `always` or this-workspace `from`. */
+    workspaceAccessChoice(decision) {
+        if (decision.workspaceAccessChoice === 'always' || decision.workspaceAccessChoice === 'from') {
+            return decision.workspaceAccessChoice;
+        }
+        const reason = decision.response?.reason ?? decision.reason;
+        return reason === 'always' ? 'always' : 'from';
+    }
+    /** The typed error an agent loop throws once a deferred approval is durably checkpointed. */
+    deferred(requestId, toolCallId) {
+        return new ToolApprovalDeferredError(requestId, toolCallId);
+    }
+    /**
+     * True when `error` carries the typed deferred-approval signal, by either
+     * shape (the typed `code`, or the `CapabilityError` reason a message-only
+     * boundary restores). Never throws, whatever `error` is.
+     */
+    isDeferred(error) {
+        return readDeferred(CaughtFailureSchema.parse(error)).deferred;
+    }
+}
+/** A failure whose own properties cannot be read is not the signal, and keeps only its value-free facts. */
+function readDeferred(failure) {
+    try {
+        const carrier = failure instanceof Error ? failure : failure.value;
+        return { deferred: ToolApprovalDeferredSignalSchema.safeParse(carrier).success };
+    }
+    catch (unreadable) {
+        return { deferred: false, unreadable: valueFreeFailure(CaughtFailureSchema.parse(unreadable)) };
+    }
+}
+//# sourceMappingURL=approval-client.js.map

package/dist/agents/approval/approval-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-client.js","sourceRoot":"","sources":["../../../src/agents/approval/approval-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAKhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EACN,0BAA0B,EAC1B,mCAAmC,EAEnC,MAAM,iDAAiD,CAAC;AACzD,OAAO,EACN,2BAA2B,EAC3B,6BAA6B,EAC7B,gCAAgC,EAGhC,MAAM,+CAA+C,CAAC;AAOvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IACnD,OAAO;QACN,KAAK,CAAC,eAAe,CAAC,OAAO;YAC5B,OAAO;gBACN,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,aAAa;gBACrB,MAAM,EAAE,qCAAqC,OAAO,CAAC,QAAQ,6BAA6B,KAAK,EAAE;aACjG,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,MAAM,sBAAsB,GAAwB,sBAAsB,CAChF,mBAAmB,CACnB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,yBAA0B,SAAQ,eAAe;IAE5C;IACA;IAFV,YACU,SAAiB,EACjB,UAAmB;QAE5B,4EAA4E;QAC5E,wEAAwE;QACxE,KAAK,CAAC,GAAG,2BAA2B,IAAI,SAAS,EAAE,EAAE,UAAU,EAAE;YAChE,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,UAAU,EAAE,2BAA2B,EAAE;SACpD,CAAC,CAAC;QATM,cAAS,GAAT,SAAS,CAAQ;QACjB,eAAU,GAAV,UAAU,CAAS;QAS5B,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IACzC,CAAC;CACD;AAKD,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEpF,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CAAQ,KAAY;IACxD,OAAO,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CAAQ,KAAY;IAC7C,OAAO,4BAA4B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC;AAED,MAAM,OAAO,kBAAkB;IAKD;IAJpB,OAAO,CAAuB;IACvC,0EAA0E;IACjE,WAAW,GAAqB,mBAAmB,CAAC;IAE7D,YAA6B,OAAmB;QAAnB,YAAO,GAAP,OAAO,CAAY;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC;IAED,OAAO;QACN,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,gBAAgB,CACf,QAAgB,EAChB,OAAyB,IAAI,CAAC,WAAW,EACzC,SAAmC,EAAE;QAErC,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,gBAAgB;gBACpB,OAAO,KAAK,CAAC;YACd,KAAK,YAAY,CAAC;YAClB,KAAK,eAAe;gBACnB,OAAO,IAAI,CAAC;YACb,KAAK,gBAAgB;gBACpB,OAAO,QAAQ,KAAK,kBAAkB,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,CAAC;YAChF,KAAK,mBAAmB;gBACvB,OAAO,MAAM,CAAC,0BAA0B,KAAK,IAAI,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,CAAC;YAC3F,KAAK,mBAAmB,CAAC;YACzB;gBACC,OAAO,CACN,MAAM,CAAC,0BAA0B,KAAK,IAAI;oBAC1C,MAAM,CAAC,oBAAoB,KAAK,IAAI;oBACpC,MAAM,CAAC,kBAAkB,KAAK,KAAK,CACnC,CAAC;QACJ,CAAC;IACF,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAChB,OAAgB,EAChB,OAAiC;QAEjC,0EAA0E;QAC1E,+EAA+E;QAC/E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;QAEnE,8EAA8E;QAC9E,MAAM,MAAM,GAAG,mCAAmC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1F,OAAO,sBAAsB,CAAC,6DAA6D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;QAE/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,MAAM,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC;QAC3C,6DAA6D;QAC7D,MAAM,CAAC,IAAI,CAAC,4DAA4D,EAAE;YACzE,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC,CAAC;QACH,OAAO,sBAAsB,CAC5B,YAAY,UAAU,CAAC,OAAO,2BAA2B,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,GAAG,CACxG,CAAC;IACH,CAAC;IAED,gGAAgG;IACxF,KAAK,CAAC,WAAW,CACxB,UAAyC,EACzC,OAA4C;QAE5C,IAAI,CAAC;YACJ,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,MAAM,GAAgB,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5F,OAAO,MAAM,CAAC;QACf,CAAC;IACF,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,SAAS,CACtB,UAAyC,EACzC,OAA4C;QAE5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,IAAI,CACV,qBAAqB,UAAU,CAAC,OAAO,uBAAuB,0BAA0B,GAAG;gBAC1F,yFAAyF;gBACzF,+CAA+C,CAChD,CAAC;YACF,OAAO,sBAAsB,CAC5B,QAAQ,0BAA0B,mEAAmE,CACrG,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO;aACxB,KAAK,CAAkD,0BAA0B,CAAC;aAClF,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;aAC1B,OAAO,EAAE;aACT,OAAO,EAAE,CAAC;QAEZ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACV,qBAAqB,UAAU,CAAC,OAAO,0DAA0D,CACjG,CAAC;YACF,OAAO,sBAAsB,CAC5B,wBAAwB,UAAU,CAAC,OAAO,0BAA0B,CACpE,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACV,qBAAqB,UAAU,CAAC,OAAO,6CAA6C,EACpF,EAAE,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE,CACpD,CAAC;YACF,OAAO,sBAAsB,CAC5B,YAAY,UAAU,CAAC,OAAO,yCAAyC;gBACtE,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAC3D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACb,CAAC;IAED,8EAA8E;IAC9E,qBAAqB,CAAC,QAA8B;QACnD,IAAI,QAAQ,CAAC,qBAAqB,KAAK,QAAQ,IAAI,QAAQ,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YAC9F,OAAO,QAAQ,CAAC,qBAAqB,CAAC;QACvC,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC;QAC5D,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,CAAC;IAED,6FAA6F;IAC7F,QAAQ,CAAC,SAAiB,EAAE,UAAmB;QAC9C,OAAO,IAAI,yBAAyB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,KAAc;QACxB,OAAO,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAChE,CAAC;CACD;AASD,4GAA4G;AAC5G,SAAS,YAAY,CAAC,OAAsB;IAC3C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,EAAE,QAAQ,EAAE,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACrB,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;IACjG,CAAC;AACF,CAAC"}

package/dist/agents/approval/channel.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Tool-approval CHANNEL — the serializable contract for "where do I ask?".
+ *
+ * WHY THIS EXISTS (and why the alternatives were wrong).
+ *
+ * A {@link ToolApprovalRuntime} is a LIVE FUNCTION. It cannot cross a JSON wire,
+ * a queue, or a process boundary. Historically that one fact deformed everything
+ * downstream of it:
+ *
+ *   - `generation.api-sse` REFUSED agent+tool runs outright (the gate could not
+ *     be serialized, so it would not risk running gated tools ungated);
+ *   - `generation.worker` short-circuited agent runs to in-process execution,
+ *     so agent loops never actually rode a worker;
+ *   - an in-process token registry was invented so the gate could survive the
+ *     tool-execution seam WITHIN one process (and failed closed across any
+ *     boundary, because the registry map is per-process);
+ *   - chat-web grew a bespoke deny-all planner + remote channel to fake the hop.
+ *
+ * Four mechanisms, one concept, and one real security bug (a gate that was
+ * silently inert on one path until it was patched inside `LoopBackedAgent`).
+ *
+ * THE FIX is to make approval symmetric with tools. A generation request already
+ * carries `toolIds` (pure data) and the EXECUTING side reconstructs a live
+ * `ToolProvider` from its own runtime. Approval now works exactly the same way:
+ * the request carries a {@link ToolApprovalChannelDescriptor} (pure data) and the
+ * executing side reconstructs a live {@link ToolApprovalRuntime} from ITS runtime.
+ *
+ *   request.toolIds  --(resolveRequestToolProvider)--> live ToolProvider
+ *   request.approval --(ToolsClient.approval.resolveGate)--> live ToolApprovalRuntime
+ *
+ * The consequence that makes this inevitable rather than merely tidy: the SAME
+ * descriptor resolves differently depending on where you stand. A request that
+ * says `{ channel: 'chat-room', correlation: { roomId, runId, userId } }` means
+ * "ask the human in this chat room". chat-web resolves that against its own
+ * approval store (it OWNS the store). ai-web resolves the same descriptor to an
+ * HTTP-backed gate that asks chat-web. Neither the caller nor the agent loop
+ * knows or cares which — and no live function is ever placed on a wire.
+ *
+ * Fail-closed is the default: a descriptor naming a channel that does not
+ * resolve in this scope yields a deny-all gate, never an open one.
+ */
+export type { ToolApprovalChannelInterface, ToolApprovalGateOptions } from '../contracts/approval-types.ts';
+//# sourceMappingURL=channel.d.ts.map

package/dist/agents/approval/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../../src/agents/approval/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,YAAY,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC"}

package/dist/agents/approval/channel.js

@@ -0,0 +1,43 @@
+/**
+ * Tool-approval CHANNEL — the serializable contract for "where do I ask?".
+ *
+ * WHY THIS EXISTS (and why the alternatives were wrong).
+ *
+ * A {@link ToolApprovalRuntime} is a LIVE FUNCTION. It cannot cross a JSON wire,
+ * a queue, or a process boundary. Historically that one fact deformed everything
+ * downstream of it:
+ *
+ *   - `generation.api-sse` REFUSED agent+tool runs outright (the gate could not
+ *     be serialized, so it would not risk running gated tools ungated);
+ *   - `generation.worker` short-circuited agent runs to in-process execution,
+ *     so agent loops never actually rode a worker;
+ *   - an in-process token registry was invented so the gate could survive the
+ *     tool-execution seam WITHIN one process (and failed closed across any
+ *     boundary, because the registry map is per-process);
+ *   - chat-web grew a bespoke deny-all planner + remote channel to fake the hop.
+ *
+ * Four mechanisms, one concept, and one real security bug (a gate that was
+ * silently inert on one path until it was patched inside `LoopBackedAgent`).
+ *
+ * THE FIX is to make approval symmetric with tools. A generation request already
+ * carries `toolIds` (pure data) and the EXECUTING side reconstructs a live
+ * `ToolProvider` from its own runtime. Approval now works exactly the same way:
+ * the request carries a {@link ToolApprovalChannelDescriptor} (pure data) and the
+ * executing side reconstructs a live {@link ToolApprovalRuntime} from ITS runtime.
+ *
+ *   request.toolIds  --(resolveRequestToolProvider)--> live ToolProvider
+ *   request.approval --(ToolsClient.approval.resolveGate)--> live ToolApprovalRuntime
+ *
+ * The consequence that makes this inevitable rather than merely tidy: the SAME
+ * descriptor resolves differently depending on where you stand. A request that
+ * says `{ channel: 'chat-room', correlation: { roomId, runId, userId } }` means
+ * "ask the human in this chat room". chat-web resolves that against its own
+ * approval store (it OWNS the store). ai-web resolves the same descriptor to an
+ * HTTP-backed gate that asks chat-web. Neither the caller nor the agent loop
+ * knows or cares which — and no live function is ever placed on a wire.
+ *
+ * Fail-closed is the default: a descriptor naming a channel that does not
+ * resolve in this scope yields a deny-all gate, never an open one.
+ */
+export {};
+//# sourceMappingURL=channel.js.map

package/dist/agents/approval/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../../src/agents/approval/channel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG"}

package/dist/agents/approval/events.d.ts

@@ -0,0 +1,2 @@
+export * from '@vibesdotdev/ai-schemas/agents/approval/events';
+//# sourceMappingURL=events.d.ts.map

package/dist/agents/approval/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/agents/approval/events.ts"],"names":[],"mappings":"AACA,cAAc,gDAAgD,CAAC"}

package/dist/agents/approval/events.js

@@ -0,0 +1,3 @@
+// Re-export shim — moved to @vibesdotdev/ai-schemas (contract floor).
+export * from '@vibesdotdev/ai-schemas/agents/approval/events';
+//# sourceMappingURL=events.js.map

package/dist/agents/approval/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../src/agents/approval/events.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,cAAc,gDAAgD,CAAC"}

package/dist/agents/approval/index.d.ts

@@ -0,0 +1,8 @@
+export { approvalRequestSchema, approvalResponseSchema } from './schemas.ts';
+export type { ApprovalRequest, ApprovalResponse } from './schemas.ts';
+export { toolApprovalRequiredEventSchema, toolApprovalGrantedEventSchema, toolApprovalDeniedEventSchema, toolApprovalTimeoutEventSchema } from './events.ts';
+export type { ToolApprovalRequiredEvent, ToolApprovalGrantedEvent, ToolApprovalDeniedEvent, ToolApprovalTimeoutEvent } from './events.ts';
+export { registerPendingApproval, resolvePendingApproval, cancelPendingApproval, listPendingApprovals, clearPendingApprovals } from './store.ts';
+export type { RegisterApprovalOptions } from './store.ts';
+export type { ToolApprovalRequest, ToolApprovalDecision } from './types.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/agents/approval/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/agents/approval/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC7E,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEtE,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,EAC9B,MAAM,aAAa,CAAC;AACrB,YAAY,EACX,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/agents/approval/index.js

@@ -0,0 +1,4 @@
+export { approvalRequestSchema, approvalResponseSchema } from "./schemas.js";
+export { toolApprovalRequiredEventSchema, toolApprovalGrantedEventSchema, toolApprovalDeniedEventSchema, toolApprovalTimeoutEventSchema } from "./events.js";
+export { registerPendingApproval, resolvePendingApproval, cancelPendingApproval, listPendingApprovals, clearPendingApprovals } from "./store.js";
+//# sourceMappingURL=index.js.map

package/dist/agents/approval/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/agents/approval/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAG7E,OAAO,EACN,+BAA+B,EAC/B,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,EAC9B,MAAM,aAAa,CAAC;AAQrB,OAAO,EACN,uBAAuB,EACvB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,MAAM,YAAY,CAAC"}

package/dist/agents/approval/schemas.d.ts

@@ -0,0 +1,2 @@
+export * from '@vibesdotdev/ai-schemas/agents/approval/schemas';
+//# sourceMappingURL=schemas.d.ts.map

package/dist/agents/approval/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/agents/approval/schemas.ts"],"names":[],"mappings":"AACA,cAAc,iDAAiD,CAAC"}

package/dist/agents/approval/schemas.js

@@ -0,0 +1,3 @@
+// Re-export shim — moved to @vibesdotdev/ai-schemas (contract floor).
+export * from '@vibesdotdev/ai-schemas/agents/approval/schemas';
+//# sourceMappingURL=schemas.js.map

package/dist/agents/approval/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/agents/approval/schemas.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,cAAc,iDAAiD,CAAC"}