@weave-kit/engine 0.1.0

package/dist/core/storage/report.js

@@ -0,0 +1,189 @@
+import { FIELD_TYPES } from '../types/values.js';
+import { buildExpectedTable } from './diff.js';
+import { pgTypeMatches } from './map.js';
+/** readable live column type (normalizes `information_schema` spellings + numeric precision) */
+function displayActualType(col) {
+    const base = col.dataType.toUpperCase();
+    if (base === 'CHARACTER VARYING')
+        return 'VARCHAR';
+    if (base === 'TIMESTAMP WITH TIME ZONE')
+        return 'TIMESTAMPTZ';
+    if (base === 'ARRAY' || col.udtName?.startsWith('_') === true) {
+        return `${(col.udtName ?? '').replace(/^_/, '').toUpperCase()}[]`;
+    }
+    if (base === 'NUMERIC' || base === 'DECIMAL') {
+        if (col.numericPrecision != null) {
+            return col.numericScale != null ? `NUMERIC(${col.numericPrecision},${col.numericScale})` : `NUMERIC(${col.numericPrecision})`;
+        }
+        return 'NUMERIC';
+    }
+    return base;
+}
+/** schema-side type label (relation targets shown explicitly; enums carry their option count) */
+function schemaTypeOf(field, fk) {
+    switch (field.type) {
+        case FIELD_TYPES.RELATION:
+        case FIELD_TYPES.PERSON:
+        case FIELD_TYPES.DEPARTMENT:
+            return fk === undefined ? field.type : `${field.type} → ${fk.refTable}.${fk.refColumn}`;
+        case FIELD_TYPES.MULTI_RELATION:
+            return `${field.type} → ${field.target}`;
+        case FIELD_TYPES.ENUM:
+            return `${field.type}[${field.options.length}]${field.multiple === true ? '[]' : ''}`;
+        case FIELD_TYPES.IMAGE:
+            return field.multiple === true ? `${field.type}[]` : field.type;
+        default:
+            return field.type;
+    }
+}
+/**
+ * Build the schema ↔ table mapping report for every object in `defs`, drawn
+ * against the live `actual` map. Tables absent from `actual` are reported with
+ * all columns `missing` (what `weave migrate` would CREATE).
+ */
+export function buildMappingReport(defs, actual) {
+    const defsMap = new Map(defs.map((def) => [def.name, def]));
+    const tables = [];
+    for (const def of [...defs].sort((a, b) => a.name.localeCompare(b.name))) {
+        const expected = buildExpectedTable(def, defsMap);
+        const actualTable = actual.get(def.name);
+        const warnings = [];
+        const fieldByName = new Map(def.fields.map((field) => [field.name, field]));
+        const indexByName = new Map(expected.indexes.map((idx) => [idx.name, idx]));
+        const columns = [];
+        const covered = new Set();
+        for (const col of expected.columns) {
+            covered.add(col.name);
+            const field = fieldByName.get(col.name);
+            const fk = expected.fks.find((f) => f.column === col.name);
+            const index = indexByName.get(`${def.name}_${col.name}_idx`);
+            const actualCol = actualTable?.columns.find((c) => c.name === col.name);
+            let status = 'missing';
+            let actualInfo;
+            if (actualCol !== undefined) {
+                const typeMatch = pgTypeMatches(col.type, actualCol);
+                const nullableMatch = col.notNull === !actualCol.isNullable;
+                status = !typeMatch ? 'type' : !nullableMatch ? 'nullable' : 'ok';
+                actualInfo = {
+                    pgType: displayActualType(actualCol),
+                    notNull: !actualCol.isNullable,
+                    default: actualCol.columnDefault,
+                    typeMatch,
+                    nullableMatch,
+                };
+            }
+            columns.push({
+                field: col.name,
+                schemaType: field === undefined ? 'auto' : schemaTypeOf(field, fk),
+                column: col.name,
+                pgType: col.type,
+                notNull: col.notNull,
+                primary: col.primary,
+                unique: col.unique,
+                default: col.default,
+                fk: fk === undefined ? undefined : { table: fk.refTable, column: fk.refColumn, onDelete: fk.onDelete },
+                index: index === undefined ? undefined : { name: index.name, method: index.method },
+                auto: field === undefined ? true : undefined,
+                actual: actualInfo,
+                status,
+            });
+        }
+        if (actualTable !== undefined) {
+            for (const actualCol of actualTable.columns) {
+                if (covered.has(actualCol.name))
+                    continue;
+                columns.push({
+                    field: '-',
+                    schemaType: '-',
+                    column: actualCol.name,
+                    pgType: displayActualType(actualCol),
+                    notNull: !actualCol.isNullable,
+                    primary: actualTable.pk.includes(actualCol.name),
+                    unique: actualTable.uniqueColumns?.includes(actualCol.name) === true,
+                    actual: {
+                        pgType: displayActualType(actualCol),
+                        notNull: !actualCol.isNullable,
+                        default: actualCol.columnDefault,
+                        typeMatch: true,
+                        nullableMatch: true,
+                    },
+                    status: 'extra',
+                });
+            }
+        }
+        const indexes = expected.indexes.map((idx) => ({
+            name: idx.name,
+            method: idx.method,
+            columns: [...idx.columns],
+            present: actualTable?.indexNames.includes(idx.name) === true,
+        }));
+        const fks = expected.fks.map((fk) => ({
+            ...fk,
+            present: actualTable?.fks.some((a) => a.column === fk.column && a.refTable === fk.refTable) === true,
+        }));
+        const details = def.fields
+            .filter((field) => field.type === FIELD_TYPES.DETAILS)
+            .map((field) => ({ field: field.name, target: field.target }));
+        const rls = actualTable === undefined
+            ? undefined
+            : {
+                enabled: actualTable.rlsEnabled === true,
+                owner: actualTable.owner ?? '',
+                policies: [...(actualTable.rlsPolicies ?? [])].sort(),
+                selectGrantedTo: [...(actualTable.selectGrantedTo ?? [])].sort(),
+            };
+        const drift = actualTable === undefined ||
+            columns.some((c) => c.status !== 'ok' && c.status !== 'extra') ||
+            indexes.some((idx) => !idx.present) ||
+            fks.some((fk) => !fk.present);
+        if (actualTable === undefined) {
+            warnings.push(`table "${def.name}" does not exist yet (weave migrate would CREATE it)`);
+        }
+        tables.push({
+            object: def.name,
+            table: def.name,
+            label: def.label,
+            exists: actualTable !== undefined,
+            columns,
+            indexes,
+            fks,
+            details,
+            rls,
+            warnings,
+            drift,
+        });
+    }
+    const totals = {
+        objects: tables.length,
+        tablesMissing: 0,
+        columns: 0,
+        columnsOk: 0,
+        columnsMissing: 0,
+        columnsType: 0,
+        columnsNullable: 0,
+        columnsExtra: 0,
+        indexDrift: 0,
+        fkDrift: 0,
+    };
+    for (const table of tables) {
+        if (!table.exists)
+            totals.tablesMissing += 1;
+        totals.indexDrift += table.indexes.filter((idx) => !idx.present).length;
+        totals.fkDrift += table.fks.filter((fk) => !fk.present).length;
+        for (const col of table.columns) {
+            totals.columns += 1;
+            if (col.status === 'ok')
+                totals.columnsOk += 1;
+            else if (col.status === 'missing')
+                totals.columnsMissing += 1;
+            else if (col.status === 'type')
+                totals.columnsType += 1;
+            else if (col.status === 'nullable')
+                totals.columnsNullable += 1;
+            else
+                totals.columnsExtra += 1;
+        }
+    }
+    return { tables, totals };
+}
+//# sourceMappingURL=report.js.map

package/dist/core/storage/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/core/storage/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAG/C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuGzC,gGAAgG;AAChG,SAAS,iBAAiB,CAAC,GAAiB;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,IAAI,KAAK,mBAAmB;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,aAAa,CAAC;IAC9D,IAAI,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC;IACpE,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,gBAAgB,IAAI,IAAI,EAAE,CAAC;YACjC,OAAO,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,gBAAgB,GAAG,CAAC;QAChI,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iGAAiG;AACjG,SAAS,YAAY,CAAC,KAAsB,EAAE,EAA0B;IACtE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,QAAQ,CAAC;QAC1B,KAAK,WAAW,CAAC,MAAM,CAAC;QACxB,KAAK,WAAW,CAAC,UAAU;YACzB,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;QAC1F,KAAK,WAAW,CAAC,cAAc;YAC7B,OAAO,GAAG,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3C,KAAK,WAAW,CAAC,IAAI;YACnB,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACxF,KAAK,WAAW,CAAC,KAAK;YACpB,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAClE;YACE,OAAO,KAAK,CAAC,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAiC,EACjC,MAAwC;IAExC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAmB,EAAE,CAAC;IAElC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAoB,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;YAExE,IAAI,MAAM,GAAwB,SAAS,CAAC;YAC5C,IAAI,UAAmC,CAAC;YACxC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACrD,MAAM,aAAa,GAAG,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;gBAC5D,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClE,UAAU,GAAG;oBACX,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC;oBACpC,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU;oBAC9B,OAAO,EAAE,SAAS,CAAC,aAAa;oBAChC,SAAS;oBACT,aAAa;iBACd,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,GAAG,CAAC,IAAI;gBACf,UAAU,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC;gBAClE,MAAM,EAAE,GAAG,CAAC,IAAI;gBAChB,MAAM,EAAE,GAAG,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,EAAE,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE;gBACtG,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;gBACnF,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC5C,MAAM,EAAE,UAAU;gBAClB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1C,OAAO,CAAC,IAAI,CAAC;oBACX,KAAK,EAAE,GAAG;oBACV,UAAU,EAAE,GAAG;oBACf,MAAM,EAAE,SAAS,CAAC,IAAI;oBACtB,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC;oBACpC,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU;oBAC9B,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC;oBAChD,MAAM,EAAE,WAAW,CAAC,aAAa,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI;oBACpE,MAAM,EAAE;wBACN,MAAM,EAAE,iBAAiB,CAAC,SAAS,CAAC;wBACpC,OAAO,EAAE,CAAC,SAAS,CAAC,UAAU;wBAC9B,OAAO,EAAE,SAAS,CAAC,aAAa;wBAChC,SAAS,EAAE,IAAI;wBACf,aAAa,EAAE,IAAI;qBACpB;oBACD,MAAM,EAAE,OAAO;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAmB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7D,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;YACzB,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;SAC7D,CAAC,CAAC,CAAC;QACJ,MAAM,GAAG,GAAgB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACjD,GAAG,EAAE;YACL,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI;SACrG,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM;aACvB,MAAM,CAAC,CAAC,KAAK,EAAyD,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,OAAO,CAAC;aAC5G,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAEjE,MAAM,GAAG,GACP,WAAW,KAAK,SAAS;YACvB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,OAAO,EAAE,WAAW,CAAC,UAAU,KAAK,IAAI;gBACxC,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,EAAE;gBAC9B,QAAQ,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;gBACrD,eAAe,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;aACjE,CAAC;QAER,MAAM,KAAK,GACT,WAAW,KAAK,SAAS;YACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAEhC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACV,MAAM,EAAE,GAAG,CAAC,IAAI;YAChB,KAAK,EAAE,GAAG,CAAC,IAAI;YACf,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,MAAM,EAAE,WAAW,KAAK,SAAS;YACjC,OAAO;YACP,OAAO;YACP,GAAG;YACH,OAAO;YACP,GAAG;YACH,QAAQ;YACR,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAkB;QAC5B,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;QACV,SAAS,EAAE,CAAC;QACZ,cAAc,EAAE,CAAC;QACjB,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,CAAC;QAClB,YAAY,EAAE,CAAC;QACf,UAAU,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;KACX,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QACxE,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC/D,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;YACpB,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;gBAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;iBAC1C,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,cAAc,IAAI,CAAC,CAAC;iBACzD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;iBACnD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU;gBAAE,MAAM,CAAC,eAAe,IAAI,CAAC,CAAC;;gBAC3D,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC"}

package/dist/core/tools/approvals-backend.d.ts

@@ -0,0 +1,9 @@
+import type { ApprovalsBackend } from './types.js';
+/**
+ * In-memory `ApprovalsBackend` (tests / single-process default). Pure core —
+ * no I/O, keeps "disabled = not imported = zero overhead" for the persisted
+ * route. Honors the full `ApprovalListFilter` (status/action/actorKey/from/to/
+ * limit/offset/sort) so it behaves like the PG store for unit tests.
+ */
+export declare function createMemoryApprovalsBackend(): ApprovalsBackend;
+//# sourceMappingURL=approvals-backend.d.ts.map

package/dist/core/tools/approvals-backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-backend.d.ts","sourceRoot":"","sources":["../../../src/core/tools/approvals-backend.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,gBAAgB,EAAmB,MAAM,YAAY,CAAC;AAExF;;;;;GAKG;AACH,wBAAgB,4BAA4B,IAAI,gBAAgB,CA4C/D"}

package/dist/core/tools/approvals-backend.js

@@ -0,0 +1,58 @@
+/**
+ * In-memory `ApprovalsBackend` (tests / single-process default). Pure core —
+ * no I/O, keeps "disabled = not imported = zero overhead" for the persisted
+ * route. Honors the full `ApprovalListFilter` (status/action/actorKey/from/to/
+ * limit/offset/sort) so it behaves like the PG store for unit tests.
+ */
+export function createMemoryApprovalsBackend() {
+    const store = new Map();
+    const matches = (entry, filter) => {
+        if (filter.status !== undefined && entry.status !== filter.status)
+            return false;
+        if (filter.action !== undefined && entry.action !== filter.action)
+            return false;
+        if (filter.actorKey !== undefined && entry.actorKey !== filter.actorKey)
+            return false;
+        if (filter.from !== undefined && entry.createdAt < filter.from)
+            return false;
+        if (filter.to !== undefined && entry.createdAt > filter.to)
+            return false;
+        return true;
+    };
+    return {
+        async list(filter = {}) {
+            const entries = [...store.values()].filter((entry) => matches(entry, filter));
+            const field = filter.sort?.field ?? 'createdAt';
+            const order = filter.sort?.order === 'DESC' ? -1 : 1;
+            entries.sort((a, b) => {
+                const av = a[field];
+                const bv = b[field];
+                if (av === bv)
+                    return 0;
+                if (av instanceof Date && bv instanceof Date)
+                    return (av.getTime() - bv.getTime()) * order;
+                return String(av).localeCompare(String(bv)) * order;
+            });
+            const offset = filter.offset ?? 0;
+            const limit = filter.limit ?? 100;
+            return entries.slice(offset, offset + limit);
+        },
+        async get(approvalKey) {
+            return store.get(approvalKey);
+        },
+        async upsert(entry) {
+            store.set(entry.approvalKey, entry);
+        },
+        async resolve(approvalKey, by, status) {
+            const entry = store.get(approvalKey);
+            if (entry === undefined || entry.status !== 'pending')
+                return false;
+            store.set(approvalKey, { ...entry, status, approvedBy: by });
+            return true;
+        },
+        async count(filter = {}) {
+            return [...store.values()].filter((entry) => matches(entry, filter)).length;
+        },
+    };
+}
+//# sourceMappingURL=approvals-backend.js.map

package/dist/core/tools/approvals-backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals-backend.js","sourceRoot":"","sources":["../../../src/core/tools/approvals-backend.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEjD,MAAM,OAAO,GAAG,CAAC,KAAsB,EAAE,MAA0B,EAAW,EAAE;QAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAChF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAC7E,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE;YACpB,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,WAAW,CAAC;YAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACpB,MAAM,EAAE,GAAI,CAAwC,CAAC,KAAK,CAAC,CAAC;gBAC5D,MAAM,EAAE,GAAI,CAAwC,CAAC,KAAK,CAAC,CAAC;gBAC5D,IAAI,EAAE,KAAK,EAAE;oBAAE,OAAO,CAAC,CAAC;gBACxB,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,YAAY,IAAI;oBAAE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC;gBAC3F,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC;YAClC,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,WAAmB;YAC3B,OAAO,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAsB;YACjC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,EAAU,EAAE,MAA+B;YAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACpE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE;YACrB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/tools/index.d.ts

@@ -0,0 +1,5 @@
+export * from './values.js';
+export * from './types.js';
+export * from './policies.js';
+export { createMemoryApprovalsBackend } from './approvals-backend.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/tools/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/core/tools/index.js

@@ -0,0 +1,5 @@
+export * from './values.js';
+export * from './types.js';
+export * from './policies.js';
+export { createMemoryApprovalsBackend } from './approvals-backend.js';
+//# sourceMappingURL=index.js.map

package/dist/core/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/tools/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAC"}

package/dist/core/tools/policies.d.ts

@@ -0,0 +1,10 @@
+import type { GuardrailContext, GuardrailDecision, GuardrailPolicy } from './types.js';
+/**
+ * Guardrail policy evaluation core — pure, zero-dependency, protocol-agnostic
+ * (D13: tool calls today, workflow activities later both run this). Policies
+ * run in declaration order; the first `deny`/`requireApproval` short-circuits;
+ * `mask` decisions merge (later wins). Fail-closed: a policy that throws denies
+ * the call (`mcp.policy.denied`). No policies configured = fast-path allow.
+ */
+export declare function evaluatePolicies(policies: readonly GuardrailPolicy[], ctx: GuardrailContext): Promise<GuardrailDecision>;
+//# sourceMappingURL=policies.d.ts.map

package/dist/core/tools/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../../../src/core/tools/policies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEvF;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAsB5B"}

package/dist/core/tools/policies.js

@@ -0,0 +1,33 @@
+/**
+ * Guardrail policy evaluation core — pure, zero-dependency, protocol-agnostic
+ * (D13: tool calls today, workflow activities later both run this). Policies
+ * run in declaration order; the first `deny`/`requireApproval` short-circuits;
+ * `mask` decisions merge (later wins). Fail-closed: a policy that throws denies
+ * the call (`mcp.policy.denied`). No policies configured = fast-path allow.
+ */
+export async function evaluatePolicies(policies, ctx) {
+    if (policies.length === 0)
+        return { allow: true };
+    let mask;
+    for (const policy of policies) {
+        let decision;
+        try {
+            decision = await policy.decide(ctx);
+        }
+        catch (error) {
+            // fail-closed: a failing policy denies the call
+            return {
+                allow: false,
+                reason: `policy "${policy.name}" failed: ${error instanceof Error ? error.message : String(error)}`,
+                errorCode: 'mcp.policy.denied',
+            };
+        }
+        if (!decision.allow)
+            return decision;
+        if (decision.mask !== undefined) {
+            mask = { ...mask, ...decision.mask };
+        }
+    }
+    return mask !== undefined ? { allow: true, mask } : { allow: true };
+}
+//# sourceMappingURL=policies.js.map

package/dist/core/tools/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../../src/core/tools/policies.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAoC,EACpC,GAAqB;IAErB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAElD,IAAI,IAAwC,CAAC;IAC7C,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gDAAgD;YAChD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,WAAW,MAAM,CAAC,IAAI,aAAa,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;gBACnG,SAAS,EAAE,mBAAmB;aAC/B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,QAAQ,CAAC;QACrC,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACtE,CAAC"}

package/dist/core/tools/types.d.ts

@@ -0,0 +1,181 @@
+import type { RbacSubject } from '../rbac/index.js';
+import type { Locale } from '../i18n/index.js';
+import type { AuditSink } from '../audit/index.js';
+import type { ApprovalStatus } from './values.js';
+/**
+ * Tool-surface contracts (M10 open contract). Zero-dependency, no runtime
+ * imports — `runtime` depends on `core`, so `core` must not reference runtime
+ * types (dependency DAG). The runtime `ObjectDataAccess` structurally
+ * satisfies `ToolDataAccess` (method bivariance), so no adapter is needed at
+ * the boundary beyond the executor passing the injected instance through.
+ */
+/** minimal JSON Schema subset used for tool input/output (plain objects, no zod) */
+export interface ToolJsonSchema {
+    type?: string;
+    properties?: Record<string, ToolJsonSchema>;
+    required?: string[];
+    items?: ToolJsonSchema;
+    enum?: string[];
+    description?: string;
+    minimum?: number;
+    maximum?: number;
+    additionalProperties?: boolean;
+}
+/** controlled data-access surface exposed to tools — no raw pool/SQL/network */
+export interface ToolFindOptions {
+    filter?: Record<string, unknown>;
+    sort?: Array<{
+        field: string;
+        dir?: string;
+    }>;
+    limit?: number;
+    offset?: number;
+    fields?: string[];
+}
+export interface ToolFindResult<T = Record<string, unknown>> {
+    rows: T[];
+    total: number;
+}
+export interface ToolDataAccessContext {
+    subject?: RbacSubject;
+    locale?: Locale;
+}
+export interface ToolDataAccess {
+    find<T = Record<string, unknown>>(objectName: string, opts: ToolFindOptions, ctx: ToolDataAccessContext): Promise<ToolFindResult<T>>;
+    findOne<T = Record<string, unknown>>(objectName: string, id: string, ctx: ToolDataAccessContext): Promise<T | null>;
+    create<T = Record<string, unknown>>(objectName: string, data: Record<string, unknown>, ctx: ToolDataAccessContext): Promise<T>;
+    update<T = Record<string, unknown>>(objectName: string, id: string, changes: Record<string, unknown>, ctx: ToolDataAccessContext): Promise<T>;
+    delete(objectName: string, id: string, ctx: ToolDataAccessContext): Promise<void>;
+}
+/**
+ * Protocol-agnostic caller identity. `subject` (RBAC decisions) is the proxied
+ * user; `actor` is the caller (agent). Mapped from `McpSession` at the adapter
+ * boundary — the executor never imports adapter types.
+ */
+export interface ToolActor {
+    /** caller API key (audit actorId / rate-limit key source) */
+    key: string;
+    /** caller identity label (audit meta) */
+    label: string;
+    /** proxied-user reference (audit meta) */
+    onBehalfOf: string;
+}
+/** guardrail handle exposed to tools (executor wires the real limiter) */
+export interface ToolGuardrails {
+    checkRateLimit(key: string, scope?: string): boolean;
+}
+export interface PendingApproval {
+    approvalKey: string;
+    action: string;
+    args: Record<string, unknown>;
+    status: ApprovalStatus;
+    createdAt: Date;
+    /** requester's actor key (deterministic-approval-key input) */
+    actorKey: string;
+    /** actor (approver key) that resolved the entry */
+    approvedBy?: string;
+}
+/**
+ * Approval queue filter (persisted-store query model). `from`/`to` bound the
+ * `createdAt` window; `sort` defaults to `createdAt` DESC.
+ */
+export interface ApprovalListFilter {
+    status?: ApprovalStatus;
+    action?: string;
+    actorKey?: string;
+    from?: Date;
+    to?: Date;
+    limit?: number;
+    offset?: number;
+    sort?: {
+        field: 'createdAt' | 'action' | string;
+        order: 'ASC' | 'DESC';
+    };
+}
+/**
+ * Pluggable approval store (persistence backend). Implementations: in-memory
+ * (`core/tools`, tests/default) and PG (`subsystems/approvals`, MIT — the
+ * engine's mandated DB). A Redis backend is not implemented. The store
+ * never audits — resolution audit (A7) belongs to the queue facade.
+ */
+export interface ApprovalsBackend {
+    list(filter?: ApprovalListFilter): Promise<PendingApproval[]>;
+    get(approvalKey: string): Promise<PendingApproval | undefined>;
+    upsert(entry: PendingApproval): Promise<void>;
+    /** resolve a pending entry to `approved`/`rejected`; false when absent or not pending */
+    resolve(approvalKey: string, by: string, status: 'approved' | 'rejected'): Promise<boolean>;
+    count(filter?: ApprovalListFilter): Promise<number>;
+}
+/**
+ * Approval queue handle (async — a persisted backend performs I/O). Single-level
+ * gate; multi-level flows belong to workflow. Custom tool handlers receive this
+ * as `ctx.approvals` and must `await`.
+ */
+export interface ToolApprovals {
+    /** list with the full filter model (status/action/actorKey/time + paging/sort) */
+    list(filter?: ApprovalListFilter): Promise<PendingApproval[]>;
+    count(filter?: ApprovalListFilter): Promise<number>;
+    /** convenience: all entries of one status (equivalent to `list({ status })`) */
+    query(status?: ApprovalStatus): Promise<PendingApproval[]>;
+    approve(approvalKey: string, by: string): Promise<boolean>;
+    reject(approvalKey: string, by: string): Promise<boolean>;
+}
+/** tool execution result envelope (protocol-agnostic; adapter maps to MCP content) */
+export interface ToolResult {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+    isError?: boolean;
+}
+/** everything a custom tool handler may use — no raw pool/SQL/network */
+export interface ToolCallContext {
+    dataAccess: ToolDataAccess;
+    subject: RbacSubject;
+    actor: ToolActor;
+    /** caller-supplied arguments of this invocation */
+    args: Record<string, unknown>;
+    /** audit action of this invocation (e.g. `mcp.tool.<name>`); protocol binding decides the prefix */
+    action: string;
+    audit: AuditSink;
+    guardrails: ToolGuardrails;
+    approvals: ToolApprovals;
+    /** cross-object atomic execution (new `DataAccessContext.client` primitive) */
+    withTx<T>(fn: (ctx: ToolCallContext) => Promise<T>): Promise<T>;
+}
+/** user-defined tool loaded from `toolsDir` (default export of a tool module) */
+export interface ToolDefinition {
+    name: string;
+    description: string;
+    inputSchema: ToolJsonSchema;
+    /** allow-list: roles not listed simply never see the tool (not validated — the engine has no role registry) */
+    roles?: string[];
+    handler(ctx: ToolCallContext): Promise<ToolResult>;
+}
+/** policy decision — `allow`/`deny`/`requireApproval`/`mask`, fail-closed on policy errors */
+export type GuardrailDecision = {
+    allow: true;
+    mask?: Record<string, string>;
+} | {
+    allow: false;
+    reason: string;
+    errorCode?: string;
+} | {
+    allow: false;
+    requireApproval: true;
+    approvalKey: string;
+};
+/** guardrail policy decision context (protocol-agnostic; `action` = tool name or workflow transition) */
+export interface GuardrailContext {
+    actor: ToolActor;
+    subject: RbacSubject;
+    action: string;
+    args: Record<string, unknown>;
+    /** amount-threshold style policies read business data through the same narrow surface */
+    dataAccess: ToolDataAccess;
+}
+export interface GuardrailPolicy {
+    name: string;
+    decide(ctx: GuardrailContext): GuardrailDecision | Promise<GuardrailDecision>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/tools/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/tools/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;GAMG;AAEH,oFAAoF;AACpF,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC5C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AACD,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;CACf;AACD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AACD,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACrI,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACpH,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/H,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9I,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnF;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,0EAA0E;AAC1E,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtD;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,EAAE,CAAC,EAAE,IAAI,CAAC;IACV,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC;CAC1E;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,yFAAyF;IACzF,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5F,KAAK,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACrD;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,IAAI,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpD,gFAAgF;IAChF,KAAK,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3D;AAED,sFAAsF;AACtF,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,SAAS,CAAC;IACjB,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,oGAAoG;IACpG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,UAAU,EAAE,cAAc,CAAC;IAC3B,SAAS,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACjE;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,cAAc,CAAC;IAC5B,+GAA+G;IAC/G,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,8FAA8F;AAC9F,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GAC9C;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,eAAe,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjE,yGAAyG;AACzG,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,yFAAyF;IACzF,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/E"}

package/dist/core/tools/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/tools/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/tools/types.ts"],"names":[],"mappings":""}

package/dist/core/tools/values.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Tool-surface constants — single source of truth (as const, see AGENTS.md).
+ * Moved from `adapters/mcp/types.ts` so `core/tools` (contract) and the
+ * loader/executor (runtime) share one reserved-name source. No second
+ * hardcoded union anywhere.
+ */
+/** prefixes of the generated per-object CRUD tools */
+export declare const TOOL_PREFIXES: {
+    readonly SEARCH: "search_";
+    readonly GET: "get_";
+    readonly CREATE: "create_";
+    readonly UPDATE: "update_";
+    readonly DELETE: "delete_";
+};
+export type ToolPrefix = typeof TOOL_PREFIXES[keyof typeof TOOL_PREFIXES];
+/** always-on introspection tool names */
+export declare const INTROSPECTION_TOOLS: {
+    readonly LIST_OBJECTS: "list_objects";
+    readonly DESCRIBE_OBJECT: "describe_object";
+};
+/** custom tool `name` format (snake_case, lowercase start) */
+export declare const TOOL_NAME_PATTERN = "^[a-z][a-z0-9_]*$";
+/** audit namespace prefix custom tools must not use (action = `<prefix>.<detail>`) */
+export declare const RESERVED_TOOL_NAMESPACE = "mcp.";
+/** approval queue statuses — single source of truth (as const, AGENTS hard rule) */
+export declare const APPROVAL_STATUSES: {
+    readonly PENDING: "pending";
+    readonly APPROVED: "approved";
+    readonly REJECTED: "rejected";
+};
+export type ApprovalStatus = typeof APPROVAL_STATUSES[keyof typeof APPROVAL_STATUSES];
+/** true when a custom tool name collides with a generated tool or the audit namespace */
+export declare function isReservedToolName(name: string): boolean;
+//# sourceMappingURL=values.d.ts.map

package/dist/core/tools/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/core/tools/values.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sDAAsD;AACtD,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAC;AACX,MAAM,MAAM,UAAU,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAC;AAE1E,yCAAyC;AACzC,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AAEX,8DAA8D;AAC9D,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,sFAAsF;AACtF,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAE9C,oFAAoF;AACpF,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAC;AAKtF,yFAAyF;AACzF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD"}

package/dist/core/tools/values.js

@@ -0,0 +1,36 @@
+/**
+ * Tool-surface constants — single source of truth (as const, see AGENTS.md).
+ * Moved from `adapters/mcp/types.ts` so `core/tools` (contract) and the
+ * loader/executor (runtime) share one reserved-name source. No second
+ * hardcoded union anywhere.
+ */
+/** prefixes of the generated per-object CRUD tools */
+export const TOOL_PREFIXES = {
+    SEARCH: 'search_',
+    GET: 'get_',
+    CREATE: 'create_',
+    UPDATE: 'update_',
+    DELETE: 'delete_',
+};
+/** always-on introspection tool names */
+export const INTROSPECTION_TOOLS = {
+    LIST_OBJECTS: 'list_objects',
+    DESCRIBE_OBJECT: 'describe_object',
+};
+/** custom tool `name` format (snake_case, lowercase start) */
+export const TOOL_NAME_PATTERN = '^[a-z][a-z0-9_]*$';
+/** audit namespace prefix custom tools must not use (action = `<prefix>.<detail>`) */
+export const RESERVED_TOOL_NAMESPACE = 'mcp.';
+/** approval queue statuses — single source of truth (as const, AGENTS hard rule) */
+export const APPROVAL_STATUSES = {
+    PENDING: 'pending',
+    APPROVED: 'approved',
+    REJECTED: 'rejected',
+};
+const reservedPrefixes = Object.values(TOOL_PREFIXES);
+const reservedNames = Object.values(INTROSPECTION_TOOLS);
+/** true when a custom tool name collides with a generated tool or the audit namespace */
+export function isReservedToolName(name) {
+    return reservedNames.includes(name) || reservedPrefixes.some((p) => name.startsWith(p)) || name.startsWith(RESERVED_TOOL_NAMESPACE);
+}
+//# sourceMappingURL=values.js.map

package/dist/core/tools/values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../../../src/core/tools/values.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,SAAS;IACjB,GAAG,EAAE,MAAM;IACX,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;IACjB,MAAM,EAAE,SAAS;CACT,CAAC;AAGX,yCAAyC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,YAAY,EAAE,cAAc;IAC5B,eAAe,EAAE,iBAAiB;CAC1B,CAAC;AAEX,8DAA8D;AAC9D,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,sFAAsF;AACtF,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAE9C,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;CACZ,CAAC;AAGX,MAAM,gBAAgB,GAAsB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;AACzE,MAAM,aAAa,GAAsB,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAE5E,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC;AACtI,CAAC"}