apex-code 0.0.1-alpha.9 → 0.0.5

package/dist/core/tools/contract-snapshot.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The one projection ADR 0010 names. `AGENTS.md` § Tools states the rule this file
+ * implements: never re-derive a tool's capability, risk, or permission
+ * classification, because a second independent classification is the drift ADR 0010
+ * exists to prevent.
+ *
+ * This describes; it never enforces. Nothing it returns is an authorization input,
+ * and the enforcement paths stay where they are: `core/context/pipeline.ts` and
+ * `core/context/eviction.ts` consume a `contractLookup` directly and apply their own
+ * conservative defaults, which ADR 0010 permits precisely because they enforce.
+ *
+ * It computes no classification of its own. Every value below is either read off the
+ * declared `contract` or taken from the shared `UNCLASSIFIED` fallback. A future
+ * change that adds a branch here inspecting a tool's name or behaviour to decide
+ * something has turned the projection into the second classifier it replaces.
+ */
+import type { Capability, EvidenceKind, PermissionBehavior, ToolContract } from "./contract.ts";
+/** One tool as every describing surface sees it. Arrays, not sets, so it is comparable and serializable. */
+export interface ToolContractSnapshotEntry {
+    readonly name: string;
+    /**
+     * True when the tool declared no contract and is standing on `UNCLASSIFIED`.
+     *
+     * Reported rather than merely applied: contracts.md invariant 1 requires it to be
+     * visible wherever the registry is described, because a conservative default nobody
+     * can see is indistinguishable from a bug.
+     */
+    readonly unclassified: boolean;
+    readonly capabilities: readonly Capability[];
+    readonly permission: {
+        readonly defaultBehavior: PermissionBehavior;
+    };
+    readonly context: {
+        readonly resultRecoverable: boolean;
+        readonly deferSchema: boolean;
+        readonly outputBudgetTokens?: number;
+    };
+    readonly evidence: {
+        readonly emits: readonly EvidenceKind[];
+    };
+}
+/** The shape this reads. Anything without `contract` is foreign and lands on the fallback. */
+interface MaybeContracted {
+    readonly name: string;
+    readonly contract?: ToolContract;
+}
+/**
+ * The one place that decides whether a tool declared a contract.
+ *
+ * Exported because `getAllTools` needs the same answer. Two `!("contract" in x)` checks
+ * in two files is the shape of the drift ADR 0010 names, even while they agree.
+ */
+export declare function isUnclassifiedTool(tool: MaybeContracted): boolean;
+export declare function buildToolContractSnapshot(tools: readonly MaybeContracted[]): ToolContractSnapshotEntry[];
+/** The names a describing surface must report, per contracts.md invariant 1. */
+export declare function unclassifiedToolNames(snapshot: readonly ToolContractSnapshotEntry[]): string[];
+export {};
+//# sourceMappingURL=contract-snapshot.d.ts.map

package/dist/core/tools/contract-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-snapshot.d.ts","sourceRoot":"","sources":["../../../src/core/tools/contract-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGhG,4GAA4G;AAC5G,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,UAAU,EAAE,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE;QAAE,QAAQ,CAAC,eAAe,EAAE,kBAAkB,CAAA;KAAE,CAAC;IACtE,QAAQ,CAAC,OAAO,EAAE;QACjB,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;QACpC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;KACrC,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAA;KAAE,CAAC;CAC/D;AAED,8FAA8F;AAC9F,UAAU,eAAe;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAEjE;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,yBAAyB,EAAE,CAoBxG;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,SAAS,yBAAyB,EAAE,GAAG,MAAM,EAAE,CAE9F","sourcesContent":["/**\n * The one projection ADR 0010 names. `AGENTS.md` § Tools states the rule this file\n * implements: never re-derive a tool's capability, risk, or permission\n * classification, because a second independent classification is the drift ADR 0010\n * exists to prevent.\n *\n * This describes; it never enforces. Nothing it returns is an authorization input,\n * and the enforcement paths stay where they are: `core/context/pipeline.ts` and\n * `core/context/eviction.ts` consume a `contractLookup` directly and apply their own\n * conservative defaults, which ADR 0010 permits precisely because they enforce.\n *\n * It computes no classification of its own. Every value below is either read off the\n * declared `contract` or taken from the shared `UNCLASSIFIED` fallback. A future\n * change that adds a branch here inspecting a tool's name or behaviour to decide\n * something has turned the projection into the second classifier it replaces.\n */\n\nimport type { Capability, EvidenceKind, PermissionBehavior, ToolContract } from \"./contract.ts\";\nimport { UNCLASSIFIED } from \"./contract.ts\";\n\n/** One tool as every describing surface sees it. Arrays, not sets, so it is comparable and serializable. */\nexport interface ToolContractSnapshotEntry {\n\treadonly name: string;\n\t/**\n\t * True when the tool declared no contract and is standing on `UNCLASSIFIED`.\n\t *\n\t * Reported rather than merely applied: contracts.md invariant 1 requires it to be\n\t * visible wherever the registry is described, because a conservative default nobody\n\t * can see is indistinguishable from a bug.\n\t */\n\treadonly unclassified: boolean;\n\treadonly capabilities: readonly Capability[];\n\treadonly permission: { readonly defaultBehavior: PermissionBehavior };\n\treadonly context: {\n\t\treadonly resultRecoverable: boolean;\n\t\treadonly deferSchema: boolean;\n\t\treadonly outputBudgetTokens?: number;\n\t};\n\treadonly evidence: { readonly emits: readonly EvidenceKind[] };\n}\n\n/** The shape this reads. Anything without `contract` is foreign and lands on the fallback. */\ninterface MaybeContracted {\n\treadonly name: string;\n\treadonly contract?: ToolContract;\n}\n\n/**\n * The one place that decides whether a tool declared a contract.\n *\n * Exported because `getAllTools` needs the same answer. Two `!(\"contract\" in x)` checks\n * in two files is the shape of the drift ADR 0010 names, even while they agree.\n */\nexport function isUnclassifiedTool(tool: MaybeContracted): boolean {\n\treturn !(\"contract\" in tool) || tool.contract === undefined;\n}\n\nexport function buildToolContractSnapshot(tools: readonly MaybeContracted[]): ToolContractSnapshotEntry[] {\n\treturn tools.map((tool) => {\n\t\tconst unclassified = isUnclassifiedTool(tool);\n\t\tconst contract = unclassified ? UNCLASSIFIED : (tool.contract as ToolContract);\n\n\t\treturn {\n\t\t\tname: tool.name,\n\t\t\tunclassified,\n\t\t\tcapabilities: [...contract.capabilities],\n\t\t\tpermission: { defaultBehavior: contract.permission.defaultBehavior },\n\t\t\tcontext: {\n\t\t\t\tresultRecoverable: contract.context.resultRecoverable,\n\t\t\t\tdeferSchema: contract.context.deferSchema,\n\t\t\t\t...(contract.context.outputBudgetTokens === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: { outputBudgetTokens: contract.context.outputBudgetTokens }),\n\t\t\t},\n\t\t\tevidence: { emits: [...contract.evidence.emits] },\n\t\t};\n\t});\n}\n\n/** The names a describing surface must report, per contracts.md invariant 1. */\nexport function unclassifiedToolNames(snapshot: readonly ToolContractSnapshotEntry[]): string[] {\n\treturn snapshot.filter((entry) => entry.unclassified).map((entry) => entry.name);\n}\n"]}

package/dist/core/tools/contract-snapshot.js

@@ -0,0 +1,51 @@
+/**
+ * The one projection ADR 0010 names. `AGENTS.md` § Tools states the rule this file
+ * implements: never re-derive a tool's capability, risk, or permission
+ * classification, because a second independent classification is the drift ADR 0010
+ * exists to prevent.
+ *
+ * This describes; it never enforces. Nothing it returns is an authorization input,
+ * and the enforcement paths stay where they are: `core/context/pipeline.ts` and
+ * `core/context/eviction.ts` consume a `contractLookup` directly and apply their own
+ * conservative defaults, which ADR 0010 permits precisely because they enforce.
+ *
+ * It computes no classification of its own. Every value below is either read off the
+ * declared `contract` or taken from the shared `UNCLASSIFIED` fallback. A future
+ * change that adds a branch here inspecting a tool's name or behaviour to decide
+ * something has turned the projection into the second classifier it replaces.
+ */
+import { UNCLASSIFIED } from "./contract.js";
+/**
+ * The one place that decides whether a tool declared a contract.
+ *
+ * Exported because `getAllTools` needs the same answer. Two `!("contract" in x)` checks
+ * in two files is the shape of the drift ADR 0010 names, even while they agree.
+ */
+export function isUnclassifiedTool(tool) {
+    return !("contract" in tool) || tool.contract === undefined;
+}
+export function buildToolContractSnapshot(tools) {
+    return tools.map((tool) => {
+        const unclassified = isUnclassifiedTool(tool);
+        const contract = unclassified ? UNCLASSIFIED : tool.contract;
+        return {
+            name: tool.name,
+            unclassified,
+            capabilities: [...contract.capabilities],
+            permission: { defaultBehavior: contract.permission.defaultBehavior },
+            context: {
+                resultRecoverable: contract.context.resultRecoverable,
+                deferSchema: contract.context.deferSchema,
+                ...(contract.context.outputBudgetTokens === undefined
+                    ? {}
+                    : { outputBudgetTokens: contract.context.outputBudgetTokens }),
+            },
+            evidence: { emits: [...contract.evidence.emits] },
+        };
+    });
+}
+/** The names a describing surface must report, per contracts.md invariant 1. */
+export function unclassifiedToolNames(snapshot) {
+    return snapshot.filter((entry) => entry.unclassified).map((entry) => entry.name);
+}
+//# sourceMappingURL=contract-snapshot.js.map

package/dist/core/tools/contract-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-snapshot.js","sourceRoot":"","sources":["../../../src/core/tools/contract-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA6B7C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqB,EAAW;IAClE,OAAO,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAiC,EAA+B;IACzG,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1B,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAE,IAAI,CAAC,QAAyB,CAAC;QAE/E,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY;YACZ,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC;YACxC,UAAU,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,UAAU,CAAC,eAAe,EAAE;YACpE,OAAO,EAAE;gBACR,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,iBAAiB;gBACrD,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW;gBACzC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,KAAK,SAAS;oBACpD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,kBAAkB,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;aAC/D;YACD,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE;SACjD,CAAC;IAAA,CACF,CAAC,CAAC;AAAA,CACH;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,QAA8C,EAAY;IAC/F,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAAA,CACjF","sourcesContent":["/**\n * The one projection ADR 0010 names. `AGENTS.md` § Tools states the rule this file\n * implements: never re-derive a tool's capability, risk, or permission\n * classification, because a second independent classification is the drift ADR 0010\n * exists to prevent.\n *\n * This describes; it never enforces. Nothing it returns is an authorization input,\n * and the enforcement paths stay where they are: `core/context/pipeline.ts` and\n * `core/context/eviction.ts` consume a `contractLookup` directly and apply their own\n * conservative defaults, which ADR 0010 permits precisely because they enforce.\n *\n * It computes no classification of its own. Every value below is either read off the\n * declared `contract` or taken from the shared `UNCLASSIFIED` fallback. A future\n * change that adds a branch here inspecting a tool's name or behaviour to decide\n * something has turned the projection into the second classifier it replaces.\n */\n\nimport type { Capability, EvidenceKind, PermissionBehavior, ToolContract } from \"./contract.ts\";\nimport { UNCLASSIFIED } from \"./contract.ts\";\n\n/** One tool as every describing surface sees it. Arrays, not sets, so it is comparable and serializable. */\nexport interface ToolContractSnapshotEntry {\n\treadonly name: string;\n\t/**\n\t * True when the tool declared no contract and is standing on `UNCLASSIFIED`.\n\t *\n\t * Reported rather than merely applied: contracts.md invariant 1 requires it to be\n\t * visible wherever the registry is described, because a conservative default nobody\n\t * can see is indistinguishable from a bug.\n\t */\n\treadonly unclassified: boolean;\n\treadonly capabilities: readonly Capability[];\n\treadonly permission: { readonly defaultBehavior: PermissionBehavior };\n\treadonly context: {\n\t\treadonly resultRecoverable: boolean;\n\t\treadonly deferSchema: boolean;\n\t\treadonly outputBudgetTokens?: number;\n\t};\n\treadonly evidence: { readonly emits: readonly EvidenceKind[] };\n}\n\n/** The shape this reads. Anything without `contract` is foreign and lands on the fallback. */\ninterface MaybeContracted {\n\treadonly name: string;\n\treadonly contract?: ToolContract;\n}\n\n/**\n * The one place that decides whether a tool declared a contract.\n *\n * Exported because `getAllTools` needs the same answer. Two `!(\"contract\" in x)` checks\n * in two files is the shape of the drift ADR 0010 names, even while they agree.\n */\nexport function isUnclassifiedTool(tool: MaybeContracted): boolean {\n\treturn !(\"contract\" in tool) || tool.contract === undefined;\n}\n\nexport function buildToolContractSnapshot(tools: readonly MaybeContracted[]): ToolContractSnapshotEntry[] {\n\treturn tools.map((tool) => {\n\t\tconst unclassified = isUnclassifiedTool(tool);\n\t\tconst contract = unclassified ? UNCLASSIFIED : (tool.contract as ToolContract);\n\n\t\treturn {\n\t\t\tname: tool.name,\n\t\t\tunclassified,\n\t\t\tcapabilities: [...contract.capabilities],\n\t\t\tpermission: { defaultBehavior: contract.permission.defaultBehavior },\n\t\t\tcontext: {\n\t\t\t\tresultRecoverable: contract.context.resultRecoverable,\n\t\t\t\tdeferSchema: contract.context.deferSchema,\n\t\t\t\t...(contract.context.outputBudgetTokens === undefined\n\t\t\t\t\t? {}\n\t\t\t\t\t: { outputBudgetTokens: contract.context.outputBudgetTokens }),\n\t\t\t},\n\t\t\tevidence: { emits: [...contract.evidence.emits] },\n\t\t};\n\t});\n}\n\n/** The names a describing surface must report, per contracts.md invariant 1. */\nexport function unclassifiedToolNames(snapshot: readonly ToolContractSnapshotEntry[]): string[] {\n\treturn snapshot.filter((entry) => entry.unclassified).map((entry) => entry.name);\n}\n"]}

package/dist/core/tools/contract.d.ts

@@ -7,8 +7,9 @@
  * defaulting into "unclassified".
  */
 import type { AgentToolResult } from "apex-code-agent-core";
-import type { Static, TSchema } from "typebox";
+import { type Static, type TSchema, Type } from "typebox";
 import type { ToolDefinition } from "../extensions/types.ts";
+import type { PermissionPreview } from "../permissions/responder.ts";
 /** What class of thing a tool does. A set, not a single value — `bash` is `{exec}`. */
 export type Capability = "fs.read" | "fs.write" | "exec" | "net" | "delegate" | "ui" | "state";
 export declare const ALL_CAPABILITIES: ReadonlySet<Capability>;
@@ -21,8 +22,32 @@ export type PermissionBehavior = "allow" | "deny" | "ask";
 export interface PermissionSpec<TParams extends TSchema = TSchema> {
     /** Behavior when no rule matches. Read-only tools may default to "allow". */
     defaultBehavior: PermissionBehavior;
-    /** Does this call match this rule's content? The tool owns the grammar. */
+    /**
+     * Per-call behavior when no rule matches, for tools whose calls differ in
+     * nature (bash: launching a command is "ask", retrieving or killing an
+     * already-approved background command is "allow"). Return undefined to fall
+     * back to `defaultBehavior`. Floors and matching rules still outrank it --
+     * this only replaces the fallthrough, never a rule or a mode floor.
+     */
+    defaultBehaviorFor?(params: Static<TParams>): PermissionBehavior | undefined;
+    /** Prepare canonical operation facts on the validated call before authorization and execution. */
+    prepareCall?(params: Static<TParams>): void;
+    /**
+     * Describe, for a human about to approve it, what this call would change.
+     *
+     * Called by the gate only once it has resolved to `ask`, so an allowed or denied
+     * call never pays for it. It must read through the value `prepareCall` stored
+     * rather than re-deriving a target, which is what keeps the diff the user
+     * approves and the bytes execution writes the same file (ADR 0029). It must not
+     * execute the tool, write, or widen what the gate already validated.
+     */
+    previewCall?(params: Static<TParams>): PermissionPreview;
+    /** Does this call match this rule's content as an allow rule? */
     matches(ruleContent: string, params: Static<TParams>): boolean;
+    /** Optional deny matcher. It may identify any prohibited part of a structured call. */
+    matchesDeny?(ruleContent: string, params: Static<TParams>): boolean;
+    /** True when the call contains grammar that cannot be safely authorized by an allow. */
+    isUnknown?(params: Static<TParams>): boolean;
     /** Human-readable rendering of a rule, for prompts and denial messages. */
     describe(ruleContent: string): string;
     /**
@@ -94,13 +119,19 @@ export type DiagnosticEvidenceRecord = {
     serverId?: string;
     unavailableKind: DiagnosticUnavailableKind;
 };
-/** Normalized argv-based test execution facts. */
+/** How a `test` run actually ended. */
+export type TestProcessOutcome = "exit" | "signal" | "timeout" | "cancelled" | "spawn-failed";
+/** Bounded argv-based test execution facts. Full output never enters evidence; it lives in artifacts. */
 export interface TestEvidenceRecord {
     kind: "test";
     cwd: string;
     executable: string;
     argv: string[];
     exitCode: number | null;
+    /** How the run ended. Unset means a legacy record; derive from `exitCode` when reading. */
+    outcome?: TestProcessOutcome;
+    /** True when the model-facing view omitted part of a stream (full output lives in artifacts). */
+    outputTruncated?: boolean;
 }
 /** Explicit human attestation; policy decides how, or whether, it is sufficient. */
 export interface ManualEvidenceRecord {
@@ -165,8 +196,10 @@ export interface ApexToolDefinition<TParams extends TSchema = TSchema, TDetails
     contract: ToolContract<TParams, TDetails>;
 }
 /**
- * Conservative contract for a tool registered without one — MCP servers and
- * third-party extensions cannot supply a `contract`. Full capability set (so it can
+ * Conservative contract for a tool registered without one -- third-party extension
+ * tools, which cannot supply a `contract`. MCP tools no longer land here: they reach
+ * the model through the built-in `mcp` proxy, whose contract is declared in
+ * `core/mcp/contract.ts`. Full capability set (so it can
  * never widen a delegation ceiling), `ask` by default, never evicted, schema
  * deferred, emits nothing. Matching is exact-argument only: a foreign tool's rule
  * authorizes exactly the call it was generated from, never a pattern.
@@ -180,4 +213,19 @@ export declare const UNCLASSIFIED: ToolContract<TSchema, unknown>;
 export declare function resolveToolContract(lookup: (toolName: string) => ToolContract | undefined, toolName: string): ToolContract;
 /** Resolve the context projection using the same canonical foreign-tool fallback. */
 export declare function resolveToolContext(lookup: (toolName: string) => Pick<ToolContract, "context"> | undefined, toolName: string): Pick<ToolContract, "context">;
+/**
+ * A tool whose call shapes differ, declared so a provider can still see its fields.
+ *
+ * `Type.Union` compiles to `{ anyOf: [...] }`, which carries no top-level
+ * `properties`. The Anthropic request builder reads `properties` and `required`
+ * directly (`anthropic-messages.js`, `legacyInputSchema`), so a union reached the
+ * model as an object with no fields at all. It then guessed, and our own
+ * validation rejected the guess.
+ *
+ * The union still decides what is valid. `properties` is advertisement, listing
+ * every field across the variants so a provider that ignores `anyOf` has
+ * something to work from. It deliberately carries no `required`, because no field
+ * is required by every variant.
+ */
+export declare function toolUnion<T extends TSchema[]>(variants: [...T], properties: Record<string, TSchema>): Type.TUnion<T>;
 //# sourceMappingURL=contract.d.ts.map

package/dist/core/tools/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/core/tools/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,yFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC;AAE/F,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,UAAU,CAQnD,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;IAChE,6EAA6E;IAC7E,eAAe,EAAE,kBAAkB,CAAC;IAEpC,2EAA2E;IAC3E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAE/D,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAEtC;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,WAAW;IAC3B;;;;;;;;OAQG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,kEAAkE;IAClE,WAAW,EAAE,OAAO,CAAC;IAErB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;AAE9F,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,uFAAuF;AACvF,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACd;AAED,+FAA+F;AAC/F,MAAM,MAAM,yBAAyB,GAClC,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,WAAW,GACX,SAAS,GACT,YAAY,GACZ,eAAe,CAAC;AAEnB,qGAAqG;AACrG,MAAM,MAAM,wBAAwB,GACjC;IACA,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,wBAAwB,CAAC;IACzC,SAAS,EAAE,OAAO,CAAC;CAClB,GACD;IACA,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,yBAAyB,CAAC;CAC1C,CAAC;AAEL,kDAAkD;AAClD,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GACvB,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,CAAC;AAE1B,4GAA4G;AAC5G,MAAM,WAAW,YAAY;IAC5B,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACrE,gBAAgB,CAAC,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;CAC/D;AAED,0FAA0F;AAC1F,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IAClF,iEAAiE;IACjE,KAAK,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IAEjC;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;CACtF;AAED,MAAM,WAAW,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IAClF,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IACtC,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE,MAAM,GAAG,GAAG,CACtG,SAAQ,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;IACjD,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,CAUvD,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,EACtD,QAAQ,EAAE,MAAM,GACd,YAAY,CAEd;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,SAAS,EACvE,QAAQ,EAAE,MAAM,GACd,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAE/B","sourcesContent":["/**\n * The canonical tool contract. Settled by ADR 0010 and specified in full at\n * docs/architecture/contracts.md § 1 — this module implements that shape, it does\n * not redesign it. `contract` is required on every registered tool, and so is every\n * sub-field: a tool cannot compile without answering all four axes (capabilities,\n * permission, context, evidence), which is what keeps a new tool from silently\n * defaulting into \"unclassified\".\n */\n\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport type { Static, TSchema } from \"typebox\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\n\n/** What class of thing a tool does. A set, not a single value — `bash` is `{exec}`. */\nexport type Capability = \"fs.read\" | \"fs.write\" | \"exec\" | \"net\" | \"delegate\" | \"ui\" | \"state\";\n\nexport const ALL_CAPABILITIES: ReadonlySet<Capability> = new Set<Capability>([\n\t\"fs.read\",\n\t\"fs.write\",\n\t\"exec\",\n\t\"net\",\n\t\"delegate\",\n\t\"ui\",\n\t\"state\",\n]);\n\nexport type PermissionBehavior = \"allow\" | \"deny\" | \"ask\";\n\n/**\n * `ruleContent` is interpreted by the tool, never by the rule engine (ADR 0010).\n * That is what lets `Bash(git commit:*)` and `Read(~/.ssh/**)` mean entirely\n * different things while the engine that resolves precedence stays tool-agnostic.\n */\nexport interface PermissionSpec<TParams extends TSchema = TSchema> {\n\t/** Behavior when no rule matches. Read-only tools may default to \"allow\". */\n\tdefaultBehavior: PermissionBehavior;\n\n\t/** Does this call match this rule's content? The tool owns the grammar. */\n\tmatches(ruleContent: string, params: Static<TParams>): boolean;\n\n\t/** Human-readable rendering of a rule, for prompts and denial messages. */\n\tdescribe(ruleContent: string): string;\n\n\t/**\n\t * The rule that would allow this exact call — what \"always allow this\"\n\t * persists. Return null when the call is not generalizable into a rule.\n\t */\n\truleForCall(params: Static<TParams>): string | null;\n}\n\nexport interface ContextSpec {\n\t/**\n\t * True when the result's information is recoverable — the same content can be\n\t * obtained again by re-running the tool or reading the workspace.\n\t *\n\t * ONLY recoverable results may be evicted (Phase 3). A tool whose result cannot\n\t * be regenerated (a nondeterministic command, a consumed one-shot resource)\n\t * must set this false, or eviction would silently destroy information the\n\t * transcript is the only record of.\n\t */\n\tresultRecoverable: boolean;\n\n\t/** Marker substituted for an evicted result. */\n\tevictionMarker?: string;\n\n\t/** Announce by name only; load the parameter schema on demand. */\n\tdeferSchema: boolean;\n\n\t/** Soft cap on result tokens before truncation. */\n\toutputBudgetTokens?: number;\n}\n\nexport type EvidenceKind = \"diff\" | \"test\" | \"command\" | \"manual\" | \"workflow\" | \"diagnostic\";\n\n/** Source-observed command facts. `exitCode` is absent only when execution never began. */\nexport interface CommandEvidenceRecord {\n\tkind: \"command\";\n\tcommand: string;\n\tcwd?: string;\n\texecutable?: string;\n\targv?: string[];\n\texitCode?: number | null;\n}\n\n/** A file mutation is identified by hashes and paths, never raw file or patch contents. */\nexport interface DiffEvidenceRecord {\n\tkind: \"diff\";\n\tpath: string;\n\tpatchHash?: string;\n\tcontentHash?: string;\n\tbyteCount?: number;\n}\n\n/** Zero-filled diagnostic severity buckets for one bounded language-server outcome. */\nexport interface DiagnosticSeverityCounts {\n\terror: number;\n\twarning: number;\n\tinformation: number;\n\thint: number;\n\tunspecified: number;\n\tother: number;\n}\n\n/** Stable durable classification. Free-form server and process errors never enter evidence. */\nexport type DiagnosticUnavailableKind =\n\t| \"no-server\"\n\t| \"disposed\"\n\t| \"unsupported-sync\"\n\t| \"timed-out\"\n\t| \"aborted\"\n\t| \"superseded\"\n\t| \"server-failed\";\n\n/** Bounded post-mutation diagnostic facts, never diagnostic messages or rendered failure reasons. */\nexport type DiagnosticEvidenceRecord =\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"ok\";\n\t\t\tserverId: string;\n\t\t\tdiagnosticCount: number;\n\t\t\tseverityCounts: DiagnosticSeverityCounts;\n\t\t\ttruncated: boolean;\n\t  }\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"unavailable\";\n\t\t\tserverId?: string;\n\t\t\tunavailableKind: DiagnosticUnavailableKind;\n\t  };\n\n/** Normalized argv-based test execution facts. */\nexport interface TestEvidenceRecord {\n\tkind: \"test\";\n\tcwd: string;\n\texecutable: string;\n\targv: string[];\n\texitCode: number | null;\n}\n\n/** Explicit human attestation; policy decides how, or whether, it is sufficient. */\nexport interface ManualEvidenceRecord {\n\tkind: \"manual\";\n\tvalue?: unknown;\n\tobserved?: unknown;\n\tstatus?: string;\n}\n\n/** Source facts from approval and delegation workflows. */\nexport interface WorkflowEvidenceRecord {\n\tkind: \"workflow\";\n\tplan?: string;\n\tapproved?: boolean;\n\tagentType?: string;\n\ttask?: string;\n\thandle?: string;\n}\n\n/** A structured source record. Policy is a separate consumer, not an additional variant. */\nexport type EvidenceRecord =\n\t| CommandEvidenceRecord\n\t| DiffEvidenceRecord\n\t| DiagnosticEvidenceRecord\n\t| TestEvidenceRecord\n\t| ManualEvidenceRecord\n\t| WorkflowEvidenceRecord;\n\n/** Durable destination for source-level tool evidence. Policy is deliberately not part of this boundary. */\nexport interface EvidenceSink {\n\trecord(entry: { toolName: string; records: EvidenceRecord[] }): void;\n\trecordDiagnostic?(diagnostic: EvidenceCaptureDiagnostic): void;\n}\n\n/** A capture failure is observable but never changes an already-completed tool result. */\nexport interface EvidenceCaptureDiagnostic {\n\ttoolName: string;\n\treason: string;\n}\n\nexport interface EvidenceSpec<TParams extends TSchema = TSchema, TDetails = unknown> {\n\t/** Kinds this tool can emit. Empty set is valid and explicit. */\n\temits: ReadonlySet<EvidenceKind>;\n\n\t/**\n\t * Derive evidence from a completed call. Runs inside the tool's own execution\n\t * path, with access to what actually happened, not a reconstruction from\n\t * rendered output.\n\t */\n\tcapture(params: Static<TParams>, result: AgentToolResult<TDetails>): EvidenceRecord[];\n}\n\nexport interface ToolContract<TParams extends TSchema = TSchema, TDetails = unknown> {\n\tcapabilities: ReadonlySet<Capability>;\n\tpermission: PermissionSpec<TParams>;\n\tcontext: ContextSpec;\n\tevidence: EvidenceSpec<TParams, TDetails>;\n}\n\n/**\n * Apex Code extends upstream ToolDefinition with exactly one required field.\n *\n * `TState` defaults to `any`, matching upstream `ToolDefinition` exactly (not\n * `unknown`). That default is load-bearing: TypeScript compares two instantiations\n * of the *same* generic interface (here, both rooted in `ToolDefinition`) using each\n * type parameter's declared variance, without expanding `Static<TParams>`\n * structurally — but only when every type argument lines up, including the ones a\n * caller left defaulted. A mismatched default reintroduces a full structural check,\n * where `Static<any>` does not behave like `any`, and breaks every pre-existing\n * `ToolDefinition<any, X>`-typed consumer across the codebase.\n */\nexport interface ApexToolDefinition<TParams extends TSchema = TSchema, TDetails = unknown, TState = any>\n\textends ToolDefinition<TParams, TDetails, TState> {\n\tcontract: ToolContract<TParams, TDetails>;\n}\n\n/**\n * Conservative contract for a tool registered without one — MCP servers and\n * third-party extensions cannot supply a `contract`. Full capability set (so it can\n * never widen a delegation ceiling), `ask` by default, never evicted, schema\n * deferred, emits nothing. Matching is exact-argument only: a foreign tool's rule\n * authorizes exactly the call it was generated from, never a pattern.\n *\n * This must also be reported as unclassified wherever a consumer describes the tool\n * registry (contracts.md invariant 1) — a conservative default nobody can see is\n * indistinguishable from a bug.\n */\nexport const UNCLASSIFIED: ToolContract<TSchema, unknown> = {\n\tcapabilities: ALL_CAPABILITIES,\n\tpermission: {\n\t\tdefaultBehavior: \"ask\",\n\t\tmatches: (ruleContent, params) => ruleContent === JSON.stringify(params),\n\t\tdescribe: (ruleContent) => `Exact call: ${ruleContent}`,\n\t\truleForCall: (params) => JSON.stringify(params),\n\t},\n\tcontext: { resultRecoverable: false, deferSchema: false },\n\tevidence: { emits: new Set(), capture: () => [] },\n};\n\n/** Resolve a complete tool contract for enforcement consumers. */\nexport function resolveToolContract(\n\tlookup: (toolName: string) => ToolContract | undefined,\n\ttoolName: string,\n): ToolContract {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n\n/** Resolve the context projection using the same canonical foreign-tool fallback. */\nexport function resolveToolContext(\n\tlookup: (toolName: string) => Pick<ToolContract, \"context\"> | undefined,\n\ttoolName: string,\n): Pick<ToolContract, \"context\"> {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n"]}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../src/core/tools/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,KAAK,MAAM,EAAE,KAAK,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,yFAAuF;AACvF,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,IAAI,GAAG,OAAO,CAAC;AAE/F,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,UAAU,CAQnD,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO;IAChE,6EAA6E;IAC7E,eAAe,EAAE,kBAAkB,CAAC;IAEpC;;;;;;OAMG;IACH,kBAAkB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,kBAAkB,GAAG,SAAS,CAAC;IAE7E,kGAAkG;IAClG,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAE5C;;;;;;;;OAQG;IACH,WAAW,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,iBAAiB,CAAC;IACzD,iEAAiE;IACjE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC/D,uFAAuF;IACvF,WAAW,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACpE,wFAAwF;IACxF,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAE7C,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IAEtC;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,WAAW;IAC3B;;;;;;;;OAQG;IACH,iBAAiB,EAAE,OAAO,CAAC;IAE3B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,kEAAkE;IAClE,WAAW,EAAE,OAAO,CAAC;IAErB,mDAAmD;IACnD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,GAAG,YAAY,CAAC;AAE9F,2FAA2F;AAC3F,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,uFAAuF;AACvF,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACd;AAED,+FAA+F;AAC/F,MAAM,MAAM,yBAAyB,GAClC,WAAW,GACX,UAAU,GACV,kBAAkB,GAClB,WAAW,GACX,SAAS,GACT,YAAY,GACZ,eAAe,CAAC;AAEnB,qGAAqG;AACrG,MAAM,MAAM,wBAAwB,GACjC;IACA,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,wBAAwB,CAAC;IACzC,SAAS,EAAE,OAAO,CAAC;CAClB,GACD;IACA,IAAI,EAAE,YAAY,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,yBAAyB,CAAC;CAC1C,CAAC;AAEL,uCAAuC;AACvC,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,CAAC;AAE9F,yGAAyG;AACzG,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,iGAAiG;IACjG,eAAe,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,2DAA2D;AAC3D,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,UAAU,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4FAA4F;AAC5F,MAAM,MAAM,cAAc,GACvB,qBAAqB,GACrB,kBAAkB,GAClB,wBAAwB,GACxB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,CAAC;AAE1B,4GAA4G;AAC5G,MAAM,WAAW,YAAY;IAC5B,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IACrE,gBAAgB,CAAC,CAAC,UAAU,EAAE,yBAAyB,GAAG,IAAI,CAAC;CAC/D;AAED,0FAA0F;AAC1F,MAAM,WAAW,yBAAyB;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IAClF,iEAAiE;IACjE,KAAK,EAAE,WAAW,CAAC,YAAY,CAAC,CAAC;IAEjC;;;;OAIG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,cAAc,EAAE,CAAC;CACtF;AAED,MAAM,WAAW,YAAY,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO;IAClF,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,CAAC;IACtC,UAAU,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,WAAW,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,OAAO,GAAG,OAAO,EAAE,QAAQ,GAAG,OAAO,EAAE,MAAM,GAAG,GAAG,CACtG,SAAQ,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC;IACjD,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CAC1C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,CAUvD,CAAC;AAEF,kEAAkE;AAClE,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,YAAY,GAAG,SAAS,EACtD,QAAQ,EAAE,MAAM,GACd,YAAY,CAEd;AAED,qFAAqF;AACrF,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,SAAS,EACvE,QAAQ,EAAE,MAAM,GACd,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAE/B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,kBAEnG","sourcesContent":["/**\n * The canonical tool contract. Settled by ADR 0010 and specified in full at\n * docs/architecture/contracts.md § 1 — this module implements that shape, it does\n * not redesign it. `contract` is required on every registered tool, and so is every\n * sub-field: a tool cannot compile without answering all four axes (capabilities,\n * permission, context, evidence), which is what keeps a new tool from silently\n * defaulting into \"unclassified\".\n */\n\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport { type Static, type TSchema, Type } from \"typebox\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\nimport type { PermissionPreview } from \"../permissions/responder.ts\";\n\n/** What class of thing a tool does. A set, not a single value — `bash` is `{exec}`. */\nexport type Capability = \"fs.read\" | \"fs.write\" | \"exec\" | \"net\" | \"delegate\" | \"ui\" | \"state\";\n\nexport const ALL_CAPABILITIES: ReadonlySet<Capability> = new Set<Capability>([\n\t\"fs.read\",\n\t\"fs.write\",\n\t\"exec\",\n\t\"net\",\n\t\"delegate\",\n\t\"ui\",\n\t\"state\",\n]);\n\nexport type PermissionBehavior = \"allow\" | \"deny\" | \"ask\";\n\n/**\n * `ruleContent` is interpreted by the tool, never by the rule engine (ADR 0010).\n * That is what lets `Bash(git commit:*)` and `Read(~/.ssh/**)` mean entirely\n * different things while the engine that resolves precedence stays tool-agnostic.\n */\nexport interface PermissionSpec<TParams extends TSchema = TSchema> {\n\t/** Behavior when no rule matches. Read-only tools may default to \"allow\". */\n\tdefaultBehavior: PermissionBehavior;\n\n\t/**\n\t * Per-call behavior when no rule matches, for tools whose calls differ in\n\t * nature (bash: launching a command is \"ask\", retrieving or killing an\n\t * already-approved background command is \"allow\"). Return undefined to fall\n\t * back to `defaultBehavior`. Floors and matching rules still outrank it --\n\t * this only replaces the fallthrough, never a rule or a mode floor.\n\t */\n\tdefaultBehaviorFor?(params: Static<TParams>): PermissionBehavior | undefined;\n\n\t/** Prepare canonical operation facts on the validated call before authorization and execution. */\n\tprepareCall?(params: Static<TParams>): void;\n\n\t/**\n\t * Describe, for a human about to approve it, what this call would change.\n\t *\n\t * Called by the gate only once it has resolved to `ask`, so an allowed or denied\n\t * call never pays for it. It must read through the value `prepareCall` stored\n\t * rather than re-deriving a target, which is what keeps the diff the user\n\t * approves and the bytes execution writes the same file (ADR 0029). It must not\n\t * execute the tool, write, or widen what the gate already validated.\n\t */\n\tpreviewCall?(params: Static<TParams>): PermissionPreview;\n\t/** Does this call match this rule's content as an allow rule? */\n\tmatches(ruleContent: string, params: Static<TParams>): boolean;\n\t/** Optional deny matcher. It may identify any prohibited part of a structured call. */\n\tmatchesDeny?(ruleContent: string, params: Static<TParams>): boolean;\n\t/** True when the call contains grammar that cannot be safely authorized by an allow. */\n\tisUnknown?(params: Static<TParams>): boolean;\n\n\t/** Human-readable rendering of a rule, for prompts and denial messages. */\n\tdescribe(ruleContent: string): string;\n\n\t/**\n\t * The rule that would allow this exact call — what \"always allow this\"\n\t * persists. Return null when the call is not generalizable into a rule.\n\t */\n\truleForCall(params: Static<TParams>): string | null;\n}\n\nexport interface ContextSpec {\n\t/**\n\t * True when the result's information is recoverable — the same content can be\n\t * obtained again by re-running the tool or reading the workspace.\n\t *\n\t * ONLY recoverable results may be evicted (Phase 3). A tool whose result cannot\n\t * be regenerated (a nondeterministic command, a consumed one-shot resource)\n\t * must set this false, or eviction would silently destroy information the\n\t * transcript is the only record of.\n\t */\n\tresultRecoverable: boolean;\n\n\t/** Marker substituted for an evicted result. */\n\tevictionMarker?: string;\n\n\t/** Announce by name only; load the parameter schema on demand. */\n\tdeferSchema: boolean;\n\n\t/** Soft cap on result tokens before truncation. */\n\toutputBudgetTokens?: number;\n}\n\nexport type EvidenceKind = \"diff\" | \"test\" | \"command\" | \"manual\" | \"workflow\" | \"diagnostic\";\n\n/** Source-observed command facts. `exitCode` is absent only when execution never began. */\nexport interface CommandEvidenceRecord {\n\tkind: \"command\";\n\tcommand: string;\n\tcwd?: string;\n\texecutable?: string;\n\targv?: string[];\n\texitCode?: number | null;\n}\n\n/** A file mutation is identified by hashes and paths, never raw file or patch contents. */\nexport interface DiffEvidenceRecord {\n\tkind: \"diff\";\n\tpath: string;\n\tpatchHash?: string;\n\tcontentHash?: string;\n\tbyteCount?: number;\n}\n\n/** Zero-filled diagnostic severity buckets for one bounded language-server outcome. */\nexport interface DiagnosticSeverityCounts {\n\terror: number;\n\twarning: number;\n\tinformation: number;\n\thint: number;\n\tunspecified: number;\n\tother: number;\n}\n\n/** Stable durable classification. Free-form server and process errors never enter evidence. */\nexport type DiagnosticUnavailableKind =\n\t| \"no-server\"\n\t| \"disposed\"\n\t| \"unsupported-sync\"\n\t| \"timed-out\"\n\t| \"aborted\"\n\t| \"superseded\"\n\t| \"server-failed\";\n\n/** Bounded post-mutation diagnostic facts, never diagnostic messages or rendered failure reasons. */\nexport type DiagnosticEvidenceRecord =\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"ok\";\n\t\t\tserverId: string;\n\t\t\tdiagnosticCount: number;\n\t\t\tseverityCounts: DiagnosticSeverityCounts;\n\t\t\ttruncated: boolean;\n\t  }\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"unavailable\";\n\t\t\tserverId?: string;\n\t\t\tunavailableKind: DiagnosticUnavailableKind;\n\t  };\n\n/** How a `test` run actually ended. */\nexport type TestProcessOutcome = \"exit\" | \"signal\" | \"timeout\" | \"cancelled\" | \"spawn-failed\";\n\n/** Bounded argv-based test execution facts. Full output never enters evidence; it lives in artifacts. */\nexport interface TestEvidenceRecord {\n\tkind: \"test\";\n\tcwd: string;\n\texecutable: string;\n\targv: string[];\n\texitCode: number | null;\n\t/** How the run ended. Unset means a legacy record; derive from `exitCode` when reading. */\n\toutcome?: TestProcessOutcome;\n\t/** True when the model-facing view omitted part of a stream (full output lives in artifacts). */\n\toutputTruncated?: boolean;\n}\n\n/** Explicit human attestation; policy decides how, or whether, it is sufficient. */\nexport interface ManualEvidenceRecord {\n\tkind: \"manual\";\n\tvalue?: unknown;\n\tobserved?: unknown;\n\tstatus?: string;\n}\n\n/** Source facts from approval and delegation workflows. */\nexport interface WorkflowEvidenceRecord {\n\tkind: \"workflow\";\n\tplan?: string;\n\tapproved?: boolean;\n\tagentType?: string;\n\ttask?: string;\n\thandle?: string;\n}\n\n/** A structured source record. Policy is a separate consumer, not an additional variant. */\nexport type EvidenceRecord =\n\t| CommandEvidenceRecord\n\t| DiffEvidenceRecord\n\t| DiagnosticEvidenceRecord\n\t| TestEvidenceRecord\n\t| ManualEvidenceRecord\n\t| WorkflowEvidenceRecord;\n\n/** Durable destination for source-level tool evidence. Policy is deliberately not part of this boundary. */\nexport interface EvidenceSink {\n\trecord(entry: { toolName: string; records: EvidenceRecord[] }): void;\n\trecordDiagnostic?(diagnostic: EvidenceCaptureDiagnostic): void;\n}\n\n/** A capture failure is observable but never changes an already-completed tool result. */\nexport interface EvidenceCaptureDiagnostic {\n\ttoolName: string;\n\treason: string;\n}\n\nexport interface EvidenceSpec<TParams extends TSchema = TSchema, TDetails = unknown> {\n\t/** Kinds this tool can emit. Empty set is valid and explicit. */\n\temits: ReadonlySet<EvidenceKind>;\n\n\t/**\n\t * Derive evidence from a completed call. Runs inside the tool's own execution\n\t * path, with access to what actually happened, not a reconstruction from\n\t * rendered output.\n\t */\n\tcapture(params: Static<TParams>, result: AgentToolResult<TDetails>): EvidenceRecord[];\n}\n\nexport interface ToolContract<TParams extends TSchema = TSchema, TDetails = unknown> {\n\tcapabilities: ReadonlySet<Capability>;\n\tpermission: PermissionSpec<TParams>;\n\tcontext: ContextSpec;\n\tevidence: EvidenceSpec<TParams, TDetails>;\n}\n\n/**\n * Apex Code extends upstream ToolDefinition with exactly one required field.\n *\n * `TState` defaults to `any`, matching upstream `ToolDefinition` exactly (not\n * `unknown`). That default is load-bearing: TypeScript compares two instantiations\n * of the *same* generic interface (here, both rooted in `ToolDefinition`) using each\n * type parameter's declared variance, without expanding `Static<TParams>`\n * structurally — but only when every type argument lines up, including the ones a\n * caller left defaulted. A mismatched default reintroduces a full structural check,\n * where `Static<any>` does not behave like `any`, and breaks every pre-existing\n * `ToolDefinition<any, X>`-typed consumer across the codebase.\n */\nexport interface ApexToolDefinition<TParams extends TSchema = TSchema, TDetails = unknown, TState = any>\n\textends ToolDefinition<TParams, TDetails, TState> {\n\tcontract: ToolContract<TParams, TDetails>;\n}\n\n/**\n * Conservative contract for a tool registered without one -- third-party extension\n * tools, which cannot supply a `contract`. MCP tools no longer land here: they reach\n * the model through the built-in `mcp` proxy, whose contract is declared in\n * `core/mcp/contract.ts`. Full capability set (so it can\n * never widen a delegation ceiling), `ask` by default, never evicted, schema\n * deferred, emits nothing. Matching is exact-argument only: a foreign tool's rule\n * authorizes exactly the call it was generated from, never a pattern.\n *\n * This must also be reported as unclassified wherever a consumer describes the tool\n * registry (contracts.md invariant 1) — a conservative default nobody can see is\n * indistinguishable from a bug.\n */\nexport const UNCLASSIFIED: ToolContract<TSchema, unknown> = {\n\tcapabilities: ALL_CAPABILITIES,\n\tpermission: {\n\t\tdefaultBehavior: \"ask\",\n\t\tmatches: (ruleContent, params) => ruleContent === JSON.stringify(params),\n\t\tdescribe: (ruleContent) => `Exact call: ${ruleContent}`,\n\t\truleForCall: (params) => JSON.stringify(params),\n\t},\n\tcontext: { resultRecoverable: false, deferSchema: false },\n\tevidence: { emits: new Set(), capture: () => [] },\n};\n\n/** Resolve a complete tool contract for enforcement consumers. */\nexport function resolveToolContract(\n\tlookup: (toolName: string) => ToolContract | undefined,\n\ttoolName: string,\n): ToolContract {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n\n/** Resolve the context projection using the same canonical foreign-tool fallback. */\nexport function resolveToolContext(\n\tlookup: (toolName: string) => Pick<ToolContract, \"context\"> | undefined,\n\ttoolName: string,\n): Pick<ToolContract, \"context\"> {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n\n/**\n * A tool whose call shapes differ, declared so a provider can still see its fields.\n *\n * `Type.Union` compiles to `{ anyOf: [...] }`, which carries no top-level\n * `properties`. The Anthropic request builder reads `properties` and `required`\n * directly (`anthropic-messages.js`, `legacyInputSchema`), so a union reached the\n * model as an object with no fields at all. It then guessed, and our own\n * validation rejected the guess.\n *\n * The union still decides what is valid. `properties` is advertisement, listing\n * every field across the variants so a provider that ignores `anyOf` has\n * something to work from. It deliberately carries no `required`, because no field\n * is required by every variant.\n */\nexport function toolUnion<T extends TSchema[]>(variants: [...T], properties: Record<string, TSchema>) {\n\treturn Type.Union(variants, { type: \"object\", properties });\n}\n"]}

package/dist/core/tools/contract.js

@@ -6,6 +6,7 @@
  * permission, context, evidence), which is what keeps a new tool from silently
  * defaulting into "unclassified".
  */
+import { Type } from "typebox";
 export const ALL_CAPABILITIES = new Set([
     "fs.read",
     "fs.write",
@@ -16,8 +17,10 @@ export const ALL_CAPABILITIES = new Set([
     "state",
 ]);
 /**
- * Conservative contract for a tool registered without one — MCP servers and
- * third-party extensions cannot supply a `contract`. Full capability set (so it can
+ * Conservative contract for a tool registered without one -- third-party extension
+ * tools, which cannot supply a `contract`. MCP tools no longer land here: they reach
+ * the model through the built-in `mcp` proxy, whose contract is declared in
+ * `core/mcp/contract.ts`. Full capability set (so it can
  * never widen a delegation ceiling), `ask` by default, never evicted, schema
  * deferred, emits nothing. Matching is exact-argument only: a foreign tool's rule
  * authorizes exactly the call it was generated from, never a pattern.
@@ -45,4 +48,21 @@ export function resolveToolContract(lookup, toolName) {
 export function resolveToolContext(lookup, toolName) {
     return lookup(toolName) ?? UNCLASSIFIED;
 }
+/**
+ * A tool whose call shapes differ, declared so a provider can still see its fields.
+ *
+ * `Type.Union` compiles to `{ anyOf: [...] }`, which carries no top-level
+ * `properties`. The Anthropic request builder reads `properties` and `required`
+ * directly (`anthropic-messages.js`, `legacyInputSchema`), so a union reached the
+ * model as an object with no fields at all. It then guessed, and our own
+ * validation rejected the guess.
+ *
+ * The union still decides what is valid. `properties` is advertisement, listing
+ * every field across the variants so a provider that ignores `anyOf` has
+ * something to work from. It deliberately carries no `required`, because no field
+ * is required by every variant.
+ */
+export function toolUnion(variants, properties) {
+    return Type.Union(variants, { type: "object", properties });
+}
 //# sourceMappingURL=contract.js.map

package/dist/core/tools/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/core/tools/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,CAAC,MAAM,gBAAgB,GAA4B,IAAI,GAAG,CAAa;IAC5E,SAAS;IACT,UAAU;IACV,MAAM;IACN,KAAK;IACL,UAAU;IACV,IAAI;IACJ,OAAO;CACP,CAAC,CAAC;AAgMH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GAAmC;IAC3D,YAAY,EAAE,gBAAgB;IAC9B,UAAU,EAAE;QACX,eAAe,EAAE,KAAK;QACtB,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACxE,QAAQ,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,WAAW,EAAE;QACvD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;KAC/C;IACD,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;IACzD,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;CACjD,CAAC;AAEF,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAClC,MAAsD,EACtD,QAAgB,EACD;IACf,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC;AAAA,CACxC;AAED,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CACjC,MAAuE,EACvE,QAAgB,EACgB;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC;AAAA,CACxC","sourcesContent":["/**\n * The canonical tool contract. Settled by ADR 0010 and specified in full at\n * docs/architecture/contracts.md § 1 — this module implements that shape, it does\n * not redesign it. `contract` is required on every registered tool, and so is every\n * sub-field: a tool cannot compile without answering all four axes (capabilities,\n * permission, context, evidence), which is what keeps a new tool from silently\n * defaulting into \"unclassified\".\n */\n\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport type { Static, TSchema } from \"typebox\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\n\n/** What class of thing a tool does. A set, not a single value — `bash` is `{exec}`. */\nexport type Capability = \"fs.read\" | \"fs.write\" | \"exec\" | \"net\" | \"delegate\" | \"ui\" | \"state\";\n\nexport const ALL_CAPABILITIES: ReadonlySet<Capability> = new Set<Capability>([\n\t\"fs.read\",\n\t\"fs.write\",\n\t\"exec\",\n\t\"net\",\n\t\"delegate\",\n\t\"ui\",\n\t\"state\",\n]);\n\nexport type PermissionBehavior = \"allow\" | \"deny\" | \"ask\";\n\n/**\n * `ruleContent` is interpreted by the tool, never by the rule engine (ADR 0010).\n * That is what lets `Bash(git commit:*)` and `Read(~/.ssh/**)` mean entirely\n * different things while the engine that resolves precedence stays tool-agnostic.\n */\nexport interface PermissionSpec<TParams extends TSchema = TSchema> {\n\t/** Behavior when no rule matches. Read-only tools may default to \"allow\". */\n\tdefaultBehavior: PermissionBehavior;\n\n\t/** Does this call match this rule's content? The tool owns the grammar. */\n\tmatches(ruleContent: string, params: Static<TParams>): boolean;\n\n\t/** Human-readable rendering of a rule, for prompts and denial messages. */\n\tdescribe(ruleContent: string): string;\n\n\t/**\n\t * The rule that would allow this exact call — what \"always allow this\"\n\t * persists. Return null when the call is not generalizable into a rule.\n\t */\n\truleForCall(params: Static<TParams>): string | null;\n}\n\nexport interface ContextSpec {\n\t/**\n\t * True when the result's information is recoverable — the same content can be\n\t * obtained again by re-running the tool or reading the workspace.\n\t *\n\t * ONLY recoverable results may be evicted (Phase 3). A tool whose result cannot\n\t * be regenerated (a nondeterministic command, a consumed one-shot resource)\n\t * must set this false, or eviction would silently destroy information the\n\t * transcript is the only record of.\n\t */\n\tresultRecoverable: boolean;\n\n\t/** Marker substituted for an evicted result. */\n\tevictionMarker?: string;\n\n\t/** Announce by name only; load the parameter schema on demand. */\n\tdeferSchema: boolean;\n\n\t/** Soft cap on result tokens before truncation. */\n\toutputBudgetTokens?: number;\n}\n\nexport type EvidenceKind = \"diff\" | \"test\" | \"command\" | \"manual\" | \"workflow\" | \"diagnostic\";\n\n/** Source-observed command facts. `exitCode` is absent only when execution never began. */\nexport interface CommandEvidenceRecord {\n\tkind: \"command\";\n\tcommand: string;\n\tcwd?: string;\n\texecutable?: string;\n\targv?: string[];\n\texitCode?: number | null;\n}\n\n/** A file mutation is identified by hashes and paths, never raw file or patch contents. */\nexport interface DiffEvidenceRecord {\n\tkind: \"diff\";\n\tpath: string;\n\tpatchHash?: string;\n\tcontentHash?: string;\n\tbyteCount?: number;\n}\n\n/** Zero-filled diagnostic severity buckets for one bounded language-server outcome. */\nexport interface DiagnosticSeverityCounts {\n\terror: number;\n\twarning: number;\n\tinformation: number;\n\thint: number;\n\tunspecified: number;\n\tother: number;\n}\n\n/** Stable durable classification. Free-form server and process errors never enter evidence. */\nexport type DiagnosticUnavailableKind =\n\t| \"no-server\"\n\t| \"disposed\"\n\t| \"unsupported-sync\"\n\t| \"timed-out\"\n\t| \"aborted\"\n\t| \"superseded\"\n\t| \"server-failed\";\n\n/** Bounded post-mutation diagnostic facts, never diagnostic messages or rendered failure reasons. */\nexport type DiagnosticEvidenceRecord =\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"ok\";\n\t\t\tserverId: string;\n\t\t\tdiagnosticCount: number;\n\t\t\tseverityCounts: DiagnosticSeverityCounts;\n\t\t\ttruncated: boolean;\n\t  }\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"unavailable\";\n\t\t\tserverId?: string;\n\t\t\tunavailableKind: DiagnosticUnavailableKind;\n\t  };\n\n/** Normalized argv-based test execution facts. */\nexport interface TestEvidenceRecord {\n\tkind: \"test\";\n\tcwd: string;\n\texecutable: string;\n\targv: string[];\n\texitCode: number | null;\n}\n\n/** Explicit human attestation; policy decides how, or whether, it is sufficient. */\nexport interface ManualEvidenceRecord {\n\tkind: \"manual\";\n\tvalue?: unknown;\n\tobserved?: unknown;\n\tstatus?: string;\n}\n\n/** Source facts from approval and delegation workflows. */\nexport interface WorkflowEvidenceRecord {\n\tkind: \"workflow\";\n\tplan?: string;\n\tapproved?: boolean;\n\tagentType?: string;\n\ttask?: string;\n\thandle?: string;\n}\n\n/** A structured source record. Policy is a separate consumer, not an additional variant. */\nexport type EvidenceRecord =\n\t| CommandEvidenceRecord\n\t| DiffEvidenceRecord\n\t| DiagnosticEvidenceRecord\n\t| TestEvidenceRecord\n\t| ManualEvidenceRecord\n\t| WorkflowEvidenceRecord;\n\n/** Durable destination for source-level tool evidence. Policy is deliberately not part of this boundary. */\nexport interface EvidenceSink {\n\trecord(entry: { toolName: string; records: EvidenceRecord[] }): void;\n\trecordDiagnostic?(diagnostic: EvidenceCaptureDiagnostic): void;\n}\n\n/** A capture failure is observable but never changes an already-completed tool result. */\nexport interface EvidenceCaptureDiagnostic {\n\ttoolName: string;\n\treason: string;\n}\n\nexport interface EvidenceSpec<TParams extends TSchema = TSchema, TDetails = unknown> {\n\t/** Kinds this tool can emit. Empty set is valid and explicit. */\n\temits: ReadonlySet<EvidenceKind>;\n\n\t/**\n\t * Derive evidence from a completed call. Runs inside the tool's own execution\n\t * path, with access to what actually happened, not a reconstruction from\n\t * rendered output.\n\t */\n\tcapture(params: Static<TParams>, result: AgentToolResult<TDetails>): EvidenceRecord[];\n}\n\nexport interface ToolContract<TParams extends TSchema = TSchema, TDetails = unknown> {\n\tcapabilities: ReadonlySet<Capability>;\n\tpermission: PermissionSpec<TParams>;\n\tcontext: ContextSpec;\n\tevidence: EvidenceSpec<TParams, TDetails>;\n}\n\n/**\n * Apex Code extends upstream ToolDefinition with exactly one required field.\n *\n * `TState` defaults to `any`, matching upstream `ToolDefinition` exactly (not\n * `unknown`). That default is load-bearing: TypeScript compares two instantiations\n * of the *same* generic interface (here, both rooted in `ToolDefinition`) using each\n * type parameter's declared variance, without expanding `Static<TParams>`\n * structurally — but only when every type argument lines up, including the ones a\n * caller left defaulted. A mismatched default reintroduces a full structural check,\n * where `Static<any>` does not behave like `any`, and breaks every pre-existing\n * `ToolDefinition<any, X>`-typed consumer across the codebase.\n */\nexport interface ApexToolDefinition<TParams extends TSchema = TSchema, TDetails = unknown, TState = any>\n\textends ToolDefinition<TParams, TDetails, TState> {\n\tcontract: ToolContract<TParams, TDetails>;\n}\n\n/**\n * Conservative contract for a tool registered without one — MCP servers and\n * third-party extensions cannot supply a `contract`. Full capability set (so it can\n * never widen a delegation ceiling), `ask` by default, never evicted, schema\n * deferred, emits nothing. Matching is exact-argument only: a foreign tool's rule\n * authorizes exactly the call it was generated from, never a pattern.\n *\n * This must also be reported as unclassified wherever a consumer describes the tool\n * registry (contracts.md invariant 1) — a conservative default nobody can see is\n * indistinguishable from a bug.\n */\nexport const UNCLASSIFIED: ToolContract<TSchema, unknown> = {\n\tcapabilities: ALL_CAPABILITIES,\n\tpermission: {\n\t\tdefaultBehavior: \"ask\",\n\t\tmatches: (ruleContent, params) => ruleContent === JSON.stringify(params),\n\t\tdescribe: (ruleContent) => `Exact call: ${ruleContent}`,\n\t\truleForCall: (params) => JSON.stringify(params),\n\t},\n\tcontext: { resultRecoverable: false, deferSchema: false },\n\tevidence: { emits: new Set(), capture: () => [] },\n};\n\n/** Resolve a complete tool contract for enforcement consumers. */\nexport function resolveToolContract(\n\tlookup: (toolName: string) => ToolContract | undefined,\n\ttoolName: string,\n): ToolContract {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n\n/** Resolve the context projection using the same canonical foreign-tool fallback. */\nexport function resolveToolContext(\n\tlookup: (toolName: string) => Pick<ToolContract, \"context\"> | undefined,\n\ttoolName: string,\n): Pick<ToolContract, \"context\"> {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n"]}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../../../src/core/tools/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAA6B,IAAI,EAAE,MAAM,SAAS,CAAC;AAO1D,MAAM,CAAC,MAAM,gBAAgB,GAA4B,IAAI,GAAG,CAAa;IAC5E,SAAS;IACT,UAAU;IACV,MAAM;IACN,KAAK;IACL,UAAU;IACV,IAAI;IACJ,OAAO;CACP,CAAC,CAAC;AAiOH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAmC;IAC3D,YAAY,EAAE,gBAAgB;IAC9B,UAAU,EAAE;QACX,eAAe,EAAE,KAAK;QACtB,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,WAAW,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QACxE,QAAQ,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,WAAW,EAAE;QACvD,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;KAC/C;IACD,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;IACzD,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;CACjD,CAAC;AAEF,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAClC,MAAsD,EACtD,QAAgB,EACD;IACf,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC;AAAA,CACxC;AAED,qFAAqF;AACrF,MAAM,UAAU,kBAAkB,CACjC,MAAuE,EACvE,QAAgB,EACgB;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC;AAAA,CACxC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAsB,QAAgB,EAAE,UAAmC,EAAE;IACrG,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AAAA,CAC5D","sourcesContent":["/**\n * The canonical tool contract. Settled by ADR 0010 and specified in full at\n * docs/architecture/contracts.md § 1 — this module implements that shape, it does\n * not redesign it. `contract` is required on every registered tool, and so is every\n * sub-field: a tool cannot compile without answering all four axes (capabilities,\n * permission, context, evidence), which is what keeps a new tool from silently\n * defaulting into \"unclassified\".\n */\n\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport { type Static, type TSchema, Type } from \"typebox\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\nimport type { PermissionPreview } from \"../permissions/responder.ts\";\n\n/** What class of thing a tool does. A set, not a single value — `bash` is `{exec}`. */\nexport type Capability = \"fs.read\" | \"fs.write\" | \"exec\" | \"net\" | \"delegate\" | \"ui\" | \"state\";\n\nexport const ALL_CAPABILITIES: ReadonlySet<Capability> = new Set<Capability>([\n\t\"fs.read\",\n\t\"fs.write\",\n\t\"exec\",\n\t\"net\",\n\t\"delegate\",\n\t\"ui\",\n\t\"state\",\n]);\n\nexport type PermissionBehavior = \"allow\" | \"deny\" | \"ask\";\n\n/**\n * `ruleContent` is interpreted by the tool, never by the rule engine (ADR 0010).\n * That is what lets `Bash(git commit:*)` and `Read(~/.ssh/**)` mean entirely\n * different things while the engine that resolves precedence stays tool-agnostic.\n */\nexport interface PermissionSpec<TParams extends TSchema = TSchema> {\n\t/** Behavior when no rule matches. Read-only tools may default to \"allow\". */\n\tdefaultBehavior: PermissionBehavior;\n\n\t/**\n\t * Per-call behavior when no rule matches, for tools whose calls differ in\n\t * nature (bash: launching a command is \"ask\", retrieving or killing an\n\t * already-approved background command is \"allow\"). Return undefined to fall\n\t * back to `defaultBehavior`. Floors and matching rules still outrank it --\n\t * this only replaces the fallthrough, never a rule or a mode floor.\n\t */\n\tdefaultBehaviorFor?(params: Static<TParams>): PermissionBehavior | undefined;\n\n\t/** Prepare canonical operation facts on the validated call before authorization and execution. */\n\tprepareCall?(params: Static<TParams>): void;\n\n\t/**\n\t * Describe, for a human about to approve it, what this call would change.\n\t *\n\t * Called by the gate only once it has resolved to `ask`, so an allowed or denied\n\t * call never pays for it. It must read through the value `prepareCall` stored\n\t * rather than re-deriving a target, which is what keeps the diff the user\n\t * approves and the bytes execution writes the same file (ADR 0029). It must not\n\t * execute the tool, write, or widen what the gate already validated.\n\t */\n\tpreviewCall?(params: Static<TParams>): PermissionPreview;\n\t/** Does this call match this rule's content as an allow rule? */\n\tmatches(ruleContent: string, params: Static<TParams>): boolean;\n\t/** Optional deny matcher. It may identify any prohibited part of a structured call. */\n\tmatchesDeny?(ruleContent: string, params: Static<TParams>): boolean;\n\t/** True when the call contains grammar that cannot be safely authorized by an allow. */\n\tisUnknown?(params: Static<TParams>): boolean;\n\n\t/** Human-readable rendering of a rule, for prompts and denial messages. */\n\tdescribe(ruleContent: string): string;\n\n\t/**\n\t * The rule that would allow this exact call — what \"always allow this\"\n\t * persists. Return null when the call is not generalizable into a rule.\n\t */\n\truleForCall(params: Static<TParams>): string | null;\n}\n\nexport interface ContextSpec {\n\t/**\n\t * True when the result's information is recoverable — the same content can be\n\t * obtained again by re-running the tool or reading the workspace.\n\t *\n\t * ONLY recoverable results may be evicted (Phase 3). A tool whose result cannot\n\t * be regenerated (a nondeterministic command, a consumed one-shot resource)\n\t * must set this false, or eviction would silently destroy information the\n\t * transcript is the only record of.\n\t */\n\tresultRecoverable: boolean;\n\n\t/** Marker substituted for an evicted result. */\n\tevictionMarker?: string;\n\n\t/** Announce by name only; load the parameter schema on demand. */\n\tdeferSchema: boolean;\n\n\t/** Soft cap on result tokens before truncation. */\n\toutputBudgetTokens?: number;\n}\n\nexport type EvidenceKind = \"diff\" | \"test\" | \"command\" | \"manual\" | \"workflow\" | \"diagnostic\";\n\n/** Source-observed command facts. `exitCode` is absent only when execution never began. */\nexport interface CommandEvidenceRecord {\n\tkind: \"command\";\n\tcommand: string;\n\tcwd?: string;\n\texecutable?: string;\n\targv?: string[];\n\texitCode?: number | null;\n}\n\n/** A file mutation is identified by hashes and paths, never raw file or patch contents. */\nexport interface DiffEvidenceRecord {\n\tkind: \"diff\";\n\tpath: string;\n\tpatchHash?: string;\n\tcontentHash?: string;\n\tbyteCount?: number;\n}\n\n/** Zero-filled diagnostic severity buckets for one bounded language-server outcome. */\nexport interface DiagnosticSeverityCounts {\n\terror: number;\n\twarning: number;\n\tinformation: number;\n\thint: number;\n\tunspecified: number;\n\tother: number;\n}\n\n/** Stable durable classification. Free-form server and process errors never enter evidence. */\nexport type DiagnosticUnavailableKind =\n\t| \"no-server\"\n\t| \"disposed\"\n\t| \"unsupported-sync\"\n\t| \"timed-out\"\n\t| \"aborted\"\n\t| \"superseded\"\n\t| \"server-failed\";\n\n/** Bounded post-mutation diagnostic facts, never diagnostic messages or rendered failure reasons. */\nexport type DiagnosticEvidenceRecord =\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"ok\";\n\t\t\tserverId: string;\n\t\t\tdiagnosticCount: number;\n\t\t\tseverityCounts: DiagnosticSeverityCounts;\n\t\t\ttruncated: boolean;\n\t  }\n\t| {\n\t\t\tkind: \"diagnostic\";\n\t\t\tpath: string;\n\t\t\tstatus: \"unavailable\";\n\t\t\tserverId?: string;\n\t\t\tunavailableKind: DiagnosticUnavailableKind;\n\t  };\n\n/** How a `test` run actually ended. */\nexport type TestProcessOutcome = \"exit\" | \"signal\" | \"timeout\" | \"cancelled\" | \"spawn-failed\";\n\n/** Bounded argv-based test execution facts. Full output never enters evidence; it lives in artifacts. */\nexport interface TestEvidenceRecord {\n\tkind: \"test\";\n\tcwd: string;\n\texecutable: string;\n\targv: string[];\n\texitCode: number | null;\n\t/** How the run ended. Unset means a legacy record; derive from `exitCode` when reading. */\n\toutcome?: TestProcessOutcome;\n\t/** True when the model-facing view omitted part of a stream (full output lives in artifacts). */\n\toutputTruncated?: boolean;\n}\n\n/** Explicit human attestation; policy decides how, or whether, it is sufficient. */\nexport interface ManualEvidenceRecord {\n\tkind: \"manual\";\n\tvalue?: unknown;\n\tobserved?: unknown;\n\tstatus?: string;\n}\n\n/** Source facts from approval and delegation workflows. */\nexport interface WorkflowEvidenceRecord {\n\tkind: \"workflow\";\n\tplan?: string;\n\tapproved?: boolean;\n\tagentType?: string;\n\ttask?: string;\n\thandle?: string;\n}\n\n/** A structured source record. Policy is a separate consumer, not an additional variant. */\nexport type EvidenceRecord =\n\t| CommandEvidenceRecord\n\t| DiffEvidenceRecord\n\t| DiagnosticEvidenceRecord\n\t| TestEvidenceRecord\n\t| ManualEvidenceRecord\n\t| WorkflowEvidenceRecord;\n\n/** Durable destination for source-level tool evidence. Policy is deliberately not part of this boundary. */\nexport interface EvidenceSink {\n\trecord(entry: { toolName: string; records: EvidenceRecord[] }): void;\n\trecordDiagnostic?(diagnostic: EvidenceCaptureDiagnostic): void;\n}\n\n/** A capture failure is observable but never changes an already-completed tool result. */\nexport interface EvidenceCaptureDiagnostic {\n\ttoolName: string;\n\treason: string;\n}\n\nexport interface EvidenceSpec<TParams extends TSchema = TSchema, TDetails = unknown> {\n\t/** Kinds this tool can emit. Empty set is valid and explicit. */\n\temits: ReadonlySet<EvidenceKind>;\n\n\t/**\n\t * Derive evidence from a completed call. Runs inside the tool's own execution\n\t * path, with access to what actually happened, not a reconstruction from\n\t * rendered output.\n\t */\n\tcapture(params: Static<TParams>, result: AgentToolResult<TDetails>): EvidenceRecord[];\n}\n\nexport interface ToolContract<TParams extends TSchema = TSchema, TDetails = unknown> {\n\tcapabilities: ReadonlySet<Capability>;\n\tpermission: PermissionSpec<TParams>;\n\tcontext: ContextSpec;\n\tevidence: EvidenceSpec<TParams, TDetails>;\n}\n\n/**\n * Apex Code extends upstream ToolDefinition with exactly one required field.\n *\n * `TState` defaults to `any`, matching upstream `ToolDefinition` exactly (not\n * `unknown`). That default is load-bearing: TypeScript compares two instantiations\n * of the *same* generic interface (here, both rooted in `ToolDefinition`) using each\n * type parameter's declared variance, without expanding `Static<TParams>`\n * structurally — but only when every type argument lines up, including the ones a\n * caller left defaulted. A mismatched default reintroduces a full structural check,\n * where `Static<any>` does not behave like `any`, and breaks every pre-existing\n * `ToolDefinition<any, X>`-typed consumer across the codebase.\n */\nexport interface ApexToolDefinition<TParams extends TSchema = TSchema, TDetails = unknown, TState = any>\n\textends ToolDefinition<TParams, TDetails, TState> {\n\tcontract: ToolContract<TParams, TDetails>;\n}\n\n/**\n * Conservative contract for a tool registered without one -- third-party extension\n * tools, which cannot supply a `contract`. MCP tools no longer land here: they reach\n * the model through the built-in `mcp` proxy, whose contract is declared in\n * `core/mcp/contract.ts`. Full capability set (so it can\n * never widen a delegation ceiling), `ask` by default, never evicted, schema\n * deferred, emits nothing. Matching is exact-argument only: a foreign tool's rule\n * authorizes exactly the call it was generated from, never a pattern.\n *\n * This must also be reported as unclassified wherever a consumer describes the tool\n * registry (contracts.md invariant 1) — a conservative default nobody can see is\n * indistinguishable from a bug.\n */\nexport const UNCLASSIFIED: ToolContract<TSchema, unknown> = {\n\tcapabilities: ALL_CAPABILITIES,\n\tpermission: {\n\t\tdefaultBehavior: \"ask\",\n\t\tmatches: (ruleContent, params) => ruleContent === JSON.stringify(params),\n\t\tdescribe: (ruleContent) => `Exact call: ${ruleContent}`,\n\t\truleForCall: (params) => JSON.stringify(params),\n\t},\n\tcontext: { resultRecoverable: false, deferSchema: false },\n\tevidence: { emits: new Set(), capture: () => [] },\n};\n\n/** Resolve a complete tool contract for enforcement consumers. */\nexport function resolveToolContract(\n\tlookup: (toolName: string) => ToolContract | undefined,\n\ttoolName: string,\n): ToolContract {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n\n/** Resolve the context projection using the same canonical foreign-tool fallback. */\nexport function resolveToolContext(\n\tlookup: (toolName: string) => Pick<ToolContract, \"context\"> | undefined,\n\ttoolName: string,\n): Pick<ToolContract, \"context\"> {\n\treturn lookup(toolName) ?? UNCLASSIFIED;\n}\n\n/**\n * A tool whose call shapes differ, declared so a provider can still see its fields.\n *\n * `Type.Union` compiles to `{ anyOf: [...] }`, which carries no top-level\n * `properties`. The Anthropic request builder reads `properties` and `required`\n * directly (`anthropic-messages.js`, `legacyInputSchema`), so a union reached the\n * model as an object with no fields at all. It then guessed, and our own\n * validation rejected the guess.\n *\n * The union still decides what is valid. `properties` is advertisement, listing\n * every field across the variants so a provider that ignores `anyOf` has\n * something to work from. It deliberately carries no `required`, because no field\n * is required by every variant.\n */\nexport function toolUnion<T extends TSchema[]>(variants: [...T], properties: Record<string, TSchema>) {\n\treturn Type.Union(variants, { type: \"object\", properties });\n}\n"]}

package/dist/core/tools/delegate.d.ts

@@ -1,6 +1,6 @@
 import { type Static, Type } from "typebox";
 import type { DelegationRuntimeOptions } from "../delegation/runtime.ts";
-import type { ApexToolDefinition } from "./contract.ts";
+import { type ApexToolDefinition } from "./contract.ts";
 declare const delegateSchema: Type.TUnion<[Type.TObject<{
     agentType: Type.TString;
     task: Type.TString;
@@ -21,9 +21,11 @@ export interface DelegateDetails {
  * real child through the injected `DelegationRuntimeOptions` -- capability ceiling,
  * derived permission store, and child-session construction all live behind that
  * injection (ADR 0008), matching the `todo_write`/`tool_schema` convention of
- * injecting collaborators rather than reaching for global state. Recursion depth
- * (task 5.3), artifact isolation (task 5.4), and real agent discovery (task 5.5,
- * replacing the resolver a test or caller injects here) are not yet wired.
+ * injecting collaborators rather than reaching for global state. Recursion
+ * depth, artifact isolation, and real agent discovery are wired:
+ * `../delegation/runtime.ts` bounds depth and roots per-child artifact
+ * directories, and `../delegation/agents.ts` supplies production markdown
+ * discovery through the injected resolver.
  */
 export declare function createDelegateToolDefinition(runtime: DelegationRuntimeOptions): ApexToolDefinition<typeof delegateSchema, DelegateDetails>;
 export declare function createDelegateTool(runtime: DelegationRuntimeOptions): import("apex-code-agent-core").AgentTool<Type.TUnion<[Type.TObject<{

package/dist/core/tools/delegate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../../../src/core/tools/delegate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,eAAe,CAAC;AAGxE,QAAA,MAAM,cAAc;;;;;;;IAYlB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,wBAAwB,GAC/B,kBAAkB,CAAC,OAAO,cAAc,EAAE,eAAe,CAAC,CAiD5D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,wBAAwB;;;;;;;uBAEnE","sourcesContent":["import { Text } from \"@earendil-works/pi-tui\";\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport { minimatch } from \"minimatch\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport type { DelegationRuntimeOptions } from \"../delegation/runtime.ts\";\nimport { retrieveDelegationResult, runDelegation } from \"../delegation/runtime.ts\";\nimport type { ApexToolDefinition, EvidenceRecord } from \"./contract.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst delegateSchema = Type.Union([\n\tType.Object({\n\t\tagentType: Type.String({ description: \"The type of subagent to delegate to.\" }),\n\t\ttask: Type.String({ description: \"The task to delegate.\" }),\n\t\tbackground: Type.Optional(\n\t\t\tType.Boolean({ description: \"Return a handle immediately instead of waiting for the child.\" }),\n\t\t),\n\t}),\n\tType.Object({\n\t\tagentType: Type.String({ description: \"The agent type that produced the background result.\" }),\n\t\thandle: Type.String({ description: \"A background delegation handle returned by an earlier call.\" }),\n\t}),\n]);\n\nexport type DelegateInput = Static<typeof delegateSchema>;\n\nexport interface DelegateDetails {\n\tagentType: string;\n\ttask: string;\n\toutput: string;\n\thandle?: string;\n}\n\nfunction formatDelegateCall(input: DelegateInput, theme: Theme): string {\n\tif (\"handle\" in input) {\n\t\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · retrieve`;\n\t}\n\tconst task = input.task.replace(/\\s+/g, \" \").trim();\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · ${theme.fg(\"toolOutput\", task)}`;\n}\n\nfunction formatDelegateResult(details: DelegateDetails, expanded: boolean, theme: Theme): string {\n\tif (expanded) return theme.fg(\"toolOutput\", details.output);\n\tconst lineCount = details.output ? details.output.split(\"\\n\").length : 0;\n\treturn `${theme.fg(\"accent\", details.agentType)} · ${lineCount} ${lineCount === 1 ? \"line\" : \"lines\"}`;\n}\n\n/**\n * The delegation entry point (task 4.6's contract, task 5.2's execution). Runs a\n * real child through the injected `DelegationRuntimeOptions` -- capability ceiling,\n * derived permission store, and child-session construction all live behind that\n * injection (ADR 0008), matching the `todo_write`/`tool_schema` convention of\n * injecting collaborators rather than reaching for global state. Recursion depth\n * (task 5.3), artifact isolation (task 5.4), and real agent discovery (task 5.5,\n * replacing the resolver a test or caller injects here) are not yet wired.\n */\nexport function createDelegateToolDefinition(\n\truntime: DelegationRuntimeOptions,\n): ApexToolDefinition<typeof delegateSchema, DelegateDetails> {\n\treturn {\n\t\tname: \"delegate\",\n\t\tlabel: \"delegate\",\n\t\tdescription: \"Delegate a task to a subagent.\",\n\t\tparameters: delegateSchema,\n\t\tcontract: {\n\t\t\tcapabilities: new Set([\"delegate\"]),\n\t\t\tpermission: {\n\t\t\t\tdefaultBehavior: \"ask\",\n\t\t\t\tmatches: (ruleContent, params) => minimatch(params.agentType, ruleContent),\n\t\t\t\tdescribe: (ruleContent) => `Delegate to agent types matching \"${ruleContent}\"`,\n\t\t\t\truleForCall: (params) => params.agentType,\n\t\t\t},\n\t\t\tcontext: { resultRecoverable: false, deferSchema: true },\n\t\t\tevidence: {\n\t\t\t\temits: new Set([\"workflow\"]),\n\t\t\t\tcapture: (params): EvidenceRecord[] =>\n\t\t\t\t\t\"task\" in params\n\t\t\t\t\t\t? [{ kind: \"workflow\", agentType: params.agentType, task: params.task }]\n\t\t\t\t\t\t: [{ kind: \"workflow\", agentType: params.agentType, handle: params.handle }],\n\t\t\t},\n\t\t},\n\t\tasync execute(_toolCallId, input: DelegateInput): Promise<AgentToolResult<DelegateDetails>> {\n\t\t\tconst result =\n\t\t\t\t\"task\" in input\n\t\t\t\t\t? await runDelegation(runtime, input.agentType, input.task, { background: input.background })\n\t\t\t\t\t: await retrieveDelegationResult(runtime, input.handle, input.agentType);\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text: result.output }],\n\t\t\t\tdetails: {\n\t\t\t\t\tagentType: result.agentType,\n\t\t\t\t\ttask: result.task,\n\t\t\t\t\toutput: result.output,\n\t\t\t\t\thandle: result.handleId,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t\trenderCall(input, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateCall(input, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateResult(result.details, options.expanded, theme));\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createDelegateTool(runtime: DelegationRuntimeOptions) {\n\treturn wrapToolDefinition(createDelegateToolDefinition(runtime));\n}\n"]}
+{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../../../src/core/tools/delegate.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAE,KAAK,kBAAkB,EAAkC,MAAM,eAAe,CAAC;AAgBxF,QAAA,MAAM,cAAc;;;;;;;IAUnB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAgBD;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,wBAAwB,GAC/B,kBAAkB,CAAC,OAAO,cAAc,EAAE,eAAe,CAAC,CAiD5D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,wBAAwB;;;;;;;uBAEnE","sourcesContent":["import { Text } from \"@earendil-works/pi-tui\";\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport { minimatch } from \"minimatch\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport type { DelegationRuntimeOptions } from \"../delegation/runtime.ts\";\nimport { retrieveDelegationResult, runDelegation } from \"../delegation/runtime.ts\";\nimport { type ApexToolDefinition, type EvidenceRecord, toolUnion } from \"./contract.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst delegateSchemaProperties = {\n\tagentType: Type.String({\n\t\tdescription: \"The subagent type. Required both to launch a task and to retrieve a background result.\",\n\t}),\n\ttask: Type.String({ description: \"The task to delegate. Supply it to launch a delegation.\" }),\n\tbackground: Type.Optional(\n\t\tType.Boolean({ description: \"Return a handle immediately instead of waiting for the child.\" }),\n\t),\n\thandle: Type.String({\n\t\tdescription: \"A background delegation handle returned by an earlier call. Supply it to retrieve the result.\",\n\t}),\n};\n\nconst delegateSchema = toolUnion(\n\t[\n\t\tType.Object({\n\t\t\tagentType: Type.String(),\n\t\t\ttask: Type.String(),\n\t\t\tbackground: Type.Optional(Type.Boolean()),\n\t\t}),\n\t\tType.Object({ agentType: Type.String(), handle: Type.String() }),\n\t],\n\tdelegateSchemaProperties,\n);\n\nexport type DelegateInput = Static<typeof delegateSchema>;\n\nexport interface DelegateDetails {\n\tagentType: string;\n\ttask: string;\n\toutput: string;\n\thandle?: string;\n}\n\nfunction formatDelegateCall(input: DelegateInput, theme: Theme): string {\n\tif (\"handle\" in input) {\n\t\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · retrieve`;\n\t}\n\tconst task = input.task.replace(/\\s+/g, \" \").trim();\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · ${theme.fg(\"toolOutput\", task)}`;\n}\n\nfunction formatDelegateResult(details: DelegateDetails, expanded: boolean, theme: Theme): string {\n\tif (expanded) return theme.fg(\"toolOutput\", details.output);\n\tconst lineCount = details.output ? details.output.split(\"\\n\").length : 0;\n\treturn `${theme.fg(\"accent\", details.agentType)} · ${lineCount} ${lineCount === 1 ? \"line\" : \"lines\"}`;\n}\n\n/**\n * The delegation entry point (task 4.6's contract, task 5.2's execution). Runs a\n * real child through the injected `DelegationRuntimeOptions` -- capability ceiling,\n * derived permission store, and child-session construction all live behind that\n * injection (ADR 0008), matching the `todo_write`/`tool_schema` convention of\n * injecting collaborators rather than reaching for global state. Recursion\n * depth, artifact isolation, and real agent discovery are wired:\n * `../delegation/runtime.ts` bounds depth and roots per-child artifact\n * directories, and `../delegation/agents.ts` supplies production markdown\n * discovery through the injected resolver.\n */\nexport function createDelegateToolDefinition(\n\truntime: DelegationRuntimeOptions,\n): ApexToolDefinition<typeof delegateSchema, DelegateDetails> {\n\treturn {\n\t\tname: \"delegate\",\n\t\tlabel: \"delegate\",\n\t\tdescription: \"Delegate a task to a subagent.\",\n\t\tparameters: delegateSchema,\n\t\tcontract: {\n\t\t\tcapabilities: new Set([\"delegate\"]),\n\t\t\tpermission: {\n\t\t\t\tdefaultBehavior: \"ask\",\n\t\t\t\tmatches: (ruleContent, params) => minimatch(params.agentType, ruleContent),\n\t\t\t\tdescribe: (ruleContent) => `Delegate to agent types matching \"${ruleContent}\"`,\n\t\t\t\truleForCall: (params) => params.agentType,\n\t\t\t},\n\t\t\tcontext: { resultRecoverable: false, deferSchema: true },\n\t\t\tevidence: {\n\t\t\t\temits: new Set([\"workflow\"]),\n\t\t\t\tcapture: (params): EvidenceRecord[] =>\n\t\t\t\t\t\"task\" in params\n\t\t\t\t\t\t? [{ kind: \"workflow\", agentType: params.agentType, task: params.task }]\n\t\t\t\t\t\t: [{ kind: \"workflow\", agentType: params.agentType, handle: params.handle }],\n\t\t\t},\n\t\t},\n\t\tasync execute(_toolCallId, input: DelegateInput): Promise<AgentToolResult<DelegateDetails>> {\n\t\t\tconst result =\n\t\t\t\t\"task\" in input\n\t\t\t\t\t? await runDelegation(runtime, input.agentType, input.task, { background: input.background })\n\t\t\t\t\t: await retrieveDelegationResult(runtime, input.handle, input.agentType);\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text: result.output }],\n\t\t\t\tdetails: {\n\t\t\t\t\tagentType: result.agentType,\n\t\t\t\t\ttask: result.task,\n\t\t\t\t\toutput: result.output,\n\t\t\t\t\thandle: result.handleId,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t\trenderCall(input, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateCall(input, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateResult(result.details, options.expanded, theme));\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createDelegateTool(runtime: DelegationRuntimeOptions) {\n\treturn wrapToolDefinition(createDelegateToolDefinition(runtime));\n}\n"]}

package/dist/core/tools/delegate.js

@@ -2,18 +2,26 @@ import { Text } from "@earendil-works/pi-tui";
 import { minimatch } from "minimatch";
 import { Type } from "typebox";
 import { retrieveDelegationResult, runDelegation } from "../delegation/runtime.js";
+import { toolUnion } from "./contract.js";
 import { wrapToolDefinition } from "./tool-definition-wrapper.js";
-const delegateSchema = Type.Union([
-    Type.Object({
-        agentType: Type.String({ description: "The type of subagent to delegate to." }),
-        task: Type.String({ description: "The task to delegate." }),
-        background: Type.Optional(Type.Boolean({ description: "Return a handle immediately instead of waiting for the child." })),
+const delegateSchemaProperties = {
+    agentType: Type.String({
+        description: "The subagent type. Required both to launch a task and to retrieve a background result.",
+    }),
+    task: Type.String({ description: "The task to delegate. Supply it to launch a delegation." }),
+    background: Type.Optional(Type.Boolean({ description: "Return a handle immediately instead of waiting for the child." })),
+    handle: Type.String({
+        description: "A background delegation handle returned by an earlier call. Supply it to retrieve the result.",
     }),
+};
+const delegateSchema = toolUnion([
     Type.Object({
-        agentType: Type.String({ description: "The agent type that produced the background result." }),
-        handle: Type.String({ description: "A background delegation handle returned by an earlier call." }),
+        agentType: Type.String(),
+        task: Type.String(),
+        background: Type.Optional(Type.Boolean()),
     }),
-]);
+    Type.Object({ agentType: Type.String(), handle: Type.String() }),
+], delegateSchemaProperties);
 function formatDelegateCall(input, theme) {
     if ("handle" in input) {
         return `${theme.fg("toolTitle", theme.bold("delegate"))} ${theme.fg("accent", input.agentType)} · retrieve`;
@@ -32,9 +40,11 @@ function formatDelegateResult(details, expanded, theme) {
  * real child through the injected `DelegationRuntimeOptions` -- capability ceiling,
  * derived permission store, and child-session construction all live behind that
  * injection (ADR 0008), matching the `todo_write`/`tool_schema` convention of
- * injecting collaborators rather than reaching for global state. Recursion depth
- * (task 5.3), artifact isolation (task 5.4), and real agent discovery (task 5.5,
- * replacing the resolver a test or caller injects here) are not yet wired.
+ * injecting collaborators rather than reaching for global state. Recursion
+ * depth, artifact isolation, and real agent discovery are wired:
+ * `../delegation/runtime.ts` bounds depth and roots per-child artifact
+ * directories, and `../delegation/agents.ts` supplies production markdown
+ * discovery through the injected resolver.
  */
 export function createDelegateToolDefinition(runtime) {
     return {

package/dist/core/tools/delegate.js.map

@@ -1 +1 @@
-{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../../../src/core/tools/delegate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAG5C,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;QAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;QAC3D,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC,CAC9F;KACD,CAAC;IACF,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;QAC9F,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;KACnG,CAAC;CACF,CAAC,CAAC;AAWH,SAAS,kBAAkB,CAAC,KAAoB,EAAE,KAAY,EAAU;IACvE,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,cAAa,CAAC;IAC7G,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,OAAM,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,CACnI;AAED,SAAS,oBAAoB,CAAC,OAAwB,EAAE,QAAiB,EAAE,KAAY,EAAU;IAChG,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,OAAM,SAAS,IAAI,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAAA,CACvG;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC3C,OAAiC,EAC4B;IAC7D,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,gCAAgC;QAC7C,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE;YACT,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;YACnC,UAAU,EAAE;gBACX,eAAe,EAAE,KAAK;gBACtB,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;gBAC1E,QAAQ,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,qCAAqC,WAAW,GAAG;gBAC9E,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS;aACzC;YACD,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;YACxD,QAAQ,EAAE;gBACT,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC,MAAM,EAAoB,EAAE,CACrC,MAAM,IAAI,MAAM;oBACf,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;oBACxE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC9E;SACD;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAoB,EAA6C;YAC3F,MAAM,MAAM,GACX,MAAM,IAAI,KAAK;gBACd,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC7F,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChD,OAAO,EAAE;oBACR,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,QAAQ;iBACvB;aACD,CAAC;QAAA,CACF;QACD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;YACjC,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QAAA,CACZ;QACD,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7C,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QAAA,CACZ;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAiC,EAAE;IACrE,OAAO,kBAAkB,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC;AAAA,CACjE","sourcesContent":["import { Text } from \"@earendil-works/pi-tui\";\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport { minimatch } from \"minimatch\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport type { DelegationRuntimeOptions } from \"../delegation/runtime.ts\";\nimport { retrieveDelegationResult, runDelegation } from \"../delegation/runtime.ts\";\nimport type { ApexToolDefinition, EvidenceRecord } from \"./contract.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst delegateSchema = Type.Union([\n\tType.Object({\n\t\tagentType: Type.String({ description: \"The type of subagent to delegate to.\" }),\n\t\ttask: Type.String({ description: \"The task to delegate.\" }),\n\t\tbackground: Type.Optional(\n\t\t\tType.Boolean({ description: \"Return a handle immediately instead of waiting for the child.\" }),\n\t\t),\n\t}),\n\tType.Object({\n\t\tagentType: Type.String({ description: \"The agent type that produced the background result.\" }),\n\t\thandle: Type.String({ description: \"A background delegation handle returned by an earlier call.\" }),\n\t}),\n]);\n\nexport type DelegateInput = Static<typeof delegateSchema>;\n\nexport interface DelegateDetails {\n\tagentType: string;\n\ttask: string;\n\toutput: string;\n\thandle?: string;\n}\n\nfunction formatDelegateCall(input: DelegateInput, theme: Theme): string {\n\tif (\"handle\" in input) {\n\t\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · retrieve`;\n\t}\n\tconst task = input.task.replace(/\\s+/g, \" \").trim();\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · ${theme.fg(\"toolOutput\", task)}`;\n}\n\nfunction formatDelegateResult(details: DelegateDetails, expanded: boolean, theme: Theme): string {\n\tif (expanded) return theme.fg(\"toolOutput\", details.output);\n\tconst lineCount = details.output ? details.output.split(\"\\n\").length : 0;\n\treturn `${theme.fg(\"accent\", details.agentType)} · ${lineCount} ${lineCount === 1 ? \"line\" : \"lines\"}`;\n}\n\n/**\n * The delegation entry point (task 4.6's contract, task 5.2's execution). Runs a\n * real child through the injected `DelegationRuntimeOptions` -- capability ceiling,\n * derived permission store, and child-session construction all live behind that\n * injection (ADR 0008), matching the `todo_write`/`tool_schema` convention of\n * injecting collaborators rather than reaching for global state. Recursion depth\n * (task 5.3), artifact isolation (task 5.4), and real agent discovery (task 5.5,\n * replacing the resolver a test or caller injects here) are not yet wired.\n */\nexport function createDelegateToolDefinition(\n\truntime: DelegationRuntimeOptions,\n): ApexToolDefinition<typeof delegateSchema, DelegateDetails> {\n\treturn {\n\t\tname: \"delegate\",\n\t\tlabel: \"delegate\",\n\t\tdescription: \"Delegate a task to a subagent.\",\n\t\tparameters: delegateSchema,\n\t\tcontract: {\n\t\t\tcapabilities: new Set([\"delegate\"]),\n\t\t\tpermission: {\n\t\t\t\tdefaultBehavior: \"ask\",\n\t\t\t\tmatches: (ruleContent, params) => minimatch(params.agentType, ruleContent),\n\t\t\t\tdescribe: (ruleContent) => `Delegate to agent types matching \"${ruleContent}\"`,\n\t\t\t\truleForCall: (params) => params.agentType,\n\t\t\t},\n\t\t\tcontext: { resultRecoverable: false, deferSchema: true },\n\t\t\tevidence: {\n\t\t\t\temits: new Set([\"workflow\"]),\n\t\t\t\tcapture: (params): EvidenceRecord[] =>\n\t\t\t\t\t\"task\" in params\n\t\t\t\t\t\t? [{ kind: \"workflow\", agentType: params.agentType, task: params.task }]\n\t\t\t\t\t\t: [{ kind: \"workflow\", agentType: params.agentType, handle: params.handle }],\n\t\t\t},\n\t\t},\n\t\tasync execute(_toolCallId, input: DelegateInput): Promise<AgentToolResult<DelegateDetails>> {\n\t\t\tconst result =\n\t\t\t\t\"task\" in input\n\t\t\t\t\t? await runDelegation(runtime, input.agentType, input.task, { background: input.background })\n\t\t\t\t\t: await retrieveDelegationResult(runtime, input.handle, input.agentType);\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text: result.output }],\n\t\t\t\tdetails: {\n\t\t\t\t\tagentType: result.agentType,\n\t\t\t\t\ttask: result.task,\n\t\t\t\t\toutput: result.output,\n\t\t\t\t\thandle: result.handleId,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t\trenderCall(input, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateCall(input, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateResult(result.details, options.expanded, theme));\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createDelegateTool(runtime: DelegationRuntimeOptions) {\n\treturn wrapToolDefinition(createDelegateToolDefinition(runtime));\n}\n"]}
+{"version":3,"file":"delegate.js","sourceRoot":"","sources":["../../../src/core/tools/delegate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAG5C,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACnF,OAAO,EAAgD,SAAS,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,wBAAwB,GAAG;IAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC;QACtB,WAAW,EAAE,wFAAwF;KACrG,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IAC7F,UAAU,EAAE,IAAI,CAAC,QAAQ,CACxB,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC,CAC9F;IACD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,+FAA+F;KAC5G,CAAC;CACF,CAAC;AAEF,MAAM,cAAc,GAAG,SAAS,CAC/B;IACC,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE;QACnB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;KACzC,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;CAChE,EACD,wBAAwB,CACxB,CAAC;AAWF,SAAS,kBAAkB,CAAC,KAAoB,EAAE,KAAY,EAAU;IACvE,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACvB,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,cAAa,CAAC;IAC7G,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,OAAM,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;AAAA,CACnI;AAED,SAAS,oBAAoB,CAAC,OAAwB,EAAE,QAAiB,EAAE,KAAY,EAAU;IAChG,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,OAAM,SAAS,IAAI,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AAAA,CACvG;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC3C,OAAiC,EAC4B;IAC7D,OAAO;QACN,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EAAE,gCAAgC;QAC7C,UAAU,EAAE,cAAc;QAC1B,QAAQ,EAAE;YACT,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;YACnC,UAAU,EAAE;gBACX,eAAe,EAAE,KAAK;gBACtB,OAAO,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC;gBAC1E,QAAQ,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,qCAAqC,WAAW,GAAG;gBAC9E,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS;aACzC;YACD,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE;YACxD,QAAQ,EAAE;gBACT,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;gBAC5B,OAAO,EAAE,CAAC,MAAM,EAAoB,EAAE,CACrC,MAAM,IAAI,MAAM;oBACf,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;oBACxE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;aAC9E;SACD;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAoB,EAA6C;YAC3F,MAAM,MAAM,GACX,MAAM,IAAI,KAAK;gBACd,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;gBAC7F,CAAC,CAAC,MAAM,wBAAwB,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YAC3E,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;gBAChD,OAAO,EAAE;oBACR,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,QAAQ;iBACvB;aACD,CAAC;QAAA,CACF;QACD,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;YACjC,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QAAA,CACZ;QACD,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7C,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YAC5E,OAAO,IAAI,CAAC;QAAA,CACZ;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAiC,EAAE;IACrE,OAAO,kBAAkB,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC;AAAA,CACjE","sourcesContent":["import { Text } from \"@earendil-works/pi-tui\";\nimport type { AgentToolResult } from \"apex-code-agent-core\";\nimport { minimatch } from \"minimatch\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport type { DelegationRuntimeOptions } from \"../delegation/runtime.ts\";\nimport { retrieveDelegationResult, runDelegation } from \"../delegation/runtime.ts\";\nimport { type ApexToolDefinition, type EvidenceRecord, toolUnion } from \"./contract.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst delegateSchemaProperties = {\n\tagentType: Type.String({\n\t\tdescription: \"The subagent type. Required both to launch a task and to retrieve a background result.\",\n\t}),\n\ttask: Type.String({ description: \"The task to delegate. Supply it to launch a delegation.\" }),\n\tbackground: Type.Optional(\n\t\tType.Boolean({ description: \"Return a handle immediately instead of waiting for the child.\" }),\n\t),\n\thandle: Type.String({\n\t\tdescription: \"A background delegation handle returned by an earlier call. Supply it to retrieve the result.\",\n\t}),\n};\n\nconst delegateSchema = toolUnion(\n\t[\n\t\tType.Object({\n\t\t\tagentType: Type.String(),\n\t\t\ttask: Type.String(),\n\t\t\tbackground: Type.Optional(Type.Boolean()),\n\t\t}),\n\t\tType.Object({ agentType: Type.String(), handle: Type.String() }),\n\t],\n\tdelegateSchemaProperties,\n);\n\nexport type DelegateInput = Static<typeof delegateSchema>;\n\nexport interface DelegateDetails {\n\tagentType: string;\n\ttask: string;\n\toutput: string;\n\thandle?: string;\n}\n\nfunction formatDelegateCall(input: DelegateInput, theme: Theme): string {\n\tif (\"handle\" in input) {\n\t\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · retrieve`;\n\t}\n\tconst task = input.task.replace(/\\s+/g, \" \").trim();\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"delegate\"))} ${theme.fg(\"accent\", input.agentType)} · ${theme.fg(\"toolOutput\", task)}`;\n}\n\nfunction formatDelegateResult(details: DelegateDetails, expanded: boolean, theme: Theme): string {\n\tif (expanded) return theme.fg(\"toolOutput\", details.output);\n\tconst lineCount = details.output ? details.output.split(\"\\n\").length : 0;\n\treturn `${theme.fg(\"accent\", details.agentType)} · ${lineCount} ${lineCount === 1 ? \"line\" : \"lines\"}`;\n}\n\n/**\n * The delegation entry point (task 4.6's contract, task 5.2's execution). Runs a\n * real child through the injected `DelegationRuntimeOptions` -- capability ceiling,\n * derived permission store, and child-session construction all live behind that\n * injection (ADR 0008), matching the `todo_write`/`tool_schema` convention of\n * injecting collaborators rather than reaching for global state. Recursion\n * depth, artifact isolation, and real agent discovery are wired:\n * `../delegation/runtime.ts` bounds depth and roots per-child artifact\n * directories, and `../delegation/agents.ts` supplies production markdown\n * discovery through the injected resolver.\n */\nexport function createDelegateToolDefinition(\n\truntime: DelegationRuntimeOptions,\n): ApexToolDefinition<typeof delegateSchema, DelegateDetails> {\n\treturn {\n\t\tname: \"delegate\",\n\t\tlabel: \"delegate\",\n\t\tdescription: \"Delegate a task to a subagent.\",\n\t\tparameters: delegateSchema,\n\t\tcontract: {\n\t\t\tcapabilities: new Set([\"delegate\"]),\n\t\t\tpermission: {\n\t\t\t\tdefaultBehavior: \"ask\",\n\t\t\t\tmatches: (ruleContent, params) => minimatch(params.agentType, ruleContent),\n\t\t\t\tdescribe: (ruleContent) => `Delegate to agent types matching \"${ruleContent}\"`,\n\t\t\t\truleForCall: (params) => params.agentType,\n\t\t\t},\n\t\t\tcontext: { resultRecoverable: false, deferSchema: true },\n\t\t\tevidence: {\n\t\t\t\temits: new Set([\"workflow\"]),\n\t\t\t\tcapture: (params): EvidenceRecord[] =>\n\t\t\t\t\t\"task\" in params\n\t\t\t\t\t\t? [{ kind: \"workflow\", agentType: params.agentType, task: params.task }]\n\t\t\t\t\t\t: [{ kind: \"workflow\", agentType: params.agentType, handle: params.handle }],\n\t\t\t},\n\t\t},\n\t\tasync execute(_toolCallId, input: DelegateInput): Promise<AgentToolResult<DelegateDetails>> {\n\t\t\tconst result =\n\t\t\t\t\"task\" in input\n\t\t\t\t\t? await runDelegation(runtime, input.agentType, input.task, { background: input.background })\n\t\t\t\t\t: await retrieveDelegationResult(runtime, input.handle, input.agentType);\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text: result.output }],\n\t\t\t\tdetails: {\n\t\t\t\t\tagentType: result.agentType,\n\t\t\t\t\ttask: result.task,\n\t\t\t\t\toutput: result.output,\n\t\t\t\t\thandle: result.handleId,\n\t\t\t\t},\n\t\t\t};\n\t\t},\n\t\trenderCall(input, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateCall(input, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatDelegateResult(result.details, options.expanded, theme));\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createDelegateTool(runtime: DelegationRuntimeOptions) {\n\treturn wrapToolDefinition(createDelegateToolDefinition(runtime));\n}\n"]}