avantgate 1.2.2 → 1.3.0

package/dist/agent/index.js

@@ -27,11 +27,13 @@ __export(agent_exports, {
   DtoValidationError: () => DtoValidationError,
   HttpTelemetryExporter: () => HttpTelemetryExporter,
   KeyValueStorageAdapter: () => KeyValueStorageAdapter,
+  MaxImpactToolStrategy: () => MaxImpactToolStrategy,
   MemoryStorageAdapter: () => MemoryStorageAdapter,
   PhaseBasedToolStrategy: () => PhaseBasedToolStrategy,
   PiiLeakError: () => PiiLeakError,
   PlatformStorageAdapter: () => PlatformStorageAdapter,
   PrismaStorageAdapter: () => PrismaStorageAdapter,
+  ReadOnlyToolStrategy: () => ReadOnlyToolStrategy,
   RoleBasedToolStrategy: () => RoleBasedToolStrategy,
   SQLiteStorageAdapter: () => SQLiteStorageAdapter,
   StepExecutionError: () => StepExecutionError,
@@ -329,6 +331,8 @@ function createIsolatedTool(config) {
   const toolAlias = config.alias;
   const clientCallback = config.clientDto;
   const toolIdentifier = toolAlias || config.name;
+  const toolImpact = config.impact ?? "READ_ONLY";
+  const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
   const tool = {
     description: config.description,
     parameters: config.parameters,
@@ -340,8 +344,8 @@ function createIsolatedTool(config) {
     _domain: config.domain,
     _resource: config.resource,
     _roles: config.roles ? Object.freeze([...config.roles]) : void 0,
-    _permissions: config.permissions ? Object.freeze([...config.permissions]) : void 0,
-    _requireApproval: config.requireApproval ?? false,
+    _impact: toolImpact,
+    _requireApproval: requireApproval,
     _lastPiiFilteredCount: 0,
     _lastInvalidationTags: void 0,
     async execute(args, context) {
@@ -475,7 +479,7 @@ function normalizeToolDefinition(toolDef) {
       domain: toolDef._domain,
       resource: toolDef._resource,
       roles: toolDef._roles ? Array.from(toolDef._roles) : void 0,
-      permissions: toolDef._permissions ? Array.from(toolDef._permissions) : void 0,
+      impact: toolDef._impact ?? "READ_ONLY",
       requireApproval: toolDef._requireApproval,
       tool: toolDef
     };
@@ -483,7 +487,7 @@ function normalizeToolDefinition(toolDef) {
   const id = toolDef.id || toolDef.name || toolDef.tool?._toolId;
   const publicName = toolDef.alias || toolDef.name || toolDef.tool?._toolAlias || toolDef.tool?._toolName;
   const roles = toolDef.roles ?? (toolDef.tool?._roles ? Array.from(toolDef.tool._roles) : toolDef.requiredRoles);
-  const permissions = toolDef.permissions ?? (toolDef.tool?._permissions ? Array.from(toolDef.tool._permissions) : void 0);
+  const impact = toolDef.impact ?? toolDef.tool?._impact ?? "READ_ONLY";
   return {
     ...toolDef,
     id,
@@ -492,7 +496,7 @@ function normalizeToolDefinition(toolDef) {
     domain: toolDef.domain ?? toolDef.tool?._domain,
     resource: toolDef.resource ?? toolDef.tool?._resource,
     roles,
-    permissions,
+    impact,
     requireApproval: toolDef.requireApproval ?? toolDef.tool?._requireApproval
   };
 }
@@ -515,7 +519,7 @@ function toDescriptor(tool) {
     domain: tool.domain,
     resource: tool.resource,
     roles: tool.roles ?? tool.requiredRoles,
-    permissions: tool.permissions,
+    impact: tool.impact ?? "READ_ONLY",
     requireApproval: tool.requireApproval,
     cacheTTL: tool.tool._cacheTTL,
     tags: tool.tags
@@ -603,6 +607,12 @@ var ToolRegistry = class _ToolRegistry {
       return roles.some((role) => roleSet.has(role));
     });
   }
+  /**
+   * Filters tools matching a specific physical impact profile (READ_ONLY, MUTATIVE, DESTRUCTIVE).
+   */
+  getByImpact(impact) {
+    return this.getAll().filter((item) => (item.impact ?? "READ_ONLY") === impact);
+  }
   /**
    * Exports headless technical descriptors without UI rendering coupling.
    */
@@ -614,6 +624,9 @@ var ToolRegistry = class _ToolRegistry {
     if (filter?.role) {
       list = list.filter((item) => matchesRoleFilter(item, filter.role));
     }
+    if (filter?.impact) {
+      list = list.filter((item) => (item.impact ?? "READ_ONLY") === filter.impact);
+    }
     return list.map(toDescriptor);
   }
   /**
@@ -641,6 +654,18 @@ var ToolRegistry = class _ToolRegistry {
 };
 
 // src/agent/strategy.ts
+var IMPACT_WEIGHTS = {
+  READ_ONLY: 1,
+  MUTATIVE: 2,
+  DESTRUCTIVE: 3
+};
+function matchesMaxImpact(tool, maxImpact) {
+  if (!maxImpact) {
+    return true;
+  }
+  const toolImpact = tool.impact ?? "READ_ONLY";
+  return IMPACT_WEIGHTS[toolImpact] <= IMPACT_WEIGHTS[maxImpact];
+}
 var PhaseBasedToolStrategy = class {
   selectTools(tools, context) {
     if (!context.phase) {
@@ -673,6 +698,24 @@ var RoleBasedToolStrategy = class {
     });
   }
 };
+var ReadOnlyToolStrategy = class {
+  selectTools(tools, _context) {
+    return tools.filter((tool) => (tool.impact ?? "READ_ONLY") === "READ_ONLY");
+  }
+};
+var MaxImpactToolStrategy = class {
+  maxImpact;
+  constructor(maxImpact) {
+    this.maxImpact = maxImpact;
+  }
+  selectTools(tools, _context) {
+    const maxWeight = IMPACT_WEIGHTS[this.maxImpact];
+    return tools.filter((tool) => {
+      const toolImpact = tool.impact ?? "READ_ONLY";
+      return IMPACT_WEIGHTS[toolImpact] <= maxWeight;
+    });
+  }
+};
 function matchesDomain(tool, allowedDomains) {
   if (!allowedDomains) {
     return true;
@@ -696,23 +739,18 @@ function matchesRoles(tool, context) {
   }
   return toolRoles.some((roleName) => userRoles.includes(roleName));
 }
-function matchesPermissions(tool, context) {
-  if (!tool.permissions || tool.permissions.length === 0) {
-    return true;
-  }
-  const userPermissions = context.permissions ?? [];
-  return tool.permissions.every((permissionName) => userPermissions.includes(permissionName));
-}
 var AccessControlToolStrategy = class {
   allowedDomains;
+  maxImpact;
   constructor(options) {
     if (options?.allowedDomains) {
       this.allowedDomains = new Set(options.allowedDomains);
     }
+    this.maxImpact = options?.maxImpact;
   }
   selectTools(tools, context) {
     return tools.filter(
-      (tool) => matchesDomain(tool, this.allowedDomains) && matchesRoles(tool, context) && matchesPermissions(tool, context)
+      (tool) => matchesDomain(tool, this.allowedDomains) && matchesRoles(tool, context) && matchesMaxImpact(tool, this.maxImpact)
     );
   }
 };
@@ -1971,11 +2009,13 @@ var HttpTelemetryExporter = class {
   DtoValidationError,
   HttpTelemetryExporter,
   KeyValueStorageAdapter,
+  MaxImpactToolStrategy,
   MemoryStorageAdapter,
   PhaseBasedToolStrategy,
   PiiLeakError,
   PlatformStorageAdapter,
   PrismaStorageAdapter,
+  ReadOnlyToolStrategy,
   RoleBasedToolStrategy,
   SQLiteStorageAdapter,
   StepExecutionError,

package/dist/agent/index.mjs

@@ -226,6 +226,8 @@ function createIsolatedTool(config) {
   const toolAlias = config.alias;
   const clientCallback = config.clientDto;
   const toolIdentifier = toolAlias || config.name;
+  const toolImpact = config.impact ?? "READ_ONLY";
+  const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
   const tool = {
     description: config.description,
     parameters: config.parameters,
@@ -237,8 +239,8 @@ function createIsolatedTool(config) {
     _domain: config.domain,
     _resource: config.resource,
     _roles: config.roles ? Object.freeze([...config.roles]) : void 0,
-    _permissions: config.permissions ? Object.freeze([...config.permissions]) : void 0,
-    _requireApproval: config.requireApproval ?? false,
+    _impact: toolImpact,
+    _requireApproval: requireApproval,
     _lastPiiFilteredCount: 0,
     _lastInvalidationTags: void 0,
     async execute(args, context) {
@@ -372,7 +374,7 @@ function normalizeToolDefinition(toolDef) {
       domain: toolDef._domain,
       resource: toolDef._resource,
       roles: toolDef._roles ? Array.from(toolDef._roles) : void 0,
-      permissions: toolDef._permissions ? Array.from(toolDef._permissions) : void 0,
+      impact: toolDef._impact ?? "READ_ONLY",
       requireApproval: toolDef._requireApproval,
       tool: toolDef
     };
@@ -380,7 +382,7 @@ function normalizeToolDefinition(toolDef) {
   const id = toolDef.id || toolDef.name || toolDef.tool?._toolId;
   const publicName = toolDef.alias || toolDef.name || toolDef.tool?._toolAlias || toolDef.tool?._toolName;
   const roles = toolDef.roles ?? (toolDef.tool?._roles ? Array.from(toolDef.tool._roles) : toolDef.requiredRoles);
-  const permissions = toolDef.permissions ?? (toolDef.tool?._permissions ? Array.from(toolDef.tool._permissions) : void 0);
+  const impact = toolDef.impact ?? toolDef.tool?._impact ?? "READ_ONLY";
   return {
     ...toolDef,
     id,
@@ -389,7 +391,7 @@ function normalizeToolDefinition(toolDef) {
     domain: toolDef.domain ?? toolDef.tool?._domain,
     resource: toolDef.resource ?? toolDef.tool?._resource,
     roles,
-    permissions,
+    impact,
     requireApproval: toolDef.requireApproval ?? toolDef.tool?._requireApproval
   };
 }
@@ -412,7 +414,7 @@ function toDescriptor(tool) {
     domain: tool.domain,
     resource: tool.resource,
     roles: tool.roles ?? tool.requiredRoles,
-    permissions: tool.permissions,
+    impact: tool.impact ?? "READ_ONLY",
     requireApproval: tool.requireApproval,
     cacheTTL: tool.tool._cacheTTL,
     tags: tool.tags
@@ -500,6 +502,12 @@ var ToolRegistry = class _ToolRegistry {
       return roles.some((role) => roleSet.has(role));
     });
   }
+  /**
+   * Filters tools matching a specific physical impact profile (READ_ONLY, MUTATIVE, DESTRUCTIVE).
+   */
+  getByImpact(impact) {
+    return this.getAll().filter((item) => (item.impact ?? "READ_ONLY") === impact);
+  }
   /**
    * Exports headless technical descriptors without UI rendering coupling.
    */
@@ -511,6 +519,9 @@ var ToolRegistry = class _ToolRegistry {
     if (filter?.role) {
       list = list.filter((item) => matchesRoleFilter(item, filter.role));
     }
+    if (filter?.impact) {
+      list = list.filter((item) => (item.impact ?? "READ_ONLY") === filter.impact);
+    }
     return list.map(toDescriptor);
   }
   /**
@@ -538,6 +549,18 @@ var ToolRegistry = class _ToolRegistry {
 };
 
 // src/agent/strategy.ts
+var IMPACT_WEIGHTS = {
+  READ_ONLY: 1,
+  MUTATIVE: 2,
+  DESTRUCTIVE: 3
+};
+function matchesMaxImpact(tool, maxImpact) {
+  if (!maxImpact) {
+    return true;
+  }
+  const toolImpact = tool.impact ?? "READ_ONLY";
+  return IMPACT_WEIGHTS[toolImpact] <= IMPACT_WEIGHTS[maxImpact];
+}
 var PhaseBasedToolStrategy = class {
   selectTools(tools, context) {
     if (!context.phase) {
@@ -570,6 +593,24 @@ var RoleBasedToolStrategy = class {
     });
   }
 };
+var ReadOnlyToolStrategy = class {
+  selectTools(tools, _context) {
+    return tools.filter((tool) => (tool.impact ?? "READ_ONLY") === "READ_ONLY");
+  }
+};
+var MaxImpactToolStrategy = class {
+  maxImpact;
+  constructor(maxImpact) {
+    this.maxImpact = maxImpact;
+  }
+  selectTools(tools, _context) {
+    const maxWeight = IMPACT_WEIGHTS[this.maxImpact];
+    return tools.filter((tool) => {
+      const toolImpact = tool.impact ?? "READ_ONLY";
+      return IMPACT_WEIGHTS[toolImpact] <= maxWeight;
+    });
+  }
+};
 function matchesDomain(tool, allowedDomains) {
   if (!allowedDomains) {
     return true;
@@ -593,23 +634,18 @@ function matchesRoles(tool, context) {
   }
   return toolRoles.some((roleName) => userRoles.includes(roleName));
 }
-function matchesPermissions(tool, context) {
-  if (!tool.permissions || tool.permissions.length === 0) {
-    return true;
-  }
-  const userPermissions = context.permissions ?? [];
-  return tool.permissions.every((permissionName) => userPermissions.includes(permissionName));
-}
 var AccessControlToolStrategy = class {
   allowedDomains;
+  maxImpact;
   constructor(options) {
     if (options?.allowedDomains) {
       this.allowedDomains = new Set(options.allowedDomains);
     }
+    this.maxImpact = options?.maxImpact;
   }
   selectTools(tools, context) {
     return tools.filter(
-      (tool) => matchesDomain(tool, this.allowedDomains) && matchesRoles(tool, context) && matchesPermissions(tool, context)
+      (tool) => matchesDomain(tool, this.allowedDomains) && matchesRoles(tool, context) && matchesMaxImpact(tool, this.maxImpact)
     );
   }
 };
@@ -1867,11 +1903,13 @@ export {
   DtoValidationError,
   HttpTelemetryExporter,
   KeyValueStorageAdapter,
+  MaxImpactToolStrategy,
   MemoryStorageAdapter,
   PhaseBasedToolStrategy,
   PiiLeakError,
   PlatformStorageAdapter,
   PrismaStorageAdapter,
+  ReadOnlyToolStrategy,
   RoleBasedToolStrategy,
   SQLiteStorageAdapter,
   StepExecutionError,

package/dist/agent/isolated-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAoHjB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,MAAM,EAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CA8DlC"}
+{"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAoHjB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,MAAM,EAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAgElC"}

package/dist/agent/registry.d.ts

@@ -1,4 +1,4 @@
-import type { RegisteredTool, ToolDescriptor, VercelAiCoreTool } from "./types";
+import type { RegisteredTool, ToolDescriptor, ToolImpact, VercelAiCoreTool } from "./types";
 export interface ToRecordOptions {
     anonymize?: boolean;
     domain?: string;
@@ -6,9 +6,10 @@ export interface ToRecordOptions {
 export interface ToolDescriptorFilter {
     domain?: string;
     role?: string;
+    impact?: ToolImpact;
 }
 /**
- * Centralized catalog for managing and filtering tools with permissions, domains and metadata.
+ * Centralized catalog for managing and filtering tools with roles, domains, impact and metadata.
  * Supports O(1) Key-Value lookup by technical ID and by public alias.
  */
 export declare class ToolRegistry {
@@ -54,6 +55,10 @@ export declare class ToolRegistry {
      * Filters tools matching the user's roles (RBAC).
      */
     filterByRoles(userRoles: string[]): RegisteredTool[];
+    /**
+     * Filters tools matching a specific physical impact profile (READ_ONLY, MUTATIVE, DESTRUCTIVE).
+     */
+    getByImpact(impact: ToolImpact): RegisteredTool[];
     /**
      * Exports headless technical descriptors without UI rendering coupling.
      */

package/dist/agent/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/agent/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhF,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAoED;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IAEvE;;OAEG;IACI,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,gBAAgB,GAAG,IAAI;IASjE;;OAEG;IACI,YAAY,CAAC,KAAK,EAAE,CAAC,cAAc,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI;IAOvE;;OAEG;IACI,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIxD;;OAEG;IACI,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAItD;;OAEG;IACI,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAItE;;OAEG;IACI,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIrC;;OAEG;IACI,MAAM,IAAI,cAAc,EAAE;IAIjC;;OAEG;IACI,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE;IAIpD;;OAEG;IACI,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE;IASlD;;OAEG;IACI,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE;IAW3D;;OAEG;IACI,cAAc,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc,EAAE;IAWtE;;OAEG;IACI,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAIhF;;;OAGG;WACW,QAAQ,CACpB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;CAYpC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/agent/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE5F,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAmED;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqC;IAC/D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqC;IAEvE;;OAEG;IACI,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,gBAAgB,GAAG,IAAI;IASjE;;OAEG;IACI,YAAY,CAAC,KAAK,EAAE,CAAC,cAAc,GAAG,gBAAgB,CAAC,EAAE,GAAG,IAAI;IAOvE;;OAEG;IACI,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIxD;;OAEG;IACI,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAItD;;OAEG;IACI,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAItE;;OAEG;IACI,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAIrC;;OAEG;IACI,MAAM,IAAI,cAAc,EAAE;IAIjC;;OAEG;IACI,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE;IAIpD;;OAEG;IACI,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE;IASlD;;OAEG;IACI,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE;IAW3D;;OAEG;IACI,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,cAAc,EAAE;IAIxD;;OAEG;IACI,cAAc,CAAC,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc,EAAE;IActE;;OAEG;IACI,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAIhF;;;OAGG;WACW,QAAQ,CACpB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;CAYpC"}

package/dist/agent/strategy.d.ts

@@ -1,4 +1,4 @@
-import type { RegisteredTool, ToolContext, ToolSelectionStrategy, VercelAiCoreTool } from "./types";
+import type { RegisteredTool, ToolContext, ToolImpact, ToolSelectionStrategy, VercelAiCoreTool } from "./types";
 /**
  * Strategy selecting tools that match the current workflow phase.
  */
@@ -11,14 +11,30 @@ export declare class PhaseBasedToolStrategy implements ToolSelectionStrategy {
 export declare class RoleBasedToolStrategy implements ToolSelectionStrategy {
     selectTools(tools: RegisteredTool[], context: ToolContext): RegisteredTool[];
 }
+/**
+ * Strategy selecting exclusively observation/read-only tools (ideal for auditors, critics, reflection).
+ */
+export declare class ReadOnlyToolStrategy implements ToolSelectionStrategy {
+    selectTools(tools: RegisteredTool[], _context: ToolContext): RegisteredTool[];
+}
+/**
+ * Strategy capping maximum permitted impact level for autonomous agents.
+ */
+export declare class MaxImpactToolStrategy implements ToolSelectionStrategy {
+    private readonly maxImpact;
+    constructor(maxImpact: ToolImpact);
+    selectTools(tools: RegisteredTool[], _context: ToolContext): RegisteredTool[];
+}
 export interface AccessControlToolStrategyOptions {
     allowedDomains?: string[];
+    maxImpact?: ToolImpact;
 }
 /**
- * Unified strategy evaluating role, permissions and allowed business domains in a single pass.
+ * Unified strategy evaluating user roles, allowed business domains and maximum impact in a single pass.
  */
 export declare class AccessControlToolStrategy implements ToolSelectionStrategy {
     private readonly allowedDomains?;
+    private readonly maxImpact?;
     constructor(options?: AccessControlToolStrategyOptions);
     selectTools(tools: RegisteredTool[], context: ToolContext): RegisteredTool[];
 }

package/dist/agent/strategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../src/agent/strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,qBAAa,sBAAuB,YAAW,qBAAqB;IAC3D,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE;CAYpB;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IAC1D,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE;CAgBpB;AAED,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAmCD;;GAEG;AACH,qBAAa,yBAA0B,YAAW,qBAAqB;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAc;gBAElC,OAAO,CAAC,EAAE,gCAAgC;IAM/C,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE;CAQpB;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;gBAEzC,UAAU,EAAE,qBAAqB,EAAE;IAIlC,WAAW,CACtB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,EAAE,CAAC;CAO7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,cAAc,EAAE,EACvB,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAG3C"}
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../src/agent/strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAgBjB;;GAEG;AACH,qBAAa,sBAAuB,YAAW,qBAAqB;IAC3D,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE;CAYpB;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IAC1D,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE;CAgBpB;AAED;;GAEG;AACH,qBAAa,oBAAqB,YAAW,qBAAqB;IACzD,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,QAAQ,EAAE,WAAW,GACpB,cAAc,EAAE;CAGpB;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAa;gBAE3B,SAAS,EAAE,UAAU;IAI1B,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,QAAQ,EAAE,WAAW,GACpB,cAAc,EAAE;CAOpB;AAED,MAAM,WAAW,gCAAgC;IAC/C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,UAAU,CAAC;CACxB;AA2BD;;GAEG;AACH,qBAAa,yBAA0B,YAAW,qBAAqB;IACrE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAc;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAa;gBAE5B,OAAO,CAAC,EAAE,gCAAgC;IAO/C,WAAW,CAChB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE;CAQpB;AAED;;GAEG;AACH,qBAAa,qBAAsB,YAAW,qBAAqB;IACjE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0B;gBAEzC,UAAU,EAAE,qBAAqB,EAAE;IAIlC,WAAW,CACtB,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,EAAE,CAAC;CAO7B;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,cAAc,EAAE,EACvB,QAAQ,EAAE,qBAAqB,EAC/B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAG3C"}

package/dist/agent/types.d.ts

@@ -122,6 +122,10 @@ export interface ToolExecutionContext {
     onInvalidationTags?: (tags: string[]) => void | Promise<void>;
     [key: string]: unknown;
 }
+/**
+ * Nature physique d'effet de bord et rayon d'action de l'outil pour le confinement du LLM.
+ */
+export type ToolImpact = "READ_ONLY" | "MUTATIVE" | "DESTRUCTIVE";
 /**
  * User and environment context injected into tools.
  */
@@ -130,7 +134,6 @@ export interface ToolContext {
     tenantId?: string;
     role?: string;
     roles?: string[];
-    permissions?: string[];
     phase?: string;
     metadata?: Record<string, unknown>;
     [key: string]: unknown;
@@ -154,7 +157,7 @@ export type InvalidationTagsResolver<TArgs = any, TResult = any> = string[] | ((
 export type DataAccessGuard<TArgs = any> = (args: TArgs, context?: ToolExecutionContext) => boolean | Promise<boolean>;
 /**
  * Configuration for creating an isolated tool with PII protection, Dual-Channel DTO,
- * access governance, stable ID, aliasing and caching.
+ * access governance, stable ID, aliasing, impact categorization and caching.
  */
 export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult> {
     id?: string;
@@ -164,7 +167,7 @@ export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknow
     domain?: string;
     resource?: string;
     roles?: string[];
-    permissions?: string[];
+    impact?: ToolImpact;
     requireApproval?: boolean;
     dataAccessGuard?: DataAccessGuard<TArgs>;
     invalidationTags?: InvalidationTagsResolver<TArgs, TResult>;
@@ -195,7 +198,7 @@ export interface VercelAiCoreTool<TArgs = any, TResult = any> {
     readonly _domain?: string;
     readonly _resource?: string;
     readonly _roles?: readonly string[];
-    readonly _permissions?: readonly string[];
+    readonly _impact?: ToolImpact;
     readonly _requireApproval?: boolean;
     _lastPiiFilteredCount?: number;
     _lastInvalidationTags?: string[];
@@ -211,7 +214,7 @@ export interface RegisteredTool<TArgs = any, TResult = any> {
     domain?: string;
     resource?: string;
     roles?: string[];
-    permissions?: string[];
+    impact?: ToolImpact;
     phases?: string[];
     requiredRoles?: string[];
     tags?: string[];
@@ -229,7 +232,7 @@ export interface ToolDescriptor {
     domain?: string;
     resource?: string;
     roles?: string[];
-    permissions?: string[];
+    impact?: ToolImpact;
     requireApproval?: boolean;
     cacheTTL?: number;
     tags?: string[];

package/dist/agent/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,CAAC;AAEvB;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "avantgate",
-  "version": "1.2.2",
+  "version": "1.3.0",
   "description": "Zero-infrastructure, in-process AI Application Firewall (AI-WAF) & privacy control plane for TypeScript: real-time prompt guardrails, zero-egress PII redaction, agent tool isolation, anti-IDOR defense, pre-flight token budgets, and multi-model failover.",
   "author": "Antigravity & LexTalk Team",
   "license": "MIT",
@@ -16,6 +16,9 @@
     "ai",
     "agent",
     "dual-channel",
+    "tool-governance",
+    "blast-radius",
+    "impact-control",
     "token-budget",
     "cost-control",
     "durable-execution",
@@ -64,7 +67,7 @@
     "test:finance": "tsx tests/financial-normalizer.test.ts",
     "test:prompts": "tsx tests/prompt-builder.test.ts",
     "test:pii": "tsx tests/pii-extended.test.ts",
-    "test:agent": "tsx tests/agent/step-runner.test.ts && tsx tests/agent/isolated-tool.test.ts && tsx tests/agent/dto-pattern.test.ts && tsx tests/agent/tool-patterns.test.ts && tsx tests/agent/storage-adapters.test.ts && tsx tests/agent/tool-aliasing.test.ts && tsx tests/agent/tool-chaining.test.ts && tsx tests/agent/tool-storage.test.ts && tsx tests/agent/telemetry-exporter.test.ts && tsx tests/agent/platform-adapter.test.ts && tsx tests/agent/tool-governance.test.ts",
+    "test:agent": "tsx tests/agent/step-runner.test.ts && tsx tests/agent/isolated-tool.test.ts && tsx tests/agent/dto-pattern.test.ts && tsx tests/agent/tool-patterns.test.ts && tsx tests/agent/storage-adapters.test.ts && tsx tests/agent/tool-aliasing.test.ts && tsx tests/agent/tool-chaining.test.ts && tsx tests/agent/tool-storage.test.ts && tsx tests/agent/telemetry-exporter.test.ts && tsx tests/agent/platform-adapter.test.ts && tsx tests/agent/tool-governance.test.ts && tsx tests/agent/tool-impact.test.ts",
     "lint": "tsc --noEmit",
     "prepublishOnly": "npm run build && npm test"
   },