avantgate 2.2.0 → 2.4.0

package/dist/middleware.d.ts

@@ -0,0 +1,15 @@
+import type { AvantGateMiddleware, BeforeRequestContext, BeforeRequestResult, AfterResponseContext, ChatMessage } from "./types";
+export interface BeforeExecutionState {
+    messages: ChatMessage[];
+    metadata?: Record<string, unknown>;
+    shortCircuit?: BeforeRequestResult["shortCircuit"];
+}
+export interface AfterExecutionState {
+    responseText: string;
+    metadata?: Record<string, unknown>;
+}
+export declare const applySingleBeforeMiddleware: (middleware: AvantGateMiddleware, current: BeforeExecutionState, model: string, temperature?: number, timeoutMs?: number) => Promise<BeforeExecutionState>;
+export declare const executeBeforeRequestHooks: (middlewares: AvantGateMiddleware[] | undefined, context: BeforeRequestContext, timeoutMs?: number) => Promise<BeforeExecutionState>;
+export declare const applySingleAfterMiddleware: (middleware: AvantGateMiddleware, current: AfterExecutionState, baseContext: Omit<AfterResponseContext, "responseText" | "metadata">, timeoutMs?: number) => Promise<AfterExecutionState>;
+export declare const executeAfterResponseHooks: (middlewares: AvantGateMiddleware[] | undefined, context: AfterResponseContext, timeoutMs?: number) => Promise<AfterExecutionState>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EAEpB,WAAW,EACZ,MAAM,SAAS,CAAC;AAKjB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,YAAY,CAAC,EAAE,mBAAmB,CAAC,cAAc,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAgCD,eAAO,MAAM,2BAA2B,GACtC,YAAY,mBAAmB,EAC/B,SAAS,oBAAoB,EAC7B,OAAO,MAAM,EACb,cAAc,MAAM,EACpB,kBAAgB,KACf,OAAO,CAAC,oBAAoB,CA4B9B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,aAAa,mBAAmB,EAAE,GAAG,SAAS,EAC9C,SAAS,oBAAoB,EAC7B,kBAAgB,KACf,OAAO,CAAC,oBAAoB,CAmB9B,CAAC;AAEF,eAAO,MAAM,0BAA0B,GACrC,YAAY,mBAAmB,EAC/B,SAAS,mBAAmB,EAC5B,aAAa,IAAI,CAAC,oBAAoB,EAAE,cAAc,GAAG,UAAU,CAAC,EACpE,kBAAgB,KACf,OAAO,CAAC,mBAAmB,CAsB7B,CAAC;AAEF,eAAO,MAAM,yBAAyB,GACpC,aAAa,mBAAmB,EAAE,GAAG,SAAS,EAC9C,SAAS,oBAAoB,EAC7B,kBAAgB,KACf,OAAO,CAAC,mBAAmB,CAY7B,CAAC"}

package/dist/presets.d.ts

@@ -0,0 +1,13 @@
+import type { ControlLayerConfig, ProviderConfig } from "./types";
+export interface PresetBaseOptions extends Partial<ControlLayerConfig> {
+    primary: ProviderConfig;
+}
+export declare const createLaunchSafeConfig: (options: PresetBaseOptions) => ControlLayerConfig;
+export declare const createEnterpriseStrictConfig: (options: PresetBaseOptions) => ControlLayerConfig;
+export declare const createDevPermissiveConfig: (options: PresetBaseOptions) => ControlLayerConfig;
+export declare const PRESETS: {
+    LAUNCH_SAFE: (options: PresetBaseOptions) => ControlLayerConfig;
+    ENTERPRISE_STRICT: (options: PresetBaseOptions) => ControlLayerConfig;
+    DEV_PERMISSIVE: (options: PresetBaseOptions) => ControlLayerConfig;
+};
+//# sourceMappingURL=presets.d.ts.map

package/dist/presets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.d.ts","sourceRoot":"","sources":["../src/presets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAA+B,MAAM,SAAS,CAAC;AAE/F,MAAM,WAAW,iBAAkB,SAAQ,OAAO,CAAC,kBAAkB,CAAC;IACpE,OAAO,EAAE,cAAc,CAAC;CACzB;AAED,eAAO,MAAM,sBAAsB,GAAI,SAAS,iBAAiB,KAAG,kBAkBnE,CAAC;AAEF,eAAO,MAAM,4BAA4B,GAAI,SAAS,iBAAiB,KAAG,kBAsBzE,CAAC;AAEF,eAAO,MAAM,yBAAyB,GAAI,SAAS,iBAAiB,KAAG,kBAiBtE,CAAC;AAEF,eAAO,MAAM,OAAO;2BA/D4B,iBAAiB,KAAG,kBAAkB;iCAoBhC,iBAAiB,KAAG,kBAAkB;8BAwBzC,iBAAiB,KAAG,kBAAkB;CAuBxF,CAAC"}

package/dist/providers/http-client.d.ts

@@ -4,11 +4,14 @@ export declare class HttpProviderClient implements LLMProviderPort {
     private readonly baseUrl;
     private readonly apiKey?;
     private readonly providerType;
+    private readonly ttftTimeoutMs;
+    private readonly idleTimeoutMs;
     constructor(config: ProviderConfig);
     private resolveEndpoint;
     private buildHeaders;
     private buildPayload;
     private extractUsage;
+    private readStreamWithHeartbeat;
     complete: (options: LLMCompletionOptions) => Promise<{
         text: string;
         usage?: LLMUsage;

package/dist/providers/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/providers/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,QAAQ,EAER,cAAc,EACf,MAAM,UAAU,CAAC;AA+BlB,qBAAa,kBAAmB,YAAW,eAAe;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,MAAM,EAAE,cAAc;IAOlC,OAAO,CAAC,eAAe,CAMrB;IAEF,OAAO,CAAC,YAAY,CAelB;IAEF,OAAO,CAAC,YAAY,CAUlB;IAEF,OAAO,CAAC,YAAY,CAUlB;IAEF,QAAQ,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAwB3F;CACH;AAED,eAAO,MAAM,wBAAwB,GAAI,QAAQ,cAAc,KAAG,kBAEjE,CAAC"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/providers/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,QAAQ,EAER,cAAc,EACf,MAAM,UAAU,CAAC;AAmClB,qBAAa,kBAAmB,YAAW,eAAe;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;gBAE3B,MAAM,EAAE,cAAc;IASlC,OAAO,CAAC,eAAe,CAMrB;IAEF,OAAO,CAAC,YAAY,CAelB;IAEF,OAAO,CAAC,YAAY,CAWlB;IAEF,OAAO,CAAC,YAAY,CAUlB;IAEF,OAAO,CAAC,uBAAuB,CA8D7B;IAEF,QAAQ,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CA2D3F;CACH;AAED,eAAO,MAAM,wBAAwB,GAAI,QAAQ,cAAc,KAAG,kBAEjE,CAAC"}

package/dist/types.d.ts

@@ -1,8 +1,30 @@
 import { z } from "zod";
-export interface ChatMessage {
-    role: "system" | "user" | "assistant" | "tool";
-    content: string;
-}
+export declare const ChatRoleSchema: z.ZodEnum<{
+    system: "system";
+    user: "user";
+    assistant: "assistant";
+    tool: "tool";
+}>;
+export type ChatRole = z.infer<typeof ChatRoleSchema>;
+export declare const ChatMessageSchema: z.ZodObject<{
+    role: z.ZodEnum<{
+        system: "system";
+        user: "user";
+        assistant: "assistant";
+        tool: "tool";
+    }>;
+    content: z.ZodString;
+}, z.core.$strict>;
+export declare const ChatMessagesArraySchema: z.ZodArray<z.ZodObject<{
+    role: z.ZodEnum<{
+        system: "system";
+        user: "user";
+        assistant: "assistant";
+        tool: "tool";
+    }>;
+    content: z.ZodString;
+}, z.core.$strict>>;
+export type ChatMessage = z.infer<typeof ChatMessageSchema>;
 export interface LLMUsage {
     promptTokens?: number;
     completionTokens?: number;
@@ -46,6 +68,25 @@ export declare class ConfigurationError extends Error {
 export declare class BudgetExceededError extends Error {
     constructor(message: string);
 }
+export declare class ProviderTTFTTimeoutError extends Error {
+    readonly ttftTimeoutMs: number;
+    constructor(message: string, ttftTimeoutMs: number);
+}
+export declare class ProviderIdleTimeoutError extends Error {
+    readonly idleTimeoutMs: number;
+    constructor(message: string, idleTimeoutMs: number);
+}
+export type BudgetReservationStatus = "RESERVED" | "SETTLED" | "RELEASED" | "UNCONFIRMED_TIMEOUT";
+export interface BudgetReservation {
+    id: string;
+    tenantId?: string;
+    parentRunId?: string;
+    estimatedCostUsd: number;
+    settledCostUsd?: number;
+    status: BudgetReservationStatus;
+    createdAt: number;
+    updatedAt: number;
+}
 export declare class SecretLeakBlockedError extends Error {
     readonly detections?: Array<{
         type: string;
@@ -66,6 +107,8 @@ export interface ProviderConfig {
     baseUrl?: string;
     client?: LLMProviderPort;
     pricing?: ModelPrice;
+    ttftTimeoutMs?: number;
+    idleTimeoutMs?: number;
 }
 export type TermCategory = "PROJECT" | "COMPANY" | "INFRA" | "CUSTOM";
 export interface CustomRedactionTermDef {
@@ -115,6 +158,43 @@ export interface FinanceFeaturesConfig {
 export interface FeaturesConfig {
     finance?: FinanceFeaturesConfig;
 }
+export interface BeforeRequestContext {
+    messages: readonly ChatMessage[];
+    model: string;
+    temperature?: number;
+    metadata?: Readonly<Record<string, unknown>>;
+}
+export interface BeforeRequestResult {
+    messages?: ChatMessage[];
+    shortCircuit?: {
+        text: string;
+        tokens?: LLMUsage;
+        costUSD?: number;
+    };
+}
+export interface AfterResponseContext {
+    messages: readonly ChatMessage[];
+    responseText: string;
+    modelUsed: string;
+    tokens: {
+        prompt: number;
+        completion: number;
+        total: number;
+    };
+    costUSD: number;
+    attempts: number;
+    failoverOccurred: boolean;
+    metadata?: Readonly<Record<string, unknown>>;
+}
+export interface AfterResponseResult {
+    responseText?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface AvantGateMiddleware {
+    name: string;
+    beforeRequest?: (context: BeforeRequestContext) => Promise<BeforeRequestResult | void> | BeforeRequestResult | void;
+    afterResponse?: (context: AfterResponseContext) => Promise<AfterResponseResult | void> | AfterResponseResult | void;
+}
 export interface ControlLayerConfig {
     primary: ProviderConfig;
     fallback?: ProviderConfig;
@@ -131,6 +211,9 @@ export interface ControlLayerConfig {
     pricingCacheTtlMs?: number;
     customPricing?: Record<string, ModelPrice>;
     mockSimulation?: boolean;
+    middlewares?: AvantGateMiddleware[];
+    middlewareTimeoutMs?: number;
+    reScanIngressAfterHooks?: boolean;
 }
 export interface ExecutionResult {
     text: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACrF,MAAM,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACrF,wBAAwB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;CACxG;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAExD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAKxF;AAED,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,CAAC;AAC7D,OAAO,EAAE,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;AAC/D,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,EAAE,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACtC,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,eAAe,CAAC;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,cAAc;;;;;EAAkD,CAAC;AAC9E,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,iBAAiB;;;;;;;;kBAGnB,CAAC;AAEZ,eAAO,MAAM,uBAAuB;;;;;;;;mBAA6B,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,MAAM,WAAW,QAAQ;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACrF,MAAM,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACrF,wBAAwB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;CACxG;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;CAKnD;AAED,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;CAKnD;AAED,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,qBAAqB,CAAC;AAElG,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,uBAAuB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAGD,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAExD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAKxF;AAED,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,CAAC;AAC7D,OAAO,EAAE,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;AAC/D,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,EAAE,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACtC,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,eAAe,CAAC;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,QAAQ,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC9C;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,mBAAmB,GAAG,IAAI,CAAC;IACpH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,KAAK,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,mBAAmB,GAAG,IAAI,CAAC;CACrH;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACpC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}

package/dist/utils/immutability.d.ts

@@ -0,0 +1,5 @@
+export interface DeepFreezeOptions {
+    maxDepth?: number;
+}
+export declare const deepFreeze: <T>(target: T, options?: DeepFreezeOptions, currentDepth?: number, visited?: WeakSet<object>) => Readonly<T>;
+//# sourceMappingURL=immutability.d.ts.map

package/dist/utils/immutability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"immutability.d.ts","sourceRoot":"","sources":["../../src/utils/immutability.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,UAAU,GAAI,CAAC,EAC1B,QAAQ,CAAC,EACT,UAAU,iBAAiB,EAC3B,qBAAgB,EAChB,yBAA+B,KAC9B,QAAQ,CAAC,CAAC,CA4BZ,CAAC"}

package/dist/workflow/index.js

@@ -80,6 +80,25 @@ var DtoValidationError = class extends Error {
     this.issues = issues;
   }
 };
+var AmbiguousToolExecutionError = class extends Error {
+  toolCallId;
+  toolName;
+  impact;
+  originalError;
+  constructor(details, toolName, impact) {
+    const isStr = typeof details === "string";
+    const callId = isStr ? details : details.toolCallId;
+    const name = isStr ? toolName : details.toolName;
+    const imp = isStr ? impact ?? "MUTATIVE" : details.impact ?? "MUTATIVE";
+    const msg = isStr ? "" : details.message ? `: ${details.message}` : "";
+    super(`Ambiguous tool execution detected for [${name || "tool"}::${callId}] (${imp})${msg}. Re-execution blocked without reconciliation.`);
+    this.name = "AmbiguousToolExecutionError";
+    this.toolCallId = callId;
+    this.toolName = name;
+    this.impact = imp;
+    this.originalError = isStr ? void 0 : details.originalError;
+  }
+};
 
 // src/sanitizer.ts
 var EMAIL_REGEX = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,7}\b/g;
@@ -186,16 +205,220 @@ function auditToolResult(data, options) {
   };
 }
 
+// src/agent/tool-resilience.ts
+var MAX_FALLBACK_CAP = 1e3;
+var inMemoryFallbackStore = /* @__PURE__ */ new Map();
+var setFallbackRecord = (toolCallId, record) => {
+  if (inMemoryFallbackStore.size >= MAX_FALLBACK_CAP) {
+    const firstKey = inMemoryFallbackStore.keys().next().value;
+    if (firstKey) inMemoryFallbackStore.delete(firstKey);
+  }
+  inMemoryFallbackStore.set(toolCallId, record);
+};
+var isDeterministicClientError = (error) => {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+  const err = error;
+  const status = Number(err.status ?? err.statusCode);
+  if (status >= 400 && status < 500 && status !== 408 && status !== 429) {
+    return true;
+  }
+  return err.name === "DtoValidationError" || err.name === "ToolAccessDeniedError";
+};
+var isAmbiguousTimeoutError = (error, isTimedOut) => {
+  if (isTimedOut) return true;
+  if (!error || typeof error !== "object") return false;
+  const err = error;
+  const name = String(err.name ?? "");
+  const status = Number(err.status ?? err.statusCode);
+  if (name === "AbortError" || name === "TimeoutError") return true;
+  if (status === 408 || status === 502 || status === 503 || status === 504) return true;
+  const msg = String(err.message ?? "").toLowerCase();
+  const code = String(err.code ?? "").toLowerCase();
+  return ["timeout", "etimedout", "econnreset", "socket hang up", "network error", "fetch failed"].some((key) => msg.includes(key) || code.includes(key));
+};
+var classifyErrorStatus = (error, isTimedOut) => {
+  if (isDeterministicClientError(error)) {
+    return "FAILED";
+  }
+  if (isAmbiguousTimeoutError(error, isTimedOut)) {
+    return "UNCONFIRMED_TIMEOUT";
+  }
+  return "FAILED";
+};
+var getToolExecutionRecord = async (storage, toolCallId) => {
+  if (!storage) {
+    return inMemoryFallbackStore.get(toolCallId) ?? null;
+  }
+  if (storage.getStateValue) {
+    const val = await storage.getStateValue(`tool_resilience:${toolCallId}`);
+    if (val) return val;
+    const directVal = await storage.getStateValue(toolCallId);
+    if (directVal) return directVal;
+  }
+  const step = await storage.getStep("_tool_resilience", toolCallId);
+  return step?.metadata?.resilienceRecord ?? null;
+};
+var saveToStateStorage = async (storage, toolCallId, record) => {
+  if (!storage.setStateValue) return;
+  await storage.setStateValue(`tool_resilience:${toolCallId}`, record);
+  await storage.setStateValue(toolCallId, record);
+};
+var saveResilienceRecord = async (storage, record) => {
+  if (!storage) {
+    setFallbackRecord(record.toolCallId, record);
+    return;
+  }
+  await saveToStateStorage(storage, record.toolCallId, record);
+  const status = record.status === "COMPLETED" ? "COMPLETED" : record.status === "FAILED" ? "FAILED" : "RUNNING";
+  await storage.saveStep({
+    workflowId: "_tool_resilience",
+    stepId: record.toolCallId,
+    status,
+    result: record.result,
+    error: record.error,
+    metadata: { resilienceRecord: record },
+    createdAt: new Date(record.startedAt).toISOString(),
+    updatedAt: new Date(record.updatedAt).toISOString()
+  });
+};
+var handleAmbiguousFailure = (options, originalError) => {
+  const workflowId = options.workflowId ?? "_tool_resilience";
+  if (options.suspendOnAmbiguous) {
+    throw new StepSuspendedError(options.toolCallId, workflowId, {
+      toolCallId: options.toolCallId,
+      impact: options.impact,
+      reason: "Ambiguous mutation requires human intervention",
+      originalError
+    });
+  }
+  throw new AmbiguousToolExecutionError({
+    toolCallId: options.toolCallId,
+    toolName: options.toolName,
+    impact: options.impact,
+    message: "Ambiguous execution state (UNCONFIRMED_TIMEOUT). Re-execution blocked without reconciliation.",
+    originalError
+  });
+};
+var saveReconciledRecord = async (options, result) => {
+  await saveResilienceRecord(options.storage, {
+    toolCallId: options.toolCallId,
+    status: "COMPLETED",
+    result,
+    impact: options.impact,
+    startedAt: Date.now(),
+    updatedAt: Date.now()
+  });
+  return { result, isCached: true, status: "COMPLETED" };
+};
+var tryReconciliation = async (options) => {
+  if (!options.onAmbiguousRetry) {
+    return handleAmbiguousFailure(options);
+  }
+  try {
+    const outcome = await options.onAmbiguousRetry({ toolCallId: options.toolCallId, args: options.args });
+    if (!outcome.reconciled) {
+      return handleAmbiguousFailure(options);
+    }
+    return await saveReconciledRecord(options, outcome.result);
+  } catch (err) {
+    if (err instanceof StepSuspendedError || err instanceof AmbiguousToolExecutionError) throw err;
+    return handleAmbiguousFailure(options, err);
+  }
+};
+var checkExistingState = async (options) => {
+  const existing = await getToolExecutionRecord(options.storage, options.toolCallId);
+  if (!existing) {
+    return null;
+  }
+  if (existing.status === "COMPLETED") {
+    return { result: existing.result, isCached: true, status: "COMPLETED" };
+  }
+  if (existing.status === "UNCONFIRMED_TIMEOUT") {
+    if (options.impact === "READ_ONLY") {
+      return null;
+    }
+    return await tryReconciliation(options);
+  }
+  return null;
+};
+var executeActionWithTimeout = async (action, timeoutMs, idempotencyKey) => {
+  const controller = new AbortController();
+  let isTimedOut = false;
+  const timer = setTimeout(() => {
+    isTimedOut = true;
+    controller.abort(new Error(`Tool execution timed out after ${timeoutMs}ms`));
+  }, timeoutMs);
+  try {
+    const result = await action(controller.signal, idempotencyKey);
+    return { result, isTimedOut: false };
+  } catch (error) {
+    return { error, isTimedOut };
+  } finally {
+    clearTimeout(timer);
+  }
+};
+var saveFailureRecord = async (options, startedAt, error, isTimedOut) => {
+  const status = classifyErrorStatus(error, isTimedOut);
+  const errorMsg = error instanceof Error ? error.message : String(error);
+  await saveResilienceRecord(options.storage, {
+    toolCallId: options.toolCallId,
+    status,
+    error: errorMsg,
+    impact: options.impact,
+    startedAt,
+    updatedAt: Date.now()
+  });
+  throw error;
+};
+var saveSuccessRecord = async (options, startedAt, result) => {
+  await saveResilienceRecord(options.storage, {
+    toolCallId: options.toolCallId,
+    status: "COMPLETED",
+    result,
+    impact: options.impact,
+    startedAt,
+    updatedAt: Date.now()
+  });
+  return { result, isCached: false, status: "COMPLETED" };
+};
+var claimExecutionIntent = async (options, startedAt) => {
+  await saveResilienceRecord(options.storage, {
+    toolCallId: options.toolCallId,
+    status: "CLAIMED",
+    impact: options.impact,
+    startedAt,
+    updatedAt: startedAt
+  });
+};
+var withToolResilience = async (options) => {
+  const existingResult = await checkExistingState(options);
+  if (existingResult) {
+    return existingResult;
+  }
+  const startedAt = Date.now();
+  const idempotencyKey = options.idempotencyKey || options.toolCallId;
+  await claimExecutionIntent(options, startedAt);
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  const outcome = await executeActionWithTimeout(options.action, timeoutMs, idempotencyKey);
+  if (outcome.error) {
+    return await saveFailureRecord(options, startedAt, outcome.error, outcome.isTimedOut);
+  }
+  return await saveSuccessRecord(options, startedAt, outcome.result);
+};
+
 // src/agent/isolated-tool.ts
 var verifyRoles = (configuredRoles, context, toolIdentifier) => {
   if (!configuredRoles || configuredRoles.length === 0) {
     return;
   }
-  const userRoles = [
-    ...context.roles ?? [],
-    ...context.role ? [context.role] : []
-  ];
-  const hasAllowedRole = configuredRoles.some((role) => userRoles.includes(role));
+  if (!context.role && (!context.roles || context.roles.length === 0)) {
+    throw new ToolAccessDeniedError(toolIdentifier, "Access denied: insufficient role permissions");
+  }
+  const roleSet = new Set(context.roles ?? []);
+  if (context.role) roleSet.add(context.role);
+  const hasAllowedRole = configuredRoles.some((role) => roleSet.has(role));
   if (!hasAllowedRole) {
     throw new ToolAccessDeniedError(
       toolIdentifier,
@@ -312,6 +535,35 @@ var processLlmPayload = async (rawResult, args, context, config, toolIdentifier)
     config.throwOnPii === true
   );
 };
+var buildResilientContext = (config, args, context) => {
+  const toolCallId = context.toolCallId || `call_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
+  const genKey = config.resilience?.idempotencyKeyGenerator?.(args, context);
+  const idempotencyKey = context.idempotencyKey || genKey || toolCallId;
+  const resilientContext = { ...context, toolCallId, idempotencyKey };
+  return { toolCallId, idempotencyKey, resilientContext };
+};
+var executeWithResilienceGuard = async (config, args, context, toolIdentifier) => {
+  if (!config.resilience) {
+    return await config.execute(args, context);
+  }
+  const { toolCallId, idempotencyKey, resilientContext } = buildResilientContext(config, args, context);
+  const outcome = await withToolResilience({
+    toolCallId,
+    toolName: toolIdentifier,
+    storage: context.storage,
+    impact: config.impact ?? "READ_ONLY",
+    idempotencyKey,
+    timeoutMs: config.resilience.timeoutMs,
+    suspendOnAmbiguous: config.resilience.suspendOnAmbiguous,
+    workflowId: context.workflowId,
+    args,
+    action: async (signal, idKey) => {
+      return await config.execute(args, { ...resilientContext, abortSignal: signal, idempotencyKey: idKey });
+    },
+    onAmbiguousRetry: config.resilience.onAmbiguousRetry
+  });
+  return outcome.result;
+};
 var createIsolatedTool = (config) => {
   const toolId = config.id || config.name;
   const toolAlias = config.alias;
@@ -333,6 +585,7 @@ var createIsolatedTool = (config) => {
     _roles: config.roles ? Object.freeze([...config.roles]) : void 0,
     _impact: toolImpact,
     _requireApproval: requireApproval,
+    _resilience: config.resilience,
     _lastPiiFilteredCount: 0,
     _lastInvalidationTags: void 0,
     execute: async (args, context) => {
@@ -347,7 +600,12 @@ var createIsolatedTool = (config) => {
         updatedContext,
         toolIdentifier
       );
-      const rawResult = await config.execute(args, updatedContext);
+      const rawResult = await executeWithResilienceGuard(
+        config,
+        args,
+        updatedContext,
+        toolIdentifier
+      );
       verifyTenantIsolation(config.assertTenant, rawResult, updatedContext, toolIdentifier);
       await verifyResourceOwnership(
         config.assertOwnership,

package/dist/workflow/index.mjs

@@ -5,8 +5,8 @@ import {
   defineWorkflow,
   executeWorkflow,
   isWorkflowAbortSignal
-} from "../chunk-AH5XXSS4.mjs";
-import "../chunk-W27A25DK.mjs";
+} from "../chunk-KEJ4VNSN.mjs";
+import "../chunk-B22KKIQQ.mjs";
 import "../chunk-Y6FXYEAI.mjs";
 export {
   WorkflowAbortSignal,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "avantgate",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "description": "Zero-infrastructure, in-process AI Application Firewall (AI-WAF), privacy control plane & headless UI canvas for TypeScript: real-time prompt guardrails, zero-egress PII redaction, deterministic tool envelopes, anti-IDOR defense, pre-flight token budgets, and multi-model failover.",
   "author": "Gatewall Team",
   "license": "MIT",
@@ -96,14 +96,17 @@
   ],
   "scripts": {
     "build": "tsup src/index.ts src/finance/index.ts src/agent/index.ts src/workflow/index.ts src/client/index.ts src/ui/index.ts src/ui/react/index.ts --format cjs --format esm --clean && tsc --emitDeclarationOnly --outDir dist",
-    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/sqlite-pricing-adapter.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && tsx tests/output-dlp-secret-guard.test.ts && npm run test:agent && npm run test:workflow && npm run test:client && npm run test:ui",
+    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/sqlite-pricing-adapter.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && tsx tests/output-dlp-secret-guard.test.ts && tsx tests/utils/immutability.test.ts && tsx tests/middleware-lifecycle.test.ts && tsx tests/presets.test.ts && tsx tests/finops/pessimistic-budget.test.ts && tsx tests/providers/stream-timeout.test.ts && npm run test:agent && npm run test:workflow && npm run test:client && npm run test:ui",
+    "test:finops": "tsx tests/finops/pessimistic-budget.test.ts && tsx tests/providers/stream-timeout.test.ts",
+    "test:presets": "tsx tests/presets.test.ts",
+    "test:middleware": "tsx tests/utils/immutability.test.ts && tsx tests/middleware-lifecycle.test.ts",
     "test:ui": "tsx tests/ui/envelope.test.ts && tsx tests/ui/reducer.test.ts && tsx tests/ui/sanitize.test.ts && tsx tests/ui/react-registry.test.tsx",
     "test:secrets": "tsx tests/output-dlp-secret-guard.test.ts",
     "test:pricing": "tsx tests/sqlite-pricing-adapter.test.ts",
     "test:finance": "tsx tests/financial-normalizer.test.ts",
     "test:prompts": "tsx tests/prompt-builder.test.ts",
     "test:pii": "tsx tests/pii-extended.test.ts",
-    "test:agent": "tsx tests/agent/step-runner.test.ts && tsx tests/agent/isolated-tool.test.ts && tsx tests/agent/dto-pattern.test.ts && tsx tests/agent/tool-patterns.test.ts && tsx tests/agent/storage-adapters.test.ts && tsx tests/agent/tool-aliasing.test.ts && tsx tests/agent/tool-chaining.test.ts && tsx tests/agent/tool-storage.test.ts && tsx tests/agent/telemetry-exporter.test.ts && tsx tests/agent/platform-adapter.test.ts && tsx tests/agent/tool-governance.test.ts && tsx tests/agent/tool-impact.test.ts && tsx tests/agent/idempotency-guard.test.ts",
+    "test:agent": "tsx tests/agent/step-runner.test.ts && tsx tests/agent/isolated-tool.test.ts && tsx tests/agent/dto-pattern.test.ts && tsx tests/agent/tool-patterns.test.ts && tsx tests/agent/storage-adapters.test.ts && tsx tests/agent/tool-aliasing.test.ts && tsx tests/agent/tool-chaining.test.ts && tsx tests/agent/tool-storage.test.ts && tsx tests/agent/telemetry-exporter.test.ts && tsx tests/agent/platform-adapter.test.ts && tsx tests/agent/tool-governance.test.ts && tsx tests/agent/tool-impact.test.ts && tsx tests/agent/idempotency-guard.test.ts && tsx tests/agent/tool-resilience.test.ts",
     "test:workflow": "tsx tests/workflow/workflow-saga.test.ts && tsx tests/workflow/workflow-abort.test.ts",
     "test:client": "tsx tests/client/browser-exporter.test.ts && tsx tests/client/use-avantgate-task.test.ts && tsx tests/client/task-runner.test.ts",
     "test:demo": "tsx tests/agent/prospect-ai-demo-scenario.test.ts",