1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
//! Wire-level interop: guard LLM tool calls from any agent framework.
//!
//! Agent frameworks (Pydantic AI, LangChain, the OpenAI and Anthropic SDKs)
//! all share the same last-mile shape: the model emits a *tool call* — a tool
//! name plus JSON arguments — and the host process decides whether to run it.
//! That decision point is exactly where Typesec belongs, and it is the one
//! place none of the frameworks guard for you.
//!
//! This module provides:
//!
//! - [`ToolCallRequest`] — a framework-neutral, normalized tool call.
//! - [`ToolBinding`] — the declaration of how one tool maps onto the Typesec
//! `(action, resource)` plane, optionally taking the resource from a tool
//! argument.
//! - [`ToolCallGuard`] — evaluates normalized calls against any
//! [`PolicyEngine`](typesec_core::policy::PolicyEngine), **deny-by-default**
//! for tools without a binding.
//! - Dialect codecs ([`openai`], [`anthropic`], [`langchain`],
//! [`pydantic_ai`]) that parse each framework's wire shape into
//! [`ToolCallRequest`]s and render denials back in the shape the framework
//! expects (an error tool-result / retry part), so a blocked call flows back
//! to the model as feedback instead of crashing the run.
//!
//! ```text
//! model output ─▶ dialect::parse_tool_calls ─▶ ToolCallGuard::check_all
//! │ Allow ─▶ run the tool
//! └ Deny ─▶ dialect::denial ─▶ model
//! ```
//!
//! The typed [`ProtectedTool`](crate::ProtectedTool) path remains the
//! strongest boundary (a capability is required to *compile* the call); this
//! module is the runtime bridge for tools that live on the other side of a
//! JSON wire, where Rust types cannot reach.
pub use ;
pub use ToolCallGuard;
pub use ;