@adonis-agora/agent 0.25.2 → 0.25.4

package/skills/agent-testing/SKILL.md

@@ -0,0 +1,236 @@
+---
+name: agent-testing
+description: >-
+  Test @adonis-agora/agent offline: FakeModelProvider with a pure FakeScript
+  (args, turnIndex) and echoScript, the in-memory SPI doubles from
+  @adonis-agora/agent/testing (InMemoryAgentStore, InMemoryTokenStreamSink.subscribe,
+  InMemoryQuotaStore, InMemoryPricingStore, InMemoryGovernanceQueries,
+  InMemoryActorDirectory, InMemoryAttachmentStagingStore, FakeEmbeddingProvider,
+  FakeReranker, inMemoryRetriever), driving runAgentLoop directly with the
+  step/awaitApproval/openSink hooks seam, or AgentDepsFactory + InlineAgentRunner, and
+  asserting on typed StreamFrames. Use for "test the agent without an API key",
+  "script a tool-call turn", "assert streamed text", "HITL approve in tests".
+metadata:
+  type: core
+  library: "@adonis-agora/agent"
+  library_version: "0.25.2"
+  framework: adonisjs
+sources:
+  - "DavideCarvalho/adonis-agent:packages/adonis/docs/testing.mdx"
+  - "DavideCarvalho/adonis-agent:packages/adonis/src/testing/index.ts"
+  - "DavideCarvalho/adonis-agent:packages/adonis/src/testing/fake-model-provider.ts"
+  - "DavideCarvalho/adonis-agent:packages/adonis/src/agent-loop.ts"
+---
+
+# Testing @adonis-agora/agent offline
+
+Everything the agent depends on is a seam, so a test can run a full turn — model call,
+tool execution, governance, cost accounting — with **no API key and no database**. The
+in-memory doubles implement the SAME SPIs as the production adapters, so a green test
+exercises the real loop code paths.
+
+## Setup
+
+A minimal turn through the full loop, straight from the testing kit:
+
+```ts
+import {
+  runAgentLoop,
+  ToolRegistry,
+  DefaultRolesPolicy,
+} from '@adonis-agora/agent'
+import {
+  FakeModelProvider,
+  echoScript,
+  InMemoryAgentStore,
+  InMemoryTokenStreamSink,
+} from '@adonis-agora/agent/testing'
+
+const sink = new InMemoryTokenStreamSink()
+const { text } = await runAgentLoop(
+  {
+    model: new FakeModelProvider(echoScript('hi there')),
+    store: new InMemoryAgentStore(),
+    registry: new ToolRegistry(),
+    rolesPolicy: new DefaultRolesPolicy(),
+    day: '2026-07-21',
+    systemPrompt: 'You are a helpful assistant.',
+  },
+  { threadId: 'thread-1', actor: { id: 'user-1', roles: ['USER'] }, userText: 'hi' },
+  {
+    runId: crypto.randomUUID(),
+    openSink: () => sink.open('run-1'),
+    awaitApproval: async () => 'approve',
+    step: (_name, fn) => fn(),
+  },
+)
+```
+
+`hooks.step(name, fn)` is the checkpoint seam: inline it just calls `fn`; the durable
+runner memoizes each named step. `hooks.awaitApproval` is where a HITL decision comes
+from — return `{ approved: true }` (or a bare `'approve'`) to auto-approve in tests.
+
+Source: `packages/adonis/README.md` ("Framework-agnostic core"),
+`packages/adonis/src/agent-loop.ts` (`AgentLoopHooks`).
+
+## Core patterns
+
+### Pattern 1 — script a tool-call round-trip
+
+`FakeModelProvider` takes a script — a pure function of `(args, turnIndex)`. `turnIndex`
+counts assistant turns already in history, so there is no internal counter to reset:
+
+```ts
+import { FakeModelProvider } from '@adonis-agora/agent/testing'
+
+const model = new FakeModelProvider((args, turnIndex) => {
+  if (turnIndex === 0) {
+    // first turn: ask to call a tool
+    return { text: 'Let me check that.', toolCall: { name: 'getWeather', input: { city: 'Lisbon' } } }
+  }
+  // second turn: finish with the tool result in hand
+  return { text: 'It is 21°C in Lisbon.' }
+})
+```
+
+A scripted turn may also report `costUsd`, exactly as a gateway provider would, to
+exercise the cost fold.
+
+Source: `packages/adonis/docs/testing.mdx` ("The fake model"),
+`packages/adonis/src/testing/fake-model-provider.ts`.
+
+### Pattern 2 — run through the runner like production does
+
+`AgentDepsFactory` + `InlineAgentRunner` is the same composition the provider builds at
+boot, so the test covers run lifecycle persistence, not just the loop:
+
+```ts
+import {
+  AgentDepsFactory,
+  AgentRegistry,
+  ToolRegistry,
+  DefaultToolAuthorizer,
+  InlineAgentRunner,
+} from '@adonis-agora/agent'
+import {
+  FakeModelProvider,
+  echoScript,
+  InMemoryAgentStore,
+  InMemoryTokenStreamSink,
+} from '@adonis-agora/agent/testing'
+
+const store = new InMemoryAgentStore()
+const sink = new InMemoryTokenStreamSink()
+const registry = new ToolRegistry()
+const agents = new AgentRegistry()
+agents.register({ name: 'default' })
+
+const factory = new AgentDepsFactory({
+  model: new FakeModelProvider(echoScript('hello')),
+  store,
+  sink,
+  rolesPolicy: new DefaultToolAuthorizer(['ADMIN']),
+  registry,
+  agents,
+})
+
+const runner = new InlineAgentRunner(factory, store)
+const { runId } = await runner.start({
+  threadId: (await store.createThread({ actor: { id: 'u1', roles: ['ADMIN'] }, persona: 'default' })).id,
+  actor: { id: 'u1', roles: ['ADMIN'] },
+  userText: 'hi',
+})
+
+let text = ''
+for await (const frame of sink.subscribe(runId)) {
+  if (frame.t === 'text') text += frame.v
+}
+```
+
+Source: `packages/adonis/docs/testing.mdx` ("A minimal turn in a test").
+
+### Pattern 3 — assert on typed `StreamFrame`s, not bytes
+
+`sink.subscribe(runId)` yields discriminated frames — `{ t: 'text', v }` and
+`{ t: 'component', name, data }` — so one loop can assert prose and Generative-UI
+emissions separately. The SSE wire encoding happens later, in the provider's route
+handler; a test never sees it:
+
+```ts
+const components: { name: string; data: unknown }[] = []
+for await (const frame of sink.subscribe(runId)) {
+  if (frame.t === 'text') text += frame.v
+  if (frame.t === 'component') components.push({ name: frame.name, data: frame.data })
+}
+```
+
+Source: `packages/adonis/docs/testing.mdx` ("Because the fakes are behavioral twins"
+note), `packages/adonis/src/in-process-sink.ts`.
+
+## Common mistakes
+
+### MEDIUM — keeping mutable state in a FakeModelProvider script
+
+```ts
+// Wrong — a closure counter: the script is no longer a pure function of its inputs.
+let calls = 0
+const model = new FakeModelProvider(() => (calls++ === 0 ? { text: 'call tool' } : { text: 'done' }))
+```
+
+```ts
+// Correct — derive the turn from turnIndex (assistant turns already in history).
+const model = new FakeModelProvider((_args, turnIndex) =>
+  turnIndex === 0 ? { text: 'call tool' } : { text: 'done' },
+)
+```
+
+Mechanism: `turnIndex` is computed from the message history each call
+(`messages.filter(m => m.role === 'assistant').length`), so history-derived scripts stay
+deterministic and replay-safe; a closure counter diverges the moment a run is retried or
+replayed.
+Source: `packages/adonis/src/testing/fake-model-provider.ts` (`turnIndex` derivation).
+
+### MEDIUM — registering a tool the test actor's roles cannot reach, then asserting it ran
+
+```ts
+// Wrong — DefaultRolesPolicy(['ADMIN']) + actor roles: ['USER'] → the tool is never OFFERED.
+registry.register({ name: 'get_weather', kind: 'read', description: '', inputSchema: zodSchema }, handler)
+const { text } = await runAgentLoop({ ..., rolesPolicy: new DefaultRolesPolicy() },
+  { actor: { id: 'u1', roles: ['USER'] }, ... }, hooks)
+```
+
+```ts
+// Correct — align the actor's roles with the tool spec (or the policy's defaults).
+await runAgentLoop({ ..., rolesPolicy: new DefaultRolesPolicy() },
+  { actor: { id: 'u1', roles: ['ADMIN'] }, ... }, hooks)
+```
+
+Mechanism: the offered-tools filter drops role-forbidden tools BEFORE the model turn, so
+the fake model's `toolCall` for a hidden tool fails with `ToolForbiddenError` at invoke —
+the loop never auto-executes what was never offered.
+Source: `packages/adonis/src/tool-registry.ts` (`definitionsFor`, `invoke`),
+`packages/adonis/docs/governance/authorization.mdx` ("The double check").
+
+### LOW — asserting on the in-memory sink's frames as if they were SSE text
+
+```ts
+// Wrong — frames are typed objects, not an SSE byte stream.
+const raw = await res.text() // 'data: {"delta":"..."}\n\n'
+expect(raw).toContain('delta')
+```
+
+```ts
+// Correct — narrow on t and assert the payload.
+for await (const frame of sink.subscribe(runId)) {
+  if (frame.t === 'text') expect(frame.v).toBeDefined()
+}
+```
+
+Mechanism: `InMemoryTokenStreamSink.subscribe` yields `StreamFrame` objects; the SSE
+envelope (`event: meta` / `data: {"delta":...}` / `event: done`) is produced by the
+provider's route handler via `frameToSse`, a layer tests never cross.
+Source: `packages/adonis/docs/testing.mdx` (StreamFrame note),
+`packages/adonis/src/sse.ts` (`frameToSse`).
+
+See also: `agent-tools/SKILL.md` — registering real tools into the test registry;
+`agent-setup/SKILL.md` — why `day` is a required, runner-stamped loop dep.

package/skills/agent-tools/SKILL.md

@@ -0,0 +1,270 @@
+---
+name: agent-tools
+description: >-
+  Author and register governed tools for @adonis-agora/agent: @AiTool decorated classes,
+  BaseTool/ReadTool/ActionTool static-tool subclasses, defineTool functional tools,
+  discovery from app/agent_tools via the .adonisjs/agent/tools.js barrel (toolsHook with
+  source/importAlias/output) vs the runtime scan fallback, Standard Schema inputs
+  (Zod/Valibot/ArkType), AiToolCtx actor scoping, constructor DI (@inject, lazy + cached),
+  roles/ability fail-closed gating under defaultRoles, and the dataTool governed read-only
+  SQL satellite. Use for "write a tool", "my tool is never called", "tool forbidden",
+  "agent_tools barrel not generating", or "let the agent query the database".
+metadata:
+  type: core
+  library: "@adonis-agora/agent"
+  library_version: "0.25.2"
+  framework: adonisjs
+sources:
+  - "DavideCarvalho/adonis-agent:packages/adonis/docs/authoring/tools.mdx"
+  - "DavideCarvalho/adonis-agent:packages/adonis/docs/authoring/data-satellite.mdx"
+  - "DavideCarvalho/adonis-agent:packages/adonis/src/ai-tool-ref.ts"
+  - "DavideCarvalho/adonis-agent:packages/adonis/src/tool-discovery.ts"
+---
+
+# Writing governed tools for @adonis-agora/agent
+
+A tool is a named capability with a typed input schema; the model decides *when* to call
+it, the loop decides *whether it may* (role gate) and *how* (auto-execute vs human
+approval). `read` auto-executes, `action` pauses for HITL approval. There are two ways to
+author one — a class or a function — and both register the same way.
+
+## Setup
+
+Create `app/agent_tools/get_weather.ts`. The Assembler init hook registered by
+`node ace configure @adonis-agora/agent` generates the `.adonisjs/agent/tools.js` barrel
+at build/dev time, and the provider registers every export at boot:
+
+```ts
+// app/agent_tools/get_weather.ts
+import { z } from 'zod'
+import { ReadTool } from '@adonis-agora/agent'
+import type { AiToolCtx } from '@adonis-agora/agent'
+
+const input = z.object({ city: z.string() })
+type Input = z.infer<typeof input>
+
+export default class GetWeather extends ReadTool<Input, { tempC: number }> {
+  // No `kind` — the base pins 'read'. Type-checks bare, no satisfies needed.
+  static tool = {
+    name: 'get_weather',
+    description: 'Current weather for a city.',
+    input,
+    roles: ['MEMBER'], // omit → config.defaultRoles (['ADMIN'] by default)
+  }
+
+  async execute({ city }: Input, _ctx: AiToolCtx) {
+    return { tempC: 21 }
+  }
+}
+```
+
+Prefer a function? `defineTool(options, execute)` returns a branded `{ spec, handler }`
+discovery picks up identically — or pass it straight to `defineConfig({ tools: [...] })`.
+
+## Core patterns
+
+### Pattern 1 — mutating tools as `ActionTool` (HITL approval)
+
+`kind: 'action'` records the call `pending_approval` and suspends the run until a client
+posts approve/reject to `/agent/tool-call/approve|reject`. Dependencies come from the IoC
+container — declare them in the constructor with `@inject()`:
+
+```ts
+// app/agent_tools/purge_cache.ts
+import { inject } from '@adonisjs/core'
+import { z } from 'zod'
+import { ActionTool } from '@adonis-agora/agent'
+import type { AiToolCtx } from '@adonis-agora/agent'
+
+const input = z.object({ key: z.string() })
+type Input = z.infer<typeof input>
+
+@inject()
+export default class PurgeCache extends ActionTool<Input, { purged: string }> {
+  constructor(private readonly cache: CacheService) {
+    super()
+  }
+
+  static tool = {
+    name: 'purge_cache',
+    description: 'Purge one cache key.',
+    input,
+    ability: 'cache.purge', // consumed by an ability-aware RolesPolicy (authz adapter)
+  }
+
+  async execute({ key }: Input, _ctx: AiToolCtx) {
+    await this.cache.forget(key)
+    return { purged: key }
+  }
+}
+```
+
+Class tools resolve lazily through the container on first invocation, then cached — so a
+constructor needing a peer service fails nothing at boot.
+
+Source: `packages/adonis/docs/authoring/tools.mdx` ("Constructor DI").
+
+### Pattern 2 — let the agent query SQL with `dataTool` (fail-closed)
+
+`dataTool` validates a single SELECT, enforces a REQUIRED role→group→table allow-list
+(there is no allow-all), rewrites in an optional tenant scope, injects LIMIT, and
+truncates oversized results before they hit the model's context:
+
+```ts
+// config/agent.ts
+import { defineConfig, dataTool } from '@adonis-agora/agent'
+import db from '@adonisjs/lucid/services/db'
+
+export default defineConfig({
+  model: () => aiSdkModel(openai('gpt-4o-mini')),
+  tools: [
+    dataTool({
+      db: db.connection('readonly'),          // point at a read-only replica
+      tableAccess: {                          // REQUIRED — fail-closed, no implicit allow-all
+        roleGroups: { MEMBER: ['sales'], ADMIN: ['sales', 'ops'] },
+        tablesByGroup: { sales: ['orders', 'products'], ops: ['audit_log'] },
+      },
+      tenant: { tenantColumn: 'tenant_id', scopedTables: ['orders'] },
+      maxRows: 100,                           // LIMIT injected when the query has none
+    }),
+  ],
+})
+```
+
+The model sees a tool named `executeSql` taking `{ sql: string }`. Two governance layers
+stack: `roles`/`ability` gate whether the tool may be called at all; `tableAccess` +
+`tenant` gate what a permitted call may read.
+
+Source: `packages/adonis/docs/authoring/data-satellite.mdx`.
+
+### Pattern 3 — move the scan directory with `toolsHook`
+
+To keep tools in a shared package or differently-named directory, call the hook factory
+yourself in `adonisrc.ts`:
+
+```ts
+// adonisrc.ts
+import { defineConfig } from '@adonisjs/core'
+import { toolsHook } from '@adonis-agora/agent/hooks/tools'
+
+export default defineConfig({
+  hooks: {
+    init: [
+      async () => ({
+        default: toolsHook({ source: 'app/ai/tools', importAlias: '#ai_tools' }),
+      }),
+    ],
+  },
+})
+```
+
+Change `source` and `importAlias` together; leave `output` alone (default
+`.adonisjs/agent/tools.ts`) — moving the output makes the provider silently fall back to
+the runtime scan you were replacing.
+
+Source: `packages/adonis/docs/authoring/tools.mdx` ("Configuring the generator"),
+`packages/adonis/src/hooks/tools.ts` (`ToolsHookOptions`).
+
+## Common mistakes
+
+### CRITICAL — shipping tools without `roles` and calling them unreachable
+
+```ts
+// Wrong — no roles → inherits defaultRoles ['ADMIN']; MEMBER actors never see this tool.
+static tool = { name: 'get_order', description: '...', input }
+```
+
+```ts
+// Correct — declare who may invoke.
+static tool = { name: 'get_order', description: '...', input, roles: ['MEMBER'] }
+```
+
+Mechanism: `definitionsFor` filters the offered tool list through the role gate BEFORE
+each model turn, so a tool the actor cannot invoke is never described to the model — it
+cannot call what it was never shown. This is why "the model didn't call my tool" is
+usually an authorization default, not a prompt problem.
+Source: `packages/adonis/docs/authoring/tools.mdx` (fail-closed callout),
+`packages/adonis/src/tool-registry.ts` (`DefaultRolesPolicy.can`).
+
+### HIGH — trusting an id from the model's arguments instead of `ctx.actor`
+
+```ts
+// Wrong — the MODEL chose this customerId; any caller can read anyone's orders.
+async execute({ customerId }: Input) {
+  return Order.query().where('customer_id', customerId)
+}
+```
+
+```ts
+// Correct — scope to the acting identity the resolver authenticated.
+async execute(_input: Input, ctx: AiToolCtx) {
+  return Order.query().where('customer_ref', ctx.actor.id)
+}
+```
+
+Mechanism: tool arguments are untrusted model output; identity is single-sourced on
+`ctx.actor` (`id`, `roles`, `tenantRef`) populated from the server-side actor resolver.
+Source: `packages/adonis/docs/authoring/tools.mdx` ("The tool context"),
+`packages/adonis/src/spi/tool.ts`.
+
+### MEDIUM — renaming the generated barrel's output path
+
+```ts
+// Wrong — the provider imports .adonisjs/agent/tools.js; elsewhere = silently ignored.
+toolsHook({ source: 'app/ai/tools', importAlias: '#ai_tools', output: '.adonisjs/mytools.ts' })
+```
+
+```ts
+// Correct — change source + importAlias together; leave output at its default.
+toolsHook({ source: 'app/ai/tools', importAlias: '#ai_tools' })
+```
+
+Mechanism: the provider imports the compiled barrel from the fixed
+`.adonisjs/agent/tools.js`; a moved file is absent there, so boot falls back to scanning
+`app/agent_tools` — which no longer holds your tools — and the agent runs with none of
+them, logging only a quiet fallback.
+Source: `packages/adonis/docs/authoring/tools.mdx` ("Point `output` elsewhere…"),
+`packages/adonis/src/hooks/tools.ts` (`GENERATED_TOOLS_OUTPUT`).
+
+### MEDIUM — debugging "zero tools" after adding one that throws on import
+
+```ts
+// Wrong assumption — a throwing tool file aborts discovery, so NOTHING registers.
+// app/agent_tools/broken.ts references a service whose `app` is undefined during boot.
+```
+
+```ts
+// Correct mental model — the bad file is skipped loudly; every OTHER tool still registers.
+// Fix the import error surfaced in the logs; the rest of agent_tools keeps working meanwhile.
+```
+
+Mechanism: `discoverTools` wraps each dynamic import in its own try/catch, logs the
+failure, and continues — so the symptom is one missing tool (the model narrating calls it
+was never given), not a dead registry.
+Source: `packages/adonis/src/tool-discovery.ts` (`discoverTools` import try/catch and log
+message).
+
+### LOW — declaring `kind` on a ReadTool/ActionTool subclass
+
+```ts
+// Wrong — the base already pins kind; the literal widens and fights the inherited static type.
+export default class CloseTicket extends ActionTool<Input, Row> {
+  static tool = { name: 'close_ticket', kind: 'action', description: '...', input }
+}
+```
+
+```ts
+// Correct — truly bare static; the base carries kind.
+export default class CloseTicket extends ActionTool<Input, Row> {
+  static tool = { name: 'close_ticket', description: '...', input }
+}
+```
+
+Mechanism: `ReadTool`/`ActionTool` pin `static readonly kind`; redeclaring it adds a union
+field the inherited `static tool?: BaseToolOptions` doesn't contextualize, so the literal's
+`kind: string` widens and type-checking degrades instead of failing.
+Source: `packages/adonis/src/base-tool.ts` (`BaseToolOptions`, kind-specific bases),
+`packages/adonis/docs/authoring/tools.mdx` ("truly bare").
+
+See also: `agent-governance/SKILL.md` — swapping `rolesPolicy` for ability checks;
+`agent-personas-agents/SKILL.md` — narrowing tools per persona/agent.

package/dist/assets/spa/assets/index-DshcMnMD.css

@@ -1 +0,0 @@
-:root{--bg: #09090b;--panel: #0c0c0f;--panel-2: #101017;--line: #1c1c22;--line-soft: #16161a;--text: #e7e7ea;--muted: #76767f;--agora-primary: #a78bfa;--agora-primary-soft: color-mix(in srgb, #a78bfa 14%, transparent);--agora-accent: #60a5fa;--primary: var(--agora-primary);--primary-fg: #09090b;--good: #34d399;--warn: #fbbf24;--bad: #f87171;--info: var(--agora-accent)}:root[data-theme=light],:root:not([data-theme=dark]){color-scheme:dark}:root[data-theme=dark]{color-scheme:dark}:root[data-theme=light]{color-scheme:light;--bg: hsl(40 30% 96%);--panel: hsl(40 28% 98%);--panel-2: hsl(40 24% 95%);--line: hsl(240 10% 14% / .12);--line-soft: hsl(240 10% 14% / .06);--text: hsl(240 14% 12%);--muted: hsl(240 6% 42%);--primary-fg: hsl(40 40% 97%)}*{box-sizing:border-box}html,body,#root{height:100%;margin:0}body{background:var(--bg);color:var(--text);font-family:Space Grotesk,ui-sans-serif,system-ui,sans-serif;-webkit-font-smoothing:antialiased}.mono{font-family:JetBrains Mono,ui-monospace,SF Mono,Menlo,monospace}.tnum{font-variant-numeric:tabular-nums}.app-bg{position:fixed;inset:0;z-index:0;pointer-events:none;background-image:radial-gradient(900px 420px at 82% -10%,hsl(250 74% 51% / .12),transparent 70%),radial-gradient(700px 360px at 8% -12%,hsl(190 90% 50% / .06),transparent 70%);opacity:.9}.shell{position:relative;z-index:1;max-width:1180px;margin:0 auto;padding:28px 24px 64px}.masthead{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap;margin-bottom:22px}.brand{display:flex;align-items:center;gap:12px}.brand-mark{width:32px;height:32px;border-radius:8px;display:grid;place-items:center;color:var(--primary);background:color-mix(in srgb,var(--primary) 10%,transparent);border:1px solid color-mix(in srgb,var(--primary) 40%,transparent);font-weight:700}.brand h1{font-size:14px;font-weight:600;margin:0;letter-spacing:-.01em}.brand p{margin:1px 0 0;font-family:JetBrains Mono,ui-monospace,SF Mono,Menlo,monospace;font-size:10px;text-transform:uppercase;letter-spacing:.2em;color:var(--muted)}.tabs{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:20px}.tab{appearance:none;border:1px solid var(--line);background:var(--panel);color:var(--muted);border-radius:8px;padding:6px 12px;font-size:12px;cursor:pointer;display:inline-flex;align-items:center;gap:7px;transition:color .15s,border-color .15s,background .15s}.tab:hover{color:var(--text)}.tab[aria-selected=true]{color:var(--text);background:color-mix(in srgb,var(--primary) 10%,transparent);border-color:color-mix(in srgb,var(--primary) 50%,var(--line))}.controls{display:flex;align-items:center;gap:10px;flex-wrap:wrap}.range-input{background:var(--panel);border:1px solid var(--line);color:var(--text);border-radius:8px;padding:6px 9px;font-size:12px;font-family:inherit}.price-input{min-width:225px}.icon-btn{appearance:none;border:1px solid var(--line);background:var(--panel);color:var(--muted);border-radius:8px;width:34px;height:32px;cursor:pointer;display:grid;place-items:center}.icon-btn:hover{color:var(--text)}.panel{background:linear-gradient(180deg,var(--panel-2),var(--panel));border:1px solid var(--line);border-radius:12px;padding:18px}.grid{display:grid;gap:16px}.grid.cols-3{grid-template-columns:repeat(3,1fr)}.grid.cols-2{grid-template-columns:repeat(2,1fr)}.grid.stat-4{grid-template-columns:repeat(4,1fr)}@media(max-width:900px){.grid.cols-3,.grid.cols-2,.grid.stat-4{grid-template-columns:repeat(2,1fr)}}@media(max-width:560px){.grid.cols-3,.grid.cols-2,.grid.stat-4{grid-template-columns:1fr}}.stat .label{font-size:11px;text-transform:uppercase;letter-spacing:.06em;color:var(--muted);margin-bottom:8px}.stat .value{font-size:24px;font-weight:600;letter-spacing:-.02em}.stat .sub{font-size:12px;color:var(--muted);margin-top:4px}.section-title{display:flex;align-items:center;justify-content:space-between;margin:0 0 14px;gap:12px}.section-title h2{font-size:14px;margin:0;letter-spacing:.01em}.section-title .hint{font-size:12px;color:var(--muted)}.table{width:100%;border-collapse:collapse;font-size:12px}.table tbody{font-family:JetBrains Mono,ui-monospace,SF Mono,Menlo,monospace;font-variant-numeric:tabular-nums}.table th{text-align:left;font-weight:500;font-size:11px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);padding:0 10px 10px;border-bottom:1px solid var(--line)}.table td{padding:10px;border-bottom:1px solid var(--line-soft);vertical-align:middle}.table tr:last-child td{border-bottom:none}.table .num{text-align:right}.table-wrap{overflow-x:auto}.bar{height:6px;border-radius:999px;background:var(--line);overflow:hidden;min-width:60px}.bar>span{display:block;height:100%;border-radius:999px;background:var(--primary)}.legend{display:flex;flex-direction:column;gap:8px;font-size:12px}.legend .row{display:flex;align-items:center;gap:8px}.swatch{width:10px;height:10px;border-radius:3px;flex:none}.legend .name{flex:1;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.pill{display:inline-flex;align-items:center;gap:6px;padding:2px 9px;border-radius:999px;font-size:11px;border:1px solid var(--line);color:var(--muted)}.dot{width:7px;height:7px;border-radius:999px;background:currentColor;display:inline-block}.s-completed,.s-ok,.s-success,.s-approved{color:var(--good)}.s-running,.s-pending,.s-pending_approval,.s-awaiting_approval{color:var(--info)}.s-failed,.s-error,.s-rejected,.s-forbidden{color:var(--bad)}.s-cancelled,.s-canceled{color:var(--warn)}.btn{appearance:none;border:1px solid var(--line);background:var(--panel);color:var(--text);border-radius:6px;padding:6px 12px;font-size:12px;font-family:inherit;cursor:pointer;transition:color .15s,border-color .15s,background .15s}.btn:hover:not(:disabled){border-color:var(--muted)}.btn:disabled{opacity:.45;cursor:not-allowed}.btn.approve{color:var(--good);background:color-mix(in srgb,var(--good) 10%,var(--panel));border-color:color-mix(in srgb,var(--good) 50%,var(--line))}.btn.reject{color:var(--bad);background:color-mix(in srgb,var(--bad) 10%,var(--panel));border-color:color-mix(in srgb,var(--bad) 50%,var(--line))}.rowbtns{display:inline-flex;gap:6px;justify-content:flex-end}.table tr.clickable{cursor:pointer}.table tr.clickable:hover td{background:var(--panel-2)}.th-sort{appearance:none;background:none;border:none;padding:0;margin:0;font:inherit;color:inherit;text-transform:inherit;letter-spacing:inherit;cursor:pointer}.th-sort:hover{color:var(--text)}.warnnum{color:var(--warn)}.msg{border:1px solid var(--line);border-radius:10px;padding:10px 12px;background:var(--panel-2)}.msg-head{display:flex;align-items:center;justify-content:space-between;gap:8px;margin-bottom:6px}.msg-body{font-size:13px;white-space:pre-wrap;word-break:break-word}.empty{color:var(--muted);font-size:13px;text-align:center;padding:26px 10px}.err{color:var(--bad);font-size:13px;padding:20px 10px;text-align:center}.skeleton{border-radius:8px;background:linear-gradient(90deg,var(--line-soft),var(--line),var(--line-soft));background-size:200% 100%;animation:shimmer 1.3s ease-in-out infinite;height:14px}@keyframes shimmer{0%{background-position:200% 0}to{background-position:-200% 0}}.stack{display:flex;flex-direction:column;gap:16px}.muted{color:var(--muted)}.right{text-align:right}.chart-svg{width:100%;height:auto;display:block}.foot{margin-top:26px;font-size:11px;color:var(--muted);text-align:center}