@aid-framework/runtime 0.0.0 → 0.1.39

package/dist/agents/guardrails.js

@@ -0,0 +1,336 @@
+/**
+ * The guardrails engine: the IR's `guardrails` collection, actually evaluated.
+ *
+ * The IR already carries the *declaration* -- stages, policy kinds, an action, the fields
+ * a redaction may touch. This module is the missing other half: something that looks at
+ * text and decides. It is deliberately small and offline. Every detector is a regular
+ * expression, so the answer for a given input does not depend on a model, a network call,
+ * or a random seed, and a spec that passes here will pass here again tomorrow.
+ *
+ * Four stages, in the order a run meets them:
+ *
+ * - `input` -- before the model sees the user's turn.
+ * - `retrieval` -- around the chunks a retriever would splice into the prompt.
+ * - `tool-call` -- before a tool's handler body runs, over the call's arguments.
+ * - `output` -- after the model answers.
+ *
+ * Three decisions this module owns:
+ *
+ * **Undecidable is a block.** A guardrail naming a policy with no evaluator, or whose
+ * `redact` fields do not cover the text it matched, raises {@link GuardrailBlockedError}.
+ * There is no path from "the check could not run" to "no violation found".
+ *
+ * **Evaluation order is declaration order, except that `block` outranks it.** At one stage
+ * the engine walks the agent's guardrails in the order the IR declared them and collects
+ * every guardrail that fired. If *any* of them is a `block`, the first such guardrail
+ * decides -- a later `flag` cannot talk an earlier `block` down. Otherwise the first
+ * guardrail that fired decides.
+ *
+ * **`flag` cannot be ignored, but it does not stop anything.** A flag is recorded on the
+ * run (`RunResult.guardrails`) and the guarded text passes through unchanged. The consumer
+ * is whoever reads the run result -- an eval, a log shipper, a reviewer. It is *not* an
+ * allow: a flag means a detector matched, and the run carried on because the spec said the
+ * run may.
+ */
+import { ConfigurationError, GuardrailBlockedError } from '../errors.js';
+import { repr } from '../internal/json.js';
+export const ACTION_BLOCK = 'block';
+export const ACTION_REDACT = 'redact';
+export const ACTION_FLAG = 'flag';
+export const ACTION_ESCALATE = 'escalate';
+export const GUARDRAIL_STAGES = [
+    'input',
+    'retrieval',
+    'tool-call',
+    'output',
+];
+export const GUARDRAIL_ACTIONS = [
+    ACTION_BLOCK,
+    ACTION_REDACT,
+    ACTION_FLAG,
+    ACTION_ESCALATE,
+];
+/** What a redacted span is replaced with. Carrying the policy name says *why* it vanished. */
+const REDACTION = '[REDACTED:{policy}]';
+/** Whether any guardrail matched, whatever it decided to do about it. */
+export function fired(verdict) {
+    return verdict.records.length > 0;
+}
+function escapeRegExp(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function phrase(...phrases) {
+    const joined = phrases.map((item) => escapeRegExp(item)).join('|');
+    return new RegExp(`\\b(?:${joined})\\b`, 'i');
+}
+/**
+ * One entry per `GuardrailPolicyKind` in `packages/ir/src/shapes.ts`.
+ *
+ * These are *heuristics*, and saying so is the honest description. They catch the shapes a
+ * red-team corpus is built from -- an instruction-override phrase, a well-formed email or
+ * card-like digit run, a jailbreak persona -- and they will not catch a paraphrase.
+ */
+export const DETECTORS = {
+    'prompt-injection': [
+        phrase('ignore previous instructions', 'ignore all previous instructions', 'ignore the previous instructions', 'ignore your instructions', 'disregard previous instructions', 'disregard your instructions', 'forget your instructions', 'override your instructions', 'ignore the system prompt', 'reveal the system prompt', 'reveal your system prompt', 'print the system prompt', 'show me your system prompt'),
+        /\byou are now (?:a|an|the|in|no longer)\b/i,
+        /<\|\s*im_start\s*\|>/i,
+    ],
+    jailbreak: [
+        phrase('do anything now', 'developer mode', 'jailbreak mode', 'dan mode', 'without any restrictions', 'no ethical guidelines', 'no restrictions apply'),
+        /\bpretend (?:that )?you (?:have no|are not bound)/i,
+        /\bact as (?:an? )?(?:unrestricted|uncensored)\b/i,
+    ],
+    'pii-detect': [
+        /[\w.+-]+@[\w-]+\.[\w.-]+/,
+        /(?<!\d)(?:\+?\d{1,3}[ -]?)?(?:\(\d{3}\)[ -]?|\d{3}[ -])\d{3}[ -]\d{4}(?!\d)/,
+        /(?<!\d)\d{3}-\d{2}-\d{4}(?!\d)/,
+        /(?<!\d)(?:\d[ -]?){13,19}(?!\d)/,
+    ],
+    'pii-redact': [
+        /[\w.+-]+@[\w-]+\.[\w.-]+/,
+        /(?<!\d)(?:\+?\d{1,3}[ -]?)?(?:\(\d{3}\)[ -]?|\d{3}[ -])\d{3}[ -]\d{4}(?!\d)/,
+        /(?<!\d)\d{3}-\d{2}-\d{4}(?!\d)/,
+        /(?<!\d)(?:\d[ -]?){13,19}(?!\d)/,
+    ],
+    'secret-scan': [
+        /\bAKIA[0-9A-Z]{16}\b/,
+        /\bgh[pousr]_[A-Za-z0-9]{16,}\b/,
+        /\bsk-[A-Za-z0-9]{16,}\b/,
+        /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/,
+        /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/,
+    ],
+    moderation: [
+        phrase('how to build a bomb', 'how to make a bomb', 'build an explosive device', 'synthesize sarin', 'make nerve agent'),
+    ],
+    toxicity: [phrase('kill yourself', 'go die', 'you should die', 'subhuman')],
+};
+/**
+ * Policy kinds whose detection is about a *value* that a redaction can erase. The others
+ * match intent, and masking an intent phrase would not make the request safe -- which is
+ * why a `redact` guardrail over them fails closed below.
+ */
+const REDACTABLE = new Set(['pii-detect', 'pii-redact', 'secret-scan']);
+/**
+ * Every match of `policy` in `text`, in document order.
+ *
+ * Raises {@link ConfigurationError} for an unknown policy: that is a caller bug, not
+ * untrusted input, and the engine reports it as a block before it ever gets here.
+ */
+export function detect(policy, text) {
+    const patterns = DETECTORS[policy];
+    if (patterns === undefined) {
+        throw new ConfigurationError(`no detector for guardrail policy ${repr(policy)}; known policies: ` +
+            `[${Object.keys(DETECTORS)
+                .sort()
+                .map((name) => repr(name))
+                .join(', ')}]`);
+    }
+    const hits = [];
+    for (const pattern of patterns) {
+        // A fresh global copy per call: a shared RegExp carries `lastIndex` between calls,
+        // which would make the second evaluation of the same text miss a match.
+        const flags = pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`;
+        for (const match of text.matchAll(new RegExp(pattern.source, flags))) {
+            const start = match.index ?? 0;
+            hits.push({ policy, start, end: start + match[0].length });
+        }
+    }
+    hits.sort((left, right) => left.start - right.start || left.end - right.end);
+    return hits;
+}
+function mask(policy, text) {
+    const hits = detect(policy, text);
+    const replacement = REDACTION.replace('{policy}', policy);
+    let masked = text;
+    // Right to left, so an earlier replacement cannot move a later span's offsets.
+    for (const hit of [...hits].reverse()) {
+        masked = `${masked.slice(0, hit.start)}${replacement}${masked.slice(hit.end)}`;
+    }
+    return masked;
+}
+/**
+ * The `(field, value)` pairs a detector may look at.
+ *
+ * Only strings: a detector that coerced a number or a nested object to text would fire on
+ * payloads a redaction cannot edit, and the redaction's fail-closed re-check below would
+ * then block a run it could have repaired.
+ */
+function texts(payload) {
+    const pairs = [];
+    for (const [name, value] of Object.entries(payload)) {
+        if (typeof value === 'string' && value !== '')
+            pairs.push([name, value]);
+    }
+    return pairs;
+}
+/** Evaluates an agent's guardrails at one stage. */
+export class GuardrailEngine {
+    #declared;
+    constructor(guardrails) {
+        this.#declared = new Map(guardrails ?? []);
+    }
+    declared(guardrailId) {
+        return this.#declared.get(guardrailId);
+    }
+    checkInput(guardrails, text) {
+        return this.check('input', guardrails, { text }, undefined);
+    }
+    checkOutput(guardrails, text) {
+        return this.check('output', guardrails, { text }, undefined);
+    }
+    /**
+     * Guard what a retriever would splice into the prompt.
+     *
+     * Only the *results* are in the payload, not the query. The stage is about the text a
+     * model is handed, and putting the user's question in the same payload would let a
+     * `redact` guardrail over the `text` field fire on a violation it cannot remove -- which
+     * fails closed as a block and hides the real cause. The query's own checks belong to the
+     * `input` stage.
+     */
+    checkRetrieval(guardrails, results) {
+        return this.check('retrieval', guardrails, { text: results.join('\n') }, undefined);
+    }
+    checkToolCall(guardrails, toolId, arguments_) {
+        return this.check('tool-call', guardrails, { ...arguments_ }, toolId);
+    }
+    check(stage, guardrails, payload, toolId) {
+        const applicable = guardrails.filter((guardrail) => guardrail.stages.includes(stage) && covers(guardrail, stage, toolId));
+        const records = [];
+        const firedGuardrails = [];
+        for (const guardrail of applicable) {
+            const policies = firingPolicies(guardrail, stage, payload);
+            if (policies.length === 0)
+                continue;
+            firedGuardrails.push(guardrail);
+            records.push({
+                guardrail: guardrail.id,
+                stage,
+                action: actionOf(guardrail),
+                policies,
+                message: guardrail.message,
+            });
+        }
+        const deciding = decide(records);
+        if (deciding === undefined) {
+            return {
+                stage,
+                records: [],
+                action: undefined,
+                deciding: undefined,
+                text: textOf(payload),
+                arguments: { ...payload },
+            };
+        }
+        let redacted = payload;
+        if (deciding.action === ACTION_REDACT) {
+            redacted = redact(stage, firedGuardrails.filter((guardrail) => guardrail.action === ACTION_REDACT), payload);
+        }
+        return {
+            stage,
+            records,
+            action: deciding.action,
+            deciding,
+            text: textOf(redacted),
+            arguments: { ...redacted },
+        };
+    }
+}
+/**
+ * Whether `guardrail` applies to this particular call.
+ *
+ * `tools` is only meaningful on a `tool-call` guardrail, and an empty list means "every
+ * tool that reaches the stage" -- absent and empty are the same thing in the IR, and
+ * reading them differently here would be a second, undocumented meaning for an empty array.
+ */
+function covers(guardrail, stage, toolId) {
+    if (stage !== 'tool-call' || guardrail.tools.length === 0)
+        return true;
+    return toolId !== undefined && guardrail.tools.includes(toolId);
+}
+function textOf(payload) {
+    const value = payload.text;
+    return typeof value === 'string' ? value : '';
+}
+function firingPolicies(guardrail, stage, payload) {
+    const fields = texts(payload);
+    const hits = [];
+    for (const policy of guardrail.policies) {
+        if (DETECTORS[policy] === undefined) {
+            // Fail closed: a policy the engine cannot evaluate is a block, and it is reported
+            // with the guardrail that named it so an operator knows which declaration to fix.
+            throw new GuardrailBlockedError(guardrail.id, stage, `policy ${repr(policy)} has no evaluator in this runtime`);
+        }
+        if (fields.some(([, text]) => detect(policy, text).length > 0))
+            hits.push(policy);
+    }
+    return hits;
+}
+/**
+ * The guardrail's action, refused if it is outside the closed vocabulary.
+ *
+ * `GuardrailDefinition.action` is a `string` because the IR layer reads it out of JSON, so
+ * this is where the closed set is enforced. It has to be enforced rather than assumed:
+ * `decide` looks for `block` by equality, so an unrecognised action could not decide a
+ * block and would otherwise fall through to whatever the caller does with "not block" -- an
+ * allow nobody declared.
+ */
+function actionOf(guardrail) {
+    const action = guardrail.action;
+    if (!GUARDRAIL_ACTIONS.includes(action)) {
+        throw new ConfigurationError(`guardrail ${repr(guardrail.id)} declares unknown action ${repr(action)}; ` +
+            `expected one of ${GUARDRAIL_ACTIONS.join(', ')}`);
+    }
+    return action;
+}
+/**
+ * The deciding record: the first `block`, else the first record.
+ *
+ * `block` outranks declaration order deliberately. Ordering is about which of two
+ * *comparable* actions wins, and "stop the run" is not comparable to "let it continue with
+ * a note"; if declaration order could overrule a block, an author could neuter a strict
+ * guardrail by declaring a permissive one first.
+ */
+function decide(records) {
+    for (const record of records) {
+        if (record.action === ACTION_BLOCK)
+            return record;
+    }
+    return records.length > 0 ? records[0] : undefined;
+}
+/**
+ * Mask the declared fields, then prove nothing the detectors saw survived.
+ *
+ * The re-check is the part that matters. A spec that declares `redact: [answer]` for a
+ * payload whose violation is in some other field would otherwise "redact" successfully
+ * while shipping the violation, so this raises instead of returning a payload it could not
+ * clean.
+ */
+function redact(stage, guardrails, payload) {
+    const redacted = { ...payload };
+    for (const guardrail of guardrails) {
+        for (const name of guardrail.redact) {
+            const current = redacted[name];
+            if (typeof current !== 'string')
+                continue;
+            let value = current;
+            for (const policy of guardrail.policies) {
+                if (!REDACTABLE.has(policy)) {
+                    throw new GuardrailBlockedError(guardrail.id, stage, `policy ${repr(policy)} detects intent, which masking field ${repr(name)} ` +
+                        "cannot remove; use 'block', 'flag' or 'escalate'");
+                }
+                value = mask(policy, value);
+            }
+            redacted[name] = value;
+        }
+    }
+    for (const guardrail of guardrails) {
+        const remaining = firingPolicies(guardrail, stage, redacted);
+        if (remaining.length > 0) {
+            throw new GuardrailBlockedError(guardrail.id, stage, `redacting [${guardrail.redact.map((field) => repr(field)).join(', ')}] left a ` +
+                `${repr(remaining[0] ?? '')} match; the declared fields do not cover the payload`);
+        }
+    }
+    return redacted;
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/agents/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/agents/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAM3C,MAAM,CAAC,MAAM,YAAY,GAAoB,OAAO,CAAC;AACrD,MAAM,CAAC,MAAM,aAAa,GAAoB,QAAQ,CAAC;AACvD,MAAM,CAAC,MAAM,WAAW,GAAoB,MAAM,CAAC;AACnD,MAAM,CAAC,MAAM,eAAe,GAAoB,UAAU,CAAC;AAE3D,MAAM,CAAC,MAAM,gBAAgB,GAA8B;IACzD,OAAO;IACP,WAAW;IACX,WAAW;IACX,QAAQ;CACT,CAAC;AACF,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D,YAAY;IACZ,aAAa;IACb,WAAW;IACX,eAAe;CAChB,CAAC;AAEF,8FAA8F;AAC9F,MAAM,SAAS,GAAG,qBAAqB,CAAC;AAiDxC,yEAAyE;AACzE,MAAM,UAAU,KAAK,CAAC,OAAyB;IAC7C,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,MAAM,CAAC,GAAG,OAA0B;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,OAAO,IAAI,MAAM,CAAC,SAAS,MAAM,MAAM,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAgD;IACpE,kBAAkB,EAAE;QAClB,MAAM,CACJ,8BAA8B,EAC9B,kCAAkC,EAClC,kCAAkC,EAClC,0BAA0B,EAC1B,iCAAiC,EACjC,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,yBAAyB,EACzB,4BAA4B,CAC7B;QACD,4CAA4C;QAC5C,uBAAuB;KACxB;IACD,SAAS,EAAE;QACT,MAAM,CACJ,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,CACxB;QACD,oDAAoD;QACpD,kDAAkD;KACnD;IACD,YAAY,EAAE;QACZ,0BAA0B;QAC1B,6EAA6E;QAC7E,gCAAgC;QAChC,iCAAiC;KAClC;IACD,YAAY,EAAE;QACZ,0BAA0B;QAC1B,6EAA6E;QAC7E,gCAAgC;QAChC,iCAAiC;KAClC;IACD,aAAa,EAAE;QACb,sBAAsB;QACtB,gCAAgC;QAChC,yBAAyB;QACzB,kCAAkC;QAClC,mDAAmD;KACpD;IACD,UAAU,EAAE;QACV,MAAM,CACJ,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,kBAAkB,CACnB;KACF;IACD,QAAQ,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;CAC5E,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AAE7F;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,IAAY;IACjD,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,kBAAkB,CAC1B,oCAAoC,IAAI,CAAC,MAAM,CAAC,oBAAoB;YAClE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;iBACvB,IAAI,EAAE;iBACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;iBACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,mFAAmF;QACnF,wEAAwE;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QAChF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,+EAA+E;IAC/E,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,KAAK,CAAC,OAA0C;IACvD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oDAAoD;AACpD,MAAM,OAAO,eAAe;IACjB,SAAS,CAA2C;IAE7D,YAAY,UAAqD;QAC/D,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,QAAQ,CAAC,WAAmB;QAC1B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,UAAU,CAAC,UAA0C,EAAE,IAAY;QACjE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,WAAW,CAAC,UAA0C,EAAE,IAAY;QAClE,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CACZ,UAA0C,EAC1C,OAA0B;QAE1B,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACtF,CAAC;IAED,aAAa,CACX,UAA0C,EAC1C,MAAc,EACd,UAA6C;QAE7C,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CACH,KAAqB,EACrB,UAA0C,EAC1C,OAA0C,EAC1C,MAA0B;QAE1B,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAClC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CACpF,CAAC;QACF,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,MAAM,eAAe,GAA0B,EAAE,CAAC;QAClD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAC3D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACpC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,SAAS,CAAC,EAAE;gBACvB,KAAK;gBACL,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC;gBAC3B,QAAQ;gBACR,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK;gBACL,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,SAAS;gBACnB,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;gBACrB,SAAS,EAAE,EAAE,GAAG,OAAO,EAAE;aAC1B,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,GAAG,OAAO,CAAC;QACvB,IAAI,QAAQ,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACtC,QAAQ,GAAG,MAAM,CACf,KAAK,EACL,eAAe,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,EACzE,OAAO,CACR,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK;YACL,OAAO;YACP,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ;YACR,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;YACtB,SAAS,EAAE,EAAE,GAAG,QAAQ,EAAE;SAC3B,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CACb,SAA8B,EAC9B,KAAa,EACb,MAA0B;IAE1B,IAAI,KAAK,KAAK,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,MAAM,CAAC,OAA0C;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,cAAc,CACrB,SAA8B,EAC9B,KAAqB,EACrB,OAA0C;IAE1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACxC,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YACpC,kFAAkF;YAClF,kFAAkF;YAClF,MAAM,IAAI,qBAAqB,CAC7B,SAAS,CAAC,EAAE,EACZ,KAAK,EACL,UAAU,IAAI,CAAC,MAAM,CAAC,mCAAmC,CAC1D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,SAA8B;IAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAyB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,kBAAkB,CAC1B,aAAa,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,4BAA4B,IAAI,CAAC,MAAM,CAAC,IAAI;YACzE,mBAAmB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpD,CAAC;IACJ,CAAC;IACD,OAAO,MAAyB,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,OAAmC;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,YAAY;YAAE,OAAO,MAAM,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,MAAM,CACb,KAAqB,EACrB,UAA0C,EAC1C,OAA0C;IAE1C,MAAM,QAAQ,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAC;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ;gBAAE,SAAS;YAC1C,IAAI,KAAK,GAAW,OAAO,CAAC;YAC5B,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;gBACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,qBAAqB,CAC7B,SAAS,CAAC,EAAE,EACZ,KAAK,EACL,UAAU,IAAI,CAAC,MAAM,CAAC,wCAAwC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACzE,kDAAkD,CACrD,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,qBAAqB,CAC7B,SAAS,CAAC,EAAE,EACZ,KAAK,EACL,cAAc,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW;gBAC9E,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,sDAAsD,CACpF,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/agents/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The agent engine: IR, guardrails, memory, and the loop.
+ *
+ * Mirrors the Python package's `aid_runtime.agents`. Both engines are here: the native
+ * loop, and the opt-in `deepagents` backend that runs the harness at the pinned release
+ * behind our gateway, guardrails and tool executor. Agent-span tracing is still decision
+ * D-7.
+ */
+export { checkEngine, DEEPAGENTS, DEEPAGENTS_DISTRIBUTION, DEEPAGENTS_EXTRA, DEEPAGENTS_PIN, ENGINES, installedDeepagentsVersion, NATIVE, } from './engine.js';
+export { ACTION_BLOCK, ACTION_ESCALATE, ACTION_FLAG, ACTION_REDACT, DETECTORS, type Detection, detect, fired, type GuardrailAction, GuardrailEngine, type GuardrailEscalation, type GuardrailRecord, type GuardrailStage, type GuardrailVerdict, } from './guardrails.js';
+export { type AgentDefinition, fromIr, GUARDRAIL_ACTIONS, GUARDRAIL_POLICIES, GUARDRAIL_STAGES, type GuardrailDefinition, type HumanApproval, hasControlTools, type MemoryDefinition, RuntimeSpec, stageGuardrails, type ToolSpec, } from './ir.js';
+export { AgentRuntime, CONTROL_ARGUMENT, DELEGATE_PREFIX, TRANSFER_PREFIX } from './loop.js';
+export { checkMemorySupported, FileMemoryStore, IMPLEMENTED_MEMORY_KINDS, InProcessMemoryStore, MEMORY_SCOPES, type MemoryStore, renderContext, ThreadMemory, } from './memory.js';
+export { type AgentCheckpoint, checkpointFromJson, checkpointsEqual, checkpointToJson, type HumanDecision, type PendingApproval, pendingApprovalFrom, RUN_STATUSES, RunResult, type RunStatus, STEP_KINDS, type StepKind, type StepRecord, } from './state.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/agents/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/agents/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,0BAA0B,EAC1B,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,SAAS,EACT,KAAK,SAAS,EACd,MAAM,EACN,KAAK,EACL,KAAK,eAAe,EACpB,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,eAAe,EACpB,MAAM,EACN,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,eAAe,EACf,KAAK,gBAAgB,EACrB,WAAW,EACX,eAAe,EACf,KAAK,QAAQ,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EACb,KAAK,WAAW,EAChB,aAAa,EACb,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,KAAK,eAAe,EACpB,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,mBAAmB,EACnB,YAAY,EACZ,SAAS,EACT,KAAK,SAAS,EACd,UAAU,EACV,KAAK,QAAQ,EACb,KAAK,UAAU,GAChB,MAAM,YAAY,CAAC"}

package/dist/agents/index.js

@@ -0,0 +1,15 @@
+/**
+ * The agent engine: IR, guardrails, memory, and the loop.
+ *
+ * Mirrors the Python package's `aid_runtime.agents`. Both engines are here: the native
+ * loop, and the opt-in `deepagents` backend that runs the harness at the pinned release
+ * behind our gateway, guardrails and tool executor. Agent-span tracing is still decision
+ * D-7.
+ */
+export { checkEngine, DEEPAGENTS, DEEPAGENTS_DISTRIBUTION, DEEPAGENTS_EXTRA, DEEPAGENTS_PIN, ENGINES, installedDeepagentsVersion, NATIVE, } from './engine.js';
+export { ACTION_BLOCK, ACTION_ESCALATE, ACTION_FLAG, ACTION_REDACT, DETECTORS, detect, fired, GuardrailEngine, } from './guardrails.js';
+export { fromIr, GUARDRAIL_ACTIONS, GUARDRAIL_POLICIES, GUARDRAIL_STAGES, hasControlTools, RuntimeSpec, stageGuardrails, } from './ir.js';
+export { AgentRuntime, CONTROL_ARGUMENT, DELEGATE_PREFIX, TRANSFER_PREFIX } from './loop.js';
+export { checkMemorySupported, FileMemoryStore, IMPLEMENTED_MEMORY_KINDS, InProcessMemoryStore, MEMORY_SCOPES, renderContext, ThreadMemory, } from './memory.js';
+export { checkpointFromJson, checkpointsEqual, checkpointToJson, pendingApprovalFrom, RUN_STATUSES, RunResult, STEP_KINDS, } from './state.js';
+//# sourceMappingURL=index.js.map

package/dist/agents/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/agents/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,WAAW,EACX,UAAU,EACV,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,0BAA0B,EAC1B,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,eAAe,EACf,WAAW,EACX,aAAa,EACb,SAAS,EAET,MAAM,EACN,KAAK,EAEL,eAAe,GAKhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAEL,MAAM,EACN,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAGhB,eAAe,EAEf,WAAW,EACX,eAAe,GAEhB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC7F,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,oBAAoB,EACpB,aAAa,EAEb,aAAa,EACb,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,OAAO,EAEL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAGhB,mBAAmB,EACnB,YAAY,EACZ,SAAS,EAET,UAAU,GAGX,MAAM,YAAY,CAAC"}

package/dist/agents/ir.d.ts

@@ -0,0 +1,144 @@
+/**
+ * The IR seam: an emitted document in, resolved agent definitions out.
+ *
+ * The pipeline runtime consumes the IR's *pipeline* shapes and is deliberately unaware of
+ * agents; this module is the equivalent seam for them. It reads only the collections an
+ * agent can reach -- `agents`, `models`, `prompts`, `tools`, `memory`, `guardrails` -- and
+ * resolves every reference at load time, so a loop never runs against a dangling prompt id
+ * or an unpriced model.
+ *
+ * Nothing here invents vocabulary. Field names are the IR's, `instructions` stays the
+ * prompt *reference* the IR carries and is resolved to `prompt.template` here, and the
+ * scopes are `thread`/`user`/`global`.
+ */
+import { ModelSpec } from '../types.js';
+/** The closed vocabularies from `packages/ir/src/shapes.ts`, repeated on purpose. */
+export declare const GUARDRAIL_STAGES: ReadonlySet<string>;
+export declare const GUARDRAIL_ACTIONS: ReadonlySet<string>;
+export declare const GUARDRAIL_POLICIES: ReadonlySet<string>;
+/** An IR tool, as the loop needs it: name, side effects, and its auth policy. */
+export interface ToolSpec {
+    readonly id: string;
+    readonly name: string;
+    readonly description: string;
+    readonly requiresConfirmation: boolean;
+    readonly sideEffects: string;
+    readonly auth: Readonly<Record<string, unknown>> | undefined;
+}
+/**
+ * One resolved guardrail: where it runs, what it detects, and what it does.
+ *
+ * `tools` holds tool *ids*, because that is how the IR scopes a tool-call guardrail; the
+ * loop translates a model's tool *name* to the id before asking.
+ */
+export interface GuardrailDefinition {
+    readonly id: string;
+    readonly stages: readonly string[];
+    readonly policies: readonly string[];
+    readonly action: string;
+    readonly redact: readonly string[];
+    readonly tools: readonly string[];
+    readonly message: string;
+    readonly fallbackPrompt: string | undefined;
+    readonly log: boolean;
+}
+/** One IR `memory` entry, resolved for the scope rules in `agents/memory`. */
+export interface MemoryDefinition {
+    readonly id: string;
+    readonly kind: string;
+    readonly scope: string;
+    readonly tokenBudget: number;
+    readonly backend: string | undefined;
+    readonly store: string | undefined;
+    readonly summarizeModel: string | undefined;
+    readonly ttl: string | undefined;
+    readonly redact: readonly string[];
+}
+/** The parsed `humanInTheLoop` block: a policy, and a channel to ask on. */
+export interface HumanApproval {
+    readonly when: Readonly<Record<string, unknown>>;
+    readonly channel: string;
+}
+/** One agent, with every reference resolved. */
+export interface AgentDefinition {
+    readonly id: string;
+    readonly name: string;
+    readonly instructions: string;
+    readonly model: string;
+    readonly tools: readonly string[];
+    readonly memory: readonly MemoryDefinition[];
+    readonly maxSteps: number;
+    readonly maxTokensBudget: number | undefined;
+    readonly maxCostBudget: number | undefined;
+    readonly onBudgetExhausted: string;
+    readonly handoffs: readonly string[];
+    readonly delegates: readonly string[];
+    readonly engine: string;
+    /**
+     * The pinned Deep Agents release, when the engine is `deepagents`. Empty for `native`;
+     * the IR gate refuses `deepagents` without a pin, so an empty value here means the
+     * document skipped the gate.
+     */
+    readonly engineVersion: string;
+    readonly approval: HumanApproval | undefined;
+    readonly guardrails: readonly GuardrailDefinition[];
+}
+/** Whether this agent may move control at all (transfer *or* delegate). */
+export declare function hasControlTools(agent: AgentDefinition): boolean;
+/**
+ * Every guardrail declared on this agent that runs at `stage`.
+ *
+ * Declaration order is the order of `guardrails` in the IR, and that is the order the
+ * engine evaluates in. It has to come from the document: an order the runtime invented
+ * would make the outcome of two conflicting guardrails depend on which version of the
+ * runtime ran the spec.
+ */
+export declare function stageGuardrails(agent: AgentDefinition, stage: string): readonly GuardrailDefinition[];
+/** Everything the loop needs, resolved from one IR document. */
+export declare class RuntimeSpec {
+    readonly models: ReadonlyMap<string, ModelSpec>;
+    readonly fallbacks: ReadonlyMap<string, readonly string[]>;
+    readonly prompts: ReadonlyMap<string, string>;
+    readonly tools: ReadonlyMap<string, ToolSpec>;
+    readonly agents: ReadonlyMap<string, AgentDefinition>;
+    readonly guardrails: ReadonlyMap<string, GuardrailDefinition>;
+    /**
+     * The single concurrency cap, read from the IR's `deployments[].concurrency`. `undefined`
+     * means unbounded: the runtime only shares a limiter when a deployment declares one,
+     * which keeps plain request/response usage free of surprises.
+     */
+    readonly concurrency: number | undefined;
+    constructor(init: {
+        readonly models: ReadonlyMap<string, ModelSpec>;
+        readonly fallbacks: ReadonlyMap<string, readonly string[]>;
+        readonly prompts: ReadonlyMap<string, string>;
+        readonly tools: ReadonlyMap<string, ToolSpec>;
+        readonly agents: ReadonlyMap<string, AgentDefinition>;
+        readonly guardrails?: ReadonlyMap<string, GuardrailDefinition>;
+        readonly concurrency?: number;
+    });
+    agent(agentId: string): AgentDefinition;
+    systemPrompt(agent: AgentDefinition): string;
+    fallbacksFor(alias: string): readonly string[];
+    toolSpecs(agent: AgentDefinition): readonly ToolSpec[];
+    /**
+     * Combined price, the same number `agents/budget-degrade` compares.
+     *
+     * The gate compares `inputPerMTok + outputPerMTok`; keeping the identical sum here means
+     * a spec the gate accepted cannot have the runtime pick a "cheaper" alias that the gate
+     * would have called more expensive.
+     */
+    price(alias: string): number;
+    /**
+     * The first declared fallback that is strictly cheaper than `alias`.
+     *
+     * One step, in the order the spec declared: this is the alias ladder's next rung, not a
+     * search for the cheapest reachable model. `undefined` means there is nowhere to step,
+     * which is what makes a `degrade` declaration fail closed instead of pretending to
+     * degrade.
+     */
+    cheaperFallback(alias: string): string | undefined;
+}
+/** Resolve an emitted IR document into a {@link RuntimeSpec}. */
+export declare function fromIr(document: Record<string, unknown>): RuntimeSpec;
+//# sourceMappingURL=ir.d.ts.map

package/dist/agents/ir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ir.d.ts","sourceRoot":"","sources":["../../src/agents/ir.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAgC,SAAS,EAAE,MAAM,aAAa,CAAC;AActE,qFAAqF;AACrF,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAK/C,CAAC;AACH,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAKhD,CAAC;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAQjD,CAAC;AAIH,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;CAC9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,4EAA4E;AAC5E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACrD;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAE/D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,eAAe,EACtB,KAAK,EAAE,MAAM,GACZ,SAAS,mBAAmB,EAAE,CAEhC;AAED,gEAAgE;AAChE,qBAAa,WAAW;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC3D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC9D;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAEzC,YAAY,IAAI,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;QAC3D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;QACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;QAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;KAC/B,EAQA;IAED,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,CAQtC;IAED,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAS3C;IAED,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAE7C;IAED,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,QAAQ,EAAE,CAMrD;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ3B;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMjD;CACF;AAED,iEAAiE;AACjE,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAkErE"}