@aigne/agent-runtime 1.12.0-beta.5

package/dist/program/agent-action.mjs

@@ -0,0 +1,497 @@
+import { withQueryPairing } from "../providers/basic/ash/dist/index.mjs";
+import { resolveDotPaths } from "./tool-discovery/dot-path-resolver.mjs";
+import { runGuideRails } from "../agent-runners/guide-rails.mjs";
+import { sanitizeSystemAppend } from "../agent-runners/system-prompt.mjs";
+import { withRetry } from "../agent-runners/retry.mjs";
+import { isJsonSafe, sanitizeMetaEnv, sanitizeScratchPath } from "./result-contract.mjs";
+import { normalizeRunnerError } from "./runner-error.mjs";
+import { getRunnerForType } from "./agent-runner-registry.mjs";
+import { joinURL } from "ufo";
+
+//#region src/program/agent-action.ts
+const MAX_PAYLOAD_BYTES = 1024 * 1024;
+const BLOCKED_FIELDS = new Set([
+	"_system_append",
+	"_budget_override",
+	"_model_override",
+	"_parent_session",
+	"_parent_budget_remaining",
+	"_chain"
+]);
+function buildInputSchema(inputKey, override) {
+	if (override && typeof override === "object") return override;
+	return {
+		type: "object",
+		properties: { [inputKey]: {
+			type: "string",
+			description: `Input for the agent (key: ${inputKey})`
+		} },
+		required: [inputKey]
+	};
+}
+function sanitizeArgs(args) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(args)) if (!BLOCKED_FIELDS.has(key)) sanitized[key] = value;
+	return sanitized;
+}
+const SAFE_META_KEYS = new Set([
+	"run_id",
+	"rounds",
+	"tokens_used",
+	"sub_runs",
+	"scratch_path",
+	"mode",
+	"pipeline_steps",
+	"members_run",
+	"max_iterations_hit",
+	"warnings",
+	"session",
+	"parent_session",
+	"depth",
+	"chain",
+	"hook_events",
+	"hook_events_path",
+	"max_concurrency",
+	"member_run_ids",
+	"completed_steps",
+	"iterations",
+	"items_count",
+	"render",
+	"context"
+]);
+/**
+* B9 — accept only the documented shape: { template_vars: string[] }.
+* Anything else (primitives, arrays, foreign keys) is rejected so the
+* envelope can't leak arbitrary runner internals through _meta.
+*/
+function sanitizeRenderMeta(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+	const vars = raw.template_vars;
+	if (!Array.isArray(vars)) return void 0;
+	return { template_vars: vars.filter((v) => typeof v === "string") };
+}
+/**
+* B9 — accept only the documented shape: { system: string }. Empty string is
+* allowed (ai-runner sets it to "" when no system prompt is configured).
+*/
+function sanitizeContextMeta(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+	const sys = raw.system;
+	if (typeof sys !== "string") return void 0;
+	return { system: sys };
+}
+/**
+* B24 — strip any leading path so a full session path like
+* `/instance/.sessions/agent/deep-42` is recorded as `deep-42` in _meta.
+* Callers (MCP, LLM tool results) receive only the opaque id.
+*/
+function sessionBasename(value) {
+	const trimmed = value.replace(/\/+$/, "");
+	const idx = trimmed.lastIndexOf("/");
+	return idx >= 0 ? trimmed.slice(idx + 1) : trimmed;
+}
+/**
+* B23 — coerce any runner-reported count into a non-negative finite integer.
+*
+* The result-contract promises `rounds`/`tokens_used`/`sub_runs` are always
+* numbers. Runners have historically leaked strings (`"5"`), NaN, Infinity,
+* and negative values. Silent passthrough breaks downstream consumers that
+* e.g. render `_meta.tokens_used.toLocaleString()`.
+*/
+function coerceCount(raw) {
+	const n = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw) : NaN;
+	if (!Number.isFinite(n)) return 0;
+	return Math.max(0, Math.floor(n));
+}
+function shapeOutput(runnerOutput, options) {
+	if (!runnerOutput || typeof runnerOutput !== "object") {
+		const baseMeta = {
+			run_id: crypto.randomUUID(),
+			rounds: 0,
+			tokens_used: 0,
+			sub_runs: 0
+		};
+		const ctx0 = options?.context;
+		if (ctx0) {
+			if (typeof ctx0.session === "string" && ctx0.session.length > 0) baseMeta.session = sessionBasename(ctx0.session);
+			if (Array.isArray(ctx0.chain)) {
+				const cleaned = ctx0.chain.filter((s) => typeof s === "string" && s.length > 0);
+				if (cleaned.length > 0) baseMeta.chain = cleaned;
+				baseMeta.depth = cleaned.length;
+			} else if (ctx0.session !== void 0) baseMeta.depth = 0;
+		}
+		return {
+			result: runnerOutput ?? null,
+			_meta: baseMeta
+		};
+	}
+	const out = runnerOutput;
+	const warnings = [];
+	const runnerMeta = out._meta && typeof out._meta === "object" ? out._meta : {};
+	const data = out.data && typeof out.data === "object" ? out.data : {};
+	const hasStructuredShape = "data" in out || "result" in out || "_meta" in out || "success" in out || "error" in out;
+	const isFailureEnvelope = out.success === false;
+	let resultValue;
+	if (isFailureEnvelope) resultValue = data.result !== void 0 ? data.result : null;
+	else if (!hasStructuredShape) resultValue = runnerOutput;
+	else if (out.result !== void 0) resultValue = out.result;
+	else if (data.result !== void 0) resultValue = data.result;
+	else if (out.data !== void 0 && out.data !== null && typeof out.data === "object") {
+		const { _meta: _dataMeta, ...rest } = data;
+		resultValue = Object.keys(rest).length > 0 ? rest : null;
+	} else if (out.data !== void 0) resultValue = out.data;
+	else resultValue = null;
+	const resultIsEmpty = resultValue === void 0 || resultValue === null || typeof resultValue === "object" && Object.keys(resultValue).length === 0;
+	if (options?.outputKey && resultIsEmpty) {
+		warnings.push({
+			code: "OUTPUT_KEY_MISSING",
+			message: `Expected output key "${options.outputKey}" but runner returned no result`
+		});
+		resultValue = null;
+	}
+	if (resultValue != null && !isJsonSafe(resultValue)) {
+		warnings.push({
+			code: "RESULT_NOT_JSON_SAFE",
+			message: "Result contains circular references or non-serializable values"
+		});
+		resultValue = null;
+	}
+	const runIdRaw = runnerMeta.run_id ?? data.run_id;
+	const meta = {
+		run_id: typeof runIdRaw === "string" && runIdRaw.length > 0 ? runIdRaw : crypto.randomUUID(),
+		rounds: coerceCount(runnerMeta.rounds ?? runnerMeta.iterations ?? data.rounds),
+		tokens_used: coerceCount(runnerMeta.tokens_used ?? data.total_tokens),
+		sub_runs: coerceCount(runnerMeta.sub_runs ?? data.sub_runs)
+	};
+	const rawScratch = runnerMeta.scratch_path ?? data.scratch_path;
+	if (typeof rawScratch === "string") meta.scratch_path = sanitizeScratchPath(rawScratch);
+	for (const key of Object.keys(runnerMeta)) if (SAFE_META_KEYS.has(key) && !(key in meta)) if (key === "render") {
+		const cleaned = sanitizeRenderMeta(runnerMeta[key]);
+		if (cleaned) meta[key] = cleaned;
+	} else if (key === "context") {
+		const cleaned = sanitizeContextMeta(runnerMeta[key]);
+		if (cleaned) meta[key] = cleaned;
+	} else meta[key] = runnerMeta[key];
+	const ctx = options?.context;
+	if (ctx) {
+		if (typeof ctx.session === "string" && ctx.session.length > 0) meta.session = sessionBasename(ctx.session);
+		if (Array.isArray(ctx.chain)) {
+			const cleaned = ctx.chain.filter((s) => typeof s === "string" && s.length > 0);
+			if (cleaned.length > 0) meta.chain = cleaned;
+			meta.depth = cleaned.length;
+		} else if (ctx.session !== void 0) meta.depth = 0;
+	}
+	if (runnerMeta.env && typeof runnerMeta.env === "object") meta.env = sanitizeMetaEnv(runnerMeta.env);
+	if (warnings.length > 0) meta.warnings = warnings;
+	return {
+		result: resultValue,
+		_meta: meta
+	};
+}
+function estimatePayloadSize(args) {
+	let size = 0;
+	for (const value of Object.values(args)) if (typeof value === "string") size += value.length;
+	else if (value instanceof Uint8Array) size += value.length;
+	else if (typeof value === "function" || typeof value === "symbol") {} else if (value !== null && value !== void 0) try {
+		const serialized = JSON.stringify(value);
+		if (typeof serialized === "string") size += serialized.length;
+	} catch {}
+	return size;
+}
+/**
+* B29 — Compile a statically-known tool catalog from `manifest.tools` so
+* `/.actions/run/.meta` can surface the LLM's tool surface without having to
+* invoke the agent.
+*
+* This is the dot-path resolver pass only — `.ash` frontmatter discovery and
+* skill-gated helpers require AFS I/O and happen later inside the runner. The
+* catalog returned here covers:
+*   - resolved bare-path declarations (`./knowledge/` → `<root>/knowledge/**`)
+*   - object-form declarations (passed through verbatim)
+*   - built-in `.actions/cancel` and `.actions/status` (auto-registered for
+*     every agent blocklet, so they must always appear)
+*
+* Invalid declarations (absolute paths, null bytes, …) surface as structured
+* warnings instead of silently dropping — one bad tool must not poison the
+* rest (mirrors the S13 "data loss prevention" contract).
+*/
+function compileStaticToolCatalog(manifest, mountPath, actionPrefix) {
+	const catalog = [];
+	const warnings = [];
+	const tools = manifest.tools ?? [];
+	for (const raw of tools) if (typeof raw === "string") try {
+		const [resolved] = resolveDotPaths([raw], mountPath);
+		if (resolved) catalog.push(resolved);
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		const code = msg.startsWith("TOOL_PATH_OUTSIDE_BLOCKLET") ? "TOOL_PATH_OUTSIDE_BLOCKLET" : "TOOL_PATH_INVALID";
+		warnings.push({
+			code,
+			path: raw,
+			message: msg
+		});
+	}
+	else if (raw && typeof raw === "object") {
+		const entry = raw;
+		if (typeof entry.path !== "string" || entry.path.length === 0) {
+			warnings.push({
+				code: "TOOL_PATH_INVALID",
+				message: "object tool entry missing 'path' field"
+			});
+			continue;
+		}
+		catalog.push({
+			path: entry.path,
+			ops: withQueryPairing(entry.ops ?? [
+				"read",
+				"list",
+				"search"
+			]),
+			...entry.maxDepth != null ? { maxDepth: entry.maxDepth } : {}
+		});
+	}
+	const cancelName = actionPrefix ? `${actionPrefix}-cancel` : "cancel";
+	const statusName = actionPrefix ? `${actionPrefix}-status` : "status";
+	catalog.push({
+		path: joinURL(mountPath, `.actions/${cancelName}`),
+		ops: ["exec"]
+	});
+	catalog.push({
+		path: joinURL(mountPath, `.actions/${statusName}`),
+		ops: ["exec"]
+	});
+	return {
+		catalog,
+		warnings
+	};
+}
+function createAgentActionHandlers(manifest, _mountPath, options) {
+	const inputKey = manifest.inputKey ?? "message";
+	const inputSchema = buildInputSchema(inputKey, manifest.inputSchema);
+	const actionPrefix = options?.actionPrefix;
+	const runName = actionPrefix ? `${actionPrefix}-run` : "run";
+	const cancelName = actionPrefix ? `${actionPrefix}-cancel` : "cancel";
+	const statusName = actionPrefix ? `${actionPrefix}-status` : "status";
+	const { catalog: toolCatalog, warnings: catalogWarnings } = compileStaticToolCatalog(manifest, _mountPath, actionPrefix);
+	const runEntry = {
+		id: runName,
+		path: `/.actions/${runName}`,
+		summary: `Run agent "${manifest.name}"`,
+		meta: {
+			kind: "afs:executable",
+			kinds: ["afs:executable", "afs:node"],
+			effect: "write",
+			tool_catalog: toolCatalog,
+			...catalogWarnings.length > 0 ? { warnings: catalogWarnings } : {}
+		},
+		actions: [{
+			name: runName,
+			description: `Execute the "${manifest.name}" agent with the given input`,
+			inputSchema,
+			effect: "write"
+		}]
+	};
+	const cancelEntry = {
+		id: cancelName,
+		path: `/.actions/${cancelName}`,
+		summary: `Cancel a running agent session for "${manifest.name}"`,
+		meta: {
+			kind: "afs:executable",
+			kinds: ["afs:executable", "afs:node"],
+			effect: "write"
+		},
+		actions: [{
+			name: cancelName,
+			effect: "write",
+			description: `Cancel the "${manifest.name}" agent run for a given session`,
+			inputSchema: {
+				type: "object",
+				properties: { session: {
+					type: "string",
+					description: "Session ID to cancel"
+				} },
+				required: ["session"]
+			}
+		}]
+	};
+	const statusEntry = {
+		id: statusName,
+		path: `/.actions/${statusName}`,
+		summary: `Get agent run status for "${manifest.name}"`,
+		meta: {
+			kind: "afs:executable",
+			kinds: ["afs:executable", "afs:node"],
+			effect: "read"
+		},
+		actions: [{
+			name: statusName,
+			effect: "read",
+			description: `Get the current status of a "${manifest.name}" agent run`,
+			inputSchema: {
+				type: "object",
+				properties: { session: {
+					type: "string",
+					description: "Session ID to check"
+				} }
+			}
+		}]
+	};
+	return {
+		run: {
+			entry: runEntry,
+			inputSchema,
+			handler: async (args, context) => {
+				const sanitized = sanitizeArgs(args);
+				if (estimatePayloadSize(sanitized) > MAX_PAYLOAD_BYTES) return {
+					success: false,
+					error: {
+						code: "PAYLOAD_TOO_LARGE",
+						message: "Input payload exceeds 1 MB limit"
+					}
+				};
+				const inputValue = sanitized[inputKey];
+				if (inputValue === void 0 || inputValue === null) return {
+					success: false,
+					error: {
+						code: "INPUT_SCHEMA_INVALID",
+						message: `Missing required field: ${inputKey}`,
+						details: { field: inputKey }
+					}
+				};
+				const expectedType = (inputSchema?.properties)?.[inputKey]?.type;
+				if ((expectedType === void 0 || expectedType === "string") && typeof inputValue !== "string") return {
+					success: false,
+					error: {
+						code: "INPUT_SCHEMA_INVALID",
+						message: `Field "${inputKey}" must be a string, got ${typeof inputValue}`,
+						details: { field: inputKey }
+					}
+				};
+				if (!context) return {
+					success: false,
+					error: {
+						code: "INTERNAL_ERROR",
+						message: "No runner context provided"
+					}
+				};
+				try {
+					const runner = getRunnerForType(manifest.type);
+					const systemAppend = sanitizeSystemAppend(args._system_append);
+					const enrichedContext = {
+						...context,
+						session: typeof args.session === "string" ? args.session : context.session,
+						parentSession: args._parent_session ?? void 0,
+						chain: Array.isArray(args._chain) ? args._chain : void 0,
+						systemAppend
+					};
+					const result = await withRetry(() => runner(sanitized, enrichedContext), manifest.retry, (r) => r?.success === false);
+					let effectiveResult = result;
+					if (result?.success !== false && manifest.guideRails && manifest.guideRails.length > 0) {
+						const decision = await runGuideRails(enrichedContext.afs, manifest.guideRails, sanitized, result?.data ?? result, { mountPath: enrichedContext.mountPath });
+						if (decision.abort) {
+							const shapedAbort = shapeOutput(null, {
+								outputKey: manifest.outputKey,
+								context: {
+									session: enrichedContext.session,
+									chain: enrichedContext.chain
+								}
+							});
+							return {
+								success: false,
+								error: {
+									code: "GUIDE_RAIL_ABORT",
+									message: decision.reason ?? "GuideRail aborted"
+								},
+								data: shapedAbort
+							};
+						}
+						if (decision.output !== void 0) effectiveResult = {
+							...result,
+							data: decision.output
+						};
+					}
+					const shaped = shapeOutput(effectiveResult, {
+						outputKey: manifest.outputKey,
+						context: {
+							session: enrichedContext.session,
+							chain: enrichedContext.chain
+						}
+					});
+					if (result?.success === false) return {
+						success: false,
+						error: normalizeRunnerError(result?.error ?? {
+							code: "RUNNER_FAILED",
+							message: "Runner reported failure"
+						}),
+						data: shaped
+					};
+					return {
+						success: true,
+						data: shaped
+					};
+				} catch (err) {
+					const sessionFromArgs = typeof args.session === "string" ? args.session : context.session;
+					const chainFromArgs = Array.isArray(args._chain) ? args._chain : void 0;
+					const shapedOnError = shapeOutput(null, {
+						outputKey: manifest.outputKey,
+						context: {
+							session: sessionFromArgs,
+							chain: chainFromArgs
+						}
+					});
+					return {
+						success: false,
+						error: normalizeRunnerError(err),
+						data: shapedOnError
+					};
+				}
+			},
+			sanitizeArgs,
+			shapeOutput
+		},
+		cancel: {
+			entry: cancelEntry,
+			inputSchema: cancelEntry.actions[0].inputSchema,
+			handler: async (args) => {
+				const session = args.session;
+				if (session) return {
+					success: false,
+					error: {
+						code: "SESSION_NOT_FOUND",
+						message: `Session "${session}" not found`
+					}
+				};
+				return {
+					success: true,
+					data: { cancelled: true }
+				};
+			},
+			sanitizeArgs,
+			shapeOutput
+		},
+		status: {
+			entry: statusEntry,
+			inputSchema: statusEntry.actions[0].inputSchema,
+			handler: async (args) => {
+				const session = args.session;
+				if (session) return {
+					success: false,
+					error: {
+						code: "SESSION_NOT_FOUND",
+						message: `Session "${session}" not found`
+					}
+				};
+				return {
+					success: true,
+					data: { state: "unknown" }
+				};
+			},
+			sanitizeArgs,
+			shapeOutput
+		}
+	};
+}
+
+//#endregion
+export { createAgentActionHandlers };
+//# sourceMappingURL=agent-action.mjs.map

package/dist/program/agent-action.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-action.mjs","names":[],"sources":["../../src/program/agent-action.ts"],"sourcesContent":["/**\n * Agent action handlers — .actions/run, .actions/cancel, .actions/status.\n *\n * Auto-generated from an AgentManifest and registered on the blocklet's\n * runtime AFS as custom root actions during activation.\n */\n\nimport type { AFSEntry, AFSExecResult, AgentManifest } from \"@aigne/afs\";\nimport { withQueryPairing } from \"@aigne/afs-ash\";\nimport { joinURL } from \"ufo\";\nimport { runGuideRails } from \"../agent-runners/guide-rails.js\";\nimport { withRetry } from \"../agent-runners/retry.js\";\nimport { sanitizeSystemAppend } from \"../agent-runners/system-prompt.js\";\nimport { getRunnerForType, type RunnerContext } from \"./agent-runner-registry.js\";\nimport { isJsonSafe, sanitizeMetaEnv, sanitizeScratchPath } from \"./result-contract.js\";\nimport { normalizeRunnerError } from \"./runner-error.js\";\nimport { resolveDotPaths } from \"./tool-discovery/dot-path-resolver.js\";\n\nconst MAX_PAYLOAD_BYTES = 1024 * 1024; // 1 MB\n\nconst BLOCKED_FIELDS = new Set([\n  \"_system_append\",\n  \"_budget_override\",\n  \"_model_override\",\n  \"_parent_session\",\n  \"_parent_budget_remaining\",\n  \"_chain\",\n]);\n\nexport interface AgentActionHandler {\n  entry: AFSEntry;\n  inputSchema: Record<string, unknown>;\n  handler: (args: Record<string, unknown>, context?: RunnerContext) => Promise<AFSExecResult>;\n  sanitizeArgs: (args: Record<string, unknown>) => Record<string, unknown>;\n  shapeOutput: (\n    runnerOutput: unknown,\n    options?: {\n      outputKey?: string;\n      context?: { session?: string; chain?: string[] };\n    },\n  ) => { result: any; _meta: Record<string, unknown> };\n}\n\nexport interface AgentActionHandlers {\n  run: AgentActionHandler;\n  cancel: AgentActionHandler;\n  status: AgentActionHandler;\n}\n\nfunction buildInputSchema(\n  inputKey: string,\n  override?: Record<string, unknown>,\n): Record<string, unknown> {\n  // B13: honor manifest-declared inputSchema when provided. This lets a\n  // fixture say \"feeds is an array\" or \"query is a nested object\" instead\n  // of the one-size-fits-all string default.\n  if (override && typeof override === \"object\") {\n    return override;\n  }\n  return {\n    type: \"object\",\n    properties: {\n      [inputKey]: { type: \"string\", description: `Input for the agent (key: ${inputKey})` },\n    },\n    required: [inputKey],\n  };\n}\n\nfunction sanitizeArgs(args: Record<string, unknown>): Record<string, unknown> {\n  const sanitized: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(args)) {\n    if (!BLOCKED_FIELDS.has(key)) {\n      sanitized[key] = value;\n    }\n  }\n  return sanitized;\n}\n\nconst SAFE_META_KEYS = new Set([\n  \"run_id\",\n  \"rounds\",\n  \"tokens_used\",\n  \"sub_runs\",\n  \"scratch_path\",\n  \"mode\",\n  \"pipeline_steps\",\n  \"members_run\",\n  \"max_iterations_hit\",\n  \"warnings\",\n  \"session\",\n  \"parent_session\",\n  \"depth\",\n  \"chain\",\n  \"hook_events\",\n  \"hook_events_path\",\n  // team/parallel/iterate observability — runners emit these but shapeOutput's\n  // allow-list would drop them without explicit listing.\n  \"max_concurrency\",\n  \"member_run_ids\",\n  \"completed_steps\",\n  \"iterations\",\n  \"items_count\",\n  // B9: template introspection for S4 ai runner. `render.template_vars` exposes\n  // which template variables were available; `context.system` exposes the fully\n  // rendered system prompt. Both are copied through only when the runner emits\n  // them as objects with the expected shape (see sanitizeRenderMeta /\n  // sanitizeContextMeta below).\n  \"render\",\n  \"context\",\n]);\n\n/**\n * B9 — accept only the documented shape: { template_vars: string[] }.\n * Anything else (primitives, arrays, foreign keys) is rejected so the\n * envelope can't leak arbitrary runner internals through _meta.\n */\nfunction sanitizeRenderMeta(raw: unknown): { template_vars: string[] } | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const vars = (raw as Record<string, unknown>).template_vars;\n  if (!Array.isArray(vars)) return undefined;\n  const cleaned = vars.filter((v): v is string => typeof v === \"string\");\n  return { template_vars: cleaned };\n}\n\n/**\n * B9 — accept only the documented shape: { system: string }. Empty string is\n * allowed (ai-runner sets it to \"\" when no system prompt is configured).\n */\nfunction sanitizeContextMeta(raw: unknown): { system: string } | undefined {\n  if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return undefined;\n  const sys = (raw as Record<string, unknown>).system;\n  if (typeof sys !== \"string\") return undefined;\n  return { system: sys };\n}\n\n/**\n * B24 — strip any leading path so a full session path like\n * `/instance/.sessions/agent/deep-42` is recorded as `deep-42` in _meta.\n * Callers (MCP, LLM tool results) receive only the opaque id.\n */\nfunction sessionBasename(value: string): string {\n  const trimmed = value.replace(/\\/+$/, \"\");\n  const idx = trimmed.lastIndexOf(\"/\");\n  return idx >= 0 ? trimmed.slice(idx + 1) : trimmed;\n}\n\n/**\n * B23 — coerce any runner-reported count into a non-negative finite integer.\n *\n * The result-contract promises `rounds`/`tokens_used`/`sub_runs` are always\n * numbers. Runners have historically leaked strings (`\"5\"`), NaN, Infinity,\n * and negative values. Silent passthrough breaks downstream consumers that\n * e.g. render `_meta.tokens_used.toLocaleString()`.\n */\nfunction coerceCount(raw: unknown): number {\n  const n = typeof raw === \"number\" ? raw : typeof raw === \"string\" ? Number(raw) : NaN;\n  if (!Number.isFinite(n)) return 0;\n  return Math.max(0, Math.floor(n));\n}\n\nfunction shapeOutput(\n  runnerOutput: unknown,\n  options?: {\n    outputKey?: string;\n    context?: { session?: string; chain?: string[] };\n  },\n): { result: any; _meta: Record<string, unknown> } {\n  if (!runnerOutput || typeof runnerOutput !== \"object\") {\n    const baseMeta: Record<string, unknown> = {\n      run_id: crypto.randomUUID(),\n      rounds: 0,\n      tokens_used: 0,\n      sub_runs: 0,\n    };\n    const ctx0 = options?.context;\n    if (ctx0) {\n      if (typeof ctx0.session === \"string\" && ctx0.session.length > 0) {\n        baseMeta.session = sessionBasename(ctx0.session);\n      }\n      if (Array.isArray(ctx0.chain)) {\n        const cleaned = ctx0.chain.filter(\n          (s): s is string => typeof s === \"string\" && s.length > 0,\n        );\n        if (cleaned.length > 0) baseMeta.chain = cleaned;\n        baseMeta.depth = cleaned.length;\n      } else if (ctx0.session !== undefined) {\n        baseMeta.depth = 0;\n      }\n    }\n    return { result: runnerOutput ?? null, _meta: baseMeta };\n  }\n\n  const out = runnerOutput as Record<string, unknown>;\n  const warnings: Array<{ code: string; message: string }> = [];\n\n  const runnerMeta = (out._meta && typeof out._meta === \"object\" ? out._meta : {}) as Record<\n    string,\n    unknown\n  >;\n  const data = (out.data && typeof out.data === \"object\" ? out.data : {}) as Record<\n    string,\n    unknown\n  >;\n\n  const hasStructuredShape =\n    \"data\" in out || \"result\" in out || \"_meta\" in out || \"success\" in out || \"error\" in out;\n  const isFailureEnvelope = out.success === false;\n  let resultValue: unknown;\n  if (isFailureEnvelope) {\n    // Runner returned a failure envelope — the inner `data` may carry a partial\n    // result (e.g. tokens consumed before abort), but there is no completed\n    // output. Callers should see `result: null` rather than the envelope itself.\n    resultValue = data.result !== undefined ? data.result : null;\n  } else if (!hasStructuredShape) {\n    resultValue = runnerOutput;\n  } else if (out.result !== undefined) {\n    resultValue = out.result;\n  } else if (data.result !== undefined) {\n    resultValue = data.result;\n  } else if (out.data !== undefined && out.data !== null && typeof out.data === \"object\") {\n    // B8 — data fallback must not surface `_meta` as part of the result payload.\n    const { _meta: _dataMeta, ...rest } = data;\n    resultValue = Object.keys(rest).length > 0 ? rest : null;\n  } else if (out.data !== undefined) {\n    resultValue = out.data;\n  } else {\n    resultValue = null;\n  }\n\n  const resultIsEmpty =\n    resultValue === undefined ||\n    resultValue === null ||\n    (typeof resultValue === \"object\" && Object.keys(resultValue as object).length === 0);\n  if (options?.outputKey && resultIsEmpty) {\n    warnings.push({\n      code: \"OUTPUT_KEY_MISSING\",\n      message: `Expected output key \"${options.outputKey}\" but runner returned no result`,\n    });\n    resultValue = null;\n  }\n\n  if (resultValue != null && !isJsonSafe(resultValue)) {\n    warnings.push({\n      code: \"RESULT_NOT_JSON_SAFE\",\n      message: \"Result contains circular references or non-serializable values\",\n    });\n    resultValue = null;\n  }\n\n  const runIdRaw = runnerMeta.run_id ?? data.run_id;\n  const meta: Record<string, unknown> = {\n    run_id: typeof runIdRaw === \"string\" && runIdRaw.length > 0 ? runIdRaw : crypto.randomUUID(),\n    rounds: coerceCount(runnerMeta.rounds ?? runnerMeta.iterations ?? data.rounds),\n    tokens_used: coerceCount(runnerMeta.tokens_used ?? data.total_tokens),\n    // B4 — fall back to data.sub_runs the same way rounds/tokens_used do.\n    // Runners that embed counts inside the inner data envelope (e.g. ash\n    // agent-run's nested .actions/run dispatch counter) were silently zeroed.\n    sub_runs: coerceCount(runnerMeta.sub_runs ?? data.sub_runs),\n  };\n\n  const rawScratch = runnerMeta.scratch_path ?? data.scratch_path;\n  if (typeof rawScratch === \"string\") {\n    meta.scratch_path = sanitizeScratchPath(rawScratch);\n  }\n\n  for (const key of Object.keys(runnerMeta)) {\n    if (SAFE_META_KEYS.has(key) && !(key in meta)) {\n      // B9 — render/context go through structural sanitizers so malformed\n      // runner output (e.g. `render: \"oops\"`) is dropped, not propagated.\n      if (key === \"render\") {\n        const cleaned = sanitizeRenderMeta(runnerMeta[key]);\n        if (cleaned) meta[key] = cleaned;\n      } else if (key === \"context\") {\n        const cleaned = sanitizeContextMeta(runnerMeta[key]);\n        if (cleaned) meta[key] = cleaned;\n      } else {\n        meta[key] = runnerMeta[key];\n      }\n    }\n  }\n\n  // B24 — caller context takes precedence over runner-reported session/chain.\n  // When a context is supplied, the current run has authoritative knowledge of\n  // its own session hierarchy; the runner's self-report may be stale (e.g. a\n  // mocked result carrying an old session id).\n  const ctx = options?.context;\n  if (ctx) {\n    if (typeof ctx.session === \"string\" && ctx.session.length > 0) {\n      meta.session = sessionBasename(ctx.session);\n    }\n    if (Array.isArray(ctx.chain)) {\n      const cleaned = ctx.chain.filter((s): s is string => typeof s === \"string\" && s.length > 0);\n      if (cleaned.length > 0) meta.chain = cleaned;\n      meta.depth = cleaned.length;\n    } else if (ctx.session !== undefined) {\n      // Explicit context supplied without a chain → root-level (depth 0)\n      meta.depth = 0;\n    }\n  }\n\n  if (runnerMeta.env && typeof runnerMeta.env === \"object\") {\n    meta.env = sanitizeMetaEnv(runnerMeta.env as Record<string, unknown>);\n  }\n\n  if (warnings.length > 0) meta.warnings = warnings;\n\n  return { result: resultValue, _meta: meta };\n}\n\nfunction estimatePayloadSize(args: Record<string, unknown>): number {\n  let size = 0;\n  for (const value of Object.values(args)) {\n    if (typeof value === \"string\") {\n      size += value.length;\n    } else if (value instanceof Uint8Array) {\n      size += value.length;\n    } else if (typeof value === \"function\" || typeof value === \"symbol\") {\n      // Non-serializable — skip (callers may pass progress callbacks etc.)\n    } else if (value !== null && value !== undefined) {\n      try {\n        const serialized = JSON.stringify(value);\n        if (typeof serialized === \"string\") {\n          size += serialized.length;\n        }\n      } catch {\n        // Circular references / non-serializable objects — skip\n      }\n    }\n  }\n  return size;\n}\n\n/**\n * B29 — Compile a statically-known tool catalog from `manifest.tools` so\n * `/.actions/run/.meta` can surface the LLM's tool surface without having to\n * invoke the agent.\n *\n * This is the dot-path resolver pass only — `.ash` frontmatter discovery and\n * skill-gated helpers require AFS I/O and happen later inside the runner. The\n * catalog returned here covers:\n *   - resolved bare-path declarations (`./knowledge/` → `<root>/knowledge/**`)\n *   - object-form declarations (passed through verbatim)\n *   - built-in `.actions/cancel` and `.actions/status` (auto-registered for\n *     every agent blocklet, so they must always appear)\n *\n * Invalid declarations (absolute paths, null bytes, …) surface as structured\n * warnings instead of silently dropping — one bad tool must not poison the\n * rest (mirrors the S13 \"data loss prevention\" contract).\n */\nfunction compileStaticToolCatalog(\n  manifest: AgentManifest,\n  mountPath: string,\n  actionPrefix?: string,\n): {\n  catalog: Array<{ path: string; ops: string[]; maxDepth?: number }>;\n  warnings: Array<{ code: string; path?: string; message: string }>;\n} {\n  const catalog: Array<{ path: string; ops: string[]; maxDepth?: number }> = [];\n  const warnings: Array<{ code: string; path?: string; message: string }> = [];\n  const tools = (manifest as { tools?: unknown[] }).tools ?? [];\n\n  for (const raw of tools) {\n    if (typeof raw === \"string\") {\n      try {\n        const [resolved] = resolveDotPaths([raw], mountPath);\n        if (resolved) catalog.push(resolved);\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        const code = msg.startsWith(\"TOOL_PATH_OUTSIDE_BLOCKLET\")\n          ? \"TOOL_PATH_OUTSIDE_BLOCKLET\"\n          : \"TOOL_PATH_INVALID\";\n        warnings.push({ code, path: raw, message: msg });\n      }\n    } else if (raw && typeof raw === \"object\") {\n      const entry = raw as { path?: string; ops?: string[]; maxDepth?: number };\n      if (typeof entry.path !== \"string\" || entry.path.length === 0) {\n        warnings.push({\n          code: \"TOOL_PATH_INVALID\",\n          message: \"object tool entry missing 'path' field\",\n        });\n        continue;\n      }\n      catalog.push({\n        path: entry.path,\n        // list grants pair with query (read-class collection view).\n        ops: withQueryPairing(entry.ops ?? [\"read\", \"list\", \"search\"]),\n        ...(entry.maxDepth != null ? { maxDepth: entry.maxDepth } : {}),\n      });\n    }\n  }\n\n  // Built-in action paths — always visible, always exec-only.\n  // Under an actionPrefix, the cancel/status siblings live at the prefixed\n  // names; pointing the catalog at the bare paths would lure tool-using\n  // LLMs into calling actions that don't exist on this blocklet.\n  const cancelName = actionPrefix ? `${actionPrefix}-cancel` : \"cancel\";\n  const statusName = actionPrefix ? `${actionPrefix}-status` : \"status\";\n  catalog.push({ path: joinURL(mountPath, `.actions/${cancelName}`), ops: [\"exec\"] });\n  catalog.push({ path: joinURL(mountPath, `.actions/${statusName}`), ops: [\"exec\"] });\n\n  return { catalog, warnings };\n}\n\n/**\n * Options for `createAgentActionHandlers`.\n *\n * `actionPrefix` is used by the blocklet manager when registering nested\n * agents under a single blocklet's runtime AFS. Without a prefix, every\n * blocklet would collide on the unqualified `run`/`cancel`/`status` keys\n * after the second nested manifest. With `actionPrefix: \"s1\"`, the\n * registered names become `s1-run`/`s1-cancel`/`s1-status`, and any\n * catalog references the LLM sees rewrite to match.\n */\nexport interface CreateAgentActionHandlersOptions {\n  actionPrefix?: string;\n}\n\nexport function createAgentActionHandlers(\n  manifest: AgentManifest,\n  _mountPath: string,\n  options?: CreateAgentActionHandlersOptions,\n): AgentActionHandlers {\n  const inputKey = manifest.inputKey ?? \"message\";\n  const inputSchema = buildInputSchema(\n    inputKey,\n    (manifest as any).inputSchema as Record<string, unknown> | undefined,\n  );\n\n  const actionPrefix = options?.actionPrefix;\n  const runName = actionPrefix ? `${actionPrefix}-run` : \"run\";\n  const cancelName = actionPrefix ? `${actionPrefix}-cancel` : \"cancel\";\n  const statusName = actionPrefix ? `${actionPrefix}-status` : \"status\";\n\n  const { catalog: toolCatalog, warnings: catalogWarnings } = compileStaticToolCatalog(\n    manifest,\n    _mountPath,\n    actionPrefix,\n  );\n\n  const runEntry: AFSEntry = {\n    id: runName,\n    path: `/.actions/${runName}`,\n    summary: `Run agent \"${manifest.name}\"`,\n    meta: {\n      kind: \"afs:executable\",\n      kinds: [\"afs:executable\", \"afs:node\"],\n      // exec-auth-gate P2: agent runs mutate state (traces, sessions) — the\n      // custom-action gate branch reads this (fail-closed \"write\" if absent).\n      effect: \"write\",\n      tool_catalog: toolCatalog,\n      ...(catalogWarnings.length > 0 ? { warnings: catalogWarnings } : {}),\n    },\n    actions: [\n      {\n        name: runName,\n        description: `Execute the \"${manifest.name}\" agent with the given input`,\n        inputSchema: inputSchema as any,\n        effect: \"write\",\n      },\n    ],\n  };\n\n  const cancelEntry: AFSEntry = {\n    id: cancelName,\n    path: `/.actions/${cancelName}`,\n    summary: `Cancel a running agent session for \"${manifest.name}\"`,\n    meta: {\n      kind: \"afs:executable\",\n      kinds: [\"afs:executable\", \"afs:node\"],\n      // exec-auth-gate P2: cancel mutates the run's lifecycle state.\n      effect: \"write\",\n    },\n    actions: [\n      {\n        name: cancelName,\n        effect: \"write\",\n        description: `Cancel the \"${manifest.name}\" agent run for a given session`,\n        inputSchema: {\n          type: \"object\",\n          properties: {\n            session: { type: \"string\", description: \"Session ID to cancel\" },\n          },\n          required: [\"session\"],\n        },\n      },\n    ],\n  };\n\n  const statusEntry: AFSEntry = {\n    id: statusName,\n    path: `/.actions/${statusName}`,\n    summary: `Get agent run status for \"${manifest.name}\"`,\n    meta: {\n      kind: \"afs:executable\",\n      kinds: [\"afs:executable\", \"afs:node\"],\n      // exec-auth-gate P2: status is read-only — without this annotation the\n      // fail-closed custom branch would 401 anonymous status checks (P3).\n      effect: \"read\",\n    },\n    actions: [\n      {\n        name: statusName,\n        effect: \"read\",\n        description: `Get the current status of a \"${manifest.name}\" agent run`,\n        inputSchema: {\n          type: \"object\",\n          properties: {\n            session: { type: \"string\", description: \"Session ID to check\" },\n          },\n        },\n      },\n    ],\n  };\n\n  const runHandler: AgentActionHandler = {\n    entry: runEntry,\n    inputSchema,\n    handler: async (args, context) => {\n      const sanitized = sanitizeArgs(args);\n\n      if (estimatePayloadSize(sanitized) > MAX_PAYLOAD_BYTES) {\n        return {\n          success: false,\n          error: { code: \"PAYLOAD_TOO_LARGE\", message: \"Input payload exceeds 1 MB limit\" },\n        };\n      }\n\n      const inputValue = sanitized[inputKey];\n      if (inputValue === undefined || inputValue === null) {\n        return {\n          success: false,\n          error: {\n            code: \"INPUT_SCHEMA_INVALID\",\n            message: `Missing required field: ${inputKey}`,\n            details: { field: inputKey },\n          },\n        };\n      }\n\n      // B13: enforce string only when the effective schema for inputKey says so.\n      // If the manifest declared a richer type (array/object/number/...), skip\n      // the string check and let the runner handle the value natively.\n      const schemaProps = (inputSchema as any)?.properties as Record<string, any> | undefined;\n      const expectedType = schemaProps?.[inputKey]?.type;\n      const expectsString = expectedType === undefined || expectedType === \"string\";\n      if (expectsString && typeof inputValue !== \"string\") {\n        return {\n          success: false,\n          error: {\n            code: \"INPUT_SCHEMA_INVALID\",\n            message: `Field \"${inputKey}\" must be a string, got ${typeof inputValue}`,\n            details: { field: inputKey },\n          },\n        };\n      }\n\n      if (!context) {\n        return {\n          success: false,\n          error: { code: \"INTERNAL_ERROR\", message: \"No runner context provided\" },\n        };\n      }\n\n      try {\n        const runner = getRunnerForType(manifest.type);\n\n        // Phase 6 — legacy `_budget_override`, `_parent_budget_remaining`,\n        // `_hook_chain_depth`, and `_parent_tools` exec-args are retired.\n        // Budget / tools / chain depth now flow through AgentScope\n        // (`context.afs.scope`) via `projectForChild`.\n        const systemAppend = sanitizeSystemAppend(args._system_append);\n\n        const enrichedContext: RunnerContext = {\n          ...context,\n          session: typeof args.session === \"string\" ? args.session : context.session,\n          parentSession: (args._parent_session as string) ?? undefined,\n          chain: Array.isArray(args._chain) ? (args._chain as string[]) : undefined,\n          systemAppend,\n        };\n        const result = await withRetry(\n          () => runner(sanitized, enrichedContext),\n          manifest.retry,\n          (r) => (r as { success?: boolean })?.success === false,\n        );\n\n        let effectiveResult: unknown = result;\n        const runnerSuccessForRails = (result as any)?.success !== false;\n        if (runnerSuccessForRails && manifest.guideRails && manifest.guideRails.length > 0) {\n          const decision = await runGuideRails(\n            enrichedContext.afs,\n            manifest.guideRails,\n            sanitized,\n            (result as any)?.data ?? result,\n            { mountPath: enrichedContext.mountPath },\n          );\n          if (decision.abort) {\n            const shapedAbort = shapeOutput(null, {\n              outputKey: manifest.outputKey,\n              context: { session: enrichedContext.session, chain: enrichedContext.chain },\n            });\n            return {\n              success: false,\n              error: {\n                code: \"GUIDE_RAIL_ABORT\",\n                message: decision.reason ?? \"GuideRail aborted\",\n              },\n              data: shapedAbort,\n            };\n          }\n          if (decision.output !== undefined) {\n            effectiveResult = {\n              ...(result as unknown as Record<string, unknown>),\n              data: decision.output,\n            };\n          }\n        }\n\n        const shaped = shapeOutput(effectiveResult, {\n          outputKey: manifest.outputKey,\n          context: {\n            session: enrichedContext.session,\n            chain: enrichedContext.chain,\n          },\n        });\n        const runnerSuccess = (result as any)?.success;\n        if (runnerSuccess === false) {\n          const rawError = (result as any)?.error ?? {\n            code: \"RUNNER_FAILED\",\n            message: \"Runner reported failure\",\n          };\n          return {\n            success: false,\n            error: normalizeRunnerError(rawError),\n            data: shaped,\n          };\n        }\n        return { success: true, data: shaped };\n      } catch (err: unknown) {\n        // B23 — even on exception we must emit the { result, _meta } envelope\n        // so callers never have to branch on shape. Session/chain context is\n        // still captured from the sanitized args.\n        const sessionFromArgs = typeof args.session === \"string\" ? args.session : context.session;\n        const chainFromArgs = Array.isArray(args._chain) ? (args._chain as string[]) : undefined;\n        const shapedOnError = shapeOutput(null, {\n          outputKey: manifest.outputKey,\n          context: { session: sessionFromArgs, chain: chainFromArgs },\n        });\n        return { success: false, error: normalizeRunnerError(err), data: shapedOnError };\n      }\n    },\n    sanitizeArgs,\n    shapeOutput,\n  };\n\n  const cancelHandler: AgentActionHandler = {\n    entry: cancelEntry,\n    inputSchema: cancelEntry.actions![0]!.inputSchema as Record<string, unknown>,\n    handler: async (args) => {\n      const session = args.session as string | undefined;\n      if (session) {\n        // S2 stub: full cancel wiring comes in S11.\n        // For now, return SESSION_NOT_FOUND for any specific session\n        // since we don't track sessions yet.\n        return {\n          success: false,\n          error: { code: \"SESSION_NOT_FOUND\", message: `Session \"${session}\" not found` },\n        };\n      }\n      return { success: true, data: { cancelled: true } };\n    },\n    sanitizeArgs,\n    shapeOutput,\n  };\n\n  const statusHandler: AgentActionHandler = {\n    entry: statusEntry,\n    inputSchema: statusEntry.actions![0]!.inputSchema as Record<string, unknown>,\n    handler: async (args) => {\n      const session = args.session as string | undefined;\n      if (session) {\n        // S2 stub: return SESSION_NOT_FOUND for specific sessions\n        return {\n          success: false,\n          error: { code: \"SESSION_NOT_FOUND\", message: `Session \"${session}\" not found` },\n        };\n      }\n      // Generic status: stub until S14 provisions scratch\n      return { success: true, data: { state: \"unknown\" } };\n    },\n    sanitizeArgs,\n    shapeOutput,\n  };\n\n  return {\n    run: runHandler,\n    cancel: cancelHandler,\n    status: statusHandler,\n  };\n}\n"],"mappings":";;;;;;;;;;;AAkBA,MAAM,oBAAoB,OAAO;AAEjC,MAAM,iBAAiB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAsBF,SAAS,iBACP,UACA,UACyB;AAIzB,KAAI,YAAY,OAAO,aAAa,SAClC,QAAO;AAET,QAAO;EACL,MAAM;EACN,YAAY,GACT,WAAW;GAAE,MAAM;GAAU,aAAa,6BAA6B,SAAS;GAAI,EACtF;EACD,UAAU,CAAC,SAAS;EACrB;;AAGH,SAAS,aAAa,MAAwD;CAC5E,MAAM,YAAqC,EAAE;AAC7C,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,CAC7C,KAAI,CAAC,eAAe,IAAI,IAAI,CAC1B,WAAU,OAAO;AAGrB,QAAO;;AAGT,MAAM,iBAAiB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAGA;CACA;CACA;CACA;CACA;CAMA;CACA;CACD,CAAC;;;;;;AAOF,SAAS,mBAAmB,KAAuD;AACjF,KAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO;CAClE,MAAM,OAAQ,IAAgC;AAC9C,KAAI,CAAC,MAAM,QAAQ,KAAK,CAAE,QAAO;AAEjC,QAAO,EAAE,eADO,KAAK,QAAQ,MAAmB,OAAO,MAAM,SAAS,EACrC;;;;;;AAOnC,SAAS,oBAAoB,KAA8C;AACzE,KAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAE,QAAO;CAClE,MAAM,MAAO,IAAgC;AAC7C,KAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAO,EAAE,QAAQ,KAAK;;;;;;;AAQxB,SAAS,gBAAgB,OAAuB;CAC9C,MAAM,UAAU,MAAM,QAAQ,QAAQ,GAAG;CACzC,MAAM,MAAM,QAAQ,YAAY,IAAI;AACpC,QAAO,OAAO,IAAI,QAAQ,MAAM,MAAM,EAAE,GAAG;;;;;;;;;;AAW7C,SAAS,YAAY,KAAsB;CACzC,MAAM,IAAI,OAAO,QAAQ,WAAW,MAAM,OAAO,QAAQ,WAAW,OAAO,IAAI,GAAG;AAClF,KAAI,CAAC,OAAO,SAAS,EAAE,CAAE,QAAO;AAChC,QAAO,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;;AAGnC,SAAS,YACP,cACA,SAIiD;AACjD,KAAI,CAAC,gBAAgB,OAAO,iBAAiB,UAAU;EACrD,MAAM,WAAoC;GACxC,QAAQ,OAAO,YAAY;GAC3B,QAAQ;GACR,aAAa;GACb,UAAU;GACX;EACD,MAAM,OAAO,SAAS;AACtB,MAAI,MAAM;AACR,OAAI,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,SAAS,EAC5D,UAAS,UAAU,gBAAgB,KAAK,QAAQ;AAElD,OAAI,MAAM,QAAQ,KAAK,MAAM,EAAE;IAC7B,MAAM,UAAU,KAAK,MAAM,QACxB,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,EACzD;AACD,QAAI,QAAQ,SAAS,EAAG,UAAS,QAAQ;AACzC,aAAS,QAAQ,QAAQ;cAChB,KAAK,YAAY,OAC1B,UAAS,QAAQ;;AAGrB,SAAO;GAAE,QAAQ,gBAAgB;GAAM,OAAO;GAAU;;CAG1D,MAAM,MAAM;CACZ,MAAM,WAAqD,EAAE;CAE7D,MAAM,aAAc,IAAI,SAAS,OAAO,IAAI,UAAU,WAAW,IAAI,QAAQ,EAAE;CAI/E,MAAM,OAAQ,IAAI,QAAQ,OAAO,IAAI,SAAS,WAAW,IAAI,OAAO,EAAE;CAKtE,MAAM,qBACJ,UAAU,OAAO,YAAY,OAAO,WAAW,OAAO,aAAa,OAAO,WAAW;CACvF,MAAM,oBAAoB,IAAI,YAAY;CAC1C,IAAI;AACJ,KAAI,kBAIF,eAAc,KAAK,WAAW,SAAY,KAAK,SAAS;UAC/C,CAAC,mBACV,eAAc;UACL,IAAI,WAAW,OACxB,eAAc,IAAI;UACT,KAAK,WAAW,OACzB,eAAc,KAAK;UACV,IAAI,SAAS,UAAa,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,UAAU;EAEtF,MAAM,EAAE,OAAO,WAAW,GAAG,SAAS;AACtC,gBAAc,OAAO,KAAK,KAAK,CAAC,SAAS,IAAI,OAAO;YAC3C,IAAI,SAAS,OACtB,eAAc,IAAI;KAElB,eAAc;CAGhB,MAAM,gBACJ,gBAAgB,UAChB,gBAAgB,QACf,OAAO,gBAAgB,YAAY,OAAO,KAAK,YAAsB,CAAC,WAAW;AACpF,KAAI,SAAS,aAAa,eAAe;AACvC,WAAS,KAAK;GACZ,MAAM;GACN,SAAS,wBAAwB,QAAQ,UAAU;GACpD,CAAC;AACF,gBAAc;;AAGhB,KAAI,eAAe,QAAQ,CAAC,WAAW,YAAY,EAAE;AACnD,WAAS,KAAK;GACZ,MAAM;GACN,SAAS;GACV,CAAC;AACF,gBAAc;;CAGhB,MAAM,WAAW,WAAW,UAAU,KAAK;CAC3C,MAAM,OAAgC;EACpC,QAAQ,OAAO,aAAa,YAAY,SAAS,SAAS,IAAI,WAAW,OAAO,YAAY;EAC5F,QAAQ,YAAY,WAAW,UAAU,WAAW,cAAc,KAAK,OAAO;EAC9E,aAAa,YAAY,WAAW,eAAe,KAAK,aAAa;EAIrE,UAAU,YAAY,WAAW,YAAY,KAAK,SAAS;EAC5D;CAED,MAAM,aAAa,WAAW,gBAAgB,KAAK;AACnD,KAAI,OAAO,eAAe,SACxB,MAAK,eAAe,oBAAoB,WAAW;AAGrD,MAAK,MAAM,OAAO,OAAO,KAAK,WAAW,CACvC,KAAI,eAAe,IAAI,IAAI,IAAI,EAAE,OAAO,MAGtC,KAAI,QAAQ,UAAU;EACpB,MAAM,UAAU,mBAAmB,WAAW,KAAK;AACnD,MAAI,QAAS,MAAK,OAAO;YAChB,QAAQ,WAAW;EAC5B,MAAM,UAAU,oBAAoB,WAAW,KAAK;AACpD,MAAI,QAAS,MAAK,OAAO;OAEzB,MAAK,OAAO,WAAW;CAS7B,MAAM,MAAM,SAAS;AACrB,KAAI,KAAK;AACP,MAAI,OAAO,IAAI,YAAY,YAAY,IAAI,QAAQ,SAAS,EAC1D,MAAK,UAAU,gBAAgB,IAAI,QAAQ;AAE7C,MAAI,MAAM,QAAQ,IAAI,MAAM,EAAE;GAC5B,MAAM,UAAU,IAAI,MAAM,QAAQ,MAAmB,OAAO,MAAM,YAAY,EAAE,SAAS,EAAE;AAC3F,OAAI,QAAQ,SAAS,EAAG,MAAK,QAAQ;AACrC,QAAK,QAAQ,QAAQ;aACZ,IAAI,YAAY,OAEzB,MAAK,QAAQ;;AAIjB,KAAI,WAAW,OAAO,OAAO,WAAW,QAAQ,SAC9C,MAAK,MAAM,gBAAgB,WAAW,IAA+B;AAGvE,KAAI,SAAS,SAAS,EAAG,MAAK,WAAW;AAEzC,QAAO;EAAE,QAAQ;EAAa,OAAO;EAAM;;AAG7C,SAAS,oBAAoB,MAAuC;CAClE,IAAI,OAAO;AACX,MAAK,MAAM,SAAS,OAAO,OAAO,KAAK,CACrC,KAAI,OAAO,UAAU,SACnB,SAAQ,MAAM;UACL,iBAAiB,WAC1B,SAAQ,MAAM;UACL,OAAO,UAAU,cAAc,OAAO,UAAU,UAAU,YAE1D,UAAU,QAAQ,UAAU,OACrC,KAAI;EACF,MAAM,aAAa,KAAK,UAAU,MAAM;AACxC,MAAI,OAAO,eAAe,SACxB,SAAQ,WAAW;SAEf;AAKZ,QAAO;;;;;;;;;;;;;;;;;;;AAoBT,SAAS,yBACP,UACA,WACA,cAIA;CACA,MAAM,UAAqE,EAAE;CAC7E,MAAM,WAAoE,EAAE;CAC5E,MAAM,QAAS,SAAmC,SAAS,EAAE;AAE7D,MAAK,MAAM,OAAO,MAChB,KAAI,OAAO,QAAQ,SACjB,KAAI;EACF,MAAM,CAAC,YAAY,gBAAgB,CAAC,IAAI,EAAE,UAAU;AACpD,MAAI,SAAU,SAAQ,KAAK,SAAS;UAC7B,KAAK;EACZ,MAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;EAC5D,MAAM,OAAO,IAAI,WAAW,6BAA6B,GACrD,+BACA;AACJ,WAAS,KAAK;GAAE;GAAM,MAAM;GAAK,SAAS;GAAK,CAAC;;UAEzC,OAAO,OAAO,QAAQ,UAAU;EACzC,MAAM,QAAQ;AACd,MAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,WAAW,GAAG;AAC7D,YAAS,KAAK;IACZ,MAAM;IACN,SAAS;IACV,CAAC;AACF;;AAEF,UAAQ,KAAK;GACX,MAAM,MAAM;GAEZ,KAAK,iBAAiB,MAAM,OAAO;IAAC;IAAQ;IAAQ;IAAS,CAAC;GAC9D,GAAI,MAAM,YAAY,OAAO,EAAE,UAAU,MAAM,UAAU,GAAG,EAAE;GAC/D,CAAC;;CAQN,MAAM,aAAa,eAAe,GAAG,aAAa,WAAW;CAC7D,MAAM,aAAa,eAAe,GAAG,aAAa,WAAW;AAC7D,SAAQ,KAAK;EAAE,MAAM,QAAQ,WAAW,YAAY,aAAa;EAAE,KAAK,CAAC,OAAO;EAAE,CAAC;AACnF,SAAQ,KAAK;EAAE,MAAM,QAAQ,WAAW,YAAY,aAAa;EAAE,KAAK,CAAC,OAAO;EAAE,CAAC;AAEnF,QAAO;EAAE;EAAS;EAAU;;AAiB9B,SAAgB,0BACd,UACA,YACA,SACqB;CACrB,MAAM,WAAW,SAAS,YAAY;CACtC,MAAM,cAAc,iBAClB,UACC,SAAiB,YACnB;CAED,MAAM,eAAe,SAAS;CAC9B,MAAM,UAAU,eAAe,GAAG,aAAa,QAAQ;CACvD,MAAM,aAAa,eAAe,GAAG,aAAa,WAAW;CAC7D,MAAM,aAAa,eAAe,GAAG,aAAa,WAAW;CAE7D,MAAM,EAAE,SAAS,aAAa,UAAU,oBAAoB,yBAC1D,UACA,YACA,aACD;CAED,MAAM,WAAqB;EACzB,IAAI;EACJ,MAAM,aAAa;EACnB,SAAS,cAAc,SAAS,KAAK;EACrC,MAAM;GACJ,MAAM;GACN,OAAO,CAAC,kBAAkB,WAAW;GAGrC,QAAQ;GACR,cAAc;GACd,GAAI,gBAAgB,SAAS,IAAI,EAAE,UAAU,iBAAiB,GAAG,EAAE;GACpE;EACD,SAAS,CACP;GACE,MAAM;GACN,aAAa,gBAAgB,SAAS,KAAK;GAC9B;GACb,QAAQ;GACT,CACF;EACF;CAED,MAAM,cAAwB;EAC5B,IAAI;EACJ,MAAM,aAAa;EACnB,SAAS,uCAAuC,SAAS,KAAK;EAC9D,MAAM;GACJ,MAAM;GACN,OAAO,CAAC,kBAAkB,WAAW;GAErC,QAAQ;GACT;EACD,SAAS,CACP;GACE,MAAM;GACN,QAAQ;GACR,aAAa,eAAe,SAAS,KAAK;GAC1C,aAAa;IACX,MAAM;IACN,YAAY,EACV,SAAS;KAAE,MAAM;KAAU,aAAa;KAAwB,EACjE;IACD,UAAU,CAAC,UAAU;IACtB;GACF,CACF;EACF;CAED,MAAM,cAAwB;EAC5B,IAAI;EACJ,MAAM,aAAa;EACnB,SAAS,6BAA6B,SAAS,KAAK;EACpD,MAAM;GACJ,MAAM;GACN,OAAO,CAAC,kBAAkB,WAAW;GAGrC,QAAQ;GACT;EACD,SAAS,CACP;GACE,MAAM;GACN,QAAQ;GACR,aAAa,gCAAgC,SAAS,KAAK;GAC3D,aAAa;IACX,MAAM;IACN,YAAY,EACV,SAAS;KAAE,MAAM;KAAU,aAAa;KAAuB,EAChE;IACF;GACF,CACF;EACF;AAqLD,QAAO;EACL,KApLqC;GACrC,OAAO;GACP;GACA,SAAS,OAAO,MAAM,YAAY;IAChC,MAAM,YAAY,aAAa,KAAK;AAEpC,QAAI,oBAAoB,UAAU,GAAG,kBACnC,QAAO;KACL,SAAS;KACT,OAAO;MAAE,MAAM;MAAqB,SAAS;MAAoC;KAClF;IAGH,MAAM,aAAa,UAAU;AAC7B,QAAI,eAAe,UAAa,eAAe,KAC7C,QAAO;KACL,SAAS;KACT,OAAO;MACL,MAAM;MACN,SAAS,2BAA2B;MACpC,SAAS,EAAE,OAAO,UAAU;MAC7B;KACF;IAOH,MAAM,gBADe,aAAqB,cACP,WAAW;AAE9C,SADsB,iBAAiB,UAAa,iBAAiB,aAChD,OAAO,eAAe,SACzC,QAAO;KACL,SAAS;KACT,OAAO;MACL,MAAM;MACN,SAAS,UAAU,SAAS,0BAA0B,OAAO;MAC7D,SAAS,EAAE,OAAO,UAAU;MAC7B;KACF;AAGH,QAAI,CAAC,QACH,QAAO;KACL,SAAS;KACT,OAAO;MAAE,MAAM;MAAkB,SAAS;MAA8B;KACzE;AAGH,QAAI;KACF,MAAM,SAAS,iBAAiB,SAAS,KAAK;KAM9C,MAAM,eAAe,qBAAqB,KAAK,eAAe;KAE9D,MAAM,kBAAiC;MACrC,GAAG;MACH,SAAS,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,QAAQ;MACnE,eAAgB,KAAK,mBAA8B;MACnD,OAAO,MAAM,QAAQ,KAAK,OAAO,GAAI,KAAK,SAAsB;MAChE;MACD;KACD,MAAM,SAAS,MAAM,gBACb,OAAO,WAAW,gBAAgB,EACxC,SAAS,QACR,MAAO,GAA6B,YAAY,MAClD;KAED,IAAI,kBAA2B;AAE/B,SAD+B,QAAgB,YAAY,SAC9B,SAAS,cAAc,SAAS,WAAW,SAAS,GAAG;MAClF,MAAM,WAAW,MAAM,cACrB,gBAAgB,KAChB,SAAS,YACT,WACC,QAAgB,QAAQ,QACzB,EAAE,WAAW,gBAAgB,WAAW,CACzC;AACD,UAAI,SAAS,OAAO;OAClB,MAAM,cAAc,YAAY,MAAM;QACpC,WAAW,SAAS;QACpB,SAAS;SAAE,SAAS,gBAAgB;SAAS,OAAO,gBAAgB;SAAO;QAC5E,CAAC;AACF,cAAO;QACL,SAAS;QACT,OAAO;SACL,MAAM;SACN,SAAS,SAAS,UAAU;SAC7B;QACD,MAAM;QACP;;AAEH,UAAI,SAAS,WAAW,OACtB,mBAAkB;OAChB,GAAI;OACJ,MAAM,SAAS;OAChB;;KAIL,MAAM,SAAS,YAAY,iBAAiB;MAC1C,WAAW,SAAS;MACpB,SAAS;OACP,SAAS,gBAAgB;OACzB,OAAO,gBAAgB;OACxB;MACF,CAAC;AAEF,SADuB,QAAgB,YACjB,MAKpB,QAAO;MACL,SAAS;MACT,OAAO,qBANS,QAAgB,SAAS;OACzC,MAAM;OACN,SAAS;OACV,CAGsC;MACrC,MAAM;MACP;AAEH,YAAO;MAAE,SAAS;MAAM,MAAM;MAAQ;aAC/B,KAAc;KAIrB,MAAM,kBAAkB,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,QAAQ;KAClF,MAAM,gBAAgB,MAAM,QAAQ,KAAK,OAAO,GAAI,KAAK,SAAsB;KAC/E,MAAM,gBAAgB,YAAY,MAAM;MACtC,WAAW,SAAS;MACpB,SAAS;OAAE,SAAS;OAAiB,OAAO;OAAe;MAC5D,CAAC;AACF,YAAO;MAAE,SAAS;MAAO,OAAO,qBAAqB,IAAI;MAAE,MAAM;MAAe;;;GAGpF;GACA;GACD;EA2CC,QAzCwC;GACxC,OAAO;GACP,aAAa,YAAY,QAAS,GAAI;GACtC,SAAS,OAAO,SAAS;IACvB,MAAM,UAAU,KAAK;AACrB,QAAI,QAIF,QAAO;KACL,SAAS;KACT,OAAO;MAAE,MAAM;MAAqB,SAAS,YAAY,QAAQ;MAAc;KAChF;AAEH,WAAO;KAAE,SAAS;KAAM,MAAM,EAAE,WAAW,MAAM;KAAE;;GAErD;GACA;GACD;EAwBC,QAtBwC;GACxC,OAAO;GACP,aAAa,YAAY,QAAS,GAAI;GACtC,SAAS,OAAO,SAAS;IACvB,MAAM,UAAU,KAAK;AACrB,QAAI,QAEF,QAAO;KACL,SAAS;KACT,OAAO;MAAE,MAAM;MAAqB,SAAS,YAAY,QAAQ;MAAc;KAChF;AAGH,WAAO;KAAE,SAAS;KAAM,MAAM,EAAE,OAAO,WAAW;KAAE;;GAEtD;GACA;GACD;EAMA"}