@alneas/eaos-server 0.0.0-stage → 0.2.0

package/dist/chunk-HXFVOR7Z.js

@@ -0,0 +1,496 @@
+// src/agentic/graph.ts
+import { Command, END, interrupt, MemorySaver, START, StateGraph, Annotation } from "@langchain/langgraph";
+import { createApprovalBinding, validateApprovalBinding } from "@alneas/eaos-core";
+import { randomUUID } from "node:crypto";
+var GraphState = Annotation.Root({
+  sessionId: Annotation,
+  tenantId: Annotation,
+  userId: Annotation,
+  currentStep: Annotation,
+  history: Annotation({ reducer: (_left, right) => right, default: () => [] }),
+  context: Annotation({
+    reducer: (left, right) => {
+      if (right === void 0) return left;
+      const merged = { ...left, ...right };
+      if (merged.__eaosSubgraphResume === null) delete merged.__eaosSubgraphResume;
+      return merged;
+    },
+    default: () => void 0
+  }),
+  citations: Annotation,
+  pendingApproval: Annotation,
+  checkpointRevision: Annotation,
+  lastApproval: Annotation,
+  isComplete: Annotation,
+  error: Annotation
+});
+var AgentGraphEngine = class {
+  nodes = /* @__PURE__ */ new Map();
+  edges = /* @__PURE__ */ new Map();
+  edgeVisuals = /* @__PURE__ */ new Map();
+  nodeOptions = /* @__PURE__ */ new Map();
+  conditionalRoutes = /* @__PURE__ */ new Map();
+  checkpointer;
+  authorizeResume;
+  workflowId;
+  workflowVersion;
+  entryNode = "start";
+  compiled;
+  graphVersion = 0;
+  compiledVersion = -1;
+  /**
+   * Creates a graph builder with a host saver or options; compilation is deferred until execution/checkpoint reads.
+   * @param checkpointerOrOptions - LangGraph saver or options; omission uses an independent MemorySaver.
+   * @param options - Additional options used only when the first argument is a saver; otherwise ignored.
+   */
+  constructor(checkpointerOrOptions = {}, options = {}) {
+    const supplied = isCheckpointSaver(checkpointerOrOptions) ? { ...options, checkpointer: checkpointerOrOptions } : checkpointerOrOptions;
+    this.checkpointer = supplied.checkpointer ?? new MemorySaver();
+    this.authorizeResume = supplied.authorizeResume;
+    this.workflowId = supplied.workflowId;
+    this.workflowVersion = supplied.workflowVersion;
+  }
+  /**
+   * Registers or replaces a named handler and invalidates compiled topology.
+   * @param name - Nonblank node name; __eaos_approval__ is reserved. Names are retained without trimming.
+   * @param handler - Async callback receiving a cloned state and resolving partial state updates.
+   * @param options - Optional LangGraph retry policy and serializable display metadata.
+   * @returns This builder for chaining.
+   * @throws For blank/reserved names; handler failures occur later during execution.
+   * @example
+   * ```typescript
+   * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+   * const graph = new AgentGraphEngine();
+   * graph.addNode("start", async () => ({ isComplete: true }));
+   * graph.addNode("finish", async () => ({ isComplete: true }));
+   * ```
+   */
+  addNode(name, handler, options = {}) {
+    if (!name.trim() || name === "__eaos_approval__") throw new Error("Invalid workflow node name");
+    this.nodes.set(name, handler);
+    this.nodeOptions.set(name, options);
+    this.invalidate();
+    return this;
+  }
+  /**
+   * Mount a plugin-owned compiled LangGraph as one parent-graph node.
+   * Input/output mapping is explicit so plugin state does not silently leak into
+   * the EAOS state, while the nested graph still gets its own checkpoint thread.
+   * @param name - Parent node identifier, subject to addNode validation.
+   * @param subgraph - Compiled graph with invoke and optional state/resume capabilities.
+   * @param options - Input/output mapping and child-thread identity; defaults pass state/output through and use sessionId:name as thread ID.
+   * @returns This graph builder.
+   * @throws If subgraph lacks invoke or the name is invalid. Execution propagates mapping/subgraph errors except recognized interrupts handled by mapInterrupted.
+   * @remarks Child config uses checkpoint_ns=name. A mapped interrupt stores resume metadata in context; host mappings must preserve tenant boundaries and avoid leaking child state.
+   * @example
+   * ```typescript
+   * import { AgentGraphEngine, type GraphSubgraph } from "@alneas/eaos-server/agentic/graph";
+   * export function nested(subgraph: GraphSubgraph) {
+   *   return new AgentGraphEngine().addSubgraph("start", subgraph, { mapOutput: output => ({ context: { child: output } }) });
+   * }
+   * ```
+   */
+  addSubgraph(name, subgraph, options = {}) {
+    if (!subgraph || typeof subgraph.invoke !== "function") throw new Error("Compiled workflow subgraph is required");
+    return this.addNode(name, async (state) => {
+      const input = options.mapInput ? options.mapInput(state) : state;
+      const threadId = options.threadId?.(state) ?? `${state.sessionId}:${name}`;
+      if (!threadId.trim()) throw new Error("Subgraph thread id is required");
+      const config = { configurable: { thread_id: threadId, checkpoint_ns: name } };
+      const resume = state.context?.__eaosSubgraphResume;
+      let output;
+      try {
+        output = resume?.node === name && resume.decision && subgraph.resume ? await subgraph.resume(input, resume.decision, config) : await subgraph.invoke(input, config);
+      } catch (error) {
+        if (!options.mapInterrupted || !isLangGraphInterrupt(error)) throw error;
+        const subgraphState = subgraph.getState ? await subgraph.getState(config) : void 0;
+        const mapped2 = await options.mapInterrupted(error, state, subgraphState);
+        return { ...mapped2, context: { ...mapped2.context, __eaosSubgraphResume: { node: name } } };
+      }
+      const context = { ...state.context ?? {} };
+      if (context.__eaosSubgraphResume) context.__eaosSubgraphResume = null;
+      const mapped = options.mapOutput ? options.mapOutput(output, state) : output;
+      return { ...mapped, context: { ...context, ...mapped.context ?? {} } };
+    }, { visual: options.visual ?? { kind: "subgraph", label: name } });
+  }
+  /**
+   * Adds a declared edge and its display metadata.
+   * @param from - Nonblank source node name.
+   * @param to - Nonblank destination node name.
+   * @param options - Optional serializable display metadata, cloned on insertion.
+   * @returns This graph builder.
+   * @throws For blank endpoints or uncloneable display metadata. Missing node references can fail compilation later.
+   * @remarks Without conditional routing, execution follows only the first declared outgoing edge; describe may list additional declared edges.
+   * @example
+   * ```typescript
+   * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+   * const graph = new AgentGraphEngine();
+   * graph.addNode("start", async () => ({ isComplete: true }));
+   * graph.addNode("finish", async () => ({}));
+   * graph.addEdge("start", "finish");
+   * ```
+   */
+  addEdge(from, to, options = {}) {
+    if (!from.trim() || !to.trim()) throw new Error("Invalid workflow edge");
+    this.edges.set(from, [...this.edges.get(from) ?? [], to]);
+    this.edgeVisuals.set(from, [...this.edgeVisuals.get(from) ?? [], structuredClone(options.visual ?? {})]);
+    this.invalidate();
+    return this;
+  }
+  /**
+  * Sets a source node's conditional router and complete allowed destination set.
+  * @param from - Nonblank source node name.
+  * @param router - Called synchronously after the node with a state clone; must return one declared destination.
+  * @param destinations - Nonempty list of nonblank destination names; duplicates are collapsed.
+  * @param options - Cloned optional edge metadata and destination labels.
+  * @returns This graph builder.
+  * @throws For invalid source/destinations or uncloneable options; runtime routing rejects undeclared destinations and callback errors.
+  * @remarks A pending approval overrides conditional routing and enters the approval node. This replaces an existing conditional route for from.
+  * @example
+  * ```typescript
+  * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+  * const graph = new AgentGraphEngine();
+  * graph.addNode("start", async () => ({ isComplete: true }));
+  * graph.addNode("finish", async () => ({}));
+  * graph.addConditionalEdges("start", () => "finish", ["finish"]);
+  * ```
+  */
+  addConditionalEdges(from, router, destinations, options = {}) {
+    if (!from.trim() || !destinations.length || destinations.some((destination) => !destination.trim())) throw new Error("Invalid conditional workflow route");
+    this.conditionalRoutes.set(from, { router, destinations: [...new Set(destinations)], visual: structuredClone(options) });
+    this.invalidate();
+    return this;
+  }
+  /**
+   * Selects the registered node where future graph execution starts.
+   * @param nodeName - Nonblank node name; existence is checked on deferred compilation.
+   * @returns This builder after invalidating compiled topology.
+   * @throws For a blank name; missing entry registration fails later on compilation.
+   * @example
+   * ```typescript
+   * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+   * const graph = new AgentGraphEngine();
+   * graph.addNode("start", async () => ({ isComplete: true }));
+   * graph.setEntryPoint("start");
+   * ```
+   */
+  setEntryPoint(nodeName) {
+    if (!nodeName.trim()) throw new Error("Invalid workflow entry node");
+    this.entryNode = nodeName;
+    this.invalidate();
+    return this;
+  }
+  /**
+   * Reads the first statically declared outgoing edge without evaluating conditional routing.
+   * @param fromNode - Exact source node identifier.
+   * @returns First declared destination, or undefined when no static edge exists.
+   * @example
+   * ```typescript
+   * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+   * const graph = new AgentGraphEngine();
+   * graph.addNode("start", async () => ({ isComplete: true }));
+   * console.log(graph.getNextNode("start")); // undefined
+   * ```
+   */
+  getNextNode(fromNode) {
+    return this.edges.get(fromNode)?.[0];
+  }
+  /**
+   * Return a serializable graph description for UI/API/diagram consumers.
+   * Handlers and router functions are intentionally omitted: this is metadata,
+   * not a remotely executable workflow definition.
+   * @returns A structured clone of versioned node/edge display metadata in insertion order; may describe an incomplete graph before compilation.
+   * @throws If retained metadata has become uncloneable.
+   * @example
+   * ```typescript
+   * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+   * const graph = new AgentGraphEngine();
+   * graph.addNode("start", async () => ({ isComplete: true }));
+   * console.log(graph.describe().nodes.length); // 1
+   * ```
+   */
+  describe() {
+    const nodes = [...this.nodes.keys()].map((id) => {
+      const visual = this.nodeOptions.get(id)?.visual ?? {};
+      return {
+        id,
+        kind: visual.kind ?? "task",
+        label: visual.label?.trim() || id,
+        ...visual.description === void 0 ? {} : { description: visual.description },
+        ...visual.pluginId === void 0 ? {} : { pluginId: visual.pluginId },
+        ...visual.approvalLevel === void 0 ? {} : { approvalLevel: visual.approvalLevel },
+        ...visual.riskLevel === void 0 ? {} : { riskLevel: visual.riskLevel },
+        ...visual.toolName === void 0 ? {} : { toolName: visual.toolName },
+        canRequestApproval: visual.canRequestApproval ?? true,
+        ...visual.retryable === void 0 ? {} : { retryable: visual.retryable },
+        ...visual.subgraphId === void 0 ? {} : { subgraphId: visual.subgraphId },
+        ...visual.subgraphVersion === void 0 ? {} : { subgraphVersion: visual.subgraphVersion }
+      };
+    });
+    const edges = [];
+    for (const [from, destinations] of this.edges) {
+      if (this.conditionalRoutes.has(from)) continue;
+      destinations.forEach((to, index) => {
+        const visual = this.edgeVisuals.get(from)?.[index] ?? {};
+        edges.push({ from, to, kind: visual.kind ?? "normal", ...visual.label === void 0 ? {} : { label: visual.label }, ...visual.condition === void 0 ? {} : { condition: visual.condition } });
+      });
+    }
+    for (const [from, route] of this.conditionalRoutes) {
+      for (const to of route.destinations) {
+        const visual = route.visual?.visual ?? {};
+        const label = route.visual?.labels?.[to] ?? visual.label;
+        edges.push({ from, to, kind: visual.kind ?? "conditional", ...label === void 0 ? {} : { label }, ...visual.condition === void 0 ? {} : { condition: visual.condition } });
+      }
+    }
+    return structuredClone({ schemaVersion: "1.0", ...this.workflowId ? { workflowId: this.workflowId } : {}, ...this.workflowVersion ? { workflowVersion: this.workflowVersion } : {}, entryNode: this.entryNode, nodes, edges });
+  }
+  /**
+  * Extracts runtime status and approval display metadata without history, context, or approval args.
+  * @param state - Authorized checkpoint state to summarize.
+  * @returns Status prioritized as waiting_approval, failed, completed, running, then idle, plus current node/revision and optional error/approval display details.
+  * @remarks Reasons and errors remain visible; the host must control their content and authorize access to this overlay.
+  * @example
+  * ```typescript
+  * import { AgentGraphEngine, type AgentGraphState } from "@alneas/eaos-server/agentic/graph";
+  * export function overlay(state: AgentGraphState) {
+  *   return new AgentGraphEngine().describeRuntime(state);
+  * }
+  * ```
+  */
+  describeRuntime(state) {
+    const status = state.pendingApproval ? "waiting_approval" : state.error ? "failed" : state.isComplete ? "completed" : state.currentStep ? "running" : "idle";
+    return {
+      status,
+      ...state.currentStep && state.currentStep !== END ? { currentNodeId: state.currentStep } : {},
+      ...state.checkpointRevision === void 0 ? {} : { checkpointRevision: state.checkpointRevision },
+      ...state.pendingApproval ? {
+        pendingApproval: {
+          ...state.pendingApproval.approvalId === void 0 ? {} : { approvalId: state.pendingApproval.approvalId },
+          toolName: state.pendingApproval.toolName,
+          approvalLevel: state.pendingApproval.approvalLevel,
+          riskLevel: state.pendingApproval.riskLevel,
+          reason: state.pendingApproval.reason
+        }
+      } : {},
+      ...state.error === void 0 ? {} : { error: state.error }
+    };
+  }
+  /**
+  * Reads a session checkpoint and combines its display overlay with the current static graph.
+  * @param sessionId - Authorized host session/thread identifier.
+  * @returns Graph description and runtime overlay when a checkpoint exists, or only graph metadata otherwise.
+  * @throws Rejects compilation, saver, or description failures.
+  * @remarks This method does not authenticate the caller or authorize session access.
+  * @example
+  * ```typescript
+  * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+  * const graph = new AgentGraphEngine();
+  * graph.addNode("start", async () => ({ isComplete: true }));
+  * const visualization = await graph.getVisualization("example-session");
+  * console.log(visualization.graph.nodes.length);
+  * ```
+  */
+  async getVisualization(sessionId) {
+    const state = await this.getCheckpoint(sessionId);
+    return { graph: this.describe(), ...state ? { runtime: this.describeRuntime(state) } : {} };
+  }
+  /**
+   * Reads the current saved state for one graph session.
+   * @param sessionId - Authorized LangGraph thread ID.
+   * @returns A structured clone of persisted state, or null when no session state exists.
+   * @throws Rejects deferred compilation, saver, or clone failures.
+   * @remarks The host authorizes tenant/session access; sessionId alone is not an authentication claim.
+   * @example
+   * ```typescript
+   * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+   * const graph = new AgentGraphEngine();
+   * graph.addNode("start", async () => ({ isComplete: true }));
+   * console.log(await graph.getCheckpoint("example-session")); // null
+   * ```
+   */
+  async getCheckpoint(sessionId) {
+    const snapshot = await this.ensureCompiled().getState(this.config(sessionId));
+    return snapshot.values && typeof snapshot.values === "object" && "sessionId" in snapshot.values ? toAgentState(snapshot.values) : null;
+  }
+  /**
+  * Runs the graph until completion or a LangGraph approval interrupt.
+  * @param initialState - Verified host session/tenant/user state; a nonblank sessionId is required. Existing pendingApproval returns an immediate clone without invoking the graph.
+  * @returns Latest checkpoint state after execution, interrupted approval state, or the supplied initial state when no checkpoint is available.
+  * @throws Rejects invalid sessionId, compilation, handler/retry, saver, binding, or clone errors except recognized approval interrupts.
+  * @remarks This method runs multiple nodes, despite its name. The host must serialize writers and make retried handlers safe for side effects. It installs no timeout or cancellation itself.
+  * @example
+  * ```typescript
+  * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+  * const graph = new AgentGraphEngine();
+  * graph.addNode("start", async () => ({ isComplete: true }));
+  * const state = await graph.runStep({ sessionId: "example-session", tenantId: "example", userId: "example-user", currentStep: "start", history: [], isComplete: false });
+  * console.log(state.isComplete); // true
+  * ```
+  */
+  async runStep(initialState) {
+    if (!initialState?.sessionId?.trim()) throw new Error("Workflow sessionId is required");
+    if (initialState.pendingApproval) return structuredClone(initialState);
+    try {
+      await this.ensureCompiled().invoke(initialState, this.config(initialState.sessionId));
+    } catch (error) {
+      const interrupted = await this.getCheckpoint(initialState.sessionId);
+      if (interrupted?.pendingApproval && isLangGraphInterrupt(error)) return interrupted;
+      throw error;
+    }
+    return await this.getCheckpoint(initialState.sessionId) ?? initialState;
+  }
+  /**
+  * Validates a pending approval binding and host authority before resuming its LangGraph thread.
+  * @param input - Session ID, verified approver ID/role, boolean decision, optional comment, optional expected approvalId/bindingHash, and optional live authorizer overriding constructor settings.
+  * @returns Resumed state on success, or resumed:false with an error for absent/mismatched approval, denied authorization, or normalized invocation failure. A denial decision completes the graph as rejected.
+  * @throws Can reject saver/compilation errors, live authorizer rejection, or post-resume checkpoint failures.
+  * @remarks An approved decision requires a live authorizer returning exactly true; a supplied authorizer also checks rejection decisions. Host writer serialization is required: this method does not acquire an independent lock or compare-and-swap checkpoint revisions. Missing optional expected IDs skip those comparisons. Resume failures can follow side effects; no rollback or automatic retry occurs.
+  * @example
+  * ```typescript
+  * import { AgentGraphEngine } from "@alneas/eaos-server/agentic/graph";
+  * export async function decide(graph: AgentGraphEngine, input: Parameters<AgentGraphEngine["resumeAfterApproval"]>[0]) {
+  *   // Authenticate the approver and supply live authorization before approving.
+  *   return graph.resumeAfterApproval(input);
+  * }
+  * ```
+  */
+  async resumeAfterApproval(input) {
+    const graph = this.ensureCompiled();
+    const checkpoint = await this.getCheckpoint(input.sessionId);
+    if (!checkpoint) return { resumed: false, error: `Workflow session '${input.sessionId}' not found` };
+    const pending = checkpoint.pendingApproval;
+    if (!pending) return { resumed: false, error: "Workflow is not awaiting approval" };
+    try {
+      if (input.approvalId && input.approvalId !== pending.approvalId) return { resumed: false, error: "Approval ticket does not match workflow state" };
+      if (!pending.binding || input.bindingHash && input.bindingHash !== pending.binding.bindingHash) return { resumed: false, error: "Approval binding does not match workflow state" };
+      validateApprovalBinding(pending.binding);
+    } catch (error) {
+      return { resumed: false, error: error instanceof Error ? error.message : "Invalid approval binding" };
+    }
+    if (!input.approverId.trim() || !input.approverRole.trim()) return { resumed: false, error: "Approver identity is required" };
+    const authorizeResume = input.authorizeResume ?? this.authorizeResume;
+    if (input.approved && !authorizeResume) return { resumed: false, error: "Current authorization verifier is required before workflow resume" };
+    if (authorizeResume && await authorizeResume(structuredClone(checkpoint), { approverId: input.approverId, approverRole: input.approverRole, approved: input.approved }) !== true) return { resumed: false, error: "Current authorization no longer permits workflow resume" };
+    const decision = { approved: input.approved, approverId: input.approverId, approverRole: input.approverRole, comment: input.comment };
+    try {
+      await graph.invoke(new Command({ resume: decision }), this.config(input.sessionId));
+    } catch (error) {
+      if (!isLangGraphInterrupt(error)) return { resumed: false, error: error instanceof Error ? error.message : "Workflow resume failed" };
+    }
+    const state = await this.getCheckpoint(input.sessionId);
+    return state ? { resumed: true, state } : { resumed: false, error: "Workflow checkpoint disappeared after resume" };
+  }
+  invalidate() {
+    this.graphVersion += 1;
+    this.compiled = void 0;
+  }
+  config(sessionId) {
+    return { configurable: { thread_id: sessionId } };
+  }
+  ensureCompiled() {
+    if (this.compiled && this.compiledVersion === this.graphVersion) return this.compiled;
+    if (!this.nodes.has(this.entryNode)) throw new Error(`Workflow entry node '${this.entryNode}' is not registered`);
+    const builder = new StateGraph(GraphState);
+    for (const [name, handler] of this.nodes) {
+      builder.addNode(name, async (state) => this.runNode(name, handler, state), this.nodeOptions.get(name));
+    }
+    builder.addNode("__eaos_approval__", async (state) => this.runApprovalNode(state));
+    builder.addEdge(START, this.entryNode);
+    for (const name of this.nodes.keys()) {
+      const route = this.conditionalRoutes.get(name);
+      const next = this.edges.get(name)?.[0] ?? END;
+      if (route) {
+        const destinations = [.../* @__PURE__ */ new Set([...route.destinations, "__eaos_approval__"])];
+        builder.addConditionalEdges(
+          name,
+          (state) => state.pendingApproval ? "__eaos_approval__" : routeToDestination(route, state),
+          destinations
+        );
+      } else {
+        const destinations = next === END ? [END, "__eaos_approval__"] : [next, "__eaos_approval__"];
+        builder.addConditionalEdges(name, (state) => state.pendingApproval ? "__eaos_approval__" : next, destinations);
+      }
+    }
+    const approvalDestinations = [...this.nodes.keys(), END, "__eaos_approval__"];
+    builder.addConditionalEdges("__eaos_approval__", (state) => state.pendingApproval ? "__eaos_approval__" : state.currentStep || END, approvalDestinations);
+    this.compiled = builder.compile({ checkpointer: this.checkpointer });
+    this.compiledVersion = this.graphVersion;
+    return this.compiled;
+  }
+  async runNode(name, handler, state) {
+    const update = await handler(toAgentState(state));
+    const nextState = { ...update, currentStep: update.currentStep ?? name };
+    if (nextState.pendingApproval) {
+      nextState.pendingApproval = this.bindApproval(state, nextState.pendingApproval);
+      nextState.isComplete = false;
+    } else if (!this.edges.get(name)?.length && !this.conditionalRoutes.has(name)) {
+      nextState.isComplete = true;
+    }
+    return nextState;
+  }
+  runApprovalNode(state) {
+    if (!state.pendingApproval) return { currentStep: END, isComplete: true };
+    const decision = interrupt({ type: "approval", pendingApproval: state.pendingApproval });
+    if (!decision || typeof decision.approved !== "boolean" || !decision.approverId || !decision.approverRole) throw new Error("Invalid approval decision");
+    const lastApproval = { ...decision, approvalId: state.pendingApproval.approvalId, bindingHash: state.pendingApproval.binding.bindingHash, decidedAt: (/* @__PURE__ */ new Date()).toISOString() };
+    if (!decision.approved) {
+      return {
+        pendingApproval: void 0,
+        lastApproval,
+        currentStep: END,
+        isComplete: true,
+        error: `Rejected by ${decision.approverRole} (${decision.approverId}): ${decision.comment || "No reason provided"}`
+      };
+    }
+    const next = this.edges.get(state.currentStep)?.[0] ?? END;
+    return {
+      pendingApproval: void 0,
+      lastApproval,
+      currentStep: state.context?.__eaosSubgraphResume ? state.currentStep : next,
+      isComplete: state.context?.__eaosSubgraphResume ? false : next === END,
+      context: state.context?.__eaosSubgraphResume ? { ...state.context, __eaosSubgraphResume: { ...state.context.__eaosSubgraphResume, decision } } : state.context,
+      history: [...state.history, { role: "human_approver", content: `Approved by ${decision.approverRole} (${decision.approverId})`, timestamp: (/* @__PURE__ */ new Date()).toISOString() }]
+    };
+  }
+  bindApproval(state, pending) {
+    const approvalId = pending.approvalId ?? randomUUID();
+    const binding = pending.binding ? validateApprovalBinding(pending.binding) : createApprovalBinding({
+      tenantId: state.tenantId,
+      requestedBy: state.userId,
+      operation: pending.toolName,
+      ...pending.target ? { target: pending.target } : {},
+      input: pending.args,
+      contract: {
+        operation: pending.toolName,
+        version: pending.contractVersion ?? "1.0.0",
+        /** Optional generated binding permission; defaults to toolName. */
+        permission: pending.permission ?? pending.toolName,
+        sideEffect: "external",
+        riskLevel: ["low", "medium", "high", "critical"].includes(pending.riskLevel) ? pending.riskLevel : "high",
+        approvalLevel: pending.approvalLevel,
+        inputSchema: { type: "object", additionalProperties: true }
+      }
+    });
+    if (binding.tenantId !== state.tenantId || binding.requestedBy !== state.userId || binding.operation !== pending.toolName) throw new Error("Approval binding does not match workflow state");
+    return { ...pending, approvalId, binding };
+  }
+};
+function isCheckpointSaver(value) {
+  return typeof value === "object" && value !== null && "getTuple" in value && "put" in value;
+}
+function routeToDestination(route, state) {
+  const destination = route.router(toAgentState(state));
+  if (!route.destinations.includes(destination)) throw new Error(`Workflow router returned undeclared destination '${destination}'`);
+  return destination;
+}
+function toAgentState(value) {
+  return structuredClone(value);
+}
+function isLangGraphInterrupt(error) {
+  return Boolean(error && typeof error === "object" && ("lc_error_code" in error && error.lc_error_code === "GRAPH_INTERRUPT" || error.constructor?.name === "GraphInterrupt"));
+}
+
+export {
+  AgentGraphEngine
+};
+//# sourceMappingURL=chunk-HXFVOR7Z.js.map

package/dist/chunk-HXFVOR7Z.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/agentic/graph.ts"],"sourcesContent":["import { Command, END, interrupt, MemorySaver, START, StateGraph, Annotation, type BaseCheckpointSaver, type RetryPolicy } from '@langchain/langgraph'\nimport { createApprovalBinding, validateApprovalBinding, type ApprovalBinding, type ApprovalLevel, type RiskLevel, type WorkflowGraphDescription, type WorkflowGraphEdgeInput, type WorkflowGraphNodeInput, type WorkflowGraphRuntimeSnapshot, type WorkflowGraphVisualization } from '@alneas/eaos-core'\nimport { randomUUID } from 'node:crypto'\n\n/**\n * Serializable workflow identity, history, context, and approval state persisted by the graph checkpointer.\n * @see AgentGraphEngine.runStep for a complete usage example.\n */\nexport interface AgentGraphState {\n  /** Host-authorized checkpoint thread ID. */\n  sessionId: string\n  /** Verified tenant that owns this workflow. */\n  tenantId: string\n  /** Verified requesting user, bound into generated approvals. */\n  userId: string\n  /** Current node identifier used for display and approval continuation. */\n  currentStep: string\n  /** Ordered conversation/history entries; returned history replaces rather than appends automatically. */\n  history: Array<{\n    /** Speaker/category label supplied by the host or runtime. */\n    role: string\n    /** Human-readable history text. */\n    content: string\n    /** ISO timestamp for runtime-generated entries; host entries are not validated here. */\n    timestamp: string\n  }>\n  /** Optional domain state merged by key; reserved __eaos keys belong to runtime internals. */\n  context?: Record<string, unknown>\n  /** Optional supporting source metadata carried through state. */\n  citations?: Array<{\n    /** Display title supplied by the citing node. */\n    title: string\n    /** Source identifier or URL supplied by the node. */\n    source: string\n    /** Host/model relevance score; this engine imposes no numeric range. */\n    score: number\n  }>\n  /** Optional pending human decision, bound to tenant/user/operation before checkpointing. */\n  pendingApproval?: {\n    /** Optional ticket ID; generated when absent during binding. */\n    approvalId?: string\n    /** Operation name bound to the approval and requested permission by default. */\n    toolName: string\n    /** Required human-approval level for the operation. */\n    approvalLevel: ApprovalLevel\n    /** Risk label; generated binding normalizes unknown labels to high. */\n    riskLevel: string\n    /** Human-readable approval justification, visible in runtime overlays. */\n    reason: string\n    /** Operation input used to construct the approval binding. */\n    args: Record<string, unknown>\n    /** Optional prebuilt binding validated against workflow tenant/user/operation. */\n    binding?: ApprovalBinding\n    /** Optional resource identity and revision included in generated binding. */\n    target?: {\n      /** Resource category included in the approval binding. */\n      type: string\n      /** Resource identifier included in the approval binding. */\n      id: string\n      /** Optional expected resource revision for host approval/admission. */\n      revision?: number\n    }\n    /** Optional generated binding contract version; defaults to 1.0.0. */\n    contractVersion?: string\n    /** Optional generated binding permission; defaults to toolName. */\n    permission?: string\n  }\n  /** Optional host checkpoint revision metadata; this engine does not increment it itself. */\n  checkpointRevision?: number\n  /** Optional last decision plus approval ID, binding hash, and ISO decision timestamp. */\n  lastApproval?: GraphApprovalDecision & { \n  /**\n   * Identity of the pending review ticket consumed by this completed approval decision.\n   */\n  approvalId: string; \n  /**\n   * Exact approved request/contract binding hash copied from the consumed pending approval.\n   */\n  bindingHash: string; \n  /**\n   * ISO timestamp generated when the graph processes the resumed review decision.\n   */\n  decidedAt: string }\n  /** True when execution has completed or a decision rejected the workflow. */\n  isComplete: boolean\n  /** Optional domain/runtime failure description included in runtime display overlays. */\n  error?: string\n}\n\n/**\n * Async node operation receiving an isolated graph-state clone and returning partial state updates.\n * @param state - Current graph state; mutating it alone does not persist changes unless returned.\n * @returns Partial update; context is merged, while supplied history replaces the existing history.\n * @throws Handler failures propagate through LangGraph retry policy and graph execution.\n * @see AgentGraphEngine.addNode for a complete example.\n */\nexport type GraphNodeHandler = (state: AgentGraphState) => Promise<Partial<AgentGraphState>>\n/**\n * Synchronous conditional route selector over a cloned graph state.\n * @param state - Current state after the source node has run.\n * @returns One exact declared destination name; undeclared destinations fail execution.\n * @see AgentGraphEngine.addConditionalEdges for a complete example.\n */\nexport type GraphRouter = (state: AgentGraphState) => string\n\n/** Minimal boundary for a compiled LangGraph subgraph. The plugin owns its state schema.\n * @see AgentGraphEngine.addSubgraph for setup and usage.\n */\nexport interface GraphSubgraph {\n  /**\n   * Invokes the compiled child graph.\n   * @param input - Host-mapped child input.\n   * @param config - Parent-supplied checkpoint thread/namespace configuration.\n   * @returns Child output, interpreted by the parent mapOutput callback.\n   * @throws Child execution/checkpoint failures propagate or can be mapped for recognized interrupts.\n   \n   * @example\n   * ```typescript\n   * import type { GraphSubgraph } from \"@alneas/eaos-server\";\n   * export async function invokeHostSubgraph(\n   *   subgraph: GraphSubgraph,\n   *   input: Parameters<GraphSubgraph[\"invoke\"]>[0],\n   *   config: Parameters<GraphSubgraph[\"invoke\"]>[1],\n   * ) {\n   *   // Supply the host's admitted input and checkpoint/thread configuration.\n   *   return await subgraph.invoke(input, config);\n   * }\n   * ```\n   */\n  invoke(input: unknown, config?: unknown): Promise<unknown>\n  /**\n * Inspects child state when a recognized interrupt needs mapping.\n * @param config - Child checkpoint thread/namespace configuration.\n * @returns Host-specific child checkpoint state.\n * @throws Inspection failures propagate to parent execution.\n \n   * @example\n   * ```typescript\n   * import type { GraphSubgraph } from \"@alneas/eaos-server\";\n   * export async function inspectHostSubgraph(\n   *   subgraph: GraphSubgraph, config: Parameters<NonNullable<GraphSubgraph[\"getState\"]>>[0],\n   * ) {\n   *   if (!subgraph.getState) throw new Error(\"Subgraph state inspection is unavailable\");\n   *   return await subgraph.getState(config);\n   * }\n   * ```\n   */\n  getState?(config?: unknown): Promise<unknown>\n  /**\n * Continues a child after a verified parent approval.\n * @param input - Host-mapped child input.\n * @param decision - Parent-approved human decision.\n * @param config - Child checkpoint thread/namespace configuration.\n * @returns Resumed child output.\n * @throws Child execution/checkpoint failures propagate.\n \n   * @example\n   * ```typescript\n   * import type { GraphSubgraph } from \"@alneas/eaos-server\";\n   * export async function resumeHostSubgraph(\n   *   subgraph: GraphSubgraph,\n   *   input: Parameters<NonNullable<GraphSubgraph[\"resume\"]>>[0],\n   *   verifiedDecision: Parameters<NonNullable<GraphSubgraph[\"resume\"]>>[1],\n   *   config: Parameters<NonNullable<GraphSubgraph[\"resume\"]>>[2],\n   * ) {\n   *   if (!subgraph.resume) throw new Error(\"Subgraph resumption is unavailable\");\n   *   // The host authenticates/authorizes this decision before entering the subgraph.\n   *   return await subgraph.resume(input, verifiedDecision, config);\n   * }\n   * ```\n   */\n  resume?(input: unknown, decision: GraphApprovalDecision, config?: unknown): Promise<unknown>\n}\n\n/**\n * Host-verified human decision supplied to a pending graph approval.\n * @see AgentGraphEngine.resumeAfterApproval.\n */\nexport interface GraphApprovalDecision {\n  /** True to continue; false to finish with a rejection error. */\n  approved: boolean\n  /** Authenticated human approver identifier. */\n  approverId: string\n  /** Verified role associated with the decision. */\n  approverRole: string\n  /** Optional human note; rejection uses a default description when blank. */\n  comment?: string\n}\n\n/**\n * Explicit state mapping, child-thread identity, and interrupt translation for {@link AgentGraphEngine.addSubgraph}.\n */\nexport interface GraphSubgraphOptions {\n  /** Optional synchronous parent-state to child-input mapping; defaults to passing parent state. */\n  mapInput?: (state: AgentGraphState) => unknown\n  /** Optional synchronous child-output/parent-state to update mapping; absent treats output as a partial parent state. */\n  mapOutput?: (output: unknown, state: AgentGraphState) => Partial<AgentGraphState>\n  /** Optional synchronous child thread ID builder; defaults to sessionId:name and must be nonblank. */\n  threadId?: (state: AgentGraphState) => string\n  /** Called for a recognized nested LangGraph interrupt with error, parent state, and optional child checkpoint; resolves a parent update, normally pendingApproval. Errors propagate. */\n  mapInterrupted?: (error: unknown, state: AgentGraphState, subgraphState: unknown) => Partial<AgentGraphState> | Promise<Partial<AgentGraphState>>\n  /** Serializable metadata used by workflow viewers; never executed. */\n  visual?: WorkflowGraphNodeInput\n}\n\n/**\n * Checkpoint persistence, live approval authority, and workflow metadata for {@link AgentGraphEngine}.\n */\nexport interface AgentGraphEngineOptions {\n  /** Host-owned live membership/lifecycle/resource re-check at resume time. */\n  authorizeResume?: (state: AgentGraphState, input: {\n  /**\n   * Nonblank authenticated approver identifier supplied by the host.\n   */\n  approverId: string;\n  /**\n   * Nonblank verified role associated with this human decision.\n   */\n  approverRole: string;\n  /**\n   * True requests continuation and requires a current authorizer; false rejects the workflow but is also checked when an authorizer exists.\n   */\n  approved: boolean }) => Promise<boolean>\n  /** Official LangGraph checkpointer. MemorySaver is local/test-only when omitted. */\n  checkpointer?: BaseCheckpointSaver\n  /** Stable identity shown by workflow viewers and exported graph documents. */\n  workflowId?: string\n  /** Optional workflow version included in graph descriptions. */\n  workflowVersion?: string\n}\n\n/**\n * Execution retry and display settings for {@link AgentGraphEngine.addNode}.\n */\nexport interface GraphNodeOptions {\n  /** Optional LangGraph retry settings; retries can repeat handler side effects and must be safe by host design. */\n  retryPolicy?: RetryPolicy\n  /** Serializable metadata used by workflow viewers; never executed. */\n  visual?: WorkflowGraphNodeInput\n}\n\n/**\n * Serializable display metadata for {@link AgentGraphEngine.addEdge}.\n */\nexport interface GraphEdgeOptions {\n  /** Serializable metadata used by workflow viewers; never executed. */\n  visual?: WorkflowGraphEdgeInput\n}\n\n/**\n * Display metadata for declared branches in {@link AgentGraphEngine.addConditionalEdges}.\n */\nexport interface GraphConditionalEdgeOptions extends GraphEdgeOptions {\n  /** Per-destination labels such as `approved` or `needs_correction`. */\n  labels?: Readonly<Record<string, string>>\n}\n\ninterface ConditionalRoute {\n  router: GraphRouter\n  destinations: string[]\n  visual?: GraphConditionalEdgeOptions\n}\n\ntype RuntimeState = AgentGraphState\n\nconst GraphState = Annotation.Root({\n  sessionId: Annotation<string>,\n  tenantId: Annotation<string>,\n  userId: Annotation<string>,\n  currentStep: Annotation<string>,\n  history: Annotation<AgentGraphState['history']>({ reducer: (_left, right) => right, default: () => [] }),\n  context: Annotation<Record<string, unknown> | undefined>({\n    reducer: (left, right) => {\n      if (right === undefined) return left\n      const merged = { ...left, ...right }\n      if (merged.__eaosSubgraphResume === null) delete merged.__eaosSubgraphResume\n      return merged\n    },\n    default: () => undefined,\n  }),\n  citations: Annotation<AgentGraphState['citations']>,\n  pendingApproval: Annotation<AgentGraphState['pendingApproval']>,\n  checkpointRevision: Annotation<number | undefined>,\n  lastApproval: Annotation<AgentGraphState['lastApproval']>,\n  isComplete: Annotation<boolean>,\n  error: Annotation<string | undefined>,\n})\n\n/**\n * EAOS workflow runtime backed by the official LangGraph StateGraph.\n * EAOS remains responsible for authorization, approval bindings and side effects.\n * @remarks The default MemorySaver is process-local/test storage. Production hosts must supply durable, tenant-scoped checkpoint persistence, verified initial identity, live resume authorization, and writer serialization. This class does not serialize concurrent calls for the same session or implement transactional side effects. Mutating topology invalidates the compiled graph; configure it before starting workflow sessions.\n * @example\n * ```typescript\n * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n * const graph = new AgentGraphEngine();\n * graph.addNode(\"start\", async () => ({ isComplete: true }));\n * console.log(graph.describe().entryNode); // \"start\"\n * ```\n */\nexport class AgentGraphEngine {\n  private readonly nodes = new Map<string, GraphNodeHandler>()\n  private readonly edges = new Map<string, string[]>()\n  private readonly edgeVisuals = new Map<string, WorkflowGraphEdgeInput[]>()\n  private readonly nodeOptions = new Map<string, GraphNodeOptions>()\n  private readonly conditionalRoutes = new Map<string, ConditionalRoute>()\n  private readonly checkpointer: BaseCheckpointSaver\n  private readonly authorizeResume?: AgentGraphEngineOptions['authorizeResume']\n  private readonly workflowId?: string\n  private readonly workflowVersion?: string\n  private entryNode = 'start'\n  private compiled?: ReturnType<StateGraph<typeof GraphState, RuntimeState, Partial<RuntimeState>, string>['compile']>\n  private graphVersion = 0\n  private compiledVersion = -1\n\n  /**\n   * Creates a graph builder with a host saver or options; compilation is deferred until execution/checkpoint reads.\n   * @param checkpointerOrOptions - LangGraph saver or options; omission uses an independent MemorySaver.\n   * @param options - Additional options used only when the first argument is a saver; otherwise ignored.\n   */\n  constructor(\n    checkpointerOrOptions: BaseCheckpointSaver | AgentGraphEngineOptions = {},\n    options: AgentGraphEngineOptions = {},\n  ) {\n    const supplied = isCheckpointSaver(checkpointerOrOptions)\n      ? { ...options, checkpointer: checkpointerOrOptions }\n      : checkpointerOrOptions\n    this.checkpointer = supplied.checkpointer ?? new MemorySaver()\n    this.authorizeResume = supplied.authorizeResume\n    this.workflowId = supplied.workflowId\n    this.workflowVersion = supplied.workflowVersion\n  }\n\n  /**\n   * Registers or replaces a named handler and invalidates compiled topology.\n   * @param name - Nonblank node name; __eaos_approval__ is reserved. Names are retained without trimming.\n   * @param handler - Async callback receiving a cloned state and resolving partial state updates.\n   * @param options - Optional LangGraph retry policy and serializable display metadata.\n   * @returns This builder for chaining.\n   * @throws For blank/reserved names; handler failures occur later during execution.\n   * @example\n   * ```typescript\n   * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n   * const graph = new AgentGraphEngine();\n   * graph.addNode(\"start\", async () => ({ isComplete: true }));\n   * graph.addNode(\"finish\", async () => ({ isComplete: true }));\n   * ```\n   */\n  addNode(name: string, handler: GraphNodeHandler, options: GraphNodeOptions = {}): this {\n    if (!name.trim() || name === '__eaos_approval__') throw new Error('Invalid workflow node name')\n    this.nodes.set(name, handler)\n    this.nodeOptions.set(name, options)\n    this.invalidate()\n    return this\n  }\n\n  /**\n   * Mount a plugin-owned compiled LangGraph as one parent-graph node.\n   * Input/output mapping is explicit so plugin state does not silently leak into\n   * the EAOS state, while the nested graph still gets its own checkpoint thread.\n   * @param name - Parent node identifier, subject to addNode validation.\n   * @param subgraph - Compiled graph with invoke and optional state/resume capabilities.\n   * @param options - Input/output mapping and child-thread identity; defaults pass state/output through and use sessionId:name as thread ID.\n   * @returns This graph builder.\n   * @throws If subgraph lacks invoke or the name is invalid. Execution propagates mapping/subgraph errors except recognized interrupts handled by mapInterrupted.\n   * @remarks Child config uses checkpoint_ns=name. A mapped interrupt stores resume metadata in context; host mappings must preserve tenant boundaries and avoid leaking child state.\n   * @example\n   * ```typescript\n   * import { AgentGraphEngine, type GraphSubgraph } from \"@alneas/eaos-server/agentic/graph\";\n   * export function nested(subgraph: GraphSubgraph) {\n   *   return new AgentGraphEngine().addSubgraph(\"start\", subgraph, { mapOutput: output => ({ context: { child: output } }) });\n   * }\n   * ```\n   */\n  addSubgraph(name: string, subgraph: GraphSubgraph, options: GraphSubgraphOptions = {}): this {\n    if (!subgraph || typeof subgraph.invoke !== 'function') throw new Error('Compiled workflow subgraph is required')\n    return this.addNode(name, async state => {\n      const input = options.mapInput ? options.mapInput(state) : state\n      const threadId = options.threadId?.(state) ?? `${state.sessionId}:${name}`\n      if (!threadId.trim()) throw new Error('Subgraph thread id is required')\n      const config = { configurable: { thread_id: threadId, checkpoint_ns: name } }\n      const resume = state.context?.__eaosSubgraphResume as { node?: string; decision?: GraphApprovalDecision } | undefined\n      let output: unknown\n      try {\n        output = resume?.node === name && resume.decision && subgraph.resume\n          ? await subgraph.resume(input, resume.decision, config)\n          : await subgraph.invoke(input, config)\n      } catch (error) {\n        if (!options.mapInterrupted || !isLangGraphInterrupt(error)) throw error\n        const subgraphState = subgraph.getState ? await subgraph.getState(config) : undefined\n        const mapped = await options.mapInterrupted(error, state, subgraphState)\n        return { ...mapped, context: { ...mapped.context, __eaosSubgraphResume: { node: name } } }\n      }\n      const context = { ...(state.context ?? {}) }\n      if (context.__eaosSubgraphResume) context.__eaosSubgraphResume = null\n      const mapped = options.mapOutput ? options.mapOutput(output, state) : (output as Partial<AgentGraphState>)\n      return { ...mapped, context: { ...context, ...(mapped.context ?? {}) } }\n    }, { visual: options.visual ?? { kind: 'subgraph', label: name } })\n  }\n\n  /**\n   * Adds a declared edge and its display metadata.\n   * @param from - Nonblank source node name.\n   * @param to - Nonblank destination node name.\n   * @param options - Optional serializable display metadata, cloned on insertion.\n   * @returns This graph builder.\n   * @throws For blank endpoints or uncloneable display metadata. Missing node references can fail compilation later.\n   * @remarks Without conditional routing, execution follows only the first declared outgoing edge; describe may list additional declared edges.\n   * @example\n   * ```typescript\n   * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n   * const graph = new AgentGraphEngine();\n   * graph.addNode(\"start\", async () => ({ isComplete: true }));\n   * graph.addNode(\"finish\", async () => ({}));\n   * graph.addEdge(\"start\", \"finish\");\n   * ```\n   */\n  addEdge(from: string, to: string, options: GraphEdgeOptions = {}): this {\n    if (!from.trim() || !to.trim()) throw new Error('Invalid workflow edge')\n    this.edges.set(from, [...this.edges.get(from) ?? [], to])\n    this.edgeVisuals.set(from, [...this.edgeVisuals.get(from) ?? [], structuredClone(options.visual ?? {})])\n    this.invalidate()\n    return this\n  }\n\n  /**\n * Sets a source node's conditional router and complete allowed destination set.\n * @param from - Nonblank source node name.\n * @param router - Called synchronously after the node with a state clone; must return one declared destination.\n * @param destinations - Nonempty list of nonblank destination names; duplicates are collapsed.\n * @param options - Cloned optional edge metadata and destination labels.\n * @returns This graph builder.\n * @throws For invalid source/destinations or uncloneable options; runtime routing rejects undeclared destinations and callback errors.\n * @remarks A pending approval overrides conditional routing and enters the approval node. This replaces an existing conditional route for from.\n * @example\n * ```typescript\n * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n * const graph = new AgentGraphEngine();\n * graph.addNode(\"start\", async () => ({ isComplete: true }));\n * graph.addNode(\"finish\", async () => ({}));\n * graph.addConditionalEdges(\"start\", () => \"finish\", [\"finish\"]);\n * ```\n */\n  addConditionalEdges(from: string, router: GraphRouter, destinations: string[], options: GraphConditionalEdgeOptions = {}): this {\n    if (!from.trim() || !destinations.length || destinations.some(destination => !destination.trim())) throw new Error('Invalid conditional workflow route')\n    this.conditionalRoutes.set(from, { router, destinations: [...new Set(destinations)], visual: structuredClone(options) })\n    this.invalidate()\n    return this\n  }\n\n  /**\n   * Selects the registered node where future graph execution starts.\n   * @param nodeName - Nonblank node name; existence is checked on deferred compilation.\n   * @returns This builder after invalidating compiled topology.\n   * @throws For a blank name; missing entry registration fails later on compilation.\n   * @example\n   * ```typescript\n   * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n   * const graph = new AgentGraphEngine();\n   * graph.addNode(\"start\", async () => ({ isComplete: true }));\n   * graph.setEntryPoint(\"start\");\n   * ```\n   */\n  setEntryPoint(nodeName: string): this {\n    if (!nodeName.trim()) throw new Error('Invalid workflow entry node')\n    this.entryNode = nodeName\n    this.invalidate()\n    return this\n  }\n\n  /**\n   * Reads the first statically declared outgoing edge without evaluating conditional routing.\n   * @param fromNode - Exact source node identifier.\n   * @returns First declared destination, or undefined when no static edge exists.\n   * @example\n   * ```typescript\n   * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n   * const graph = new AgentGraphEngine();\n   * graph.addNode(\"start\", async () => ({ isComplete: true }));\n   * console.log(graph.getNextNode(\"start\")); // undefined\n   * ```\n   */\n  getNextNode(fromNode: string): string | undefined {\n    return this.edges.get(fromNode)?.[0]\n  }\n\n  /**\n   * Return a serializable graph description for UI/API/diagram consumers.\n   * Handlers and router functions are intentionally omitted: this is metadata,\n   * not a remotely executable workflow definition.\n   * @returns A structured clone of versioned node/edge display metadata in insertion order; may describe an incomplete graph before compilation.\n   * @throws If retained metadata has become uncloneable.\n   * @example\n   * ```typescript\n   * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n   * const graph = new AgentGraphEngine();\n   * graph.addNode(\"start\", async () => ({ isComplete: true }));\n   * console.log(graph.describe().nodes.length); // 1\n   * ```\n   */\n  describe(): WorkflowGraphDescription {\n    const nodes = [...this.nodes.keys()].map(id => {\n      const visual = this.nodeOptions.get(id)?.visual ?? {}\n      return {\n        id,\n        kind: visual.kind ?? 'task',\n        label: visual.label?.trim() || id,\n        ...(visual.description === undefined ? {} : { description: visual.description }),\n        ...(visual.pluginId === undefined ? {} : { pluginId: visual.pluginId }),\n        ...(visual.approvalLevel === undefined ? {} : { approvalLevel: visual.approvalLevel }),\n        ...(visual.riskLevel === undefined ? {} : { riskLevel: visual.riskLevel }),\n        ...(visual.toolName === undefined ? {} : { toolName: visual.toolName }),\n        canRequestApproval: visual.canRequestApproval ?? true,\n        ...(visual.retryable === undefined ? {} : { retryable: visual.retryable }),\n        ...(visual.subgraphId === undefined ? {} : { subgraphId: visual.subgraphId }),\n        ...(visual.subgraphVersion === undefined ? {} : { subgraphVersion: visual.subgraphVersion }),\n      }\n    })\n    const edges = [] as WorkflowGraphDescription['edges'][number][]\n    for (const [from, destinations] of this.edges) {\n      if (this.conditionalRoutes.has(from)) continue\n      destinations.forEach((to, index) => {\n        const visual = this.edgeVisuals.get(from)?.[index] ?? {}\n        edges.push({ from, to, kind: visual.kind ?? 'normal', ...(visual.label === undefined ? {} : { label: visual.label }), ...(visual.condition === undefined ? {} : { condition: visual.condition }) })\n      })\n    }\n    for (const [from, route] of this.conditionalRoutes) {\n      for (const to of route.destinations) {\n        const visual = route.visual?.visual ?? {}\n        const label = route.visual?.labels?.[to] ?? visual.label\n        edges.push({ from, to, kind: visual.kind ?? 'conditional', ...(label === undefined ? {} : { label }), ...(visual.condition === undefined ? {} : { condition: visual.condition }) })\n      }\n    }\n    return structuredClone({ schemaVersion: '1.0' as const, ...(this.workflowId ? { workflowId: this.workflowId } : {}), ...(this.workflowVersion ? { workflowVersion: this.workflowVersion } : {}), entryNode: this.entryNode, nodes, edges })\n  }\n\n  /**\n * Extracts runtime status and approval display metadata without history, context, or approval args.\n * @param state - Authorized checkpoint state to summarize.\n * @returns Status prioritized as waiting_approval, failed, completed, running, then idle, plus current node/revision and optional error/approval display details.\n * @remarks Reasons and errors remain visible; the host must control their content and authorize access to this overlay.\n * @example\n * ```typescript\n * import { AgentGraphEngine, type AgentGraphState } from \"@alneas/eaos-server/agentic/graph\";\n * export function overlay(state: AgentGraphState) {\n *   return new AgentGraphEngine().describeRuntime(state);\n * }\n * ```\n */\n  describeRuntime(state: AgentGraphState): WorkflowGraphRuntimeSnapshot {\n    const status: WorkflowGraphRuntimeSnapshot['status'] = state.pendingApproval ? 'waiting_approval' : state.error ? 'failed' : state.isComplete ? 'completed' : state.currentStep ? 'running' : 'idle'\n    return {\n      status,\n      ...(state.currentStep && state.currentStep !== END ? { currentNodeId: state.currentStep } : {}),\n      ...(state.checkpointRevision === undefined ? {} : { checkpointRevision: state.checkpointRevision }),\n      ...(state.pendingApproval ? {\n        pendingApproval: {\n          ...(state.pendingApproval.approvalId === undefined ? {} : { approvalId: state.pendingApproval.approvalId }),\n          toolName: state.pendingApproval.toolName,\n          approvalLevel: state.pendingApproval.approvalLevel,\n          riskLevel: state.pendingApproval.riskLevel,\n          reason: state.pendingApproval.reason,\n        },\n      } : {}),\n      ...(state.error === undefined ? {} : { error: state.error }),\n    }\n  }\n\n  /**\n * Reads a session checkpoint and combines its display overlay with the current static graph.\n * @param sessionId - Authorized host session/thread identifier.\n * @returns Graph description and runtime overlay when a checkpoint exists, or only graph metadata otherwise.\n * @throws Rejects compilation, saver, or description failures.\n * @remarks This method does not authenticate the caller or authorize session access.\n * @example\n * ```typescript\n * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n * const graph = new AgentGraphEngine();\n * graph.addNode(\"start\", async () => ({ isComplete: true }));\n * const visualization = await graph.getVisualization(\"example-session\");\n * console.log(visualization.graph.nodes.length);\n * ```\n */\n  async getVisualization(sessionId: string): Promise<WorkflowGraphVisualization> {\n    const state = await this.getCheckpoint(sessionId)\n    return { graph: this.describe(), ...(state ? { runtime: this.describeRuntime(state) } : {}) }\n  }\n\n  /**\n   * Reads the current saved state for one graph session.\n   * @param sessionId - Authorized LangGraph thread ID.\n   * @returns A structured clone of persisted state, or null when no session state exists.\n   * @throws Rejects deferred compilation, saver, or clone failures.\n   * @remarks The host authorizes tenant/session access; sessionId alone is not an authentication claim.\n   * @example\n   * ```typescript\n   * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n   * const graph = new AgentGraphEngine();\n   * graph.addNode(\"start\", async () => ({ isComplete: true }));\n   * console.log(await graph.getCheckpoint(\"example-session\")); // null\n   * ```\n   */\n  async getCheckpoint(sessionId: string): Promise<AgentGraphState | null> {\n    const snapshot = await this.ensureCompiled().getState(this.config(sessionId))\n    return snapshot.values && typeof snapshot.values === 'object' && 'sessionId' in snapshot.values\n      ? toAgentState(snapshot.values as RuntimeState)\n      : null\n  }\n\n  /**\n * Runs the graph until completion or a LangGraph approval interrupt.\n * @param initialState - Verified host session/tenant/user state; a nonblank sessionId is required. Existing pendingApproval returns an immediate clone without invoking the graph.\n * @returns Latest checkpoint state after execution, interrupted approval state, or the supplied initial state when no checkpoint is available.\n * @throws Rejects invalid sessionId, compilation, handler/retry, saver, binding, or clone errors except recognized approval interrupts.\n * @remarks This method runs multiple nodes, despite its name. The host must serialize writers and make retried handlers safe for side effects. It installs no timeout or cancellation itself.\n * @example\n * ```typescript\n * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n * const graph = new AgentGraphEngine();\n * graph.addNode(\"start\", async () => ({ isComplete: true }));\n * const state = await graph.runStep({ sessionId: \"example-session\", tenantId: \"example\", userId: \"example-user\", currentStep: \"start\", history: [], isComplete: false });\n * console.log(state.isComplete); // true\n * ```\n */\n  async runStep(initialState: AgentGraphState): Promise<AgentGraphState> {\n    if (!initialState?.sessionId?.trim()) throw new Error('Workflow sessionId is required')\n    if (initialState.pendingApproval) return structuredClone(initialState)\n    try {\n      await this.ensureCompiled().invoke(initialState as RuntimeState, this.config(initialState.sessionId))\n    } catch (error) {\n      const interrupted = await this.getCheckpoint(initialState.sessionId)\n      if (interrupted?.pendingApproval && isLangGraphInterrupt(error)) return interrupted\n      throw error\n    }\n    return (await this.getCheckpoint(initialState.sessionId)) ?? initialState\n  }\n\n  /**\n * Validates a pending approval binding and host authority before resuming its LangGraph thread.\n * @param input - Session ID, verified approver ID/role, boolean decision, optional comment, optional expected approvalId/bindingHash, and optional live authorizer overriding constructor settings.\n * @returns Resumed state on success, or resumed:false with an error for absent/mismatched approval, denied authorization, or normalized invocation failure. A denial decision completes the graph as rejected.\n * @throws Can reject saver/compilation errors, live authorizer rejection, or post-resume checkpoint failures.\n * @remarks An approved decision requires a live authorizer returning exactly true; a supplied authorizer also checks rejection decisions. Host writer serialization is required: this method does not acquire an independent lock or compare-and-swap checkpoint revisions. Missing optional expected IDs skip those comparisons. Resume failures can follow side effects; no rollback or automatic retry occurs.\n * @example\n * ```typescript\n * import { AgentGraphEngine } from \"@alneas/eaos-server/agentic/graph\";\n * export async function decide(graph: AgentGraphEngine, input: Parameters<AgentGraphEngine[\"resumeAfterApproval\"]>[0]) {\n *   // Authenticate the approver and supply live authorization before approving.\n *   return graph.resumeAfterApproval(input);\n * }\n * ```\n */\n  async resumeAfterApproval(input: {\n    \n    /**\n     * LangGraph thread/session identity whose saved pending approval is loaded and resumed.\n     */\n    sessionId: string\n    \n    /**\n     * Optional expected ticket identity; when truthy it must equal the saved pending ticket, while omission skips this comparison.\n     */\n    approvalId?: string\n    \n    /**\n     * Optional expected request/contract binding hash; when truthy it must match the saved binding, while omission skips this comparison.\n     */\n    bindingHash?: string\n    \n    /**\n     * Verified review decision; true requires live authorization returning exactly true, while false resumes the graph as rejected.\n     */\n    approved: boolean\n    \n    /**\n     * Nonblank host-verified reviewer identity supplied to the live authorizer and recorded in lastApproval.\n     */\n    approverId: string\n    \n    /**\n     * Nonblank host-verified reviewer role supplied to the live authorizer and recorded in lastApproval.\n     */\n    approverRole: string\n    \n    /**\n     * Optional reviewer comment retained in the graph decision; the host owns content/privacy policy.\n     */\n    comment?: string\n    \n    /**\n     * Optional live reviewer-authority callback overriding the constructor authorizer for this resume attempt.\n     * @remarks Uses AgentGraphEngineOptions.authorizeResume: receives a cloned checkpoint and reviewer/decision metadata, resolves exactly true to permit resumption, and may reject. Required from either source for approved=true; when supplied it also checks rejected decisions. Omission uses the constructor callback.\n     * @see {@link AgentGraphEngineOptions.authorizeResume}\n     */\n    authorizeResume?: AgentGraphEngineOptions['authorizeResume']\n  }): Promise<{ \n  /** True when verification/resumption reaches a readable checkpoint, including a resumed rejection decision; false on normalized failures and not proof that no side effect occurred. */\n  resumed: boolean; \n  /** Graph state loaded after resumption when available; may represent completion, rejection or another pending interrupt rather than final workflow success. */\n  state?: AgentGraphState; \n  /** Optional explanation for a missing/mismatched approval, denied authority, invocation failure or disappeared checkpoint; some saver/authorizer errors reject instead. */\n  error?: string }> {\n    const graph = this.ensureCompiled()\n    const checkpoint = await this.getCheckpoint(input.sessionId)\n    if (!checkpoint) return { resumed: false, error: `Workflow session '${input.sessionId}' not found` }\n    const pending = checkpoint.pendingApproval\n    if (!pending) return { resumed: false, error: 'Workflow is not awaiting approval' }\n    try {\n      if (input.approvalId && input.approvalId !== pending.approvalId) return { resumed: false, error: 'Approval ticket does not match workflow state' }\n      if (!pending.binding || (input.bindingHash && input.bindingHash !== pending.binding.bindingHash)) return { resumed: false, error: 'Approval binding does not match workflow state' }\n      validateApprovalBinding(pending.binding)\n    } catch (error) {\n      return { resumed: false, error: error instanceof Error ? error.message : 'Invalid approval binding' }\n    }\n    if (!input.approverId.trim() || !input.approverRole.trim()) return { resumed: false, error: 'Approver identity is required' }\n    const authorizeResume = input.authorizeResume ?? this.authorizeResume\n    if (input.approved && !authorizeResume) return { resumed: false, error: 'Current authorization verifier is required before workflow resume' }\n    if (authorizeResume && await authorizeResume(structuredClone(checkpoint), { approverId: input.approverId, approverRole: input.approverRole, approved: input.approved }) !== true) return { resumed: false, error: 'Current authorization no longer permits workflow resume' }\n\n    const decision: GraphApprovalDecision = { approved: input.approved, approverId: input.approverId, approverRole: input.approverRole, comment: input.comment }\n    try {\n      await graph.invoke(new Command({ resume: decision }), this.config(input.sessionId))\n    } catch (error) {\n      if (!isLangGraphInterrupt(error)) return { resumed: false, error: error instanceof Error ? error.message : 'Workflow resume failed' }\n    }\n    const state = await this.getCheckpoint(input.sessionId)\n    return state ? { resumed: true, state } : { resumed: false, error: 'Workflow checkpoint disappeared after resume' }\n  }\n\n  private invalidate() {\n    this.graphVersion += 1\n    this.compiled = undefined\n  }\n\n  private config(sessionId: string) {\n    return { configurable: { thread_id: sessionId } }\n  }\n\n  private ensureCompiled() {\n    if (this.compiled && this.compiledVersion === this.graphVersion) return this.compiled\n    if (!this.nodes.has(this.entryNode)) throw new Error(`Workflow entry node '${this.entryNode}' is not registered`)\n\n    const builder = new StateGraph<typeof GraphState, RuntimeState, Partial<RuntimeState>, string>(GraphState)\n    for (const [name, handler] of this.nodes) {\n      builder.addNode(name, async (state) => this.runNode(name, handler, state as RuntimeState), this.nodeOptions.get(name))\n    }\n    builder.addNode('__eaos_approval__', async (state) => this.runApprovalNode(state as RuntimeState))\n    builder.addEdge(START, this.entryNode)\n\n    for (const name of this.nodes.keys()) {\n      const route = this.conditionalRoutes.get(name)\n      const next = this.edges.get(name)?.[0] ?? END\n      if (route) {\n        const destinations = [...new Set([...route.destinations, '__eaos_approval__'])]\n        builder.addConditionalEdges(\n          name,\n          state => state.pendingApproval ? '__eaos_approval__' : routeToDestination(route, state as RuntimeState),\n          destinations,\n        )\n      } else {\n        const destinations = next === END ? [END, '__eaos_approval__'] : [next, '__eaos_approval__']\n        builder.addConditionalEdges(name, state => (state.pendingApproval ? '__eaos_approval__' : next), destinations)\n      }\n    }\n    const approvalDestinations = [...this.nodes.keys(), END, '__eaos_approval__']\n    builder.addConditionalEdges('__eaos_approval__', state => state.pendingApproval ? '__eaos_approval__' : (state.currentStep || END), approvalDestinations)\n\n    this.compiled = builder.compile({ checkpointer: this.checkpointer })\n    this.compiledVersion = this.graphVersion\n    return this.compiled\n  }\n\n  private async runNode(name: string, handler: GraphNodeHandler, state: RuntimeState) {\n    const update = await handler(toAgentState(state))\n    const nextState: Partial<RuntimeState> = { ...update, currentStep: update.currentStep ?? name }\n    if (nextState.pendingApproval) {\n      nextState.pendingApproval = this.bindApproval(state, nextState.pendingApproval)\n      nextState.isComplete = false\n    } else if (!this.edges.get(name)?.length && !this.conditionalRoutes.has(name)) {\n      nextState.isComplete = true\n    }\n    return nextState\n  }\n\n  private runApprovalNode(state: RuntimeState) {\n    if (!state.pendingApproval) return { currentStep: END, isComplete: true }\n    const decision = interrupt({ type: 'approval', pendingApproval: state.pendingApproval }) as { approved?: boolean; approverId?: string; approverRole?: string; comment?: string }\n    if (!decision || typeof decision.approved !== 'boolean' || !decision.approverId || !decision.approverRole) throw new Error('Invalid approval decision')\n    const lastApproval = { ...decision, approvalId: state.pendingApproval.approvalId!, bindingHash: state.pendingApproval.binding!.bindingHash, decidedAt: new Date().toISOString() }\n    if (!decision.approved) {\n      return {\n        pendingApproval: undefined,\n        lastApproval,\n        currentStep: END,\n        isComplete: true,\n        error: `Rejected by ${decision.approverRole} (${decision.approverId}): ${decision.comment || 'No reason provided'}`,\n      }\n    }\n    const next = this.edges.get(state.currentStep)?.[0] ?? END\n    return {\n      pendingApproval: undefined,\n      lastApproval,\n        currentStep: state.context?.__eaosSubgraphResume ? state.currentStep : next,\n        isComplete: state.context?.__eaosSubgraphResume ? false : next === END,\n        context: state.context?.__eaosSubgraphResume ? { ...state.context, __eaosSubgraphResume: { ...state.context.__eaosSubgraphResume as object, decision } } : state.context,\n      history: [...state.history, { role: 'human_approver', content: `Approved by ${decision.approverRole} (${decision.approverId})`, timestamp: new Date().toISOString() }],\n    }\n  }\n\n  private bindApproval(state: RuntimeState, pending: NonNullable<AgentGraphState['pendingApproval']>) {\n    const approvalId = pending.approvalId ?? randomUUID()\n    const binding = pending.binding ? validateApprovalBinding(pending.binding) : createApprovalBinding({\n      tenantId: state.tenantId,\n      requestedBy: state.userId,\n      operation: pending.toolName,\n      ...(pending.target ? { target: pending.target } : {}),\n      input: pending.args,\n      contract: {\n        operation: pending.toolName,\n        version: pending.contractVersion ?? '1.0.0',\n        /** Optional generated binding permission; defaults to toolName. */\n    permission: pending.permission ?? pending.toolName,\n        sideEffect: 'external',\n        riskLevel: (['low', 'medium', 'high', 'critical'].includes(pending.riskLevel) ? pending.riskLevel : 'high') as RiskLevel,\n        approvalLevel: pending.approvalLevel,\n        inputSchema: { type: 'object', additionalProperties: true },\n      },\n    })\n    if (binding.tenantId !== state.tenantId || binding.requestedBy !== state.userId || binding.operation !== pending.toolName) throw new Error('Approval binding does not match workflow state')\n    return { ...pending, approvalId, binding }\n  }\n}\n\nfunction isCheckpointSaver(value: BaseCheckpointSaver | AgentGraphEngineOptions): value is BaseCheckpointSaver {\n  return typeof value === 'object' && value !== null && 'getTuple' in value && 'put' in value\n}\n\nfunction routeToDestination(route: ConditionalRoute, state: RuntimeState): string {\n  const destination = route.router(toAgentState(state))\n  if (!route.destinations.includes(destination)) throw new Error(`Workflow router returned undeclared destination '${destination}'`)\n  return destination\n}\n\nfunction toAgentState(value: RuntimeState): AgentGraphState {\n  return structuredClone(value)\n}\n\nfunction isLangGraphInterrupt(error: unknown): boolean {\n  return Boolean(error && typeof error === 'object' && ('lc_error_code' in error && (error as { lc_error_code?: unknown }).lc_error_code === 'GRAPH_INTERRUPT' || error.constructor?.name === 'GraphInterrupt'))\n}\n"],"mappings":";AAAA,SAAS,SAAS,KAAK,WAAW,aAAa,OAAO,YAAY,kBAA8D;AAChI,SAAS,uBAAuB,+BAAsP;AACtR,SAAS,kBAAkB;AAuQ3B,IAAM,aAAa,WAAW,KAAK;AAAA,EACjC,WAAW;AAAA,EACX,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,aAAa;AAAA,EACb,SAAS,WAAuC,EAAE,SAAS,CAAC,OAAO,UAAU,OAAO,SAAS,MAAM,CAAC,EAAE,CAAC;AAAA,EACvG,SAAS,WAAgD;AAAA,IACvD,SAAS,CAAC,MAAM,UAAU;AACxB,UAAI,UAAU,OAAW,QAAO;AAChC,YAAM,SAAS,EAAE,GAAG,MAAM,GAAG,MAAM;AACnC,UAAI,OAAO,yBAAyB,KAAM,QAAO,OAAO;AACxD,aAAO;AAAA,IACT;AAAA,IACA,SAAS,MAAM;AAAA,EACjB,CAAC;AAAA,EACD,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,cAAc;AAAA,EACd,YAAY;AAAA,EACZ,OAAO;AACT,CAAC;AAcM,IAAM,mBAAN,MAAuB;AAAA,EACX,QAAQ,oBAAI,IAA8B;AAAA,EAC1C,QAAQ,oBAAI,IAAsB;AAAA,EAClC,cAAc,oBAAI,IAAsC;AAAA,EACxD,cAAc,oBAAI,IAA8B;AAAA,EAChD,oBAAoB,oBAAI,IAA8B;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,YAAY;AAAA,EACZ;AAAA,EACA,eAAe;AAAA,EACf,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO1B,YACE,wBAAuE,CAAC,GACxE,UAAmC,CAAC,GACpC;AACA,UAAM,WAAW,kBAAkB,qBAAqB,IACpD,EAAE,GAAG,SAAS,cAAc,sBAAsB,IAClD;AACJ,SAAK,eAAe,SAAS,gBAAgB,IAAI,YAAY;AAC7D,SAAK,kBAAkB,SAAS;AAChC,SAAK,aAAa,SAAS;AAC3B,SAAK,kBAAkB,SAAS;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,QAAQ,MAAc,SAA2B,UAA4B,CAAC,GAAS;AACrF,QAAI,CAAC,KAAK,KAAK,KAAK,SAAS,oBAAqB,OAAM,IAAI,MAAM,4BAA4B;AAC9F,SAAK,MAAM,IAAI,MAAM,OAAO;AAC5B,SAAK,YAAY,IAAI,MAAM,OAAO;AAClC,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,YAAY,MAAc,UAAyB,UAAgC,CAAC,GAAS;AAC3F,QAAI,CAAC,YAAY,OAAO,SAAS,WAAW,WAAY,OAAM,IAAI,MAAM,wCAAwC;AAChH,WAAO,KAAK,QAAQ,MAAM,OAAM,UAAS;AACvC,YAAM,QAAQ,QAAQ,WAAW,QAAQ,SAAS,KAAK,IAAI;AAC3D,YAAM,WAAW,QAAQ,WAAW,KAAK,KAAK,GAAG,MAAM,SAAS,IAAI,IAAI;AACxE,UAAI,CAAC,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AACtE,YAAM,SAAS,EAAE,cAAc,EAAE,WAAW,UAAU,eAAe,KAAK,EAAE;AAC5E,YAAM,SAAS,MAAM,SAAS;AAC9B,UAAI;AACJ,UAAI;AACF,iBAAS,QAAQ,SAAS,QAAQ,OAAO,YAAY,SAAS,SAC1D,MAAM,SAAS,OAAO,OAAO,OAAO,UAAU,MAAM,IACpD,MAAM,SAAS,OAAO,OAAO,MAAM;AAAA,MACzC,SAAS,OAAO;AACd,YAAI,CAAC,QAAQ,kBAAkB,CAAC,qBAAqB,KAAK,EAAG,OAAM;AACnE,cAAM,gBAAgB,SAAS,WAAW,MAAM,SAAS,SAAS,MAAM,IAAI;AAC5E,cAAMA,UAAS,MAAM,QAAQ,eAAe,OAAO,OAAO,aAAa;AACvE,eAAO,EAAE,GAAGA,SAAQ,SAAS,EAAE,GAAGA,QAAO,SAAS,sBAAsB,EAAE,MAAM,KAAK,EAAE,EAAE;AAAA,MAC3F;AACA,YAAM,UAAU,EAAE,GAAI,MAAM,WAAW,CAAC,EAAG;AAC3C,UAAI,QAAQ,qBAAsB,SAAQ,uBAAuB;AACjE,YAAM,SAAS,QAAQ,YAAY,QAAQ,UAAU,QAAQ,KAAK,IAAK;AACvE,aAAO,EAAE,GAAG,QAAQ,SAAS,EAAE,GAAG,SAAS,GAAI,OAAO,WAAW,CAAC,EAAG,EAAE;AAAA,IACzE,GAAG,EAAE,QAAQ,QAAQ,UAAU,EAAE,MAAM,YAAY,OAAO,KAAK,EAAE,CAAC;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,QAAQ,MAAc,IAAY,UAA4B,CAAC,GAAS;AACtE,QAAI,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,KAAK,EAAG,OAAM,IAAI,MAAM,uBAAuB;AACvE,SAAK,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;AACxD,SAAK,YAAY,IAAI,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,IAAI,KAAK,CAAC,GAAG,gBAAgB,QAAQ,UAAU,CAAC,CAAC,CAAC,CAAC;AACvG,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,oBAAoB,MAAc,QAAqB,cAAwB,UAAuC,CAAC,GAAS;AAC9H,QAAI,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa,UAAU,aAAa,KAAK,iBAAe,CAAC,YAAY,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,oCAAoC;AACvJ,SAAK,kBAAkB,IAAI,MAAM,EAAE,QAAQ,cAAc,CAAC,GAAG,IAAI,IAAI,YAAY,CAAC,GAAG,QAAQ,gBAAgB,OAAO,EAAE,CAAC;AACvH,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,cAAc,UAAwB;AACpC,QAAI,CAAC,SAAS,KAAK,EAAG,OAAM,IAAI,MAAM,6BAA6B;AACnE,SAAK,YAAY;AACjB,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,YAAY,UAAsC;AAChD,WAAO,KAAK,MAAM,IAAI,QAAQ,IAAI,CAAC;AAAA,EACrC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,WAAqC;AACnC,UAAM,QAAQ,CAAC,GAAG,KAAK,MAAM,KAAK,CAAC,EAAE,IAAI,QAAM;AAC7C,YAAM,SAAS,KAAK,YAAY,IAAI,EAAE,GAAG,UAAU,CAAC;AACpD,aAAO;AAAA,QACL;AAAA,QACA,MAAM,OAAO,QAAQ;AAAA,QACrB,OAAO,OAAO,OAAO,KAAK,KAAK;AAAA,QAC/B,GAAI,OAAO,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,OAAO,YAAY;AAAA,QAC9E,GAAI,OAAO,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;AAAA,QACrE,GAAI,OAAO,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,OAAO,cAAc;AAAA,QACpF,GAAI,OAAO,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,OAAO,UAAU;AAAA,QACxE,GAAI,OAAO,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,OAAO,SAAS;AAAA,QACrE,oBAAoB,OAAO,sBAAsB;AAAA,QACjD,GAAI,OAAO,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,OAAO,UAAU;AAAA,QACxE,GAAI,OAAO,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,OAAO,WAAW;AAAA,QAC3E,GAAI,OAAO,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,OAAO,gBAAgB;AAAA,MAC5F;AAAA,IACF,CAAC;AACD,UAAM,QAAQ,CAAC;AACf,eAAW,CAAC,MAAM,YAAY,KAAK,KAAK,OAAO;AAC7C,UAAI,KAAK,kBAAkB,IAAI,IAAI,EAAG;AACtC,mBAAa,QAAQ,CAAC,IAAI,UAAU;AAClC,cAAM,SAAS,KAAK,YAAY,IAAI,IAAI,IAAI,KAAK,KAAK,CAAC;AACvD,cAAM,KAAK,EAAE,MAAM,IAAI,MAAM,OAAO,QAAQ,UAAU,GAAI,OAAO,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,OAAO,MAAM,GAAI,GAAI,OAAO,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,OAAO,UAAU,EAAG,CAAC;AAAA,MACpM,CAAC;AAAA,IACH;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,mBAAmB;AAClD,iBAAW,MAAM,MAAM,cAAc;AACnC,cAAM,SAAS,MAAM,QAAQ,UAAU,CAAC;AACxC,cAAM,QAAQ,MAAM,QAAQ,SAAS,EAAE,KAAK,OAAO;AACnD,cAAM,KAAK,EAAE,MAAM,IAAI,MAAM,OAAO,QAAQ,eAAe,GAAI,UAAU,SAAY,CAAC,IAAI,EAAE,MAAM,GAAI,GAAI,OAAO,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,OAAO,UAAU,EAAG,CAAC;AAAA,MACpL;AAAA,IACF;AACA,WAAO,gBAAgB,EAAE,eAAe,OAAgB,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC,GAAI,GAAI,KAAK,kBAAkB,EAAE,iBAAiB,KAAK,gBAAgB,IAAI,CAAC,GAAI,WAAW,KAAK,WAAW,OAAO,MAAM,CAAC;AAAA,EAC5O;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,gBAAgB,OAAsD;AACpE,UAAM,SAAiD,MAAM,kBAAkB,qBAAqB,MAAM,QAAQ,WAAW,MAAM,aAAa,cAAc,MAAM,cAAc,YAAY;AAC9L,WAAO;AAAA,MACL;AAAA,MACA,GAAI,MAAM,eAAe,MAAM,gBAAgB,MAAM,EAAE,eAAe,MAAM,YAAY,IAAI,CAAC;AAAA,MAC7F,GAAI,MAAM,uBAAuB,SAAY,CAAC,IAAI,EAAE,oBAAoB,MAAM,mBAAmB;AAAA,MACjG,GAAI,MAAM,kBAAkB;AAAA,QAC1B,iBAAiB;AAAA,UACf,GAAI,MAAM,gBAAgB,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,MAAM,gBAAgB,WAAW;AAAA,UACzG,UAAU,MAAM,gBAAgB;AAAA,UAChC,eAAe,MAAM,gBAAgB;AAAA,UACrC,WAAW,MAAM,gBAAgB;AAAA,UACjC,QAAQ,MAAM,gBAAgB;AAAA,QAChC;AAAA,MACF,IAAI,CAAC;AAAA,MACL,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,iBAAiB,WAAwD;AAC7E,UAAM,QAAQ,MAAM,KAAK,cAAc,SAAS;AAChD,WAAO,EAAE,OAAO,KAAK,SAAS,GAAG,GAAI,QAAQ,EAAE,SAAS,KAAK,gBAAgB,KAAK,EAAE,IAAI,CAAC,EAAG;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,cAAc,WAAoD;AACtE,UAAM,WAAW,MAAM,KAAK,eAAe,EAAE,SAAS,KAAK,OAAO,SAAS,CAAC;AAC5E,WAAO,SAAS,UAAU,OAAO,SAAS,WAAW,YAAY,eAAe,SAAS,SACrF,aAAa,SAAS,MAAsB,IAC5C;AAAA,EACN;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,QAAQ,cAAyD;AACrE,QAAI,CAAC,cAAc,WAAW,KAAK,EAAG,OAAM,IAAI,MAAM,gCAAgC;AACtF,QAAI,aAAa,gBAAiB,QAAO,gBAAgB,YAAY;AACrE,QAAI;AACF,YAAM,KAAK,eAAe,EAAE,OAAO,cAA8B,KAAK,OAAO,aAAa,SAAS,CAAC;AAAA,IACtG,SAAS,OAAO;AACd,YAAM,cAAc,MAAM,KAAK,cAAc,aAAa,SAAS;AACnE,UAAI,aAAa,mBAAmB,qBAAqB,KAAK,EAAG,QAAO;AACxE,YAAM;AAAA,IACR;AACA,WAAQ,MAAM,KAAK,cAAc,aAAa,SAAS,KAAM;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAM,oBAAoB,OAiDR;AAChB,UAAM,QAAQ,KAAK,eAAe;AAClC,UAAM,aAAa,MAAM,KAAK,cAAc,MAAM,SAAS;AAC3D,QAAI,CAAC,WAAY,QAAO,EAAE,SAAS,OAAO,OAAO,qBAAqB,MAAM,SAAS,cAAc;AACnG,UAAM,UAAU,WAAW;AAC3B,QAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,OAAO,oCAAoC;AAClF,QAAI;AACF,UAAI,MAAM,cAAc,MAAM,eAAe,QAAQ,WAAY,QAAO,EAAE,SAAS,OAAO,OAAO,gDAAgD;AACjJ,UAAI,CAAC,QAAQ,WAAY,MAAM,eAAe,MAAM,gBAAgB,QAAQ,QAAQ,YAAc,QAAO,EAAE,SAAS,OAAO,OAAO,iDAAiD;AACnL,8BAAwB,QAAQ,OAAO;AAAA,IACzC,SAAS,OAAO;AACd,aAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,2BAA2B;AAAA,IACtG;AACA,QAAI,CAAC,MAAM,WAAW,KAAK,KAAK,CAAC,MAAM,aAAa,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,OAAO,gCAAgC;AAC5H,UAAM,kBAAkB,MAAM,mBAAmB,KAAK;AACtD,QAAI,MAAM,YAAY,CAAC,gBAAiB,QAAO,EAAE,SAAS,OAAO,OAAO,oEAAoE;AAC5I,QAAI,mBAAmB,MAAM,gBAAgB,gBAAgB,UAAU,GAAG,EAAE,YAAY,MAAM,YAAY,cAAc,MAAM,cAAc,UAAU,MAAM,SAAS,CAAC,MAAM,KAAM,QAAO,EAAE,SAAS,OAAO,OAAO,0DAA0D;AAE5Q,UAAM,WAAkC,EAAE,UAAU,MAAM,UAAU,YAAY,MAAM,YAAY,cAAc,MAAM,cAAc,SAAS,MAAM,QAAQ;AAC3J,QAAI;AACF,YAAM,MAAM,OAAO,IAAI,QAAQ,EAAE,QAAQ,SAAS,CAAC,GAAG,KAAK,OAAO,MAAM,SAAS,CAAC;AAAA,IACpF,SAAS,OAAO;AACd,UAAI,CAAC,qBAAqB,KAAK,EAAG,QAAO,EAAE,SAAS,OAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,yBAAyB;AAAA,IACtI;AACA,UAAM,QAAQ,MAAM,KAAK,cAAc,MAAM,SAAS;AACtD,WAAO,QAAQ,EAAE,SAAS,MAAM,MAAM,IAAI,EAAE,SAAS,OAAO,OAAO,+CAA+C;AAAA,EACpH;AAAA,EAEQ,aAAa;AACnB,SAAK,gBAAgB;AACrB,SAAK,WAAW;AAAA,EAClB;AAAA,EAEQ,OAAO,WAAmB;AAChC,WAAO,EAAE,cAAc,EAAE,WAAW,UAAU,EAAE;AAAA,EAClD;AAAA,EAEQ,iBAAiB;AACvB,QAAI,KAAK,YAAY,KAAK,oBAAoB,KAAK,aAAc,QAAO,KAAK;AAC7E,QAAI,CAAC,KAAK,MAAM,IAAI,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,wBAAwB,KAAK,SAAS,qBAAqB;AAEhH,UAAM,UAAU,IAAI,WAA2E,UAAU;AACzG,eAAW,CAAC,MAAM,OAAO,KAAK,KAAK,OAAO;AACxC,cAAQ,QAAQ,MAAM,OAAO,UAAU,KAAK,QAAQ,MAAM,SAAS,KAAqB,GAAG,KAAK,YAAY,IAAI,IAAI,CAAC;AAAA,IACvH;AACA,YAAQ,QAAQ,qBAAqB,OAAO,UAAU,KAAK,gBAAgB,KAAqB,CAAC;AACjG,YAAQ,QAAQ,OAAO,KAAK,SAAS;AAErC,eAAW,QAAQ,KAAK,MAAM,KAAK,GAAG;AACpC,YAAM,QAAQ,KAAK,kBAAkB,IAAI,IAAI;AAC7C,YAAM,OAAO,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;AAC1C,UAAI,OAAO;AACT,cAAM,eAAe,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,MAAM,cAAc,mBAAmB,CAAC,CAAC;AAC9E,gBAAQ;AAAA,UACN;AAAA,UACA,WAAS,MAAM,kBAAkB,sBAAsB,mBAAmB,OAAO,KAAqB;AAAA,UACtG;AAAA,QACF;AAAA,MACF,OAAO;AACL,cAAM,eAAe,SAAS,MAAM,CAAC,KAAK,mBAAmB,IAAI,CAAC,MAAM,mBAAmB;AAC3F,gBAAQ,oBAAoB,MAAM,WAAU,MAAM,kBAAkB,sBAAsB,MAAO,YAAY;AAAA,MAC/G;AAAA,IACF;AACA,UAAM,uBAAuB,CAAC,GAAG,KAAK,MAAM,KAAK,GAAG,KAAK,mBAAmB;AAC5E,YAAQ,oBAAoB,qBAAqB,WAAS,MAAM,kBAAkB,sBAAuB,MAAM,eAAe,KAAM,oBAAoB;AAExJ,SAAK,WAAW,QAAQ,QAAQ,EAAE,cAAc,KAAK,aAAa,CAAC;AACnE,SAAK,kBAAkB,KAAK;AAC5B,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,QAAQ,MAAc,SAA2B,OAAqB;AAClF,UAAM,SAAS,MAAM,QAAQ,aAAa,KAAK,CAAC;AAChD,UAAM,YAAmC,EAAE,GAAG,QAAQ,aAAa,OAAO,eAAe,KAAK;AAC9F,QAAI,UAAU,iBAAiB;AAC7B,gBAAU,kBAAkB,KAAK,aAAa,OAAO,UAAU,eAAe;AAC9E,gBAAU,aAAa;AAAA,IACzB,WAAW,CAAC,KAAK,MAAM,IAAI,IAAI,GAAG,UAAU,CAAC,KAAK,kBAAkB,IAAI,IAAI,GAAG;AAC7E,gBAAU,aAAa;AAAA,IACzB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,gBAAgB,OAAqB;AAC3C,QAAI,CAAC,MAAM,gBAAiB,QAAO,EAAE,aAAa,KAAK,YAAY,KAAK;AACxE,UAAM,WAAW,UAAU,EAAE,MAAM,YAAY,iBAAiB,MAAM,gBAAgB,CAAC;AACvF,QAAI,CAAC,YAAY,OAAO,SAAS,aAAa,aAAa,CAAC,SAAS,cAAc,CAAC,SAAS,aAAc,OAAM,IAAI,MAAM,2BAA2B;AACtJ,UAAM,eAAe,EAAE,GAAG,UAAU,YAAY,MAAM,gBAAgB,YAAa,aAAa,MAAM,gBAAgB,QAAS,aAAa,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChL,QAAI,CAAC,SAAS,UAAU;AACtB,aAAO;AAAA,QACL,iBAAiB;AAAA,QACjB;AAAA,QACA,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,OAAO,eAAe,SAAS,YAAY,KAAK,SAAS,UAAU,MAAM,SAAS,WAAW,oBAAoB;AAAA,MACnH;AAAA,IACF;AACA,UAAM,OAAO,KAAK,MAAM,IAAI,MAAM,WAAW,IAAI,CAAC,KAAK;AACvD,WAAO;AAAA,MACL,iBAAiB;AAAA,MACjB;AAAA,MACE,aAAa,MAAM,SAAS,uBAAuB,MAAM,cAAc;AAAA,MACvE,YAAY,MAAM,SAAS,uBAAuB,QAAQ,SAAS;AAAA,MACnE,SAAS,MAAM,SAAS,uBAAuB,EAAE,GAAG,MAAM,SAAS,sBAAsB,EAAE,GAAG,MAAM,QAAQ,sBAAgC,SAAS,EAAE,IAAI,MAAM;AAAA,MACnK,SAAS,CAAC,GAAG,MAAM,SAAS,EAAE,MAAM,kBAAkB,SAAS,eAAe,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AAAA,IACvK;AAAA,EACF;AAAA,EAEQ,aAAa,OAAqB,SAA0D;AAClG,UAAM,aAAa,QAAQ,cAAc,WAAW;AACpD,UAAM,UAAU,QAAQ,UAAU,wBAAwB,QAAQ,OAAO,IAAI,sBAAsB;AAAA,MACjG,UAAU,MAAM;AAAA,MAChB,aAAa,MAAM;AAAA,MACnB,WAAW,QAAQ;AAAA,MACnB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,MACnD,OAAO,QAAQ;AAAA,MACf,UAAU;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,mBAAmB;AAAA;AAAA,QAExC,YAAY,QAAQ,cAAc,QAAQ;AAAA,QACtC,YAAY;AAAA,QACZ,WAAY,CAAC,OAAO,UAAU,QAAQ,UAAU,EAAE,SAAS,QAAQ,SAAS,IAAI,QAAQ,YAAY;AAAA,QACpG,eAAe,QAAQ;AAAA,QACvB,aAAa,EAAE,MAAM,UAAU,sBAAsB,KAAK;AAAA,MAC5D;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,aAAa,MAAM,YAAY,QAAQ,gBAAgB,MAAM,UAAU,QAAQ,cAAc,QAAQ,SAAU,OAAM,IAAI,MAAM,gDAAgD;AAC3L,WAAO,EAAE,GAAG,SAAS,YAAY,QAAQ;AAAA,EAC3C;AACF;AAEA,SAAS,kBAAkB,OAAoF;AAC7G,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,cAAc,SAAS,SAAS;AACxF;AAEA,SAAS,mBAAmB,OAAyB,OAA6B;AAChF,QAAM,cAAc,MAAM,OAAO,aAAa,KAAK,CAAC;AACpD,MAAI,CAAC,MAAM,aAAa,SAAS,WAAW,EAAG,OAAM,IAAI,MAAM,oDAAoD,WAAW,GAAG;AACjI,SAAO;AACT;AAEA,SAAS,aAAa,OAAsC;AAC1D,SAAO,gBAAgB,KAAK;AAC9B;AAEA,SAAS,qBAAqB,OAAyB;AACrD,SAAO,QAAQ,SAAS,OAAO,UAAU,aAAa,mBAAmB,SAAU,MAAsC,kBAAkB,qBAAqB,MAAM,aAAa,SAAS,iBAAiB;AAC/M;","names":["mapped"]}