@archmax-ai/harness 0.0.0

package/dist/core/skill-prompt.js

@@ -0,0 +1,54 @@
+/**
+ * The model-facing account of the skills a state may use — rendered by the
+ * runtime rather than delegated to the upstream skills middleware.
+ *
+ * Upstream renders one section, once, from a whole source directory: its
+ * `sources` are fixed at construction and its result is cached in a closure, so
+ * nothing about it can vary per state. Under a governed workflow that is exactly
+ * the wrong shape — a state that may use one capability would be told about
+ * three, two of which the kernel refuses. So the runtime renders this instead,
+ * from the same resolved set the kernel enforces, into the **volatile** system
+ * block (see `workflow/middleware.ts`), which is where anything that changes
+ * with the state belongs.
+ *
+ * What it says is the Agent Skills progressive-disclosure contract itself and
+ * nothing more: the slug, what the skill is for, and where to read the rest.
+ */
+/** Heading of the rendered section, also the marker tests assert on. */
+export const SKILLS_SECTION_HEADING = "Skills available in this state";
+/**
+ * Render the section for one state's enabled skills, or `null` when the set is
+ * empty — a state that may use no skill gets no heading rather than an empty
+ * one, and therefore no invitation to go looking.
+ *
+ * `enabled` is the resolved slug order (see `WorkflowMachine.enabledSkills`), so
+ * the text is byte-identical on every model call of a turn and on every
+ * re-entry: a prompt section that reordered itself would churn the transcript
+ * for no reason. A slug with no registry entry is skipped rather than rendered
+ * as a bare name — the description is the whole value of disclosing it.
+ */
+export function renderSkillsSection(enabled, registry) {
+    const skills = enabled
+        .map((slug) => registry.get(slug))
+        .filter((skill) => skill !== undefined);
+    if (skills.length === 0)
+        return null;
+    const bullets = skills.map((skill) => `- **\`${skill.slug}\`** — ${oneLine(skill.description)} Read \`${skill.skillFile}\` first.`);
+    return [
+        `## ${SKILLS_SECTION_HEADING}`,
+        "",
+        ...bullets,
+        "",
+        `Only these skills are reachable from this state: every other skill's files are blocked here, ` +
+            `whatever an earlier state could read.`,
+    ].join("\n");
+}
+/**
+ * Collapse a description to one line and end it with a sentence terminator, so a
+ * multi-line `description:` cannot break the bullet list it is rendered into.
+ */
+function oneLine(description) {
+    const text = description.replace(/\s+/g, " ").trim();
+    return /[.!?]$/.test(text) ? text : `${text}.`;
+}
+//# sourceMappingURL=skill-prompt.js.map

package/dist/core/skill-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-prompt.js","sourceRoot":"","sources":["../../src/core/skill-prompt.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG,gCAAgC,CAAC;AAEvE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA0B,EAC1B,QAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO;SACnB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACjC,MAAM,CAAC,CAAC,KAAK,EAA4B,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CACxB,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,KAAK,CAAC,IAAI,UAAU,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,KAAK,CAAC,SAAS,WAAW,CACxG,CAAC;IACF,OAAO;QACL,MAAM,sBAAsB,EAAE;QAC9B,EAAE;QACF,GAAG,OAAO;QACV,EAAE;QACF,+FAA+F;YAC7F,uCAAuC;KAC1C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,WAAmB;IAClC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;AACjD,CAAC"}

package/dist/core/skill-redact.d.ts

@@ -0,0 +1,15 @@
+import { type SkillPrefixes } from "./skills.js";
+/**
+ * Keep a disabled skill out of a *listing*, not just out of a read — the skills
+ * half of the shared listing filter (`core/listing-redact.ts`, which carries the
+ * reasoning and the line shapes).
+ */
+/**
+ * Drop from `text` every line about a skill bundle absent from `enabled`.
+ *
+ * Returns the text unchanged when nothing was hidden — including the whole
+ * no-skills and no-hidden-bundle cases — so a result the filter has no opinion
+ * about is passed through by identity rather than rebuilt.
+ */
+export declare function redactDisabledSkills(text: string, enabled: readonly string[], skills: SkillPrefixes): string;
+export { REDACTED_TOOLS } from "./listing-redact.js";

package/dist/core/skill-redact.js

@@ -0,0 +1,27 @@
+import { redactListing } from "./listing-redact.js";
+import { skillOfPath } from "./skills.js";
+/**
+ * Keep a disabled skill out of a *listing*, not just out of a read — the skills
+ * half of the shared listing filter (`core/listing-redact.ts`, which carries the
+ * reasoning and the line shapes).
+ */
+/**
+ * Drop from `text` every line about a skill bundle absent from `enabled`.
+ *
+ * Returns the text unchanged when nothing was hidden — including the whole
+ * no-skills and no-hidden-bundle cases — so a result the filter has no opinion
+ * about is passed through by identity rather than rebuilt.
+ */
+export function redactDisabledSkills(text, enabled, skills) {
+    if (skills.length === 0 || !text)
+        return text;
+    const allowed = new Set(enabled);
+    // Nothing to hide: every discovered bundle is enabled here.
+    if (skills.every((skill) => allowed.has(skill.slug)))
+        return text;
+    return redactListing(text, (path) => skillOfPath(path, skills), (slug) => !allowed.has(slug));
+}
+// The filtered tools are a property of the listing shapes, not of skills;
+// re-exported here so existing callers reach it from either module.
+export { REDACTED_TOOLS } from "./listing-redact.js";
+//# sourceMappingURL=skill-redact.js.map

package/dist/core/skill-redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-redact.js","sourceRoot":"","sources":["../../src/core/skill-redact.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAsB,MAAM,aAAa,CAAC;AAE9D;;;;GAIG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,OAA0B,EAC1B,MAAqB;IAErB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,4DAA4D;IAC5D,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,aAAa,CAClB,IAAI,EACJ,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EACnC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAC7B,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,oEAAoE;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/core/skills.d.ts

@@ -0,0 +1,172 @@
+import { type WorkflowEventHandler } from "./events.js";
+import { Workspace } from "./workspace.js";
+/**
+ * The skill registry: what skills a workspace provides, resolved **once per
+ * assembly** from the declared skill sources and read through the backend like
+ * every other authored input.
+ *
+ * It exists because three components have to agree about the same three facts —
+ * which slugs exist, where each bundle lives, and what to say about it:
+ *
+ * - **disclosure** names the active state's skills in the prompt,
+ * - the **decision kernel** refuses a path inside a bundle the state does not
+ *   enable,
+ * - **`archmax validate`** reports a `skills.allow` entry no bundle provides.
+ *
+ * Deriving all three from one resolved table is the same move the mount table
+ * makes (`core/mounts.ts` → {@link MountPrefixes}): a prompt cannot advertise a
+ * skill the kernel would refuse, and the validator cannot accept a slug the
+ * runtime would not find, because there is only one answer to look up.
+ *
+ * The framework therefore never names `skills/`. The **sources** are an
+ * assembly input, and what governance consumes is this table.
+ */
+/** A discovered skill: its slug, what it is for, and where its bundle lives. */
+export interface SkillDefinition {
+    /**
+     * The bundle's directory name — the token authors govern by, and the only one
+     * `skills.allow` accepts. Kept even when the bundle's `SKILL.md` `name:`
+     * disagrees: the path is what governance decides against, so the directory
+     * has the final say and the mismatch is reported instead of resolved.
+     */
+    slug: string;
+    /** The `description:` frontmatter field, as disclosed to the model. */
+    description: string;
+    /**
+     * Canonical, workspace-relative bundle path with no trailing slash
+     * (`skills/order-data`) — the prefix a governed path is matched against.
+     */
+    prefix: string;
+    /** Path of the bundle's `SKILL.md`, as the agent addresses it. */
+    skillFile: string;
+}
+/** Discovered skills by slug, in discovery order. */
+export type SkillRegistry = ReadonlyMap<string, SkillDefinition>;
+/**
+ * One skill's identity for path classification: the pair the kernel and the
+ * validator need, and nothing else. Prompt-facing fields are deliberately
+ * absent — a governance decision must not be able to depend on a description.
+ */
+export interface SkillLocation {
+    readonly slug: string;
+    /** Canonical bundle prefix, no trailing slash. */
+    readonly prefix: string;
+}
+/**
+ * The resolved skill table governance classifies against — the {@link
+ * MountPrefixes} of skills. Ordered longest-prefix-first so a nested bundle
+ * (were a source ever to serve one) resolves to the innermost skill.
+ */
+export type SkillPrefixes = readonly SkillLocation[];
+/** No skills: no path lands inside a bundle, so the skill rule never fires. */
+export declare const NO_SKILLS: SkillPrefixes;
+/**
+ * The conventional skill source, matching the `skills/` key in
+ * {@link defaultMounts}. A **default value only**: it is the runtime option's
+ * default, never a name any governance module refers to.
+ */
+export declare const DEFAULT_SKILL_SOURCES: readonly string[];
+/** The Agent Skills bundle manifest, at the root of a skill directory. */
+export declare const SKILL_FILE = "SKILL.md";
+/** Structural inspection of a `SKILL.md`, for the loader and the validator. */
+export interface SkillInspection {
+    /** The parsed definition, or null when a fatal problem was found. */
+    definition: Omit<SkillDefinition, "prefix" | "skillFile"> | null;
+    /** Problems that make the bundle unloadable — the runtime skips it. */
+    errors: string[];
+    /** Non-fatal advisories (e.g. `name:`/directory mismatch). */
+    warnings: string[];
+}
+/**
+ * Inspect a `SKILL.md` (YAML frontmatter + markdown body) without emitting
+ * events, so the runtime loader and the static validator agree about what is
+ * unloadable. `expectedDir` is the containing directory name — the slug.
+ *
+ * Deep Agents' own `parseSkillMetadata` is not reused: it takes a filesystem
+ * path and reads it with `fs`, while every authored input here arrives through
+ * the backend. What is shared instead are its Agent Skills limits
+ * (`MAX_SKILL_NAME_LENGTH`, `MAX_SKILL_DESCRIPTION_LENGTH`), so a bundle this
+ * loader accepts is one upstream's skills middleware would accept too.
+ *
+ * A `name:` that disagrees with the directory is a **warning, not an error**:
+ * the bundle still governs correctly (its path is unambiguous), and refusing to
+ * load it would take a capability away over a label. `validate` reports the same
+ * mismatch as an error, where an author is asking to be told.
+ */
+export declare function inspectSkillMarkdown(raw: string, expectedDir: string): SkillInspection;
+/**
+ * One problem found while discovering skills. Carries the severity a **static**
+ * check should report, which is not always the severity the runtime acts on: a
+ * bundle whose `name:` disagrees with its directory still loads and governs
+ * correctly (the path is unambiguous), so the runtime warns and keeps the
+ * capability — while `validate`, asked precisely to find that, errors.
+ *
+ * Structured rather than pre-formatted so the validator classifies by `kind`
+ * instead of matching on message text, and both paths report the same sentence.
+ */
+export interface SkillIssue {
+    kind: "unloadable" | "name-mismatch" | "non-slug-dir" | "shadowed";
+    /** Severity for a static check; the runtime treats every issue as a warning. */
+    severity: "error" | "warning";
+    /** The bundle directory name the issue is about. */
+    slug: string;
+    message: string;
+}
+/**
+ * Read the skills served by `sources`, in order, through the workspace backend —
+ * never `fs`, and never upstream's filesystem-only `listSkills`, so a store or
+ * sandbox backend serves skills exactly as it serves everything else.
+ *
+ * Each source is accepted in either Agent Skills form, distinguished the way
+ * upstream distinguishes them — by whether the directory itself holds a
+ * `SKILL.md`:
+ *
+ * - a **parent directory** (`skills/`), whose every child bundle is loaded;
+ * - a **direct bundle** (`skills/order-data/`), loaded as one skill.
+ *
+ * A later source providing an already-discovered slug **shadows** it (upstream's
+ * documented last-one-wins precedence), reported as an issue: silently serving
+ * one of two bundles under one governed name is exactly the ambiguity a governed
+ * runtime should not keep to itself. A source that serves nothing is not a
+ * problem — it is a workspace without that kind of capability.
+ *
+ * The one discovery path, shared by the runtime ({@link discoverSkills}) and
+ * `archmax validate`, so the two cannot disagree about which skills exist.
+ */
+export declare function inspectSkillSources(workspace: Workspace, sources?: readonly string[]): Promise<{
+    registry: SkillRegistry;
+    issues: SkillIssue[];
+}>;
+/**
+ * The runtime's discovery: {@link inspectSkillSources}, with every issue emitted
+ * as a warning on the event stream. Nothing here fails an assembly — a workspace
+ * with one malformed bundle still runs, with that capability missing and said so.
+ */
+export declare function discoverSkills(workspace: Workspace, sources?: readonly string[], onEvent?: WorkflowEventHandler): Promise<SkillRegistry>;
+/**
+ * Reduce a registry to the table governance classifies against, ordered so the
+ * longest prefix matches first.
+ */
+export declare function skillPrefixes(registry: SkillRegistry): SkillPrefixes;
+/**
+ * The slug of the skill bundle a path lands inside, or null when it lands in
+ * none — a path elsewhere in the workspace, *or* a path under a skill source
+ * that belongs to no bundle (a stray file beside the bundles). The latter is
+ * deliberately not this rule's business: it governs bundles, and the zone rules
+ * already govern the authored directory holding them.
+ *
+ * Canonicalizes first, so `./skills//order-data/x`, `skills/order-data/./x`, and
+ * `skills/other/../order-data/x` are all the one path the backend would resolve.
+ * A path that escapes the workspace root belongs to no bundle (and is refused
+ * elsewhere on its own terms).
+ */
+export declare function skillOfPath(path: string, skills?: SkillPrefixes): string | null;
+/**
+ * Whether a glob or path pattern can only ever match inside one skill bundle —
+ * the shape `validate` needs to spot a `tools.allow` entry that contradicts the
+ * state's enabled set. Returns the slug when the pattern's literal prefix
+ * (everything before its first wildcard) is already inside a bundle, else null:
+ * a broader pattern (`skills/**`) matches several bundles and is left to the
+ * runtime rule, which refuses the disabled ones call by call.
+ */
+export declare function skillOfPattern(pattern: string, skills?: SkillPrefixes): string | null;

package/dist/core/skills.js

@@ -0,0 +1,214 @@
+import { MAX_SKILL_DESCRIPTION_LENGTH, MAX_SKILL_NAME_LENGTH } from "deepagents";
+import { createWorkflowEventEmitter, } from "./events.js";
+import { parseFrontmatter } from "./frontmatter.js";
+import { canonicalizeRelPath, dirName, normalizeRelPath } from "./workspace.js";
+import { isSlug } from "../machine/slug.js";
+/** No skills: no path lands inside a bundle, so the skill rule never fires. */
+export const NO_SKILLS = [];
+/**
+ * The conventional skill source, matching the `skills/` key in
+ * {@link defaultMounts}. A **default value only**: it is the runtime option's
+ * default, never a name any governance module refers to.
+ */
+export const DEFAULT_SKILL_SOURCES = ["skills/"];
+/** The Agent Skills bundle manifest, at the root of a skill directory. */
+export const SKILL_FILE = "SKILL.md";
+/**
+ * Inspect a `SKILL.md` (YAML frontmatter + markdown body) without emitting
+ * events, so the runtime loader and the static validator agree about what is
+ * unloadable. `expectedDir` is the containing directory name — the slug.
+ *
+ * Deep Agents' own `parseSkillMetadata` is not reused: it takes a filesystem
+ * path and reads it with `fs`, while every authored input here arrives through
+ * the backend. What is shared instead are its Agent Skills limits
+ * (`MAX_SKILL_NAME_LENGTH`, `MAX_SKILL_DESCRIPTION_LENGTH`), so a bundle this
+ * loader accepts is one upstream's skills middleware would accept too.
+ *
+ * A `name:` that disagrees with the directory is a **warning, not an error**:
+ * the bundle still governs correctly (its path is unambiguous), and refusing to
+ * load it would take a capability away over a label. `validate` reports the same
+ * mismatch as an error, where an author is asking to be told.
+ */
+export function inspectSkillMarkdown(raw, expectedDir) {
+    const errors = [];
+    const warnings = [];
+    const fail = (message) => {
+        errors.push(message);
+        return { definition: null, errors, warnings };
+    };
+    if (raw.trim() === "")
+        return fail("file is empty");
+    const parsed = parseFrontmatter(raw);
+    if (!parsed)
+        return fail("no valid YAML frontmatter found");
+    if (!parsed.data || typeof parsed.data !== "object")
+        return fail("invalid YAML frontmatter");
+    const meta = parsed.data;
+    const description = meta.description;
+    if (description === undefined || description === null || String(description).trim() === "") {
+        return fail("missing required 'description'");
+    }
+    if (String(description).length > MAX_SKILL_DESCRIPTION_LENGTH) {
+        return fail(`'description' exceeds ${MAX_SKILL_DESCRIPTION_LENGTH} characters (Agent Skills limit)`);
+    }
+    if (meta.name !== undefined && String(meta.name).length > MAX_SKILL_NAME_LENGTH) {
+        return fail(`'name' exceeds ${MAX_SKILL_NAME_LENGTH} characters (Agent Skills limit)`);
+    }
+    if (meta.name !== undefined && String(meta.name) !== expectedDir) {
+        warnings.push(`Skill '${String(meta.name)}' should match directory name '${expectedDir}' — ` +
+            `'${expectedDir}' is the slug governance uses`);
+    }
+    if (!isSlug(expectedDir)) {
+        warnings.push(`Skill directory '${expectedDir}' is not a kebab-case slug, so no 'skills.allow' entry can name it`);
+    }
+    return {
+        definition: { slug: expectedDir, description: String(description).trim() },
+        errors,
+        warnings,
+    };
+}
+/** A source path, canonicalized: no leading slash, no trailing slash. */
+function normalizeSource(source) {
+    return canonicalizeRelPath(source).path;
+}
+/**
+ * Read the skills served by `sources`, in order, through the workspace backend —
+ * never `fs`, and never upstream's filesystem-only `listSkills`, so a store or
+ * sandbox backend serves skills exactly as it serves everything else.
+ *
+ * Each source is accepted in either Agent Skills form, distinguished the way
+ * upstream distinguishes them — by whether the directory itself holds a
+ * `SKILL.md`:
+ *
+ * - a **parent directory** (`skills/`), whose every child bundle is loaded;
+ * - a **direct bundle** (`skills/order-data/`), loaded as one skill.
+ *
+ * A later source providing an already-discovered slug **shadows** it (upstream's
+ * documented last-one-wins precedence), reported as an issue: silently serving
+ * one of two bundles under one governed name is exactly the ambiguity a governed
+ * runtime should not keep to itself. A source that serves nothing is not a
+ * problem — it is a workspace without that kind of capability.
+ *
+ * The one discovery path, shared by the runtime ({@link discoverSkills}) and
+ * `archmax validate`, so the two cannot disagree about which skills exist.
+ */
+export async function inspectSkillSources(workspace, sources = DEFAULT_SKILL_SOURCES) {
+    const registry = new Map();
+    const issues = [];
+    const load = async (prefix) => {
+        const slug = dirName(prefix);
+        if (!slug)
+            return;
+        const skillFile = `${prefix}/${SKILL_FILE}`;
+        const raw = await workspace.readText(skillFile);
+        if (raw == null)
+            return;
+        const { definition, errors, warnings } = inspectSkillMarkdown(raw, slug);
+        for (const message of errors) {
+            issues.push({
+                kind: "unloadable",
+                severity: "warning",
+                slug,
+                message: `Skipping skill '${slug}' at ${prefix}: ${message}`,
+            });
+        }
+        for (const message of warnings) {
+            issues.push({
+                kind: message.includes("kebab-case") ? "non-slug-dir" : "name-mismatch",
+                severity: "error",
+                slug,
+                message,
+            });
+        }
+        if (!definition)
+            return;
+        const shadowed = registry.get(slug);
+        if (shadowed && shadowed.prefix !== prefix) {
+            issues.push({
+                kind: "shadowed",
+                severity: "warning",
+                slug,
+                message: `Skill '${slug}' at ${prefix} shadows the one at ${shadowed.prefix}`,
+            });
+        }
+        registry.set(slug, { ...definition, prefix, skillFile });
+    };
+    for (const source of sources) {
+        const root = normalizeSource(source);
+        if (!root)
+            continue;
+        if (await workspace.exists(`${root}/${SKILL_FILE}`)) {
+            await load(root);
+            continue;
+        }
+        for (const entry of await workspace.listDir(root)) {
+            if (entry.is_dir === false)
+                continue;
+            const name = dirName(entry.path);
+            if (!name)
+                continue;
+            await load(`${root}/${name}`);
+        }
+    }
+    return { registry, issues };
+}
+/**
+ * The runtime's discovery: {@link inspectSkillSources}, with every issue emitted
+ * as a warning on the event stream. Nothing here fails an assembly — a workspace
+ * with one malformed bundle still runs, with that capability missing and said so.
+ */
+export async function discoverSkills(workspace, sources = DEFAULT_SKILL_SOURCES, onEvent) {
+    const emit = createWorkflowEventEmitter(onEvent);
+    const { registry, issues } = await inspectSkillSources(workspace, sources);
+    for (const issue of issues) {
+        emit({ type: "warning", scope: "skills", message: issue.message });
+    }
+    return registry;
+}
+/**
+ * Reduce a registry to the table governance classifies against, ordered so the
+ * longest prefix matches first.
+ */
+export function skillPrefixes(registry) {
+    return [...registry.values()]
+        .map(({ slug, prefix }) => ({ slug, prefix }))
+        .sort((a, b) => b.prefix.length - a.prefix.length || a.slug.localeCompare(b.slug));
+}
+/**
+ * The slug of the skill bundle a path lands inside, or null when it lands in
+ * none — a path elsewhere in the workspace, *or* a path under a skill source
+ * that belongs to no bundle (a stray file beside the bundles). The latter is
+ * deliberately not this rule's business: it governs bundles, and the zone rules
+ * already govern the authored directory holding them.
+ *
+ * Canonicalizes first, so `./skills//order-data/x`, `skills/order-data/./x`, and
+ * `skills/other/../order-data/x` are all the one path the backend would resolve.
+ * A path that escapes the workspace root belongs to no bundle (and is refused
+ * elsewhere on its own terms).
+ */
+export function skillOfPath(path, skills = NO_SKILLS) {
+    if (skills.length === 0)
+        return null;
+    const { path: rel, escapes } = canonicalizeRelPath(path);
+    if (escapes || rel === "")
+        return null;
+    for (const { slug, prefix } of skills) {
+        if (rel === prefix || rel.startsWith(`${prefix}/`))
+            return slug;
+    }
+    return null;
+}
+/**
+ * Whether a glob or path pattern can only ever match inside one skill bundle —
+ * the shape `validate` needs to spot a `tools.allow` entry that contradicts the
+ * state's enabled set. Returns the slug when the pattern's literal prefix
+ * (everything before its first wildcard) is already inside a bundle, else null:
+ * a broader pattern (`skills/**`) matches several bundles and is left to the
+ * runtime rule, which refuses the disabled ones call by call.
+ */
+export function skillOfPattern(pattern, skills = NO_SKILLS) {
+    const literal = normalizeRelPath(pattern).split(/[*?[{]/, 1)[0] ?? "";
+    const upToSegment = literal.slice(0, literal.lastIndexOf("/") + 1);
+    return skillOfPath(upToSegment, skills);
+}
+//# sourceMappingURL=skills.js.map

package/dist/core/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/core/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EACL,0BAA0B,GAE3B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAa,mBAAmB,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAiE5C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,SAAS,GAAkB,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,SAAS,CAAC,CAAC;AAEpE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC;AAYrC;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,WAAmB;IACnE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,OAAe,EAAmB,EAAE;QAChD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAChD,CAAC,CAAC;IAEF,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAEpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAE7F,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,4BAA4B,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC,yBAAyB,4BAA4B,kCAAkC,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,kBAAkB,qBAAqB,kCAAkC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;QACjE,QAAQ,CAAC,IAAI,CACX,UAAU,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,WAAW,MAAM;YAC5E,IAAI,WAAW,+BAA+B,CACjD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CACX,oBAAoB,WAAW,oEAAoE,CACpG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1E,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;AAC1C,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAoB,EACpB,UAA6B,qBAAqB;IAElD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IACpD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,UAAU,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO;QACxB,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzE,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,SAAS;gBACnB,IAAI;gBACJ,OAAO,EAAE,mBAAmB,IAAI,QAAQ,MAAM,KAAK,OAAO,EAAE;aAC7D,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe;gBACvE,QAAQ,EAAE,OAAO;gBACjB,IAAI;gBACJ,OAAO;aACR,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,UAAU;YAAE,OAAO;QACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,SAAS;gBACnB,IAAI;gBACJ,OAAO,EAAE,UAAU,IAAI,QAAQ,MAAM,uBAAuB,QAAQ,CAAC,MAAM,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,UAAU,EAAE,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAoB,EACpB,UAA6B,qBAAqB,EAClD,OAA8B;IAE9B,MAAM,IAAI,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAuB;IACnD,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;SAC1B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;SAC7C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,SAAwB,SAAS;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,OAAO,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACtC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,SAAwB,SAAS;IAC/E,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACnE,OAAO,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/core/tool-mocks.d.ts

@@ -0,0 +1,23 @@
+export interface ToolMockSpec {
+    name: string;
+    whenInput?: Record<string, unknown>;
+    result: unknown;
+}
+/**
+ * The middleware name `createToolMockMiddleware()` registers under. Assembly
+ * detects the middleware by this name to stamp `capabilities.toolMocks` on the
+ * runtime it returns — which is what lets the case engine refuse a
+ * mock-declaring case against a target whose agent-initiated calls would not be
+ * intercepted.
+ */
+export declare const TOOL_MOCK_MIDDLEWARE_NAME = "ToolMockMiddleware";
+/** The mocks declared for this run, or none. */
+export declare function readMocks(configurable: Record<string, unknown> | undefined): ToolMockSpec[];
+/**
+ * The first mock matching this call by name and (optionally) a partial input
+ * match, or `undefined` when none does. Declaration order decides, so a test
+ * can shadow a broad mock with a narrower one declared earlier.
+ */
+export declare function findMock(mocks: ToolMockSpec[], toolName: string, args: Record<string, unknown>): ToolMockSpec | undefined;
+/** A mock's result as the string payload a tool call settles with. */
+export declare function mockPayload(mock: ToolMockSpec): string;

package/dist/core/tool-mocks.js

@@ -0,0 +1,39 @@
+/**
+ * Declarative tool-mock matching, shared by the two places a mocked call can be
+ * intercepted: the tool-call middleware (agent-initiated calls) and the PTC
+ * gateway (calls scripts make through `tools.*`). Both read the same
+ * `__toolMocks` entry off the run's `configurable`, so a `mocks:` entry
+ * declared by a case means one thing whoever makes the call.
+ *
+ * Runtime-owned (not `testing/`) precisely because runtime code consumes it:
+ * the PTC gateway is runtime, and runtime never imports from testing modules.
+ * Input matching is the shared `partialMatch` — the same vocabulary a case's
+ * `calledTool.input` uses, so declaring a mock and asserting a call read alike.
+ */
+import { partialMatch } from "./match.js";
+/**
+ * The middleware name `createToolMockMiddleware()` registers under. Assembly
+ * detects the middleware by this name to stamp `capabilities.toolMocks` on the
+ * runtime it returns — which is what lets the case engine refuse a
+ * mock-declaring case against a target whose agent-initiated calls would not be
+ * intercepted.
+ */
+export const TOOL_MOCK_MIDDLEWARE_NAME = "ToolMockMiddleware";
+/** The mocks declared for this run, or none. */
+export function readMocks(configurable) {
+    const raw = configurable?.__toolMocks;
+    return Array.isArray(raw) ? raw : [];
+}
+/**
+ * The first mock matching this call by name and (optionally) a partial input
+ * match, or `undefined` when none does. Declaration order decides, so a test
+ * can shadow a broad mock with a narrower one declared earlier.
+ */
+export function findMock(mocks, toolName, args) {
+    return mocks.find((mock) => mock.name === toolName && (!mock.whenInput || partialMatch(mock.whenInput, args)));
+}
+/** A mock's result as the string payload a tool call settles with. */
+export function mockPayload(mock) {
+    return typeof mock.result === "string" ? mock.result : JSON.stringify(mock.result ?? null);
+}
+//# sourceMappingURL=tool-mocks.js.map

package/dist/core/tool-mocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-mocks.js","sourceRoot":"","sources":["../../src/core/tool-mocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAQ1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D,gDAAgD;AAChD,MAAM,UAAU,SAAS,CAAC,YAAiD;IACzE,MAAM,GAAG,GAAG,YAAY,EAAE,WAAW,CAAC;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAqB,EACrB,QAAgB,EAChB,IAA6B;IAE7B,OAAO,KAAK,CAAC,IAAI,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,IAAkB;IAC5C,OAAO,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;AAC7F,CAAC"}

package/dist/core/tool-telemetry.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Shared shaping for tool-call telemetry, so the two places that emit it — the
+ * tool-call middleware (agent-initiated calls) and the PTC gateway (calls
+ * scripts make through `tools.*`) — produce identically shaped events. A
+ * consumer must not be able to tell which path a `tool-result` came from except
+ * by its `origin`.
+ */
+/** Size cap for the `tool-result` output preview; full outputs stay in messages. */
+export declare const TOOL_OUTPUT_PREVIEW_CAP = 4096;
+/** Flatten a tool call's settled value to a capped text preview. */
+export declare function toolOutputPreview(value: unknown): {
+    output: string;
+    truncated: boolean;
+};
+/** A concise, single-value hint for a tool call (e.g. its `file_path`), for the CLI. */
+export declare function toolCallDetail(args: Record<string, unknown>): string | undefined;

package/dist/core/tool-telemetry.js

@@ -0,0 +1,40 @@
+import { ToolMessage } from "@langchain/core/messages";
+/**
+ * Shared shaping for tool-call telemetry, so the two places that emit it — the
+ * tool-call middleware (agent-initiated calls) and the PTC gateway (calls
+ * scripts make through `tools.*`) — produce identically shaped events. A
+ * consumer must not be able to tell which path a `tool-result` came from except
+ * by its `origin`.
+ */
+/** Size cap for the `tool-result` output preview; full outputs stay in messages. */
+export const TOOL_OUTPUT_PREVIEW_CAP = 4096;
+/** Flatten a tool call's settled value to a capped text preview. */
+export function toolOutputPreview(value) {
+    let text;
+    if (value instanceof ToolMessage) {
+        text = typeof value.content === "string" ? value.content : JSON.stringify(value.content) ?? "";
+    }
+    else if (typeof value === "string") {
+        text = value;
+    }
+    else {
+        try {
+            text = JSON.stringify(value) ?? String(value);
+        }
+        catch {
+            text = String(value);
+        }
+    }
+    const truncated = text.length > TOOL_OUTPUT_PREVIEW_CAP;
+    return { output: truncated ? text.slice(0, TOOL_OUTPUT_PREVIEW_CAP) : text, truncated };
+}
+/** A concise, single-value hint for a tool call (e.g. its `file_path`), for the CLI. */
+export function toolCallDetail(args) {
+    for (const key of ["file_path", "path", "to", "pattern", "command", "url"]) {
+        const value = args[key];
+        if (typeof value === "string" && value.trim())
+            return value;
+    }
+    return undefined;
+}
+//# sourceMappingURL=tool-telemetry.js.map

package/dist/core/tool-telemetry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-telemetry.js","sourceRoot":"","sources":["../../src/core/tool-telemetry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;;;GAMG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,IAAY,CAAC;IACjB,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;QACjC,IAAI,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjG,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,uBAAuB,CAAC;IACxD,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;AAC1F,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,IAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;IAC9D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}