@evalops/maestro 0.10.31 → 0.10.33

package/dist/agent/transport/tool-safety-pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-safety-pipeline.js","sourceRoot":"","sources":["../../../src/agent/transport/tool-safety-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEN,wBAAwB,GACxB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAE7B,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAEN,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACN,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,GAChB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAenE,OAAO,EAEN,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAuFrD,SAAS,uBAAuB,CAC/B,QAAgB,EAChB,IAA6B,EAC7B,KAA8B,EAC9B,QAGC;IAED,MAAM,OAAO,GAA4B;QACxC,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,IAAI;KACJ,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,YAAY,GAAG;YACtB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,+BAA+B,CAAC,QAAQ,CAAC;SACjD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC9B,2BAAoC;IAEpC,OAAO,2BAA2B;QACjC,CAAC,CAAC;YACA,SAAS,EAAE,6BAA6B;YACxC,UAAU,EAAE,cAAc;SAC1B;QACF,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,KAAK,UAAU,kCAAkC,CAChD,eAAsC,EACtC,SAAiB,EACjB,eAAgD,EAChD,MAAoB;IAEpB,MAAM,iBAAiB,GAAG,eACO,CAAC;IAClC,IACC,OAAO,iBAAiB,CAAC,kCAAkC,KAAK,UAAU,EACzE,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACzB,iBAAiB,CAAC,kCAAkC,CAAC,SAAS,EAAE;gBAC/D,MAAM;aACN,CAAC;YACF,eAAe,CAAC,IAAI,CACnB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,IAAI,CACV;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAaD,SAAS,cAAc,CAAC,GAAsB;IAY7C,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;IACpE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC;IAC7E,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC;IAEpE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;IAElE,sDAAsD;IACtD,IAAI,GAAG,GAAG,iBAAiB,IAAI,MAAM,EAAE,CAAC;QACvC,kBAAkB,CAAC,iBAAiB,CACnC,OAAO,CAAC,qBAAqB,EAC7B,mBAAmB,CACnB,CAAC;QACF,mBAAmB,GAAG,CAAC,CAAC;QACxB,iBAAiB,GAAG,GAAG,CAAC;IACzB,CAAC;IACD,mBAAmB,EAAE,CAAC;IAEtB,8BAA8B;IAC9B,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC1D,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;SAAM,IACN,aAAa,KAAK,OAAO;QACzB,aAAa,KAAK,MAAM;QACxB,aAAa,KAAK,aAAa,EAC9B,CAAC;QACF,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;SAAM,IACN,aAAa,KAAK,UAAU;QAC5B,aAAa,KAAK,WAAW;QAC7B,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5B,CAAC;QACF,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAoB;QACrC,mBAAmB;QACnB,iBAAiB;KACjB,CAAC;IAEF,qCAAqC;IACrC,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CACnD,OAAO,CAAC,qBAAqB,EAC7B,mBAAmB,CACnB,CAAC;IAEF,4BAA4B;IAC5B,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,qBAAqB,YAAY,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACtF,gBAAgB,CAAC;YAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,MAAM;YACN,MAAM,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,MAAM,cAAc,GAAsB;YACzC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,YAAY,QAAQ,CAAC,IAAI,gCAAgC,YAAY,CAAC,MAAM,IAAI,oCAAoC,cAAc,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;iBACvP;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;SACd,CAAC;QACF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC;YACtD,YAAY;YACZ,KAAK,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,mBAAmB,CAChE,aAAa,QAAQ,CAAC,IAAI,EAAE,EAC5B,SAAS,CACT,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,yBAAyB,kBAAkB,aAAa,YAAY,GAAG,IAAI,UAAU,CAAC;QACrG,MAAM,WAAW,GAAsB;YACtC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,YAAY,QAAQ,CAAC,IAAI,yBAAyB,kBAAkB,aAAa,YAAY,GAAG,IAAI,YACzG,YAAY,CAAC,SAAS;wBACrB,CAAC,CAAC,uBAAuB,YAAY,CAAC,MAAM,GAAG;wBAC/C,CAAC,CAAC,EACJ,EAAE;iBACF;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;SACd,CAAC;QACF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;YACnD,YAAY;YACZ,KAAK,EAAE;gBACN,IAAI,EAAE,YAAY;gBAClB,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAAC,iBAAiB,CACnC,aAAa,QAAQ,CAAC,IAAI,EAAE,EAC5B,MAAM,CAAC,MAAM,CACb,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEhD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACjD,CAAC;AAOD,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,kBAAkB,CACxC,GAAsB;IAKtB,MAAM,EACL,QAAQ,EACR,KAAK,EACL,WAAW,EACX,GAAG,EACH,MAAM,EACN,KAAK,EACL,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,uBAAuB,EACvB,cAAc,GACd,GAAG,GAAG,CAAC;IAER,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAE,EAAE;QACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,KAAK,CAAC;IACd,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,SAAuB,EAAE,EAAE;QAChD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAC1B,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,kBAAkB,CAC7D,QAAQ,CAAC,SAAoC,CAC7C,CAAC;IAEF,mBAAmB;IACnB,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,qBAAqB,CAC1B,WAAW,EACX,QAAQ,CAAC,IAAI,EACb,kBAAkB,EAClB,QAAQ,EACR,CAAC,EACD,eAAe,CAAC,KAAK,CAAC,MAAM,CAC5B,CAAC;QACF,MAAM,aAAa,GAAG,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IACD,MAAM,WAAW,CAAC;QACjB,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,GAAG,CAAC,kBAAkB;KAClC,CAAC,CAAC;IAEH,sBAAsB;IACtB,IAAI,iBAAiB,GAAG,QAAQ,CAAC;IACjC,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE1E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,iBAAiB,GAAsB;gBAC5C,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE;oBACR;wBACC,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,oBAAoB,UAAU,CAAC,WAAW,IAAI,uBAAuB,EAAE;qBAC7E;iBACD;gBACD,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,MAAM,qBAAqB,CAC1B,WAAW,EACX,QAAQ,CAAC,IAAI,EACb,gBAAgB,CAAC,kBAAkB,CAClC,QAAQ,CAAC,SAAoC,CAC7C,EACD,QAAQ,EACR,CAAC,EACD,UAAU,CAAC,WAAW,CACtB,CAAC;YACF,MAAM,iBAAiB,GAAG,YAAY,CACrC,cAAc,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,CACjD,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACvC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,OAAO;gBACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;gBACvC,eAAe,EAAE,eAAe,CAAC,YAAY;aAC7C,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAC/B,QAAQ,CAAC,SAAoC,CAC7C,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CACL,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACvB,QAAQ,CAAC,SAAqC,CAAC,CAAC,CAAC;oBACjD,UAAU,CAAC,YAAa,CAAC,CAAC,CAAC,CAC7B,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,SAAS;gBACT,WAAW;gBACX,YAAY;aACZ,CAAC,CAAC;YACH,iBAAiB,GAAG;gBACnB,GAAG,QAAQ;gBACX,SAAS,EAAE,UAAU,CAAC,YAAY;aAClC,CAAC;QACH,CAAC;IACF,CAAC;IAED,yCAAyC;IACzC,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,CAChD,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,SAAoC,EACtD;QACC,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,iBAAiB,CAAC,KAAK,IAAI;KACxE,CACD,CAAC;IAEF,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,mBAAmB,GAAsB;YAC9C,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,4BAA4B,WAAW,CAAC,MAAM,IAAI,yBAAyB,EAAE;iBACnF;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,qBAAqB,CAC1B,WAAW,EACX,QAAQ,CAAC,IAAI,EACb,WAAW,CAAC,aAAa,EACzB,QAAQ,EACR,CAAC,EACD,WAAW,CAAC,MAAM,CAClB,CAAC;QACF,MAAM,mBAAmB,GAAG,YAAY,CACvC,cAAc,CAAC,mBAAmB,EAAE,QAAQ,EAAE,IAAI,CAAC,CACnD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,eAAe,GAAG,IAAI,CAAC;IAC3B,IAAI,cAAkC,CAAC;IAEvC,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAClC,eAAe,GAAG,KAAK,CAAC;QACxB,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC;IACrC,CAAC;IAED,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,CAAC,IAA6B,EAAE,EAAE,CAAC,CAAC;QACxD,WAAW,EAAE,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAClE,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAC5D,iBAAiB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QACvC,QAAQ,EAAE,iBAAiB,CAAC,IAAI;QAChC,IAAI,EAAE,iBAAiB,CAAC,SAAS;QACjC,QAAQ,EAAE;YACT,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,OAAO,EAAE,WAAW;YACjC,YAAY,EAAE,GAAG,CAAC,YAAY;SAC9B;QACD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,gBAAgB,GAAG,wBAAwB,CAC9C,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,SAAS,EAC3B,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,CAC5B,CAAC;IACF,IAAI,2BAA2B,GAC9B,OAAO,CAAC,gBAAgB,CAAC;QACzB,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACrC,OAAO,CAAC,MAAM,KAAK,4BAA4B,CAAC,CAAC;IACnD,IAAI,yBAAyB,GAAG,gBAAgB;QAC/C,CAAC,CAAC,+BAA+B,CAAC,gBAAgB,CAAC;QACnD,CAAC,CAAC,2BAA2B,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACrE,CAAC,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,uBAAuB,GAAG,CAC/B,KAAuB,EAC+B,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;QAC9C,WAAW,EACV,mIAAmI;KACpI,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,KAAK,EAC9B,YAAiE,EACjE,eAAyB,EACxB,EAAE;QACH,MAAM,aAAa,GAAsB;YACxC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,eAAe,CAAC,EAAE;YAC9B,QAAQ,EAAE,eAAe,CAAC,IAAI;YAC9B,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,+BAA+B,YAAY,CAAC,MAAM,GACvD,YAAY,CAAC,WAAW;wBACvB,CAAC,CAAC,mBAAmB,YAAY,CAAC,WAAW,EAAE;wBAC/C,CAAC,CAAC,EACJ,EAAE;iBACF;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,qBAAqB,CAC1B,WAAW,EACX,eAAe,CAAC,IAAI,EACpB,gBAAgB,CAAC,kBAAkB,CAClC,eAAe,CAAC,SAAoC,CACpD,EACD,QAAQ,EACR,CAAC,EACD,YAAY,CAAC,MAAM,CACnB,CAAC;QACF,MAAM,qBAAqB,GAAG,YAAY,CACzC,cAAc,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,CACpD,CAAC;QACF,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAChE,eAAe,CAAC,SAAoC,CACpD,CAAC;QACF,0BAA0B,CAAC;YAC1B,OAAO,EAAE,YAAY,CAAC,MAAM;YAC5B,SAAS,EAAE,eAAe,CAAC,IAAI;YAC/B,MAAM,EACL,OAAO,qBAAqB,CAAC,OAAO,KAAK,QAAQ;gBAChD,CAAC,CAAC,qBAAqB,CAAC,OAAO;gBAC/B,CAAC,CAAC,eAAe,CAAC,IAAI;YACxB,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,qBAAqB;YAC9B,WAAW,EAAE;gBACZ,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE;gBAC3B,iBAAiB,EAAE,eAAe,CAAC,EAAE;aACrC;SACD,CAAC,CAAC;QACH,MAAM,wBAAwB,GAAG,EAAE,OAAO,EAAE,SAAkB,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO;YACN,aAAa,EAAE,qBAAqB;YACpC,OAAO,EAAE,wBAAwB;YACjC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;SACxC,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,eAAe,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACtC,uBAAuB,CAAC,gBAAgB,CAAC,EACzC,iBAAiB,CACjB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;SACxC,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IACC,OAAO,CAAC,MAAM,KAAK,kBAAkB;QACrC,OAAO,CAAC,MAAM,KAAK,wBAAwB,EAC1C,CAAC;QACF,MAAM,YAAY,GAAG,oBAAoB,CACxC,QAAQ,EACR,gBAAgB,EAChB,KAAK,CACL,CAAC;QACF,MAAM,mBAAmB,GAAG,YAAY,CACvC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC5C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,WAAW,GAAsB;YACtC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,gBAAgB,QAAQ,CAAC,IAAI,aAAa;iBAChD;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,WAAW,GAAG,YAAY,CAC/B,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,uBAA4D,CAAC;IACjE,IAAI,uBAEQ,CAAC;IACb,IAAI,wBAAwB,GAAG,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC,kBAAkB,CACrD,iBAAiB,CAAC,SAAoC,CACtD,CAAC;IACF,MAAM,WAAW,GAA6B;QAC7C,GAAG;QACH,QAAQ;QACR,OAAO;QACP,aAAa,EAAE,UAAU;QACzB,GAAG,YAAY,CAAC,UAAU,CAAC;KAC3B,CAAC;IACF,IAAI,mBAAmB,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC;YAC7B,KAAK,SAAS,CAAC;YACf,KAAK,OAAO;gBACX,uBAAuB,GAAG,YAAY,CAAC,IAAI,CAAC;gBAC5C,MAAM;YACP,KAAK,eAAe;gBACnB,uBAAuB,GAAG,YAAY,CAAC,IAAI,CAAC;gBAC5C,uBAAuB;oBACtB,YAAY,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;wBAC7C,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE;wBACvD,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;gBACzB,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC7C,MAAM;YACP,KAAK,MAAM,CAAC,CAAC,CAAC;gBACb,MAAM,qBAAqB,CAC1B,WAAW,EACX,iBAAiB,CAAC,IAAI,EACtB,UAAU,EACV,QAAQ,EACR,CAAC,EACD,YAAY,CAAC,MAAM,CACnB,CAAC;gBACF,MAAM,YAAY,GAAsB;oBACvC,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;oBACtD,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,MAAM,YAAY,GAAG,YAAY,CAChC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC5C,eAAe,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,eAAe;oBAC5D,iBAAiB,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB;iBAChE,CAAC,CACF,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,OAAO;oBACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;oBACvC,eAAe,EAAE,eAAe,CAAC,YAAY;iBAC7C,CAAC;YACH,CAAC;YACD;gBACC,MAAM;QACR,CAAC;IACF,CAAC;IAED,mBAAmB;IACnB,IACC,OAAO,CAAC,MAAM,KAAK,kBAAkB;QACrC,uBAAuB;QACvB,2BAA2B,EAC1B,CAAC;QACF,MAAM,mBAAmB,GACxB,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,0BAA0B,GAAG,KAAK,CAAC;QACvC,IAAI,WAAW,EAAE,yBAAyB,EAAE,CAAC;YAC5C,MAAM,oBAAoB,GAAG,MAAM,WAAW,CAAC,yBAAyB,CACvE,iBAAiB,EACjB,uBAAuB,EAAE,MAAM;gBAC9B,yBAAyB;gBACzB,mBAAmB;gBACnB,cAAc;gBACd,mBAAmB,EACpB,MAAM,CACN,CAAC;YACF,IAAI,oBAAoB,CAAC,YAAY,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACvE,iBAAiB,GAAG;oBACnB,GAAG,iBAAiB;oBACpB,SAAS,EAAE,oBAAoB,CAAC,YAAY;iBAC5C,CAAC;gBACF,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;oBAChD,QAAQ,EAAE,iBAAiB,CAAC,IAAI;oBAChC,IAAI,EAAE,iBAAiB,CAAC,SAAS;oBACjC,QAAQ,EAAE;wBACT,aAAa,EAAE,gBAAgB;wBAC/B,WAAW,EAAE,OAAO,EAAE,WAAW;wBACjC,YAAY,EAAE,GAAG,CAAC,YAAY;qBAC9B;oBACD,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,UAAU,EAAE,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC;iBACvD,CAAC,CAAC;gBACH,IAAI,gBAAgB,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACzC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACtC,gBAAgB,EAChB,iBAAiB,CACjB,CAAC;oBACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;wBAC3C,MAAM,KAAK,CAAC;oBACb,CAAC;oBACD,OAAO;wBACN,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,eAAe,EAAE,OAAO,CAAC,eAAe;qBACxC,CAAC;gBACH,CAAC;gBACD,MAAM,YAAY,GAAG,wBAAwB,CAC5C,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,SAAS,EAC3B,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,CAC5B,CAAC;gBACF,IAAI,YAAY,EAAE,eAAe,KAAK,OAAO,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACtC,uBAAuB,CAAC,YAAY,CAAC,EACrC,iBAAiB,CACjB,CAAC;oBACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;wBAC3C,MAAM,KAAK,CAAC;oBACb,CAAC;oBACD,OAAO;wBACN,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,eAAe,EAAE,OAAO,CAAC,eAAe;qBACxC,CAAC;gBACH,CAAC;gBACD,IAAI,YAAY,EAAE,CAAC;oBAClB,gBAAgB,GAAG,YAAY,CAAC;oBAChC,2BAA2B,GAAG,IAAI,CAAC;oBACnC,yBAAyB;wBACxB,+BAA+B,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC;YACF,CAAC;YACD,IAAI,oBAAoB,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/C,IAAI,CAAC,2BAA2B,EAAE,CAAC;oBAClC,0BAA0B,GAAG,IAAI,CAAC;oBAClC,eAAe,GAAG,IAAI,CAAC;oBACvB,cAAc,GAAG,oBAAoB,CAAC,cAAc,CAAC;gBACtD,CAAC;YACF,CAAC;iBAAM,IAAI,oBAAoB,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACrD,0BAA0B,GAAG,IAAI,CAAC;gBAClC,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc;oBACb,oBAAoB,CAAC,cAAc;wBACnC,6CAA6C,CAAC;YAChD,CAAC;QACF,CAAC;QAED,IACC,0BAA0B;YAC1B,mBAAmB;YACnB,uBAAuB;YACvB,uBAAuB,EAAE,IAAI,KAAK,UAAU,EAC3C,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAC3D,WAAW,EACX,uBAAuB,EACvB;gBACC,QAAQ,EAAE,eAAe;gBACzB,MAAM,EAAE,cAAc;gBACtB,UAAU,EAAE,QAAQ;aACpB,EACD,MAAM,CACN,CAAC;YACF,wBAAwB,GAAG,IAAI,CAAC;YAChC,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC;YAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClC,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,IAAI,CAAC;gBACvB,cAAc,GAAG,SAAS,CAAC;YAC5B,CAAC;QACF,CAAC;QAED,IACC,2BAA2B;YAC3B,eAAe,EAAE,uBAAuB,EAAE,KAAK,IAAI,EAClD,CAAC;YACF,eAAe,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBACjC,cAAc,GAAG,GAAG,yBAAyB,IAAI,mBAAmB,IAAI,gDAAgD,wDAAwD,CAAC;YAClL,CAAC;YACD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAChE,iBAAiB,CAAC,SAAoC,CACtD,CAAC;YACF,MAAM,mBAAmB,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAChE,wBAAwB,CAAC;gBACxB,mBAAmB,EAClB,uBAAuB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,QAAQ,CAAC,EAAE;gBACnE,MAAM,EACL,mBAAmB,CAAC,iBAAiB;oBACrC,mBAAmB,CAAC,YAAY;oBAChC,iBAAiB,CAAC,IAAI;gBACvB,OAAO,EACN,OAAO,qBAAqB,CAAC,OAAO,KAAK,QAAQ;oBAChD,CAAC,CAAC,qBAAqB,CAAC,OAAO;oBAC/B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,wCAAwC;gBACvD,GAAG,sBAAsB,CAAC,IAAI,CAAC;gBAC/B,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,uBAAuB,CAC/B,iBAAiB,CAAC,IAAI,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,CACnB;gBACD,WAAW,EAAE;oBACZ,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE;oBAC3B,iBAAiB,EAAE,QAAQ,CAAC,EAAE;iBAC9B;aACD,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,eAAe,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC3D,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAChE,iBAAiB,CAAC,SAAoC,CACtD,CAAC;YACF,MAAM,OAAO,GACZ,CAAC,2BAA2B,IAAI,uBAAuB;gBACtD,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAE;oBACD,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,GAAG,YAAY,CAAC,qBAAqB,CAAC;oBACtC,IAAI,EAAE,qBAAqB;oBAC3B,MAAM,EACL,yBAAyB;wBACzB,mBAAmB;wBACnB,mBAAmB;oBACpB,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE;iBACyC,CAAC;YACtE,MAAM,gBAAgB,GAAG,eAAe,CAAC,uBAAuB,EAAE,CAAC;YACnE,MAAM,eAAe,GAAG,eAAe,CAAC,eAAe,CACtD,OAAO,EACP,MAAM,EACN,KAAK,CACL,CAAC;YACF,MAAM,oBAAoB,GAAG,MAAM,kCAAkC,CACpE,eAAe,EACf,OAAO,CAAC,EAAE,EACV,eAAe,EACf,MAAM,CACN,CAAC;YACF,wBAAwB,CAAC;gBACxB,mBAAmB,EAClB,uBAAuB,EAAE,EAAE;oBAC3B,uBAAuB,EAAE,QAAQ,CAAC,iBAAiB;oBACnD,oBAAoB,EAAE,uBAAuB;oBAC7C,OAAO,CAAC,EAAE;gBACX,MAAM,EACL,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ;gBACtE,OAAO,EACN,OAAO,qBAAqB,CAAC,OAAO,KAAK,QAAQ;oBAChD,CAAC,CAAC,qBAAqB,CAAC,OAAO;oBAC/B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,wCAAwC;gBACvD,GAAG,sBAAsB,CAAC,2BAA2B,CAAC;gBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,uBAAuB,CAC/B,OAAO,CAAC,QAAQ,EAChB,qBAAqB,EACrB,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EACrD;oBACC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;iBAClC,CACD;gBACD,WAAW,EAAE;oBACZ,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE;oBAC3B,iBAAiB,EAAE,QAAQ,CAAC,EAAE;iBAC9B;aACD,CAAC,CAAC;YACH,IAAI,gBAAgB,EAAE,CAAC;gBACtB,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC;YAC1C,MAAM,QAAQ,GACb,WAAW,CAAC,YAAY,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE;gBAC/C,CAAC,CAAC,WAAW,CAAC;YAChB,IAAI,gBAAgB,EAAE,CAAC;gBACtB,MAAM,WAAW,CAAC;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO;oBACP,QAAQ;iBACR,CAAC,CAAC;YACJ,CAAC;YAED,IACC,mBAAmB;gBACnB,uBAAuB;gBACvB,uBAAuB,EAAE,IAAI,KAAK,UAAU,EAC3C,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAC3D,WAAW,EACX,uBAAuB,EACvB,QAAQ,EACR,MAAM,CACN,CAAC;gBACF,wBAAwB,GAAG,IAAI,CAAC;gBAChC,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAClC,eAAe,GAAG,KAAK,CAAC;oBACxB,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;gBACpC,CAAC;qBAAM,CAAC;oBACP,eAAe,GAAG,IAAI,CAAC;oBACvB,cAAc,GAAG,SAAS,CAAC;gBAC5B,CAAC;YACF,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxB,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc,GAAG,QAAQ,CAAC,MAAM,IAAI,mBAAmB,CAAC;YACzD,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,IACC,mBAAmB;YACnB,uBAAuB;YACvB,uBAAuB,EAAE,IAAI,KAAK,UAAU;YAC5C,CAAC,wBAAwB,EACxB,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAC3D,WAAW,EACX,uBAAuB,EACvB;gBACC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,cAAc,IAAI,iBAAiB;gBAC3C,UAAU,EAAE,QAAQ;aACpB,EACD,MAAM,CACN,CAAC;YACF,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC;YAC1C,cAAc;gBACb,UAAU,CAAC,MAAM,KAAK,MAAM;oBAC3B,CAAC,CAAC,UAAU,CAAC,MAAM;oBACnB,CAAC,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,qBAAqB,CAC1B,WAAW,EACX,iBAAiB,CAAC,IAAI,EACtB,gBAAgB,CAAC,kBAAkB,CAClC,iBAAiB,CAAC,SAAoC,CACtD,EACD,QAAQ,EACR,CAAC,EACD,cAAc,CACd,CAAC;QACF,MAAM,YAAY,GAAsB;YACvC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAI,eAAe,EAAE,CAAC;YACpE,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,YAAY,GAAG,YAAY,CAChC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC5C,eAAe,EAAE,uBAAuB,EAAE,QAAQ,CAAC,eAAe;YAClE,iBAAiB,EAAE,uBAAuB,EAAE,QAAQ,CAAC,iBAAiB;SACtE,CAAC,CACF,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,aAAsC,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACnE,aAAa,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,MAAM,qBAAqB,GAAsB;YAChD,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC5D;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,gBAAgB,GAAG,YAAY,CACpC,cAAc,CAAC,qBAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC,CACrD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAC3B,gBAAgB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,OAAO;QACN,OAAO,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,iBAAiB;YACjB,aAAa;YACb,OAAO;YACP,MAAM;YACN,sBAAsB;YACtB,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;QACD,eAAe,EAAE,eAAe,CAAC,YAAY;KAC7C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Tool Safety Pipeline\n * Pre-execution safety evaluation: rate limiting, adaptive thresholds,\n * safety middleware, firewall checks, PII policy, approval flow, and tool validation.\n *\n * Yields events as they occur and returns a verdict when complete.\n */\n\nimport {\n\ttype ActionFirewall,\n\tHUMAN_EGRESS_PII_RULE_ID,\n} from \"../../safety/action-firewall.js\";\nimport type { AdaptiveThresholds } from \"../../safety/adaptive-thresholds.js\";\nimport { METRICS } from \"../../safety/adaptive-thresholds.js\";\nimport {\n\tDEFAULT_GUARDED_FILE_RULE_ID,\n\tGUARDED_FILES_BLOCK_POLICY_ID,\n\ttype GuardedFileMatch,\n\tclassifyGuardedFileAccessAction,\n\tdescribeDefaultGuardedFileMatch,\n\tfindGuardedToolCallMatch,\n} from \"../../safety/guarded-files.js\";\nimport type { SafetyMiddleware } from \"../../safety/safety-middleware.js\";\nimport type { WorkflowStateTracker } from \"../../safety/workflow-state.js\";\nimport {\n\ttype RecordMaestroApprovalHitInput,\n\trecordMaestroApprovalHit,\n\trecordMaestroFirewallBlock,\n} from \"../../telemetry/maestro-event-bus.js\";\nimport { trackToolBlocked } from \"../../telemetry/security-events.js\";\nimport type { Clock } from \"../../utils/clock.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nimport {\n\tdescribeToolActivity,\n\tdescribeToolDisplayName,\n\tsummarizeToolUse,\n} from \"../../utils/tool-use-summary.js\";\nimport type {\n\tActionApprovalDecision,\n\tActionApprovalService,\n\tActionFirewallVerdict,\n} from \"../action-approval.js\";\nimport { validateToolArguments } from \"../providers/validation.js\";\nimport type {\n\tAgentEvent,\n\tAgentRunConfig,\n\tAgentTool,\n\tMessage,\n\tToolCall,\n\tToolResultMessage,\n\tToolSchedulingMetadata,\n} from \"../types.js\";\nimport type {\n\tPlatformToolExecutionBridge,\n\tToolExecutionBridgeInput,\n\tToolExecutionBridgePlan,\n} from \"./tool-execution-bridge.js\";\nimport {\n\ttype ToolAuditLogger,\n\tbuildPiiPolicyResult,\n\textractTextFromContent,\n\tlogToolExecutionAudit,\n} from \"./transport-utils.js\";\n\nconst logger = createLogger(\"transport:tool-safety\");\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type ToolSafetyVerdict =\n\t| { outcome: \"blocked\"; events: AgentEvent[] }\n\t| {\n\t\t\toutcome: \"proceed\";\n\t\t\teffectiveToolCall: ToolCall;\n\t\t\tvalidatedArgs: Record<string, unknown>;\n\t\t\ttoolDef: AgentTool;\n\t\t\tevents: AgentEvent[];\n\t\t\tsanitizedExecutionArgs: Record<string, unknown>;\n\t\t\ttoolExecutionBridgePlan?: ToolExecutionBridgePlan;\n\t  };\n\nexport interface ToolSafetyContext {\n\ttoolCall: ToolCall;\n\ttools: AgentTool[];\n\tuserMessage: Message;\n\tcfg: AgentRunConfig;\n\tsignal?: AbortSignal;\n\t// Services\n\tclock: Clock;\n\tsafetyMiddleware: SafetyMiddleware;\n\tworkflowState: WorkflowStateTracker;\n\tadaptiveThresholds: AdaptiveThresholds;\n\tauditLogger?: ToolAuditLogger;\n\tapprovalService?: ActionApprovalService;\n\ttoolExecutionBridge?: PlatformToolExecutionBridge;\n\thookService?: {\n\t\trunPreToolUseHooks: (\n\t\t\ttoolCall: ToolCall,\n\t\t\tsignal?: AbortSignal,\n\t\t) => Promise<{\n\t\t\tblocked?: boolean;\n\t\t\tblockReason?: string;\n\t\t\tupdatedInput?: Record<string, unknown>;\n\t\t}>;\n\t\trunPermissionRequestHooks?: (\n\t\t\ttoolCall: ToolCall,\n\t\t\treason: string,\n\t\t\tsignal?: AbortSignal,\n\t\t) => Promise<{\n\t\t\tdecision?: \"allow\" | \"deny\";\n\t\t\tdecisionReason?: string;\n\t\t\tupdatedInput?: Record<string, unknown>;\n\t\t}>;\n\t};\n\tfirewall: ActionFirewall;\n\t// Mutable rate-limit state\n\trateLimitState: {\n\t\trecentToolTimestamps: Map<string, number[]>;\n\t\ttoolCallsThisMinute: number;\n\t\tminuteWindowStart: number;\n\t\trateWindowMs: number;\n\t\trateLimit: number;\n\t};\n\t/** Suppress loop warnings for a transport-managed read-only duplicate while preserving other policy checks. */\n\tshouldSkipLoopDetection?: (toolCall: ToolCall) => boolean;\n\t/** Scheduler diagnostics captured before safety hooks mutate the call. */\n\tschedulingMetadata?: ToolSchedulingMetadata;\n\t// Emit helpers\n\temitToolResult: (\n\t\tmessage: ToolResultMessage,\n\t\ttoolCall: ToolCall,\n\t\tisError: boolean,\n\t\tmetadata?: {\n\t\t\ttoolExecutionId?: string;\n\t\t\tapprovalRequestId?: string;\n\t\t},\n\t) => AgentEvent[];\n}\n\ninterface ApprovalRegistrationMetadata {\n\tremoteApprovalRequestId?: string;\n}\n\ninterface ApprovalRegistrationAwareService {\n\twaitForPendingApprovalRegistration?: (\n\t\trequestId: string,\n\t\toptions?: { signal?: AbortSignal },\n\t) => Promise<ApprovalRegistrationMetadata | null>;\n}\n\nfunction guardedFileAuditContext(\n\ttoolName: string,\n\targs: Record<string, unknown>,\n\tmatch: GuardedFileMatch | null,\n\tmetadata: {\n\t\tdisplayName?: string;\n\t\tsummaryLabel?: string;\n\t},\n): Record<string, unknown> {\n\tconst context: Record<string, unknown> = {\n\t\ttool_name: toolName,\n\t\tdisplay_name: metadata.displayName,\n\t\tsummary_label: metadata.summaryLabel,\n\t\targs,\n\t};\n\tif (match) {\n\t\tcontext.guarded_file = {\n\t\t\trule_id: match.ruleId,\n\t\t\tcategory: match.category,\n\t\t\tpattern: match.pattern,\n\t\t\tpath: match.path,\n\t\t\taction: classifyGuardedFileAccessAction(toolName),\n\t\t};\n\t}\n\treturn context;\n}\n\nfunction guardedFileAuditFields(\n\tguardedFileApprovalRequired: boolean,\n): Pick<RecordMaestroApprovalHitInput, \"policy_id\" | \"risk_level\"> {\n\treturn guardedFileApprovalRequired\n\t\t? {\n\t\t\t\tpolicy_id: GUARDED_FILES_BLOCK_POLICY_ID,\n\t\t\t\trisk_level: \"guarded_file\",\n\t\t\t}\n\t\t: {};\n}\n\nasync function waitForPendingApprovalRegistration(\n\tapprovalService: ActionApprovalService,\n\trequestId: string,\n\tdecisionPromise: Promise<ActionApprovalDecision>,\n\tsignal?: AbortSignal,\n): Promise<ApprovalRegistrationMetadata | null> {\n\tconst registrationAware = approvalService as ActionApprovalService &\n\t\tApprovalRegistrationAwareService;\n\tif (\n\t\ttypeof registrationAware.waitForPendingApprovalRegistration !== \"function\"\n\t) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\treturn await Promise.race([\n\t\t\tregistrationAware.waitForPendingApprovalRegistration(requestId, {\n\t\t\t\tsignal,\n\t\t\t}),\n\t\t\tdecisionPromise.then(\n\t\t\t\t() => null,\n\t\t\t\t() => null,\n\t\t\t),\n\t\t]);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Rate Limiting\n// ─────────────────────────────────────────────────────────────────────────────\n\ntype RateLimitBlockKind = \"anomaly\" | \"rate_limit\";\n\ninterface RateLimitBlock {\n\tkind: RateLimitBlockKind;\n\treason: string;\n}\n\nfunction checkRateLimit(ctx: ToolSafetyContext):\n\t| {\n\t\t\tblocked: true;\n\t\t\tevents: AgentEvent[];\n\t\t\tupdatedState: RateLimitUpdate;\n\t\t\tblock: RateLimitBlock;\n\t  }\n\t| {\n\t\t\tblocked: false;\n\t\t\trecent: number[];\n\t\t\tupdatedState: RateLimitUpdate;\n\t  } {\n\tconst { toolCall, clock, adaptiveThresholds, emitToolResult } = ctx;\n\tconst { recentToolTimestamps, rateWindowMs, rateLimit } = ctx.rateLimitState;\n\tlet { toolCallsThisMinute, minuteWindowStart } = ctx.rateLimitState;\n\n\tconst now = clock.now();\n\tconst timestamps = recentToolTimestamps.get(toolCall.name) ?? [];\n\tconst recent = timestamps.filter((ts) => now - ts < rateWindowMs);\n\n\t// Track tool calls per minute for adaptive thresholds\n\tif (now - minuteWindowStart >= 60_000) {\n\t\tadaptiveThresholds.recordObservation(\n\t\t\tMETRICS.TOOL_CALLS_PER_MINUTE,\n\t\t\ttoolCallsThisMinute,\n\t\t);\n\t\ttoolCallsThisMinute = 0;\n\t\tminuteWindowStart = now;\n\t}\n\ttoolCallsThisMinute++;\n\n\t// Track tool-specific metrics\n\tconst toolNameLower = toolCall.name.toLowerCase();\n\tif (toolNameLower === \"read\" || toolNameLower === \"glob\") {\n\t\tadaptiveThresholds.recordObservation(METRICS.READS_PER_MINUTE, 1);\n\t} else if (\n\t\ttoolNameLower === \"write\" ||\n\t\ttoolNameLower === \"edit\" ||\n\t\ttoolNameLower === \"apply_patch\"\n\t) {\n\t\tadaptiveThresholds.recordObservation(METRICS.WRITES_PER_MINUTE, 1);\n\t} else if (\n\t\ttoolNameLower === \"webfetch\" ||\n\t\ttoolNameLower === \"websearch\" ||\n\t\ttoolNameLower.includes(\"mcp\")\n\t) {\n\t\tadaptiveThresholds.recordObservation(METRICS.EGRESS_PER_MINUTE, 1);\n\t}\n\n\tconst updatedState: RateLimitUpdate = {\n\t\ttoolCallsThisMinute,\n\t\tminuteWindowStart,\n\t};\n\n\t// Check for anomalous tool call rate\n\tconst anomalyCheck = adaptiveThresholds.checkAnomaly(\n\t\tMETRICS.TOOL_CALLS_PER_MINUTE,\n\t\ttoolCallsThisMinute,\n\t);\n\n\t// Enforce anomaly detection\n\tif (anomalyCheck.isAnomaly) {\n\t\tconst reason = `Anomaly detected: ${anomalyCheck.reason ?? \"Unusual tool call rate\"}`;\n\t\ttrackToolBlocked({\n\t\t\ttoolName: toolCall.name,\n\t\t\treason,\n\t\t\tsource: \"adaptive\",\n\t\t});\n\t\tconst anomalyMessage: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Blocked \"${toolCall.name}\" due to anomalous behavior: ${anomalyCheck.reason ?? \"Unusual tool call pattern detected\"}. Z-score: ${anomalyCheck.zScore.toFixed(2)}, Baseline: ${anomalyCheck.mean.toFixed(2)} ± ${anomalyCheck.stdDev.toFixed(2)}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: now,\n\t\t};\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tevents: emitToolResult(anomalyMessage, toolCall, true),\n\t\t\tupdatedState,\n\t\t\tblock: {\n\t\t\t\tkind: \"anomaly\",\n\t\t\t\treason,\n\t\t\t},\n\t\t};\n\t}\n\n\t// Use adaptive threshold if we have enough data, otherwise use static limit\n\tconst effectiveRateLimit = adaptiveThresholds.getAdaptedThreshold(\n\t\t`tool_rate_${toolCall.name}`,\n\t\trateLimit,\n\t);\n\n\tif (recent.length >= effectiveRateLimit) {\n\t\tconst reason = `Rate limit exceeded: >${effectiveRateLimit} calls in ${rateWindowMs / 1000}s window`;\n\t\tconst rateMessage: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Blocked \"${toolCall.name}\" due to rate limit: >${effectiveRateLimit} calls in ${rateWindowMs / 1000}s window.${\n\t\t\t\t\t\tanomalyCheck.isAnomaly\n\t\t\t\t\t\t\t? ` (Anomaly detected: ${anomalyCheck.reason})`\n\t\t\t\t\t\t\t: \"\"\n\t\t\t\t\t}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: now,\n\t\t};\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tevents: emitToolResult(rateMessage, toolCall, true),\n\t\t\tupdatedState,\n\t\t\tblock: {\n\t\t\t\tkind: \"rate_limit\",\n\t\t\t\treason,\n\t\t\t},\n\t\t};\n\t}\n\n\t// Record observation for per-tool adaptive rate\n\tadaptiveThresholds.recordObservation(\n\t\t`tool_rate_${toolCall.name}`,\n\t\trecent.length,\n\t);\n\trecent.push(now);\n\trecentToolTimestamps.set(toolCall.name, recent);\n\n\treturn { blocked: false, recent, updatedState };\n}\n\ninterface RateLimitUpdate {\n\ttoolCallsThisMinute: number;\n\tminuteWindowStart: number;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Main Safety Evaluation\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Evaluate all safety checks for a tool call before execution.\n * Yields events as they occur and returns the final verdict.\n */\nexport async function* evaluateToolSafety(\n\tctx: ToolSafetyContext,\n): AsyncGenerator<\n\tAgentEvent,\n\t{ verdict: ToolSafetyVerdict; rateLimitUpdate: RateLimitUpdate }\n> {\n\tconst {\n\t\ttoolCall,\n\t\ttools,\n\t\tuserMessage,\n\t\tcfg,\n\t\tsignal,\n\t\tclock,\n\t\tsafetyMiddleware,\n\t\tworkflowState,\n\t\tauditLogger,\n\t\tapprovalService,\n\t\ttoolExecutionBridge,\n\t\thookService,\n\t\tfirewall,\n\t\tshouldSkipLoopDetection,\n\t\temitToolResult,\n\t} = ctx;\n\n\tconst events: AgentEvent[] = [];\n\tconst recordEvent = (event: AgentEvent) => {\n\t\tevents.push(event);\n\t\treturn event;\n\t};\n\tconst recordEvents = (newEvents: AgentEvent[]) => {\n\t\tevents.push(...newEvents);\n\t\treturn newEvents;\n\t};\n\n\tconst sanitizedStartArgs = safetyMiddleware.sanitizeForLogging(\n\t\ttoolCall.arguments as Record<string, unknown>,\n\t);\n\n\t// 1. Rate limiting\n\tconst rateLimitResult = checkRateLimit(ctx);\n\tif (rateLimitResult.blocked) {\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\ttoolCall.name,\n\t\t\tsanitizedStartArgs,\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\trateLimitResult.block.reason,\n\t\t);\n\t\tconst blockedEvents = recordEvents(rateLimitResult.events);\n\t\tfor (const event of blockedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\tyield recordEvent({\n\t\ttype: \"tool_execution_start\",\n\t\ttoolCallId: toolCall.id,\n\t\ttoolName: toolCall.name,\n\t\targs: sanitizedStartArgs,\n\t\tscheduling: ctx.schedulingMetadata,\n\t});\n\n\t// 2. PreToolUse hooks\n\tlet effectiveToolCall = toolCall;\n\tif (hookService) {\n\t\tconst hookResult = await hookService.runPreToolUseHooks(toolCall, signal);\n\n\t\tif (hookResult.blocked) {\n\t\t\tconst hookBlockedResult: ToolResultMessage = {\n\t\t\t\trole: \"toolResult\",\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\tcontent: [\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\ttext: `Blocked by hook: ${hookResult.blockReason ?? \"Hook denied execution\"}`,\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t\tisError: true,\n\t\t\t\ttimestamp: clock.now(),\n\t\t\t};\n\t\t\tawait logToolExecutionAudit(\n\t\t\t\tauditLogger,\n\t\t\t\ttoolCall.name,\n\t\t\t\tsafetyMiddleware.sanitizeForLogging(\n\t\t\t\t\ttoolCall.arguments as Record<string, unknown>,\n\t\t\t\t),\n\t\t\t\t\"denied\",\n\t\t\t\t0,\n\t\t\t\thookResult.blockReason,\n\t\t\t);\n\t\t\tconst hookBlockedEvents = recordEvents(\n\t\t\t\temitToolResult(hookBlockedResult, toolCall, true),\n\t\t\t);\n\t\t\tfor (const event of hookBlockedEvents) {\n\t\t\t\tyield event;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t\t};\n\t\t}\n\n\t\tif (hookResult.updatedInput) {\n\t\t\tconst originalKeys = Object.keys(\n\t\t\t\ttoolCall.arguments as Record<string, unknown>,\n\t\t\t);\n\t\t\tconst updatedKeys = Object.keys(hookResult.updatedInput);\n\t\t\tconst addedKeys = updatedKeys.filter((k) => !originalKeys.includes(k));\n\t\t\tconst removedKeys = originalKeys.filter((k) => !updatedKeys.includes(k));\n\t\t\tconst modifiedKeys = updatedKeys.filter(\n\t\t\t\t(k) =>\n\t\t\t\t\toriginalKeys.includes(k) &&\n\t\t\t\t\t(toolCall.arguments as Record<string, unknown>)[k] !==\n\t\t\t\t\t\thookResult.updatedInput![k],\n\t\t\t);\n\t\t\tlogger.debug(\"Hook modified tool input\", {\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\taddedKeys,\n\t\t\t\tremovedKeys,\n\t\t\t\tmodifiedKeys,\n\t\t\t});\n\t\t\teffectiveToolCall = {\n\t\t\t\t...toolCall,\n\t\t\t\targuments: hookResult.updatedInput,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 3. Safety middleware sequence analysis\n\tconst safetyCheck = safetyMiddleware.preExecution(\n\t\teffectiveToolCall.name,\n\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t{\n\t\t\tskipLoopDetection: shouldSkipLoopDetection?.(effectiveToolCall) === true,\n\t\t},\n\t);\n\n\tif (!safetyCheck.allowed && !safetyCheck.requiresApproval) {\n\t\tconst safetyBlockedResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Blocked by safety check: ${safetyCheck.reason ?? \"Safety policy violation\"}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\ttoolCall.name,\n\t\t\tsafetyCheck.sanitizedArgs,\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\tsafetyCheck.reason,\n\t\t);\n\t\tconst safetyBlockedEvents = recordEvents(\n\t\t\temitToolResult(safetyBlockedResult, toolCall, true),\n\t\t);\n\t\tfor (const event of safetyBlockedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tlet approvalAllowed = true;\n\tlet approvalReason: string | undefined;\n\n\tif (safetyCheck.requiresApproval) {\n\t\tapprovalAllowed = false;\n\t\tapprovalReason = safetyCheck.reason;\n\t}\n\n\t// 4. Firewall evaluation\n\tconst workflowSnapshot = workflowState.snapshot();\n\tconst toolDef = tools.find((t) => t.name === effectiveToolCall.name);\n\tconst describeArgs = (args: Record<string, unknown>) => ({\n\t\tdisplayName: describeToolDisplayName(toolCall.name, args, toolDef),\n\t\tsummaryLabel: summarizeToolUse(toolCall.name, args, toolDef),\n\t\tactionDescription: describeToolActivity(toolCall.name, args, toolDef),\n\t});\n\tconst verdict = await firewall.evaluate({\n\t\ttoolName: effectiveToolCall.name,\n\t\targs: effectiveToolCall.arguments,\n\t\tmetadata: {\n\t\t\tworkflowState: workflowSnapshot,\n\t\t\tannotations: toolDef?.annotations,\n\t\t\tguardedFiles: cfg.guardedFiles,\n\t\t},\n\t\tuser: cfg.user,\n\t\tsession: cfg.session,\n\t\tuserIntent: extractTextFromContent(userMessage.content),\n\t});\n\tlet guardedFileMatch = findGuardedToolCallMatch(\n\t\teffectiveToolCall.name,\n\t\teffectiveToolCall.arguments,\n\t\t{ policy: cfg.guardedFiles },\n\t);\n\tlet guardedFileApprovalRequired =\n\t\tBoolean(guardedFileMatch) ||\n\t\t(verdict.action === \"require_approval\" &&\n\t\t\tverdict.ruleId === DEFAULT_GUARDED_FILE_RULE_ID);\n\tlet guardedFileApprovalReason = guardedFileMatch\n\t\t? describeDefaultGuardedFileMatch(guardedFileMatch)\n\t\t: guardedFileApprovalRequired && verdict.action === \"require_approval\"\n\t\t\t? verdict.reason\n\t\t\t: undefined;\n\tconst guardedFileBlockVerdict = (\n\t\tmatch: GuardedFileMatch,\n\t): Extract<ActionFirewallVerdict, { action: \"block\" }> => ({\n\t\taction: \"block\",\n\t\truleId: DEFAULT_GUARDED_FILE_RULE_ID,\n\t\treason: describeDefaultGuardedFileMatch(match),\n\t\tremediation:\n\t\t\t\"Remove the matching custom guard or change its defaultBehavior to ask if this access should be approval-gated instead of blocked.\",\n\t});\n\n\tconst emitFirewallBlock = async (\n\t\tblockVerdict: Extract<ActionFirewallVerdict, { action: \"block\" }>,\n\t\tblockedToolCall: ToolCall,\n\t) => {\n\t\tconst blockedResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: blockedToolCall.id,\n\t\t\ttoolName: blockedToolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Action blocked by firewall: ${blockVerdict.reason}${\n\t\t\t\t\t\tblockVerdict.remediation\n\t\t\t\t\t\t\t? `\\n\\nSuggestion: ${blockVerdict.remediation}`\n\t\t\t\t\t\t\t: \"\"\n\t\t\t\t\t}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\tblockedToolCall.name,\n\t\t\tsafetyMiddleware.sanitizeForLogging(\n\t\t\t\tblockedToolCall.arguments as Record<string, unknown>,\n\t\t\t),\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\tblockVerdict.reason,\n\t\t);\n\t\tconst firewallBlockedEvents = recordEvents(\n\t\t\temitToolResult(blockedResult, blockedToolCall, true),\n\t\t);\n\t\tconst sanitizedFirewallArgs = safetyMiddleware.sanitizeForLogging(\n\t\t\tblockedToolCall.arguments as Record<string, unknown>,\n\t\t);\n\t\trecordMaestroFirewallBlock({\n\t\t\trule_id: blockVerdict.ruleId,\n\t\t\toperation: blockedToolCall.name,\n\t\t\ttarget:\n\t\t\t\ttypeof sanitizedFirewallArgs.command === \"string\"\n\t\t\t\t\t? sanitizedFirewallArgs.command\n\t\t\t\t\t: blockedToolCall.name,\n\t\t\treason: blockVerdict.reason,\n\t\t\tcontext: sanitizedFirewallArgs,\n\t\t\tcorrelation: {\n\t\t\t\tsession_id: cfg.session?.id,\n\t\t\t\tagent_run_step_id: blockedToolCall.id,\n\t\t\t},\n\t\t});\n\t\tconst blockedToolSafetyVerdict = { outcome: \"blocked\" as const, events };\n\t\treturn {\n\t\t\teventsToYield: firewallBlockedEvents,\n\t\t\tverdict: blockedToolSafetyVerdict,\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t};\n\n\tif (verdict.action === \"block\") {\n\t\tconst blocked = await emitFirewallBlock(verdict, effectiveToolCall);\n\t\tfor (const event of blocked.eventsToYield) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: blocked.verdict,\n\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t};\n\t}\n\n\tif (guardedFileMatch?.defaultBehavior === \"block\") {\n\t\tconst blocked = await emitFirewallBlock(\n\t\t\tguardedFileBlockVerdict(guardedFileMatch),\n\t\t\teffectiveToolCall,\n\t\t);\n\t\tfor (const event of blocked.eventsToYield) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: blocked.verdict,\n\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t};\n\t}\n\n\t// 5. PII policy check\n\tif (\n\t\tverdict.action === \"require_approval\" &&\n\t\tverdict.ruleId === HUMAN_EGRESS_PII_RULE_ID\n\t) {\n\t\tconst policyResult = buildPiiPolicyResult(\n\t\t\ttoolCall,\n\t\t\tworkflowSnapshot,\n\t\t\tclock,\n\t\t);\n\t\tconst policyBlockedEvents = recordEvents(\n\t\t\temitToolResult(policyResult, toolCall, true),\n\t\t);\n\t\tfor (const event of policyBlockedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tif (!toolDef) {\n\t\tconst errorResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Error: Tool \"${toolCall.name}\" not found`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tconst errorEvents = recordEvents(\n\t\t\temitToolResult(errorResult, toolCall, true),\n\t\t);\n\t\tfor (const event of errorEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tlet toolExecutionBridgePlan: ToolExecutionBridgePlan | undefined;\n\tlet platformApprovalRequest:\n\t\t| import(\"../action-approval.js\").ActionApprovalRequest\n\t\t| undefined;\n\tlet platformApprovalResolved = false;\n\tconst bridgeArgs = safetyMiddleware.sanitizeForLogging(\n\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t);\n\tconst bridgeInput: ToolExecutionBridgeInput = {\n\t\tcfg,\n\t\ttoolCall,\n\t\ttoolDef,\n\t\tsanitizedArgs: bridgeArgs,\n\t\t...describeArgs(bridgeArgs),\n\t};\n\tif (toolExecutionBridge) {\n\t\tconst bridgeResult = await toolExecutionBridge.prepare(bridgeInput, signal);\n\t\tswitch (bridgeResult.status) {\n\t\t\tcase \"observe\":\n\t\t\tcase \"allow\":\n\t\t\t\ttoolExecutionBridgePlan = bridgeResult.plan;\n\t\t\t\tbreak;\n\t\t\tcase \"wait_approval\":\n\t\t\t\ttoolExecutionBridgePlan = bridgeResult.plan;\n\t\t\t\tplatformApprovalRequest =\n\t\t\t\t\tbridgeResult.request.startedAtMs === undefined\n\t\t\t\t\t\t? { ...bridgeResult.request, startedAtMs: clock.now() }\n\t\t\t\t\t\t: bridgeResult.request;\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason = bridgeResult.request.reason;\n\t\t\t\tbreak;\n\t\t\tcase \"deny\": {\n\t\t\t\tawait logToolExecutionAudit(\n\t\t\t\t\tauditLogger,\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\t\tbridgeArgs,\n\t\t\t\t\t\"denied\",\n\t\t\t\t\t0,\n\t\t\t\t\tbridgeResult.reason,\n\t\t\t\t);\n\t\t\t\tconst deniedResult: ToolResultMessage = {\n\t\t\t\t\trole: \"toolResult\",\n\t\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\t\ttoolName: toolCall.name,\n\t\t\t\t\tcontent: [{ type: \"text\", text: bridgeResult.reason }],\n\t\t\t\t\tisError: true,\n\t\t\t\t\ttimestamp: clock.now(),\n\t\t\t\t};\n\t\t\t\tconst deniedEvents = recordEvents(\n\t\t\t\t\temitToolResult(deniedResult, toolCall, true, {\n\t\t\t\t\t\ttoolExecutionId: bridgeResult.plan?.metadata.toolExecutionId,\n\t\t\t\t\t\tapprovalRequestId: bridgeResult.plan?.metadata.approvalRequestId,\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\tfor (const event of deniedEvents) {\n\t\t\t\t\tyield event;\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t\t\t};\n\t\t\t}\n\t\t\tdefault:\n\t\t\t\tbreak;\n\t\t}\n\t}\n\n\t// 6. Approval flow\n\tif (\n\t\tverdict.action === \"require_approval\" ||\n\t\tplatformApprovalRequest ||\n\t\tguardedFileApprovalRequired\n\t) {\n\t\tconst localApprovalReason =\n\t\t\tverdict.action === \"require_approval\" ? verdict.reason : undefined;\n\t\tlet permissionHookMadeDecision = false;\n\t\tif (hookService?.runPermissionRequestHooks) {\n\t\t\tconst permissionHookResult = await hookService.runPermissionRequestHooks(\n\t\t\t\teffectiveToolCall,\n\t\t\t\tplatformApprovalRequest?.reason ??\n\t\t\t\t\tguardedFileApprovalReason ??\n\t\t\t\t\tlocalApprovalReason ??\n\t\t\t\t\tapprovalReason ??\n\t\t\t\t\t\"Approval required\",\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\tif (permissionHookResult.updatedInput && !guardedFileApprovalRequired) {\n\t\t\t\teffectiveToolCall = {\n\t\t\t\t\t...effectiveToolCall,\n\t\t\t\t\targuments: permissionHookResult.updatedInput,\n\t\t\t\t};\n\t\t\t\tconst rewrittenVerdict = await firewall.evaluate({\n\t\t\t\t\ttoolName: effectiveToolCall.name,\n\t\t\t\t\targs: effectiveToolCall.arguments,\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tworkflowState: workflowSnapshot,\n\t\t\t\t\t\tannotations: toolDef?.annotations,\n\t\t\t\t\t\tguardedFiles: cfg.guardedFiles,\n\t\t\t\t\t},\n\t\t\t\t\tuser: cfg.user,\n\t\t\t\t\tsession: cfg.session,\n\t\t\t\t\tuserIntent: extractTextFromContent(userMessage.content),\n\t\t\t\t});\n\t\t\t\tif (rewrittenVerdict.action === \"block\") {\n\t\t\t\t\tconst blocked = await emitFirewallBlock(\n\t\t\t\t\t\trewrittenVerdict,\n\t\t\t\t\t\teffectiveToolCall,\n\t\t\t\t\t);\n\t\t\t\t\tfor (const event of blocked.eventsToYield) {\n\t\t\t\t\t\tyield event;\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tverdict: blocked.verdict,\n\t\t\t\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\tconst guardedMatch = findGuardedToolCallMatch(\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\t\teffectiveToolCall.arguments,\n\t\t\t\t\t{ policy: cfg.guardedFiles },\n\t\t\t\t);\n\t\t\t\tif (guardedMatch?.defaultBehavior === \"block\") {\n\t\t\t\t\tconst blocked = await emitFirewallBlock(\n\t\t\t\t\t\tguardedFileBlockVerdict(guardedMatch),\n\t\t\t\t\t\teffectiveToolCall,\n\t\t\t\t\t);\n\t\t\t\t\tfor (const event of blocked.eventsToYield) {\n\t\t\t\t\t\tyield event;\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tverdict: blocked.verdict,\n\t\t\t\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\tif (guardedMatch) {\n\t\t\t\t\tguardedFileMatch = guardedMatch;\n\t\t\t\t\tguardedFileApprovalRequired = true;\n\t\t\t\t\tguardedFileApprovalReason =\n\t\t\t\t\t\tdescribeDefaultGuardedFileMatch(guardedMatch);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (permissionHookResult.decision === \"allow\") {\n\t\t\t\tif (!guardedFileApprovalRequired) {\n\t\t\t\t\tpermissionHookMadeDecision = true;\n\t\t\t\t\tapprovalAllowed = true;\n\t\t\t\t\tapprovalReason = permissionHookResult.decisionReason;\n\t\t\t\t}\n\t\t\t} else if (permissionHookResult.decision === \"deny\") {\n\t\t\t\tpermissionHookMadeDecision = true;\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason =\n\t\t\t\t\tpermissionHookResult.decisionReason ??\n\t\t\t\t\t\"Permission denied by PermissionRequest hook\";\n\t\t\t}\n\t\t}\n\n\t\tif (\n\t\t\tpermissionHookMadeDecision &&\n\t\t\ttoolExecutionBridge &&\n\t\t\tplatformApprovalRequest &&\n\t\t\ttoolExecutionBridgePlan?.kind === \"governed\"\n\t\t) {\n\t\t\tconst resolution = await toolExecutionBridge.resolveApproval(\n\t\t\t\tbridgeInput,\n\t\t\t\ttoolExecutionBridgePlan,\n\t\t\t\t{\n\t\t\t\t\tapproved: approvalAllowed,\n\t\t\t\t\treason: approvalReason,\n\t\t\t\t\tresolvedBy: \"policy\",\n\t\t\t\t},\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\tplatformApprovalResolved = true;\n\t\t\ttoolExecutionBridgePlan = resolution.plan;\n\t\t\tif (resolution.status === \"deny\") {\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason = resolution.reason;\n\t\t\t} else {\n\t\t\t\tapprovalAllowed = true;\n\t\t\t\tapprovalReason = undefined;\n\t\t\t}\n\t\t}\n\n\t\tif (\n\t\t\tguardedFileApprovalRequired &&\n\t\t\tapprovalService?.requiresUserInteraction() !== true\n\t\t) {\n\t\t\tapprovalAllowed = false;\n\t\t\tif (!permissionHookMadeDecision) {\n\t\t\t\tapprovalReason = `${guardedFileApprovalReason ?? localApprovalReason ?? \"Guarded file access requires explicit approval\"} Approval mode must be prompt for guarded file access.`;\n\t\t\t}\n\t\t\tconst sanitizedApprovalArgs = safetyMiddleware.sanitizeForLogging(\n\t\t\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t\t);\n\t\t\tconst approvalDescription = describeArgs(sanitizedApprovalArgs);\n\t\t\trecordMaestroApprovalHit({\n\t\t\t\tapproval_request_id:\n\t\t\t\t\ttoolExecutionBridgePlan?.metadata.approvalRequestId ?? toolCall.id,\n\t\t\t\taction:\n\t\t\t\t\tapprovalDescription.actionDescription ??\n\t\t\t\t\tapprovalDescription.summaryLabel ??\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\tcommand:\n\t\t\t\t\ttypeof sanitizedApprovalArgs.command === \"string\"\n\t\t\t\t\t\t? sanitizedApprovalArgs.command\n\t\t\t\t\t\t: undefined,\n\t\t\t\tdecision_mode: \"MAESTRO_DECISION_MODE_REQUIRE_APPROVAL\",\n\t\t\t\t...guardedFileAuditFields(true),\n\t\t\t\treason: approvalReason,\n\t\t\t\tcontext: guardedFileAuditContext(\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\t\tsanitizedApprovalArgs,\n\t\t\t\t\tguardedFileMatch,\n\t\t\t\t\tapprovalDescription,\n\t\t\t\t),\n\t\t\t\tcorrelation: {\n\t\t\t\t\tsession_id: cfg.session?.id,\n\t\t\t\t\tagent_run_step_id: toolCall.id,\n\t\t\t\t},\n\t\t\t});\n\t\t} else if (approvalService && !permissionHookMadeDecision) {\n\t\t\tconst sanitizedApprovalArgs = safetyMiddleware.sanitizeForLogging(\n\t\t\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t\t);\n\t\t\tconst request =\n\t\t\t\t!guardedFileApprovalRequired && platformApprovalRequest\n\t\t\t\t\t? platformApprovalRequest\n\t\t\t\t\t: ({\n\t\t\t\t\t\t\tid: toolCall.id,\n\t\t\t\t\t\t\ttoolName: toolCall.name,\n\t\t\t\t\t\t\t...describeArgs(sanitizedApprovalArgs),\n\t\t\t\t\t\t\targs: sanitizedApprovalArgs,\n\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\tguardedFileApprovalReason ??\n\t\t\t\t\t\t\t\tlocalApprovalReason ??\n\t\t\t\t\t\t\t\t\"Approval required\",\n\t\t\t\t\t\t\tstartedAtMs: clock.now(),\n\t\t\t\t\t\t} satisfies import(\"../action-approval.js\").ActionApprovalRequest);\n\t\t\tconst shouldEmitEvents = approvalService.requiresUserInteraction();\n\t\t\tconst decisionPromise = approvalService.requestApproval(\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t\tclock,\n\t\t\t);\n\t\t\tconst registrationMetadata = await waitForPendingApprovalRegistration(\n\t\t\t\tapprovalService,\n\t\t\t\trequest.id,\n\t\t\t\tdecisionPromise,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\trecordMaestroApprovalHit({\n\t\t\t\tapproval_request_id:\n\t\t\t\t\tplatformApprovalRequest?.id ??\n\t\t\t\t\ttoolExecutionBridgePlan?.metadata.approvalRequestId ??\n\t\t\t\t\tregistrationMetadata?.remoteApprovalRequestId ??\n\t\t\t\t\trequest.id,\n\t\t\t\taction:\n\t\t\t\t\trequest.actionDescription ?? request.summaryLabel ?? request.toolName,\n\t\t\t\tcommand:\n\t\t\t\t\ttypeof sanitizedApprovalArgs.command === \"string\"\n\t\t\t\t\t\t? sanitizedApprovalArgs.command\n\t\t\t\t\t\t: undefined,\n\t\t\t\tdecision_mode: \"MAESTRO_DECISION_MODE_REQUIRE_APPROVAL\",\n\t\t\t\t...guardedFileAuditFields(guardedFileApprovalRequired),\n\t\t\t\treason: request.reason,\n\t\t\t\tcontext: guardedFileAuditContext(\n\t\t\t\t\trequest.toolName,\n\t\t\t\t\tsanitizedApprovalArgs,\n\t\t\t\t\tguardedFileApprovalRequired ? guardedFileMatch : null,\n\t\t\t\t\t{\n\t\t\t\t\t\tdisplayName: request.displayName,\n\t\t\t\t\t\tsummaryLabel: request.summaryLabel,\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t\t\tcorrelation: {\n\t\t\t\t\tsession_id: cfg.session?.id,\n\t\t\t\t\tagent_run_step_id: toolCall.id,\n\t\t\t\t},\n\t\t\t});\n\t\t\tif (shouldEmitEvents) {\n\t\t\t\tyield recordEvent({ type: \"action_approval_required\", request });\n\t\t\t}\n\n\t\t\tconst rawDecision = await decisionPromise;\n\t\t\tconst decision =\n\t\t\t\trawDecision.resolvedAtMs === undefined\n\t\t\t\t\t? { ...rawDecision, resolvedAtMs: clock.now() }\n\t\t\t\t\t: rawDecision;\n\t\t\tif (shouldEmitEvents) {\n\t\t\t\tyield recordEvent({\n\t\t\t\t\ttype: \"action_approval_resolved\",\n\t\t\t\t\trequest,\n\t\t\t\t\tdecision,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\ttoolExecutionBridge &&\n\t\t\t\tplatformApprovalRequest &&\n\t\t\t\ttoolExecutionBridgePlan?.kind === \"governed\"\n\t\t\t) {\n\t\t\t\tconst resolution = await toolExecutionBridge.resolveApproval(\n\t\t\t\t\tbridgeInput,\n\t\t\t\t\ttoolExecutionBridgePlan,\n\t\t\t\t\tdecision,\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t\tplatformApprovalResolved = true;\n\t\t\t\ttoolExecutionBridgePlan = resolution.plan;\n\t\t\t\tif (resolution.status === \"deny\") {\n\t\t\t\t\tapprovalAllowed = false;\n\t\t\t\t\tapprovalReason = resolution.reason;\n\t\t\t\t} else {\n\t\t\t\t\tapprovalAllowed = true;\n\t\t\t\t\tapprovalReason = undefined;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!decision.approved) {\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason = decision.reason ?? localApprovalReason;\n\t\t\t}\n\t\t}\n\t}\n\n\tif (!approvalAllowed) {\n\t\tif (\n\t\t\ttoolExecutionBridge &&\n\t\t\tplatformApprovalRequest &&\n\t\t\ttoolExecutionBridgePlan?.kind === \"governed\" &&\n\t\t\t!platformApprovalResolved\n\t\t) {\n\t\t\tconst resolution = await toolExecutionBridge.resolveApproval(\n\t\t\t\tbridgeInput,\n\t\t\t\ttoolExecutionBridgePlan,\n\t\t\t\t{\n\t\t\t\t\tapproved: false,\n\t\t\t\t\treason: approvalReason ?? \"Approval denied\",\n\t\t\t\t\tresolvedBy: \"policy\",\n\t\t\t\t},\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\ttoolExecutionBridgePlan = resolution.plan;\n\t\t\tapprovalReason =\n\t\t\t\tresolution.status === \"deny\"\n\t\t\t\t\t? resolution.reason\n\t\t\t\t\t: (approvalReason ?? \"Approval denied\");\n\t\t}\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\teffectiveToolCall.name,\n\t\t\tsafetyMiddleware.sanitizeForLogging(\n\t\t\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t\t),\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\tapprovalReason,\n\t\t);\n\t\tconst deniedResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [{ type: \"text\", text: approvalReason ?? \"Action denied\" }],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tconst deniedEvents = recordEvents(\n\t\t\temitToolResult(deniedResult, toolCall, true, {\n\t\t\t\ttoolExecutionId: toolExecutionBridgePlan?.metadata.toolExecutionId,\n\t\t\t\tapprovalRequestId: toolExecutionBridgePlan?.metadata.approvalRequestId,\n\t\t\t}),\n\t\t);\n\t\tfor (const event of deniedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\t// 7. Argument validation\n\tlet validatedArgs: Record<string, unknown>;\n\ttry {\n\t\tconst rawArgs = validateToolArguments(toolDef, effectiveToolCall);\n\t\tconst vaultedArgs = safetyMiddleware.prepareExecutionArgs(rawArgs);\n\t\tvalidatedArgs = safetyMiddleware.resolveCredentials(vaultedArgs);\n\t} catch (error: unknown) {\n\t\tconst validationErrorResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: error instanceof Error ? error.message : String(error),\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tconst validationEvents = recordEvents(\n\t\t\temitToolResult(validationErrorResult, toolCall, true),\n\t\t);\n\t\tfor (const event of validationEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tconst sanitizedExecutionArgs =\n\t\tsafetyMiddleware.sanitizeForLogging(validatedArgs);\n\n\treturn {\n\t\tverdict: {\n\t\t\toutcome: \"proceed\",\n\t\t\teffectiveToolCall,\n\t\t\tvalidatedArgs,\n\t\t\ttoolDef,\n\t\t\tevents,\n\t\t\tsanitizedExecutionArgs,\n\t\t\t...(toolExecutionBridgePlan ? { toolExecutionBridgePlan } : {}),\n\t\t},\n\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t};\n}\n"]}
+{"version":3,"file":"tool-safety-pipeline.js","sourceRoot":"","sources":["../../../src/agent/transport/tool-safety-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEN,wBAAwB,GACxB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAE7B,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,GACxB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EAEN,wBAAwB,EACxB,0BAA0B,GAC1B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACN,oBAAoB,EACpB,uBAAuB,EACvB,gBAAgB,GAChB,MAAM,iCAAiC,CAAC;AAMzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAenE,OAAO,EAEN,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,GACrB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,MAAM,GAAG,YAAY,CAAC,uBAAuB,CAAC,CAAC;AAwFrD,SAAS,uBAAuB,CAC/B,QAAgB,EAChB,IAA6B,EAC7B,KAA8B,EAC9B,QAGC;IAED,MAAM,OAAO,GAA4B;QACxC,SAAS,EAAE,QAAQ;QACnB,YAAY,EAAE,QAAQ,CAAC,WAAW;QAClC,aAAa,EAAE,QAAQ,CAAC,YAAY;QACpC,IAAI;KACJ,CAAC;IACF,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,YAAY,GAAG;YACtB,OAAO,EAAE,KAAK,CAAC,MAAM;YACrB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,+BAA+B,CAAC,QAAQ,CAAC;SACjD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC9B,2BAAoC;IAEpC,OAAO,2BAA2B;QACjC,CAAC,CAAC;YACA,SAAS,EAAE,6BAA6B;YACxC,UAAU,EAAE,cAAc;SAC1B;QACF,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,KAAK,UAAU,kCAAkC,CAChD,eAAsC,EACtC,SAAiB,EACjB,eAAgD,EAChD,MAAoB;IAEpB,MAAM,iBAAiB,GAAG,eACO,CAAC;IAClC,IACC,OAAO,iBAAiB,CAAC,kCAAkC,KAAK,UAAU,EACzE,CAAC;QACF,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC;YACzB,iBAAiB,CAAC,kCAAkC,CAAC,SAAS,EAAE;gBAC/D,MAAM;aACN,CAAC;YACF,eAAe,CAAC,IAAI,CACnB,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,IAAI,CACV;SACD,CAAC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAaD,SAAS,cAAc,CAAC,GAAsB;IAY7C,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;IACpE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC;IAC7E,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC;IAEpE,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC;IAElE,sDAAsD;IACtD,IAAI,GAAG,GAAG,iBAAiB,IAAI,MAAM,EAAE,CAAC;QACvC,kBAAkB,CAAC,iBAAiB,CACnC,OAAO,CAAC,qBAAqB,EAC7B,mBAAmB,CACnB,CAAC;QACF,mBAAmB,GAAG,CAAC,CAAC;QACxB,iBAAiB,GAAG,GAAG,CAAC;IACzB,CAAC;IACD,mBAAmB,EAAE,CAAC;IAEtB,8BAA8B;IAC9B,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,MAAM,EAAE,CAAC;QAC1D,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;SAAM,IACN,aAAa,KAAK,OAAO;QACzB,aAAa,KAAK,MAAM;QACxB,aAAa,KAAK,aAAa,EAC9B,CAAC;QACF,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;SAAM,IACN,aAAa,KAAK,UAAU;QAC5B,aAAa,KAAK,WAAW;QAC7B,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC5B,CAAC;QACF,kBAAkB,CAAC,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,YAAY,GAAoB;QACrC,mBAAmB;QACnB,iBAAiB;KACjB,CAAC;IAEF,qCAAqC;IACrC,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CACnD,OAAO,CAAC,qBAAqB,EAC7B,mBAAmB,CACnB,CAAC;IAEF,4BAA4B;IAC5B,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,qBAAqB,YAAY,CAAC,MAAM,IAAI,wBAAwB,EAAE,CAAC;QACtF,gBAAgB,CAAC;YAChB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,MAAM;YACN,MAAM,EAAE,UAAU;SAClB,CAAC,CAAC;QACH,MAAM,cAAc,GAAsB;YACzC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,YAAY,QAAQ,CAAC,IAAI,gCAAgC,YAAY,CAAC,MAAM,IAAI,oCAAoC,cAAc,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;iBACvP;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;SACd,CAAC;QACF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC;YACtD,YAAY;YACZ,KAAK,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,mBAAmB,CAChE,aAAa,QAAQ,CAAC,IAAI,EAAE,EAC5B,SAAS,CACT,CAAC;IAEF,IAAI,MAAM,CAAC,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,yBAAyB,kBAAkB,aAAa,YAAY,GAAG,IAAI,UAAU,CAAC;QACrG,MAAM,WAAW,GAAsB;YACtC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,YAAY,QAAQ,CAAC,IAAI,yBAAyB,kBAAkB,aAAa,YAAY,GAAG,IAAI,YACzG,YAAY,CAAC,SAAS;wBACrB,CAAC,CAAC,uBAAuB,YAAY,CAAC,MAAM,GAAG;wBAC/C,CAAC,CAAC,EACJ,EAAE;iBACF;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,GAAG;SACd,CAAC;QACF,OAAO;YACN,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;YACnD,YAAY;YACZ,KAAK,EAAE;gBACN,IAAI,EAAE,YAAY;gBAClB,MAAM;aACN;SACD,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAAC,iBAAiB,CACnC,aAAa,QAAQ,CAAC,IAAI,EAAE,EAC5B,MAAM,CAAC,MAAM,CACb,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjB,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEhD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACjD,CAAC;AAOD,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,kBAAkB,CACxC,GAAsB;IAKtB,MAAM,EACL,QAAQ,EACR,KAAK,EACL,WAAW,EACX,GAAG,EACH,MAAM,EACN,KAAK,EACL,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,QAAQ,EACR,uBAAuB,EACvB,cAAc,GACd,GAAG,GAAG,CAAC;IAER,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAG,CAAC,KAAiB,EAAE,EAAE;QACzC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,KAAK,CAAC;IACd,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,SAAuB,EAAE,EAAE;QAChD,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAC1B,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,kBAAkB,CAC7D,QAAQ,CAAC,SAAoC,CAC7C,CAAC;IAEF,mBAAmB;IACnB,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,qBAAqB,CAC1B,WAAW,EACX,QAAQ,CAAC,IAAI,EACb,kBAAkB,EAClB,QAAQ,EACR,CAAC,EACD,eAAe,CAAC,KAAK,CAAC,MAAM,CAC5B,CAAC;QACF,MAAM,aAAa,GAAG,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3D,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;YACnC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IACD,MAAM,WAAW,CAAC;QACjB,IAAI,EAAE,sBAAsB;QAC5B,UAAU,EAAE,QAAQ,CAAC,EAAE;QACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;QACvB,IAAI,EAAE,kBAAkB;QACxB,UAAU,EAAE,GAAG,CAAC,kBAAkB;KAClC,CAAC,CAAC;IAEH,sBAAsB;IACtB,IAAI,iBAAiB,GAAG,QAAQ,CAAC;IACjC,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,MAAM,WAAW,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE1E,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACxB,MAAM,iBAAiB,GAAsB;gBAC5C,IAAI,EAAE,YAAY;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE;oBACR;wBACC,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,oBAAoB,UAAU,CAAC,WAAW,IAAI,uBAAuB,EAAE;qBAC7E;iBACD;gBACD,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,MAAM,qBAAqB,CAC1B,WAAW,EACX,QAAQ,CAAC,IAAI,EACb,gBAAgB,CAAC,kBAAkB,CAClC,QAAQ,CAAC,SAAoC,CAC7C,EACD,QAAQ,EACR,CAAC,EACD,UAAU,CAAC,WAAW,CACtB,CAAC;YACF,MAAM,iBAAiB,GAAG,YAAY,CACrC,cAAc,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,CACjD,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;gBACvC,MAAM,KAAK,CAAC;YACb,CAAC;YACD,OAAO;gBACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;gBACvC,eAAe,EAAE,eAAe,CAAC,YAAY;aAC7C,CAAC;QACH,CAAC;QAED,IAAI,UAAU,CAAC,YAAY,EAAE,CAAC;YAC7B,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAC/B,QAAQ,CAAC,SAAoC,CAC7C,CAAC;YACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACzE,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CACtC,CAAC,CAAC,EAAE,EAAE,CACL,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACvB,QAAQ,CAAC,SAAqC,CAAC,CAAC,CAAC;oBACjD,UAAU,CAAC,YAAa,CAAC,CAAC,CAAC,CAC7B,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE;gBACxC,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,SAAS;gBACT,WAAW;gBACX,YAAY;aACZ,CAAC,CAAC;YACH,iBAAiB,GAAG;gBACnB,GAAG,QAAQ;gBACX,SAAS,EAAE,UAAU,CAAC,YAAY;aAClC,CAAC;QACH,CAAC;IACF,CAAC;IAED,yCAAyC;IACzC,MAAM,WAAW,GAAG,gBAAgB,CAAC,YAAY,CAChD,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,SAAoC,EACtD;QACC,iBAAiB,EAAE,uBAAuB,EAAE,CAAC,iBAAiB,CAAC,KAAK,IAAI;KACxE,CACD,CAAC;IAEF,IAAI,CAAC,WAAW,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,mBAAmB,GAAsB;YAC9C,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,4BAA4B,WAAW,CAAC,MAAM,IAAI,yBAAyB,EAAE;iBACnF;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,qBAAqB,CAC1B,WAAW,EACX,QAAQ,CAAC,IAAI,EACb,WAAW,CAAC,aAAa,EACzB,QAAQ,EACR,CAAC,EACD,WAAW,CAAC,MAAM,CAClB,CAAC;QACF,MAAM,mBAAmB,GAAG,YAAY,CACvC,cAAc,CAAC,mBAAmB,EAAE,QAAQ,EAAE,IAAI,CAAC,CACnD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,eAAe,GAAG,IAAI,CAAC;IAC3B,IAAI,cAAkC,CAAC;IAEvC,IAAI,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAClC,eAAe,GAAG,KAAK,CAAC;QACxB,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC;IACrC,CAAC;IAED,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,CAAC,IAA6B,EAAE,EAAE,CAAC,CAAC;QACxD,WAAW,EAAE,uBAAuB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAClE,YAAY,EAAE,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAC5D,iBAAiB,EAAE,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;KACrE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;QACvC,QAAQ,EAAE,iBAAiB,CAAC,IAAI;QAChC,IAAI,EAAE,iBAAiB,CAAC,SAAS;QACjC,QAAQ,EAAE;YACT,aAAa,EAAE,gBAAgB;YAC/B,WAAW,EAAE,OAAO,EAAE,WAAW;YACjC,YAAY,EAAE,GAAG,CAAC,YAAY;SAC9B;QACD,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC;KACvD,CAAC,CAAC;IACH,IAAI,gBAAgB,GAAG,wBAAwB,CAC9C,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,SAAS,EAC3B,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,CAC5B,CAAC;IACF,IAAI,2BAA2B,GAC9B,OAAO,CAAC,gBAAgB,CAAC;QACzB,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACrC,OAAO,CAAC,MAAM,KAAK,4BAA4B,CAAC,CAAC;IACnD,IAAI,yBAAyB,GAAG,gBAAgB;QAC/C,CAAC,CAAC,+BAA+B,CAAC,gBAAgB,CAAC;QACnD,CAAC,CAAC,2BAA2B,IAAI,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACrE,CAAC,CAAC,OAAO,CAAC,MAAM;YAChB,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,uBAAuB,GAAG,CAC/B,KAAuB,EAC+B,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,4BAA4B;QACpC,MAAM,EAAE,+BAA+B,CAAC,KAAK,CAAC;QAC9C,WAAW,EACV,mIAAmI;KACpI,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,KAAK,EAC9B,YAAiE,EACjE,eAAyB,EACxB,EAAE;QACH,MAAM,aAAa,GAAsB;YACxC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,eAAe,CAAC,EAAE;YAC9B,QAAQ,EAAE,eAAe,CAAC,IAAI;YAC9B,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,+BAA+B,YAAY,CAAC,MAAM,GACvD,YAAY,CAAC,WAAW;wBACvB,CAAC,CAAC,mBAAmB,YAAY,CAAC,WAAW,EAAE;wBAC/C,CAAC,CAAC,EACJ,EAAE;iBACF;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,qBAAqB,CAC1B,WAAW,EACX,eAAe,CAAC,IAAI,EACpB,gBAAgB,CAAC,kBAAkB,CAClC,eAAe,CAAC,SAAoC,CACpD,EACD,QAAQ,EACR,CAAC,EACD,YAAY,CAAC,MAAM,CACnB,CAAC;QACF,MAAM,qBAAqB,GAAG,YAAY,CACzC,cAAc,CAAC,aAAa,EAAE,eAAe,EAAE,IAAI,CAAC,CACpD,CAAC;QACF,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAChE,eAAe,CAAC,SAAoC,CACpD,CAAC;QACF,0BAA0B,CAAC;YAC1B,OAAO,EAAE,YAAY,CAAC,MAAM;YAC5B,SAAS,EAAE,eAAe,CAAC,IAAI;YAC/B,MAAM,EACL,OAAO,qBAAqB,CAAC,OAAO,KAAK,QAAQ;gBAChD,CAAC,CAAC,qBAAqB,CAAC,OAAO;gBAC/B,CAAC,CAAC,eAAe,CAAC,IAAI;YACxB,MAAM,EAAE,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,qBAAqB;YAC9B,WAAW,EAAE;gBACZ,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE;gBAC3B,iBAAiB,EAAE,eAAe,CAAC,EAAE;aACrC;SACD,CAAC,CAAC;QACH,MAAM,wBAAwB,GAAG,EAAE,OAAO,EAAE,SAAkB,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO;YACN,aAAa,EAAE,qBAAqB;YACpC,OAAO,EAAE,wBAAwB;YACjC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;SACxC,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,eAAe,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACtC,uBAAuB,CAAC,gBAAgB,CAAC,EACzC,iBAAiB,CACjB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,OAAO,CAAC,eAAe;SACxC,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IACC,OAAO,CAAC,MAAM,KAAK,kBAAkB;QACrC,OAAO,CAAC,MAAM,KAAK,wBAAwB,EAC1C,CAAC;QACF,MAAM,YAAY,GAAG,oBAAoB,CACxC,QAAQ,EACR,gBAAgB,EAChB,KAAK,CACL,CAAC;QACF,MAAM,mBAAmB,GAAG,YAAY,CACvC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC5C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,WAAW,GAAsB;YACtC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,gBAAgB,QAAQ,CAAC,IAAI,aAAa;iBAChD;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,WAAW,GAAG,YAAY,CAC/B,cAAc,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC,CAC3C,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YACjC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,IAAI,uBAA4D,CAAC;IACjE,IAAI,iBAAqC,CAAC;IAC1C,IAAI,uBAEQ,CAAC;IACb,IAAI,wBAAwB,GAAG,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,gBAAgB,CAAC,kBAAkB,CACrD,iBAAiB,CAAC,SAAoC,CACtD,CAAC;IACF,MAAM,WAAW,GAA6B;QAC7C,GAAG;QACH,QAAQ;QACR,OAAO;QACP,aAAa,EAAE,UAAU;QACzB,GAAG,YAAY,CAAC,UAAU,CAAC;KAC3B,CAAC;IACF,IAAI,mBAAmB,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5E,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC;YAC7B,KAAK,SAAS,CAAC;YACf,KAAK,OAAO;gBACX,uBAAuB,GAAG,YAAY,CAAC,IAAI,CAAC;gBAC5C,MAAM;YACP,KAAK,eAAe;gBACnB,uBAAuB,GAAG,YAAY,CAAC,IAAI,CAAC;gBAC5C,uBAAuB;oBACtB,YAAY,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;wBAC7C,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE;wBACvD,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC;gBACzB,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC7C,MAAM;YACP,KAAK,MAAM,CAAC,CAAC,CAAC;gBACb,MAAM,qBAAqB,CAC1B,WAAW,EACX,iBAAiB,CAAC,IAAI,EACtB,UAAU,EACV,QAAQ,EACR,CAAC,EACD,YAAY,CAAC,MAAM,CACnB,CAAC;gBACF,MAAM,YAAY,GAAsB;oBACvC,IAAI,EAAE,YAAY;oBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;oBACtD,OAAO,EAAE,IAAI;oBACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;iBACtB,CAAC;gBACF,MAAM,YAAY,GAAG,YAAY,CAChC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;oBAC5C,eAAe,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,eAAe;oBAC5D,iBAAiB,EAAE,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,iBAAiB;iBAChE,CAAC,CACF,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;oBAClC,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,OAAO;oBACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;oBACvC,eAAe,EAAE,eAAe,CAAC,YAAY;iBAC7C,CAAC;YACH,CAAC;YACD;gBACC,MAAM;QACR,CAAC;IACF,CAAC;IAED,mBAAmB;IACnB,IACC,OAAO,CAAC,MAAM,KAAK,kBAAkB;QACrC,uBAAuB;QACvB,2BAA2B,EAC1B,CAAC;QACF,MAAM,mBAAmB,GACxB,OAAO,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,0BAA0B,GAAG,KAAK,CAAC;QACvC,IAAI,WAAW,EAAE,yBAAyB,EAAE,CAAC;YAC5C,MAAM,oBAAoB,GAAG,MAAM,WAAW,CAAC,yBAAyB,CACvE,iBAAiB,EACjB,uBAAuB,EAAE,MAAM;gBAC9B,yBAAyB;gBACzB,mBAAmB;gBACnB,cAAc;gBACd,mBAAmB,EACpB,MAAM,CACN,CAAC;YACF,IAAI,oBAAoB,CAAC,YAAY,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACvE,iBAAiB,GAAG;oBACnB,GAAG,iBAAiB;oBACpB,SAAS,EAAE,oBAAoB,CAAC,YAAY;iBAC5C,CAAC;gBACF,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC;oBAChD,QAAQ,EAAE,iBAAiB,CAAC,IAAI;oBAChC,IAAI,EAAE,iBAAiB,CAAC,SAAS;oBACjC,QAAQ,EAAE;wBACT,aAAa,EAAE,gBAAgB;wBAC/B,WAAW,EAAE,OAAO,EAAE,WAAW;wBACjC,YAAY,EAAE,GAAG,CAAC,YAAY;qBAC9B;oBACD,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,UAAU,EAAE,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC;iBACvD,CAAC,CAAC;gBACH,IAAI,gBAAgB,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;oBACzC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACtC,gBAAgB,EAChB,iBAAiB,CACjB,CAAC;oBACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;wBAC3C,MAAM,KAAK,CAAC;oBACb,CAAC;oBACD,OAAO;wBACN,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,eAAe,EAAE,OAAO,CAAC,eAAe;qBACxC,CAAC;gBACH,CAAC;gBACD,MAAM,YAAY,GAAG,wBAAwB,CAC5C,iBAAiB,CAAC,IAAI,EACtB,iBAAiB,CAAC,SAAS,EAC3B,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,CAC5B,CAAC;gBACF,IAAI,YAAY,EAAE,eAAe,KAAK,OAAO,EAAE,CAAC;oBAC/C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACtC,uBAAuB,CAAC,YAAY,CAAC,EACrC,iBAAiB,CACjB,CAAC;oBACF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;wBAC3C,MAAM,KAAK,CAAC;oBACb,CAAC;oBACD,OAAO;wBACN,OAAO,EAAE,OAAO,CAAC,OAAO;wBACxB,eAAe,EAAE,OAAO,CAAC,eAAe;qBACxC,CAAC;gBACH,CAAC;gBACD,IAAI,YAAY,EAAE,CAAC;oBAClB,gBAAgB,GAAG,YAAY,CAAC;oBAChC,2BAA2B,GAAG,IAAI,CAAC;oBACnC,yBAAyB;wBACxB,+BAA+B,CAAC,YAAY,CAAC,CAAC;gBAChD,CAAC;YACF,CAAC;YACD,IAAI,oBAAoB,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/C,IAAI,CAAC,2BAA2B,EAAE,CAAC;oBAClC,0BAA0B,GAAG,IAAI,CAAC;oBAClC,eAAe,GAAG,IAAI,CAAC;oBACvB,cAAc,GAAG,oBAAoB,CAAC,cAAc,CAAC;gBACtD,CAAC;YACF,CAAC;iBAAM,IAAI,oBAAoB,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACrD,0BAA0B,GAAG,IAAI,CAAC;gBAClC,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc;oBACb,oBAAoB,CAAC,cAAc;wBACnC,6CAA6C,CAAC;YAChD,CAAC;QACF,CAAC;QAED,IACC,0BAA0B;YAC1B,mBAAmB;YACnB,uBAAuB;YACvB,uBAAuB,EAAE,IAAI,KAAK,UAAU,EAC3C,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAC3D,WAAW,EACX,uBAAuB,EACvB;gBACC,QAAQ,EAAE,eAAe;gBACzB,MAAM,EAAE,cAAc;gBACtB,UAAU,EAAE,QAAQ;aACpB,EACD,MAAM,CACN,CAAC;YACF,wBAAwB,GAAG,IAAI,CAAC;YAChC,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC;YAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClC,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACP,eAAe,GAAG,IAAI,CAAC;gBACvB,cAAc,GAAG,SAAS,CAAC;YAC5B,CAAC;QACF,CAAC;QAED,IACC,2BAA2B;YAC3B,eAAe,EAAE,uBAAuB,EAAE,KAAK,IAAI,EAClD,CAAC;YACF,eAAe,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC,0BAA0B,EAAE,CAAC;gBACjC,cAAc,GAAG,GAAG,yBAAyB,IAAI,mBAAmB,IAAI,gDAAgD,wDAAwD,CAAC;YAClL,CAAC;YACD,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAChE,iBAAiB,CAAC,SAAoC,CACtD,CAAC;YACF,MAAM,mBAAmB,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;YAChE,wBAAwB,CAAC;gBACxB,mBAAmB,EAClB,uBAAuB,EAAE,QAAQ,CAAC,iBAAiB,IAAI,QAAQ,CAAC,EAAE;gBACnE,MAAM,EACL,mBAAmB,CAAC,iBAAiB;oBACrC,mBAAmB,CAAC,YAAY;oBAChC,iBAAiB,CAAC,IAAI;gBACvB,OAAO,EACN,OAAO,qBAAqB,CAAC,OAAO,KAAK,QAAQ;oBAChD,CAAC,CAAC,qBAAqB,CAAC,OAAO;oBAC/B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,wCAAwC;gBACvD,GAAG,sBAAsB,CAAC,IAAI,CAAC;gBAC/B,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,uBAAuB,CAC/B,iBAAiB,CAAC,IAAI,EACtB,qBAAqB,EACrB,gBAAgB,EAChB,mBAAmB,CACnB;gBACD,WAAW,EAAE;oBACZ,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE;oBAC3B,iBAAiB,EAAE,QAAQ,CAAC,EAAE;iBAC9B;aACD,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,eAAe,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAC3D,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,kBAAkB,CAChE,iBAAiB,CAAC,SAAoC,CACtD,CAAC;YACF,MAAM,OAAO,GACZ,CAAC,2BAA2B,IAAI,uBAAuB;gBACtD,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAE;oBACD,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,QAAQ,EAAE,QAAQ,CAAC,IAAI;oBACvB,GAAG,YAAY,CAAC,qBAAqB,CAAC;oBACtC,IAAI,EAAE,qBAAqB;oBAC3B,MAAM,EACL,yBAAyB;wBACzB,mBAAmB;wBACnB,mBAAmB;oBACpB,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE;iBACyC,CAAC;YACtE,MAAM,gBAAgB,GAAG,eAAe,CAAC,uBAAuB,EAAE,CAAC;YACnE,MAAM,eAAe,GAAG,eAAe,CAAC,eAAe,CACtD,OAAO,EACP,MAAM,EACN,KAAK,CACL,CAAC;YACF,MAAM,oBAAoB,GAAG,MAAM,kCAAkC,CACpE,eAAe,EACf,OAAO,CAAC,EAAE,EACV,eAAe,EACf,MAAM,CACN,CAAC;YACF,iBAAiB;gBAChB,uBAAuB,EAAE,EAAE;oBAC3B,uBAAuB,EAAE,QAAQ,CAAC,iBAAiB;oBACnD,oBAAoB,EAAE,uBAAuB;oBAC7C,OAAO,CAAC,EAAE,CAAC;YACZ,wBAAwB,CAAC;gBACxB,mBAAmB,EAAE,iBAAiB;gBACtC,MAAM,EACL,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ;gBACtE,OAAO,EACN,OAAO,qBAAqB,CAAC,OAAO,KAAK,QAAQ;oBAChD,CAAC,CAAC,qBAAqB,CAAC,OAAO;oBAC/B,CAAC,CAAC,SAAS;gBACb,aAAa,EAAE,wCAAwC;gBACvD,GAAG,sBAAsB,CAAC,2BAA2B,CAAC;gBACtD,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,uBAAuB,CAC/B,OAAO,CAAC,QAAQ,EAChB,qBAAqB,EACrB,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EACrD;oBACC,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;iBAClC,CACD;gBACD,WAAW,EAAE;oBACZ,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE;oBAC3B,iBAAiB,EAAE,QAAQ,CAAC,EAAE;iBAC9B;aACD,CAAC,CAAC;YACH,IAAI,gBAAgB,EAAE,CAAC;gBACtB,MAAM,WAAW,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC;YAC1C,MAAM,QAAQ,GACb,WAAW,CAAC,YAAY,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE;gBAC/C,CAAC,CAAC,WAAW,CAAC;YAChB,IAAI,gBAAgB,EAAE,CAAC;gBACtB,MAAM,WAAW,CAAC;oBACjB,IAAI,EAAE,0BAA0B;oBAChC,OAAO;oBACP,QAAQ;iBACR,CAAC,CAAC;YACJ,CAAC;YAED,IACC,mBAAmB;gBACnB,uBAAuB;gBACvB,uBAAuB,EAAE,IAAI,KAAK,UAAU,EAC3C,CAAC;gBACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAC3D,WAAW,EACX,uBAAuB,EACvB,QAAQ,EACR,MAAM,CACN,CAAC;gBACF,wBAAwB,GAAG,IAAI,CAAC;gBAChC,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC;gBAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAClC,eAAe,GAAG,KAAK,CAAC;oBACxB,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;gBACpC,CAAC;qBAAM,CAAC;oBACP,eAAe,GAAG,IAAI,CAAC;oBACvB,cAAc,GAAG,SAAS,CAAC;gBAC5B,CAAC;YACF,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxB,eAAe,GAAG,KAAK,CAAC;gBACxB,cAAc,GAAG,QAAQ,CAAC,MAAM,IAAI,mBAAmB,CAAC;YACzD,CAAC;QACF,CAAC;IACF,CAAC;IAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,IACC,mBAAmB;YACnB,uBAAuB;YACvB,uBAAuB,EAAE,IAAI,KAAK,UAAU;YAC5C,CAAC,wBAAwB,EACxB,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,eAAe,CAC3D,WAAW,EACX,uBAAuB,EACvB;gBACC,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,cAAc,IAAI,iBAAiB;gBAC3C,UAAU,EAAE,QAAQ;aACpB,EACD,MAAM,CACN,CAAC;YACF,uBAAuB,GAAG,UAAU,CAAC,IAAI,CAAC;YAC1C,cAAc;gBACb,UAAU,CAAC,MAAM,KAAK,MAAM;oBAC3B,CAAC,CAAC,UAAU,CAAC,MAAM;oBACnB,CAAC,CAAC,CAAC,cAAc,IAAI,iBAAiB,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,qBAAqB,CAC1B,WAAW,EACX,iBAAiB,CAAC,IAAI,EACtB,gBAAgB,CAAC,kBAAkB,CAClC,iBAAiB,CAAC,SAAoC,CACtD,EACD,QAAQ,EACR,CAAC,EACD,cAAc,CACd,CAAC;QACF,MAAM,YAAY,GAAsB;YACvC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAI,eAAe,EAAE,CAAC;YACpE,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,YAAY,GAAG,YAAY,CAChC,cAAc,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC5C,eAAe,EAAE,uBAAuB,EAAE,QAAQ,CAAC,eAAe;YAClE,iBAAiB,EAChB,uBAAuB,EAAE,QAAQ,CAAC,iBAAiB;gBACnD,iBAAiB;SAClB,CAAC,CACF,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,aAAsC,CAAC;IAC3C,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,gBAAgB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACnE,aAAa,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACzB,MAAM,qBAAqB,GAAsB;YAChD,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,OAAO,EAAE;gBACR;oBACC,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC5D;aACD;YACD,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,gBAAgB,GAAG,YAAY,CACpC,cAAc,CAAC,qBAAqB,EAAE,QAAQ,EAAE,IAAI,CAAC,CACrD,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC;QACb,CAAC;QACD,OAAO;YACN,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE;YACvC,eAAe,EAAE,eAAe,CAAC,YAAY;SAC7C,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,GAC3B,gBAAgB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEpD,OAAO;QACN,OAAO,EAAE;YACR,OAAO,EAAE,SAAS;YAClB,iBAAiB;YACjB,aAAa;YACb,OAAO;YACP,MAAM;YACN,sBAAsB;YACtB,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;QACD,eAAe,EAAE,eAAe,CAAC,YAAY;KAC7C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Tool Safety Pipeline\n * Pre-execution safety evaluation: rate limiting, adaptive thresholds,\n * safety middleware, firewall checks, PII policy, approval flow, and tool validation.\n *\n * Yields events as they occur and returns a verdict when complete.\n */\n\nimport {\n\ttype ActionFirewall,\n\tHUMAN_EGRESS_PII_RULE_ID,\n} from \"../../safety/action-firewall.js\";\nimport type { AdaptiveThresholds } from \"../../safety/adaptive-thresholds.js\";\nimport { METRICS } from \"../../safety/adaptive-thresholds.js\";\nimport {\n\tDEFAULT_GUARDED_FILE_RULE_ID,\n\tGUARDED_FILES_BLOCK_POLICY_ID,\n\ttype GuardedFileMatch,\n\tclassifyGuardedFileAccessAction,\n\tdescribeDefaultGuardedFileMatch,\n\tfindGuardedToolCallMatch,\n} from \"../../safety/guarded-files.js\";\nimport type { SafetyMiddleware } from \"../../safety/safety-middleware.js\";\nimport type { WorkflowStateTracker } from \"../../safety/workflow-state.js\";\nimport {\n\ttype RecordMaestroApprovalHitInput,\n\trecordMaestroApprovalHit,\n\trecordMaestroFirewallBlock,\n} from \"../../telemetry/maestro-event-bus.js\";\nimport { trackToolBlocked } from \"../../telemetry/security-events.js\";\nimport type { Clock } from \"../../utils/clock.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nimport {\n\tdescribeToolActivity,\n\tdescribeToolDisplayName,\n\tsummarizeToolUse,\n} from \"../../utils/tool-use-summary.js\";\nimport type {\n\tActionApprovalDecision,\n\tActionApprovalService,\n\tActionFirewallVerdict,\n} from \"../action-approval.js\";\nimport { validateToolArguments } from \"../providers/validation.js\";\nimport type {\n\tAgentEvent,\n\tAgentRunConfig,\n\tAgentTool,\n\tMessage,\n\tToolCall,\n\tToolResultMessage,\n\tToolSchedulingMetadata,\n} from \"../types.js\";\nimport type {\n\tPlatformToolExecutionBridge,\n\tToolExecutionBridgeInput,\n\tToolExecutionBridgePlan,\n} from \"./tool-execution-bridge.js\";\nimport {\n\ttype ToolAuditLogger,\n\tbuildPiiPolicyResult,\n\textractTextFromContent,\n\tlogToolExecutionAudit,\n} from \"./transport-utils.js\";\n\nconst logger = createLogger(\"transport:tool-safety\");\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Types\n// ─────────────────────────────────────────────────────────────────────────────\n\nexport type ToolSafetyVerdict =\n\t| { outcome: \"blocked\"; events: AgentEvent[] }\n\t| {\n\t\t\toutcome: \"proceed\";\n\t\t\teffectiveToolCall: ToolCall;\n\t\t\tvalidatedArgs: Record<string, unknown>;\n\t\t\ttoolDef: AgentTool;\n\t\t\tevents: AgentEvent[];\n\t\t\tsanitizedExecutionArgs: Record<string, unknown>;\n\t\t\tapprovalRequestId?: string;\n\t\t\ttoolExecutionBridgePlan?: ToolExecutionBridgePlan;\n\t  };\n\nexport interface ToolSafetyContext {\n\ttoolCall: ToolCall;\n\ttools: AgentTool[];\n\tuserMessage: Message;\n\tcfg: AgentRunConfig;\n\tsignal?: AbortSignal;\n\t// Services\n\tclock: Clock;\n\tsafetyMiddleware: SafetyMiddleware;\n\tworkflowState: WorkflowStateTracker;\n\tadaptiveThresholds: AdaptiveThresholds;\n\tauditLogger?: ToolAuditLogger;\n\tapprovalService?: ActionApprovalService;\n\ttoolExecutionBridge?: PlatformToolExecutionBridge;\n\thookService?: {\n\t\trunPreToolUseHooks: (\n\t\t\ttoolCall: ToolCall,\n\t\t\tsignal?: AbortSignal,\n\t\t) => Promise<{\n\t\t\tblocked?: boolean;\n\t\t\tblockReason?: string;\n\t\t\tupdatedInput?: Record<string, unknown>;\n\t\t}>;\n\t\trunPermissionRequestHooks?: (\n\t\t\ttoolCall: ToolCall,\n\t\t\treason: string,\n\t\t\tsignal?: AbortSignal,\n\t\t) => Promise<{\n\t\t\tdecision?: \"allow\" | \"deny\";\n\t\t\tdecisionReason?: string;\n\t\t\tupdatedInput?: Record<string, unknown>;\n\t\t}>;\n\t};\n\tfirewall: ActionFirewall;\n\t// Mutable rate-limit state\n\trateLimitState: {\n\t\trecentToolTimestamps: Map<string, number[]>;\n\t\ttoolCallsThisMinute: number;\n\t\tminuteWindowStart: number;\n\t\trateWindowMs: number;\n\t\trateLimit: number;\n\t};\n\t/** Suppress loop warnings for a transport-managed read-only duplicate while preserving other policy checks. */\n\tshouldSkipLoopDetection?: (toolCall: ToolCall) => boolean;\n\t/** Scheduler diagnostics captured before safety hooks mutate the call. */\n\tschedulingMetadata?: ToolSchedulingMetadata;\n\t// Emit helpers\n\temitToolResult: (\n\t\tmessage: ToolResultMessage,\n\t\ttoolCall: ToolCall,\n\t\tisError: boolean,\n\t\tmetadata?: {\n\t\t\ttoolExecutionId?: string;\n\t\t\tapprovalRequestId?: string;\n\t\t},\n\t) => AgentEvent[];\n}\n\ninterface ApprovalRegistrationMetadata {\n\tremoteApprovalRequestId?: string;\n}\n\ninterface ApprovalRegistrationAwareService {\n\twaitForPendingApprovalRegistration?: (\n\t\trequestId: string,\n\t\toptions?: { signal?: AbortSignal },\n\t) => Promise<ApprovalRegistrationMetadata | null>;\n}\n\nfunction guardedFileAuditContext(\n\ttoolName: string,\n\targs: Record<string, unknown>,\n\tmatch: GuardedFileMatch | null,\n\tmetadata: {\n\t\tdisplayName?: string;\n\t\tsummaryLabel?: string;\n\t},\n): Record<string, unknown> {\n\tconst context: Record<string, unknown> = {\n\t\ttool_name: toolName,\n\t\tdisplay_name: metadata.displayName,\n\t\tsummary_label: metadata.summaryLabel,\n\t\targs,\n\t};\n\tif (match) {\n\t\tcontext.guarded_file = {\n\t\t\trule_id: match.ruleId,\n\t\t\tcategory: match.category,\n\t\t\tpattern: match.pattern,\n\t\t\tpath: match.path,\n\t\t\taction: classifyGuardedFileAccessAction(toolName),\n\t\t};\n\t}\n\treturn context;\n}\n\nfunction guardedFileAuditFields(\n\tguardedFileApprovalRequired: boolean,\n): Pick<RecordMaestroApprovalHitInput, \"policy_id\" | \"risk_level\"> {\n\treturn guardedFileApprovalRequired\n\t\t? {\n\t\t\t\tpolicy_id: GUARDED_FILES_BLOCK_POLICY_ID,\n\t\t\t\trisk_level: \"guarded_file\",\n\t\t\t}\n\t\t: {};\n}\n\nasync function waitForPendingApprovalRegistration(\n\tapprovalService: ActionApprovalService,\n\trequestId: string,\n\tdecisionPromise: Promise<ActionApprovalDecision>,\n\tsignal?: AbortSignal,\n): Promise<ApprovalRegistrationMetadata | null> {\n\tconst registrationAware = approvalService as ActionApprovalService &\n\t\tApprovalRegistrationAwareService;\n\tif (\n\t\ttypeof registrationAware.waitForPendingApprovalRegistration !== \"function\"\n\t) {\n\t\treturn null;\n\t}\n\n\ttry {\n\t\treturn await Promise.race([\n\t\t\tregistrationAware.waitForPendingApprovalRegistration(requestId, {\n\t\t\t\tsignal,\n\t\t\t}),\n\t\t\tdecisionPromise.then(\n\t\t\t\t() => null,\n\t\t\t\t() => null,\n\t\t\t),\n\t\t]);\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Rate Limiting\n// ─────────────────────────────────────────────────────────────────────────────\n\ntype RateLimitBlockKind = \"anomaly\" | \"rate_limit\";\n\ninterface RateLimitBlock {\n\tkind: RateLimitBlockKind;\n\treason: string;\n}\n\nfunction checkRateLimit(ctx: ToolSafetyContext):\n\t| {\n\t\t\tblocked: true;\n\t\t\tevents: AgentEvent[];\n\t\t\tupdatedState: RateLimitUpdate;\n\t\t\tblock: RateLimitBlock;\n\t  }\n\t| {\n\t\t\tblocked: false;\n\t\t\trecent: number[];\n\t\t\tupdatedState: RateLimitUpdate;\n\t  } {\n\tconst { toolCall, clock, adaptiveThresholds, emitToolResult } = ctx;\n\tconst { recentToolTimestamps, rateWindowMs, rateLimit } = ctx.rateLimitState;\n\tlet { toolCallsThisMinute, minuteWindowStart } = ctx.rateLimitState;\n\n\tconst now = clock.now();\n\tconst timestamps = recentToolTimestamps.get(toolCall.name) ?? [];\n\tconst recent = timestamps.filter((ts) => now - ts < rateWindowMs);\n\n\t// Track tool calls per minute for adaptive thresholds\n\tif (now - minuteWindowStart >= 60_000) {\n\t\tadaptiveThresholds.recordObservation(\n\t\t\tMETRICS.TOOL_CALLS_PER_MINUTE,\n\t\t\ttoolCallsThisMinute,\n\t\t);\n\t\ttoolCallsThisMinute = 0;\n\t\tminuteWindowStart = now;\n\t}\n\ttoolCallsThisMinute++;\n\n\t// Track tool-specific metrics\n\tconst toolNameLower = toolCall.name.toLowerCase();\n\tif (toolNameLower === \"read\" || toolNameLower === \"glob\") {\n\t\tadaptiveThresholds.recordObservation(METRICS.READS_PER_MINUTE, 1);\n\t} else if (\n\t\ttoolNameLower === \"write\" ||\n\t\ttoolNameLower === \"edit\" ||\n\t\ttoolNameLower === \"apply_patch\"\n\t) {\n\t\tadaptiveThresholds.recordObservation(METRICS.WRITES_PER_MINUTE, 1);\n\t} else if (\n\t\ttoolNameLower === \"webfetch\" ||\n\t\ttoolNameLower === \"websearch\" ||\n\t\ttoolNameLower.includes(\"mcp\")\n\t) {\n\t\tadaptiveThresholds.recordObservation(METRICS.EGRESS_PER_MINUTE, 1);\n\t}\n\n\tconst updatedState: RateLimitUpdate = {\n\t\ttoolCallsThisMinute,\n\t\tminuteWindowStart,\n\t};\n\n\t// Check for anomalous tool call rate\n\tconst anomalyCheck = adaptiveThresholds.checkAnomaly(\n\t\tMETRICS.TOOL_CALLS_PER_MINUTE,\n\t\ttoolCallsThisMinute,\n\t);\n\n\t// Enforce anomaly detection\n\tif (anomalyCheck.isAnomaly) {\n\t\tconst reason = `Anomaly detected: ${anomalyCheck.reason ?? \"Unusual tool call rate\"}`;\n\t\ttrackToolBlocked({\n\t\t\ttoolName: toolCall.name,\n\t\t\treason,\n\t\t\tsource: \"adaptive\",\n\t\t});\n\t\tconst anomalyMessage: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Blocked \"${toolCall.name}\" due to anomalous behavior: ${anomalyCheck.reason ?? \"Unusual tool call pattern detected\"}. Z-score: ${anomalyCheck.zScore.toFixed(2)}, Baseline: ${anomalyCheck.mean.toFixed(2)} ± ${anomalyCheck.stdDev.toFixed(2)}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: now,\n\t\t};\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tevents: emitToolResult(anomalyMessage, toolCall, true),\n\t\t\tupdatedState,\n\t\t\tblock: {\n\t\t\t\tkind: \"anomaly\",\n\t\t\t\treason,\n\t\t\t},\n\t\t};\n\t}\n\n\t// Use adaptive threshold if we have enough data, otherwise use static limit\n\tconst effectiveRateLimit = adaptiveThresholds.getAdaptedThreshold(\n\t\t`tool_rate_${toolCall.name}`,\n\t\trateLimit,\n\t);\n\n\tif (recent.length >= effectiveRateLimit) {\n\t\tconst reason = `Rate limit exceeded: >${effectiveRateLimit} calls in ${rateWindowMs / 1000}s window`;\n\t\tconst rateMessage: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Blocked \"${toolCall.name}\" due to rate limit: >${effectiveRateLimit} calls in ${rateWindowMs / 1000}s window.${\n\t\t\t\t\t\tanomalyCheck.isAnomaly\n\t\t\t\t\t\t\t? ` (Anomaly detected: ${anomalyCheck.reason})`\n\t\t\t\t\t\t\t: \"\"\n\t\t\t\t\t}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: now,\n\t\t};\n\t\treturn {\n\t\t\tblocked: true,\n\t\t\tevents: emitToolResult(rateMessage, toolCall, true),\n\t\t\tupdatedState,\n\t\t\tblock: {\n\t\t\t\tkind: \"rate_limit\",\n\t\t\t\treason,\n\t\t\t},\n\t\t};\n\t}\n\n\t// Record observation for per-tool adaptive rate\n\tadaptiveThresholds.recordObservation(\n\t\t`tool_rate_${toolCall.name}`,\n\t\trecent.length,\n\t);\n\trecent.push(now);\n\trecentToolTimestamps.set(toolCall.name, recent);\n\n\treturn { blocked: false, recent, updatedState };\n}\n\ninterface RateLimitUpdate {\n\ttoolCallsThisMinute: number;\n\tminuteWindowStart: number;\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Main Safety Evaluation\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Evaluate all safety checks for a tool call before execution.\n * Yields events as they occur and returns the final verdict.\n */\nexport async function* evaluateToolSafety(\n\tctx: ToolSafetyContext,\n): AsyncGenerator<\n\tAgentEvent,\n\t{ verdict: ToolSafetyVerdict; rateLimitUpdate: RateLimitUpdate }\n> {\n\tconst {\n\t\ttoolCall,\n\t\ttools,\n\t\tuserMessage,\n\t\tcfg,\n\t\tsignal,\n\t\tclock,\n\t\tsafetyMiddleware,\n\t\tworkflowState,\n\t\tauditLogger,\n\t\tapprovalService,\n\t\ttoolExecutionBridge,\n\t\thookService,\n\t\tfirewall,\n\t\tshouldSkipLoopDetection,\n\t\temitToolResult,\n\t} = ctx;\n\n\tconst events: AgentEvent[] = [];\n\tconst recordEvent = (event: AgentEvent) => {\n\t\tevents.push(event);\n\t\treturn event;\n\t};\n\tconst recordEvents = (newEvents: AgentEvent[]) => {\n\t\tevents.push(...newEvents);\n\t\treturn newEvents;\n\t};\n\n\tconst sanitizedStartArgs = safetyMiddleware.sanitizeForLogging(\n\t\ttoolCall.arguments as Record<string, unknown>,\n\t);\n\n\t// 1. Rate limiting\n\tconst rateLimitResult = checkRateLimit(ctx);\n\tif (rateLimitResult.blocked) {\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\ttoolCall.name,\n\t\t\tsanitizedStartArgs,\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\trateLimitResult.block.reason,\n\t\t);\n\t\tconst blockedEvents = recordEvents(rateLimitResult.events);\n\t\tfor (const event of blockedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\tyield recordEvent({\n\t\ttype: \"tool_execution_start\",\n\t\ttoolCallId: toolCall.id,\n\t\ttoolName: toolCall.name,\n\t\targs: sanitizedStartArgs,\n\t\tscheduling: ctx.schedulingMetadata,\n\t});\n\n\t// 2. PreToolUse hooks\n\tlet effectiveToolCall = toolCall;\n\tif (hookService) {\n\t\tconst hookResult = await hookService.runPreToolUseHooks(toolCall, signal);\n\n\t\tif (hookResult.blocked) {\n\t\t\tconst hookBlockedResult: ToolResultMessage = {\n\t\t\t\trole: \"toolResult\",\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\tcontent: [\n\t\t\t\t\t{\n\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\ttext: `Blocked by hook: ${hookResult.blockReason ?? \"Hook denied execution\"}`,\n\t\t\t\t\t},\n\t\t\t\t],\n\t\t\t\tisError: true,\n\t\t\t\ttimestamp: clock.now(),\n\t\t\t};\n\t\t\tawait logToolExecutionAudit(\n\t\t\t\tauditLogger,\n\t\t\t\ttoolCall.name,\n\t\t\t\tsafetyMiddleware.sanitizeForLogging(\n\t\t\t\t\ttoolCall.arguments as Record<string, unknown>,\n\t\t\t\t),\n\t\t\t\t\"denied\",\n\t\t\t\t0,\n\t\t\t\thookResult.blockReason,\n\t\t\t);\n\t\t\tconst hookBlockedEvents = recordEvents(\n\t\t\t\temitToolResult(hookBlockedResult, toolCall, true),\n\t\t\t);\n\t\t\tfor (const event of hookBlockedEvents) {\n\t\t\t\tyield event;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t\t};\n\t\t}\n\n\t\tif (hookResult.updatedInput) {\n\t\t\tconst originalKeys = Object.keys(\n\t\t\t\ttoolCall.arguments as Record<string, unknown>,\n\t\t\t);\n\t\t\tconst updatedKeys = Object.keys(hookResult.updatedInput);\n\t\t\tconst addedKeys = updatedKeys.filter((k) => !originalKeys.includes(k));\n\t\t\tconst removedKeys = originalKeys.filter((k) => !updatedKeys.includes(k));\n\t\t\tconst modifiedKeys = updatedKeys.filter(\n\t\t\t\t(k) =>\n\t\t\t\t\toriginalKeys.includes(k) &&\n\t\t\t\t\t(toolCall.arguments as Record<string, unknown>)[k] !==\n\t\t\t\t\t\thookResult.updatedInput![k],\n\t\t\t);\n\t\t\tlogger.debug(\"Hook modified tool input\", {\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\taddedKeys,\n\t\t\t\tremovedKeys,\n\t\t\t\tmodifiedKeys,\n\t\t\t});\n\t\t\teffectiveToolCall = {\n\t\t\t\t...toolCall,\n\t\t\t\targuments: hookResult.updatedInput,\n\t\t\t};\n\t\t}\n\t}\n\n\t// 3. Safety middleware sequence analysis\n\tconst safetyCheck = safetyMiddleware.preExecution(\n\t\teffectiveToolCall.name,\n\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t{\n\t\t\tskipLoopDetection: shouldSkipLoopDetection?.(effectiveToolCall) === true,\n\t\t},\n\t);\n\n\tif (!safetyCheck.allowed && !safetyCheck.requiresApproval) {\n\t\tconst safetyBlockedResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Blocked by safety check: ${safetyCheck.reason ?? \"Safety policy violation\"}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\ttoolCall.name,\n\t\t\tsafetyCheck.sanitizedArgs,\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\tsafetyCheck.reason,\n\t\t);\n\t\tconst safetyBlockedEvents = recordEvents(\n\t\t\temitToolResult(safetyBlockedResult, toolCall, true),\n\t\t);\n\t\tfor (const event of safetyBlockedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tlet approvalAllowed = true;\n\tlet approvalReason: string | undefined;\n\n\tif (safetyCheck.requiresApproval) {\n\t\tapprovalAllowed = false;\n\t\tapprovalReason = safetyCheck.reason;\n\t}\n\n\t// 4. Firewall evaluation\n\tconst workflowSnapshot = workflowState.snapshot();\n\tconst toolDef = tools.find((t) => t.name === effectiveToolCall.name);\n\tconst describeArgs = (args: Record<string, unknown>) => ({\n\t\tdisplayName: describeToolDisplayName(toolCall.name, args, toolDef),\n\t\tsummaryLabel: summarizeToolUse(toolCall.name, args, toolDef),\n\t\tactionDescription: describeToolActivity(toolCall.name, args, toolDef),\n\t});\n\tconst verdict = await firewall.evaluate({\n\t\ttoolName: effectiveToolCall.name,\n\t\targs: effectiveToolCall.arguments,\n\t\tmetadata: {\n\t\t\tworkflowState: workflowSnapshot,\n\t\t\tannotations: toolDef?.annotations,\n\t\t\tguardedFiles: cfg.guardedFiles,\n\t\t},\n\t\tuser: cfg.user,\n\t\tsession: cfg.session,\n\t\tuserIntent: extractTextFromContent(userMessage.content),\n\t});\n\tlet guardedFileMatch = findGuardedToolCallMatch(\n\t\teffectiveToolCall.name,\n\t\teffectiveToolCall.arguments,\n\t\t{ policy: cfg.guardedFiles },\n\t);\n\tlet guardedFileApprovalRequired =\n\t\tBoolean(guardedFileMatch) ||\n\t\t(verdict.action === \"require_approval\" &&\n\t\t\tverdict.ruleId === DEFAULT_GUARDED_FILE_RULE_ID);\n\tlet guardedFileApprovalReason = guardedFileMatch\n\t\t? describeDefaultGuardedFileMatch(guardedFileMatch)\n\t\t: guardedFileApprovalRequired && verdict.action === \"require_approval\"\n\t\t\t? verdict.reason\n\t\t\t: undefined;\n\tconst guardedFileBlockVerdict = (\n\t\tmatch: GuardedFileMatch,\n\t): Extract<ActionFirewallVerdict, { action: \"block\" }> => ({\n\t\taction: \"block\",\n\t\truleId: DEFAULT_GUARDED_FILE_RULE_ID,\n\t\treason: describeDefaultGuardedFileMatch(match),\n\t\tremediation:\n\t\t\t\"Remove the matching custom guard or change its defaultBehavior to ask if this access should be approval-gated instead of blocked.\",\n\t});\n\n\tconst emitFirewallBlock = async (\n\t\tblockVerdict: Extract<ActionFirewallVerdict, { action: \"block\" }>,\n\t\tblockedToolCall: ToolCall,\n\t) => {\n\t\tconst blockedResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: blockedToolCall.id,\n\t\t\ttoolName: blockedToolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Action blocked by firewall: ${blockVerdict.reason}${\n\t\t\t\t\t\tblockVerdict.remediation\n\t\t\t\t\t\t\t? `\\n\\nSuggestion: ${blockVerdict.remediation}`\n\t\t\t\t\t\t\t: \"\"\n\t\t\t\t\t}`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\tblockedToolCall.name,\n\t\t\tsafetyMiddleware.sanitizeForLogging(\n\t\t\t\tblockedToolCall.arguments as Record<string, unknown>,\n\t\t\t),\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\tblockVerdict.reason,\n\t\t);\n\t\tconst firewallBlockedEvents = recordEvents(\n\t\t\temitToolResult(blockedResult, blockedToolCall, true),\n\t\t);\n\t\tconst sanitizedFirewallArgs = safetyMiddleware.sanitizeForLogging(\n\t\t\tblockedToolCall.arguments as Record<string, unknown>,\n\t\t);\n\t\trecordMaestroFirewallBlock({\n\t\t\trule_id: blockVerdict.ruleId,\n\t\t\toperation: blockedToolCall.name,\n\t\t\ttarget:\n\t\t\t\ttypeof sanitizedFirewallArgs.command === \"string\"\n\t\t\t\t\t? sanitizedFirewallArgs.command\n\t\t\t\t\t: blockedToolCall.name,\n\t\t\treason: blockVerdict.reason,\n\t\t\tcontext: sanitizedFirewallArgs,\n\t\t\tcorrelation: {\n\t\t\t\tsession_id: cfg.session?.id,\n\t\t\t\tagent_run_step_id: blockedToolCall.id,\n\t\t\t},\n\t\t});\n\t\tconst blockedToolSafetyVerdict = { outcome: \"blocked\" as const, events };\n\t\treturn {\n\t\t\teventsToYield: firewallBlockedEvents,\n\t\t\tverdict: blockedToolSafetyVerdict,\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t};\n\n\tif (verdict.action === \"block\") {\n\t\tconst blocked = await emitFirewallBlock(verdict, effectiveToolCall);\n\t\tfor (const event of blocked.eventsToYield) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: blocked.verdict,\n\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t};\n\t}\n\n\tif (guardedFileMatch?.defaultBehavior === \"block\") {\n\t\tconst blocked = await emitFirewallBlock(\n\t\t\tguardedFileBlockVerdict(guardedFileMatch),\n\t\t\teffectiveToolCall,\n\t\t);\n\t\tfor (const event of blocked.eventsToYield) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: blocked.verdict,\n\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t};\n\t}\n\n\t// 5. PII policy check\n\tif (\n\t\tverdict.action === \"require_approval\" &&\n\t\tverdict.ruleId === HUMAN_EGRESS_PII_RULE_ID\n\t) {\n\t\tconst policyResult = buildPiiPolicyResult(\n\t\t\ttoolCall,\n\t\t\tworkflowSnapshot,\n\t\t\tclock,\n\t\t);\n\t\tconst policyBlockedEvents = recordEvents(\n\t\t\temitToolResult(policyResult, toolCall, true),\n\t\t);\n\t\tfor (const event of policyBlockedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tif (!toolDef) {\n\t\tconst errorResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: `Error: Tool \"${toolCall.name}\" not found`,\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tconst errorEvents = recordEvents(\n\t\t\temitToolResult(errorResult, toolCall, true),\n\t\t);\n\t\tfor (const event of errorEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tlet toolExecutionBridgePlan: ToolExecutionBridgePlan | undefined;\n\tlet approvalRequestId: string | undefined;\n\tlet platformApprovalRequest:\n\t\t| import(\"../action-approval.js\").ActionApprovalRequest\n\t\t| undefined;\n\tlet platformApprovalResolved = false;\n\tconst bridgeArgs = safetyMiddleware.sanitizeForLogging(\n\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t);\n\tconst bridgeInput: ToolExecutionBridgeInput = {\n\t\tcfg,\n\t\ttoolCall,\n\t\ttoolDef,\n\t\tsanitizedArgs: bridgeArgs,\n\t\t...describeArgs(bridgeArgs),\n\t};\n\tif (toolExecutionBridge) {\n\t\tconst bridgeResult = await toolExecutionBridge.prepare(bridgeInput, signal);\n\t\tswitch (bridgeResult.status) {\n\t\t\tcase \"observe\":\n\t\t\tcase \"allow\":\n\t\t\t\ttoolExecutionBridgePlan = bridgeResult.plan;\n\t\t\t\tbreak;\n\t\t\tcase \"wait_approval\":\n\t\t\t\ttoolExecutionBridgePlan = bridgeResult.plan;\n\t\t\t\tplatformApprovalRequest =\n\t\t\t\t\tbridgeResult.request.startedAtMs === undefined\n\t\t\t\t\t\t? { ...bridgeResult.request, startedAtMs: clock.now() }\n\t\t\t\t\t\t: bridgeResult.request;\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason = bridgeResult.request.reason;\n\t\t\t\tbreak;\n\t\t\tcase \"deny\": {\n\t\t\t\tawait logToolExecutionAudit(\n\t\t\t\t\tauditLogger,\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\t\tbridgeArgs,\n\t\t\t\t\t\"denied\",\n\t\t\t\t\t0,\n\t\t\t\t\tbridgeResult.reason,\n\t\t\t\t);\n\t\t\t\tconst deniedResult: ToolResultMessage = {\n\t\t\t\t\trole: \"toolResult\",\n\t\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\t\ttoolName: toolCall.name,\n\t\t\t\t\tcontent: [{ type: \"text\", text: bridgeResult.reason }],\n\t\t\t\t\tisError: true,\n\t\t\t\t\ttimestamp: clock.now(),\n\t\t\t\t};\n\t\t\t\tconst deniedEvents = recordEvents(\n\t\t\t\t\temitToolResult(deniedResult, toolCall, true, {\n\t\t\t\t\t\ttoolExecutionId: bridgeResult.plan?.metadata.toolExecutionId,\n\t\t\t\t\t\tapprovalRequestId: bridgeResult.plan?.metadata.approvalRequestId,\n\t\t\t\t\t}),\n\t\t\t\t);\n\t\t\t\tfor (const event of deniedEvents) {\n\t\t\t\t\tyield event;\n\t\t\t\t}\n\t\t\t\treturn {\n\t\t\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t\t\t};\n\t\t\t}\n\t\t\tdefault:\n\t\t\t\tbreak;\n\t\t}\n\t}\n\n\t// 6. Approval flow\n\tif (\n\t\tverdict.action === \"require_approval\" ||\n\t\tplatformApprovalRequest ||\n\t\tguardedFileApprovalRequired\n\t) {\n\t\tconst localApprovalReason =\n\t\t\tverdict.action === \"require_approval\" ? verdict.reason : undefined;\n\t\tlet permissionHookMadeDecision = false;\n\t\tif (hookService?.runPermissionRequestHooks) {\n\t\t\tconst permissionHookResult = await hookService.runPermissionRequestHooks(\n\t\t\t\teffectiveToolCall,\n\t\t\t\tplatformApprovalRequest?.reason ??\n\t\t\t\t\tguardedFileApprovalReason ??\n\t\t\t\t\tlocalApprovalReason ??\n\t\t\t\t\tapprovalReason ??\n\t\t\t\t\t\"Approval required\",\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\tif (permissionHookResult.updatedInput && !guardedFileApprovalRequired) {\n\t\t\t\teffectiveToolCall = {\n\t\t\t\t\t...effectiveToolCall,\n\t\t\t\t\targuments: permissionHookResult.updatedInput,\n\t\t\t\t};\n\t\t\t\tconst rewrittenVerdict = await firewall.evaluate({\n\t\t\t\t\ttoolName: effectiveToolCall.name,\n\t\t\t\t\targs: effectiveToolCall.arguments,\n\t\t\t\t\tmetadata: {\n\t\t\t\t\t\tworkflowState: workflowSnapshot,\n\t\t\t\t\t\tannotations: toolDef?.annotations,\n\t\t\t\t\t\tguardedFiles: cfg.guardedFiles,\n\t\t\t\t\t},\n\t\t\t\t\tuser: cfg.user,\n\t\t\t\t\tsession: cfg.session,\n\t\t\t\t\tuserIntent: extractTextFromContent(userMessage.content),\n\t\t\t\t});\n\t\t\t\tif (rewrittenVerdict.action === \"block\") {\n\t\t\t\t\tconst blocked = await emitFirewallBlock(\n\t\t\t\t\t\trewrittenVerdict,\n\t\t\t\t\t\teffectiveToolCall,\n\t\t\t\t\t);\n\t\t\t\t\tfor (const event of blocked.eventsToYield) {\n\t\t\t\t\t\tyield event;\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tverdict: blocked.verdict,\n\t\t\t\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\tconst guardedMatch = findGuardedToolCallMatch(\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\t\teffectiveToolCall.arguments,\n\t\t\t\t\t{ policy: cfg.guardedFiles },\n\t\t\t\t);\n\t\t\t\tif (guardedMatch?.defaultBehavior === \"block\") {\n\t\t\t\t\tconst blocked = await emitFirewallBlock(\n\t\t\t\t\t\tguardedFileBlockVerdict(guardedMatch),\n\t\t\t\t\t\teffectiveToolCall,\n\t\t\t\t\t);\n\t\t\t\t\tfor (const event of blocked.eventsToYield) {\n\t\t\t\t\t\tyield event;\n\t\t\t\t\t}\n\t\t\t\t\treturn {\n\t\t\t\t\t\tverdict: blocked.verdict,\n\t\t\t\t\t\trateLimitUpdate: blocked.rateLimitUpdate,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t\tif (guardedMatch) {\n\t\t\t\t\tguardedFileMatch = guardedMatch;\n\t\t\t\t\tguardedFileApprovalRequired = true;\n\t\t\t\t\tguardedFileApprovalReason =\n\t\t\t\t\t\tdescribeDefaultGuardedFileMatch(guardedMatch);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (permissionHookResult.decision === \"allow\") {\n\t\t\t\tif (!guardedFileApprovalRequired) {\n\t\t\t\t\tpermissionHookMadeDecision = true;\n\t\t\t\t\tapprovalAllowed = true;\n\t\t\t\t\tapprovalReason = permissionHookResult.decisionReason;\n\t\t\t\t}\n\t\t\t} else if (permissionHookResult.decision === \"deny\") {\n\t\t\t\tpermissionHookMadeDecision = true;\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason =\n\t\t\t\t\tpermissionHookResult.decisionReason ??\n\t\t\t\t\t\"Permission denied by PermissionRequest hook\";\n\t\t\t}\n\t\t}\n\n\t\tif (\n\t\t\tpermissionHookMadeDecision &&\n\t\t\ttoolExecutionBridge &&\n\t\t\tplatformApprovalRequest &&\n\t\t\ttoolExecutionBridgePlan?.kind === \"governed\"\n\t\t) {\n\t\t\tconst resolution = await toolExecutionBridge.resolveApproval(\n\t\t\t\tbridgeInput,\n\t\t\t\ttoolExecutionBridgePlan,\n\t\t\t\t{\n\t\t\t\t\tapproved: approvalAllowed,\n\t\t\t\t\treason: approvalReason,\n\t\t\t\t\tresolvedBy: \"policy\",\n\t\t\t\t},\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\tplatformApprovalResolved = true;\n\t\t\ttoolExecutionBridgePlan = resolution.plan;\n\t\t\tif (resolution.status === \"deny\") {\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason = resolution.reason;\n\t\t\t} else {\n\t\t\t\tapprovalAllowed = true;\n\t\t\t\tapprovalReason = undefined;\n\t\t\t}\n\t\t}\n\n\t\tif (\n\t\t\tguardedFileApprovalRequired &&\n\t\t\tapprovalService?.requiresUserInteraction() !== true\n\t\t) {\n\t\t\tapprovalAllowed = false;\n\t\t\tif (!permissionHookMadeDecision) {\n\t\t\t\tapprovalReason = `${guardedFileApprovalReason ?? localApprovalReason ?? \"Guarded file access requires explicit approval\"} Approval mode must be prompt for guarded file access.`;\n\t\t\t}\n\t\t\tconst sanitizedApprovalArgs = safetyMiddleware.sanitizeForLogging(\n\t\t\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t\t);\n\t\t\tconst approvalDescription = describeArgs(sanitizedApprovalArgs);\n\t\t\trecordMaestroApprovalHit({\n\t\t\t\tapproval_request_id:\n\t\t\t\t\ttoolExecutionBridgePlan?.metadata.approvalRequestId ?? toolCall.id,\n\t\t\t\taction:\n\t\t\t\t\tapprovalDescription.actionDescription ??\n\t\t\t\t\tapprovalDescription.summaryLabel ??\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\tcommand:\n\t\t\t\t\ttypeof sanitizedApprovalArgs.command === \"string\"\n\t\t\t\t\t\t? sanitizedApprovalArgs.command\n\t\t\t\t\t\t: undefined,\n\t\t\t\tdecision_mode: \"MAESTRO_DECISION_MODE_REQUIRE_APPROVAL\",\n\t\t\t\t...guardedFileAuditFields(true),\n\t\t\t\treason: approvalReason,\n\t\t\t\tcontext: guardedFileAuditContext(\n\t\t\t\t\teffectiveToolCall.name,\n\t\t\t\t\tsanitizedApprovalArgs,\n\t\t\t\t\tguardedFileMatch,\n\t\t\t\t\tapprovalDescription,\n\t\t\t\t),\n\t\t\t\tcorrelation: {\n\t\t\t\t\tsession_id: cfg.session?.id,\n\t\t\t\t\tagent_run_step_id: toolCall.id,\n\t\t\t\t},\n\t\t\t});\n\t\t} else if (approvalService && !permissionHookMadeDecision) {\n\t\t\tconst sanitizedApprovalArgs = safetyMiddleware.sanitizeForLogging(\n\t\t\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t\t);\n\t\t\tconst request =\n\t\t\t\t!guardedFileApprovalRequired && platformApprovalRequest\n\t\t\t\t\t? platformApprovalRequest\n\t\t\t\t\t: ({\n\t\t\t\t\t\t\tid: toolCall.id,\n\t\t\t\t\t\t\ttoolName: toolCall.name,\n\t\t\t\t\t\t\t...describeArgs(sanitizedApprovalArgs),\n\t\t\t\t\t\t\targs: sanitizedApprovalArgs,\n\t\t\t\t\t\t\treason:\n\t\t\t\t\t\t\t\tguardedFileApprovalReason ??\n\t\t\t\t\t\t\t\tlocalApprovalReason ??\n\t\t\t\t\t\t\t\t\"Approval required\",\n\t\t\t\t\t\t\tstartedAtMs: clock.now(),\n\t\t\t\t\t\t} satisfies import(\"../action-approval.js\").ActionApprovalRequest);\n\t\t\tconst shouldEmitEvents = approvalService.requiresUserInteraction();\n\t\t\tconst decisionPromise = approvalService.requestApproval(\n\t\t\t\trequest,\n\t\t\t\tsignal,\n\t\t\t\tclock,\n\t\t\t);\n\t\t\tconst registrationMetadata = await waitForPendingApprovalRegistration(\n\t\t\t\tapprovalService,\n\t\t\t\trequest.id,\n\t\t\t\tdecisionPromise,\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\tapprovalRequestId =\n\t\t\t\tplatformApprovalRequest?.id ??\n\t\t\t\ttoolExecutionBridgePlan?.metadata.approvalRequestId ??\n\t\t\t\tregistrationMetadata?.remoteApprovalRequestId ??\n\t\t\t\trequest.id;\n\t\t\trecordMaestroApprovalHit({\n\t\t\t\tapproval_request_id: approvalRequestId,\n\t\t\t\taction:\n\t\t\t\t\trequest.actionDescription ?? request.summaryLabel ?? request.toolName,\n\t\t\t\tcommand:\n\t\t\t\t\ttypeof sanitizedApprovalArgs.command === \"string\"\n\t\t\t\t\t\t? sanitizedApprovalArgs.command\n\t\t\t\t\t\t: undefined,\n\t\t\t\tdecision_mode: \"MAESTRO_DECISION_MODE_REQUIRE_APPROVAL\",\n\t\t\t\t...guardedFileAuditFields(guardedFileApprovalRequired),\n\t\t\t\treason: request.reason,\n\t\t\t\tcontext: guardedFileAuditContext(\n\t\t\t\t\trequest.toolName,\n\t\t\t\t\tsanitizedApprovalArgs,\n\t\t\t\t\tguardedFileApprovalRequired ? guardedFileMatch : null,\n\t\t\t\t\t{\n\t\t\t\t\t\tdisplayName: request.displayName,\n\t\t\t\t\t\tsummaryLabel: request.summaryLabel,\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t\t\tcorrelation: {\n\t\t\t\t\tsession_id: cfg.session?.id,\n\t\t\t\t\tagent_run_step_id: toolCall.id,\n\t\t\t\t},\n\t\t\t});\n\t\t\tif (shouldEmitEvents) {\n\t\t\t\tyield recordEvent({ type: \"action_approval_required\", request });\n\t\t\t}\n\n\t\t\tconst rawDecision = await decisionPromise;\n\t\t\tconst decision =\n\t\t\t\trawDecision.resolvedAtMs === undefined\n\t\t\t\t\t? { ...rawDecision, resolvedAtMs: clock.now() }\n\t\t\t\t\t: rawDecision;\n\t\t\tif (shouldEmitEvents) {\n\t\t\t\tyield recordEvent({\n\t\t\t\t\ttype: \"action_approval_resolved\",\n\t\t\t\t\trequest,\n\t\t\t\t\tdecision,\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (\n\t\t\t\ttoolExecutionBridge &&\n\t\t\t\tplatformApprovalRequest &&\n\t\t\t\ttoolExecutionBridgePlan?.kind === \"governed\"\n\t\t\t) {\n\t\t\t\tconst resolution = await toolExecutionBridge.resolveApproval(\n\t\t\t\t\tbridgeInput,\n\t\t\t\t\ttoolExecutionBridgePlan,\n\t\t\t\t\tdecision,\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t\tplatformApprovalResolved = true;\n\t\t\t\ttoolExecutionBridgePlan = resolution.plan;\n\t\t\t\tif (resolution.status === \"deny\") {\n\t\t\t\t\tapprovalAllowed = false;\n\t\t\t\t\tapprovalReason = resolution.reason;\n\t\t\t\t} else {\n\t\t\t\t\tapprovalAllowed = true;\n\t\t\t\t\tapprovalReason = undefined;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (!decision.approved) {\n\t\t\t\tapprovalAllowed = false;\n\t\t\t\tapprovalReason = decision.reason ?? localApprovalReason;\n\t\t\t}\n\t\t}\n\t}\n\n\tif (!approvalAllowed) {\n\t\tif (\n\t\t\ttoolExecutionBridge &&\n\t\t\tplatformApprovalRequest &&\n\t\t\ttoolExecutionBridgePlan?.kind === \"governed\" &&\n\t\t\t!platformApprovalResolved\n\t\t) {\n\t\t\tconst resolution = await toolExecutionBridge.resolveApproval(\n\t\t\t\tbridgeInput,\n\t\t\t\ttoolExecutionBridgePlan,\n\t\t\t\t{\n\t\t\t\t\tapproved: false,\n\t\t\t\t\treason: approvalReason ?? \"Approval denied\",\n\t\t\t\t\tresolvedBy: \"policy\",\n\t\t\t\t},\n\t\t\t\tsignal,\n\t\t\t);\n\t\t\ttoolExecutionBridgePlan = resolution.plan;\n\t\t\tapprovalReason =\n\t\t\t\tresolution.status === \"deny\"\n\t\t\t\t\t? resolution.reason\n\t\t\t\t\t: (approvalReason ?? \"Approval denied\");\n\t\t}\n\t\tawait logToolExecutionAudit(\n\t\t\tauditLogger,\n\t\t\teffectiveToolCall.name,\n\t\t\tsafetyMiddleware.sanitizeForLogging(\n\t\t\t\teffectiveToolCall.arguments as Record<string, unknown>,\n\t\t\t),\n\t\t\t\"denied\",\n\t\t\t0,\n\t\t\tapprovalReason,\n\t\t);\n\t\tconst deniedResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [{ type: \"text\", text: approvalReason ?? \"Action denied\" }],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tconst deniedEvents = recordEvents(\n\t\t\temitToolResult(deniedResult, toolCall, true, {\n\t\t\t\ttoolExecutionId: toolExecutionBridgePlan?.metadata.toolExecutionId,\n\t\t\t\tapprovalRequestId:\n\t\t\t\t\ttoolExecutionBridgePlan?.metadata.approvalRequestId ??\n\t\t\t\t\tapprovalRequestId,\n\t\t\t}),\n\t\t);\n\t\tfor (const event of deniedEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\t// 7. Argument validation\n\tlet validatedArgs: Record<string, unknown>;\n\ttry {\n\t\tconst rawArgs = validateToolArguments(toolDef, effectiveToolCall);\n\t\tconst vaultedArgs = safetyMiddleware.prepareExecutionArgs(rawArgs);\n\t\tvalidatedArgs = safetyMiddleware.resolveCredentials(vaultedArgs);\n\t} catch (error: unknown) {\n\t\tconst validationErrorResult: ToolResultMessage = {\n\t\t\trole: \"toolResult\",\n\t\t\ttoolCallId: toolCall.id,\n\t\t\ttoolName: toolCall.name,\n\t\t\tcontent: [\n\t\t\t\t{\n\t\t\t\t\ttype: \"text\",\n\t\t\t\t\ttext: error instanceof Error ? error.message : String(error),\n\t\t\t\t},\n\t\t\t],\n\t\t\tisError: true,\n\t\t\ttimestamp: clock.now(),\n\t\t};\n\t\tconst validationEvents = recordEvents(\n\t\t\temitToolResult(validationErrorResult, toolCall, true),\n\t\t);\n\t\tfor (const event of validationEvents) {\n\t\t\tyield event;\n\t\t}\n\t\treturn {\n\t\t\tverdict: { outcome: \"blocked\", events },\n\t\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t\t};\n\t}\n\n\tconst sanitizedExecutionArgs =\n\t\tsafetyMiddleware.sanitizeForLogging(validatedArgs);\n\n\treturn {\n\t\tverdict: {\n\t\t\toutcome: \"proceed\",\n\t\t\teffectiveToolCall,\n\t\t\tvalidatedArgs,\n\t\t\ttoolDef,\n\t\t\tevents,\n\t\t\tsanitizedExecutionArgs,\n\t\t\t...(approvalRequestId ? { approvalRequestId } : {}),\n\t\t\t...(toolExecutionBridgePlan ? { toolExecutionBridgePlan } : {}),\n\t\t},\n\t\trateLimitUpdate: rateLimitResult.updatedState,\n\t};\n}\n"]}

package/dist/agent/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/agent/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,mBAAmB,CAAC;AAGhF,OAAO,EAAE,KAAK,KAAK,EAAe,MAAM,mBAAmB,CAAC;AAI5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwB3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2BzE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAYxF,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAGpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EACX,UAAU,EACV,cAAc,EAEd,eAAe,EACf,cAAc,EAGd,OAAO,EAMP,MAAM,YAAY,CAAC;AAGpB,YAAY,EACX,mBAAmB,EACnB,eAAe,GACf,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,0BAA0B;IAC1C,gBAAgB,EAAE,CACjB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC;QAAE,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,wBAAwB;IACxC,SAAS,CAAC,EAAE,CACX,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;IACtD,cAAc,CAAC,EAAE,CAChB,QAAQ,EAAE,MAAM,KACZ,cAAc,GAAG,SAAS,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,uDAAuD;IACvD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,sDAAsD;IACtD,2BAA2B,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;CAClE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IA6C3C,OAAO,CAAC,OAAO;IA5C3B,sEAAsE;IACtE,OAAO,CAAC,aAAa,CAA8B;IACnD,qEAAqE;IACrE,OAAO,CAAC,8BAA8B,CAAS;IAC/C,8DAA8D;IAC9D,OAAO,CAAC,oBAAoB,CAA+B;IAC3D,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IACzD,uEAAuE;IACvE,OAAO,CAAC,mBAAmB,CAAK;IAChC,oCAAoC;IACpC,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAsB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAkB;IAC/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAGhC;IACJ,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAGvC;IACJ,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAA6B;IAC7E,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CACpC;IACd,OAAO,CAAC,0BAA0B,CAAC,CAAS;IAC5C,OAAO,CAAC,6BAA6B,CAAC,CAAS;IAE/C;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAErD;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAK;gBAExB,OAAO,GAAE,wBAA6B;IAqC1D,OAAO,CAAC,8BAA8B;IAmCtC;;;;;;;;;;;;;OAaG;IACI,QAAQ,CACd,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,cAAc,EACtB,MAAM,CAAC,EAAE,WAAW,GAClB,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;IAgBrC,GAAG,CACT,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,OAAO,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,CAAC,EAAE,WAAW,GAClB,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;CAovE5C"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/agent/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,OAAO,EAAE,KAAK,eAAe,EAAyB,MAAM,mBAAmB,CAAC;AAGhF,OAAO,EAAE,KAAK,KAAK,EAAe,MAAM,mBAAmB,CAAC;AAI5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAwB3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAElE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AA2BzE,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAaxF,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,eAAe,EAGpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EACX,UAAU,EACV,cAAc,EAEd,eAAe,EACf,cAAc,EAGd,OAAO,EAMP,MAAM,YAAY,CAAC;AAGpB,YAAY,EACX,mBAAmB,EACnB,eAAe,GACf,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,0BAA0B;IAC1C,gBAAgB,EAAE,CACjB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC;QAAE,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxE;AAED,MAAM,WAAW,wBAAwB;IACxC,SAAS,CAAC,EAAE,CACX,QAAQ,EAAE,MAAM,KACZ,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;IACtD,cAAc,CAAC,EAAE,CAChB,QAAQ,EAAE,MAAM,KACZ,cAAc,GAAG,SAAS,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,0BAA0B,CAAC;IAC/C,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,uDAAuD;IACvD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,sDAAsD;IACtD,2BAA2B,CAAC,EAAE,2BAA2B,GAAG,KAAK,CAAC;CAClE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IA6C3C,OAAO,CAAC,OAAO;IA5C3B,sEAAsE;IACtE,OAAO,CAAC,aAAa,CAA8B;IACnD,qEAAqE;IACrE,OAAO,CAAC,8BAA8B,CAAS;IAC/C,8DAA8D;IAC9D,OAAO,CAAC,oBAAoB,CAA+B;IAC3D,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;IACrD,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAsB;IACzD,uEAAuE;IACvE,OAAO,CAAC,mBAAmB,CAAK;IAChC,oCAAoC;IACpC,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAsB;IAC3D,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAkB;IAC/C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAGhC;IACJ,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAGvC;IACJ,OAAO,CAAC,QAAQ,CAAC,mCAAmC,CAAqB;IACzE,OAAO,CAAC,QAAQ,CAAC,+BAA+B,CAA6B;IAC7E,OAAO,CAAC,QAAQ,CAAC,iCAAiC,CACpC;IACd,OAAO,CAAC,0BAA0B,CAAC,CAAS;IAC5C,OAAO,CAAC,6BAA6B,CAAC,CAAS;IAE/C;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAErD;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAK;gBAExB,OAAO,GAAE,wBAA6B;IAqC1D,OAAO,CAAC,8BAA8B;IAmCtC;;;;;;;;;;;;;OAaG;IACI,QAAQ,CACd,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,cAAc,EACtB,MAAM,CAAC,EAAE,WAAW,GAClB,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;IAgBrC,GAAG,CACT,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,OAAO,EACpB,GAAG,EAAE,cAAc,EACnB,MAAM,CAAC,EAAE,WAAW,GAClB,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC;CAqmE5C"}

package/dist/agent/transport.js

@@ -65,6 +65,7 @@ import { createProviderStream } from "./transport/create-provider-stream.js";
 import { AgentEventQueue, getGovernedToolResultEventMetadata, getSkillToolResultEventMetadata, isDynamicToolApprovalEvent, } from "./transport/events.js";
 import { clearReusableToolResultState, clearRunScopedReusableToolResultState, cloneToolOutcomeForCall, computeReusableToolResultSnapshot, createToolMetadataCache, decrementPendingReusableToolSafetyCheck, getReusableToolRegistrySignature, getReusableToolResultCacheKey, hasPendingMutatingToolExecution, hasReusableToolResultState, incrementPendingReusableToolSafetyCheck, invalidateReusableToolResultsAfterMutation, recordReusableToolExecutionBridgeOutput, resolvePlatformToolExecutionBridge, trackReusableToolResult, } from "./transport/reusable-tool-results.js";
 import { createToolExecutionPromise } from "./transport/tool-execution.js";
+import { buildToolPhaseSummaryEvent } from "./transport/tool-phase-summary.js";
 import { evaluateToolSafety, } from "./transport/tool-safety-pipeline.js";
 import { createToolUpdateQueue, waitForNextExecutionOrUpdate, } from "./transport/tool-update-queue.js";
 import { calculateCost, resolveEnvCredential, } from "./transport/transport-utils.js";
@@ -512,6 +513,7 @@ export class ProviderTransport {
                     clientToolService: this.options.clientToolService,
                     toolExecutionBridge: platformToolExecutionBridge,
                     toolExecutionBridgePlan: safetyVerdict.toolExecutionBridgePlan,
+                    approvalRequestId: safetyVerdict.approvalRequestId,
                     toolUpdateQueue,
                 });
                 const trackedExecutionPromise = canReuseToolResult && reusableToolResultKey
@@ -939,105 +941,7 @@ export class ProviderTransport {
                 const isMcpParallelOptIn = (toolDef) => toolDef.source?.type === "mcp" &&
                     toolDef.source.supportsParallelToolCalls === true &&
                     toolDef.annotations?.destructiveHint !== true;
-                const buildToolPhaseSummary = () => {
-                    const rawDecisions = [...toolSchedulingDecisions.values()].sort((left, right) => left.emittedIndex - right.emittedIndex);
-                    if (rawDecisions.length === 0) {
-                        return undefined;
-                    }
-                    const waveCounts = new Map();
-                    for (const decision of rawDecisions) {
-                        if (decision.waveIndex !== undefined) {
-                            waveCounts.set(decision.waveIndex, (waveCounts.get(decision.waveIndex) ?? 0) + 1);
-                        }
-                    }
-                    const decisions = rawDecisions.map((decision) => {
-                        const isSingleModelToolCall = rawDecisions.length === 1;
-                        const waveSize = decision.waveIndex !== undefined
-                            ? (waveCounts.get(decision.waveIndex) ?? 1)
-                            : 1;
-                        const outcome = decision.cacheHit === true
-                            ? "cached"
-                            : decision.decision === "skipped"
-                                ? "skipped"
-                                : decision.decision === "delayed" ||
-                                    decision.blockedByMutation === true
-                                    ? "delayed"
-                                    : decision.decision === "parallelized" ||
-                                        (waveSize > 1 && decision.decision === "scheduled")
-                                        ? "parallelized"
-                                        : "serialized";
-                        const reason = outcome === "cached"
-                            ? "cache_hit"
-                            : decision.blockedByMutation === true
-                                ? decision.reason
-                                : decision.reason === "workflow_state_serialized"
-                                    ? "workflow_state_serialized"
-                                    : decision.mcpOptIn === true
-                                        ? "mcp_parallel_opt_in"
-                                        : decision.reason.startsWith("read_only")
-                                            ? outcome === "parallelized"
-                                                ? "read_only_parallel_safe"
-                                                : isSingleModelToolCall
-                                                    ? "single_read_only_call"
-                                                    : decision.reason
-                                            : decision.reason.startsWith("path_scoped_mutation")
-                                                ? "path_scoped_mutation"
-                                                : decision.reason;
-                        return {
-                            toolCallId: decision.callId,
-                            toolName: decision.toolName,
-                            emittedIndex: decision.emittedIndex,
-                            outcome,
-                            decision: outcome,
-                            reason,
-                            waveIndex: decision.waveIndex !== undefined
-                                ? Math.max(0, decision.waveIndex - 1)
-                                : undefined,
-                            waitMs: Math.max(0, Math.round(decision.schedulerWaitMs ?? 0)),
-                            schedulerWaitMs: Math.max(0, Math.round(decision.schedulerWaitMs ?? 0)),
-                            mcpOptIn: decision.mcpOptIn,
-                            cacheHit: decision.cacheHit,
-                            blockedByMutation: decision.blockedByMutation,
-                        };
-                    });
-                    const parallelizedCallCount = decisions.filter((decision) => decision.outcome === "parallelized").length;
-                    const delayedCallCount = decisions.filter((decision) => decision.outcome === "delayed").length;
-                    const batchShapingFeedback = decisions.length === 1 &&
-                        decisions[0]?.reason === "single_read_only_call"
-                        ? {
-                            avoidableSingleton: true,
-                            reason: "single_read_only_call",
-                            hint: "When you need several independent reads or searches, emit them together in one assistant message so Maestro can batch them safely.",
-                        }
-                        : undefined;
-                    const serializationReasons = Object.fromEntries([...decisions]
-                        .filter((decision) => decision.outcome === "serialized" ||
-                        decision.outcome === "delayed")
-                        .reduce((counts, decision) => {
-                        counts.set(decision.reason, (counts.get(decision.reason) ?? 0) + 1);
-                        return counts;
-                    }, new Map()));
-                    return {
-                        type: "tool_phase_summary",
-                        modelToolCallCount: rawDecisions.length,
-                        modelEmittedToolCallCount: rawDecisions.length,
-                        schedulableWaveCount: waveCounts.size,
-                        parallelizedCallCount,
-                        actuallyParallelizedCallCount: parallelizedCallCount,
-                        serializedCallCount: decisions.filter((decision) => decision.outcome === "serialized" ||
-                            decision.outcome === "delayed").length,
-                        delayedCallCount,
-                        blockedByMutationCount: decisions.filter((decision) => decision.blockedByMutation === true).length,
-                        mcpOptInCallCount: decisions.filter((decision) => decision.mcpOptIn === true).length,
-                        mcpOptInUseCount: decisions.filter((decision) => decision.mcpOptIn === true).length,
-                        cacheHitCount: decisions.filter((decision) => decision.cacheHit === true).length,
-                        totalToolWaitMs: decisions.reduce((total, decision) => total + decision.waitMs, 0),
-                        toolWaitTimeMs: decisions.reduce((total, decision) => total + decision.waitMs, 0),
-                        serializationReasons,
-                        decisions,
-                        batchShapingFeedback,
-                    };
-                };
+                const buildToolPhaseSummary = () => buildToolPhaseSummaryEvent(toolSchedulingDecisions.values());
                 const getMutationScope = (toolCall, toolDef = toolMetadataCache.get(toolCall.name)) => getPathScopedMutation(toolCall, toolDef, mutationPathBase);
                 const sameMutationScope = (left, right) => {
                     if (!left || !right) {
@@ -1788,6 +1692,7 @@ export class ProviderTransport {
                         clientToolService: this.options.clientToolService,
                         toolExecutionBridge: platformToolExecutionBridge,
                         toolExecutionBridgePlan: safetyVerdict.toolExecutionBridgePlan,
+                        approvalRequestId: safetyVerdict.approvalRequestId,
                         toolUpdateQueue,
                         clientToolExecPromise,
                     });