@graphorin/agent 0.5.0

package/dist/tooling/dataflow.js

@@ -0,0 +1,99 @@
+import { containsPii } from "@graphorin/security/guardrails";
+import { createDataFlowPolicy, createTaintLedger, deriveTaintLabel } from "@graphorin/security/dataflow";
+
+//#region src/tooling/dataflow.ts
+/**
+* Adapter: build the executor's {@link DataFlowGuard} from a
+* {@link DataFlowPolicyConfig} (WI-12 / P1-3).
+*
+* Bridges `@graphorin/security`'s pure taint engine (policy + per-run
+* ledger + provenance derivation) to the `@graphorin/tools` executor hook.
+* The executor calls {@link DataFlowGuard.inspect} as a sink gate and
+* {@link DataFlowGuard.record} after every successful output; this adapter
+* routes each call to the right run's {@link TaintLedger} and maps the
+* security {@link DataFlowDecision} onto the executor's
+* {@link DataFlowVerdict} (so the executor takes no security dependency).
+*
+* Because the agent builds one executor that serves the whole run (and the
+* code-mode quiet executor too), the guard keeps a per-run ledger map.
+* Taint state is in-memory and run-scoped; like `tool_search` promotion it
+* is **not** persisted across a suspend/resume. The map is bounded by
+* insertion-order eviction so a long-lived agent never leaks ledgers.
+*
+* @packageDocumentation
+*/
+/** Max concurrent run ledgers retained before evicting the oldest. */
+const MAX_TRACKED_RUNS = 128;
+/** Serialize tool-call args to text for the verbatim-carry probe. */
+function stringifyArgs(value) {
+	if (typeof value === "string") return value;
+	try {
+		return JSON.stringify(value) ?? "";
+	} catch {
+		return "";
+	}
+}
+function buildDataFlowGuard(config) {
+	const policy = createDataFlowPolicy(config);
+	const ledgerOpts = {
+		...config.minSpanLength !== void 0 ? { minSpanLength: config.minSpanLength } : {},
+		...config.treatPiiAsSensitive === true ? { piiSensitivity: containsPii } : {}
+	};
+	const ledgers = /* @__PURE__ */ new Map();
+	function ledgerFor(runId) {
+		const existing = ledgers.get(runId);
+		if (existing !== void 0) return existing;
+		const ledger = createTaintLedger(ledgerOpts);
+		ledgers.set(runId, ledger);
+		while (ledgers.size > MAX_TRACKED_RUNS) {
+			const oldest = ledgers.keys().next().value;
+			if (oldest === void 0) break;
+			ledgers.delete(oldest);
+		}
+		return ledger;
+	}
+	return {
+		inspect(input) {
+			const ledger = ledgerFor(input.runContext.runId);
+			const probe = ledger.inspectArgs(stringifyArgs(input.args));
+			const decision = policy.evaluate({
+				toolName: input.toolName,
+				sideEffectClass: input.sideEffectClass,
+				carriesUntrustedVerbatim: probe.carriesUntrustedVerbatim,
+				untrustedSeen: ledger.untrustedSeen,
+				sensitiveSeen: ledger.sensitiveSeen,
+				sourceKinds: probe.matchedSourceKinds.length > 0 ? probe.matchedSourceKinds : ledger.untrustedSourceKinds
+			});
+			if (decision.action === "allow") return { action: "allow" };
+			return {
+				action: decision.action,
+				flow: decision.flow,
+				reason: decision.reason,
+				sourceKinds: decision.sourceKinds
+			};
+		},
+		record(input) {
+			const ledger = ledgerFor(input.runContext.runId);
+			const label = deriveTaintLabel({
+				trustClass: input.trustClass,
+				...input.source !== void 0 ? { source: input.source } : {},
+				...input.sensitivity !== void 0 ? { sensitivity: input.sensitivity } : {},
+				...config.sensitiveTiers !== void 0 ? { sensitiveTiers: config.sensitiveTiers } : {}
+			});
+			ledger.recordOutput(label, input.outputText);
+		},
+		snapshotLedger(runId) {
+			return ledgers.get(runId)?.snapshot();
+		},
+		seedLedger(runId, summary) {
+			ledgers.set(runId, createTaintLedger({
+				...ledgerOpts,
+				initial: summary
+			}));
+		}
+	};
+}
+
+//#endregion
+export { buildDataFlowGuard };
+//# sourceMappingURL=dataflow.js.map

package/dist/tooling/dataflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataflow.js","names":[],"sources":["../../src/tooling/dataflow.ts"],"sourcesContent":["/**\n * Adapter: build the executor's {@link DataFlowGuard} from a\n * {@link DataFlowPolicyConfig} (WI-12 / P1-3).\n *\n * Bridges `@graphorin/security`'s pure taint engine (policy + per-run\n * ledger + provenance derivation) to the `@graphorin/tools` executor hook.\n * The executor calls {@link DataFlowGuard.inspect} as a sink gate and\n * {@link DataFlowGuard.record} after every successful output; this adapter\n * routes each call to the right run's {@link TaintLedger} and maps the\n * security {@link DataFlowDecision} onto the executor's\n * {@link DataFlowVerdict} (so the executor takes no security dependency).\n *\n * Because the agent builds one executor that serves the whole run (and the\n * code-mode quiet executor too), the guard keeps a per-run ledger map.\n * Taint state is in-memory and run-scoped; like `tool_search` promotion it\n * is **not** persisted across a suspend/resume. The map is bounded by\n * insertion-order eviction so a long-lived agent never leaks ledgers.\n *\n * @packageDocumentation\n */\n\nimport {\n  createDataFlowPolicy,\n  createTaintLedger,\n  type DataFlowPolicyConfig,\n  deriveTaintLabel,\n  type TaintLedger,\n  type TaintLedgerSnapshot,\n} from '@graphorin/security/dataflow';\nimport { containsPii } from '@graphorin/security/guardrails';\nimport type {\n  DataFlowGuard,\n  DataFlowInspectInput,\n  DataFlowRecordInput,\n  DataFlowVerdict,\n} from '@graphorin/tools/executor';\n\n/** Max concurrent run ledgers retained before evicting the oldest. */\nconst MAX_TRACKED_RUNS = 128;\n\n/** Serialize tool-call args to text for the verbatim-carry probe. */\nfunction stringifyArgs(value: unknown): string {\n  if (typeof value === 'string') return value;\n  try {\n    return JSON.stringify(value) ?? '';\n  } catch {\n    return '';\n  }\n}\n\n/**\n * Build a {@link DataFlowGuard} backed by `@graphorin/security`'s taint\n * engine. Returns a guard whose `inspect`/`record` operate on a per-run\n * ledger keyed by `runContext.runId`.\n *\n * @internal\n */\n/**\n * The executor's {@link DataFlowGuard} plus AG-19 ledger-persistence hooks the\n * agent uses to carry the coarse taint summary across a suspend/resume.\n */\nexport interface DataFlowGuardWithLedgers extends DataFlowGuard {\n  /** Read a run's coarse taint summary to persist on suspend (or `undefined`). */\n  snapshotLedger(runId: string): TaintLedgerSnapshot | undefined;\n  /** Pre-seed a run's ledger from a persisted summary on resume. */\n  seedLedger(runId: string, summary: TaintLedgerSnapshot): void;\n}\n\nexport function buildDataFlowGuard(config: DataFlowPolicyConfig): DataFlowGuardWithLedgers {\n  const policy = createDataFlowPolicy(config);\n  // FIDES-lattice (SDF-8): when treatPiiAsSensitive is on, feed the PII catalogue\n  // into the ledger so PII reads arm the trifecta `sensitive` leg. Default off.\n  const ledgerOpts = {\n    ...(config.minSpanLength !== undefined ? { minSpanLength: config.minSpanLength } : {}),\n    ...(config.treatPiiAsSensitive === true ? { piiSensitivity: containsPii } : {}),\n  };\n  const ledgers = new Map<string, TaintLedger>();\n\n  function ledgerFor(runId: string): TaintLedger {\n    const existing = ledgers.get(runId);\n    if (existing !== undefined) return existing;\n    const ledger = createTaintLedger(ledgerOpts);\n    ledgers.set(runId, ledger);\n    while (ledgers.size > MAX_TRACKED_RUNS) {\n      const oldest = ledgers.keys().next().value;\n      if (oldest === undefined) break;\n      ledgers.delete(oldest);\n    }\n    return ledger;\n  }\n\n  return {\n    inspect(input: DataFlowInspectInput): DataFlowVerdict {\n      const ledger = ledgerFor(input.runContext.runId);\n      const probe = ledger.inspectArgs(stringifyArgs(input.args));\n      const decision = policy.evaluate({\n        toolName: input.toolName,\n        sideEffectClass: input.sideEffectClass,\n        carriesUntrustedVerbatim: probe.carriesUntrustedVerbatim,\n        untrustedSeen: ledger.untrustedSeen,\n        sensitiveSeen: ledger.sensitiveSeen,\n        sourceKinds:\n          probe.matchedSourceKinds.length > 0\n            ? probe.matchedSourceKinds\n            : ledger.untrustedSourceKinds,\n      });\n      if (decision.action === 'allow') return { action: 'allow' };\n      return {\n        action: decision.action,\n        flow: decision.flow,\n        reason: decision.reason,\n        sourceKinds: decision.sourceKinds,\n      };\n    },\n\n    record(input: DataFlowRecordInput): void {\n      const ledger = ledgerFor(input.runContext.runId);\n      const label = deriveTaintLabel({\n        trustClass: input.trustClass,\n        ...(input.source !== undefined ? { source: input.source } : {}),\n        ...(input.sensitivity !== undefined ? { sensitivity: input.sensitivity } : {}),\n        // SDF-8: widen the trifecta `sensitive` leg to the operator's\n        // configured tiers (default secret-only ⇒ byte-identical).\n        ...(config.sensitiveTiers !== undefined ? { sensitiveTiers: config.sensitiveTiers } : {}),\n      });\n      ledger.recordOutput(label, input.outputText);\n    },\n\n    // AG-19: snapshot/rehydrate the run's coarse taint summary across a\n    // suspend/resume so the sink gate is not silently un-gated on the HITL\n    // boundary. Only the load-bearing flags cross the boundary — never spans.\n    snapshotLedger(runId: string): TaintLedgerSnapshot | undefined {\n      return ledgers.get(runId)?.snapshot();\n    },\n    seedLedger(runId: string, summary: TaintLedgerSnapshot): void {\n      ledgers.set(runId, createTaintLedger({ ...ledgerOpts, initial: summary }));\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,MAAM,mBAAmB;;AAGzB,SAAS,cAAc,OAAwB;AAC7C,KAAI,OAAO,UAAU,SAAU,QAAO;AACtC,KAAI;AACF,SAAO,KAAK,UAAU,MAAM,IAAI;SAC1B;AACN,SAAO;;;AAsBX,SAAgB,mBAAmB,QAAwD;CACzF,MAAM,SAAS,qBAAqB,OAAO;CAG3C,MAAM,aAAa;EACjB,GAAI,OAAO,kBAAkB,SAAY,EAAE,eAAe,OAAO,eAAe,GAAG,EAAE;EACrF,GAAI,OAAO,wBAAwB,OAAO,EAAE,gBAAgB,aAAa,GAAG,EAAE;EAC/E;CACD,MAAM,0BAAU,IAAI,KAA0B;CAE9C,SAAS,UAAU,OAA4B;EAC7C,MAAM,WAAW,QAAQ,IAAI,MAAM;AACnC,MAAI,aAAa,OAAW,QAAO;EACnC,MAAM,SAAS,kBAAkB,WAAW;AAC5C,UAAQ,IAAI,OAAO,OAAO;AAC1B,SAAO,QAAQ,OAAO,kBAAkB;GACtC,MAAM,SAAS,QAAQ,MAAM,CAAC,MAAM,CAAC;AACrC,OAAI,WAAW,OAAW;AAC1B,WAAQ,OAAO,OAAO;;AAExB,SAAO;;AAGT,QAAO;EACL,QAAQ,OAA8C;GACpD,MAAM,SAAS,UAAU,MAAM,WAAW,MAAM;GAChD,MAAM,QAAQ,OAAO,YAAY,cAAc,MAAM,KAAK,CAAC;GAC3D,MAAM,WAAW,OAAO,SAAS;IAC/B,UAAU,MAAM;IAChB,iBAAiB,MAAM;IACvB,0BAA0B,MAAM;IAChC,eAAe,OAAO;IACtB,eAAe,OAAO;IACtB,aACE,MAAM,mBAAmB,SAAS,IAC9B,MAAM,qBACN,OAAO;IACd,CAAC;AACF,OAAI,SAAS,WAAW,QAAS,QAAO,EAAE,QAAQ,SAAS;AAC3D,UAAO;IACL,QAAQ,SAAS;IACjB,MAAM,SAAS;IACf,QAAQ,SAAS;IACjB,aAAa,SAAS;IACvB;;EAGH,OAAO,OAAkC;GACvC,MAAM,SAAS,UAAU,MAAM,WAAW,MAAM;GAChD,MAAM,QAAQ,iBAAiB;IAC7B,YAAY,MAAM;IAClB,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,QAAQ,GAAG,EAAE;IAC9D,GAAI,MAAM,gBAAgB,SAAY,EAAE,aAAa,MAAM,aAAa,GAAG,EAAE;IAG7E,GAAI,OAAO,mBAAmB,SAAY,EAAE,gBAAgB,OAAO,gBAAgB,GAAG,EAAE;IACzF,CAAC;AACF,UAAO,aAAa,OAAO,MAAM,WAAW;;EAM9C,eAAe,OAAgD;AAC7D,UAAO,QAAQ,IAAI,MAAM,EAAE,UAAU;;EAEvC,WAAW,OAAe,SAAoC;AAC5D,WAAQ,IAAI,OAAO,kBAAkB;IAAE,GAAG;IAAY,SAAS;IAAS,CAAC,CAAC;;EAE7E"}

package/dist/tooling/registry-build.js

@@ -0,0 +1,85 @@
+import { stampSkillTool } from "@graphorin/skills";
+import { createToolRegistry } from "@graphorin/tools/registry";
+
+//#region src/tooling/registry-build.ts
+/** The source attributed to an unstamped first-party `config.tools` entry. */
+const FIRST_PARTY_SOURCE = Object.freeze({ kind: "first-party" });
+/** The five `ToolSource.kind` discriminants (used to validate a stamp). */
+const TOOL_SOURCE_KINDS = new Set([
+	"first-party",
+	"built-in",
+	"skill",
+	"mcp",
+	"web-search"
+]);
+/**
+* Build and collision-resolve a {@link ToolRegistry} from the supplied
+* tool sources.
+*
+* Registration order (which seeds the `'registration-order'` tie-break)
+* is: every `tools` entry, then every inline tool of every skill.
+* Throws whatever `register(...)` throws for a malformed tool
+* (`InvalidExampleError`, `InvalidPreferredModelError`,
+* `InvalidSideEffectClassError`) — the registry is the validation
+* authority, so a bad tool fails fast at build time.
+*
+* @stable
+*/
+function buildToolRegistry(options = {}) {
+	const registry = createToolRegistry({
+		...options.emitAudit !== void 0 ? { emitAudit: options.emitAudit } : {},
+		...options.embedder !== void 0 ? { embedder: options.embedder } : {},
+		...options.semanticScoreThreshold !== void 0 ? { semanticScoreThreshold: options.semanticScoreThreshold } : {}
+	});
+	let registered = 0;
+	for (const tool of options.tools ?? []) {
+		registry.register(tool, inferToolSource(tool));
+		registered += 1;
+	}
+	let skippedSkillEntries = 0;
+	for (const entry of options.skills?.list?.() ?? []) {
+		if (!isSkillLike(entry)) {
+			skippedSkillEntries += 1;
+			continue;
+		}
+		for (const tool of entry.tools()) {
+			const stamped = stampSkillTool(tool, entry);
+			registry.register(stamped.tool, stamped.source);
+			registered += 1;
+		}
+	}
+	const resolutions = registry.assertNoDuplicates(options.collisionStrategy ?? "auto-prefix", options.collisionContext ?? { source: FIRST_PARTY_SOURCE });
+	return Object.freeze({
+		registry,
+		resolutions,
+		registered,
+		skippedSkillEntries
+	});
+}
+/**
+* Derive the {@link ToolSource} for a `config.tools` entry. Honours an
+* explicit, well-formed `__source` stamp when present (so re-registered
+* `ResolvedTool`s and a future `mcp` config hook keep their provenance);
+* otherwise the tool is first-party. See the module doc on why MCP tools
+* are *not* auto-detected here.
+*/
+function inferToolSource(tool) {
+	const stamped = tool.__source;
+	return isToolSource(stamped) ? stamped : FIRST_PARTY_SOURCE;
+}
+/** Structural guard: a well-formed {@link ToolSource} discriminated union. */
+function isToolSource(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const kind = value.kind;
+	return typeof kind === "string" && TOOL_SOURCE_KINDS.has(kind);
+}
+/** Structural guard for the {@link SkillLike} surface. */
+function isSkillLike(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const metadata = value.metadata;
+	return typeof metadata === "object" && metadata !== null && typeof metadata.name === "string" && typeof metadata.graphorinTrustLevel === "string" && typeof value.tools === "function";
+}
+
+//#endregion
+export { buildToolRegistry };
+//# sourceMappingURL=registry-build.js.map

package/dist/tooling/registry-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-build.js","names":["FIRST_PARTY_SOURCE: ToolSource","TOOL_SOURCE_KINDS: ReadonlySet<string>"],"sources":["../../src/tooling/registry-build.ts"],"sourcesContent":["/**\n * Assemble a single `@graphorin/tools` {@link ToolRegistry} from every\n * tool source the agent knows about (first-party `config.tools` + skill\n * tools), then resolve cross-source name collisions deterministically.\n *\n * This realises Principle #12 (one registry, one collision policy) and\n * gives `createToolRegistry(...)` its first production call-site\n * (`createAgent(...)` warm-up — see `factory.ts`). The run loop consumes\n * the resulting registry in a later work item (WI-03); `tool_search`\n * uses it in WI-05. This module only *builds* it.\n *\n * Two deliberate fidelity notes (verified against source, not the plan):\n *  - **MCP tools are not auto-stamped.** `adaptMCPTools(...)` returns\n *    plain `Tool`s; `__source`/`__trustClass` are only ever assigned by\n *    the registry's `normaliseTool(...)` at registration time, derived\n *    from the `source` passed to `register(...)`. So {@link inferToolSource}\n *    honours an explicit `__source` stamp if one is present (forward-\n *    compatible with a dedicated `mcp` config hook / re-registered\n *    `ResolvedTool`s) and otherwise treats the tool as first-party. The\n *    MCP tool's baked-in `sandboxPolicy` / `inboundSanitization` are\n *    preserved regardless (operator override > trust-class default).\n *  - **Skill tool-stamping lives here, not in `@graphorin/skills`.** The\n *    skills loader defers it (it does not depend on a tools registry);\n *    the agent — which depends on both — stamps each inline skill tool\n *    via `stampSkillTool(...)`.\n *\n * @packageDocumentation\n */\n\nimport type { Tool, ToolSource } from '@graphorin/core';\nimport type { SkillMetadata } from '@graphorin/skills';\nimport { stampSkillTool } from '@graphorin/skills';\nimport {\n  type CollisionContext,\n  type CollisionResolution,\n  type CollisionStrategy,\n  createToolRegistry,\n  type ToolAuditEvent,\n  type ToolRegistry,\n  type ToolSearchEmbedder,\n} from '@graphorin/tools/registry';\n\nimport type { SkillsRegistryLike } from '../types.js';\n\n/** The source attributed to an unstamped first-party `config.tools` entry. */\nconst FIRST_PARTY_SOURCE: ToolSource = Object.freeze({ kind: 'first-party' });\n\n/** The five `ToolSource.kind` discriminants (used to validate a stamp). */\nconst TOOL_SOURCE_KINDS: ReadonlySet<string> = new Set([\n  'first-party',\n  'built-in',\n  'skill',\n  'mcp',\n  'web-search',\n]);\n\n/** Options for {@link buildToolRegistry}. */\nexport interface BuildToolRegistryOptions {\n  /** First-party (and any pre-stamped) tools, i.e. `config.tools`. */\n  readonly tools?: ReadonlyArray<Tool<unknown, unknown, unknown>>;\n  /**\n   * The agent's skill registry (`config.skills`). Only entries that\n   * structurally match the {@link SkillLike} surface contribute tools;\n   * non-inline skill sources expose `tools(): []` and are a no-op here.\n   */\n  readonly skills?: SkillsRegistryLike;\n  /** Collision-resolution strategy. Default `'auto-prefix'`. */\n  readonly collisionStrategy?: CollisionStrategy;\n  /**\n   * Context tag carried on the collision audit rows + used for the\n   * `'priority'` tie-break boost. Default `{ source: first-party }`.\n   */\n  readonly collisionContext?: CollisionContext;\n  /** Audit sink forwarded to the registry (collision + classification rows). */\n  readonly emitAudit?: (event: ToolAuditEvent) => void;\n  /** Semantic-search embedder. Passed through; consumed by `tool_search` (WI-05). */\n  readonly embedder?: ToolSearchEmbedder;\n  /** Cosine threshold for the semantic search stage (WI-05). */\n  readonly semanticScoreThreshold?: number;\n}\n\n/** Outcome of {@link buildToolRegistry}. */\nexport interface BuildToolRegistryResult {\n  /** The assembled registry, post collision-resolution. */\n  readonly registry: ToolRegistry;\n  /** The collision resolutions (also emitted on the audit sink). */\n  readonly resolutions: ReadonlyArray<CollisionResolution>;\n  /** Count of tools registered across every source. */\n  readonly registered: number;\n  /** Count of `skills.list()` entries skipped for not matching the `Skill` surface. */\n  readonly skippedSkillEntries: number;\n}\n\n/**\n * Build and collision-resolve a {@link ToolRegistry} from the supplied\n * tool sources.\n *\n * Registration order (which seeds the `'registration-order'` tie-break)\n * is: every `tools` entry, then every inline tool of every skill.\n * Throws whatever `register(...)` throws for a malformed tool\n * (`InvalidExampleError`, `InvalidPreferredModelError`,\n * `InvalidSideEffectClassError`) — the registry is the validation\n * authority, so a bad tool fails fast at build time.\n *\n * @stable\n */\nexport function buildToolRegistry(options: BuildToolRegistryOptions = {}): BuildToolRegistryResult {\n  const registry = createToolRegistry({\n    ...(options.emitAudit !== undefined ? { emitAudit: options.emitAudit } : {}),\n    ...(options.embedder !== undefined ? { embedder: options.embedder } : {}),\n    ...(options.semanticScoreThreshold !== undefined\n      ? { semanticScoreThreshold: options.semanticScoreThreshold }\n      : {}),\n  });\n\n  let registered = 0;\n\n  // 1. First-party / pre-stamped tools (`config.tools`).\n  for (const tool of options.tools ?? []) {\n    registry.register(tool, inferToolSource(tool));\n    registered += 1;\n  }\n\n  // 2. Skill tools. The agent accepts a loose `SkillsRegistryLike`, so\n  //    each `list()` entry is narrowed structurally before stamping.\n  let skippedSkillEntries = 0;\n  for (const entry of options.skills?.list?.() ?? []) {\n    if (!isSkillLike(entry)) {\n      skippedSkillEntries += 1;\n      continue;\n    }\n    for (const tool of entry.tools()) {\n      const stamped = stampSkillTool(tool, entry);\n      registry.register(stamped.tool, stamped.source);\n      registered += 1;\n    }\n  }\n\n  // 3. Resolve collisions deterministically (first-party wins; losers\n  //    are namespaced). `assertNoDuplicates(strategy, ctx)` emits a\n  //    `tool:collision:*` audit row per resolution.\n  const resolutions = registry.assertNoDuplicates(\n    options.collisionStrategy ?? 'auto-prefix',\n    options.collisionContext ?? { source: FIRST_PARTY_SOURCE },\n  );\n\n  return Object.freeze({ registry, resolutions, registered, skippedSkillEntries });\n}\n\n/**\n * Derive the {@link ToolSource} for a `config.tools` entry. Honours an\n * explicit, well-formed `__source` stamp when present (so re-registered\n * `ResolvedTool`s and a future `mcp` config hook keep their provenance);\n * otherwise the tool is first-party. See the module doc on why MCP tools\n * are *not* auto-detected here.\n */\nfunction inferToolSource(tool: Tool<unknown, unknown, unknown>): ToolSource {\n  const stamped = (tool as { readonly __source?: unknown }).__source;\n  return isToolSource(stamped) ? stamped : FIRST_PARTY_SOURCE;\n}\n\n/** Structural guard: a well-formed {@link ToolSource} discriminated union. */\nfunction isToolSource(value: unknown): value is ToolSource {\n  if (typeof value !== 'object' || value === null) return false;\n  const kind = (value as { readonly kind?: unknown }).kind;\n  return typeof kind === 'string' && TOOL_SOURCE_KINDS.has(kind);\n}\n\n/**\n * Minimal structural view of a `@graphorin/skills` `Skill` — exactly the\n * members {@link buildToolRegistry} reads. The agent's `SkillsRegistryLike`\n * is intentionally loose (`list?(): unknown[]`), so entries are validated\n * at runtime before being treated as skills.\n */\ninterface SkillLike {\n  readonly metadata: SkillMetadata;\n  tools(): ReadonlyArray<Tool<unknown, unknown, unknown>>;\n}\n\n/** Structural guard for the {@link SkillLike} surface. */\nfunction isSkillLike(value: unknown): value is SkillLike {\n  if (typeof value !== 'object' || value === null) return false;\n  const metadata = (value as { readonly metadata?: unknown }).metadata;\n  const metadataOk =\n    typeof metadata === 'object' &&\n    metadata !== null &&\n    typeof (metadata as { readonly name?: unknown }).name === 'string' &&\n    typeof (metadata as { readonly graphorinTrustLevel?: unknown }).graphorinTrustLevel ===\n      'string';\n  return metadataOk && typeof (value as { readonly tools?: unknown }).tools === 'function';\n}\n"],"mappings":";;;;;AA6CA,MAAMA,qBAAiC,OAAO,OAAO,EAAE,MAAM,eAAe,CAAC;;AAG7E,MAAMC,oBAAyC,IAAI,IAAI;CACrD;CACA;CACA;CACA;CACA;CACD,CAAC;;;;;;;;;;;;;;AAoDF,SAAgB,kBAAkB,UAAoC,EAAE,EAA2B;CACjG,MAAM,WAAW,mBAAmB;EAClC,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,WAAW,GAAG,EAAE;EAC3E,GAAI,QAAQ,aAAa,SAAY,EAAE,UAAU,QAAQ,UAAU,GAAG,EAAE;EACxE,GAAI,QAAQ,2BAA2B,SACnC,EAAE,wBAAwB,QAAQ,wBAAwB,GAC1D,EAAE;EACP,CAAC;CAEF,IAAI,aAAa;AAGjB,MAAK,MAAM,QAAQ,QAAQ,SAAS,EAAE,EAAE;AACtC,WAAS,SAAS,MAAM,gBAAgB,KAAK,CAAC;AAC9C,gBAAc;;CAKhB,IAAI,sBAAsB;AAC1B,MAAK,MAAM,SAAS,QAAQ,QAAQ,QAAQ,IAAI,EAAE,EAAE;AAClD,MAAI,CAAC,YAAY,MAAM,EAAE;AACvB,0BAAuB;AACvB;;AAEF,OAAK,MAAM,QAAQ,MAAM,OAAO,EAAE;GAChC,MAAM,UAAU,eAAe,MAAM,MAAM;AAC3C,YAAS,SAAS,QAAQ,MAAM,QAAQ,OAAO;AAC/C,iBAAc;;;CAOlB,MAAM,cAAc,SAAS,mBAC3B,QAAQ,qBAAqB,eAC7B,QAAQ,oBAAoB,EAAE,QAAQ,oBAAoB,CAC3D;AAED,QAAO,OAAO,OAAO;EAAE;EAAU;EAAa;EAAY;EAAqB,CAAC;;;;;;;;;AAUlF,SAAS,gBAAgB,MAAmD;CAC1E,MAAM,UAAW,KAAyC;AAC1D,QAAO,aAAa,QAAQ,GAAG,UAAU;;;AAI3C,SAAS,aAAa,OAAqC;AACzD,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;CACxD,MAAM,OAAQ,MAAsC;AACpD,QAAO,OAAO,SAAS,YAAY,kBAAkB,IAAI,KAAK;;;AAehE,SAAS,YAAY,OAAoC;AACvD,KAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;CACxD,MAAM,WAAY,MAA0C;AAO5D,QALE,OAAO,aAAa,YACpB,aAAa,QACb,OAAQ,SAAyC,SAAS,YAC1D,OAAQ,SAAwD,wBAC9D,YACiB,OAAQ,MAAuC,UAAU"}

package/dist/types.d.ts

@@ -0,0 +1,413 @@
+import { AgentFallbackPolicy } from "./fallback/index.js";
+import { MergeGuardConfig } from "./lateral-leak/merge-guard.js";
+import { ChildResult, FanOutOptions, FanOutResult, MergeStrategy, PerChildBudget } from "./fanout/index.js";
+import { CausalityMonitorConfig } from "./lateral-leak/causality-monitor.js";
+import { ProgressIO, ProgressReadOptions, ProgressWriteOptions } from "./progress/index.js";
+import { AgentEvent, AgentResult, CheckpointStore, HandoffFilter, Message, ModelHint, ModelSpec, ProgressArtifactRef, Provider, ReasoningRetention, RunContext, RunState, Sensitivity, StopCondition, Tool, ToolChoice, Tracer } from "@graphorin/core";
+import { InputGuardrail, OutputGuardrail } from "@graphorin/security/guardrails";
+import { ResultReader } from "@graphorin/tools/result";
+import { DataFlowPolicyConfig } from "@graphorin/security/dataflow";
+import { ToolRegistry } from "@graphorin/tools/registry";
+import { Memory, PostCompactionHook } from "@graphorin/memory";
+
+//#region src/types.d.ts
+
+/**
+ * Forward-compatible type alias for the input accepted by
+ * `Agent.stream / run / steer / followUp`. v0.1 ships with the
+ * canonical text + multimodal Message shape; future versions may
+ * add structured inputs.
+ *
+ * @stable
+ */
+type AgentInput = string | Message | ReadonlyArray<Message>;
+/**
+ * Output type specification.
+ *
+ * @stable
+ */
+interface OutputSpec<TOutput> {
+  readonly kind: 'text' | 'structured';
+  /**
+   * Local validator (Zod-compatible `{ parse }`) applied to the final
+   * model output on the completed path (AG-3). A parse failure fails
+   * the run with `output-validation-failed` — never a silent cast.
+   */
+  readonly schema?: {
+    parse(value: unknown): TOutput;
+  };
+  /** Optional description shown to the model alongside the schema. */
+  readonly description?: string;
+  /**
+   * Wire-format JSON Schema advertised to the model: forwarded on
+   * `ProviderRequest.outputType` for adapters with native structured
+   * output, and embedded in the fallback JSON instruction appended as
+   * a trailing system message (the documented contract until adapters
+   * consume `outputType` natively — PS-24).
+   */
+  readonly jsonSchema?: Readonly<Record<string, unknown>>;
+}
+/**
+ * Per-step override hook. Receives the current `RunContext` and may
+ * return overrides applied to the next provider call only.
+ *
+ * @stable
+ */
+type PrepareStepHook<TDeps = unknown> = (ctx: RunContext<TDeps>) => Promise<PrepareStepOverrides<TDeps>> | PrepareStepOverrides<TDeps>;
+/** @stable */
+interface PrepareStepOverrides<TDeps = unknown> {
+  readonly provider?: Provider;
+  readonly tools?: ReadonlyArray<Tool<unknown, unknown, TDeps>>;
+  readonly toolChoice?: ToolChoice;
+  readonly temperature?: number;
+  readonly maxTokens?: number;
+}
+/**
+ * Compaction post-hook factory accepted by `createAgent({...})`.
+ * Re-exported from `@graphorin/memory` here for ergonomic typing.
+ *
+ * @stable
+ */
+type PostCompactionHook$1 = PostCompactionHook;
+/**
+ * Skill-registry shape consumed by the agent loop. Implementations
+ * live in `@graphorin/skills`. We accept any structurally-compatible
+ * value to avoid the heavyweight peer dependency on the typing
+ * surface.
+ *
+ * @stable
+ */
+interface SkillsRegistryLike {
+  list?(): ReadonlyArray<unknown>;
+}
+/**
+ * Handoff target entry accepted by `createAgent({ handoffs })`.
+ * Either a bare {@link Agent} reference (default filter applied) or
+ * an explicit `{ target, inputFilter? }` envelope.
+ *
+ * @stable
+ */
+type HandoffEntry<TDeps = unknown> = Agent<TDeps, any> | {
+  readonly target: Agent<TDeps, any>;
+  readonly inputFilter?: HandoffFilter;
+};
+/**
+ * The full options object accepted by {@link createAgent}.
+ *
+ * @stable
+ */
+interface AgentConfig<TDeps = unknown, TOutput = string> {
+  readonly name: string;
+  /**
+   * The agent's system prompt. A string is used verbatim; a function is
+   * resolved **once per run** (sync or async, awaited) against a
+   * {@link RunContext} snapshot at step 0, and its result is pinned as the
+   * run's system-prompt prefix for the whole run (it is not re-evaluated
+   * per step). An empty string injects no system message.
+   */
+  readonly instructions: string | ((ctx: RunContext<TDeps>) => string | Promise<string>);
+  readonly provider: Provider;
+  readonly tools?: ReadonlyArray<Tool<unknown, unknown, TDeps>>;
+  readonly skills?: SkillsRegistryLike;
+  readonly memory?: Memory;
+  /**
+   * Opt in to building the per-run system prompt from the memory
+   * {@link ContextEngine} (CE-1). When `true` **and** `memory` is wired, the
+   * runtime calls `memory.contextEngine.assemble(...)` once at run start: the
+   * agent's `instructions` become Layer 2 and the engine prepends the memory
+   * base and appends working blocks, procedural rules, skill cards, the
+   * metadata counts, and — when `factsAutoRecall` is configured — auto-recalled
+   * facts. Defaults `false`: the prompt is built from `instructions` alone and
+   * the model reaches memory only through the memory tools it calls (the
+   * documented explicit pattern). Has no effect without `memory`.
+   */
+  readonly autoAssembleContext?: boolean;
+  readonly handoffs?: ReadonlyArray<HandoffEntry<TDeps>>;
+  readonly outputType?: OutputSpec<TOutput>;
+  /**
+   * Deterministic checks run by the loop (AG-2; canonical contract is
+   * `@graphorin/security`'s `GuardrailDefinition` — SDF-4).
+   *
+   * - `input` guardrails run over each **fresh-run seed user message**
+   *   (string content) before the first provider call. `'block'` fails
+   *   the run (`guardrail-blocked`) without reaching the model;
+   *   `'rewrite'` replaces the message content (mirrored into the
+   *   persisted `RunState`); `'warn'` logs and continues.
+   * - `output` guardrails run over the **final output** on the
+   *   completed path before `agent.end`. `'block'` fails the run;
+   *   `'rewrite'` replaces `result.output` (text deltas were already
+   *   streamed — the rewrite governs the durable result, not the
+   *   live token stream).
+   *
+   * Every trip emits a `guardrail.tripped` event.
+   */
+  readonly guardrails?: {
+    readonly input?: ReadonlyArray<InputGuardrail<string>>;
+    readonly output?: ReadonlyArray<OutputGuardrail<TOutput>>;
+  };
+  readonly stopWhen?: StopCondition;
+  readonly toolChoice?: ToolChoice;
+  readonly prepareStep?: PrepareStepHook<TDeps>;
+  readonly maxParallelTools?: number;
+  /**
+   * How the model invokes tools (P1-2).
+   *
+   * - `'direct'` (default) — the model emits one provider tool-call per
+   *   tool, each result inlined into the conversation.
+   * - `'code-mode'` — the agent advertises only the `code_execute` /
+   *   `code_search` meta-tools; the model writes a script that calls
+   *   tools in a sandbox via `tools.<name>(args)`, and **only the
+   *   script's final result re-enters context** (intermediate results
+   *   stay inside the sandbox). Each in-script call still runs through
+   *   the executor, so per-tool ACL / sanitization / truncation apply.
+   *   Approval-gated tools are not reachable from code-mode (there is no
+   *   durable-HITL path mid-script); call those in `'direct'` mode.
+   *
+   * @default 'direct'
+   */
+  readonly toolInvocation?: 'direct' | 'code-mode';
+  readonly fallbackModels?: ReadonlyArray<ModelSpec>;
+  readonly fallbackPolicy?: AgentFallbackPolicy;
+  readonly preferredModel?: ModelHint | ModelSpec;
+  readonly modelTierMap?: Partial<Record<ModelHint, ModelSpec>>;
+  /**
+   * Per-agent override of the per-provider auto-detected
+   * {@link ReasoningRetention} default. Wins over the provider-
+   * level default when both are present. The agent runtime feeds
+   * the effective value into every `provider.stream(...)` call so
+   * the wire-correct contract is honoured per RB-42 / suggested
+   * DEC-158 / suggested ADR-046.
+   */
+  readonly reasoningRetention?: ReasoningRetention;
+  readonly causalityMonitor?: CausalityMonitorConfig;
+  /**
+   * Sideways-injection merge guard for `agent.fanOut` `'judge-merge'`
+   * (AG-7): scores per-child source trust × contribution weight against
+   * the judge's merged output; a biased merge emits
+   * `agent.lateral-leak.detected` and `'detect-and-block'` throws
+   * `MergeBlockedError`.
+   */
+  readonly mergeGuard?: MergeGuardConfig;
+  /**
+   * Provenance / taint-based data-flow policy (P1-3, opt-in). Enforces
+   * data-flow rules at the tool-execution boundary using the provenance
+   * Graphorin already tracks (trust class + source + sensitivity), to
+   * defuse the lethal trifecta: a sink (`side-effecting` /
+   * `external-stateful` tool) is blocked when untrusted content flows
+   * into it verbatim, or — conservatively — when it fires while both
+   * untrusted content and secret-tier data are present in the run.
+   *
+   * - `mode: 'shadow'`  — audit-only; tainted flows are flagged
+   *   (`tool:dataflow:flagged` audit + counter) but never blocked. Ship
+   *   this first to surface false positives.
+   * - `mode: 'enforce'` — tainted flows are blocked (the sink does not
+   *   run; the call yields a `dataflow_policy_blocked` error) unless the
+   *   sink is listed in `declassifySinks` (an audited operator override).
+   *
+   * Composes with `'code-mode'`: each in-script tool call flows through
+   * the same executor gate. Absent (the default) leaves the loop
+   * unchanged.
+   */
+  readonly dataFlowPolicy?: DataFlowPolicyConfig;
+  /**
+   * Additional result-handle readers (P1-4 / WI-13), tried after the
+   * built-in spill-file reader. Wire an MCP resource reader
+   * (`createMcpResourceReader` from `@graphorin/mcp/client`) here so the
+   * model can resolve an MCP `resource_link` on demand via the built-in
+   * `read_result` tool, instead of inlining the resource body. Supplying
+   * any reader force-registers `read_result` even when no tool spills.
+   */
+  readonly resultReaders?: ReadonlyArray<ResultReader>;
+  readonly tracer?: Tracer;
+  readonly checkpointStore?: CheckpointStore;
+  readonly sensitivity?: Sensitivity;
+  readonly sessionId?: string;
+  readonly userId?: string;
+  readonly deps?: TDeps;
+}
+/**
+ * Single approval decision attached to a {@link ResumeDirective}.
+ * Mirrors the directive surface the HITL caller supplies on resume
+ * (per `Command(approval: { granted, reason? })` in the agent-loop
+ * reference, renamed to `Directive` per Graphorin's own naming).
+ *
+ * @stable
+ */
+interface ApprovalDecision {
+  readonly toolCallId: string;
+  readonly granted: boolean;
+  readonly reason?: string;
+}
+/**
+ * Resume directive accepted by `agent.run(input | RunState, { directive })`.
+ *
+ * The library-mode pickup pattern is: the operator stores the
+ * suspended `RunState` from the previous `agent.run(...)` call,
+ * waits for the user / cron / webhook to resolve the pending
+ * approval, and re-invokes `agent.run(savedState, { directive: {
+ * approvals: [...] } })` to resume.
+ *
+ * @stable
+ */
+interface ResumeDirective {
+  readonly approvals?: ReadonlyArray<ApprovalDecision>;
+}
+/**
+ * Per-call options accepted by `agent.stream(...)` / `agent.run(...)`.
+ *
+ * @stable
+ */
+interface AgentCallOptions<TDeps> {
+  readonly deps?: TDeps;
+  readonly signal?: AbortSignal;
+  readonly sessionId?: string;
+  readonly userId?: string;
+  /**
+   * HITL resume directive. Supplied alongside a `RunState` to
+   * resolve any approvals that were pending when the previous
+   * `agent.run(...)` call suspended.
+   */
+  readonly directive?: ResumeDirective;
+}
+/**
+ * `agent.toTool({...})` options.
+ *
+ * @stable
+ */
+interface AgentToToolOptions {
+  readonly name?: string;
+  readonly description?: string;
+  readonly exposeTurns?: 'final' | 'all' | 'none';
+  /**
+   * Shapes the sub-agent seed from the parent history (AG-17): when
+   * supplied, the sub-agent is seeded with
+   * `[...inputFilter(parentMessages), { role: 'user', content: input }]`.
+   * Without a filter the sub-agent sees ONLY the input string — no
+   * parent conversation crosses the boundary (least authority by
+   * construction; there is no secret-inheritance mechanism at this
+   * boundary at all).
+   */
+  readonly inputFilter?: HandoffFilter;
+}
+/**
+ * Cancellation options accepted by `agent.abort({...})`.
+ *
+ * @stable
+ */
+interface AbortOptions {
+  /**
+   * When `true`, let the in-flight provider stream finish (the current step
+   * reaches its boundary) instead of interrupting it mid-event, then stop at the
+   * next step. Default `false` hard-kills the in-flight stream immediately. (The
+   * step's tool calls still observe the cancellation once the signal is set.)
+   */
+  readonly drain?: boolean;
+  /**
+   * What to do with approvals that were already requested but not
+   * resolved at abort time.
+   *
+   * - `'deny'` (default) — auto-deny pending approvals.
+   * - `'hold'`            — keep the approvals on `RunState.pendingApprovals`.
+   * - `'fail'`            — reject the run with `RunError(code: 'run-aborted')`.
+   */
+  readonly onPendingApprovals?: 'deny' | 'hold' | 'fail';
+}
+/**
+ * `agent.compact({...})` options.
+ *
+ * @stable
+ */
+interface CompactOptions {
+  readonly source?: 'manual' | 'pre-step';
+  readonly preserveRecentTurns?: number;
+}
+/**
+ * Result of `agent.compact({...})`.
+ *
+ * @stable
+ */
+interface CompactionApiResult {
+  readonly beforeTokens: number;
+  readonly afterTokens: number;
+  readonly summaryTokens: number;
+  readonly durationMs: number;
+  readonly hooksFiredCount: number;
+  readonly summary: string;
+  /**
+   * `true` when the compaction trimmed + spliced the live run buffer
+   * (CE-3/AG-13). `false` results carry an explicit
+   * {@link skippedReason} instead of silently reporting zeros.
+   */
+  readonly applied: boolean;
+  /** Why nothing was spliced, when {@link applied} is `false`. */
+  readonly skippedReason?: 'no-memory' | 'no-active-run' | 'nothing-to-trim' | 'sensitivity-gated';
+}
+/**
+ * Per-call shape accepted by `Agent.fanOut(...)`. Mirrors the
+ * pure-function {@link FanOutOptions} but omits the runtime-supplied
+ * identifiers — the `Agent` instance carries those.
+ *
+ * @stable
+ */
+interface AgentFanOutOptions<TOutput = unknown> {
+  readonly children: FanOutOptions<TOutput>['children'];
+  readonly maxConcurrentChildren?: number;
+  readonly perBudget?: PerChildBudget;
+  readonly mergeStrategy?: MergeStrategy<TOutput>;
+  readonly signal?: AbortSignal;
+}
+/**
+ * Progress IO surface exposed on the `Agent` instance. The methods
+ * default the `runId` cursor to the in-flight run when present, so
+ * callers can use them inside an `agent.run(...)` boundary without
+ * repeating the cursor.
+ *
+ * @stable
+ */
+interface AgentProgressIO {
+  write(content: string, options?: ProgressWriteOptions): Promise<ProgressArtifactRef>;
+  read(options?: ProgressReadOptions): Promise<ReadonlyArray<ProgressArtifactRef>>;
+}
+/**
+ * Public agent surface returned by {@link createAgent}.
+ *
+ * @stable
+ */
+interface Agent<TDeps = unknown, TOutput = string> {
+  readonly id: string;
+  readonly config: AgentConfig<TDeps, TOutput>;
+  stream(input: AgentInput | RunState, options?: AgentCallOptions<TDeps>): AsyncIterable<AgentEvent<TOutput>>;
+  run(input: AgentInput | RunState, options?: AgentCallOptions<TDeps>): Promise<AgentResult<TOutput>>;
+  steer(message: AgentInput): void;
+  followUp(message: AgentInput): void;
+  abort(options?: AbortOptions): void;
+  toTool(options?: AgentToToolOptions): Tool<{
+    readonly input: string;
+  }, TOutput, TDeps>;
+  compact(options?: CompactOptions): Promise<CompactionApiResult>;
+  /**
+   * Convenience wrapper around the standalone `runFanOut(...)`. The
+   * returned `FanOutResult` carries per-child status + the merged
+   * output. Per-child failures are captured in `children[].status`
+   * — this method never throws on a child failure (the merge
+   * strategy decides whether to propagate).
+   */
+  fanOut<TFanOutOutput = unknown>(options: AgentFanOutOptions<TFanOutOutput>): Promise<FanOutResult<TFanOutOutput>>;
+  /**
+   * Structured handoff-artifact APIs. Persists / reads UTF-8 text
+   * artifacts under the configured artifact root; cross-run reads
+   * require an explicit `runId` cursor on the read options.
+   */
+  readonly progress: AgentProgressIO;
+  /**
+   * The unified tool registry assembled at `createAgent(...)` warm-up
+   * (Principle #12): every first-party + skill tool, with cross-source
+   * name collisions resolved deterministically. Read-only and exposed
+   * for inspection; the run loop and `tool_search` consume it. Always
+   * present on agents built by `createAgent(...)`.
+   */
+  readonly registry?: ToolRegistry;
+}
+//#endregion
+export { AbortOptions, Agent, AgentCallOptions, AgentConfig, AgentInput, AgentToToolOptions, CompactOptions, CompactionApiResult, OutputSpec, PostCompactionHook$1 as PostCompactionHook, PrepareStepHook, PrepareStepOverrides, ResumeDirective, SkillsRegistryLike };
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","names":[],"sources":["../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;AAqDA;;;;;AA0BA;;;AAEkC,KAnCtB,UAAA,GAmCsB,MAAA,GAnCA,OAmCA,GAnCU,aAmCV,CAnCwB,OAmCxB,CAAA;;;;;;AAGjB,UA/BA,UA+BoB,CAAA,OAAA,CAAA,CAAA;EACf,SAAA,IAAA,EAAA,MAAA,GAAA,YAAA;EACkC;;;;;EAY5C,SAAA,MAAA,CAAA,EAAA;IAUK,KAAA,CAAA,KAAA,EAAA,OAAkB,CAAA,EAhDU,OAiDlC;EAcC,CAAA;EAEF;EAAN,SAAA,WAAA,CAAA,EAAA,MAAA;EAGyB;;;;AAS7B;;;EASwE,SAAA,UAAA,CAAA,EA5EhD,QA4EgD,CA5EvC,MA4EuC,CAAA,MAAA,EAAA,OAAA,CAAA,CAAA;;;;;;;;AAiBpC,KApFxB,eAoFwB,CAAA,QAAA,OAAA,CAAA,GAAA,CAAA,GAAA,EAnF7B,UAmF6B,CAnFlB,KAmFkB,CAAA,EAAA,GAlF/B,OAkF+B,CAlFvB,oBAkFuB,CAlFF,KAkFE,CAAA,CAAA,GAlFQ,oBAkFR,CAlF6B,KAkF7B,CAAA;;AACD,UAhFlB,oBAgFkB,CAAA,QAAA,OAAA,CAAA,CAAA;EAAX,SAAA,QAAA,CAAA,EA/EF,QA+EE;EAmBW,SAAA,KAAA,CAAA,EAjGhB,aAiGgB,CAjGF,IAiGE,CAAA,OAAA,EAAA,OAAA,EAjGqB,KAiGrB,CAAA,CAAA;EAAd,SAAA,UAAA,CAAA,EAhGG,UAgGH;EAC+B,SAAA,WAAA,CAAA,EAAA,MAAA;EAAhB,SAAA,SAAA,CAAA,EAAA,MAAA;;;;;;;;AAwBR,KA9GhB,oBAAA,GAAqB,kBA8GL;;;;;;;;;AAoBJ,UAxHP,kBAAA,CAwHO;EAqBI,IAAA,GAAA,EA5IjB,aA4IiB,CAAA,OAAA,CAAA;;;;;;;;AA0B5B;AAiBiB,KAzKL,YAyKoB,CAAA,QAAA,OACK,CAAA,GAxKjC,KAwKiC,CAxK3B,KAwKa,EAAA,GAAA,CAAA,GAAA;EAQN,SAAA,MAAA,EA7KM,KA6KU,CA7KJ,KA6KI,EAAA,GAAA,CAAA;EACf,SAAA,WAAA,CAAA,EA7KW,aA6KX;CACE;;;AAgBpB;AAqBA;AAwBA;AAUiB,UA7OA,WA6OmB,CAAA,QAAA,OAAA,EAAA,UAAA,MAAA,CAAA,CAAA;EAwBnB,SAAA,IAAA,EAAA,MAAkB;EACA;;;;;;;EAelB,SAAA,YAAe,EAAA,MAAA,GAAA,CAAA,CAAA,GAAA,EA5QS,UA4QT,CA5QoB,KA4QpB,CAAA,EAAA,GAAA,MAAA,GA5QwC,OA4QxC,CAAA,MAAA,CAAA,CAAA;EACG,SAAA,QAAA,EA5Qd,QA4Qc;EAA+B,SAAA,KAAA,CAAA,EA3Q/C,aA2Q+C,CA3QjC,IA2QiC,CAAA,OAAA,EAAA,OAAA,EA3QV,KA2QU,CAAA,CAAA;EAAR,SAAA,MAAA,CAAA,EA1QtC,kBA0QsC;EACzC,SAAA,MAAA,CAAA,EA1QG,MA0QH;EAA4C;;;;AAQ7D;;;;;;;EAKc,SAAA,mBAAA,CAAA,EAAA,OAAA;EACgB,SAAA,QAAA,CAAA,EA3QR,aA2QQ,CA3QM,YA2QN,CA3QmB,KA2QnB,CAAA,CAAA;EAAX,SAAA,UAAA,CAAA,EA1QK,UA0QL,CA1QgB,OA0QhB,CAAA;EAAd;;;;;;;;;;;;;;;;;EASgC,SAAA,UAAA,CAAA,EAAA;IASL,SAAA,KAAA,CAAA,EAzQX,aAyQW,CAzQG,cAyQH,CAAA,MAAA,CAAA,CAAA;IAAnB,SAAA,MAAA,CAAA,EAxQS,aAwQT,CAxQuB,eAwQvB,CAxQuC,OAwQvC,CAAA,CAAA;EACa,CAAA;EAAb,SAAA,QAAA,CAAA,EAvQS,aAuQT;EAAR,SAAA,UAAA,CAAA,EAtQmB,UAsQnB;EAMgB,SAAA,WAAA,CAAA,EA3QI,eA2QJ,CA3QoB,KA2QpB,CAAA;EAQC,SAAA,gBAAA,CAAA,EAAA,MAAA;EAAY;;;;;;;;;;;;;;;;;4BAhQN,cAAc;4BACd;4BACA,YAAY;0BACd,QAAQ,OAAO,WAAW;;;;;;;;;gCASpB;8BACF;;;;;;;;wBAQN;;;;;;;;;;;;;;;;;;;;;4BAqBI;;;;;;;;;2BASD,cAAc;oBACrB;6BACS;yBACJ;;;kBAGP;;;;;;;;;;UAWD,gBAAA;;;;;;;;;;;;;;;;UAiBA,eAAA;uBACM,cAAc;;;;;;;UAQpB;kBACC;oBACE;;;;;;;;uBAQG;;;;;;;UAQN,kBAAA;;;;;;;;;;;;;yBAaQ;;;;;;;UAQR,YAAA;;;;;;;;;;;;;;;;;;;;;;;UAwBA,cAAA;;;;;;;;;UAUA,mBAAA;;;;;;;;;;;;;;;;;;;;;;;UAwBA;qBACI,cAAc;;uBAEZ;2BACI,cAAc;oBACrB;;;;;;;;;;UAWH,eAAA;mCACkB,uBAAuB,QAAQ;iBACjD,sBAAsB,QAAQ,cAAc;;;;;;;UAQ5C;;mBAEE,YAAY,OAAO;gBAE3B,aAAa,oBACV,iBAAiB,SAC1B,cAAc,WAAW;aAEnB,aAAa,oBACV,iBAAiB,SAC1B,QAAQ,YAAY;iBACR;oBACG;kBACF;mBACC,qBAAqB;;KAAiC,SAAS;oBAC9D,iBAAiB,QAAQ;;;;;;;;2CAShC,mBAAmB,iBAC3B,QAAQ,aAAa;;;;;;qBAML;;;;;;;;sBAQC"}