@harrylabsj/kiwi-merchant-cloud 0.12.0

package/app/runtime/negotiation-turn.js

@@ -0,0 +1,317 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Role-aware single-turn orchestration (buyer and merchant share one loop).
+ *
+ * Flow per design §10 (with M3 reliability):
+ *   capabilities (fail closed) -> recover own stale claims -> list pending
+ *   -> claim -> Pi agent loop under claim heartbeat (snapshot -> decision)
+ *   -> policy result -> complete / fail / abandon.
+ *
+ * The marketplace conversation is the authoritative memory; no Pi session is
+ * persisted. Every turn rebuilds its context from the snapshot.
+ *
+ * Shutdown semantics (design §16.2): an external AbortSignal (SIGINT/SIGTERM
+ * in the foreground loop) aborts the Pi run; a claim that was never accepted
+ * is abandoned (never completed) so another worker can pick it up. A
+ * decision already accepted by the policy gate is never rolled back — the
+ * claim completes normally.
+ */
+import { Agent } from "@earendil-works/pi-agent-core";
+import { CommerceError, idempotencyKey } from "../commerce/types.js";
+import { PROTOCOL_VERSION } from "../negotiation/types.js";
+import { systemPromptForRole, userPromptForRole } from "../negotiation/prompt.js";
+import { buildNegotiationTools, createToolGuard, toolAllowlistForRole, } from "./tools.js";
+import { buildModel, resolveThinkingLevel } from "./model.js";
+import { startClaimHeartbeat } from "./heartbeat.js";
+const REQUIRED_CAPABILITIES = [
+    "consultation_read",
+    "consultation_write",
+    "inventory_read",
+];
+/**
+ * M3 reliability constants (documented in README): claims untouched for
+ * STALE_CLAIM_TTL_SECONDS are recovered as crashed; a claimed turn
+ * heartbeats every HEARTBEAT_INTERVAL_MS — comfortably below the TTL — so
+ * healthy long turns are never mistaken for crashed ones.
+ */
+export const STALE_CLAIM_TTL_SECONDS = 300;
+export const HEARTBEAT_INTERVAL_MS = 60_000;
+export async function runNegotiationTurn(options) {
+    const { profile, client, streamFn } = options;
+    const usage = { input: 0, output: 0, total: 0, cost_total: 0 };
+    // 0. Protocol + capability check: fail closed.
+    const caps = await client.getCapabilities();
+    if (!caps.protocol_versions.includes(PROTOCOL_VERSION)) {
+        throw new CommerceError("validation", `Gateway does not support ${PROTOCOL_VERSION}: ${caps.protocol_versions.join(", ")}`);
+    }
+    for (const cap of REQUIRED_CAPABILITIES) {
+        if (!caps.capabilities[cap]) {
+            throw new CommerceError("validation", `Gateway lacks required capability: ${cap}`);
+        }
+    }
+    if (caps.capabilities.orders !== false) {
+        throw new CommerceError("validation", "Gateway violates the no-order boundary (orders=true)");
+    }
+    // 0.5. Crash recovery BEFORE any work or heartbeat on this runtime:
+    // abandon this identity's own stale processing claims (never revives them;
+    // abandoned claims stay reclaimable). Runs in once and foreground modes.
+    await client.abandonStaleClaims({ ttl_seconds: STALE_CLAIM_TTL_SECONDS });
+    // 1. Find work. Role and owner are derived from the token server-side.
+    const pending = await client.listPendingMessages();
+    const target = pending[0];
+    if (!target) {
+        return { outcome: { kind: "no_work" }, steps: 0, usage };
+    }
+    // 2. Claim. Idempotency key: agent_id + message_id + protocol version.
+    const idem = idempotencyKey(profile.agent_id, target.message_id, PROTOCOL_VERSION);
+    const claim = await client.claimMessage({
+        conversation_id: target.conversation_id,
+        message_id: target.message_id,
+        idempotency_key: idem,
+    });
+    const base = {
+        conversation_id: target.conversation_id,
+        message_id: target.message_id,
+        idempotency_key: idem,
+    };
+    if (!claim.claimed) {
+        return {
+            outcome: { kind: "already_claimed", status: claim.status },
+            ...base,
+            steps: 0,
+            usage,
+        };
+    }
+    // 3. Run the constrained Pi agent loop under a claim heartbeat: a healthy
+    // long turn refreshes the claim so it is never mistaken for a crashed one.
+    const heartbeat = startClaimHeartbeat(client, target.message_id, options.heartbeatIntervalMs ?? HEARTBEAT_INTERVAL_MS);
+    let report;
+    try {
+        report = await finishTurn(options, profile, client, streamFn, target, idem, base, usage);
+    }
+    catch (err) {
+        // An error escaping a claimed turn (transient snapshot/submit/settle
+        // failures) must not strand the claim until the 300s stale TTL:
+        // best-effort abandon so the message is reclaimable immediately. The
+        // stale TTL stays the backstop if this abandon fails too.
+        try {
+            await client.abandonClaim({
+                message_id: target.message_id,
+                idempotency_key: idem,
+                error: `turn escaped settlement: ${err instanceof Error ? err.message : String(err)}`,
+            });
+        }
+        catch {
+            // The original error is what propagates.
+        }
+        throw err;
+    }
+    finally {
+        // No timer or in-flight heartbeat outlives the turn.
+        await heartbeat.stop();
+    }
+    return { ...report, heartbeat: { beats: heartbeat.beats(), failures: heartbeat.failures() } };
+}
+async function finishTurn(options, profile, client, streamFn, target, idem, base, usage) {
+    const tracker = { submissions: 0 };
+    const binding = {
+        conversation_id: target.conversation_id,
+        message_id: target.message_id,
+        idempotency_key: idem,
+    };
+    // max_retries = repair attempts beyond the first submission.
+    const maxSubmissions = profile.runtime.max_retries + 1;
+    const tools = buildNegotiationTools(client, binding, tracker, maxSubmissions, {
+        ...(profile.role === "buyer" && profile.buyer_policy
+            ? { buyerPolicy: profile.buyer_policy }
+            : {}),
+    });
+    const guard = createToolGuard(toolAllowlistForRole(profile.role), binding);
+    const model = buildModel(profile);
+    const thinkingLevel = resolveThinkingLevel(profile);
+    let steps = 0;
+    let stepCapHit = false;
+    const maxSteps = profile.runtime.max_model_steps;
+    const agent = new Agent({
+        streamFn,
+        initialState: {
+            systemPrompt: systemPromptForRole(profile),
+            model,
+            tools,
+            ...(thinkingLevel !== undefined ? { thinkingLevel } : {}),
+        },
+        convertToLlm: (messages) => messages,
+        toolExecution: "sequential",
+        beforeToolCall: guard,
+        ...(options.getApiKey !== undefined ? { getApiKey: options.getApiKey } : {}),
+    });
+    agent.subscribe((event) => {
+        if (event.type === "turn_end") {
+            steps += 1;
+            if (steps >= maxSteps) {
+                stepCapHit = true;
+                agent.abort();
+            }
+        }
+        if (event.type === "message_end" && event.message.role === "assistant") {
+            const u = event.message.usage;
+            usage.input += u.input;
+            usage.output += u.output;
+            usage.total += u.totalTokens;
+            usage.cost_total += u.cost.total;
+        }
+        return undefined;
+    });
+    const timeoutMs = profile.runtime.turn_timeout_seconds * 1000;
+    let timedOut = false;
+    let externalAbort = options.signal?.aborted === true;
+    const onExternalAbort = () => {
+        externalAbort = true;
+        agent.abort();
+    };
+    options.signal?.addEventListener("abort", onExternalAbort, { once: true });
+    const timer = setTimeout(() => {
+        timedOut = true;
+        agent.abort();
+    }, timeoutMs);
+    let runError;
+    try {
+        await agent.prompt(userPromptForRole(profile.role, target.conversation_id, target.message_id));
+        await agent.waitForIdle();
+        if (agent.state.errorMessage) {
+            runError = agent.state.errorMessage;
+        }
+    }
+    catch (err) {
+        runError = err instanceof Error ? err.message : String(err);
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", onExternalAbort);
+    }
+    // 4. Settle the claim based on the policy result. A decision the gate
+    // already accepted is never rolled back, even if a shutdown arrived
+    // afterwards.
+    const result = tracker.decisionResult;
+    if (result) {
+        if (result.result === "accepted") {
+            await client.completeClaim({ message_id: target.message_id, idempotency_key: idem });
+            const outcome = { kind: "accepted" };
+            if (result.message_id !== undefined)
+                outcome.message_id = result.message_id;
+            return { outcome, ...base, policy_result: result, steps, usage };
+        }
+        if (result.result === "human_required") {
+            // The turn did its job by escalating; the conversation now routes to a
+            // human. Completing the claim avoids an infinite retry loop.
+            await client.completeClaim({ message_id: target.message_id, idempotency_key: idem });
+            return {
+                outcome: { kind: "human_required", reason_codes: result.reason_codes },
+                ...base,
+                policy_result: result,
+                steps,
+                usage,
+            };
+        }
+        // rejected_retryable with no successful resubmission inside the turn.
+        if (externalAbort) {
+            // Shutdown semantics (design §16.2): a claim that was never accepted
+            // is abandoned, never failed — both are reclaimable, but abandon is
+            // the documented "unsettled on shutdown" settlement.
+            const reason = "shutdown: turn aborted by signal before a decision was accepted";
+            await client.abandonClaim({
+                message_id: target.message_id,
+                idempotency_key: idem,
+                error: reason,
+            });
+            return {
+                outcome: { kind: "aborted", reason },
+                ...base,
+                policy_result: result,
+                steps,
+                usage,
+            };
+        }
+        const budgetNote = tracker.submissionLimitExceeded
+            ? `; submission budget exhausted (max_retries=${profile.runtime.max_retries})`
+            : "";
+        await client.failClaim({
+            message_id: target.message_id,
+            idempotency_key: idem,
+            error: `policy rejected: ${result.public_reason}${budgetNote}`,
+        });
+        return {
+            outcome: {
+                kind: "failed",
+                error: `policy rejected: ${result.public_reason}${budgetNote}`,
+                retriable: true,
+            },
+            ...base,
+            policy_result: result,
+            steps,
+            usage,
+        };
+    }
+    // 5. No decision submitted. External shutdown abandons the claim (another
+    // worker may retry it); timeout/step-cap/model errors fail it. Neither is
+    // ever completed.
+    let outcome;
+    let reason;
+    if (externalAbort) {
+        reason = "shutdown: turn aborted by signal before a decision was accepted";
+        outcome = { kind: "aborted", reason };
+        await client.abandonClaim({
+            message_id: target.message_id,
+            idempotency_key: idem,
+            error: reason,
+        });
+        return { outcome, ...base, steps, usage };
+    }
+    if (timedOut) {
+        reason = `turn timed out after ${profile.runtime.turn_timeout_seconds}s without a decision`;
+        outcome = { kind: "timeout", reason };
+    }
+    else if (stepCapHit) {
+        reason = `model did not submit a decision within ${maxSteps} steps`;
+        outcome = { kind: "no_decision", reason };
+    }
+    else if (runError !== undefined && runError !== "") {
+        reason = `model error: ${runError}`;
+        outcome = { kind: "failed", error: reason, retriable: !isModelConfigError(runError) };
+    }
+    else {
+        reason = "model ended without submitting a decision";
+        outcome = { kind: "no_decision", reason };
+    }
+    await client.failClaim({
+        message_id: target.message_id,
+        idempotency_key: idem,
+        error: reason,
+    });
+    return { outcome, ...base, steps, usage };
+}
+/** Model auth/config problems are not retried by an external supervisor. */
+function isModelConfigError(message) {
+    const m = message.toLowerCase();
+    return (m.includes("api key") ||
+        m.includes("unauthorized") ||
+        m.includes("401") ||
+        m.includes("403") ||
+        m.includes("forbidden") ||
+        m.includes("quota"));
+}
+//# sourceMappingURL=negotiation-turn.js.map

package/app/runtime/negotiation-turn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"negotiation-turn.js","sourceRoot":"","sources":["../../src/runtime/negotiation-turn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAkC,MAAM,+BAA+B,CAAC;AAItF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAqB,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,oBAAoB,GAErB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AA2CrD,MAAM,qBAAqB,GAAG;IAC5B,mBAAmB;IACnB,oBAAoB;IACpB,gBAAgB;CACR,CAAC;AAEX;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA+B;IACtE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC9C,MAAM,KAAK,GAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAE1E,+CAA+C;IAC/C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;IAC5C,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,aAAa,CACrB,YAAY,EACZ,4BAA4B,gBAAgB,KAAK,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,sCAAsC,GAAG,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CAAC,YAAY,EAAE,sDAAsD,CAAC,CAAC;IAChG,CAAC;IAED,oEAAoE;IACpE,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAE1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC3D,CAAC;IAED,uEAAuE;IACvE,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;QACtC,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,IAAI;KACtB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YAC1D,GAAG,IAAI;YACP,KAAK,EAAE,CAAC;YACR,KAAK;SACN,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,mBAAmB,CACnC,MAAM,EACN,MAAM,CAAC,UAAU,EACjB,OAAO,CAAC,mBAAmB,IAAI,qBAAqB,CACrD,CAAC;IACF,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,qEAAqE;QACrE,gEAAgE;QAChE,qEAAqE;QACrE,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC;gBACxB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,IAAI;gBACrB,KAAK,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;aACtF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,qDAAqD;QACrD,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC;AAChG,CAAC;AAOD,KAAK,UAAU,UAAU,CACvB,OAA+B,EAC/B,OAAqB,EACrB,MAAsB,EACtB,QAAkB,EAClB,MAAkB,EAClB,IAAY,EACZ,IAA8E,EAC9E,KAAgB;IAEhB,MAAM,OAAO,GAAuB,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;IACvD,MAAM,OAAO,GAAG;QACd,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,IAAI;KACtB,CAAC;IACF,6DAA6D;IAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE;QAC5E,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY;YAClD,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,YAAY,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,eAAe,CAAC,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IAE3E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;IAEjD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,QAAQ;QACR,YAAY,EAAE;YACZ,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC;YAC1C,KAAK;YACL,KAAK;YACL,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;QACD,YAAY,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAqB;QACjD,aAAa,EAAE,YAAY;QAC3B,cAAc,EAAE,KAAK;QACrB,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAC;IAEH,KAAK,CAAC,SAAS,CAAC,CAAC,KAAiB,EAAE,EAAE;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,CAAC;YACX,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC;gBAClB,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAC9B,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC;YACvB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;YACzB,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,CAAC;YAC7B,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACnC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAC9D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,aAAa,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;IACrD,MAAM,eAAe,GAAG,GAAS,EAAE;QACjC,aAAa,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;QAC5B,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,EAAE,SAAS,CAAC,CAAC;IACd,IAAI,QAA4B,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/F,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7B,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAChE,CAAC;IAED,sEAAsE;IACtE,oEAAoE;IACpE,cAAc;IACd,MAAM,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IACtC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,MAAM,OAAO,GAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAClD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;gBAAE,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACnE,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACvC,uEAAuE;YACvE,6DAA6D;YAC7D,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,OAAO;gBACL,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;gBACtE,GAAG,IAAI;gBACP,aAAa,EAAE,MAAM;gBACrB,KAAK;gBACL,KAAK;aACN,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,IAAI,aAAa,EAAE,CAAC;YAClB,qEAAqE;YACrE,oEAAoE;YACpE,qDAAqD;YACrD,MAAM,MAAM,GAAG,iEAAiE,CAAC;YACjF,MAAM,MAAM,CAAC,YAAY,CAAC;gBACxB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,IAAI;gBACrB,KAAK,EAAE,MAAM;aACd,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE;gBACpC,GAAG,IAAI;gBACP,aAAa,EAAE,MAAM;gBACrB,KAAK;gBACL,KAAK;aACN,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,uBAAuB;YAChD,CAAC,CAAC,8CAA8C,OAAO,CAAC,OAAO,CAAC,WAAW,GAAG;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,CAAC,SAAS,CAAC;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,oBAAoB,MAAM,CAAC,aAAa,GAAG,UAAU,EAAE;SAC/D,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,oBAAoB,MAAM,CAAC,aAAa,GAAG,UAAU,EAAE;gBAC9D,SAAS,EAAE,IAAI;aAChB;YACD,GAAG,IAAI;YACP,aAAa,EAAE,MAAM;YACrB,KAAK;YACL,KAAK;SACN,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,kBAAkB;IAClB,IAAI,OAAoB,CAAC;IACzB,IAAI,MAAc,CAAC;IACnB,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,GAAG,iEAAiE,CAAC;QAC3E,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,CAAC,YAAY,CAAC;YACxB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,eAAe,EAAE,IAAI;YACrB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,wBAAwB,OAAO,CAAC,OAAO,CAAC,oBAAoB,sBAAsB,CAAC;QAC5F,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,MAAM,GAAG,0CAA0C,QAAQ,QAAQ,CAAC;QACpE,OAAO,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;SAAM,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,gBAAgB,QAAQ,EAAE,CAAC;QACpC,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,2CAA2C,CAAC;QACrD,OAAO,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,CAAC,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,eAAe,EAAE,IAAI;QACrB,KAAK,EAAE,MAAM;KACd,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,CACL,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC1B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACjB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CACpB,CAAC;AACJ,CAAC"}

package/app/runtime/tools.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { AgentTool, BeforeToolCallContext, BeforeToolCallResult } from "@earendil-works/pi-agent-core";
+import type { TSchema } from "@earendil-works/pi-ai";
+import type { BuyerPolicy } from "../config/profile.js";
+import { type PolicyResult, type Role } from "../negotiation/types.js";
+import type { CommerceClient } from "../commerce/types.js";
+export declare const TOOL_GET_SNAPSHOT = "get_negotiation_snapshot";
+export declare const TOOL_SUBMIT_DECISION = "submit_negotiation_decision";
+/** Both roles share the same minimal surface: snapshot read + decision write. */
+export declare const NEGOTIATION_TOOL_ALLOWLIST: readonly string[];
+/** Back-compat alias for the M1 name. */
+export declare const MERCHANT_TOOL_ALLOWLIST: readonly string[];
+export declare function toolAllowlistForRole(role: Role): readonly string[];
+/** Hard cap on tool argument size, checked before execution. */
+export declare const MAX_TOOL_ARGS_BYTES: number;
+/**
+ * Content-addressed submit idempotency: resubmitting byte-identical
+ * arguments replays the stored gateway result, while a repaired decision
+ * gets a fresh key. This survives process restarts without local state.
+ */
+export declare function submitIdempotencyKey(claimKey: string, decision: unknown): string;
+export interface ConversationBinding {
+    conversation_id: string;
+    message_id: number;
+    idempotency_key: string;
+}
+export interface ToolOutcomeTracker {
+    /** The latest policy result returned by the gateway, if any. */
+    decisionResult?: PolicyResult;
+    /** Number of submissions that reached the gateway (first + repairs). */
+    submissions: number;
+    /** Set when a submission was blocked by the max_retries budget. */
+    submissionLimitExceeded?: boolean;
+}
+export interface NegotiationToolOptions {
+    /**
+     * Buyer profiles only: the local private policy gate evaluated BEFORE the
+     * gateway is called. Private thresholds never leave this process.
+     */
+    buyerPolicy?: BuyerPolicy;
+}
+export declare function buildNegotiationTools(client: CommerceClient, binding: ConversationBinding, tracker: ToolOutcomeTracker, maxSubmissions: number, options?: NegotiationToolOptions): AgentTool<TSchema, unknown>[];
+/** Back-compat alias: merchant tools are the negotiation tools without a buyer gate. */
+export declare function buildMerchantTools(client: CommerceClient, binding: ConversationBinding, tracker: ToolOutcomeTracker, maxSubmissions: number): AgentTool<TSchema, unknown>[];
+/**
+ * beforeToolCall factory: allowlist enforcement, argument size cap, and
+ * conversation/message binding checks. Runs after Pi's own schema
+ * validation of the arguments.
+ */
+export declare function createToolGuard(allowlist: readonly string[], binding: ConversationBinding): (context: BeforeToolCallContext) => Promise<BeforeToolCallResult | undefined>;

package/app/runtime/tools.js

@@ -0,0 +1,236 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * Tool surface and beforeToolCall guard.
+ *
+ * The Pi agent for any role (buyer or merchant) sees exactly two tools:
+ * get_negotiation_snapshot (read-only, bound conversation) and
+ * submit_negotiation_decision (the single write intent, terminal).
+ * No file, shell, edit, arbitrary HTTP, search, or dynamic-install tools
+ * exist — nothing else is ever constructed, and the guard blocks anything
+ * unknown even if a model emits a forged call.
+ *
+ * For buyer profiles the submit tool additionally runs the LOCAL private
+ * policy gate (runtime/buyer-policy.ts) before the gateway is called, so
+ * the private budget never leaves this process.
+ *
+ * The guard is a last line of defense only; the authoritative policy gate
+ * remains the Commerce API.
+ */
+import { createHash } from "node:crypto";
+import { dereferenceSchema, loadSchema } from "../contracts/schemas.js";
+import { PROTOCOL_VERSION, } from "../negotiation/types.js";
+import { checkBuyerLocalPolicy, localBuyerPolicyResult } from "./buyer-policy.js";
+export const TOOL_GET_SNAPSHOT = "get_negotiation_snapshot";
+export const TOOL_SUBMIT_DECISION = "submit_negotiation_decision";
+/** Both roles share the same minimal surface: snapshot read + decision write. */
+export const NEGOTIATION_TOOL_ALLOWLIST = [
+    TOOL_GET_SNAPSHOT,
+    TOOL_SUBMIT_DECISION,
+];
+/** Back-compat alias for the M1 name. */
+export const MERCHANT_TOOL_ALLOWLIST = NEGOTIATION_TOOL_ALLOWLIST;
+export function toolAllowlistForRole(role) {
+    // search_products is deliberately not exposed: conversations are bound to
+    // a single SKU by the marketplace, so both roles get the same two tools.
+    void role;
+    return NEGOTIATION_TOOL_ALLOWLIST;
+}
+/** Hard cap on tool argument size, checked before execution. */
+export const MAX_TOOL_ARGS_BYTES = 32 * 1024;
+/**
+ * Content-addressed submit idempotency: resubmitting byte-identical
+ * arguments replays the stored gateway result, while a repaired decision
+ * gets a fresh key. This survives process restarts without local state.
+ */
+export function submitIdempotencyKey(claimKey, decision) {
+    const canonical = stableStringify(decision);
+    const hash = createHash("sha256").update(canonical).digest("hex").slice(0, 16);
+    return `${claimKey}:submit:${hash}`;
+}
+function stableStringify(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableStringify).join(",")}]`;
+    if (value !== null && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, v]) => v !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+            .map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`);
+        return `{${entries.join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+export function buildNegotiationTools(client, binding, tracker, maxSubmissions, options) {
+    const decisionParameters = dereferenceSchema(loadSchema("decision"));
+    const snapshotTool = {
+        name: TOOL_GET_SNAPSHOT,
+        label: "Get negotiation snapshot",
+        description: "Read the authoritative, role-trimmed negotiation snapshot for the currently claimed " +
+            "conversation. Takes no arguments; the conversation is bound by the runtime.",
+        parameters: {
+            type: "object",
+            additionalProperties: false,
+            properties: {},
+        },
+        execute: async () => {
+            const snapshot = await client.getNegotiationSnapshot({
+                conversation_id: binding.conversation_id,
+                message_id: binding.message_id,
+            });
+            return {
+                content: [{ type: "text", text: JSON.stringify(snapshot, null, 2) }],
+                details: snapshot,
+            };
+        },
+    };
+    const submitTool = {
+        name: TOOL_SUBMIT_DECISION,
+        label: "Submit negotiation decision",
+        description: "Submit the single structured negotiation decision for this turn. This is the only " +
+            "write intent and ends the turn when accepted. The marketplace policy gate is " +
+            "authoritative and may reject with a repairable reason.",
+        parameters: decisionParameters,
+        execute: async (_toolCallId, params) => {
+            // max_retries semantics: the number of repair attempts allowed beyond
+            // the first submission. Total gateway submissions per turn never exceed
+            // max_retries + 1; exceeding the budget is blocked here (the gateway is
+            // never called) and settles the turn as an auditable failure.
+            if (tracker.submissions >= maxSubmissions) {
+                tracker.submissionLimitExceeded = true;
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Submission budget exhausted: profile runtime.max_retries allows ` +
+                                `${maxSubmissions} submission(s) this turn (first attempt plus repairs). ` +
+                                "The turn is ending; do not resubmit.",
+                        },
+                    ],
+                    details: {
+                        error: "submission_limit_exceeded",
+                        submissions: tracker.submissions,
+                        max_submissions: maxSubmissions,
+                    },
+                    terminate: true,
+                };
+            }
+            const decision = params;
+            // Buyer local private policy gate: evaluated before the gateway call.
+            // A violation never reaches the server and its reason never contains
+            // private threshold values.
+            if (options?.buyerPolicy) {
+                const violation = checkBuyerLocalPolicy(decision, options.buyerPolicy);
+                if (violation) {
+                    tracker.submissions += 1;
+                    const result = localBuyerPolicyResult(binding.conversation_id, violation, maxSubmissions - tracker.submissions);
+                    tracker.decisionResult = result;
+                    return {
+                        content: [{ type: "text", text: JSON.stringify(result) }],
+                        details: { ...result, local: true },
+                        terminate: false,
+                    };
+                }
+            }
+            const result = await client.submitNegotiationDecision({
+                decision,
+                idempotency_key: submitIdempotencyKey(binding.idempotency_key, decision),
+            });
+            tracker.decisionResult = result;
+            tracker.submissions += 1;
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify(result),
+                    },
+                ],
+                details: result,
+                // Stop the loop after a terminal result; retryable rejections let the
+                // model repair and resubmit within the remaining step budget.
+                terminate: result.result !== "rejected_retryable",
+            };
+        },
+    };
+    return [snapshotTool, submitTool];
+}
+/** Back-compat alias: merchant tools are the negotiation tools without a buyer gate. */
+export function buildMerchantTools(client, binding, tracker, maxSubmissions) {
+    return buildNegotiationTools(client, binding, tracker, maxSubmissions);
+}
+/**
+ * beforeToolCall factory: allowlist enforcement, argument size cap, and
+ * conversation/message binding checks. Runs after Pi's own schema
+ * validation of the arguments.
+ */
+export function createToolGuard(allowlist, binding) {
+    return async (context) => {
+        const name = context.toolCall.name;
+        if (!allowlist.includes(name)) {
+            return {
+                block: true,
+                reason: `Tool "${name}" is not in the ${allowlist.join("/")} allowlist. ` +
+                    "No file, shell, edit, HTTP, or install tools exist.",
+            };
+        }
+        const args = context.args;
+        let size;
+        try {
+            // UTF-8 byte length, not string length: multibyte characters count
+            // fully against the cap.
+            size = Buffer.byteLength(JSON.stringify(args ?? {}), "utf8");
+        }
+        catch {
+            return { block: true, reason: "Tool arguments are not serializable." };
+        }
+        if (size > MAX_TOOL_ARGS_BYTES) {
+            return { block: true, reason: `Tool arguments exceed the ${MAX_TOOL_ARGS_BYTES} byte cap.` };
+        }
+        if (name === TOOL_GET_SNAPSHOT) {
+            if (args !== null && typeof args === "object" && Object.keys(args).length > 0) {
+                return {
+                    block: true,
+                    reason: "get_negotiation_snapshot takes no arguments; the conversation is bound by the runtime.",
+                };
+            }
+        }
+        if (name === TOOL_SUBMIT_DECISION) {
+            const decision = args;
+            if (!decision || typeof decision !== "object") {
+                return { block: true, reason: "Decision arguments must be an object." };
+            }
+            if (decision.protocol_version !== PROTOCOL_VERSION) {
+                return {
+                    block: true,
+                    reason: `protocol_version must be ${PROTOCOL_VERSION}.`,
+                };
+            }
+            if (decision.conversation_id !== binding.conversation_id) {
+                return {
+                    block: true,
+                    reason: `conversation_id must be the claimed conversation ${binding.conversation_id}; cross-conversation access is not allowed.`,
+                };
+            }
+            if (decision.in_reply_to_message_id !== binding.message_id) {
+                return {
+                    block: true,
+                    reason: `in_reply_to_message_id must be the claimed message ${binding.message_id}.`,
+                };
+            }
+        }
+        return undefined;
+    };
+}
+//# sourceMappingURL=tools.js.map

package/app/runtime/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/runtime/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EACL,gBAAgB,GAIjB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAElF,MAAM,CAAC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,6BAA6B,CAAC;AAElE,iFAAiF;AACjF,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,iBAAiB;IACjB,oBAAoB;CACrB,CAAC;AAEF,yCAAyC;AACzC,MAAM,CAAC,MAAM,uBAAuB,GAAsB,0BAA0B,CAAC;AAErF,MAAM,UAAU,oBAAoB,CAAC,IAAU;IAC7C,0EAA0E;IAC1E,yEAAyE;IACzE,KAAK,IAAI,CAAC;IACV,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7C;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,QAAiB;IACtE,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/E,OAAO,GAAG,QAAQ,WAAW,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC7E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC7D,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChD,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC;AAyBD,MAAM,UAAU,qBAAqB,CACnC,MAAsB,EACtB,OAA4B,EAC5B,OAA2B,EAC3B,cAAsB,EACtB,OAAgC;IAEhC,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAuB,CAAC;IAE3F,MAAM,YAAY,GAAgC;QAChD,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,0BAA0B;QACjC,WAAW,EACT,sFAAsF;YACtF,6EAA6E;QAC/E,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE,EAAE;SACO;QACvB,OAAO,EAAE,KAAK,IAAuC,EAAE;YACrD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC;gBACnD,eAAe,EAAE,OAAO,CAAC,eAAe;gBACxC,UAAU,EAAE,OAAO,CAAC,UAAU;aAC/B,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBACpE,OAAO,EAAE,QAAQ;aAClB,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,MAAM,UAAU,GAAgC;QAC9C,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,oFAAoF;YACpF,+EAA+E;YAC/E,wDAAwD;QAC1D,UAAU,EAAE,kBAAkB;QAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAqC,EAAE;YACxE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,8DAA8D;YAC9D,IAAI,OAAO,CAAC,WAAW,IAAI,cAAc,EAAE,CAAC;gBAC1C,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC;gBACvC,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EACF,kEAAkE;gCAClE,GAAG,cAAc,yDAAyD;gCAC1E,sCAAsC;yBACzC;qBACF;oBACD,OAAO,EAAE;wBACP,KAAK,EAAE,2BAA2B;wBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;wBAChC,eAAe,EAAE,cAAc;qBAChC;oBACD,SAAS,EAAE,IAAI;iBAChB,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,MAA6B,CAAC;YAC/C,sEAAsE;YACtE,qEAAqE;YACrE,4BAA4B;YAC5B,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;gBACzB,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;gBACvE,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;oBACzB,MAAM,MAAM,GAAG,sBAAsB,CACnC,OAAO,CAAC,eAAe,EACvB,SAAS,EACT,cAAc,GAAG,OAAO,CAAC,WAAW,CACrC,CAAC;oBACF,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC;oBAChC,OAAO;wBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;wBACzD,OAAO,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE;wBACnC,SAAS,EAAE,KAAK;qBACjB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC;gBACpD,QAAQ;gBACR,eAAe,EAAE,oBAAoB,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC;aACzE,CAAC,CAAC;YACH,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC;YAChC,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;qBAC7B;iBACF;gBACD,OAAO,EAAE,MAAM;gBACf,sEAAsE;gBACtE,8DAA8D;gBAC9D,SAAS,EAAE,MAAM,CAAC,MAAM,KAAK,oBAAoB;aAClD,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAChC,MAAsB,EACtB,OAA4B,EAC5B,OAA2B,EAC3B,cAAsB;IAEtB,OAAO,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,SAA4B,EAC5B,OAA4B;IAE5B,OAAO,KAAK,EAAE,OAA8B,EAA6C,EAAE;QACzF,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM,EACJ,SAAS,IAAI,mBAAmB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc;oBACjE,qDAAqD;aACxD,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,mEAAmE;YACnE,yBAAyB;YACzB,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,6BAA6B,mBAAmB,YAAY,EAAE,CAAC;QAC/F,CAAC;QAED,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAC/B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxF,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EACJ,wFAAwF;iBAC3F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAA2C,CAAC;YAC7D,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;YAC1E,CAAC;YACD,IAAI,QAAQ,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;gBACnD,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,4BAA4B,gBAAgB,GAAG;iBACxD,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe,EAAE,CAAC;gBACzD,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,oDAAoD,OAAO,CAAC,eAAe,6CAA6C;iBACjI,CAAC;YACJ,CAAC;YACD,IAAI,QAAQ,CAAC,sBAAsB,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC3D,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,sDAAsD,OAAO,CAAC,UAAU,GAAG;iBACpF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}