@intutic/gate 2.0.0 → 2.2.0

package/dist/ssoGroups.d.ts

@@ -0,0 +1,44 @@
+/**
+ * SSO-group tool clearance, read from the policy snapshot.
+ *
+ * Port of `evaluateSsoGroupClearance` and the `@sso_groups` record in
+ * `packages/shared-types/src/ssoGroupClearance.ts` — the evaluator the control
+ * plane's hook gate, the MCP proxy and the sync daemon's snapshot compiler
+ * share. This package has no workspace dependencies, so it carries a copy, and
+ * `src/__tests__/ssoGroups.test.ts` runs the shared vectors
+ * (`packages/shared-types/fixtures/sso-group-clearance-vectors.json`) through
+ * it so the copy cannot drift. `intutic_clawde/gate/sso_groups.py` is the
+ * Python port of the same thing.
+ *
+ * The snapshot's record carries the workspace's policy and the member the
+ * snapshot was issued to, with their groups as the control plane resolved
+ * them. It sits inside the snapshot's digest; when the digest fails, the gate
+ * still applies the policy but treats the member's groups as unknown, so an
+ * edited group list clears nothing.
+ */
+export type SsoGroupClearance = 'GRANTED' | 'DENIED' | 'REQUIRES_OBO';
+export interface SsoGroupPolicy {
+    highRiskTools: string[];
+    requiredGroups: string[];
+    requireOboFor: string[];
+}
+export interface SsoGroupRecord {
+    policy: SsoGroupPolicy;
+    member: {
+        memberId: string;
+        ssoGroups: string[];
+    } | null;
+    issuedAt: string;
+}
+export interface SsoGroupDecision {
+    clearance: SsoGroupClearance;
+    ruleId: string | null;
+    reason: string;
+}
+export declare const SSO_GROUP_RECORD_TAG = "@sso_groups";
+export declare function parseSsoGroupPolicy(value: unknown): SsoGroupPolicy | null;
+/** `memberGroups` null means the groups are unknown — a high-risk tool is then refused. */
+export declare function evaluateSsoGroupClearance(policy: SsoGroupPolicy | null, toolName: string, memberGroups: readonly string[] | null): SsoGroupDecision;
+/** Reads the snapshot's record line; null for any other line or a damaged one. */
+export declare function decodeSsoGroupRecord(line: string): SsoGroupRecord | null;
+//# sourceMappingURL=ssoGroups.d.ts.map

package/dist/ssoGroups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoGroups.d.ts","sourceRoot":"","sources":["../src/ssoGroups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAA;AAErE,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IACxD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,iBAAiB,CAAA;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,eAAO,MAAM,oBAAoB,gBAAgB,CAAA;AAMjD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAQzE;AAMD,2FAA2F;AAC3F,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,cAAc,GAAG,IAAI,EAC7B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GACrC,gBAAgB,CAqBlB;AAED,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAgBxE"}

package/dist/ssoGroups.js

@@ -0,0 +1,81 @@
+/**
+ * SSO-group tool clearance, read from the policy snapshot.
+ *
+ * Port of `evaluateSsoGroupClearance` and the `@sso_groups` record in
+ * `packages/shared-types/src/ssoGroupClearance.ts` — the evaluator the control
+ * plane's hook gate, the MCP proxy and the sync daemon's snapshot compiler
+ * share. This package has no workspace dependencies, so it carries a copy, and
+ * `src/__tests__/ssoGroups.test.ts` runs the shared vectors
+ * (`packages/shared-types/fixtures/sso-group-clearance-vectors.json`) through
+ * it so the copy cannot drift. `intutic_clawde/gate/sso_groups.py` is the
+ * Python port of the same thing.
+ *
+ * The snapshot's record carries the workspace's policy and the member the
+ * snapshot was issued to, with their groups as the control plane resolved
+ * them. It sits inside the snapshot's digest; when the digest fails, the gate
+ * still applies the policy but treats the member's groups as unknown, so an
+ * edited group list clears nothing.
+ */
+export const SSO_GROUP_RECORD_TAG = '@sso_groups';
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+export function parseSsoGroupPolicy(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return null;
+    const p = value;
+    return {
+        highRiskTools: stringList(p['highRiskTools']),
+        requiredGroups: stringList(p['requiredGroups']),
+        requireOboFor: stringList(p['requireOboFor']),
+    };
+}
+function ruleId(kind, toolName) {
+    return `sso_group.${kind}.${toolName.replace(/[^A-Za-z0-9_.:-]/g, '_')}`;
+}
+/** `memberGroups` null means the groups are unknown — a high-risk tool is then refused. */
+export function evaluateSsoGroupClearance(policy, toolName, memberGroups) {
+    if (!policy)
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    if (policy.requireOboFor.includes(toolName)) {
+        return {
+            clearance: 'REQUIRES_OBO',
+            ruleId: ruleId('require_obo', toolName),
+            reason: `SSO group policy: ${toolName} is on-behalf-of only, and a tool-call gate has no OBO token to present`,
+        };
+    }
+    if (!policy.highRiskTools.includes(toolName))
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    if (memberGroups && policy.requiredGroups.some((g) => memberGroups.includes(g))) {
+        return { clearance: 'GRANTED', ruleId: null, reason: '' };
+    }
+    const groups = policy.requiredGroups.length > 0 ? policy.requiredGroups.join(', ') : '(none configured)';
+    return {
+        clearance: 'DENIED',
+        ruleId: ruleId('high_risk', toolName),
+        reason: memberGroups
+            ? `SSO group policy: ${toolName} requires one of the SSO groups ${groups}, and this member holds none of them`
+            : `SSO group policy: ${toolName} requires one of the SSO groups ${groups}, and this gate does not know the member's groups`,
+    };
+}
+/** Reads the snapshot's record line; null for any other line or a damaged one. */
+export function decodeSsoGroupRecord(line) {
+    const [tag, b64, ...rest] = line.split('\t');
+    if (tag !== SSO_GROUP_RECORD_TAG || !b64 || rest.length > 0)
+        return null;
+    try {
+        const raw = JSON.parse(Buffer.from(b64, 'base64').toString('utf8'));
+        const policy = parseSsoGroupPolicy(raw['policy']);
+        if (!policy || typeof raw['issuedAt'] !== 'string')
+            return null;
+        const m = raw['member'];
+        const member = m && typeof m === 'object' && typeof m['memberId'] === 'string'
+            ? { memberId: m['memberId'], ssoGroups: stringList(m['ssoGroups']) }
+            : null;
+        return { policy, member, issuedAt: raw['issuedAt'] };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=ssoGroups.js.map

package/dist/ssoGroups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssoGroups.js","sourceRoot":"","sources":["../src/ssoGroups.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAsBH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAA;AAEjD,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAC7C,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC/C,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;KAC9C,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAiC,EAAE,QAAgB;IACjE,OAAO,aAAa,IAAI,IAAI,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,yBAAyB,CACvC,MAA6B,EAC7B,QAAgB,EAChB,YAAsC;IAEtC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACtE,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC;YACvC,MAAM,EAAE,qBAAqB,QAAQ,yEAAyE;SAC/G,CAAA;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IACvG,IAAI,YAAY,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;IAC3D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAA;IACxG,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC;QACrC,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,qBAAqB,QAAQ,mCAAmC,MAAM,sCAAsC;YAC9G,CAAC,CAAC,qBAAqB,QAAQ,mCAAmC,MAAM,mDAAmD;KAC9H,CAAA;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5C,IAAI,GAAG,KAAK,oBAAoB,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;QAC9F,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;QACjD,IAAI,CAAC,MAAM,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAC/D,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAmC,CAAA;QACzD,MAAM,MAAM,GACV,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;YAC7D,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE;YACpE,CAAC,CAAC,IAAI,CAAA;QACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/vercel.d.ts

@@ -14,7 +14,7 @@
  *
  * `ai@7.0.68` + `@ai-sdk/openai@4.0.43` were installed in a scratch directory
  * and `node_modules/ai/dist/index.d.ts` read directly (not inferred from
- * docs alone). The relevant types:
+ * docs alone); re-read unchanged on `ai@7.0.127`. The relevant types:
  *
  * ```ts
  * type ToolApprovalStatus =
@@ -66,7 +66,7 @@ import { type Gate } from './gate.js';
 /** Structural copy of `ai`'s `ToolApprovalStatus` — this package does not
  *  depend on `ai` at runtime, so the shape is declared here rather than
  *  imported. Confirmed field-for-field against `ai@7.0.68`'s
- *  `dist/index.d.ts` (see module doc). */
+ *  `dist/index.d.ts` (see module doc), unchanged in `ai@7.0.127`. */
 export type VercelToolApprovalStatus = undefined | 'not-applicable' | 'approved' | 'denied' | 'user-approval' | {
     type: 'not-applicable';
     reason?: undefined;
@@ -170,5 +170,5 @@ export declare function intuticProxyUrl(): string;
  */
 export declare function withIntuticProxy<TOptions extends {
     baseURL?: string;
-}, TProvider>(providerFactory: (options: TOptions) => TProvider, baseUrl?: string): (options: TOptions) => TProvider;
+} | undefined, TProvider>(providerFactory: (options: TOptions) => TProvider, baseUrl?: string): (options: TOptions) => TProvider;
 //# sourceMappingURL=vercel.d.ts.map

package/dist/vercel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../src/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAG3D;;;0CAG0C;AAC1C,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,eAAe,GACf;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAEjD;wEACwE;AACxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;CACf;AAED;;;;qCAIqC;AACrC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,cAAc,CAAA;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;8BAC8B;AAC9B,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,yBAAyB,KAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAA;AAEtC,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,0BAA+B,GAAG,kBAAkB,CAmB7F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,SAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,EACrC,SAAS,EACT,eAAe,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAGvG"}
+{"version":3,"file":"vercel.d.ts","sourceRoot":"","sources":["../src/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAE,MAAM,WAAW,CAAA;AAG3D;;;qEAGqE;AACrE,MAAM,MAAM,wBAAwB,GAChC,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,QAAQ,GACR,eAAe,GACf;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAA;CAAE,CAAA;AAEjD;wEACwE;AACxE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;CACf;AAED;;;;qCAIqC;AACrC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,cAAc,CAAA;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;8BAC8B;AAC9B,MAAM,MAAM,kBAAkB,GAAG,CAC/B,OAAO,EAAE,yBAAyB,KAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAA;AAEtC,MAAM,WAAW,0BAA0B;IACzC,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,0BAA+B,GAAG,kBAAkB,CAmB7F;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,gBAAgB,CAK9B,QAAQ,SAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACjD,SAAS,EACT,eAAe,EAAE,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAGvG"}

package/dist/vercel.js

@@ -14,7 +14,7 @@
  *
  * `ai@7.0.68` + `@ai-sdk/openai@4.0.43` were installed in a scratch directory
  * and `node_modules/ai/dist/index.d.ts` read directly (not inferred from
- * docs alone). The relevant types:
+ * docs alone); re-read unchanged on `ai@7.0.127`. The relevant types:
  *
  * ```ts
  * type ToolApprovalStatus =

package/dist/vercel.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../src/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAa,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AA6ChD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC,EAAE;IACvE,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,wEAAwE,CAC3E,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC,CAAA;YACnF,OAAO,gBAAgB,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAChD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,gBAAgB,CAG9B,eAAiD,EAAE,OAAgB;IACnE,MAAM,GAAG,GAAG,OAAO,IAAI,eAAe,EAAE,CAAA;IACxC,OAAO,CAAC,OAAiB,EAAa,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;AACxF,CAAC"}
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../src/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+DG;AAEH,OAAO,EAAE,MAAM,IAAI,UAAU,EAAa,MAAM,WAAW,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AA6ChD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC,EAAE;IACvE,OAAO,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,UAAU,EAAE,CAAA;QACnC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,wEAAwE,CAC3E,CAAA;QACH,CAAC;QACD,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC,CAAA;YACnF,OAAO,gBAAgB,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAA;YAChD,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAA;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,gBAAgB,CAO9B,eAAiD,EAAE,OAAgB;IACnE,MAAM,GAAG,GAAG,OAAO,IAAI,eAAe,EAAE,CAAA;IACxC,OAAO,CAAC,OAAiB,EAAa,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAA;AACxF,CAAC"}

package/dist/workflow.d.ts

@@ -1,6 +1,7 @@
 /**
- * `@ai-sdk/workflow` adapter: `intuticNeedsApproval()`, `withIntuticApproval()`,
- * `wrapWorkflowTools()`, and the FatalError-compatible `IntuticWorkflowRefusal`.
+ * `@ai-sdk/workflow` adapter: `withIntuticApproval()`, `intuticNeedsApproval()`,
+ * `intuticApprovalStep()`, `wrapWorkflowTools()`, and the FatalError-compatible
+ * `IntuticWorkflowRefusal`.
  *
  * `@intutic/gate/workflow` — the same idea `vercel.ts` implements for the base
  * `ai` package (wrap the framework's own veto point around this package's
@@ -9,10 +10,11 @@
  *
  * ## 1. The veto surface is per-tool `needsApproval`, not an agent option
  *
- * Confirmed against a real install (`@ai-sdk/workflow@1.0.69`):
- * `WorkflowAgent`/`WorkflowAgentOptions` carry ZERO approval fields — the
- * string `toolApproval` does not appear anywhere in the package's shipped
- * `.d.ts`. The veto surface is `needsApproval` (boolean | function) on the
+ * Confirmed against a real install (`@ai-sdk/workflow@1.0.69`, re-read on
+ * 2.0.58): `WorkflowAgent`/`WorkflowAgentOptions` carry NO approval-policy
+ * field — 1.x's shipped `.d.ts` never mentions `toolApproval`, and 2.x adds
+ * only `experimental_toolApprovalSecret`, an HMAC secret that signs approval
+ * requests so a replayed approval can be verified, not a veto. The veto surface is `needsApproval` (boolean | function) on the
  * TOOL definition, exactly as the framework's own workflow-agent docs
  * describe under "Tool Approval". The compiled agent loop confirms the
  * semantics (dist/index.js): `needsApproval == null` → no approval; a
@@ -22,9 +24,9 @@
  * later — so this framework, uniquely in this package, has a real
  * human-in-the-loop lane for the gate to route into.
  *
- * (`ai@7.0.68` marks tool-level `needsApproval` `@deprecated` in favour of
- * generateText-level `toolApproval` — but `@ai-sdk/workflow`'s OWN agent loop
- * reads the tool-level field and exposes no other veto surface, so it is the
+ * (`ai@7` — still in 7.0.127 — marks tool-level `needsApproval` `@deprecated`
+ * in favour of generateText-level `toolApproval` — but `@ai-sdk/workflow`'s
+ * OWN agent loop (1.x and 2.0.58 alike) reads the tool-level field and exposes no other veto surface, so it is the
  * correct — indeed the only — integration point here. Noted in the TD entry
  * this phase filed, so a future @ai-sdk/workflow release moving to the
  * generateText-shaped surface gets caught rather than silently ungated.)
@@ -33,11 +35,13 @@
  *
  * A durable workflow retries failed steps. Confirmed against real installs
  * (`workflow@4.8.3` re-exporting `@workflow/errors@4.2.1` via
- * `@workflow/core`): the runtime's retry/abort decision consults
- * `FatalError.is(err)` (`@workflow/core`'s `runtime/step-handler.js` — a
- * fatal error "bubbl[es] up to parent workflow"; anything else is retried
- * toward `maxAttempts`), and `FatalError.is()` DUCK-TYPES: it checks
- * `err.name === 'FatalError'` on any Error-shaped object, precisely because
+ * `@workflow/core`; re-read on `workflow@5.0.1` / `@workflow/errors@5.0.1`):
+ * the runtime's retry/abort decision consults `FatalError.is(err)`
+ * (`@workflow/core`'s `runtime/step-handler.js` in 4.x,
+ * `runtime/step-executor.js` in 5.x — a fatal error "bubbl[es] up to parent
+ * workflow"; anything else is retried toward `maxAttempts`), and
+ * `FatalError.is()` DUCK-TYPES: it checks `err.name === 'FatalError'` (5.x
+ * also accepts `err.fatal === true`) on any Error-shaped object, precisely because
  * workflows execute in a separate `vm` realm where `instanceof` fails across
  * the boundary. A plain `IntuticGateRefusal` thrown from `needsApproval` or a
  * tool body would therefore be RETRIED — a governance denial replayed on a
@@ -56,9 +60,44 @@
  * "no gate configured" case, which is deterministic and would fail every
  * retry identically) is made fatal.
  *
+ * ## 3. `needsApproval` runs in the workflow VM — the gate must run in a step
+ *
+ * Observed in a live run on the Workflow DevKit's local world (TD-498):
+ * `WorkflowAgent`'s loop runs inside the `"use workflow"` function, so it
+ * calls `needsApproval` in the workflow VM, which has no Node.js modules.
+ * `Gate` reads its policy snapshot with `node:fs`, so evaluating it there
+ * fails with `require is not defined` — and when the workflow bundle pulls
+ * `node:fs` in at module level, EVERY workflow sharing that bundle fails at
+ * load (observed with `workflow/nitro`).
+ *
+ * So the gate runs in a STEP, which has full Node.js and is durable. The
+ * caller declares one `"use step"` function in their own module — the
+ * directive must sit in a module the workflow bundler transforms, and the
+ * step's body must build/receive the `Gate` itself, because step arguments
+ * are serialized and a `Gate` instance is not serializable — whose body is
+ * {@link intuticApprovalStep}, and passes it as `{ step }`:
+ *
+ * ```ts
+ * export async function intuticGate(toolName: string, input: unknown) {
+ *   'use step'
+ *   return intuticApprovalStep(toolName, input, { gate: new Gate({ ... }) })
+ * }
+ * // in the workflow: tools: withIntuticApproval(tools, { step: intuticGate })
+ * ```
+ *
+ * With `{ step }`, the `needsApproval` this module builds only calls the step
+ * (a durable step invocation from the VM's point of view) and maps its
+ * boolean; nothing Node-only runs in the VM. This module itself is safe to
+ * import into workflow code: it imports nothing that touches Node.js
+ * (`errors.ts`, `registry.ts`, `wrapTools.ts`; `Gate` is a type-only
+ * import). Without `{ step }`, the gate is evaluated in-process, which still
+ * works wherever Node.js is available (inside a step, or any plain `ai`
+ * loop); called in the workflow VM it throws an {@link IntuticWorkflowRefusal}
+ * naming this fix instead of failing with `require is not defined`.
+ *
  * @module
  */
-import { type Gate } from './gate.js';
+import type { Gate } from './gate.js';
 import { IntuticGateRefusal } from './errors.js';
 import { type AnyFn, type ExecutableTool } from './wrapTools.js';
 /**
@@ -99,9 +138,15 @@ export interface WorkflowNeedsApprovalOptions {
  *  `ai`'s tool-level `needsApproval` (the surface `@ai-sdk/workflow`'s agent
  *  loop actually consults). */
 export type WorkflowNeedsApproval = (input: unknown, options: WorkflowNeedsApprovalOptions) => Promise<boolean>;
-export interface IntuticNeedsApprovalOptions {
-    /** Overrides the process-wide installed gate (`install(new Gate(...))`). */
-    gate?: Gate;
+/**
+ * The `"use step"` function the caller declares to run the gate (see module
+ * doc, section 3): called with the tool name and the call's input — both
+ * serializable — it resolves `true` when a human should approve the call and
+ * throws {@link IntuticWorkflowRefusal} when the gate blocks it. Its body is
+ * {@link intuticApprovalStep}.
+ */
+export type IntuticGateStep = (toolName: string, input: unknown) => Promise<boolean>;
+interface OnAllowOption {
     /**
      * What an ALLOWED call maps to. `needsApproval` answers "does a human need
      * to approve this?", which is a different question from "may this run?" —
@@ -119,30 +164,74 @@ export interface IntuticNeedsApprovalOptions {
      * the decision to a human approver as though the gate had no verdict, and
      * returning `false` would RUN the tool — the one thing a block must never
      * do.
+     *
+     * With `{ step }`, `'human'` here and the step's own answer are OR-ed:
+     * either one asking for a human is enough.
      */
     onAllow?: 'auto' | 'human';
 }
+export type IntuticNeedsApprovalOptions = (OnAllowOption & {
+    /**
+     * Evaluate the gate in this `"use step"` function — required when the
+     * `needsApproval` runs in the workflow VM, i.e. on a `WorkflowAgent`
+     * (see module doc, section 3). The step builds or receives its own
+     * `Gate`; a `gate` cannot be passed here, since the VM cannot hold one.
+     */
+    step: IntuticGateStep;
+    gate?: never;
+}) | (OnAllowOption & {
+    /** Evaluate in-process, Node.js only. Overrides the process-wide
+     *  installed gate (`install(new Gate(...))`). */
+    gate?: Gate;
+    step?: undefined;
+});
+/** Options for {@link intuticApprovalStep} — the in-process evaluation, so no
+ *  `step`. */
+export type IntuticApprovalStepOptions = OnAllowOption & {
+    gate?: Gate;
+};
 /**
- * Build an async `needsApproval` function for ONE workflow tool:
+ * The gate evaluation for ONE call, written to be the body of the caller's
+ * `"use step"` function (see module doc, section 3):
  *
  * ```ts
- * import { WorkflowAgent } from '@ai-sdk/workflow'
- * import { Gate, install } from '@intutic/gate'
- * import { intuticNeedsApproval } from '@intutic/gate/workflow'
- *
- * install(new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }))
- *
- * const agent = new WorkflowAgent({
- *   model,
- *   tools: {
- *     deployService: {
- *       description: '...',
- *       inputSchema,
- *       execute: deployStep,
- *       needsApproval: intuticNeedsApproval('deployService'),
- *     },
- *   },
- * })
+ * // workflows/intutic-gate.ts
+ * import { Gate } from '@intutic/gate'
+ * import { intuticApprovalStep } from '@intutic/gate/workflow'
+ *
+ * export async function intuticGate(toolName: string, input: unknown): Promise<boolean> {
+ *   'use step'
+ *   return intuticApprovalStep(toolName, input, {
+ *     gate: new Gate({ workspaceId: process.env.INTUTIC_WORKSPACE_ID }),
+ *   })
+ * }
+ * ```
+ *
+ * Reference `@intutic/gate` only inside step bodies in that module: the
+ * workflow bundler also bundles it into the VM with the step bodies
+ * replaced, and a module-level use would keep the Node-only gate there.
+ *
+ * Verdict mapping: BLOCK → throws {@link IntuticWorkflowRefusal} (fatal — the
+ * step runs once and the run fails instead of retry-looping; see module doc);
+ * ALLOW → `false`, or `true` with `onAllow: 'human'`. A non-refusal crash in
+ * the gate is re-thrown untouched (the step retries — correct for
+ * transients). Requires a gate (`{ gate }` or `install()` in the process
+ * that runs steps); called in the workflow VM itself, it throws naming the
+ * fix.
+ */
+export declare function intuticApprovalStep(toolName: string, input: unknown, opts?: IntuticApprovalStepOptions): Promise<boolean>;
+/**
+ * Build an async `needsApproval` function for ONE workflow tool. On a
+ * `WorkflowAgent`, pass the caller's gate step (see
+ * {@link intuticApprovalStep}):
+ *
+ * ```ts
+ * deployService: {
+ *   description: '...',
+ *   inputSchema,
+ *   execute: deployStep,
+ *   needsApproval: intuticNeedsApproval('deployService', { step: intuticGate }),
+ * },
  * ```
  *
  * The tool name is a parameter because the framework's `needsApproval`
@@ -151,6 +240,12 @@ export interface IntuticNeedsApprovalOptions {
  * {@link withIntuticApproval} to attach this to a whole tools record without
  * hand-repeating each name.
  *
+ * With `{ step }`, the returned function only calls the step and maps its
+ * answer — safe in the workflow VM. Without it, the gate is evaluated
+ * in-process (`{ gate }` or the installed gate), which needs Node.js: fine in
+ * a plain `ai` loop or inside a step, and in the workflow VM it throws an
+ * {@link IntuticWorkflowRefusal} naming the `{ step }` fix.
+ *
  * Verdict mapping: BLOCK → throws {@link IntuticWorkflowRefusal} (fatal —
  * aborts instead of retry-looping; see module doc); ALLOW → `false` or `true`
  * per `onAllow`. A non-refusal crash in the gate is re-thrown untouched
@@ -169,13 +264,29 @@ export interface WorkflowToolLike {
  * `needsApproval` the tool already declares:
  *
  * ```ts
- * const agent = new WorkflowAgent({ model, tools: withIntuticApproval(tools) })
+ * import { WorkflowAgent } from '@ai-sdk/workflow'
+ * import { withIntuticApproval } from '@intutic/gate/workflow'
+ * import { intuticGate } from './intutic-gate' // the "use step" function
+ *
+ * export async function deployAgent(messages: ModelMessage[]) {
+ *   'use workflow'
+ *   const agent = new WorkflowAgent({
+ *     model,
+ *     tools: withIntuticApproval(tools, { step: intuticGate }),
+ *   })
+ *   // ...
+ * }
  * ```
  *
+ * (`{ step }` is what makes this work on a `WorkflowAgent`, whose
+ * `needsApproval` runs in the workflow VM — see {@link intuticApprovalStep}
+ * and the module doc, section 3. Without it the gate is evaluated
+ * in-process, which needs Node.js.)
+ *
  * For each tool (the record KEY is the tool name reported to the gate — the
  * same identity the framework itself dispatches on):
  *
- *   1. `Gate.guard()` runs first. BLOCK throws {@link IntuticWorkflowRefusal}.
+ *   1. The gate runs first. BLOCK throws {@link IntuticWorkflowRefusal}.
  *   2. On allow, the tool's OWN prior `needsApproval` still applies: a
  *      boolean is returned as-is; a function is awaited with the original
  *      arguments; a tool with none falls back to `onAllow` ('auto' → false).
@@ -198,7 +309,9 @@ export declare function withIntuticApproval<T extends Record<string, WorkflowToo
  * "no gate configured" handling and the record-key-is-tool-name convention —
  * is `wrapTools`'s own behaviour, reused rather than reimplemented.
  *
- * Prefer {@link withIntuticApproval} as the primary integration: it uses the
+ * Call it inside the tool's `"use step"` body (it evaluates the gate
+ * in-process, so it needs Node.js). Prefer {@link withIntuticApproval} as the
+ * primary integration: it uses the
  * framework's own pre-execution veto surface, refuses BEFORE the durable
  * step ever starts, and keeps the human-approval lane available. This
  * execute-level wrapper is defense in depth (or the option for callers whose
@@ -206,4 +319,5 @@ export declare function withIntuticApproval<T extends Record<string, WorkflowToo
  * the call, which is harmless but emits duplicate gate telemetry.
  */
 export declare function wrapWorkflowTools<T extends AnyFn | ExecutableTool>(tools: Record<string, T>, gate?: Gate): Record<string, T>;
+export {};
 //# sourceMappingURL=workflow.d.ts.map

package/dist/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,EAAwB,KAAK,IAAI,EAAkB,MAAM,WAAW,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EAAa,KAAK,KAAK,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,SAAgB,KAAK,EAAG,IAAI,CAAS;gBACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;IAK7D,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,sBAAsB;IAIhE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CASnC;AAED;;;;qEAIqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;+BAE+B;AAC/B,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB,MAAM,WAAW,2BAA2B;IAC1C,4EAA4E;IAC5E,IAAI,CAAC,EAAE,IAAI,CAAA;IACX;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAyBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,2BAAgC,GACrC,qBAAqB,CAcvB;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,CAAA;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE,2BAAgC,GACrC,CAAC,CAiBH;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAWnB"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../src/workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkGG;AAKH,OAAO,KAAK,EAAE,IAAI,EAAa,MAAM,WAAW,CAAA;AAChD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAEhD,OAAO,EAAa,KAAK,KAAK,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,kBAAkB;IAC5D,SAAgB,KAAK,EAAG,IAAI,CAAS;gBACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;IAK7D,uEAAuE;IACvE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,sBAAsB;IAIhE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CASnC;AAED;;;;qEAIqE;AACrE,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;+BAE+B;AAC/B,MAAM,MAAM,qBAAqB,GAAG,CAClC,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAEpF,UAAU,aAAa;IACrB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAC3B;AAED,MAAM,MAAM,2BAA2B,GACnC,CAAC,aAAa,GAAG;IACf;;;;;OAKG;IACH,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,CAAC,GACF,CAAC,aAAa,GAAG;IACf;qDACiD;IACjD,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,IAAI,CAAC,EAAE,SAAS,CAAA;CACjB,CAAC,CAAA;AAEN;cACc;AACd,MAAM,MAAM,0BAA0B,GAAG,aAAa,GAAG;IAAE,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE,CAAA;AAiDxE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,0BAA+B,GACpC,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE,2BAAgC,GACrC,qBAAqB,CAYvB;AAED;;mDAEmD;AACnD,MAAM,WAAW,gBAAgB;IAC/B,aAAa,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,KAAK,OAAO,CAAC,CAAA;IACrE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5E,KAAK,EAAE,CAAC,EACR,IAAI,GAAE,2BAAgC,GACrC,CAAC,CAiBH;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,KAAK,GAAG,cAAc,EAChE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,EAAE,IAAI,GACV,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAWnB"}