@kindgi/guardrails 0.0.0-bootstrap.0 → 0.1.1

package/dist/engine.d.ts

@@ -0,0 +1,49 @@
+import type { GuardrailError, JudgeMissingError, ScopeMismatchError } from './errors.js';
+import { type ExecutionStrategy } from './execution-strategy.js';
+import type { CheckRegistry, EvaluationBindings, EvaluationResult, Guardrail, RunTrace } from './types.js';
+/** Expose the built-in registry so callers can extend it with adapter strategies. */
+export declare function builtInStrategies(): readonly ExecutionStrategy[];
+/**
+ * Evaluate one guardrail against a run trace. Handles:
+ *   - Scope check (mode + agent + flow + tenant filters).
+ *   - Dispatch by `kind` through `bindings.strategies` (or the built-ins):
+ *     zero-llm → check.evaluate; llm-judge → invokeJudge; external → an
+ *     `invalid-guardrail` error unless the caller registered its own
+ *     `external` strategy.
+ *   - Action derivation from `guardrail.action.on-violation`.
+ *   - Compliance evidence emission on violation (if bindings.compliance
+ *     is set and the trace carries a `projectId`).
+ *   - Action-handler invocation on violation (if bindings.actions is set);
+ *     an action with no registered handler returns `unknown-action`.
+ *
+ * Returns:
+ *   - `{ kind: 'ok', value: EvaluationResult }` — guardrail applied + evaluated.
+ *   - `{ kind: 'skip', reason }` — guardrail didn't apply (scope mismatch).
+ *   - `{ kind: 'err', error }` — evaluation failed (unknown kind or check,
+ *     judge missing or unroutable), or the violation's action has no
+ *     handler in `bindings.actions` (`unknown-action`, after the violation
+ *     was recorded).
+ */
+export type EvaluationOutcome = {
+    readonly kind: 'ok';
+    readonly value: EvaluationResult;
+} | {
+    readonly kind: 'skip';
+    readonly reason: ScopeMismatchError;
+} | {
+    readonly kind: 'err';
+    readonly error: GuardrailError | JudgeMissingError;
+};
+export declare function evaluateGuardrail(guardrail: Guardrail, checks: CheckRegistry, trace: RunTrace, bindings?: EvaluationBindings): Promise<EvaluationOutcome>;
+/**
+ * Evaluate every guardrail in the list against a trace. Order-independent —
+ * each check is a pure function over the trace. Returns one outcome per
+ * guardrail.
+ */
+export declare function evaluateAll(guardrails: readonly Guardrail[], checks: CheckRegistry, trace: RunTrace, bindings?: EvaluationBindings): Promise<readonly EvaluationOutcome[]>;
+/**
+ * Extract only the violations from a batch of outcomes — convenience for
+ * callers that want to apply enforcement actions.
+ */
+export declare function violations(outcomes: readonly EvaluationOutcome[]): readonly EvaluationResult[];
+//# sourceMappingURL=engine.d.ts.map

package/dist/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,KAAK,iBAAiB,EAMvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EACV,aAAa,EAEb,kBAAkB,EAClB,gBAAgB,EAChB,SAAS,EACT,QAAQ,EAET,MAAM,YAAY,CAAC;AAqBpB,qFAAqF;AACrF,wBAAgB,iBAAiB,IAAI,SAAS,iBAAiB,EAAE,CAEhE;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC9D;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAEjF,wBAAsB,iBAAiB,CACrC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,QAAQ,EACf,QAAQ,GAAE,kBAAuB,GAChC,OAAO,CAAC,iBAAiB,CAAC,CA0G5B;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,UAAU,EAAE,SAAS,SAAS,EAAE,EAChC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,QAAQ,EACf,QAAQ,GAAE,kBAAuB,GAChC,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAEvC;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,GAAG,SAAS,gBAAgB,EAAE,CAM9F"}

package/dist/engine.js

@@ -0,0 +1,198 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { createExecutionStrategyRegistry, externalStrategy, makeLlmJudgeStrategy, zeroLlmStrategy, } from './execution-strategy.js';
+import { invokeJudge } from './judge.js';
+/**
+ * Default strategy registry seeded with the built-ins (`zero-llm`,
+ * `llm-judge`, `external`). Cached so repeated `evaluateGuardrail`
+ * calls don't reinstantiate the registry.
+ */
+let defaultRegistry;
+function getDefaultStrategyRegistry() {
+    if (defaultRegistry === undefined) {
+        defaultRegistry = createExecutionStrategyRegistry([
+            zeroLlmStrategy,
+            makeLlmJudgeStrategy((config, capability, trace, bindings) => invokeJudge(config, capability, trace, bindings)),
+            externalStrategy,
+        ]);
+    }
+    return defaultRegistry;
+}
+/** Expose the built-in registry so callers can extend it with adapter strategies. */
+export function builtInStrategies() {
+    return getDefaultStrategyRegistry().list();
+}
+export async function evaluateGuardrail(guardrail, checks, trace, bindings = {}) {
+    const scope = checkScope(guardrail, trace);
+    if (scope !== null)
+        return { kind: 'skip', reason: scope };
+    // Check-registry lookup is delegated to each strategy — `zero-llm`
+    // resolves the check inside its evaluate; strategies like
+    // `sandbox-code` or `external` don't consult the CheckRegistry at
+    // all. Keeps the engine strategy-agnostic.
+    const strategies = bindings.strategies ?? getDefaultStrategyRegistry();
+    const strategy = strategies.get(guardrail.kind);
+    if (strategy === undefined) {
+        return {
+            kind: 'err',
+            error: {
+                code: 'invalid-guardrail',
+                message: `Guardrail "${guardrail.id}" declares unknown kind "${guardrail.kind}" — no execution strategy registered`,
+                issues: [{ path: '/kind', message: `unknown kind: ${guardrail.kind}` }],
+            },
+        };
+    }
+    const strategyOutcome = await strategy.evaluate(guardrail, checks, trace, bindings);
+    if (strategyOutcome.kind === 'err') {
+        const err = strategyOutcome.error;
+        return {
+            kind: 'err',
+            error: {
+                code: err.code,
+                message: err.message,
+                ...(err.issues !== undefined && { issues: err.issues }),
+                guardrailId: guardrail.id,
+            },
+        };
+    }
+    const result = strategyOutcome.value;
+    const action = result.passed
+        ? 'noop'
+        : guardrail.action['on-violation'];
+    const severity = guardrail.severity ?? 'error';
+    const evaluation = {
+        guardrailId: guardrail.id,
+        result,
+        action,
+        severity,
+        at: new Date().toISOString(),
+    };
+    if (!result.passed && bindings.compliance !== undefined && trace.projectId !== undefined) {
+        // Compliance emit needs `projectId` (every evidence record is
+        // project-scoped). Skip emit when the trace carries no project
+        // scope.
+        await bindings.compliance.emit({
+            tenantId: trace.tenantId,
+            projectId: trace.projectId,
+            kind: 'guardrail-violation',
+            outcome: 'failed',
+            payload: {
+                version: 1,
+                guardrailId: guardrail.id,
+                guardrailName: guardrail.name,
+                checkId: guardrail.check,
+                checkKind: guardrail.kind,
+                severity,
+                action: guardrail.action['on-violation'],
+                reason: result.reason,
+                judgeResponse: result.judgeResponse,
+                attributes: result.attributes,
+            },
+            ...(trace.runId !== undefined && {
+                provenanceRef: { runId: trace.runId },
+            }),
+        });
+    }
+    // Invoke the registered action handler. Handler errors are logged into
+    // the evaluation attributes but don't roll back the evaluation itself —
+    // the violation is still recorded. `on-violation` is an open string, so
+    // an action nobody registered a handler for fails here, by name.
+    if (bindings.actions !== undefined && !result.passed) {
+        const handler = bindings.actions.get(action);
+        if (handler === undefined) {
+            return {
+                kind: 'err',
+                error: {
+                    code: 'unknown-action',
+                    message: `Guardrail "${guardrail.id}" fired action "${action}", but no action handler is registered for it`,
+                    guardrailId: guardrail.id,
+                    action,
+                },
+            };
+        }
+        const applied = await handler.apply({ guardrail, evaluation, trace });
+        if (applied.kind === 'err') {
+            // Attach handler error to the evaluation attributes; don't fail.
+            evaluation.result = {
+                ...evaluation.result,
+                attributes: {
+                    ...(evaluation.result.attributes ?? {}),
+                    actionHandlerError: applied.error,
+                },
+            };
+        }
+    }
+    return { kind: 'ok', value: evaluation };
+}
+/**
+ * Evaluate every guardrail in the list against a trace. Order-independent —
+ * each check is a pure function over the trace. Returns one outcome per
+ * guardrail.
+ */
+export async function evaluateAll(guardrails, checks, trace, bindings = {}) {
+    return Promise.all(guardrails.map((inv) => evaluateGuardrail(inv, checks, trace, bindings)));
+}
+/**
+ * Extract only the violations from a batch of outcomes — convenience for
+ * callers that want to apply enforcement actions.
+ */
+export function violations(outcomes) {
+    const out = [];
+    for (const o of outcomes) {
+        if (o.kind === 'ok' && !o.value.result.passed)
+            out.push(o.value);
+    }
+    return out;
+}
+function checkScope(guardrail, trace) {
+    const scope = guardrail.scope ?? {};
+    const when = scope.when ?? 'always';
+    if (when === 'ci-only' && trace.mode !== 'ci') {
+        return {
+            code: 'scope-mismatch',
+            message: `guardrail "${guardrail.id}" is ci-only`,
+            guardrailId: guardrail.id,
+            reason: 'wrong-mode',
+        };
+    }
+    if (when === 'runtime-only' && trace.mode !== 'runtime') {
+        return {
+            code: 'scope-mismatch',
+            message: `guardrail "${guardrail.id}" is runtime-only`,
+            guardrailId: guardrail.id,
+            reason: 'wrong-mode',
+        };
+    }
+    if (scope.agents !== undefined &&
+        scope.agents.length > 0 &&
+        (trace.agentId === undefined || !scope.agents.includes(trace.agentId))) {
+        return {
+            code: 'scope-mismatch',
+            message: `guardrail "${guardrail.id}" does not apply to agent ${String(trace.agentId)}`,
+            guardrailId: guardrail.id,
+            reason: 'wrong-agent',
+        };
+    }
+    if (scope.flows !== undefined &&
+        scope.flows.length > 0 &&
+        (trace.flowId === undefined || !scope.flows.includes(trace.flowId))) {
+        return {
+            code: 'scope-mismatch',
+            message: `guardrail "${guardrail.id}" does not apply to flow ${String(trace.flowId)}`,
+            guardrailId: guardrail.id,
+            reason: 'wrong-flow',
+        };
+    }
+    if (scope.tenants !== undefined &&
+        scope.tenants.length > 0 &&
+        !scope.tenants.includes(trace.tenantId)) {
+        return {
+            code: 'scope-mismatch',
+            message: `guardrail "${guardrail.id}" does not apply to tenant ${trace.tenantId}`,
+            guardrailId: guardrail.id,
+            reason: 'wrong-tenant',
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=engine.js.map

package/dist/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAKjC,OAAO,EAGL,+BAA+B,EAC/B,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAuB,WAAW,EAAE,MAAM,YAAY,CAAC;AAW9D;;;;GAIG;AACH,IAAI,eAAsD,CAAC;AAC3D,SAAS,0BAA0B;IACjC,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,eAAe,GAAG,+BAA+B,CAAC;YAChD,eAAe;YACf,oBAAoB,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CAC3D,WAAW,CAAC,MAAwB,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,CACnE;YACD,gBAAgB;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,0BAA0B,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AA4BD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,SAAoB,EACpB,MAAqB,EACrB,KAAe,EACf,WAA+B,EAAE;IAEjC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAE3D,mEAAmE;IACnE,0DAA0D;IAC1D,kEAAkE;IAClE,2CAA2C;IAE3C,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,IAAI,0BAA0B,EAAE,CAAC;IACvE,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,4BAA4B,SAAS,CAAC,IAAI,sCAAsC;gBACnH,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;aACxE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACpF,IAAI,eAAe,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACvD,WAAW,EAAE,SAAS,CAAC,EAAE;aACY;SACxC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAgB,eAAe,CAAC,KAAK,CAAC;IAElD,MAAM,MAAM,GAA+B,MAAM,CAAC,MAAM;QACtD,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC/C,MAAM,UAAU,GAAqB;QACnC,WAAW,EAAE,SAAS,CAAC,EAAE;QACzB,MAAM;QACN,MAAM;QACN,QAAQ;QACR,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAe;KAC1C,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACzF,8DAA8D;QAC9D,+DAA+D;QAC/D,SAAS;QACT,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,QAAQ;YACjB,OAAO,EAAE;gBACP,OAAO,EAAE,CAAC;gBACV,WAAW,EAAE,SAAS,CAAC,EAAE;gBACzB,aAAa,EAAE,SAAS,CAAC,IAAI;gBAC7B,OAAO,EAAE,SAAS,CAAC,KAAK;gBACxB,SAAS,EAAE,SAAS,CAAC,IAAI;gBACzB,QAAQ;gBACR,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;gBACxC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B;YACD,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI;gBAC/B,aAAa,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;aACtC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,gBAAgB;oBACtB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,mBAAmB,MAAM,+CAA+C;oBAC3G,WAAW,EAAE,SAAS,CAAC,EAAE;oBACzB,MAAM;iBACP;aACF,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,iEAAiE;YAChE,UAAsC,CAAC,MAAM,GAAG;gBAC/C,GAAG,UAAU,CAAC,MAAM;gBACpB,UAAU,EAAE;oBACV,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;oBACvC,kBAAkB,EAAE,OAAO,CAAC,KAAK;iBAClC;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAgC,EAChC,MAAqB,EACrB,KAAe,EACf,WAA+B,EAAE;IAEjC,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAsC;IAC/D,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,UAAU,CAAC,SAAoB,EAAE,KAAe;IACvD,MAAM,KAAK,GAAU,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,cAAc;YACjD,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACxD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,mBAAmB;YACtD,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,MAAM,KAAK,SAAS;QAC1B,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EACtE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,6BAA6B,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;YACvF,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,KAAK,KAAK,SAAS;QACzB,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EACnE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,4BAA4B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;YACrF,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM,EAAE,YAAY;SACrB,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;QAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EACvC,CAAC;QACD,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,8BAA8B,KAAK,CAAC,QAAQ,EAAE;YACjF,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,MAAM,EAAE,cAAc;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,91 @@
+import type { GuardrailId } from '@kindgi/types';
+/**
+ * Errors emitted by @kindgi/guardrails. Every variant carries a `code`
+ * for pattern matching; messages are human-readable, not API contract.
+ */
+export type GuardrailError = InvalidGuardrailError | InvalidCheckDefinitionError | UnknownCheckError | InvalidCheckConfigError | JudgeMissingError | JudgeRoutingError | ScopeMismatchError | UnknownActionError;
+/**
+ * The judge model couldn't be routed via `@kindgi/capabilities`. Wraps
+ * the underlying capability error (usually `capability-unsatisfiable` —
+ * no registered provider matches the judge's declared capability).
+ */
+export interface JudgeRoutingError {
+    readonly code: 'judge-routing-failed';
+    readonly message: string;
+    readonly guardrailId: GuardrailId;
+    readonly cause: unknown;
+}
+/**
+ * The declaration is invalid. From `defineGuardrail` /
+ * `validateGuardrailSpec`: it fails the schema, or (`defineGuardrail`)
+ * its registered check has another kind. From the engine: its kind has
+ * no registered strategy, it is `llm-judge` without `judgeCapabilities`,
+ * or it is `external` and only the built-in `external` strategy is
+ * registered.
+ */
+export interface InvalidGuardrailError {
+    readonly code: 'invalid-guardrail';
+    readonly message: string;
+    readonly issues: readonly {
+        readonly path: string;
+        readonly message: string;
+    }[];
+}
+/** The guardrail references a check id that isn't registered. */
+export interface UnknownCheckError {
+    readonly code: 'unknown-check';
+    readonly message: string;
+    readonly guardrailId: GuardrailId;
+    readonly checkId: string;
+}
+/**
+ * The guardrail fired an action that no handler in
+ * `EvaluationBindings.actions` handles. `on-violation` is an open
+ * string, so an unknown name is accepted at define time and surfaces
+ * here, when the guardrail fires. The violation itself was already
+ * recorded (and compliance evidence emitted) before the lookup.
+ */
+export interface UnknownActionError {
+    readonly code: 'unknown-action';
+    readonly message: string;
+    readonly guardrailId: GuardrailId;
+    readonly action: string;
+}
+/** The guardrail's `config` failed the check's own validator. */
+export interface InvalidCheckConfigError {
+    readonly code: 'invalid-check-config';
+    readonly message: string;
+    readonly guardrailId: GuardrailId;
+    readonly reason: string;
+}
+/**
+ * `defineCheck` couldn't build the check — either the supplied Zod
+ * schema failed to convert via `z.toJSONSchema()`, or the resulting
+ * JSON Schema failed to compile as Draft 2020-12.
+ */
+export interface InvalidCheckDefinitionError {
+    readonly code: 'invalid-check-definition';
+    readonly message: string;
+    readonly checkId: string;
+    readonly cause: unknown;
+}
+/**
+ * An `llm-judge` guardrail was evaluated without the required bindings
+ * (providerRegistry or judgeProvider). Runtime-only error.
+ */
+export interface JudgeMissingError {
+    readonly code: 'judge-missing';
+    readonly message: string;
+    readonly guardrailId: GuardrailId;
+}
+/**
+ * Not really an error — surfaced so callers can distinguish "guardrail
+ * didn't apply to this trace" from "guardrail applied and passed."
+ */
+export interface ScopeMismatchError {
+    readonly code: 'scope-mismatch';
+    readonly message: string;
+    readonly guardrailId: GuardrailId;
+    readonly reason: 'wrong-mode' | 'wrong-agent' | 'wrong-flow' | 'wrong-tenant';
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjD;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB,qBAAqB,GACrB,2BAA2B,GAC3B,iBAAiB,GACjB,uBAAuB,GACvB,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjF;AAED,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,0BAA0B,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,aAAa,GAAG,YAAY,GAAG,cAAc,CAAC;CAC/E"}

package/dist/errors.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/execution-strategy.d.ts

@@ -0,0 +1,80 @@
+import type { Capability } from '@kindgi/capabilities';
+import type { CheckRegistry, CheckResult, EvaluationBindings, Guardrail, RunTrace } from './types.js';
+/**
+ * A strategy that knows how to evaluate one `Guardrail.kind`. Registered
+ * once at boot; the engine dispatches by looking up `guardrail.kind`
+ * against the strategy registry.
+ *
+ * Built-in strategies: `zero-llm` (delegates to `CheckRegistry`),
+ * `llm-judge` (routes through capabilities + `invokeJudge`), and
+ * `external` (returns an "evaluated elsewhere" error).
+ *
+ * Adapter packages register their own strategies without touching the
+ * engine — e.g. a strategy that runs check code in a sandbox, or one
+ * that delegates to an external policy engine.
+ */
+export interface ExecutionStrategy {
+    readonly kind: string;
+    /** Human-friendly name for diagnostics. */
+    readonly name?: string;
+    /**
+     * Evaluate one guardrail against a trace. Returns the CheckResult the
+     * engine finalizes into an EvaluationResult; or an error object shaped
+     * to be surfaced directly.
+     */
+    evaluate(guardrail: Guardrail, checks: CheckRegistry, trace: RunTrace, bindings: EvaluationBindings): Promise<StrategyResult>;
+}
+/**
+ * Discriminated result a strategy returns. `ok` produces a CheckResult;
+ * `err` surfaces a structured error with a JSON-Pointer-style path so
+ * the engine can attach it to the guardrail id it came from.
+ */
+export type StrategyResult = {
+    readonly kind: 'ok';
+    readonly value: CheckResult;
+} | {
+    readonly kind: 'err';
+    readonly error: StrategyError;
+};
+export interface StrategyError {
+    /** Discriminant matching the engine's GuardrailError union or a sub-code. */
+    readonly code: string;
+    readonly message: string;
+    readonly issues?: readonly {
+        readonly path: string;
+        readonly message: string;
+    }[];
+    /** Filled in by the engine — the guardrail id currently evaluating. */
+    readonly guardrailId?: string;
+}
+/**
+ * Registry the engine consults at dispatch time. Register once; every
+ * subsequent `evaluateGuardrail` call sees the additional strategy.
+ */
+export interface ExecutionStrategyRegistry {
+    register(strategy: ExecutionStrategy): void;
+    get(kind: string): ExecutionStrategy | undefined;
+    list(): readonly ExecutionStrategy[];
+}
+export declare function createExecutionStrategyRegistry(seed?: readonly ExecutionStrategy[]): ExecutionStrategyRegistry;
+/** `zero-llm` — delegate to the registered `Check` via CheckRegistry. */
+export declare const zeroLlmStrategy: ExecutionStrategy;
+/**
+ * `external` — placeholder for guardrails evaluated by an external
+ * service: it always returns an `invalid-guardrail` error. Callers that
+ * want external evaluation register their own `external` strategy that
+ * routes to their service.
+ */
+export declare const externalStrategy: ExecutionStrategy;
+/**
+ * Factory for the built-in `llm-judge` strategy. Takes the judge
+ * function as a parameter so this module does not import judge.ts; the
+ * engine passes `invokeJudge`.
+ */
+export declare function makeLlmJudgeStrategy(invokeJudge: (config: unknown, capability: Capability, trace: RunTrace, bindings: EvaluationBindings) => Promise<CheckResult | {
+    readonly error: {
+        readonly code: string;
+        readonly message: string;
+    };
+}>): ExecutionStrategy;
+//# sourceMappingURL=execution-strategy.d.ts.map

package/dist/execution-strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-strategy.d.ts","sourceRoot":"","sources":["../src/execution-strategy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,KAAK,EACV,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,SAAS,EACT,QAAQ,EACT,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CACN,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjF,uEAAuE;IACvE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;IACjD,IAAI,IAAI,SAAS,iBAAiB,EAAE,CAAC;CACtC;AAED,wBAAgB,+BAA+B,CAC7C,IAAI,GAAE,SAAS,iBAAiB,EAAO,GACtC,yBAAyB,CAc3B;AAID,yEAAyE;AACzE,eAAO,MAAM,eAAe,EAAE,iBAkB7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,iBAmB9B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,CACX,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,kBAAkB,KACzB,OAAO,CACV,WAAW,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CACtF,GACA,iBAAiB,CA8BnB"}

package/dist/execution-strategy.js

@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export function createExecutionStrategyRegistry(seed = []) {
+    const strategies = new Map();
+    for (const s of seed)
+        strategies.set(s.kind, s);
+    return {
+        register(strategy) {
+            strategies.set(strategy.kind, strategy);
+        },
+        get(kind) {
+            return strategies.get(kind);
+        },
+        list() {
+            return [...strategies.values()];
+        },
+    };
+}
+// ============ built-in strategies ============
+/** `zero-llm` — delegate to the registered `Check` via CheckRegistry. */
+export const zeroLlmStrategy = {
+    kind: 'zero-llm',
+    name: 'Zero-LLM check',
+    async evaluate(guardrail, checks, trace, bindings) {
+        const check = checks.get(guardrail.check);
+        if (check === undefined) {
+            return {
+                kind: 'err',
+                error: {
+                    code: 'unknown-check',
+                    message: `Guardrail "${guardrail.id}" references unregistered check "${guardrail.check}"`,
+                },
+            };
+        }
+        const config = (guardrail.config ?? {});
+        const result = await check.evaluate(config, trace, bindings);
+        return { kind: 'ok', value: result };
+    },
+};
+/**
+ * `external` — placeholder for guardrails evaluated by an external
+ * service: it always returns an `invalid-guardrail` error. Callers that
+ * want external evaluation register their own `external` strategy that
+ * routes to their service.
+ */
+export const externalStrategy = {
+    kind: 'external',
+    name: 'External (not implemented at engine layer)',
+    async evaluate() {
+        return {
+            kind: 'err',
+            error: {
+                code: 'invalid-guardrail',
+                message: 'external-kind guardrails are evaluated outside the engine — register an execution strategy for kind `external`',
+                issues: [
+                    {
+                        path: '/kind',
+                        message: 'external kind requires a caller-registered execution strategy',
+                    },
+                ],
+            },
+        };
+    },
+};
+/**
+ * Factory for the built-in `llm-judge` strategy. Takes the judge
+ * function as a parameter so this module does not import judge.ts; the
+ * engine passes `invokeJudge`.
+ */
+export function makeLlmJudgeStrategy(invokeJudge) {
+    return {
+        kind: 'llm-judge',
+        name: 'LLM judge',
+        async evaluate(guardrail, _checks, trace, bindings) {
+            if (guardrail.judgeCapabilities === undefined) {
+                return {
+                    kind: 'err',
+                    error: {
+                        code: 'invalid-guardrail',
+                        message: `llm-judge guardrail "${guardrail.id}" missing judgeCapabilities`,
+                        issues: [{ path: '/judgeCapabilities', message: 'required for kind=llm-judge' }],
+                    },
+                };
+            }
+            const judged = await invokeJudge(guardrail.config ?? {}, guardrail.judgeCapabilities, trace, bindings);
+            if ('error' in judged) {
+                return {
+                    kind: 'err',
+                    error: { code: judged.error.code, message: judged.error.message },
+                };
+            }
+            return { kind: 'ok', value: judged };
+        },
+    };
+}
+//# sourceMappingURL=execution-strategy.js.map

package/dist/execution-strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution-strategy.js","sourceRoot":"","sources":["../src/execution-strategy.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAsEjC,MAAM,UAAU,+BAA+B,CAC7C,OAAqC,EAAE;IAEvC,MAAM,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IACxD,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO;QACL,QAAQ,CAAC,QAAQ;YACf,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC;QACD,GAAG,CAAC,IAAI;YACN,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI;YACF,OAAO,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gDAAgD;AAEhD,yEAAyE;AACzE,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,gBAAgB;IACtB,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,cAAc,SAAS,CAAC,EAAE,oCAAoC,SAAS,CAAC,KAAK,GAAG;iBAC1F;aACF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAsC,CAAC;QAC7E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,4CAA4C;IAClD,KAAK,CAAC,QAAQ;QACZ,OAAO;YACL,IAAI,EAAE,KAAK;YACX,KAAK,EAAE;gBACL,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,gHAAgH;gBAClH,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,+DAA+D;qBACzE;iBACF;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAOC;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,WAAW;QACjB,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ;YAChD,IAAI,SAAS,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC9C,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE;wBACL,IAAI,EAAE,mBAAmB;wBACzB,OAAO,EAAE,wBAAwB,SAAS,CAAC,EAAE,6BAA6B;wBAC1E,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;qBACjF;iBACF,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAC9B,SAAS,CAAC,MAAM,IAAI,EAAE,EACtB,SAAS,CAAC,iBAAiB,EAC3B,KAAK,EACL,QAAQ,CACT,CAAC;YACF,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;gBACtB,OAAO;oBACL,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}