@nodetool-ai/runtime 0.7.0-rc.22 → 0.8.1

package/dist/providers/safe-url.d.ts

@@ -0,0 +1,70 @@
+/**
+ * SSRF guard for outbound fetches of caller-supplied URLs, and the one address
+ * table every screening surface in the repo reads.
+ *
+ * Image/video providers (FAL, Replicate, …) return result URLs that the server
+ * then `fetch`es to download the generated bytes. Those URLs originate from the
+ * provider's response, so without validation a compromised or misbehaving
+ * provider — or a response coerced via a crafted prompt — could point the
+ * server at internal services (`http://169.254.169.254/...`,
+ * `http://localhost:6379/...`, RFC1918 hosts, …). The same is true of a media
+ * ref a workflow carries and of a URL a model hands a tool.
+ *
+ * Two things live here, and the split matters. {@link isBlockedIpLiteral} is
+ * the **address table** — which literals are internal — shared with the sandbox
+ * fetch bridge (`packages/agents/src/network-guard.ts`), which allows plain
+ * http and an opt-in private mode that this module never does.
+ * {@link isSafePublicHttpsUrl} is NodeTool's **default policy** on top of it:
+ * https only, to an apparently-public host. A predicate is not a protected
+ * fetch, though — only {@link safeFetch} validates every redirect hop, so an
+ * operation that actually goes out calls that.
+ *
+ * The check is conservative: unparseable URLs, non-https schemes, and literal
+ * IP addresses in loopback / link-local / RFC1918 / CGNAT / benchmarking ranges
+ * (including IPv4-mapped IPv6 literals and IPv4 embedded in 6to4 / NAT64
+ * transition addresses) are refused. Alternate IPv4 spellings — decimal, hex,
+ * octal, short form — are normalized by the WHATWG URL parser before the table
+ * sees them.
+ *
+ * **DNS rebinding is out of scope here, deliberately.** A public name that
+ * resolves to a private address passes: this process does not control which
+ * address `fetch` connects to, and pinning one would break TLS and virtual
+ * hosting. Two answers exist and the inventory records which each surface uses
+ * — `assertResolvedHostAllowed` (a resolve-and-check pass, for a URL handed to
+ * a separate process that opens its own sockets), and the deployment's egress
+ * control as the security boundary for everything in-process. See
+ * `docs/url-egress-inventory.md`.
+ */
+/**
+ * True when `host` is a literal IPv4/IPv6 address in a loopback, link-local,
+ * private, CGNAT or benchmarking range — including the IPv6 spellings that
+ * carry an IPv4 inside them (IPv4-mapped, IPv4-compatible, 6to4, NAT64).
+ *
+ * This is the address table, not a policy: it says nothing about schemes,
+ * hostnames or redirects, and a caller that allows private networks on purpose
+ * (the sandbox fetch bridge under `allowPrivateNetwork`) skips it rather than
+ * reimplementing it. A hostname that is not a literal is not this function's
+ * question — it answers `false`, and what the name *resolves* to is decided by
+ * the surface's DNS-rebinding policy (see the module comment).
+ */
+export declare function isBlockedIpLiteral(host: string): boolean;
+/**
+ * Return `true` when `url` is an https URL whose host is not a loopback,
+ * link-local, or RFC1918 private address. NodeTool's default egress policy.
+ */
+export declare function isSafePublicHttpsUrl(url: string): boolean;
+/**
+ * Throw if `url` is not a safe public https URL (see {@link isSafePublicHttpsUrl}).
+ * Use before `fetch`ing any provider-supplied download URL.
+ */
+export declare function assertSafePublicHttpsUrl(url: string): void;
+/**
+ * `fetch` a provider-supplied URL with SSRF protection. The initial URL and
+ * every redirect hop are validated with {@link assertSafePublicHttpsUrl}, so a
+ * public host cannot redirect into an internal/loopback target or downgrade to
+ * http. Redirects are followed manually up to `maxRedirects`. When a redirect
+ * crosses to a different origin, auth headers and the request body are stripped
+ * so they are never leaked to the redirect target.
+ */
+export declare function safeFetch(url: string, init?: RequestInit, maxRedirects?: number, fetchImpl?: typeof fetch): Promise<Response>;
+//# sourceMappingURL=safe-url.d.ts.map

package/dist/providers/safe-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-url.d.ts","sourceRoot":"","sources":["../../src/providers/safe-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAgEH;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAwCxD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CA8BzD;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAM1D;AAwBD;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,WAAW,EAClB,YAAY,SAAI,EAKhB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAsBnB"}

package/dist/providers/safe-url.js

@@ -0,0 +1,277 @@
+/**
+ * SSRF guard for outbound fetches of caller-supplied URLs, and the one address
+ * table every screening surface in the repo reads.
+ *
+ * Image/video providers (FAL, Replicate, …) return result URLs that the server
+ * then `fetch`es to download the generated bytes. Those URLs originate from the
+ * provider's response, so without validation a compromised or misbehaving
+ * provider — or a response coerced via a crafted prompt — could point the
+ * server at internal services (`http://169.254.169.254/...`,
+ * `http://localhost:6379/...`, RFC1918 hosts, …). The same is true of a media
+ * ref a workflow carries and of a URL a model hands a tool.
+ *
+ * Two things live here, and the split matters. {@link isBlockedIpLiteral} is
+ * the **address table** — which literals are internal — shared with the sandbox
+ * fetch bridge (`packages/agents/src/network-guard.ts`), which allows plain
+ * http and an opt-in private mode that this module never does.
+ * {@link isSafePublicHttpsUrl} is NodeTool's **default policy** on top of it:
+ * https only, to an apparently-public host. A predicate is not a protected
+ * fetch, though — only {@link safeFetch} validates every redirect hop, so an
+ * operation that actually goes out calls that.
+ *
+ * The check is conservative: unparseable URLs, non-https schemes, and literal
+ * IP addresses in loopback / link-local / RFC1918 / CGNAT / benchmarking ranges
+ * (including IPv4-mapped IPv6 literals and IPv4 embedded in 6to4 / NAT64
+ * transition addresses) are refused. Alternate IPv4 spellings — decimal, hex,
+ * octal, short form — are normalized by the WHATWG URL parser before the table
+ * sees them.
+ *
+ * **DNS rebinding is out of scope here, deliberately.** A public name that
+ * resolves to a private address passes: this process does not control which
+ * address `fetch` connects to, and pinning one would break TLS and virtual
+ * hosting. Two answers exist and the inventory records which each surface uses
+ * — `assertResolvedHostAllowed` (a resolve-and-check pass, for a URL handed to
+ * a separate process that opens its own sockets), and the deployment's egress
+ * control as the security boundary for everything in-process. See
+ * `docs/url-egress-inventory.md`.
+ */
+/**
+ * Expand an IPv6 literal (already stripped of brackets, lower-cased) into its 8
+ * 16-bit hextets, handling `::` compression and a trailing dotted-quad. Returns
+ * `null` if `host` is not a well-formed IPv6 literal.
+ */
+function expandIpv6(host) {
+    if (!host.includes(":"))
+        return null;
+    // Rewrite a trailing dotted-quad (`...:a.b.c.d`) into two hex hextets so the
+    // rest of the parse only deals with `:`-separated groups.
+    const body = host.replace(/((?:\d{1,3}\.){3}\d{1,3})$/, (m) => {
+        const oct = m.split(".").map((n) => parseInt(n, 10));
+        if (oct.some((n) => n > 255))
+            return "\0"; // sentinel → fails group parse
+        const hex = (n) => n.toString(16).padStart(2, "0");
+        return `${hex(oct[0])}${hex(oct[1])}:${hex(oct[2])}${hex(oct[3])}`;
+    });
+    const halves = body.split("::");
+    if (halves.length > 2)
+        return null;
+    const parseGroup = (s) => {
+        if (s === "")
+            return [];
+        const out = [];
+        for (const p of s.split(":")) {
+            if (!/^[0-9a-f]{1,4}$/.test(p))
+                return null;
+            out.push(parseInt(p, 16));
+        }
+        return out;
+    };
+    const head = parseGroup(halves[0]);
+    if (head === null)
+        return null;
+    let hextets;
+    if (halves.length === 2) {
+        const rest = parseGroup(halves[1]);
+        if (rest === null)
+            return null;
+        const middle = 8 - head.length - rest.length;
+        if (middle < 0)
+            return null;
+        hextets = [...head, ...new Array(middle).fill(0), ...rest];
+    }
+    else {
+        hextets = head;
+    }
+    if (hextets.length !== 8)
+        return null;
+    return hextets;
+}
+/**
+ * True for IPv4 octet pairs in loopback / RFC1918 / link-local / CGNAT /
+ * benchmarking ranges.
+ */
+function isPrivateIpv4(a, b) {
+    // 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8
+    if (a === 0 || a === 10 || a === 127)
+        return true;
+    // 169.254.0.0/16 (link-local, incl. the 169.254.169.254 metadata service)
+    if (a === 169 && b === 254)
+        return true;
+    // 172.16.0.0/12
+    if (a === 172 && b >= 16 && b <= 31)
+        return true;
+    // 192.168.0.0/16
+    if (a === 192 && b === 168)
+        return true;
+    // 100.64.0.0/10 (CGNAT)
+    if (a === 100 && b >= 64 && b <= 127)
+        return true;
+    // 198.18.0.0/15 (benchmarking)
+    if (a === 198 && (b === 18 || b === 19))
+        return true;
+    return false;
+}
+/**
+ * True when `host` is a literal IPv4/IPv6 address in a loopback, link-local,
+ * private, CGNAT or benchmarking range — including the IPv6 spellings that
+ * carry an IPv4 inside them (IPv4-mapped, IPv4-compatible, 6to4, NAT64).
+ *
+ * This is the address table, not a policy: it says nothing about schemes,
+ * hostnames or redirects, and a caller that allows private networks on purpose
+ * (the sandbox fetch bridge under `allowPrivateNetwork`) skips it rather than
+ * reimplementing it. A hostname that is not a literal is not this function's
+ * question — it answers `false`, and what the name *resolves* to is decided by
+ * the surface's DNS-rebinding policy (see the module comment).
+ */
+export function isBlockedIpLiteral(host) {
+    // Strip IPv6 brackets and any zone id (`fe80::1%eth0`), lower-case for the
+    // hex comparisons.
+    const h = host
+        .replace(/^\[|\]$/g, "")
+        .split("%")[0]
+        .toLowerCase();
+    // IPv4 in dotted form, standalone or as an IPv6 tail (`::ffff:127.0.0.1`).
+    const dotted = h.match(/(?:^|:)((?:\d{1,3}\.){3}\d{1,3})$/);
+    if (dotted) {
+        const [a, b] = dotted[1].split(".").map((n) => parseInt(n, 10));
+        return isPrivateIpv4(a, b);
+    }
+    if (!h.includes(":"))
+        return false;
+    if (h === "::" || h === "::1")
+        return true; // unspecified / loopback
+    if (h.startsWith("fc") || h.startsWith("fd"))
+        return true; // ULA fc00::/7
+    // link-local fe80::/10 — the first hextet spans fe80–febf, so the first three
+    // hex digits are fe8/fe9/fea/feb; "fe80" alone is too narrow.
+    if (/^fe[89ab]/.test(h))
+        return true;
+    // IPv4 embedded in a hex-serialized IPv6 literal. The WHATWG parser rewrites
+    // `::ffff:127.0.0.1` to `::ffff:7f00:1`, which the dotted regex above no
+    // longer matches, and the transition prefixes hide an IPv4 in the same way:
+    // IPv4-mapped/-compatible and NAT64 (64:ff9b::/96) in the low 32 bits, 6to4
+    // (2002:WWXX:YYZZ::/16) in the second and third hextets.
+    const hextets = expandIpv6(h);
+    if (!hextets)
+        return false;
+    const isZero = (from, to) => hextets.slice(from, to).every((n) => n === 0);
+    let embedded = null;
+    if (hextets[0] === 0x2002) {
+        embedded = hextets[1];
+    }
+    else if (isZero(0, 5) && hextets[5] === 0xffff) {
+        embedded = hextets[6]; // ::ffff:a.b.c.d
+    }
+    else if (isZero(0, 6)) {
+        embedded = hextets[6]; // ::a.b.c.d (IPv4-compatible, deprecated)
+    }
+    else if (hextets[0] === 0x64 && hextets[1] === 0xff9b && isZero(2, 6)) {
+        embedded = hextets[6]; // 64:ff9b::/96
+    }
+    if (embedded === null)
+        return false;
+    return isPrivateIpv4((embedded >> 8) & 0xff, embedded & 0xff);
+}
+/**
+ * Return `true` when `url` is an https URL whose host is not a loopback,
+ * link-local, or RFC1918 private address. NodeTool's default egress policy.
+ */
+export function isSafePublicHttpsUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "https:") {
+        return false;
+    }
+    // Normalise: strip IPv6 brackets (WHATWG URL may include them depending on
+    // the runtime) and any trailing dot (`localhost.` resolves the same as
+    // `localhost` but would dodge the exact/suffix checks below). The dots are
+    // trimmed with a loop: `/\.+$/` backtracks quadratically on a long dot run.
+    const bare = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    let end = bare.length;
+    while (end > 0 && bare[end - 1] === ".")
+        end -= 1;
+    const host = bare.slice(0, end);
+    if (!host)
+        return false;
+    if (host === "localhost" ||
+        host === "ip6-localhost" ||
+        host === "ip6-loopback" ||
+        host.endsWith(".localhost") ||
+        host.endsWith(".local") ||
+        host.endsWith(".internal")) {
+        return false;
+    }
+    return !isBlockedIpLiteral(host);
+}
+/**
+ * Throw if `url` is not a safe public https URL (see {@link isSafePublicHttpsUrl}).
+ * Use before `fetch`ing any provider-supplied download URL.
+ */
+export function assertSafePublicHttpsUrl(url) {
+    if (!isSafePublicHttpsUrl(url)) {
+        throw new Error(`Refusing to fetch unsafe URL (must be https to a public host): ${url}`);
+    }
+}
+/** Request headers that must not cross an origin boundary on a redirect. */
+const CROSS_ORIGIN_SENSITIVE_HEADERS = [
+    "authorization",
+    "cookie",
+    "proxy-authorization",
+    "x-goog-api-key"
+];
+/**
+ * Return a copy of `init` with credentials and body stripped, for replay
+ * against a different origin. Mirrors browser behaviour: a cross-origin
+ * redirect must not forward `Authorization`/`Cookie` headers or the request
+ * body, both of which may carry secrets meant only for the original host.
+ */
+function stripCrossOriginCredentials(init) {
+    const headers = new Headers(init.headers ?? undefined);
+    for (const name of CROSS_ORIGIN_SENSITIVE_HEADERS)
+        headers.delete(name);
+    const next = { ...init, headers };
+    delete next.body;
+    return next;
+}
+/**
+ * `fetch` a provider-supplied URL with SSRF protection. The initial URL and
+ * every redirect hop are validated with {@link assertSafePublicHttpsUrl}, so a
+ * public host cannot redirect into an internal/loopback target or downgrade to
+ * http. Redirects are followed manually up to `maxRedirects`. When a redirect
+ * crosses to a different origin, auth headers and the request body are stripped
+ * so they are never leaked to the redirect target.
+ */
+export async function safeFetch(url, init, maxRedirects = 5, 
+// The underlying fetch implementation. Defaults to the global fetch; callers
+// that inject a fetch (e.g. providers with a testable `fetchFn`) can pass it
+// here so the SSRF URL validation still runs on every hop while the actual
+// request goes through their implementation.
+fetchImpl = fetch) {
+    let current = url;
+    let currentInit = { ...init };
+    let currentOrigin = new URL(url).origin;
+    for (let hop = 0; hop <= maxRedirects; hop++) {
+        assertSafePublicHttpsUrl(current);
+        const res = await fetchImpl(current, { ...currentInit, redirect: "manual" });
+        // A real Response always has headers; tolerate minimal fetch mocks/polyfills
+        // that omit them (treated as no redirect).
+        const location = res.headers?.get?.("location") ?? null;
+        if (res.status >= 300 && res.status < 400 && location) {
+            const next = new URL(location, current);
+            if (next.origin !== currentOrigin) {
+                currentInit = stripCrossOriginCredentials(currentInit);
+            }
+            current = next.toString();
+            currentOrigin = next.origin;
+            continue;
+        }
+        return res;
+    }
+    throw new Error(`Too many redirects while fetching: ${url}`);
+}
+//# sourceMappingURL=safe-url.js.map

package/dist/providers/safe-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-url.js","sourceRoot":"","sources":["../../src/providers/safe-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,+BAA+B;QAC1E,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,UAAU,GAAG,CAAC,CAAS,EAAmB,EAAE;QAChD,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,OAAiB,CAAC;IACtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7C,IAAI,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7D,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,CAAS,EAAE,CAAS;IACzC,qCAAqC;IACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,0EAA0E;IAC1E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,gBAAgB;IAChB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IACjD,iBAAiB;IACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxC,wBAAwB;IACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAClD,+BAA+B;IAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,2EAA2E;IAC3E,mBAAmB;IACnB,MAAM,CAAC,GAAG,IAAI;SACX,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACb,WAAW,EAAE,CAAC;IACjB,2EAA2E;IAC3E,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAChE,OAAO,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;IACrE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAC1E,8EAA8E;IAC9E,8DAA8D;IAC9D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAU,EAAW,EAAE,CACnD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC1B,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;SAAM,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACjD,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB;IAC1C,CAAC;SAAM,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACxB,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,0CAA0C;IACnE,CAAC;SAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe;IACxC,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,aAAa,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,GAAG,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,2EAA2E;IAC3E,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IACE,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,eAAe;QACxB,IAAI,KAAK,cAAc;QACvB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAC1B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,kEAAkE,GAAG,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,8BAA8B,GAAG;IACrC,eAAe;IACf,QAAQ;IACR,qBAAqB;IACrB,gBAAgB;CACjB,CAAC;AAEF;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,IAAiB;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;IACvD,KAAK,MAAM,IAAI,IAAI,8BAA8B;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,IAAI,GAAgB,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/C,OAAO,IAAI,CAAC,IAAI,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,IAAkB,EAClB,YAAY,GAAG,CAAC;AAChB,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,6CAA6C;AAC7C,SAAS,GAAiB,KAAK;IAE/B,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,IAAI,WAAW,GAAgB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,IAAI,aAAa,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,YAAY,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7C,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,6EAA6E;QAC7E,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;QACxD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBAClC,WAAW,GAAG,2BAA2B,CAAC,WAAW,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC1B,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;AAC/D,CAAC"}

package/dist/providers/scripted-provider.d.ts

@@ -97,6 +97,13 @@ export declare function multiTaskPlanScript(planSpec: MultiTaskPlanSpec): Script
  * Use this for step execution phases.
  */
 export declare function stepScript(result: unknown): ScriptFn;
+/**
+ * Script that completes a CodeAct step with one code action calling
+ * `finish(result)` — the CodeAct equivalent of {@link stepScript}. The tool
+ * name is hardcoded rather than imported: `@nodetool-ai/agents` depends on
+ * this package, not the other way round.
+ */
+export declare function codeStepScript(result: unknown): ScriptFn;
 /**
  * Script that emits a plain text chunk (no tool call).
  * Useful for unstructured steps or testing fallback behavior.
@@ -111,6 +118,8 @@ export declare function toolCallScript(name: string, args: Record<string, unknow
  * - If `create_plan` is available → call it with `opts.multiTaskPlan` or auto-wrap `opts.plan`
  * - If `create_task` is available → call it with `opts.plan`
  * - If `finish_step` is available → call it with `opts.result`
+ * - If `execute_code` is available and a result was scripted → one code
+ *   action finishing with it
  * - Otherwise → emit `opts.text` as a chunk
  *
  * This mimics a "smart" LLM that knows what tools are available.

package/dist/providers/scripted-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scripted-provider.d.ts","sourceRoot":"","sources":["../../src/providers/scripted-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM5E,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAClD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,QAAQ,EAAE,OAAO,EAAE,EACnB,KAAK,EAAE,YAAY,EAAE,KAClB,UAAU,EAAE,CAAC;AAMlB,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,OAAO,CAAK;IAEpB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAM;gBAEjE,OAAO,EAAE,QAAQ,EAAE;IAO/B,4DAA4D;IAC5D,KAAK,IAAI,IAAI;IAKP,eAAe,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUb,gBAAgB,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,cAAc,CAAC,kBAAkB,CAAC;CA4BvC;AAMD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,KAAK,EAAE,KAAK,CAAC;YACX,EAAE,EAAE,MAAM,CAAC;YACX,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;SAClB,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,CAQ3D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,QAAQ,CAQzE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAIpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAEpD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,CAEV;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,QAAQ,CA4FX;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EACjE,WAAW,EAAE,OAAO,GACnB,QAAQ,EAAE,CAaZ"}
+{"version":3,"file":"scripted-provider.d.ts","sourceRoot":"","sources":["../../src/providers/scripted-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAalD,OAAO,KAAK,EACV,OAAO,EACP,kBAAkB,EAClB,YAAY,EAEb,MAAM,YAAY,CAAC;AAOpB,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAClD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;CACb,CAAC;AAEN;;;GAGG;AACH,MAAM,MAAM,QAAQ,GAAG,CACrB,QAAQ,EAAE,OAAO,EAAE,EACnB,KAAK,EAAE,YAAY,EAAE,KAClB,UAAU,EAAE,CAAC;AAMlB,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,OAAO,CAAK;IAEpB,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,YAAY,EAAE,CAAA;KAAE,CAAC,CAAM;IAE7E,YAAY,OAAO,EAAE,QAAQ,EAAE,EAK9B;IAED,4DAA4D;IAC5D,KAAK,IAAI,IAAI,CAGZ;IAEK,eAAe,CAAC,IAAI,EAAE;QAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,OAAO,CAAC,CAenB;IAEM,gBAAgB,CAAC,IAAI,EAAE;QAC5B,QAAQ,EAAE,OAAO,EAAE,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,cAAc,CAAC,kBAAkB,CAAC,CA2BrC;CACF;AAMD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,KAAK,CAAC;QACX,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,KAAK,EAAE,KAAK,CAAC;YACX,EAAE,EAAE,MAAM,CAAC;YACX,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;YACtB,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;SAClB,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,YAAY,GAAG,QAAQ,CAQ3D;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,QAAQ,CAQzE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAIpD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,CAWxD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAEpD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,QAAQ,CAEV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE;IAC/B,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,QAAQ,CAoIX;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EACjE,WAAW,EAAE,OAAO,GACnB,QAAQ,EAAE,CAaZ"}

package/dist/providers/scripted-provider.js

@@ -13,8 +13,20 @@
  *     stepScript({ summary: "done" }),                  // call 2: step 2
  *   ]);
  */
-import { randomUUID } from "node:crypto";
+import { getNodeBuiltinSync } from "@nodetool-ai/config";
 import { BaseProvider } from "./base-provider.js";
+const _nodeCrypto = getNodeBuiltinSync("node:crypto");
+const randomUUID = () => {
+    if (_nodeCrypto?.randomUUID)
+        return _nodeCrypto.randomUUID();
+    const g = globalThis;
+    if (g.crypto?.randomUUID)
+        return g.crypto.randomUUID();
+    return `id_${Date.now().toString(36)}_${Math.random()
+        .toString(36)
+        .slice(2, 10)}`;
+};
+import { isString } from "@nodetool-ai/protocol";
 // ---------------------------------------------------------------------------
 // ScriptedProvider
 // ---------------------------------------------------------------------------
@@ -36,12 +48,20 @@ export class ScriptedProvider extends BaseProvider {
     }
     async generateMessage(args) {
         let content = "";
+        const toolCalls = [];
         for await (const item of this.generateMessages(args)) {
             if ("type" in item && item.type === "chunk") {
                 content += item.content ?? "";
             }
+            else if ("id" in item && "name" in item && "args" in item) {
+                toolCalls.push(item);
+            }
         }
-        return { role: "assistant", content: content || "Done." };
+        return {
+            role: "assistant",
+            content: content || (toolCalls.length === 0 ? "Done." : null),
+            toolCalls: toolCalls.length > 0 ? toolCalls : undefined
+        };
     }
     async *generateMessages(args) {
         const tools = args.tools ?? [];
@@ -51,12 +71,12 @@ export class ScriptedProvider extends BaseProvider {
         this.callIdx++;
         const script = this.scripts[idx];
         const items = script(args.messages, tools);
-        for (const item of items) {
+        for (const [index, item] of items.entries()) {
             if (item.type === "chunk") {
                 yield {
                     type: "chunk",
                     content: item.content,
-                    done: item.done ?? true,
+                    done: item.done ?? index === items.length - 1,
                     content_type: "text"
                 };
             }
@@ -80,7 +100,7 @@ export function planScript(taskSpec) {
         {
             type: "tool_call",
             name: "create_task",
-            args: taskSpec
+            args: { ...taskSpec }
         }
     ];
 }
@@ -93,7 +113,7 @@ export function multiTaskPlanScript(planSpec) {
         {
             type: "tool_call",
             name: "create_plan",
-            args: planSpec
+            args: { ...planSpec }
         }
     ];
 }
@@ -106,6 +126,24 @@ export function stepScript(result) {
         { type: "tool_call", name: "finish_step", args: { result } }
     ];
 }
+/**
+ * Script that completes a CodeAct step with one code action calling
+ * `finish(result)` — the CodeAct equivalent of {@link stepScript}. The tool
+ * name is hardcoded rather than imported: `@nodetool-ai/agents` depends on
+ * this package, not the other way round.
+ */
+export function codeStepScript(result) {
+    return (_messages, _tools) => [
+        {
+            type: "tool_call",
+            name: "execute_code",
+            args: {
+                title: "Finishing the step",
+                code: `await finish(${JSON.stringify(result)});`
+            }
+        }
+    ];
+}
 /**
  * Script that emits a plain text chunk (no tool call).
  * Useful for unstructured steps or testing fallback behavior.
@@ -124,6 +162,8 @@ export function toolCallScript(name, args) {
  * - If `create_plan` is available → call it with `opts.multiTaskPlan` or auto-wrap `opts.plan`
  * - If `create_task` is available → call it with `opts.plan`
  * - If `finish_step` is available → call it with `opts.result`
+ * - If `execute_code` is available and a result was scripted → one code
+ *   action finishing with it
  * - Otherwise → emit `opts.text` as a chunk
  *
  * This mimics a "smart" LLM that knows what tools are available.
@@ -131,6 +171,27 @@ export function toolCallScript(name, args) {
 export function autoScript(opts) {
     return (messages, tools) => {
         const toolNames = new Set(tools.map((t) => t.name));
+        // Generator tool loops (ListGenerator's `add_item`, DataGenerator's
+        // `add_row`): the node calls the provider repeatedly, feeding tool results
+        // back, and gives up if the first call emits no tool calls. Emit a burst of
+        // generator calls on the first invocation, then stop once our own tool
+        // results appear in history so the node's loop terminates.
+        for (const genTool of ["add_item", "add_row"]) {
+            if (!toolNames.has(genTool))
+                continue;
+            const alreadyEmitted = messages.some((m) => m.role === "assistant" &&
+                (m.toolCalls ?? []).some((tc) => tc.name === genTool));
+            if (alreadyEmitted) {
+                return [{ type: "chunk", content: "Done.", done: true }];
+            }
+            return Array.from({ length: 3 }, (_unused, i) => ({
+                type: "tool_call",
+                name: genTool,
+                args: genTool === "add_item"
+                    ? { item: `fake item ${i + 1}` }
+                    : { row: { id: i + 1, value: `fake row ${i + 1}` } }
+            }));
+        }
         // Incremental planner: add_task + finish_plan
         if (toolNames.has("add_task") &&
             toolNames.has("finish_plan") &&
@@ -151,7 +212,7 @@ export function autoScript(opts) {
             for (const m of messages) {
                 if (m.role !== "tool")
                     continue;
-                const content = typeof m.content === "string" ? m.content : "";
+                const content = isString(m.content) ? m.content : "";
                 if (content.includes('"status":"task_added"'))
                     addedCount++;
             }
@@ -161,7 +222,7 @@ export function autoScript(opts) {
                     {
                         type: "tool_call",
                         name: "add_task",
-                        args: task
+                        args: { ...task }
                     }
                 ];
             }
@@ -190,7 +251,7 @@ export function autoScript(opts) {
                 {
                     type: "tool_call",
                     name: "create_plan",
-                    args: planArgs
+                    args: { ...planArgs }
                 }
             ];
         }
@@ -199,7 +260,7 @@ export function autoScript(opts) {
                 {
                     type: "tool_call",
                     name: "create_task",
-                    args: opts.plan
+                    args: { ...opts.plan }
                 }
             ];
         }
@@ -212,6 +273,21 @@ export function autoScript(opts) {
                 }
             ];
         }
+        // CodeAct step: one action that finishes with the scripted result. Only
+        // when a result was scripted — a chat turn also carries `execute_code`
+        // and should answer with text.
+        if (toolNames.has("execute_code") && opts.result !== undefined) {
+            return [
+                {
+                    type: "tool_call",
+                    name: "execute_code",
+                    args: {
+                        title: "Finishing the step",
+                        code: `await finish(${JSON.stringify(opts.result)});`
+                    }
+                }
+            ];
+        }
         return [
             { type: "chunk", content: opts.text ?? "Task completed.", done: true }
         ];

package/dist/providers/scripted-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"scripted-provider.js","sourceRoot":"","sources":["../../src/providers/scripted-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAyBlD,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IAC/B,OAAO,CAAa;IAC7B,OAAO,GAAG,CAAC,CAAC;IAEpB,0EAA0E;IACjE,OAAO,GAA0D,EAAE,CAAC;IAE7E,YAAY,OAAmB;QAC7B,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,4DAA4D;IAC5D,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAKrB;QACC,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,MAAM,IAAI,IAAI,IAAK,IAAyB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClE,OAAO,IAAK,IAA6B,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,IAAI,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,CAAC,gBAAgB,CAAC,IAKvB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtD,yDAAyD;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,MAAM;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI;oBACvB,YAAY,EAAE,MAAM;iBACZ,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,YAAY;gBACZ,MAAM;oBACJ,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAoCD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAsB;IAC/C,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5B;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,QAA8C;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5B;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,QAA8C;SACrD;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5B,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,IAA6B;IAE7B,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CAAC,IAK1B;IACC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpD,8CAA8C;QAC9C,IACE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YACzB,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC;YAC5B,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,EACjC,CAAC;YACD,MAAM,QAAQ,GAAsB,IAAI,CAAC,aAAa,IAAI;gBACxD,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;gBACvB,KAAK,EAAE;oBACL;wBACE,EAAE,EAAE,QAAQ;wBACZ,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;wBACvB,UAAU,EAAE,EAAE;wBACd,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;qBACxB;iBACF;aACF,CAAC;YAEF,sEAAsE;YACtE,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAS;gBAChC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;oBAAE,UAAU,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACxC,OAAO;oBACL;wBACE,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,IAA0C;qBACjD;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;iBAChC;aACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,wCAAwC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI;gBACrC,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;gBACvB,KAAK,EAAE;oBACL;wBACE,EAAE,EAAE,QAAQ;wBACZ,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;wBACvB,UAAU,EAAE,EAAE;wBACd,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;qBACxB;iBACF;aACF,CAAC;YACF,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,QAA8C;iBACrD;aACF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9C,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,IAAI,CAAC,IAA0C;iBACtD;aACF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE;iBACpC;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;SACvE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiE,EACjE,WAAoB;IAEpB,MAAM,OAAO,GAAe;QAC1B,mCAAmC;QACnC,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CACpB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACrB,IAAI,EAAE,WAAoB;YAC1B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,IAAI,EAAE,EAAE,CAAC,IAAI;SACd,CAAC,CAAC;QACL,sDAAsD;QACtD,UAAU,CAAC,WAAW,CAAC;KACxB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"scripted-provider.js","sourceRoot":"","sources":["../../src/providers/scripted-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,WAAW,GAAG,kBAAkB,CACpC,aAAa,CACd,CAAC;AACF,MAAM,UAAU,GAAG,GAAW,EAAE;IAC9B,IAAI,WAAW,EAAE,UAAU;QAAE,OAAO,WAAW,CAAC,UAAU,EAAE,CAAC;IAC7D,MAAM,CAAC,GAAG,UAAU,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IACvD,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE;SAClD,QAAQ,CAAC,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACpB,CAAC,CAAC;AAOF,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAwBjD,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IAC/B,OAAO,CAAa;IAC7B,OAAO,GAAG,CAAC,CAAC;IAEpB,0EAA0E;IACjE,OAAO,GAA0D,EAAE,CAAC;IAE7E,YAAY,OAAmB;QAC7B,KAAK,CAAC,MAAM,CAAC,CAAC;QACd,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,4DAA4D;IAC5D,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAKrB;QACC,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,MAAM,SAAS,GAAe,EAAE,CAAC;QACjC,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5C,OAAO,IAAK,IAA6B,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1D,CAAC;iBAAM,IAAI,IAAI,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC5D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,SAAS,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;SACxD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,CAAC,gBAAgB,CAAC,IAKvB;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAEtD,yDAAyD;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE3C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC1B,MAAM;oBACJ,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;oBAC7C,YAAY,EAAE,MAAM;iBACrB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,YAAY;gBACZ,MAAM;oBACJ,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE;oBAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAoCD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,QAAsB;IAC/C,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5B;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5B;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAe;IACxC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5B,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAe;IAC5C,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;QAC5B;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE;gBACJ,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;aACjD;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,IAA6B;IAE7B,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,IAK1B;IACC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpD,oEAAoE;QACpE,2EAA2E;QAC3E,4EAA4E;QAC5E,uEAAuE;QACvE,2DAA2D;QAC3D,KAAK,MAAM,OAAO,IAAI,CAAC,UAAU,EAAE,SAAS,CAAU,EAAE,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACtC,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,WAAW;gBACtB,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CACxD,CAAC;YACF,IAAI,cAAc,EAAE,CAAC;gBACnB,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChD,IAAI,EAAE,WAAoB;gBAC1B,IAAI,EAAE,OAAO;gBACb,IAAI,EACF,OAAO,KAAK,UAAU;oBACpB,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE;oBAChC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;aACzD,CAAC,CAAC,CAAC;QACN,CAAC;QAED,8CAA8C;QAC9C,IACE,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC;YACzB,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC;YAC5B,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,EACjC,CAAC;YACD,MAAM,QAAQ,GAAsB,IAAI,CAAC,aAAa,IAAI;gBACxD,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;gBACvB,KAAK,EAAE;oBACL;wBACE,EAAE,EAAE,QAAQ;wBACZ,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;wBACvB,UAAU,EAAE,EAAE;wBACd,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;qBACxB;iBACF;aACF,CAAC;YAEF,sEAAsE;YACtE,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAS;gBAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;oBAAE,UAAU,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACxC,OAAO;oBACL;wBACE,IAAI,EAAE,WAAW;wBACjB,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE;qBAClB;iBACF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;iBAChC;aACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,wCAAwC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI;gBACrC,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;gBACvB,KAAK,EAAE;oBACL;wBACE,EAAE,EAAE,QAAQ;wBACZ,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;wBACvB,UAAU,EAAE,EAAE;wBACd,KAAK,EAAE,IAAI,CAAC,IAAK,CAAC,KAAK;qBACxB;iBACF;aACF,CAAC;YACF,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE;iBACtB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC9C,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE;iBACvB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,aAAa;oBACnB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE;iBACpC;aACF,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,+BAA+B;QAC/B,IAAI,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/D,OAAO;gBACL;oBACE,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE;wBACJ,KAAK,EAAE,oBAAoB;wBAC3B,IAAI,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI;qBACtD;iBACF;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE;SACvE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,SAAiE,EACjE,WAAoB;IAEpB,MAAM,OAAO,GAAe;QAC1B,mCAAmC;QACnC,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CACpB,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACrB,IAAI,EAAE,WAAoB;YAC1B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,IAAI,EAAE,EAAE,CAAC,IAAI;SACd,CAAC,CAAC;QACL,sDAAsD;QACtD,UAAU,CAAC,WAAW,CAAC;KACxB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}