@rarebit-one/harness-kernel 0.11.0 → 0.12.0

package/dist/engines/gateway.d.ts

@@ -0,0 +1,99 @@
+import type { RunSpec } from "./types.js";
+/**
+ * A credential gateway: a host-side service that holds the run's real provider
+ * keys and injects them on the way out, so the run itself only ever holds a
+ * short-lived, attempt-bound run token.
+ *
+ * The mechanism is base-URL redirection, never interception: every supported
+ * harness and adapter honours a provider base URL, so a run is pointed at
+ * `<route>` with the run token in place of the API key, and the gateway swaps
+ * in the real key (and enforces its own budget) before forwarding. No CA, no
+ * TLS termination inside the sandbox.
+ *
+ * When a spec carries one, no engine puts a raw provider credential — the
+ * run's BYO keys or the host's own env keys — anywhere a harness can read it.
+ */
+export interface RunGateway {
+    /** The gateway's base URL; a provider's default route is `<baseUrl>/p/<provider>`. */
+    baseUrl: string;
+    /** The attempt-bound token the gateway authenticates the run with. The only credential the run holds. */
+    runToken: string;
+    /** Per-provider base URLs, overriding the default route. */
+    routes?: Partial<Record<GatewayProvider, string>>;
+}
+export declare const GATEWAY_PROVIDERS: readonly ["anthropic", "openai", "openrouter"];
+export type GatewayProvider = (typeof GATEWAY_PROVIDERS)[number];
+/**
+ * Host env prefixes a harness must NOT inherit while a gateway is in use: a
+ * host `ANTHROPIC_BASE_URL` would route around the gateway, and a header or
+ * config var under these prefixes can carry a credential whose name the
+ * deny-list cannot spot (`ANTHROPIC_CUSTOM_HEADERS`).
+ */
+export declare const GATEWAY_SHADOWED_PREFIXES: readonly ["ANTHROPIC_", "OPENAI_", "OPENROUTER_"];
+/** The base URL a provider is reached through. */
+export declare function gatewayRoute(gateway: RunGateway, provider: GatewayProvider): string;
+/**
+ * The env that points a harness at the gateway for each of `providers`: the
+ * route as its base URL and the run token as its key. This is what a harness
+ * gets INSTEAD of a credential.
+ */
+export declare function gatewayEnv(gateway: RunGateway, providers?: readonly GatewayProvider[]): Record<string, string>;
+/**
+ * Drop the prefixes a gateway shadows from a harness's inherit list. A prefix
+ * overlapping one in either direction goes: `"ANTHROPIC_BASE"` sits inside a
+ * shadowed prefix, and a broader `"ANTHROPIC"` or `"A"` would match every
+ * shadowed var (and the host's `ANTHROPIC_CUSTOM_HEADERS`) just as well.
+ */
+export declare function withoutShadowed(prefixes: readonly string[]): string[];
+/**
+ * Why the spec's gateway cannot be used, or `undefined` when it can (or there
+ * is none). A malformed gateway is refused rather than ignored: ignoring it
+ * would fall back to raw credentials, which is the thing it exists to stop.
+ */
+export declare function gatewayProblem(spec: Pick<RunSpec, "gateway">): string | undefined;
+/**
+ * The refusal a microVM lane relies on: a run the caller placed on `vm`
+ * isolation must not carry raw model credentials into the
+ * guest. It reaches models through a gateway or not at all.
+ *
+ * "Raw" is any non-empty `provider.credentials` slot, and any of `hostKeys`
+ * (the env keys this engine would otherwise fall back to) set on the host. The
+ * reason names the slots, never their values. A gateway exempts only what it
+ * replaces: the routed providers' slots and host keys, for which the engine
+ * sends the run token instead. Anything else it does not route (the local
+ * provider's key, say) is still raw, and still refused.
+ */
+export declare function refuseRawCredentialsInVm(engine: string, spec: Pick<RunSpec, "isolation" | "gateway" | "provider">, hostKeys?: readonly string[], env?: NodeJS.ProcessEnv): {
+    ok: false;
+    reason: string;
+} | undefined;
+/**
+ * The other half of the microVM rule: credentials the guest would hold in the
+ * clear that are NOT model keys. A gateway cannot inject these, so they are
+ * "exposed" — the run's `secrets` (they become the agent's env), and any
+ * connector credential the harness would carry itself (a bearer `auth.token`,
+ * or `headers` / `env` values a caller's connector shape adds).
+ *
+ * Under `vm` they are refused unless the spec says
+ * `exposedCredentials: "allowed"`, which only the caller's policy may set
+ * (the owner has not decided when exposed credentials are acceptable in a
+ * microVM, so the default is refuse). A connector whose token IS the
+ * gateway's run token is not exposed: that is a connector routed through the
+ * gateway, which injects the real credential host-side. The reason names
+ * secrets and connectors, never values.
+ */
+export declare function refuseExposedCredentialsInVm(engine: string, spec: Pick<RunSpec, "isolation" | "gateway" | "secrets" | "connectors" | "exposedCredentials">): {
+    ok: false;
+    reason: string;
+} | undefined;
+/** Every credential refusal a `vm` run gets: raw model keys first, then exposed credentials. */
+export declare function refuseCredentialsInVm(engine: string, spec: Pick<RunSpec, "isolation" | "gateway" | "provider" | "secrets" | "connectors" | "exposedCredentials">, hostKeys?: readonly string[], env?: NodeJS.ProcessEnv): {
+    ok: false;
+    reason: string;
+} | undefined;
+/** The refusal for a spec whose gateway is unusable, in `supports()` shape. */
+export declare function refuseBadGateway(engine: string, spec: Pick<RunSpec, "gateway">): {
+    ok: false;
+    reason: string;
+} | undefined;
+//# sourceMappingURL=gateway.d.ts.map

package/dist/engines/gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.d.ts","sourceRoot":"","sources":["../../src/engines/gateway.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,UAAU;IACzB,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAA;IACf,yGAAyG;IACzG,QAAQ,EAAE,MAAM,CAAA;IAChB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED,eAAO,MAAM,iBAAiB,gDAAiD,CAAA;AAC/E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAShE;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,mDAAoD,CAAA;AAE1F,kDAAkD;AAClD,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe,GAAG,MAAM,CAEnF;AASD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,UAAU,EACnB,SAAS,GAAE,SAAS,eAAe,EAAsB,GACxD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOxB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAIrE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAwBjF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC,EACzD,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAyB3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,YAAY,GAAG,oBAAoB,CAAC,GAC7F;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAoC3C;AAED,gGAAgG;AAChG,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,CACR,OAAO,EACP,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,oBAAoB,CACvF,EACD,QAAQ,GAAE,SAAS,MAAM,EAAO,EAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAK3C;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAK3C"}

package/dist/engines/gateway.js

@@ -0,0 +1,181 @@
+export const GATEWAY_PROVIDERS = ["anthropic", "openai", "openrouter"];
+/** The env var each provider's harness reads its base URL and key from. */
+const PROVIDER_ENV = {
+    anthropic: { baseUrl: "ANTHROPIC_BASE_URL", key: "ANTHROPIC_API_KEY" },
+    openai: { baseUrl: "OPENAI_BASE_URL", key: "OPENAI_API_KEY" },
+    openrouter: { baseUrl: "OPENROUTER_BASE_URL", key: "OPENROUTER_API_KEY" },
+};
+/**
+ * Host env prefixes a harness must NOT inherit while a gateway is in use: a
+ * host `ANTHROPIC_BASE_URL` would route around the gateway, and a header or
+ * config var under these prefixes can carry a credential whose name the
+ * deny-list cannot spot (`ANTHROPIC_CUSTOM_HEADERS`).
+ */
+export const GATEWAY_SHADOWED_PREFIXES = ["ANTHROPIC_", "OPENAI_", "OPENROUTER_"];
+/** The base URL a provider is reached through. */
+export function gatewayRoute(gateway, provider) {
+    return gateway.routes?.[provider] ?? `${withoutTrailingSlashes(gateway.baseUrl)}/p/${provider}`;
+}
+// A loop, not `/\/+$/`: that regex backtracks polynomially on a run of slashes.
+function withoutTrailingSlashes(url) {
+    let end = url.length;
+    while (end > 0 && url[end - 1] === "/")
+        end--;
+    return url.slice(0, end);
+}
+/**
+ * The env that points a harness at the gateway for each of `providers`: the
+ * route as its base URL and the run token as its key. This is what a harness
+ * gets INSTEAD of a credential.
+ */
+export function gatewayEnv(gateway, providers = GATEWAY_PROVIDERS) {
+    const env = {};
+    for (const provider of providers) {
+        env[PROVIDER_ENV[provider].baseUrl] = gatewayRoute(gateway, provider);
+        env[PROVIDER_ENV[provider].key] = gateway.runToken;
+    }
+    return env;
+}
+/**
+ * Drop the prefixes a gateway shadows from a harness's inherit list. A prefix
+ * overlapping one in either direction goes: `"ANTHROPIC_BASE"` sits inside a
+ * shadowed prefix, and a broader `"ANTHROPIC"` or `"A"` would match every
+ * shadowed var (and the host's `ANTHROPIC_CUSTOM_HEADERS`) just as well.
+ */
+export function withoutShadowed(prefixes) {
+    return prefixes.filter((p) => !GATEWAY_SHADOWED_PREFIXES.some((s) => p.startsWith(s) || s.startsWith(p)));
+}
+/**
+ * Why the spec's gateway cannot be used, or `undefined` when it can (or there
+ * is none). A malformed gateway is refused rather than ignored: ignoring it
+ * would fall back to raw credentials, which is the thing it exists to stop.
+ */
+export function gatewayProblem(spec) {
+    const gateway = spec.gateway;
+    if (gateway === undefined)
+        return undefined;
+    if (typeof gateway.runToken !== "string" || gateway.runToken === "") {
+        return "gateway has no run token";
+    }
+    const urls = [
+        ["baseUrl", gateway.baseUrl],
+        ...Object.entries(gateway.routes ?? {}).map(([p, url]) => [
+            `routes.${p}`,
+            url,
+        ]),
+    ];
+    for (const [field, url] of urls) {
+        if (typeof url !== "string" || !/^https?:\/\/[^/\s]+/.test(url)) {
+            return `gateway ${field} is not an http(s) URL`;
+        }
+    }
+    for (const provider of Object.keys(gateway.routes ?? {})) {
+        if (!GATEWAY_PROVIDERS.includes(provider)) {
+            return `gateway routes a provider this kernel does not know: ${provider}`;
+        }
+    }
+    return undefined;
+}
+/**
+ * The refusal a microVM lane relies on: a run the caller placed on `vm`
+ * isolation must not carry raw model credentials into the
+ * guest. It reaches models through a gateway or not at all.
+ *
+ * "Raw" is any non-empty `provider.credentials` slot, and any of `hostKeys`
+ * (the env keys this engine would otherwise fall back to) set on the host. The
+ * reason names the slots, never their values. A gateway exempts only what it
+ * replaces: the routed providers' slots and host keys, for which the engine
+ * sends the run token instead. Anything else it does not route (the local
+ * provider's key, say) is still raw, and still refused.
+ */
+export function refuseRawCredentialsInVm(engine, spec, hostKeys = [], env = process.env) {
+    if (spec.isolation !== "vm")
+        return undefined;
+    const routed = spec.gateway !== undefined;
+    // CODEX_API_KEY is codex's alias for OPENAI_API_KEY; its engine sets it to
+    // the run token under a gateway too. No other engine passes it as a host key.
+    const routedKeys = [
+        ...GATEWAY_PROVIDERS.map((p) => PROVIDER_ENV[p].key),
+        "CODEX_API_KEY",
+    ];
+    const raw = [
+        ...Object.entries(spec.provider.credentials ?? {})
+            .filter(([, value]) => typeof value === "string" && value !== "")
+            .filter(([slot]) => !(routed && GATEWAY_PROVIDERS.includes(slot)))
+            .map(([slot]) => `provider.credentials.${slot}`),
+        ...hostKeys
+            .filter((key) => Boolean(env[key]) && !(routed && routedKeys.includes(key)))
+            .map((key) => `host ${key}`),
+    ];
+    if (raw.length === 0)
+        return undefined;
+    return {
+        ok: false,
+        reason: `${engine} engine refuses a vm run holding raw model credentials (${raw.join(", ")}); ` +
+            "route it through a credential gateway (RunSpec.gateway) instead",
+    };
+}
+/**
+ * The other half of the microVM rule: credentials the guest would hold in the
+ * clear that are NOT model keys. A gateway cannot inject these, so they are
+ * "exposed" — the run's `secrets` (they become the agent's env), and any
+ * connector credential the harness would carry itself (a bearer `auth.token`,
+ * or `headers` / `env` values a caller's connector shape adds).
+ *
+ * Under `vm` they are refused unless the spec says
+ * `exposedCredentials: "allowed"`, which only the caller's policy may set
+ * (the owner has not decided when exposed credentials are acceptable in a
+ * microVM, so the default is refuse). A connector whose token IS the
+ * gateway's run token is not exposed: that is a connector routed through the
+ * gateway, which injects the real credential host-side. The reason names
+ * secrets and connectors, never values.
+ */
+export function refuseExposedCredentialsInVm(engine, spec) {
+    if (spec.isolation !== "vm" || spec.exposedCredentials === "allowed")
+        return undefined;
+    const runToken = spec.gateway?.runToken;
+    const exposed = [
+        ...Object.entries(spec.secrets ?? {})
+            .filter(([, value]) => typeof value === "string" && value !== "")
+            .map(([name]) => `secret ${name}`),
+        ...(spec.connectors ?? []).flatMap((connector) => {
+            const found = [];
+            const token = connector.auth?.token;
+            if (typeof token === "string" && token !== "" && token !== runToken) {
+                found.push(`connector ${connector.name} auth.token`);
+            }
+            // Not part of ConnectorConfig, but a caller's connector may carry them,
+            // and whatever is there reaches the harness.
+            const extra = connector;
+            for (const field of ["headers", "env"]) {
+                const values = extra[field];
+                if (values &&
+                    typeof values === "object" &&
+                    Object.values(values).some((v) => v !== "" && v != null)) {
+                    found.push(`connector ${connector.name} ${field}`);
+                }
+            }
+            return found;
+        }),
+    ];
+    if (exposed.length === 0)
+        return undefined;
+    return {
+        ok: false,
+        reason: `${engine} engine refuses a vm run holding exposed credentials (${exposed.join(", ")}); ` +
+            'they reach the guest in the clear, so they need exposedCredentials: "allowed" from policy',
+    };
+}
+/** Every credential refusal a `vm` run gets: raw model keys first, then exposed credentials. */
+export function refuseCredentialsInVm(engine, spec, hostKeys = [], env = process.env) {
+    return (refuseRawCredentialsInVm(engine, spec, hostKeys, env) ??
+        refuseExposedCredentialsInVm(engine, spec));
+}
+/** The refusal for a spec whose gateway is unusable, in `supports()` shape. */
+export function refuseBadGateway(engine, spec) {
+    const problem = gatewayProblem(spec);
+    return problem
+        ? { ok: false, reason: `${engine} engine cannot use this run's gateway: ${problem}` }
+        : undefined;
+}
+//# sourceMappingURL=gateway.js.map

package/dist/engines/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/engines/gateway.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAA;AAG/E,2EAA2E;AAC3E,MAAM,YAAY,GAA8D;IAC9E,SAAS,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACtE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAC7D,UAAU,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,oBAAoB,EAAE;CAC1E,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAU,CAAA;AAE1F,kDAAkD;AAClD,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,QAAyB;IACzE,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,QAAQ,EAAE,CAAA;AACjG,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAA;IACpB,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC7C,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,OAAmB,EACnB,YAAwC,iBAAiB;IAEzD,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACrE,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAA;IACpD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAClF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAA8B;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC3C,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpE,OAAO,0BAA0B,CAAA;IACnC,CAAC;IACD,MAAM,IAAI,GAA6B;QACrC,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC;QAC5B,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAqB,EAAE,CAAC;YAC3E,UAAU,CAAC,EAAE;YACb,GAAG;SACJ,CAAC;KACH,CAAA;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,WAAW,KAAK,wBAAwB,CAAA;QACjD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,CAAE,iBAAuC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,OAAO,wDAAwD,QAAQ,EAAE,CAAA;QAC3E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAAc,EACd,IAAyD,EACzD,WAA8B,EAAE,EAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAA;IACzC,2EAA2E;IAC3E,8EAA8E;IAC9E,MAAM,UAAU,GAAsB;QACpC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACpD,eAAe;KAChB,CAAA;IACD,MAAM,GAAG,GAAG;QACV,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;aAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;aAChE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAK,iBAAuC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;aACxF,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,wBAAwB,IAAI,EAAE,CAAC;QAClD,GAAG,QAAQ;aACR,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3E,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,GAAG,EAAE,CAAC;KAC/B,CAAA;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IACtC,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,GAAG,MAAM,2DAA2D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACvF,iEAAiE;KACpE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAc,EACd,IAA8F;IAE9F,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAA;IACvC,MAAM,OAAO,GAAG;QACd,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aAClC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;aAChE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,UAAU,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAa,EAAE,CAAA;YAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAA;YACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACpE,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,IAAI,aAAa,CAAC,CAAA;YACtD,CAAC;YACD,wEAAwE;YACxE,6CAA6C;YAC7C,MAAM,KAAK,GAAG,SAA4D,CAAA;YAC1E,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,KAAK,CAAU,EAAE,CAAC;gBAChD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAA;gBAC3B,IACE,MAAM;oBACN,OAAO,MAAM,KAAK,QAAQ;oBAC1B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,EACxD,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,CAAA;gBACpD,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAA;QACd,CAAC,CAAC;KACH,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,GAAG,MAAM,yDAAyD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACzF,2FAA2F;KAC9F,CAAA;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,IAGC,EACD,WAA8B,EAAE,EAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,CACL,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC;QACrD,4BAA4B,CAAC,MAAM,EAAE,IAAI,CAAC,CAC3C,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAC9B,MAAc,EACd,IAA8B;IAE9B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACpC,OAAO,OAAO;QACZ,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,0CAA0C,OAAO,EAAE,EAAE;QACrF,CAAC,CAAC,SAAS,CAAA;AACf,CAAC"}

package/dist/engines/harnessPrompt.d.ts

@@ -0,0 +1,15 @@
+import type { RunSpec } from "./types.js";
+/**
+ * The task prompt an out-of-process harness (Claude Code, codex, an ACP agent)
+ * is handed: the workflow prompt, the run's inputs, the caller's pre-assembled
+ * context when there is any, and a closing instruction.
+ *
+ * These harnesses explore the working tree with their own tools, but that is no
+ * reason to drop `spec.context`: it can carry material that is not on disk at
+ * all (curated notes, assembled memory), which is exactly what the native loop
+ * bakes into its own prompt. An empty context adds nothing, so a run without one
+ * gets the prompt it always had. `instructions` is for a harness with no
+ * system-prompt slot of its own; absent, it adds nothing either.
+ */
+export declare function harnessPrompt(spec: RunSpec, instructions?: string): string;
+//# sourceMappingURL=harnessPrompt.d.ts.map

package/dist/engines/harnessPrompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessPrompt.d.ts","sourceRoot":"","sources":["../../src/engines/harnessPrompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAmB1E"}

package/dist/engines/harnessPrompt.js

@@ -0,0 +1,33 @@
+/**
+ * The task prompt an out-of-process harness (Claude Code, codex, an ACP agent)
+ * is handed: the workflow prompt, the run's inputs, the caller's pre-assembled
+ * context when there is any, and a closing instruction.
+ *
+ * These harnesses explore the working tree with their own tools, but that is no
+ * reason to drop `spec.context`: it can carry material that is not on disk at
+ * all (curated notes, assembled memory), which is exactly what the native loop
+ * bakes into its own prompt. An empty context adds nothing, so a run without one
+ * gets the prompt it always had. `instructions` is for a harness with no
+ * system-prompt slot of its own; absent, it adds nothing either.
+ */
+export function harnessPrompt(spec, instructions) {
+    const inputs = JSON.stringify(spec.inputs ?? {}, null, 2);
+    const context = spec.context?.trim() ? ["## Workspace context", spec.context, ""] : [];
+    // For a harness with no system-prompt slot: instructions lead the prompt.
+    const preamble = instructions ? ["## Instructions", instructions, ""] : [];
+    return [
+        ...preamble,
+        spec.workflow.prompt ?? `Execute the "${spec.workflow.name ?? spec.workflowPath}" workflow.`,
+        "",
+        "## Inputs",
+        "```json",
+        inputs,
+        "```",
+        "",
+        ...context,
+        "You are running as an autonomous workflow. The current working directory is the",
+        "workspace — inspect and edit its files directly with your tools. When finished,",
+        "reply with the workflow's output as Markdown.",
+    ].join("\n");
+}
+//# sourceMappingURL=harnessPrompt.js.map

package/dist/engines/harnessPrompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harnessPrompt.js","sourceRoot":"","sources":["../../src/engines/harnessPrompt.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa,EAAE,YAAqB;IAChE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACtF,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1E,OAAO;QACL,GAAG,QAAQ;QACX,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,gBAAgB,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,YAAY,aAAa;QAC5F,EAAE;QACF,WAAW;QACX,SAAS;QACT,MAAM;QACN,KAAK;QACL,EAAE;QACF,GAAG,OAAO;QACV,iFAAiF;QACjF,iFAAiF;QACjF,+CAA+C;KAChD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC"}

package/dist/engines/native.d.ts

@@ -65,4 +65,19 @@ export declare class NativeEngine implements AgentEngine {
      */
     private buildContext;
 }
+/**
+ * The provider selection the run resolves against. With a gateway, every
+ * cloud adapter is pointed at its gateway route and keyed with the run token,
+ * replacing the run's BYO keys — and, because a key is now always present, the
+ * host's env keys are never reached either. The `local` provider is not
+ * routed: private inference never leaves the host anyway.
+ *
+ * Because the run token keys every cloud adapter, a run with no preference
+ * would always resolve to the first one in order. So the preference is pinned
+ * to the provider the run would have resolved without the gateway (its BYO
+ * key, else the host's), keeping an OpenAI-only run on OpenAI. When none
+ * would resolve, the run token is not handed out, and the selection fails
+ * exactly as it would have without the gateway.
+ */
+export declare function providerSelection(spec: RunSpec, env?: NodeJS.ProcessEnv): RunSpec["provider"];
 //# sourceMappingURL=native.d.ts.map

package/dist/engines/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/engines/native.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1F,OAAO,EAA6B,KAAK,IAAI,EAAE,MAAM,YAAY,CAAA;AAMjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAElG;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAA;AAE9D,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAA;IACpC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,WAAW;IAC9C,QAAQ,CAAC,IAAI,YAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAM;gBAEf,OAAO,GAAE,mBAAwB;IAM7C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,aAAa;IAMjC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YA+BrD,OAAO;IA+FrB;;;;;OAKG;YACW,YAAY;CAY3B"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../../src/engines/native.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1F,OAAO,EAA6B,KAAK,IAAI,EAAE,MAAM,YAAY,CAAA;AAMjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AASlG;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE,CAAA;AAE9D,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAA;IACpC;;;;;OAKG;IACH,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED;;;;;;GAMG;AACH,qBAAa,YAAa,YAAW,WAAW;IAC9C,QAAQ,CAAC,IAAI,YAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAM;gBAEf,OAAO,GAAE,mBAAwB;IAM7C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,aAAa;IAajC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YA+BrD,OAAO;IAwGrB;;;;;OAKG;YACW,YAAY;CAY3B;AAeD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,UAAU,CAAC,CAyBrB"}

package/dist/engines/native.js

@@ -7,6 +7,8 @@ import { providerAvailability, selectProvider } from "../providers/index.js";
 import { secretsToEnv } from "../secrets.js";
 import { primitiveTools, connectorTools } from "../tools/registry.js";
 import { PrivateRunError, privateRunChannels } from "../private.js";
+import { environmentInstructions } from "./environment.js";
+import { GATEWAY_PROVIDERS, gatewayRoute, refuseBadGateway, refuseCredentialsInVm, } from "./gateway.js";
 /**
  * The in-process native engine: the provider-neutral tool-use loop over the
  * general-purpose primitives (run_code, read_file, list_files, http_fetch) plus
@@ -39,9 +41,16 @@ export class NativeEngine {
     supports(spec) {
         if (!spec)
             return { ok: true };
+        // Before the private branch: a private run is held to local inference, but
+        // a vm run must still carry no raw or exposed credentials, and a
+        // malformed gateway is refused whatever the run is.
+        const refusal = refuseBadGateway("native", spec) ?? refuseCredentialsInVm("native", spec, HOST_MODEL_KEYS);
+        if (refusal)
+            return refusal;
         if (spec.private)
             return privateProviderSupport(spec);
-        return providerAvailability(spec.provider.preferred, spec.provider);
+        const selection = providerSelection(spec);
+        return providerAvailability(selection.preferred, selection);
     }
     async run(spec, ctx) {
         if (!spec.private)
@@ -86,7 +95,8 @@ export class NativeEngine {
         // The whole selection, not a hand-picked subset: `supports()` judged the
         // run on `spec.provider` (including `allowMockFallback`), so `run()` must
         // resolve it from the same object or the two can disagree.
-        const provider = selectProvider(spec.provider.preferred, spec.provider);
+        const selection = providerSelection(spec);
+        const provider = selectProvider(selection.preferred, selection);
         // Belt and braces for the private path: whatever selection did, a private
         // run proceeds on the local provider or not at all.
         if (spec.private && provider.name !== "local") {
@@ -136,7 +146,11 @@ export class NativeEngine {
             const model = asChatModel(provider);
             const result = await runWithEvents(this.loop, {
                 model,
-                system: buildSystemPrompt(spec.workflow, spec.workspaceId, spec.workflowPath),
+                system: buildSystemPrompt(spec.workflow, spec.workspaceId, spec.workflowPath, 
+                // The loop has no AGENTS.md discovery and no skills tool, so both
+                // ride in the system prompt; the skill files themselves are on
+                // disk for read_file.
+                environmentInstructions(spec, { agentsMd: true, skillsIndex: true })),
                 messages: [{ role: "user", text: buildUserPrompt(spec.workflow, context, spec.inputs) }],
                 tools,
                 limits: resolveLoopLimits(spec.limits),
@@ -186,6 +200,55 @@ export class NativeEngine {
         return spec.context ? `${spec.context}\n\n${assembled}` : assembled;
     }
 }
+/** The host env keys the cloud adapters fall back to, in `selectProvider`'s order. */
+const CLOUD_ENV_KEYS = {
+    anthropic: "ANTHROPIC_API_KEY",
+    openai: "OPENAI_API_KEY",
+    openrouter: "OPENROUTER_API_KEY",
+};
+/**
+ * Every host env key a native run can end up holding: the cloud fallbacks and
+ * the local provider's optional key, which `selectProvider` also reads.
+ */
+const HOST_MODEL_KEYS = [...Object.values(CLOUD_ENV_KEYS), "LOCAL_MODEL_API_KEY"];
+/**
+ * The provider selection the run resolves against. With a gateway, every
+ * cloud adapter is pointed at its gateway route and keyed with the run token,
+ * replacing the run's BYO keys — and, because a key is now always present, the
+ * host's env keys are never reached either. The `local` provider is not
+ * routed: private inference never leaves the host anyway.
+ *
+ * Because the run token keys every cloud adapter, a run with no preference
+ * would always resolve to the first one in order. So the preference is pinned
+ * to the provider the run would have resolved without the gateway (its BYO
+ * key, else the host's), keeping an OpenAI-only run on OpenAI. When none
+ * would resolve, the run token is not handed out, and the selection fails
+ * exactly as it would have without the gateway.
+ */
+export function providerSelection(spec, env = process.env) {
+    const gateway = spec.gateway;
+    if (!gateway)
+        return spec.provider;
+    const baseURLs = Object.fromEntries(GATEWAY_PROVIDERS.map((p) => [p, gatewayRoute(gateway, p)]));
+    const local = spec.provider.credentials?.local;
+    const localOnly = local !== undefined ? { local } : {};
+    let preferred = spec.provider.preferred;
+    if (typeof preferred !== "string" || preferred.trim() === "") {
+        const configured = GATEWAY_PROVIDERS.find((p) => spec.provider.credentials?.[p] ?? env[CLOUD_ENV_KEYS[p]]);
+        // Nothing would resolve, so every cloud slot is absent or deliberately
+        // empty; keep them as sent, since an empty slot is what stops the host key.
+        if (!configured)
+            return { ...spec.provider, baseURLs };
+        preferred = configured;
+    }
+    const token = gateway.runToken;
+    return {
+        ...spec.provider,
+        preferred,
+        credentials: { anthropic: token, openai: token, openrouter: token, ...localOnly },
+        baseURLs,
+    };
+}
 /**
  * Whether a private run can be held to local inference on this host. Only an
  * explicit `preferred: "local"` with `LOCAL_MODEL_BASE_URL` set qualifies; every
@@ -233,8 +296,13 @@ function untilAborted(work, signal) {
         work.then(resolve, reject).finally(() => signal.removeEventListener("abort", onAbort));
     });
 }
-function buildSystemPrompt(workflow, workspaceId, workflowPath) {
-    return [
+/**
+ * The loop's system prompt. `instructions` (the run's environment, when it has
+ * one) goes last, after the kernel's own framing, so a run without one gets
+ * exactly the prompt it always had.
+ */
+function buildSystemPrompt(workflow, workspaceId, workflowPath, instructions) {
+    const base = [
         "You are an autonomous workflow executing in an isolated workspace sandbox.",
         `Workspace: ${workspaceId}`,
         `Workflow: ${workflow.name ?? workflowPath}`,
@@ -244,6 +312,7 @@ function buildSystemPrompt(workflow, workspaceId, workflowPath) {
         "than doing it yourself. When finished, reply with the workflow's output as",
         "Markdown and no further tool calls.",
     ].join("\n");
+    return instructions ? `${base}\n\n${instructions}` : base;
 }
 function buildUserPrompt(workflow, context, inputs) {
     const inputsJson = JSON.stringify(inputs ?? {}, null, 2);

package/dist/engines/native.js.map

@@ -1 +1 @@
-{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/engines/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAwB,MAAM,qBAAqB,CAAA;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAa,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAkCnE;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,QAAQ,CAAA;IAEP,WAAW,CAAmB;IAC9B,gBAAgB,CAAmB;IACnC,IAAI,CAAM;IAE3B,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAc;QACrB,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QAC9B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAA;QACrD,OAAO,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAa,EAAE,GAAkB;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEjD,wEAAwE;QACxE,2EAA2E;QAC3E,sDAAsD;QACtD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEhD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC9B,GAAG,GAAG;gBACN,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;oBACd,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;wBAAE,WAAW,GAAG,IAAI,CAAA;oBACpD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACtB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAa,EAAE,GAAkB;QACrD,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAEvD,yEAAyE;QACzE,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QACvE,0EAA0E;QAC1E,oDAAoD;QACpD,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAA;QACrF,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;QAErC,+EAA+E;QAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7F,6EAA6E;QAC7E,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,UAAU,GAAG;YACjB,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC;YACzD,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;SAC7B,CAAA;QACD,oEAAoE;QACpE,2EAA2E;QAC3E,oEAAoE;QACpE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,UAAsD,CAAA;QAC1D,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,GAAG,CAAA;YACnC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAClD,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAA;YAEzE,sEAAsE;YACtE,qEAAqE;YACrE,mDAAmD;YACnD,IAAI,OAAe,CAAA;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YACxE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;oBAAE,MAAM,GAAG,CAAA;gBACnC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;YAChC,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,IAAI,CAAC,IAAI,EACT;gBACE,KAAK;gBACL,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,CAAC;gBAC7E,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxF,KAAK;gBACL,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E;YACD,uEAAuE;YACvE,+CAA+C;YAC/C;gBACE,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;gBAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CACF,CAAA;YACD,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAA;YAC7C,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE;gBACrC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,0EAA0E;YAC1E,8CAA8C;YAC9C,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CAAC,IAAa,EAAE,GAAkB;QAC1D,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAA;QAE3D,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAA;QAE/C,GAAG,CAAC,GAAG,CACL,YAAY,SAAS,CAAC,MAAM,qBAAqB,IAAI,CAAC,gBAAgB,CAAC,MAAM,cAAc,CAC5F,CAAA;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,IAAa;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,yDAAyD;gBACzD,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK;gBACzE,wCAAwC;SAC3C,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gFAAgF;SACzF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,GAAG,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAA;IACnD,OAAO;QACL,IAAI,EAAE,+DAA+D;QACrE,OAAO,EAAE,UAAU;KACpB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAI,IAAgB,EAAE,MAA+B;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAe,CAAC,CAAA;QAC1D,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAA;QACpC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,QAA4B,EAC5B,WAAmB,EACnB,YAAoB;IAEpB,OAAO;QACL,4EAA4E;QAC5E,cAAc,WAAW,EAAE;QAC3B,aAAa,QAAQ,CAAC,IAAI,IAAI,YAAY,EAAE;QAC5C,+EAA+E;QAC/E,sEAAsE;QACtE,8EAA8E;QAC9E,4EAA4E;QAC5E,qCAAqC;KACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,SAAS,eAAe,CACtB,QAA4B,EAC5B,OAAe,EACf,MAA+B;IAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACxD,OAAO;QACL,QAAQ,CAAC,MAAM,IAAI,gBAAgB,QAAQ,CAAC,IAAI,aAAa;QAC7D,EAAE;QACF,WAAW;QACX,SAAS;QACT,UAAU;QACV,KAAK;QACL,EAAE;QACF,sBAAsB;QACtB,OAAO,IAAI,4BAA4B;KACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC"}
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../../src/engines/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAwB,MAAM,qBAAqB,CAAA;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,aAAa,EAAa,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAInE,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,cAAc,CAAA;AA+BrB;;;;;;GAMG;AACH,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,QAAQ,CAAA;IAEP,WAAW,CAAmB;IAC9B,gBAAgB,CAAmB;IACnC,IAAI,CAAM;IAE3B,YAAY,UAA+B,EAAE;QAC3C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAA;QACtD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAA;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAc;QACrB,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QAC9B,2EAA2E;QAC3E,iEAAiE;QACjE,oDAAoD;QACpD,MAAM,OAAO,GACX,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,CAAA;QAC5F,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAC3B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAA;QACrD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACzC,OAAO,oBAAoB,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IAC7D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAa,EAAE,GAAkB;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAEjD,wEAAwE;QACxE,2EAA2E;QAC3E,sDAAsD;QACtD,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5C,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEhD,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,+CAA+C;QAC/C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACtD,IAAI,WAAW,GAAG,KAAK,CAAA;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC9B,GAAG,GAAG;gBACN,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;oBACd,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;wBAAE,WAAW,GAAG,IAAI,CAAA;oBACpD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBACtB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,qEAAqE;YACrE,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAa,EAAE,GAAkB;QACrD,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAEvD,yEAAyE;QACzE,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;QAC/D,0EAA0E;QAC1E,oDAAoD;QACpD,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,IAAI,gBAAgB,CAAC,CAAA;QACrF,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;QAErC,+EAA+E;QAC/E,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1F,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC7F,6EAA6E;QAC7E,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,UAAU,GAAG;YACjB,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,CAAC;YACzD,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;SAC7B,CAAA;QACD,oEAAoE;QACpE,2EAA2E;QAC3E,oEAAoE;QACpE,oEAAoE;QACpE,gDAAgD;QAChD,IAAI,UAAsD,CAAA;QAC1D,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACvF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,GAAG,CAAA;YACnC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAClD,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAA;YAEzE,sEAAsE;YACtE,qEAAqE;YACrE,mDAAmD;YACnD,IAAI,OAAe,CAAA;YACnB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YACxE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO;oBAAE,MAAM,GAAG,CAAA;gBACnC,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAA;YAChC,CAAC;YACD,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;YACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,IAAI,CAAC,IAAI,EACT;gBACE,KAAK;gBACL,MAAM,EAAE,iBAAiB,CACvB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,YAAY;gBACjB,kEAAkE;gBAClE,+DAA+D;gBAC/D,sBAAsB;gBACtB,uBAAuB,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACrE;gBACD,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxF,KAAK;gBACL,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E;YACD,uEAAuE;YACvE,+CAA+C;YAC/C;gBACE,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;gBAC1C,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,CACF,CAAA;YACD,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAA;YAC7C,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE;gBACrC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACxE,CAAA;QACH,CAAC;gBAAS,CAAC;YACT,0EAA0E;YAC1E,8CAA8C;YAC9C,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CAAC,IAAa,EAAE,GAAkB;QAC1D,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAA;QAE3D,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;QAC7E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,OAAO,CAAA;QAE/C,GAAG,CAAC,GAAG,CACL,YAAY,SAAS,CAAC,MAAM,qBAAqB,IAAI,CAAC,gBAAgB,CAAC,MAAM,cAAc,CAC5F,CAAA;QACD,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,cAAc,GAAG;IACrB,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,oBAAoB;CACxB,CAAA;AAEV;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAU,CAAA;AAE1F;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAa,EACb,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;IAClC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChG,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAA;IAC9C,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAEtD,IAAI,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAA;IACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAChE,CAAA;QACD,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAA;QACtD,SAAS,GAAG,UAAU,CAAA;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAA;IAC9B,OAAO;QACL,GAAG,IAAI,CAAC,QAAQ;QAChB,SAAS;QACT,WAAW,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,SAAS,EAAE;QACjF,QAAQ;KACT,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,IAAa;IAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EACJ,yDAAyD;gBACzD,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK;gBACzE,wCAAwC;SAC3C,CAAA;IACH,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,gFAAgF;SACzF,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC;AAED,yEAAyE;AACzE,SAAS,kBAAkB,CAAC,GAAkB;IAC5C,GAAG,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAA;IACnD,OAAO;QACL,IAAI,EAAE,+DAA+D;QACrE,OAAO,EAAE,UAAU;KACpB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAI,IAAgB,EAAE,MAA+B;IACxE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAe,CAAC,CAAA;QAC1D,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,OAAO,EAAE,CAAA;QACpC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,QAA4B,EAC5B,WAAmB,EACnB,YAAoB,EACpB,YAAqB;IAErB,MAAM,IAAI,GAAG;QACX,4EAA4E;QAC5E,cAAc,WAAW,EAAE;QAC3B,aAAa,QAAQ,CAAC,IAAI,IAAI,YAAY,EAAE;QAC5C,+EAA+E;QAC/E,sEAAsE;QACtE,8EAA8E;QAC9E,4EAA4E;QAC5E,qCAAqC;KACtC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACZ,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3D,CAAC;AAED,SAAS,eAAe,CACtB,QAA4B,EAC5B,OAAe,EACf,MAA+B;IAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACxD,OAAO;QACL,QAAQ,CAAC,MAAM,IAAI,gBAAgB,QAAQ,CAAC,IAAI,aAAa;QAC7D,EAAE;QACF,WAAW;QACX,SAAS;QACT,UAAU;QACV,KAAK;QACL,EAAE;QACF,sBAAsB;QACtB,OAAO,IAAI,4BAA4B;KACxC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC"}

package/dist/engines/types.d.ts

@@ -4,6 +4,8 @@ import type { ProviderOptions } from "../providers/options.js";
 import type { FinishReason } from "../providers/types.js";
 import type { ConnectorConfig, Permissions, WorkflowDefinition } from "../types.js";
 import type { Isolation } from "./isolation.js";
+import type { EnvironmentFile, RunInstructions, RunSkill, RunSource } from "./environment.js";
+import type { RunGateway } from "./gateway.js";
 /**
  * The provider-neutral, harness-neutral description of one workflow run, handed
  * to an {@link AgentEngine}. It carries the *materials* (a prepared on-disk
@@ -24,8 +26,10 @@ export interface RunSpec {
     workflow: WorkflowDefinition;
     /** The run's structured inputs (context_bundle.inputs). */
     inputs: Record<string, unknown>;
-    /** Pre-assembled curated context text. The native loop bakes it into the
-     *  prompt; a filesystem-native engine (Claude Code) may ignore it and explore. */
+    /** Pre-assembled curated context text. Every engine puts it in the task
+     *  prompt — the native loop always, an out-of-process harness (Claude Code,
+     *  codex, ACP) whenever it is non-empty — since it may carry material that is
+     *  not on disk for the harness to find. */
     context: string;
     /** Absolute path to the prepared sandbox working tree (the engine edits here). */
     workdir: string;
@@ -71,6 +75,45 @@ export interface RunSpec {
      * nothing. The returned `EngineResult.text` is still the caller's to place.
      */
     private?: boolean;
+    /**
+     * Instructions on top of the harness's own defaults (see `environment.ts`).
+     * `system` reaches every engine through its system-prompt slot or nearest
+     * equivalent; `agentsMd` is the workdir root's `AGENTS.md`, which the caller
+     * materializes and an engine whose harness does not read `AGENTS.md` also
+     * puts in its prompt. Absent changes nothing.
+     */
+    instructions?: RunInstructions;
+    /** Nested `AGENTS.md` files, materialized by the caller. Absent changes nothing. */
+    agentFiles?: EnvironmentFile[];
+    /**
+     * Agent Skills, materialized by the caller under `.agents/skills/<name>/`.
+     * Claude Code also gets them as a local plugin; every other engine is told
+     * where they are. Absent changes nothing.
+     */
+    skills?: RunSkill[];
+    /**
+     * Run inputs that are not workspace content (inline files today), written by
+     * the caller before setup and removed before the change set is computed.
+     * Absent changes nothing.
+     */
+    sources?: RunSource[];
+    /**
+     * A credential gateway for the run's model calls (see `gateway.ts`). When
+     * present, every engine reaches its provider through the gateway's route
+     * with `runToken` as the key, and no raw credential — `provider.credentials`
+     * or the host's env keys — reaches a harness. A malformed gateway is
+     * refused in `supports()`, never ignored. Absent changes nothing, except
+     * that a `vm` run holding raw credentials is refused.
+     */
+    gateway?: RunGateway;
+    /**
+     * Whether a `vm` run may hold exposed credentials — `secrets`, or a
+     * connector credential the harness carries itself — which reach the guest
+     * in the clear because no gateway can inject them. Absent (or anything but
+     * `"allowed"`) refuses such a run; only the caller's policy should set it,
+     * never a workflow author. Ignored below `vm`.
+     */
+    exposedCredentials?: "allowed" | "refused";
 }
 export interface EngineContext {
     /** Append a timestamped line to the run's logs. */

package/dist/engines/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/engines/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B;sFACkF;IAClF,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,WAAW,CAAA;IACxB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,+DAA+D;IAC/D,UAAU,EAAE,eAAe,EAAE,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,iBAAiB,CAAA;IAC3D,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAA;IACZ,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,iEAAiE;IACjE,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExE;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;mFAC+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAAA;IACtC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC9D"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/engines/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC7F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,OAAO;IACtB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,kBAAkB,CAAA;IAC5B,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B;;;+CAG2C;IAC3C,OAAO,EAAE,MAAM,CAAA;IACf,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,WAAW,CAAA;IACxB,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,+DAA+D;IAC/D,UAAU,EAAE,eAAe,EAAE,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,iBAAiB,CAAA;IAC3D,8EAA8E;IAC9E,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACtD;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,eAAe,CAAA;IAC9B,oFAAoF;IACpF,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B;;;;OAIG;IACH,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAA;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;IACrB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,SAAS,GAAG,SAAS,CAAA;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC3B;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,EAAE,YAAY,CAAA;IACnB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,YAAY;IAC3B,mFAAmF;IACnF,IAAI,EAAE,MAAM,CAAA;IACZ,sEAAsE;IACtE,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,UAAU,CAAA;IACvB,iEAAiE;IACjE,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,uFAAuF;IACvF,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExE;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;mFAC+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAAA;IACtC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;CAC9D"}