@sema-agent/core 1.279.0

package/dist/orchestration/run-workflow-tool.js

@@ -0,0 +1,431 @@
+import { Type } from "typebox";
+import { defineTool } from "../core/tools.js";
+import { redactHostLeaks, boundedRedactedSummary } from "../core/untrusted-egress.js";
+import { startWorkflow } from "./workflow.js";
+import { buildWorkflowPrimitives } from "./workflow-primitives.js";
+import { parseWorkflowMeta, splitWorkflowMeta, workflowScriptReadsClockOrRandom } from "./workflow-meta.js";
+import { mergeWorkflowArgs, normalizeStringArg } from "./workflow-script-store.js";
+import { builtinWorkflowListings, resolveBuiltinWorkflow } from "./builtin-workflows.js";
+import { workflowSizeGuidelineSection } from "./workflow-size-guideline.js";
+export const RUN_WORKFLOW_TOOL_NAME = "Workflow";
+function stripCodeFences(s) {
+    const t = s.trim();
+    const m = /^```[A-Za-z]*\r?\n([\s\S]*?)\r?\n?```$/.exec(t);
+    return m ? m[1] : s;
+}
+const DEFAULTS = {
+    maxScriptChars: 100_000,
+    maxAgents: 50,
+    totalTimeoutMs: 600_000,
+    perAgentTimeoutSec: 300,
+    maxResultChars: 100_000,
+    maxLogChars: 10_000,
+};
+function completionSummary(name, run) {
+    const cleanName = name?.replace(/[^\p{L}\p{N} _.:/-]/gu, "").replace(/\s+/g, " ").trim().slice(0, 60);
+    const done = run.agents.filter((a) => a.status === "completed").length;
+    const failed = run.agents.filter((a) => a.status === "failed").length;
+    const secs = run.endedAt !== undefined ? Math.max(0, Math.round((run.endedAt - run.startedAt) / 1000)) : undefined;
+    const elapsed = secs === undefined ? "" : secs >= 60 ? ` in ${Math.floor(secs / 60)}m${secs % 60}s` : ` in ${secs}s`;
+    return (`workflow${cleanName ? ` "${cleanName}"` : ""} completed${elapsed} — agents ${done}/${run.agents.length} done` +
+        `${failed > 0 ? ` (${failed} failed)` : ""}; result via TaskOutput("${run.id}")`);
+}
+const SCRIPT_ERROR_CODES = new Set([
+    "workflow.script_error",
+    "workflow.nesting",
+    "workflow.model_not_allowed",
+    "workflow.agent_schema",
+    "workflow.max_agents",
+    "workflow.result_too_large",
+    "workflow.budget_exceeded",
+]);
+function failureSummary(err) {
+    const e = err;
+    const code = typeof e?.code === "string" ? e.code : undefined;
+    if (code && SCRIPT_ERROR_CODES.has(code) && typeof e?.message === "string") {
+        const msg = redactHostLeaks(e.message);
+        return `workflow failed (${code}): ${msg.length > 200 ? `${msg.slice(0, 200)}…` : msg}`;
+    }
+    return code && code.startsWith("workflow.") ? `workflow failed (${code})` : "workflow failed";
+}
+export function workflowWhenToUseText(m) {
+    return (m.whenToUse || m.description) || undefined;
+}
+export function renderNamedWorkflowListing(entries) {
+    if (entries.length === 0)
+        return undefined;
+    const lines = entries.map((e) => {
+        const w = workflowWhenToUseText(e);
+        return `- ${e.name}${w ? `: ${w}` : ""}`;
+    });
+    return ("Named workflows available via {name} (registered defaults merge UNDER your `args`; a top-level key you pass wins wholesale):\n" +
+        lines.join("\n"));
+}
+async function collectNamedWorkflowListings(store, builtinsEnabled) {
+    const byName = new Map();
+    if (builtinsEnabled) {
+        for (const b of builtinWorkflowListings()) {
+            let shadowed = false;
+            if (store?.resolveName) {
+                try {
+                    shadowed = (await store.resolveName(b.name)) !== undefined;
+                }
+                catch {
+                    shadowed = false;
+                }
+            }
+            byName.set(b.name, shadowed ? { name: b.name, description: "deployment-registered workflow (shadows the built-in of the same name)" } : b);
+        }
+    }
+    try {
+        const listed = await store?.list?.();
+        if (Array.isArray(listed)) {
+            for (const e of listed) {
+                if (e && typeof e.name === "string" && e.name.length > 0)
+                    byName.set(e.name, e);
+            }
+        }
+    }
+    catch {
+    }
+    return [...byName.values()];
+}
+export async function createRunWorkflowTool(d) {
+    if (d.scriptRunner.safeForUntrustedScripts !== true) {
+        throw new Error("createRunWorkflowTool: refusing to mount run_workflow on a runner that is not safeForUntrustedScripts (design/98 fail-closed)");
+    }
+    const lim = d.limits ?? {};
+    const maxScriptChars = lim.maxScriptChars ?? DEFAULTS.maxScriptChars;
+    const childCaps = {
+        perAgentTimeoutSec: lim.perAgentTimeoutSec ?? DEFAULTS.perAgentTimeoutSec,
+        childMaxCostUsd: lim.childMaxCostUsd,
+        childMaxTokens: lim.childMaxTokens,
+        childMaxTurns: lim.childMaxTurns,
+    };
+    const governance = { baseline: d.governanceBaseline, models: d.models, caps: childCaps };
+    const builtinsEnabled = d.builtinWorkflows !== false;
+    const namedWorkflowSection = renderNamedWorkflowListing(await collectNamedWorkflowListings(d.scriptStore, builtinsEnabled));
+    const sizeGuidelineSection = workflowSizeGuidelineSection(d.sizeGuideline ?? lim.sizeGuideline);
+    const structuredError = (message) => ({ content: JSON.stringify({ error: message }) });
+    return defineTool({
+        name: RUN_WORKFLOW_TOOL_NAME,
+        aliases: ["RunWorkflow", "run_workflow"],
+        description: "Author and run your own deterministic JS WORKFLOW that spawns and coordinates sub-agents. Pass `script` " +
+            "(begins with `export const meta = {...}`, then an async body) and optional `args` (a JSON value). Returns a " +
+            "runId immediately; the workflow runs asynchronously and you are notified on completion. Use for a " +
+            "SUBSTANTIAL task that genuinely decomposes.\n" +
+            "ONLY call this tool when multi-agent orchestration was explicitly opted into: the user/operator asked " +
+            "for a workflow or fan-out in their own words, a skill or task directive requests it, or your standing " +
+            "instructions authorize self-orchestration. For any other task — even one that would clearly benefit " +
+            "from parallelism — do NOT call this tool: delegate individual sub-agents instead, or briefly describe " +
+            "what a workflow could do and ask first. A task merely LOOKING decomposable does not count.\n" +
+            "Pick the MINIMAL primitive that fits — do NOT reach for parallel by default:\n" +
+            "• agent(spec): ONE sub-agent (sequential when awaited). The DEFAULT — use it for any single coherent task. " +
+            "Both forms work: agent({ objective: '…', label: '…' }) and agent('prompt string', opts?). " +
+            "Do NOT split a task into parallel agents unless its parts are GENUINELY INDEPENDENT.\n" +
+            "• parallel(thunks): run agents concurrently with a BARRIER (await ALL). ONLY for INDEPENDENT fan-out whose " +
+            "results you need together. If the parts share state, depend on each other, or just 'feel like multiple " +
+            "things', it is NOT parallel. A flat independent fan-out IS parallel — not workflow (and if those agents " +
+            "WRITE the same repo, it is isolation, below).\n" +
+            "• pipeline(items, ...stages): each item flows through the stages on its own chain (no barrier). Use for " +
+            "per-item STAGED processing of many items (e.g. for each file: lint → test → report).\n" +
+            "• agent(spec, { isolation: \"worktree\" }): run the agent in an ISOLATED git worktree. Use specifically when " +
+            "concurrent agents WRITE THE SAME FILES/REPO and must not clobber each other — even as a parallel fan-out " +
+            "(plain parallel would clobber); this takes precedence over plain parallel. A separate-working-copy need, " +
+            "NOT merely 'several agents'.\n" +
+            "• resumeFromRunId (this tool's arg): RESUME a prior/crashed run — replay its completed agents, run only new work.\n" +
+            "• scriptPath / name (this tool's args): when a script store is wired, every run persists its script and " +
+            "returns its scriptPath — to iterate, EDIT that file and re-invoke with {scriptPath} instead of resending " +
+            "the full script; {name} runs a saved workflow.\n" +
+            "• budget: SCALE the number/depth of agents to a token/cost CEILING — use whenever the task names a budget. " +
+            "Guard budget-driven loops on budget.total: with no budget set, budget.remaining() returns Infinity and a " +
+            "while-loop runs straight into the agent cap — add a hard iteration cap or pass a budget.\n" +
+            "\n" +
+            "Environment facts (read before writing the script):\n" +
+            "• Sub-agents may run in an isolated working directory — when a task concerns specific files/repos, put " +
+            "ABSOLUTE paths in the agent's objective; never assume it sees your cwd.\n" +
+            "• The script itself has NO host APIs: no require/import, no process/fs/fetch, no setTimeout (schedule " +
+            "time-based work outside the workflow). Only agent/parallel/pipeline/phase/log/budget/args exist.\n" +
+            "• Scripts must be DETERMINISTIC: `Date.now()`/`Math.random()`/argless `new Date()` throw (they would " +
+            "break resume) — pass timestamps in via `args`, stamp results after the workflow returns, and for " +
+            "randomness vary the agent prompt/label by index.\n" +
+            "• schema: if an agent's result is consumed by CODE or a downstream stage (a scorer, a file writer, the " +
+            "next pipeline stage, your own JSON.parse), pass opts.schema to FORCE structured output — prose transfer " +
+            "silently loses fields. Only results a human/LLM reads as narrative may omit schema.\n" +
+            "• phase (two forms, both fine): bare marker — phase('Scan'); groups every later agent() under 'Scan' " +
+            "until the next phase() call. Scoped — await phase('Fix', async () => { ...agents... }); groups just the " +
+            "body. Give each stage a phase so progress renders as stage groups.\n" +
+            "• spec.modelName works only when the deployment configured a workflow model allowlist; if unsure, omit " +
+            "modelName and the agent runs on the deployment's default role.\n" +
+            "\n" +
+            "Don't race. After launching, you know nothing about what the workflow found. Never fabricate or predict its " +
+            "results in any format — not as prose, summary, or structured output. When a completion notifier is wired " +
+            "(the launch note will say so) END YOUR TURN and wait — the notification carries the result; poll " +
+            "TaskOutput(task_id) only when the user asks for progress. If the user asks a follow-up before it lands, " +
+            "give status, not a guess." +
+            (namedWorkflowSection !== undefined ? `\n\n${namedWorkflowSection}` : "") +
+            sizeGuidelineSection,
+        parameters: Type.Object({
+            script: Type.Optional(Type.String({
+                description: "Self-contained workflow script. Must begin with `export const meta = { name, description, phases }` " +
+                    "(pure literal, no computed values) followed by the script body using agent()/parallel()/pipeline()/phase().",
+            })),
+            name: Type.Optional(Type.String({
+                description: "Name of a predefined workflow (a saved script in the deployment's workflow store, or a built-in — " +
+                    "see the named-workflow list in this tool's description). Resolves to a self-contained script; the " +
+                    "registration's default args merge under your `args`.",
+            })),
+            scriptPath: Type.Optional(Type.String({
+                description: "Path to a workflow script file persisted by a prior invocation (each run's tool result carries its " +
+                    "scriptPath when the deployment wires a script store). To iterate, edit that file and re-invoke with the " +
+                    "same `scriptPath` instead of re-sending the full script. Takes precedence over `script` and `name`.",
+            })),
+            args: Type.Optional(Type.Unknown()),
+            resumeFromRunId: Type.Optional(Type.String({
+                description: "design/97 CORE-9: resume a PRIOR run of the SAME script — replays the longest unchanged prefix of " +
+                    "its agent results from the journal and runs only the first changed/new call + everything after live. " +
+                    "Requires a journal-backed deployment; omit for a fresh run.",
+            })),
+        }),
+        effect: "write",
+        execute: async (rawArgs, ctx) => {
+            const rawScript = rawArgs.script;
+            const rawName = rawArgs.name;
+            const rawScriptPath = rawArgs.scriptPath;
+            const scriptArgs = rawArgs.args;
+            const rawResume = rawArgs.resumeFromRunId;
+            const resumeFromRunId = typeof rawResume === "string" && rawResume.length > 0 ? rawResume : undefined;
+            const sourceTaskId = ctx.taskId ?? d.sourceTaskId;
+            const principal = ctx.principal ?? d.principal;
+            const taskScope = ctx.principal ?? d.scope;
+            let script;
+            let registeredDefaultArgs;
+            let registeredStringArgKey;
+            if (typeof rawScriptPath === "string" && rawScriptPath.length > 0) {
+                if (!d.scriptStore)
+                    return structuredError("scriptPath requires a deployment workflow script store — none is wired; pass `script` inline");
+                try {
+                    script = await d.scriptStore.load(rawScriptPath);
+                }
+                catch (err) {
+                    return structuredError(`failed to read workflow script at scriptPath: ${redactHostLeaks(err instanceof Error ? err.message : String(err)).slice(0, 300)}`);
+                }
+            }
+            else if (typeof rawScript === "string" && rawScript.length > 0) {
+                script = stripCodeFences(rawScript);
+            }
+            else if (typeof rawName === "string" && rawName.length > 0) {
+                if (!d.scriptStore?.resolveName && !builtinsEnabled) {
+                    return structuredError("named workflows require a deployment workflow script store — none is wired (and built-in workflows are disabled); pass `script` inline");
+                }
+                let resolved;
+                if (d.scriptStore?.resolveName) {
+                    try {
+                        resolved = await d.scriptStore.resolveName(rawName);
+                    }
+                    catch (err) {
+                        return structuredError(`failed to resolve workflow name: ${redactHostLeaks(err instanceof Error ? err.message : String(err)).slice(0, 300)}`);
+                    }
+                }
+                if (resolved === undefined && builtinsEnabled) {
+                    resolved = resolveBuiltinWorkflow(rawName);
+                }
+                if (resolved === undefined)
+                    return structuredError(`unknown workflow name: ${JSON.stringify(rawName)}`);
+                script = typeof resolved === "string" ? resolved : resolved.script;
+                if (typeof resolved !== "string" && "defaultArgs" in resolved)
+                    registeredDefaultArgs = resolved.defaultArgs;
+                if (typeof resolved !== "string" && typeof resolved.stringArgKey === "string" && resolved.stringArgKey.length > 0) {
+                    registeredStringArgKey = resolved.stringArgKey;
+                }
+            }
+            else {
+                return structuredError("Must provide script, name, or scriptPath");
+            }
+            const effectiveArgs = mergeWorkflowArgs(normalizeStringArg(scriptArgs, registeredDefaultArgs, registeredStringArgKey), registeredDefaultArgs);
+            if (script.length > maxScriptChars) {
+                return structuredError(`script too large: ${script.length} chars > max ${maxScriptChars}`);
+            }
+            let meta;
+            try {
+                meta = parseWorkflowMeta(script);
+            }
+            catch (err) {
+                return structuredError(err instanceof Error ? err.message : String(err));
+            }
+            try {
+                const { body } = splitWorkflowMeta(script);
+                new Function(`return (async function(agent, parallel, pipeline, phase, log, budget, args) {\n${body}\n})`);
+                if (workflowScriptReadsClockOrRandom(body)) {
+                    return structuredError("Workflow scripts must be deterministic: Date.now()/Math.random()/new Date() are unavailable (breaks resume). " +
+                        "Stamp results after the workflow returns, or pass timestamps via args.");
+                }
+            }
+            catch (err) {
+                return structuredError(`workflow script failed to compile: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            const scriptFn = (wfCtx) => {
+                const primitives = buildWorkflowPrimitives(wfCtx, governance, d.onAgentSpawn, d.parentThinking, principal);
+                return d.scriptRunner.run({ scriptSource: script, primitives, scriptArgs: effectiveArgs, signal: wfCtx.signal }).then((r) => r.result);
+            };
+            let handle;
+            const workflowTaskId = d.taskRegistry?.mintTaskId("workflow");
+            try {
+                handle = startWorkflow(d.runner, scriptFn, {
+                    store: d.store,
+                    ...(d.agents !== undefined ? { agents: d.agents } : {}),
+                    ...(d.builtinAgents !== undefined ? { builtinAgents: d.builtinAgents } : {}),
+                    name: meta.name,
+                    ...(meta.description !== undefined ? { description: meta.description } : {}),
+                    ...(meta.phases !== undefined ? { phases: meta.phases } : {}),
+                    ...(effectiveArgs !== undefined ? { effectiveArgs } : {}),
+                    ...(sourceTaskId !== undefined ? { sourceTaskId } : {}),
+                    ...(d.originatingSessionId !== undefined ? { originatingSessionId: d.originatingSessionId } : {}),
+                    ...(workflowTaskId !== undefined ? { runId: workflowTaskId } : {}),
+                    journalStore: d.journalStore,
+                    ...(resumeFromRunId !== undefined ? { resumeFromRunId } : {}),
+                    scope: d.scope,
+                    signal: ctx.signal,
+                    budget: lim.budget,
+                    maxAgents: lim.maxAgents ?? DEFAULTS.maxAgents,
+                    totalTimeoutMs: lim.totalTimeoutMs ?? DEFAULTS.totalTimeoutMs,
+                    maxResultChars: lim.maxResultChars ?? DEFAULTS.maxResultChars,
+                    maxLogChars: lim.maxLogChars ?? DEFAULTS.maxLogChars,
+                    ...(d.parentCwd !== undefined ? { parentCwd: d.parentCwd } : {}),
+                }, { workflowDepth: d.workflowDepth });
+            }
+            catch (err) {
+                return structuredError(err instanceof Error ? err.message : String(err));
+            }
+            const runId = handle.runId;
+            let persistedScriptPath;
+            if (d.scriptStore) {
+                try {
+                    persistedScriptPath = await d.scriptStore.persist(runId, script);
+                }
+                catch {
+                }
+            }
+            if (d.taskRegistry) {
+                const taskOwner = ctx.taskId ?? d.taskOwner ?? d.sourceTaskId;
+                d.taskRegistry.registerWorkflow({
+                    runId,
+                    handle,
+                    store: d.store,
+                    description: meta.name ?? meta.description,
+                    toolUseId: ctx.toolCallId,
+                    ...(taskOwner !== undefined ? { owner: taskOwner } : {}),
+                    ...(taskScope !== undefined ? { scope: taskScope } : {}),
+                    onServedTerminal: () => {
+                        void Promise.resolve()
+                            .then(() => d.notifier?.ackServed?.({
+                            runId,
+                            ...(d.originatingSessionId !== undefined ? { originatingSessionId: d.originatingSessionId } : {}),
+                            ...(sourceTaskId !== undefined ? { sourceTaskId } : {}),
+                            ...(principal !== undefined ? { principal } : {}),
+                        }))
+                            .catch(() => { });
+                    },
+                });
+            }
+            if (d.notifier) {
+                let notified = false;
+                const fire = (notification) => {
+                    if (notified)
+                        return;
+                    notified = true;
+                    try {
+                        d.taskNotification?.(notification);
+                    }
+                    catch {
+                    }
+                    void Promise.resolve()
+                        .then(() => d.notifier.notify({
+                        runId,
+                        task_id: notification.task_id,
+                        task_type: "workflow",
+                        ...(notification.toolUseId !== undefined ? { toolUseId: notification.toolUseId } : {}),
+                        sourceTaskId,
+                        ...(d.originatingSessionId !== undefined ? { originatingSessionId: d.originatingSessionId } : {}),
+                        principal,
+                        status: notification.status === "completed" ? "completed" : "failed",
+                        summary: notification.summary,
+                        ...(notification.result !== undefined ? { result: notification.result } : {}),
+                        ...(notification.usage !== undefined ? { usage: notification.usage } : {}),
+                    }))
+                        .catch(() => { });
+                };
+                handle.done
+                    .then((res) => fire({
+                    task_id: runId,
+                    task_type: "workflow",
+                    ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}),
+                    status: "completed",
+                    summary: completionSummary(meta.name, res.run),
+                    result: boundedRedactedSummary(res.result, 4000),
+                    usage: res.run.stats,
+                }), (err) => fire({
+                    task_id: runId,
+                    task_type: "workflow",
+                    ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}),
+                    status: "failed",
+                    summary: failureSummary(err),
+                }))
+                    .catch(() => { });
+            }
+            else {
+                let notified = false;
+                const fire = (notification) => {
+                    if (notified)
+                        return;
+                    notified = true;
+                    try {
+                        d.taskNotification?.(notification);
+                    }
+                    catch {
+                    }
+                };
+                handle.done
+                    .then((res) => fire({
+                    task_id: runId,
+                    task_type: "workflow",
+                    ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}),
+                    status: "completed",
+                    summary: completionSummary(meta.name, res.run),
+                    result: boundedRedactedSummary(res.result, 4000),
+                    usage: res.run.stats,
+                }), (err) => fire({
+                    task_id: runId,
+                    task_type: "workflow",
+                    ...(ctx.toolCallId !== undefined ? { toolUseId: ctx.toolCallId } : {}),
+                    status: "failed",
+                    summary: failureSummary(err),
+                }))
+                    .catch(() => { });
+            }
+            return {
+                details: { type: "workflow-run", status: "backgrounded", workflowRunId: runId },
+                content: JSON.stringify({
+                    runId,
+                    task_id: runId,
+                    status: "started",
+                    ...(persistedScriptPath !== undefined ? { scriptPath: persistedScriptPath } : {}),
+                    note: (() => {
+                        const pollExpr = d.taskRegistry ? `TaskOutput({ task_id: "${runId}" })` : undefined;
+                        const carries = pollExpr ? ` A terminal ${pollExpr} reply carries its result.` : "";
+                        if (d.notifier) {
+                            return `The workflow runs asynchronously. You will be NOTIFIED when it completes (the notification carries the result). End your turn and wait — do not poll unless the user asks for progress.${carries}`;
+                        }
+                        if (d.taskNotification) {
+                            return `The workflow runs asynchronously. Its completion is injected into THIS session if it is still active; if you have ended your turn and hear nothing, ${pollExpr ? `poll ${pollExpr}` : "there is no poll path wired"}.${carries}`;
+                        }
+                        return pollExpr
+                            ? `The workflow runs asynchronously and no completion notifier is wired. Poll ${pollExpr}.${carries}`
+                            : "The workflow runs asynchronously; no completion notifier is wired and no status/poll path is available.";
+                    })(),
+                }),
+            };
+        },
+    });
+}
+//# sourceMappingURL=run-workflow-tool.js.map

package/dist/orchestration/run-workflow-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-workflow-tool.js","sourceRoot":"","sources":["../../src/orchestration/run-workflow-tool.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAS9C,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAAE,uBAAuB,EAA2B,MAAM,0BAA0B,CAAC;AAE5F,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,gCAAgC,EAAE,MAAM,oBAAoB,CAAC;AAE5G,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAqF,MAAM,4BAA4B,CAAC;AACtK,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,4BAA4B,EAA8B,MAAM,8BAA8B,CAAC;AAKxG,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AA8EjD,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,QAAQ,GAAG;IACf,cAAc,EAAE,OAAO;IACvB,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,OAAO;IACvB,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,OAAO;IACvB,WAAW,EAAE,MAAM;CACX,CAAC;AAUX,SAAS,iBAAiB,CAAC,IAAwB,EAAE,GAAwC;IAG3F,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtG,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnH,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC;IACrH,OAAO,CACL,WAAW,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,OAAO,aAAa,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,OAAO;QAC9G,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,4BAA4B,GAAG,CAAC,EAAE,IAAI,CACjF,CAAC;AACJ,CAAC;AAGD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,uBAAuB;IACvB,kBAAkB;IAClB,4BAA4B;IAC5B,uBAAuB;IACvB,qBAAqB;IACrB,2BAA2B;IAC3B,0BAA0B;CAC3B,CAAC,CAAC;AAMH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,CAAC,GAAG,GAAmD,CAAC;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,IAAI,IAAI,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvC,OAAO,oBAAoB,IAAI,MAAM,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC;AAChG,CAAC;AAOD,MAAM,UAAU,qBAAqB,CAAC,CAA+C;IACnF,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC;AACrD,CAAC;AAQD,MAAM,UAAU,0BAA0B,CAAC,OAA4C;IACrF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IACH,OAAO,CACL,gIAAgI;QAChI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACjB,CAAC;AACJ,CAAC;AASD,KAAK,UAAU,4BAA4B,CAAC,KAAsC,EAAE,eAAwB;IAC1G,MAAM,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACvD,IAAI,eAAe,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,EAAE,CAAC;YAC1C,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,KAAK,EAAE,WAAW,EAAE,CAAC;gBACvB,IAAI,CAAC;oBACH,QAAQ,GAAG,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,SAAS,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,KAAK,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,wEAAwE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7I,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;IAET,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAyED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,CAAsB;IAChE,IAAI,CAAC,CAAC,YAAY,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,+HAA+H,CAChI,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC3B,MAAM,cAAc,GAAG,GAAG,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc,CAAC;IACrE,MAAM,SAAS,GAAsB;QACnC,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,IAAI,QAAQ,CAAC,kBAAkB;QACzE,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;IACF,MAAM,UAAU,GAAuB,EAAE,QAAQ,EAAE,CAAC,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAG7G,MAAM,eAAe,GAAG,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC;IACrD,MAAM,oBAAoB,GAAG,0BAA0B,CAAC,MAAM,4BAA4B,CAAC,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IAK5H,MAAM,oBAAoB,GAAG,4BAA4B,CAAC,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;IAEhG,MAAM,eAAe,GAAG,CAAC,OAAe,EAAuB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAEpH,OAAO,UAAU,CAAC;QAChB,IAAI,EAAE,sBAAsB;QAE5B,OAAO,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC;QACxC,WAAW,EACT,0GAA0G;YAC1G,8GAA8G;YAC9G,oGAAoG;YACpG,+CAA+C;YAK/C,wGAAwG;YACxG,wGAAwG;YACxG,sGAAsG;YACtG,wGAAwG;YACxG,8FAA8F;YAC9F,gFAAgF;YAChF,6GAA6G;YAC7G,4FAA4F;YAC5F,wFAAwF;YACxF,6GAA6G;YAC7G,yGAAyG;YACzG,0GAA0G;YAC1G,iDAAiD;YACjD,0GAA0G;YAC1G,wFAAwF;YAKxF,+GAA+G;YAC/G,2GAA2G;YAC3G,2GAA2G;YAC3G,gCAAgC;YAChC,qHAAqH;YAGrH,0GAA0G;YAC1G,2GAA2G;YAC3G,kDAAkD;YAElD,6GAA6G;YAC7G,2GAA2G;YAC3G,4FAA4F;YAG5F,IAAI;YACJ,uDAAuD;YACvD,yGAAyG;YACzG,2EAA2E;YAC3E,wGAAwG;YACxG,oGAAoG;YAGpG,uGAAuG;YACvG,mGAAmG;YACnG,oDAAoD;YAGpD,yGAAyG;YACzG,0GAA0G;YAC1G,uFAAuF;YACvF,uGAAuG;YACvG,0GAA0G;YAC1G,sEAAsE;YACtE,yGAAyG;YACzG,kEAAkE;YAGlE,IAAI;YACJ,8GAA8G;YAC9G,2GAA2G;YAC3G,mGAAmG;YACnG,0GAA0G;YAC1G,2BAA2B;YAG3B,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAEzE,oBAAoB;QACtB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;YAGtB,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EACT,sGAAsG;oBACtG,6GAA6G;aAChH,CAAC,CACH;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CACjB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EACT,oGAAoG;oBACpG,oGAAoG;oBACpG,sDAAsD;aACzD,CAAC,CACH;YACD,UAAU,EAAE,IAAI,CAAC,QAAQ,CACvB,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EACT,qGAAqG;oBACrG,0GAA0G;oBAC1G,qGAAqG;aACxG,CAAC,CACH;YACD,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACnC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAC5B,IAAI,CAAC,MAAM,CAAC;gBACV,WAAW,EACT,oGAAoG;oBACpG,uGAAuG;oBACvG,6DAA6D;aAChE,CAAC,CACH;SACF,CAAC;QACF,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;YAC9B,MAAM,SAAS,GAAI,OAAgC,CAAC,MAAM,CAAC;YAC3D,MAAM,OAAO,GAAI,OAA8B,CAAC,IAAI,CAAC;YACrD,MAAM,aAAa,GAAI,OAAoC,CAAC,UAAU,CAAC;YACvE,MAAM,UAAU,GAAI,OAA8B,CAAC,IAAI,CAAC;YACxD,MAAM,SAAS,GAAI,OAAyC,CAAC,eAAe,CAAC;YAC7E,MAAM,eAAe,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACtG,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC;YAClD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,CAAC;YAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC;YAI3C,IAAI,MAAc,CAAC;YAEnB,IAAI,qBAA8B,CAAC;YAKnC,IAAI,sBAA0C,CAAC;YAC/C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,CAAC,CAAC,WAAW;oBAAE,OAAO,eAAe,CAAC,8FAA8F,CAAC,CAAC;gBAC3I,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,eAAe,CAAC,iDAAiD,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC7J,CAAC;YACH,CAAC;iBAAM,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAEjE,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;YACtC,CAAC;iBAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,eAAe,EAAE,CAAC;oBACpD,OAAO,eAAe,CAAC,wIAAwI,CAAC,CAAC;gBACnK,CAAC;gBACD,IAAI,QAAsD,CAAC;gBAC3D,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;oBAC/B,IAAI,CAAC;wBACH,QAAQ,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;oBACtD,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,eAAe,CAAC,oCAAoC,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChJ,CAAC;gBACH,CAAC;gBAGD,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,EAAE,CAAC;oBAC9C,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAI,QAAQ,KAAK,SAAS;oBAAE,OAAO,eAAe,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACxG,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACnE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,aAAa,IAAI,QAAQ;oBAAE,qBAAqB,GAAG,QAAQ,CAAC,WAAW,CAAC;gBAI5G,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAClH,sBAAsB,GAAG,QAAQ,CAAC,YAAY,CAAC;gBACjD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,eAAe,CAAC,0CAA0C,CAAC,CAAC;YACrE,CAAC;YAaD,MAAM,aAAa,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,UAAU,EAAE,qBAAqB,EAAE,sBAAsB,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAE9I,IAAI,MAAM,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;gBACnC,OAAO,eAAe,CAAC,qBAAqB,MAAM,CAAC,MAAM,gBAAgB,cAAc,EAAE,CAAC,CAAC;YAC7F,CAAC;YAGD,IAAI,IAA0C,CAAC;YAC/C,IAAI,CAAC;gBACH,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3E,CAAC;YAMD,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAC3C,IAAI,QAAQ,CAAC,kFAAkF,IAAI,MAAM,CAAC,CAAC;gBAK3G,IAAI,gCAAgC,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,OAAO,eAAe,CACpB,+GAA+G;wBAC7G,wEAAwE,CAC3E,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,eAAe,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnH,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,KAAiD,EAAoB,EAAE;gBAIvF,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBAI3G,OAAO,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzI,CAAC,CAAC;YACF,IAAI,MAAM,CAAC;YACX,MAAM,cAAc,GAAG,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,CAAC;gBACH,MAAM,GAAG,aAAa,CACpB,CAAC,CAAC,MAAM,EACR,QAAQ,EACR;oBACE,KAAK,EAAE,CAAC,CAAC,KAAK;oBAEd,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAE5E,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAE5E,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAI7D,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAGzD,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjG,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAIlE,YAAY,EAAE,CAAC,CAAC,YAAY;oBAC5B,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS;oBAC9C,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;oBAC7D,cAAc,EAAE,GAAG,CAAC,cAAc,IAAI,QAAQ,CAAC,cAAc;oBAC7D,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW;oBACpD,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE,EACD,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CACnC,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAEb,OAAO,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAG3B,IAAI,mBAAuC,CAAC;YAC5C,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,mBAAmB,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACnE,CAAC;gBAAC,MAAM,CAAC;gBAET,CAAC;YACH,CAAC;YACD,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;gBACnB,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,CAAC;gBAC9D,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC;oBAC9B,KAAK;oBACL,MAAM;oBACN,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;oBAC1C,SAAS,EAAE,GAAG,CAAC,UAAU;oBACzB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAIxD,gBAAgB,EAAE,GAAG,EAAE;wBACrB,KAAK,OAAO,CAAC,OAAO,EAAE;6BACnB,IAAI,CAAC,GAAG,EAAE,CACT,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC;4BACtB,KAAK;4BACL,GAAG,CAAC,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACjG,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACvD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAClD,CAAC,CACH;6BACA,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBACrB,CAAC;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACf,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,YAAqC,EAAQ,EAAE;oBAC3D,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC;wBACH,CAAC,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,CAAC;oBACrC,CAAC;oBAAC,MAAM,CAAC;oBAET,CAAC;oBAGD,KAAK,OAAO,CAAC,OAAO,EAAE;yBACnB,IAAI,CAAC,GAAG,EAAE,CACT,CAAC,CAAC,QAAS,CAAC,MAAM,CAAC;wBACjB,KAAK;wBACL,OAAO,EAAE,YAAY,CAAC,OAAO;wBAC7B,SAAS,EAAE,UAAU;wBACrB,GAAG,CAAC,YAAY,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACtF,YAAY;wBACZ,GAAG,CAAC,CAAC,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjG,SAAS;wBACT,MAAM,EAAE,YAAY,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;wBACpE,OAAO,EAAE,YAAY,CAAC,OAAO;wBAC7B,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7E,GAAG,CAAC,YAAY,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC3E,CAAC,CACH;yBACA,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrB,CAAC,CAAC;gBACF,MAAM,CAAC,IAAI;qBACR,IAAI,CACH,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,CAAC;oBACH,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,UAAU;oBACrB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;oBAC9C,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;oBAChD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK;iBACrB,CAAC,EACJ,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,CAAC;oBACH,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,UAAU;oBACrB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;iBAC7B,CAAC,CACL;qBAEA,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,IAAI,QAAQ,GAAG,KAAK,CAAC;gBACrB,MAAM,IAAI,GAAG,CAAC,YAAqC,EAAQ,EAAE;oBAC3D,IAAI,QAAQ;wBAAE,OAAO;oBACrB,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC;wBACH,CAAC,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,CAAC;oBACrC,CAAC;oBAAC,MAAM,CAAC;oBAET,CAAC;gBACH,CAAC,CAAC;gBACF,MAAM,CAAC,IAAI;qBACR,IAAI,CACH,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,CAAC;oBACH,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,UAAU;oBACrB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC;oBAC9C,MAAM,EAAE,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;oBAChD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK;iBACrB,CAAC,EACJ,CAAC,GAAG,EAAE,EAAE,CACN,IAAI,CAAC;oBACH,OAAO,EAAE,KAAK;oBACd,SAAS,EAAE,UAAU;oBACrB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,MAAM,EAAE,QAAQ;oBAChB,OAAO,EAAE,cAAc,CAAC,GAAG,CAAC;iBAC7B,CAAC,CACL;qBACA,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrB,CAAC;YASD,OAAO;gBACL,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,KAAK,EAAE;gBAC/E,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;oBACtB,KAAK;oBACL,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,SAAS;oBAEjB,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAMjF,IAAI,EAAE,CAAC,GAAW,EAAE;wBAClB,MAAM,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;wBACpF,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,eAAe,QAAQ,4BAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpF,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;4BACf,OAAO,0LAA0L,OAAO,EAAE,CAAC;wBAC7M,CAAC;wBACD,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;4BACvB,OAAO,uJAAuJ,QAAQ,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,6BAA6B,IAAI,OAAO,EAAE,CAAC;wBAC3O,CAAC;wBACD,OAAO,QAAQ;4BACb,CAAC,CAAC,8EAA8E,QAAQ,IAAI,OAAO,EAAE;4BACrG,CAAC,CAAC,yGAAyG,CAAC;oBAChH,CAAC,CAAC,EAAE;iBACL,CAAC;aACH,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/orchestration/workflow-governance.d.ts

@@ -0,0 +1,30 @@
+import type { Model } from "../internal/llm.js";
+import type { ImageInput, TaskSpec, ThinkingLevel, WorkflowGovernanceBaseline } from "../core/types.js";
+export declare class WorkflowModelNotAllowedError extends Error {
+    readonly modelName: string;
+    readonly code = "workflow.model_not_allowed";
+    constructor(modelName: string, reason: string);
+}
+export interface WorkflowAgentSpec {
+    objective: string;
+    modelName?: string;
+    thinking?: ThinkingLevel;
+    systemPrompt?: string;
+    images?: ImageInput[];
+    limits?: {
+        maxTurns?: number;
+        timeoutSec?: number;
+    };
+    maxCostUsd?: number;
+    maxTokens?: number;
+}
+export declare const WHITELIST_KEYS: readonly ["objective", "modelName", "thinking", "systemPrompt", "images", "limits", "maxCostUsd", "maxTokens"];
+export interface WorkflowChildCaps {
+    perAgentTimeoutSec?: number;
+    childMaxCostUsd?: number;
+    childMaxTokens?: number;
+    childMaxTurns?: number;
+}
+export declare function resolveModelName(name: string, allowlist: string[] | undefined, models: Record<string, Model> | undefined): Model;
+export declare function buildGovernedChildSpec(scriptSpec: unknown, baseline: WorkflowGovernanceBaseline, models: Record<string, Model> | undefined, caps?: WorkflowChildCaps): TaskSpec;
+//# sourceMappingURL=workflow-governance.d.ts.map

package/dist/orchestration/workflow-governance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-governance.d.ts","sourceRoot":"","sources":["../../src/orchestration/workflow-governance.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAMxG,qBAAa,4BAA6B,SAAQ,KAAK;IAGnD,QAAQ,CAAC,SAAS,EAAE,MAAM;IAF5B,QAAQ,CAAC,IAAI,gCAAgC;gBAElC,SAAS,EAAE,MAAM,EAC1B,MAAM,EAAE,MAAM;CAKjB;AAQD,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CAEpB;AAMD,eAAO,MAAM,cAAc,gHASgC,CAAC;AAM5D,MAAM,WAAW,iBAAiB;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAID,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,SAAS,GACxC,KAAK,CAeP;AAsGD,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,OAAO,EACnB,QAAQ,EAAE,0BAA0B,EACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,SAAS,EACzC,IAAI,CAAC,EAAE,iBAAiB,GACvB,QAAQ,CAWV"}

package/dist/orchestration/workflow-governance.js

@@ -0,0 +1,125 @@
+import { tightenTaskSpec } from "../core/tighten-task-spec.js";
+import { WorkflowScriptError } from "./workflow-meta.js";
+export class WorkflowModelNotAllowedError extends Error {
+    modelName;
+    code = "workflow.model_not_allowed";
+    constructor(modelName, reason) {
+        super(`workflow model "${modelName}" is not allowed: ${reason}`);
+        this.modelName = modelName;
+        this.name = "WorkflowModelNotAllowedError";
+    }
+}
+export const WHITELIST_KEYS = [
+    "objective",
+    "modelName",
+    "thinking",
+    "systemPrompt",
+    "images",
+    "limits",
+    "maxCostUsd",
+    "maxTokens",
+];
+const VALID_THINKING = new Set(["off", "minimal", "low", "medium", "high", "xhigh", "max"]);
+export function resolveModelName(name, allowlist, models) {
+    if (!allowlist || allowlist.length === 0) {
+        throw new WorkflowModelNotAllowedError(name, "no workflowModelAllowlist is configured (fail-closed: an LLM-authored script cannot pick a model)");
+    }
+    if (!allowlist.includes(name)) {
+        throw new WorkflowModelNotAllowedError(name, `not in the workflow model allowlist [${allowlist.join(", ")}]`);
+    }
+    const model = models?.[name];
+    if (!model) {
+        throw new WorkflowModelNotAllowedError(name, "allowed by name but not present in RunnerDeps.models");
+    }
+    return model;
+}
+function minDefined(...vals) {
+    const xs = vals.filter((v) => typeof v === "number" && Number.isFinite(v));
+    return xs.length ? Math.min(...xs) : undefined;
+}
+function pickWhitelist(scriptSpec) {
+    if (typeof scriptSpec !== "object" || scriptSpec === null || Array.isArray(scriptSpec)) {
+        throw new WorkflowScriptError("agent(spec): spec must be an object with at least an `objective` string");
+    }
+    const s = scriptSpec;
+    if (typeof s.objective !== "string" || s.objective.length === 0) {
+        throw new WorkflowScriptError("agent(spec): `objective` is required and must be a non-empty string");
+    }
+    const safe = { objective: s.objective };
+    if (s.thinking !== undefined) {
+        if (typeof s.thinking !== "string" || !VALID_THINKING.has(s.thinking)) {
+            throw new WorkflowScriptError(`agent(spec): invalid \`thinking\` (must be one of ${[...VALID_THINKING].join(", ")})`);
+        }
+        safe.thinking = s.thinking;
+    }
+    if (s.systemPrompt !== undefined) {
+        if (typeof s.systemPrompt !== "string")
+            throw new WorkflowScriptError("agent(spec): `systemPrompt` must be a string");
+        safe.systemPrompt = s.systemPrompt;
+    }
+    if (s.images !== undefined) {
+        if (!Array.isArray(s.images))
+            throw new WorkflowScriptError("agent(spec): `images` must be an array");
+        safe.images = s.images;
+    }
+    if (s.limits !== undefined) {
+        if (typeof s.limits !== "object" || s.limits === null || Array.isArray(s.limits)) {
+            throw new WorkflowScriptError("agent(spec): `limits` must be an object { maxTurns?, timeoutSec? }");
+        }
+        const l = s.limits;
+        const limits = {};
+        if (l.maxTurns !== undefined) {
+            if (typeof l.maxTurns !== "number" || !Number.isFinite(l.maxTurns))
+                throw new WorkflowScriptError("agent(spec): `limits.maxTurns` must be a number");
+            limits.maxTurns = l.maxTurns;
+        }
+        if (l.timeoutSec !== undefined) {
+            if (typeof l.timeoutSec !== "number" || !Number.isFinite(l.timeoutSec))
+                throw new WorkflowScriptError("agent(spec): `limits.timeoutSec` must be a number");
+            limits.timeoutSec = l.timeoutSec;
+        }
+        safe.limits = limits;
+    }
+    if (s.maxCostUsd !== undefined) {
+        if (typeof s.maxCostUsd !== "number" || !Number.isFinite(s.maxCostUsd))
+            throw new WorkflowScriptError("agent(spec): `maxCostUsd` must be a number");
+        safe.maxCostUsd = s.maxCostUsd;
+    }
+    if (s.maxTokens !== undefined) {
+        if (typeof s.maxTokens !== "number" || !Number.isFinite(s.maxTokens))
+            throw new WorkflowScriptError("agent(spec): `maxTokens` must be a number");
+        safe.maxTokens = s.maxTokens;
+    }
+    let modelName;
+    if (s.modelName !== undefined) {
+        if (typeof s.modelName !== "string")
+            throw new WorkflowScriptError("agent(spec): `modelName` must be a string (a model NAME, never a Model object)");
+        modelName = s.modelName;
+    }
+    return { safe, modelName };
+}
+function clampResourceLimits(safe, base, caps) {
+    const cost = minDefined(safe.maxCostUsd, base.maxCostUsd, caps?.childMaxCostUsd);
+    if (cost !== undefined)
+        safe.maxCostUsd = cost;
+    const tokens = minDefined(safe.maxTokens, base.maxTokens, caps?.childMaxTokens);
+    if (tokens !== undefined)
+        safe.maxTokens = tokens;
+    const timeoutSec = minDefined(safe.limits?.timeoutSec, base.limits?.timeoutSec, caps?.perAgentTimeoutSec);
+    const maxTurns = minDefined(safe.limits?.maxTurns, base.limits?.maxTurns, caps?.childMaxTurns);
+    if (timeoutSec !== undefined || maxTurns !== undefined) {
+        safe.limits = {
+            ...(maxTurns !== undefined ? { maxTurns } : {}),
+            ...(timeoutSec !== undefined ? { timeoutSec } : {}),
+        };
+    }
+}
+export function buildGovernedChildSpec(scriptSpec, baseline, models, caps) {
+    const { safe, modelName } = pickWhitelist(scriptSpec);
+    if (modelName !== undefined) {
+        safe.model = resolveModelName(modelName, baseline.workflowModelAllowlist, models);
+    }
+    clampResourceLimits(safe, baseline.base, caps);
+    return tightenTaskSpec(baseline.base, safe);
+}
+//# sourceMappingURL=workflow-governance.js.map

package/dist/orchestration/workflow-governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-governance.js","sourceRoot":"","sources":["../../src/orchestration/workflow-governance.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAIzD,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAG1C;IAFF,IAAI,GAAG,4BAA4B,CAAC;IAC7C,YACW,SAAiB,EAC1B,MAAc;QAEd,KAAK,CAAC,mBAAmB,SAAS,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAHxD,cAAS,GAAT,SAAS,CAAQ;QAI1B,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAwBD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,WAAW;IACX,WAAW;IACX,UAAU;IACV,cAAc;IACd,QAAQ;IACR,QAAQ;IACR,YAAY;IACZ,WAAW;CAC8C,CAAC;AAE5D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAa3G,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,SAA+B,EAC/B,MAAyC;IAEzC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,4BAA4B,CACpC,IAAI,EACJ,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,4BAA4B,CAAC,IAAI,EAAE,wCAAwC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,4BAA4B,CAAC,IAAI,EAAE,sDAAsD,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAID,SAAS,UAAU,CAAC,GAAG,IAA+B;IACpD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAQD,SAAS,aAAa,CAAC,UAAmB;IACxC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,mBAAmB,CAAC,yEAAyE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,CAAC,GAAG,UAAqC,CAAC;IAChD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,mBAAmB,CAAC,qEAAqE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;IAC3D,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,QAAyB,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,mBAAmB,CAAC,qDAAqD,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAyB,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAC;QACtH,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,wCAAwC,CAAC,CAAC;QAEtG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAsB,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,mBAAmB,CAAC,oEAAoE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAiC,CAAC;QAC9C,MAAM,MAAM,GAA+C,EAAE,CAAC;QAC9D,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,iDAAiD,CAAC,CAAC;YACrJ,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;gBAAE,MAAM,IAAI,mBAAmB,CAAC,mDAAmD,CAAC,CAAC;YAC3J,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,4CAA4C,CAAC,CAAC;QACpJ,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,mBAAmB,CAAC,2CAA2C,CAAC,CAAC;QACjJ,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/B,CAAC;IACD,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,mBAAmB,CAAC,gFAAgF,CAAC,CAAC;QACrJ,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAQD,SAAS,mBAAmB,CAAC,IAAuB,EAAE,IAAuB,EAAE,IAAwB;IACrG,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAChF,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;IAClD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC1G,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAC/F,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvD,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAYD,MAAM,UAAU,sBAAsB,CACpC,UAAmB,EACnB,QAAoC,EACpC,MAAyC,EACzC,IAAwB;IAExB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAK/C,OAAO,eAAe,CAAC,QAAQ,CAAC,IAAgB,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC"}