@tangle-network/agent-app 0.44.52 → 0.44.54

package/dist/chat-routes/index.d.ts

@@ -5,7 +5,7 @@ import { ChatTurnIdentity, ChatTurnProducer } from '@tangle-network/agent-runtim
 import { C as ChatMessagePart, a as ChatAttachmentPart, e as ChatMentionPart } from '../parts-F8W3-iry.js';
 import { InteractionAnswerRoute, InteractionAnswerRouteOptions } from '../interactions/index.js';
 import { PersistedChatMessageForTurn } from '../stream/index.js';
-import { T as TurnEventStore } from '../turn-buffer-CFKQlnxf.js';
+import { T as TurnEventStore } from '../turn-buffer-COMQUwO2.js';
 import { M as ModelFailoverAttempt } from '../failover-D-3UXXTb.js';
 export { D as DEFAULT_STALE_TURN_LOCK_GRACE_MS, a as DEFAULT_TERMINAL_TURN_LOCK_GRACE_MS, R as ReconcileStaleTurnLockOptions, b as ReconcileStaleTurnLockResult, S as StaleTurnLockSandboxProbeResult, c as StaleTurnLockSessionProbeResult, r as reconcileStaleTurnLock } from '../stale-turn-lock-DucQzvXu.js';
 import { J as JsonRecord } from '../stream-normalizer-CnPnMaTp.js';

package/dist/chat-routes/index.js

@@ -28,7 +28,7 @@ import {
   createBufferedTurnTap,
   replayTurnEvents,
   stampReplaySeq
-} from "../chunk-6VWA26BV.js";
+} from "../chunk-SDEADFHZ.js";
 import {
   createInteractionAnswerRoute
 } from "../chunk-6KMAM7BL.js";

package/dist/{chunk-6VWA26BV.js → chunk-SDEADFHZ.js}

@@ -64,26 +64,37 @@ function createBufferedTurnTap(opts) {
   let settled = false;
   let renewalTimer;
   let renewal = Promise.resolve();
+  let lastRenewedAt = 0;
+  const runningTurnRenewIntervalMs = Math.max(
+    1,
+    opts.runningTurnRenewIntervalMs ?? DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS
+  );
   function clearRenewalTimer() {
     if (renewalTimer !== void 0) clearTimeout(renewalTimer);
     renewalTimer = void 0;
   }
   function scheduleRenewal() {
     if (settled || !opts.scopeId) return;
-    const intervalMs = Math.max(
-      1,
-      opts.runningTurnRenewIntervalMs ?? DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS
-    );
+    clearRenewalTimer();
+    const elapsedMs = Math.max(0, Date.now() - lastRenewedAt);
+    const delayMs = Math.max(1, runningTurnRenewIntervalMs - elapsedMs);
     renewalTimer = setTimeout(() => {
       renewalTimer = void 0;
-      if (settled) return;
-      renewal = opts.store.setStatus(opts.turnId, "running", opts.scopeId).catch(() => {
-      }).then(scheduleRenewal);
-    }, intervalMs);
+      void renewLease();
+    }, delayMs);
     if (typeof renewalTimer === "object" && "unref" in renewalTimer) {
       renewalTimer.unref();
     }
   }
+  async function renewLease() {
+    if (settled || !opts.scopeId) return;
+    clearRenewalTimer();
+    lastRenewedAt = Date.now();
+    renewal = renewal.then(() => opts.store.setStatus(opts.turnId, "running", opts.scopeId)).catch(() => {
+    });
+    await renewal;
+    scheduleRenewal();
+  }
   async function flush() {
     if (pending.length === 0) return;
     const batch = coalesce(pending);
@@ -96,11 +107,15 @@ function createBufferedTurnTap(opts) {
     if (started) return;
     started = true;
     await opts.store.setStatus(opts.turnId, "running", opts.scopeId);
+    lastRenewedAt = Date.now();
     scheduleRenewal();
   }
   return {
     async onEvent(raw) {
       await ensureStarted();
+      if (opts.scopeId && Date.now() - lastRenewedAt >= runningTurnRenewIntervalMs) {
+        await renewLease();
+      }
       const ev = raw && typeof raw === "object" ? { ...raw, _t: Date.now() - startedAt } : raw;
       pending.push(ev);
       if (!clientGone && opts.write) {
@@ -274,4 +289,4 @@ export {
   createD1TurnEventStore,
   createMemoryTurnEventStore
 };
-//# sourceMappingURL=chunk-6VWA26BV.js.map
+//# sourceMappingURL=chunk-SDEADFHZ.js.map

package/dist/chunk-SDEADFHZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/stream/turn-buffer.ts"],"sourcesContent":["/**\n * Resumable chat turns — the router-path answer to \"streams resume on\n * disconnect\" (issue #27). A turn's loop events are teed into a store as they\n * stream; the turn keeps running under `ctx.waitUntil` when the client drops;\n * a reconnecting client replays the buffered tail by sequence number and\n * keeps following until the turn completes.\n *\n *   POST /chat/stream            → pumpBufferedTurn(...) + live NDJSON\n *   GET  /chat/stream/:turnId    → replayTurnEvents({ fromSeq }) → NDJSON\n *\n * Storage is a structural seam ({@link TurnEventStore}); a D1 implementation\n * ships here because that's what Cloudflare products have (KV is unsuitable:\n * eventually consistent cross-isolate). Per-token deltas would mean hundreds\n * of rows per turn, so consecutive text/reasoning deltas are coalesced within\n * a flush window before they are persisted — replay yields slightly chunkier\n * deltas with identical concatenation.\n */\n\nexport type TurnStatus = 'running' | 'complete' | 'error'\n\n/** A running row is a renewable lease, not permanent truth. If the process\n *  driving a turn dies before writing a terminal status, reconnect discovery\n *  must eventually stop returning that abandoned row. */\nexport const DEFAULT_RUNNING_TURN_LEASE_MS = 5 * 60_000\n\n/** Keep a healthy turn's lease comfortably ahead of expiry without turning\n *  per-token streaming into status-write traffic. */\nexport const DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS = 30_000\n\n/** Represent a buffered turn event with a sequence number and serialized event data */\nexport interface BufferedTurnEvent {\n  seq: number\n  /** The serialized event line (JSON string, no trailing newline). */\n  event: string\n}\n\n/** Manage and query turn events and their lifecycle statuses within a scoped event store */\nexport interface TurnEventStore {\n  append(turnId: string, events: BufferedTurnEvent[]): Promise<void>\n  read(turnId: string, fromSeq: number): Promise<BufferedTurnEvent[]>\n  /** Record turn lifecycle. `scopeId` (a thread/session id) is optional and lets\n   *  {@link TurnEventStore.listRunning} rediscover this turn after a client reload\n   *  loses the turnId; stores that don't track scope ignore it. */\n  setStatus(turnId: string, status: TurnStatus, scopeId?: string): Promise<void>\n  getStatus(turnId: string): Promise<TurnStatus | null>\n  /** Unexpired running turnIds for a scope, newest first — so a reloaded client\n   *  (clientRunId lost) can find and resume the in-flight turn without reviving\n   *  a row abandoned by a dead process. Optional: a store records it only if\n   *  `setStatus` was given a `scopeId`. */\n  listRunning?(scopeId: string): Promise<string[]>\n}\n\n/** Configure running-turn lease evaluation. The clock is injectable so store\n *  contract tests do not sleep. Keep the default in production unless a\n *  deployment also tunes the buffer's renewal interval. */\nexport interface TurnEventStoreOptions {\n  runningTurnLeaseMs?: number\n  now?: () => number\n}\n\n// ── coalescing ────────────────────────────────────────────────────────────\n\ntype AnyRecord = Record<string, unknown>\n\nfunction deltaTypeOf(ev: unknown): 'text' | 'reasoning' | null {\n  const e = ev as AnyRecord | null\n  if (!e || typeof e !== 'object') return null\n  const inner = (e.kind === 'event' ? (e.event as AnyRecord | undefined) : e) as AnyRecord | undefined\n  if (!inner || typeof inner !== 'object') return null\n  if ((inner.type === 'text' || inner.type === 'reasoning') && typeof inner.text === 'string') {\n    return inner.type\n  }\n  return null\n}\n\n/** Merge consecutive text/reasoning deltas of the same type into one event.\n *  Concatenation-preserving: replaying the coalesced stream produces the same\n *  accumulated text as the original. */\nexport function coalesceDeltas(events: unknown[]): unknown[] {\n  const out: unknown[] = []\n  for (const ev of events) {\n    const type = deltaTypeOf(ev)\n    const prev = out[out.length - 1]\n    if (type && prev && deltaTypeOf(prev) === type) {\n      const read = (x: unknown): AnyRecord =>\n        ((x as AnyRecord).kind === 'event' ? (x as AnyRecord).event : x) as AnyRecord\n      const merged = JSON.parse(JSON.stringify(prev)) as AnyRecord\n      read(merged).text = String(read(prev).text) + String(read(ev).text)\n      out[out.length - 1] = merged\n      continue\n    }\n    out.push(ev)\n  }\n  return out\n}\n\nfunction asPartUpdate(ev: unknown): { partId: unknown; delta: unknown } | null {\n  const e = ev as AnyRecord | null\n  if (!e || typeof e !== 'object' || e.type !== 'message.part.updated') return null\n  const data = e.data as AnyRecord | undefined\n  if (!data || typeof data !== 'object') return null\n  const part = data.part as AnyRecord | undefined\n  const partId = part?.id ?? data.partId ?? part?.partId ?? null\n  return { partId, delta: data.delta }\n}\n\n/**\n * Coalesce consecutive `message.part.updated` deltas for the SAME part into one\n * event. agent-runtime products stream `ChatStreamEvent` NDJSON\n * (`{type:'message.part.updated', data:{part, delta}}`); pumped through the\n * buffer with the default tool-loop coalescer, every per-token delta persists as\n * its own row because that coalescer never recognizes the shape. Pass this as\n * {@link PumpBufferedTurnOptions.coalesce} instead.\n *\n * Concatenation-preserving for BOTH consumer styles: the merged event keeps the\n * LATEST event's `data.part` (already the cumulative accumulation) and sets\n * `data.delta` to the concatenation of the merged deltas, so a client that\n * appends `delta` and one that reads the cumulative `part` both reconstruct the\n * identical final text.\n */\nexport function coalesceChatStreamEvents(events: unknown[]): unknown[] {\n  const out: unknown[] = []\n  for (const ev of events) {\n    const cur = asPartUpdate(ev)\n    const prevEv = out[out.length - 1]\n    const prev = prevEv ? asPartUpdate(prevEv) : null\n    if (cur && prev && cur.partId != null && cur.partId === prev.partId) {\n      // Base the merged row on the latest event (its `part` is the most complete\n      // accumulation); carry forward the summed delta.\n      const merged = JSON.parse(JSON.stringify(ev)) as AnyRecord\n      ;(merged.data as AnyRecord).delta = String(prev.delta ?? '') + String(cur.delta ?? '')\n      out[out.length - 1] = merged\n      continue\n    }\n    out.push(ev)\n  }\n  return out\n}\n\n// ── buffering core (the tap) ────────────────────────────────────────────────\n\n/** Define options for buffering and flushing turn events with optional live client delivery and event coalescing */\nexport interface BufferedTurnOptions {\n  store: TurnEventStore\n  turnId: string\n  /** Deliver one serialized line to the live client. Throwing here (client\n   *  disconnected) does NOT stop buffering — events keep persisting. */\n  write?: (line: string) => Promise<void> | void\n  /** Flush buffered events to the store at most this often. Default 400ms. */\n  flushIntervalMs?: number\n  /** Per-flush coalescer. Default {@link coalesceDeltas} (tool-loop text/reasoning\n   *  deltas). agent-runtime products streaming `ChatStreamEvent` pass\n   *  {@link coalesceChatStreamEvents} so per-token deltas don't each persist as a\n   *  row. Must be concatenation-preserving. */\n  coalesce?: (events: unknown[]) => unknown[]\n  /** Optional scope (thread/session id) recorded with the turn status, so\n   *  {@link TurnEventStore.listRunning} can find this turn after a reload. */\n  scopeId?: string\n  /** How often to renew the running-turn lease while a producer is alive.\n   *  The timer is backed up by event-driven renewal when a runtime freezes\n   *  unreferenced timers during remote I/O. Default\n   *  {@link DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS}. */\n  runningTurnRenewIntervalMs?: number\n}\n\n/** A push-driven buffer for a turn whose producer the caller does NOT own. */\nexport interface BufferedTurnTap {\n  /** Buffer one event: persist (coalesced, on the flush window) + best-effort\n   *  live-deliver. Wire to a push source's per-event hook (e.g. agent-runtime\n   *  `handleChatTurn`'s `hooks.onEvent`). Marks the turn 'running' on first call. */\n  onEvent(raw: unknown): Promise<void>\n  /** Settle the turn: final flush + set status. Call after the producer resolves\n   *  ('complete') or rejects ('error'). 'error' flushes what was produced first. */\n  done(status?: Extract<TurnStatus, 'complete' | 'error'>): Promise<void>\n}\n\n/**\n * The buffering core. Sequence-numbers every event, delivers it to `write`\n * (best-effort — a disconnected client never stops buffering), and flushes to\n * the store in coalesced batches. Drives both transports:\n *\n *   • {@link pumpBufferedTurn}     — when you OWN an `AsyncIterable` producer.\n *   • this tap (`onEvent`/`done`)  — when the producer owns iteration and only\n *     hands you a push callback (agent-runtime `handleChatTurn`'s `hooks.onEvent`\n *     + the finished body). Durability stays here in the shell; the engine needs\n *     no `TurnEventStore` seam.\n */\nexport function createBufferedTurnTap(opts: BufferedTurnOptions): BufferedTurnTap {\n  const flushIntervalMs = opts.flushIntervalMs ?? 400\n  const coalesce = opts.coalesce ?? coalesceDeltas\n  const startedAt = Date.now()\n  let seq = 0\n  let clientGone = false\n  let pending: unknown[] = []\n  let lastFlush = Date.now()\n  let started = false\n  let settled = false\n  let renewalTimer: ReturnType<typeof setTimeout> | undefined\n  let renewal: Promise<void> = Promise.resolve()\n  let lastRenewedAt = 0\n  const runningTurnRenewIntervalMs = Math.max(\n    1,\n    opts.runningTurnRenewIntervalMs ?? DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS,\n  )\n\n  function clearRenewalTimer(): void {\n    if (renewalTimer !== undefined) clearTimeout(renewalTimer)\n    renewalTimer = undefined\n  }\n\n  function scheduleRenewal(): void {\n    if (settled || !opts.scopeId) return\n    clearRenewalTimer()\n    const elapsedMs = Math.max(0, Date.now() - lastRenewedAt)\n    const delayMs = Math.max(1, runningTurnRenewIntervalMs - elapsedMs)\n    renewalTimer = setTimeout(() => {\n      renewalTimer = undefined\n      void renewLease()\n    }, delayMs)\n    // A deliberately abandoned tap in a Node test must not keep the process\n    // alive until the production renewal interval elapses.\n    if (typeof renewalTimer === 'object' && 'unref' in renewalTimer) {\n      renewalTimer.unref()\n    }\n  }\n\n  async function renewLease(): Promise<void> {\n    if (settled || !opts.scopeId) return\n    clearRenewalTimer()\n    lastRenewedAt = Date.now()\n    renewal = renewal\n      .then(() => opts.store.setStatus(opts.turnId, 'running', opts.scopeId))\n      .catch(() => {})\n    await renewal\n    scheduleRenewal()\n  }\n\n  async function flush(): Promise<void> {\n    if (pending.length === 0) return\n    const batch = coalesce(pending)\n    pending = []\n    const rows = batch.map((ev) => ({ seq: ++seq, event: JSON.stringify(ev) }))\n    await opts.store.append(opts.turnId, rows)\n    lastFlush = Date.now()\n  }\n\n  async function ensureStarted(): Promise<void> {\n    if (started) return\n    started = true\n    await opts.store.setStatus(opts.turnId, 'running', opts.scopeId)\n    lastRenewedAt = Date.now()\n    scheduleRenewal()\n  }\n\n  return {\n    async onEvent(raw) {\n      await ensureStarted()\n      // Cloudflare may freeze an unreferenced timer while a producer is\n      // awaiting remote I/O. A real event (including the route heartbeat)\n      // therefore also renews any lease whose interval has elapsed.\n      if (\n        opts.scopeId &&\n        Date.now() - lastRenewedAt >= runningTurnRenewIntervalMs\n      ) {\n        await renewLease()\n      }\n      // Stamp ms-since-turn-start so any stored turn is replayable AND traceable\n      // (see ../trace) from the same buffered rows.\n      const ev = raw && typeof raw === 'object' ? { ...(raw as Record<string, unknown>), _t: Date.now() - startedAt } : raw\n      pending.push(ev)\n      if (!clientGone && opts.write) {\n        try {\n          // Live delivery carries a provisional ordering hint, not the persisted\n          // seq (coalescing changes seq assignment); clients resume with the\n          // seqs from replay, or 0 for \"everything\".\n          await opts.write(JSON.stringify(ev))\n        } catch {\n          clientGone = true\n        }\n      }\n      if (Date.now() - lastFlush >= flushIntervalMs) await flush()\n    },\n    async done(status = 'complete') {\n      await ensureStarted()\n      settled = true\n      clearRenewalTimer()\n      await renewal\n      if (status === 'error') {\n        await flush().catch(() => {})\n        await opts.store.setStatus(opts.turnId, 'error', opts.scopeId).catch(() => {})\n        return\n      }\n      await flush()\n      await opts.store.setStatus(opts.turnId, 'complete', opts.scopeId)\n    },\n  }\n}\n\n// ── pump (producer side) ──────────────────────────────────────────────────\n\n/** Define options to pump data from an asynchronous iterable source with buffered turn control */\nexport interface PumpBufferedTurnOptions extends BufferedTurnOptions {\n  source: AsyncIterable<unknown>\n}\n\n/**\n * Drive a turn to completion regardless of the live client, when you OWN the\n * producer as an `AsyncIterable`. A thin driver over {@link createBufferedTurnTap}.\n * Returns a promise that resolves when the turn finishes — hand it to\n * `ctx.waitUntil` so a disconnect can't kill the turn. Never rejects on\n * client-write failure; a source error marks the turn 'error' (after flushing\n * what was produced) and rethrows.\n */\nexport async function pumpBufferedTurn(opts: PumpBufferedTurnOptions): Promise<void> {\n  const tap = createBufferedTurnTap(opts)\n  try {\n    for await (const raw of opts.source) await tap.onEvent(raw)\n    await tap.done('complete')\n  } catch (err) {\n    await tap.done('error')\n    throw err\n  }\n}\n\n// ── replay (consumer side) ────────────────────────────────────────────────\n\n/** Define options for replaying turn events with control over sequence, polling, and timeout */\nexport interface ReplayTurnEventsOptions {\n  store: TurnEventStore\n  turnId: string\n  /** Replay strictly after this sequence number (0 = from the beginning). */\n  fromSeq?: number\n  /** Poll cadence while the turn is still running. Default 500ms. */\n  pollMs?: number\n  /** Give up following a 'running' turn after this long. Default 120s. */\n  timeoutMs?: number\n}\n\n/**\n * Yield buffered events after `fromSeq`, then keep polling while the turn is\n * still 'running' until it completes, errors, or times out. Terminates with a\n * final `{seq: -1, event: '{\"type\":\"turn_status\",...}'}` marker so clients\n * know why the replay ended.\n */\nexport async function* replayTurnEvents(opts: ReplayTurnEventsOptions): AsyncGenerator<BufferedTurnEvent> {\n  const pollMs = opts.pollMs ?? 500\n  const timeoutMs = opts.timeoutMs ?? 120_000\n  let cursor = opts.fromSeq ?? 0\n  const deadline = Date.now() + timeoutMs\n\n  for (;;) {\n    const batch = await opts.store.read(opts.turnId, cursor)\n    for (const row of batch) {\n      cursor = Math.max(cursor, row.seq)\n      yield row\n    }\n    const status = await opts.store.getStatus(opts.turnId)\n    if (status !== 'running') {\n      yield { seq: -1, event: JSON.stringify({ type: 'turn_status', status: status ?? 'unknown' }) }\n      return\n    }\n    if (Date.now() >= deadline) {\n      yield { seq: -1, event: JSON.stringify({ type: 'turn_status', status: 'timeout' }) }\n      return\n    }\n    await new Promise((r) => setTimeout(r, pollMs))\n  }\n}\n\n/**\n * Serialize a replayed row for the wire, stamping the buffer ordinal ONTO the\n * line so a reconnecting client can continue from `?fromSeq=<lastSeq>`.\n *\n * The seq lives on the {@link BufferedTurnEvent} row wrapper, not inside the\n * serialized event — `flush()` builds `{seq: ++seq, event: JSON.stringify(ev)}`.\n * A route that enqueues `row.event` alone therefore emits lines with no seq at\n * all, and every client cursor silently pins to 0: each reconnect refetches the\n * whole turn and re-applies every delta onto already-rendered state. This\n * restores the contract `web-react/chat-stream` already documents (\"replayed\n * lines carry an extra `seq` — transparently ignored\").\n *\n * The `{seq: -1}` `turn_status` sentinel is passed through unstamped: it is a\n * terminator, not a cursor position, and stamping it would move a client's\n * cursor to -1.\n *\n * Fail-soft by construction — a line that is not a JSON object passes through\n * verbatim. A stamping bug must degrade to today's behaviour, never break a\n * replay.\n */\nexport function stampReplaySeq(row: BufferedTurnEvent): string {\n  if (row.seq <= 0) return row.event\n  const line = row.event\n  // Cheap splice instead of parse+stringify: these rows are already canonical\n  // JSON objects from `JSON.stringify`, and replay is a hot per-event path.\n  if (line.charCodeAt(0) !== 0x7b /* { */) return line\n  const rest = line.slice(1)\n  return rest.trimStart().startsWith('}')\n    ? `{\"seq\":${row.seq}${rest}`\n    : `{\"seq\":${row.seq},${rest}`\n}\n\n// ── D1 store ──────────────────────────────────────────────────────────────\n\n/** Minimal structural D1 contract (Cloudflare `D1Database` satisfies it). */\nexport interface D1LikeForTurns {\n  prepare(sql: string): {\n    bind(...values: unknown[]): {\n      run(): Promise<unknown>\n      all<T = Record<string, unknown>>(): Promise<{ results: T[] }>\n      first<T = Record<string, unknown>>(): Promise<T | null>\n    }\n  }\n}\n\n/** Schema for the D1 store — append to the product's migrations. */\nexport const TURN_EVENTS_MIGRATION_SQL = `\nCREATE TABLE IF NOT EXISTS turn_events (\n  turnId TEXT NOT NULL,\n  seq INTEGER NOT NULL,\n  event TEXT NOT NULL,\n  PRIMARY KEY (turnId, seq)\n);\nCREATE TABLE IF NOT EXISTS turn_status (\n  turnId TEXT PRIMARY KEY,\n  status TEXT NOT NULL,\n  scopeId TEXT,\n  updatedAt TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_turn_status_scope ON turn_status (scopeId, status);\n`\n\n/** For deployments whose `turn_status` table predates `scopeId`/`listRunning` —\n *  run once to add the column (the CREATE above already includes it for new\n *  deployments). SQLite ignores a duplicate-add error if already applied. */\nexport const TURN_STATUS_SCOPE_MIGRATION_SQL = `ALTER TABLE turn_status ADD COLUMN scopeId TEXT;`\n\n/** Resolve a TurnEventStore that appends and reads turn events using a D1-like database interface */\nexport function createD1TurnEventStore(\n  db: D1LikeForTurns,\n  options: TurnEventStoreOptions = {},\n): TurnEventStore {\n  const now = options.now ?? Date.now\n  const runningTurnLeaseMs = Math.max(\n    1,\n    options.runningTurnLeaseMs ?? DEFAULT_RUNNING_TURN_LEASE_MS,\n  )\n  return {\n    async append(turnId, events) {\n      if (!events.length) return\n      // One multi-row insert per flush window keeps write volume bounded.\n      const placeholders = events.map(() => '(?, ?, ?)').join(', ')\n      const values = events.flatMap((e) => [turnId, e.seq, e.event])\n      await db.prepare(`INSERT OR IGNORE INTO turn_events (turnId, seq, event) VALUES ${placeholders}`).bind(...values).run()\n    },\n    async read(turnId, fromSeq) {\n      const { results } = await db\n        .prepare('SELECT seq, event FROM turn_events WHERE turnId = ? AND seq > ? ORDER BY seq ASC')\n        .bind(turnId, fromSeq)\n        .all<{ seq: number; event: string }>()\n      return results\n    },\n    async setStatus(turnId, status, scopeId) {\n      // COALESCE preserves a scopeId set on the initial 'running' write when a\n      // later 'complete'/'error' write passes none.\n      await db\n        .prepare(\n          'INSERT INTO turn_status (turnId, status, scopeId, updatedAt) VALUES (?, ?, ?, ?) ON CONFLICT(turnId) DO UPDATE SET status = excluded.status, scopeId = COALESCE(excluded.scopeId, turn_status.scopeId), updatedAt = excluded.updatedAt',\n        )\n        .bind(turnId, status, scopeId ?? null, new Date(now()).toISOString())\n        .run()\n    },\n    async getStatus(turnId) {\n      const row = await db.prepare('SELECT status FROM turn_status WHERE turnId = ?').bind(turnId).first<{ status: TurnStatus }>()\n      return row?.status ?? null\n    },\n    async listRunning(scopeId) {\n      const { results } = await db\n        .prepare(\n          \"SELECT turnId FROM turn_status WHERE scopeId = ? AND status = 'running' AND updatedAt >= ? ORDER BY updatedAt DESC, rowid DESC\",\n        )\n        .bind(scopeId, new Date(now() - runningTurnLeaseMs).toISOString())\n        .all<{ turnId: string }>()\n      return results.map((r) => r.turnId)\n    },\n  }\n}\n\n/** In-memory store for tests and keyless local dev. */\nexport function createMemoryTurnEventStore(\n  options: TurnEventStoreOptions = {},\n): TurnEventStore {\n  const events = new Map<string, BufferedTurnEvent[]>()\n  const status = new Map<string, TurnStatus>()\n  const scopes = new Map<string, string>()\n  const order: string[] = []\n  const updatedAt = new Map<string, number>()\n  const now = options.now ?? Date.now\n  const runningTurnLeaseMs = Math.max(\n    1,\n    options.runningTurnLeaseMs ?? DEFAULT_RUNNING_TURN_LEASE_MS,\n  )\n  return {\n    async append(turnId, rows) {\n      const list = events.get(turnId) ?? []\n      list.push(...rows)\n      events.set(turnId, list)\n    },\n    async read(turnId, fromSeq) {\n      return (events.get(turnId) ?? []).filter((e) => e.seq > fromSeq)\n    },\n    async setStatus(turnId, s, scopeId) {\n      status.set(turnId, s)\n      if (scopeId) scopes.set(turnId, scopeId)\n      if (!order.includes(turnId)) order.push(turnId)\n      updatedAt.set(turnId, now())\n    },\n    async getStatus(turnId) {\n      return status.get(turnId) ?? null\n    },\n    async listRunning(scopeId) {\n      const cutoff = now() - runningTurnLeaseMs\n      return order\n        .filter(\n          (turnId) =>\n            status.get(turnId) === 'running' &&\n            scopes.get(turnId) === scopeId &&\n            (updatedAt.get(turnId) ?? Number.NEGATIVE_INFINITY) >= cutoff,\n        )\n        .sort((left, right) => {\n          const updatedDelta = (updatedAt.get(right) ?? 0) - (updatedAt.get(left) ?? 0)\n          return updatedDelta || order.indexOf(right) - order.indexOf(left)\n        })\n    },\n  }\n}\n"],"mappings":";AAuBO,IAAM,gCAAgC,IAAI;AAI1C,IAAM,yCAAyC;AAqCtD,SAAS,YAAY,IAA0C;AAC7D,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;AACxC,QAAM,QAAS,EAAE,SAAS,UAAW,EAAE,QAAkC;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,OAAK,MAAM,SAAS,UAAU,MAAM,SAAS,gBAAgB,OAAO,MAAM,SAAS,UAAU;AAC3F,WAAO,MAAM;AAAA,EACf;AACA,SAAO;AACT;AAKO,SAAS,eAAe,QAA8B;AAC3D,QAAM,MAAiB,CAAC;AACxB,aAAW,MAAM,QAAQ;AACvB,UAAM,OAAO,YAAY,EAAE;AAC3B,UAAM,OAAO,IAAI,IAAI,SAAS,CAAC;AAC/B,QAAI,QAAQ,QAAQ,YAAY,IAAI,MAAM,MAAM;AAC9C,YAAM,OAAO,CAAC,MACV,EAAgB,SAAS,UAAW,EAAgB,QAAQ;AAChE,YAAM,SAAS,KAAK,MAAM,KAAK,UAAU,IAAI,CAAC;AAC9C,WAAK,MAAM,EAAE,OAAO,OAAO,KAAK,IAAI,EAAE,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,IAAI;AAClE,UAAI,IAAI,SAAS,CAAC,IAAI;AACtB;AAAA,IACF;AACA,QAAI,KAAK,EAAE;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,aAAa,IAAyD;AAC7E,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,OAAO,MAAM,YAAY,EAAE,SAAS,uBAAwB,QAAO;AAC7E,QAAM,OAAO,EAAE;AACf,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,OAAO,KAAK;AAClB,QAAM,SAAS,MAAM,MAAM,KAAK,UAAU,MAAM,UAAU;AAC1D,SAAO,EAAE,QAAQ,OAAO,KAAK,MAAM;AACrC;AAgBO,SAAS,yBAAyB,QAA8B;AACrE,QAAM,MAAiB,CAAC;AACxB,aAAW,MAAM,QAAQ;AACvB,UAAM,MAAM,aAAa,EAAE;AAC3B,UAAM,SAAS,IAAI,IAAI,SAAS,CAAC;AACjC,UAAM,OAAO,SAAS,aAAa,MAAM,IAAI;AAC7C,QAAI,OAAO,QAAQ,IAAI,UAAU,QAAQ,IAAI,WAAW,KAAK,QAAQ;AAGnE,YAAM,SAAS,KAAK,MAAM,KAAK,UAAU,EAAE,CAAC;AAC3C,MAAC,OAAO,KAAmB,QAAQ,OAAO,KAAK,SAAS,EAAE,IAAI,OAAO,IAAI,SAAS,EAAE;AACrF,UAAI,IAAI,SAAS,CAAC,IAAI;AACtB;AAAA,IACF;AACA,QAAI,KAAK,EAAE;AAAA,EACb;AACA,SAAO;AACT;AAkDO,SAAS,sBAAsB,MAA4C;AAChF,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,MAAI,UAAqB,CAAC;AAC1B,MAAI,YAAY,KAAK,IAAI;AACzB,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,UAAyB,QAAQ,QAAQ;AAC7C,MAAI,gBAAgB;AACpB,QAAM,6BAA6B,KAAK;AAAA,IACtC;AAAA,IACA,KAAK,8BAA8B;AAAA,EACrC;AAEA,WAAS,oBAA0B;AACjC,QAAI,iBAAiB,OAAW,cAAa,YAAY;AACzD,mBAAe;AAAA,EACjB;AAEA,WAAS,kBAAwB;AAC/B,QAAI,WAAW,CAAC,KAAK,QAAS;AAC9B,sBAAkB;AAClB,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,aAAa;AACxD,UAAM,UAAU,KAAK,IAAI,GAAG,6BAA6B,SAAS;AAClE,mBAAe,WAAW,MAAM;AAC9B,qBAAe;AACf,WAAK,WAAW;AAAA,IAClB,GAAG,OAAO;AAGV,QAAI,OAAO,iBAAiB,YAAY,WAAW,cAAc;AAC/D,mBAAa,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,iBAAe,aAA4B;AACzC,QAAI,WAAW,CAAC,KAAK,QAAS;AAC9B,sBAAkB;AAClB,oBAAgB,KAAK,IAAI;AACzB,cAAU,QACP,KAAK,MAAM,KAAK,MAAM,UAAU,KAAK,QAAQ,WAAW,KAAK,OAAO,CAAC,EACrE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjB,UAAM;AACN,oBAAgB;AAAA,EAClB;AAEA,iBAAe,QAAuB;AACpC,QAAI,QAAQ,WAAW,EAAG;AAC1B,UAAM,QAAQ,SAAS,OAAO;AAC9B,cAAU,CAAC;AACX,UAAM,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,UAAU,EAAE,EAAE,EAAE;AAC1E,UAAM,KAAK,MAAM,OAAO,KAAK,QAAQ,IAAI;AACzC,gBAAY,KAAK,IAAI;AAAA,EACvB;AAEA,iBAAe,gBAA+B;AAC5C,QAAI,QAAS;AACb,cAAU;AACV,UAAM,KAAK,MAAM,UAAU,KAAK,QAAQ,WAAW,KAAK,OAAO;AAC/D,oBAAgB,KAAK,IAAI;AACzB,oBAAgB;AAAA,EAClB;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,KAAK;AACjB,YAAM,cAAc;AAIpB,UACE,KAAK,WACL,KAAK,IAAI,IAAI,iBAAiB,4BAC9B;AACA,cAAM,WAAW;AAAA,MACnB;AAGA,YAAM,KAAK,OAAO,OAAO,QAAQ,WAAW,EAAE,GAAI,KAAiC,IAAI,KAAK,IAAI,IAAI,UAAU,IAAI;AAClH,cAAQ,KAAK,EAAE;AACf,UAAI,CAAC,cAAc,KAAK,OAAO;AAC7B,YAAI;AAIF,gBAAM,KAAK,MAAM,KAAK,UAAU,EAAE,CAAC;AAAA,QACrC,QAAQ;AACN,uBAAa;AAAA,QACf;AAAA,MACF;AACA,UAAI,KAAK,IAAI,IAAI,aAAa,gBAAiB,OAAM,MAAM;AAAA,IAC7D;AAAA,IACA,MAAM,KAAK,SAAS,YAAY;AAC9B,YAAM,cAAc;AACpB,gBAAU;AACV,wBAAkB;AAClB,YAAM;AACN,UAAI,WAAW,SAAS;AACtB,cAAM,MAAM,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC5B,cAAM,KAAK,MAAM,UAAU,KAAK,QAAQ,SAAS,KAAK,OAAO,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC7E;AAAA,MACF;AACA,YAAM,MAAM;AACZ,YAAM,KAAK,MAAM,UAAU,KAAK,QAAQ,YAAY,KAAK,OAAO;AAAA,IAClE;AAAA,EACF;AACF;AAiBA,eAAsB,iBAAiB,MAA8C;AACnF,QAAM,MAAM,sBAAsB,IAAI;AACtC,MAAI;AACF,qBAAiB,OAAO,KAAK,OAAQ,OAAM,IAAI,QAAQ,GAAG;AAC1D,UAAM,IAAI,KAAK,UAAU;AAAA,EAC3B,SAAS,KAAK;AACZ,UAAM,IAAI,KAAK,OAAO;AACtB,UAAM;AAAA,EACR;AACF;AAsBA,gBAAuB,iBAAiB,MAAkE;AACxG,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,aAAa;AACpC,MAAI,SAAS,KAAK,WAAW;AAC7B,QAAM,WAAW,KAAK,IAAI,IAAI;AAE9B,aAAS;AACP,UAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,QAAQ,MAAM;AACvD,eAAW,OAAO,OAAO;AACvB,eAAS,KAAK,IAAI,QAAQ,IAAI,GAAG;AACjC,YAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACrD,QAAI,WAAW,WAAW;AACxB,YAAM,EAAE,KAAK,IAAI,OAAO,KAAK,UAAU,EAAE,MAAM,eAAe,QAAQ,UAAU,UAAU,CAAC,EAAE;AAC7F;AAAA,IACF;AACA,QAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,YAAM,EAAE,KAAK,IAAI,OAAO,KAAK,UAAU,EAAE,MAAM,eAAe,QAAQ,UAAU,CAAC,EAAE;AACnF;AAAA,IACF;AACA,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAAA,EAChD;AACF;AAsBO,SAAS,eAAe,KAAgC;AAC7D,MAAI,IAAI,OAAO,EAAG,QAAO,IAAI;AAC7B,QAAM,OAAO,IAAI;AAGjB,MAAI,KAAK,WAAW,CAAC,MAAM,IAAc,QAAO;AAChD,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,SAAO,KAAK,UAAU,EAAE,WAAW,GAAG,IAClC,UAAU,IAAI,GAAG,GAAG,IAAI,KACxB,UAAU,IAAI,GAAG,IAAI,IAAI;AAC/B;AAgBO,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmBlC,IAAM,kCAAkC;AAGxC,SAAS,uBACd,IACA,UAAiC,CAAC,GAClB;AAChB,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,qBAAqB,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ,sBAAsB;AAAA,EAChC;AACA,SAAO;AAAA,IACL,MAAM,OAAO,QAAQ,QAAQ;AAC3B,UAAI,CAAC,OAAO,OAAQ;AAEpB,YAAM,eAAe,OAAO,IAAI,MAAM,WAAW,EAAE,KAAK,IAAI;AAC5D,YAAM,SAAS,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;AAC7D,YAAM,GAAG,QAAQ,iEAAiE,YAAY,EAAE,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI;AAAA,IACxH;AAAA,IACA,MAAM,KAAK,QAAQ,SAAS;AAC1B,YAAM,EAAE,QAAQ,IAAI,MAAM,GACvB,QAAQ,kFAAkF,EAC1F,KAAK,QAAQ,OAAO,EACpB,IAAoC;AACvC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,UAAU,QAAQ,QAAQ,SAAS;AAGvC,YAAM,GACH;AAAA,QACC;AAAA,MACF,EACC,KAAK,QAAQ,QAAQ,WAAW,MAAM,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY,CAAC,EACnE,IAAI;AAAA,IACT;AAAA,IACA,MAAM,UAAU,QAAQ;AACtB,YAAM,MAAM,MAAM,GAAG,QAAQ,iDAAiD,EAAE,KAAK,MAAM,EAAE,MAA8B;AAC3H,aAAO,KAAK,UAAU;AAAA,IACxB;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,EAAE,QAAQ,IAAI,MAAM,GACvB;AAAA,QACC;AAAA,MACF,EACC,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,kBAAkB,EAAE,YAAY,CAAC,EAChE,IAAwB;AAC3B,aAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,MAAM;AAAA,IACpC;AAAA,EACF;AACF;AAGO,SAAS,2BACd,UAAiC,CAAC,GAClB;AAChB,QAAM,SAAS,oBAAI,IAAiC;AACpD,QAAM,SAAS,oBAAI,IAAwB;AAC3C,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,QAAkB,CAAC;AACzB,QAAM,YAAY,oBAAI,IAAoB;AAC1C,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,qBAAqB,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ,sBAAsB;AAAA,EAChC;AACA,SAAO;AAAA,IACL,MAAM,OAAO,QAAQ,MAAM;AACzB,YAAM,OAAO,OAAO,IAAI,MAAM,KAAK,CAAC;AACpC,WAAK,KAAK,GAAG,IAAI;AACjB,aAAO,IAAI,QAAQ,IAAI;AAAA,IACzB;AAAA,IACA,MAAM,KAAK,QAAQ,SAAS;AAC1B,cAAQ,OAAO,IAAI,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,OAAO;AAAA,IACjE;AAAA,IACA,MAAM,UAAU,QAAQ,GAAG,SAAS;AAClC,aAAO,IAAI,QAAQ,CAAC;AACpB,UAAI,QAAS,QAAO,IAAI,QAAQ,OAAO;AACvC,UAAI,CAAC,MAAM,SAAS,MAAM,EAAG,OAAM,KAAK,MAAM;AAC9C,gBAAU,IAAI,QAAQ,IAAI,CAAC;AAAA,IAC7B;AAAA,IACA,MAAM,UAAU,QAAQ;AACtB,aAAO,OAAO,IAAI,MAAM,KAAK;AAAA,IAC/B;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,SAAS,IAAI,IAAI;AACvB,aAAO,MACJ;AAAA,QACC,CAAC,WACC,OAAO,IAAI,MAAM,MAAM,aACvB,OAAO,IAAI,MAAM,MAAM,YACtB,UAAU,IAAI,MAAM,KAAK,OAAO,sBAAsB;AAAA,MAC3D,EACC,KAAK,CAAC,MAAM,UAAU;AACrB,cAAM,gBAAgB,UAAU,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,IAAI,KAAK;AAC3E,eAAO,gBAAgB,MAAM,QAAQ,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClE,CAAC;AAAA,IACL;AAAA,EACF;AACF;","names":[]}

package/dist/runtime/index.d.ts

@@ -58,6 +58,11 @@ type LoopEvent = {
 
 /** Minimal OpenAI Chat Completions streaming chunk (structural — no `openai` dep). */
 interface OpenAIStreamChunk {
+    /** The model that produced this chunk. The Tangle Router reports the DATED
+     *  upstream id here (`gpt-5-2025-08-07`) whether or not it substituted, so
+     *  this is a served-model source only after id folding — see
+     *  {@link OpenAICompatServedModel}. */
+    model?: string;
     choices?: Array<{
         delta?: {
             content?: string | null;
@@ -89,6 +94,43 @@ interface OpenAIStreamChunk {
  * throwing). Works for the Tangle Router, tcloud, or any OpenAI-compat source.
  */
 declare function toLoopEvents(chunks: AsyncIterable<OpenAIStreamChunk>): AsyncIterable<LoopEvent>;
+/**
+ * Which model actually served one direct-router turn.
+ *
+ * The router substitutes models on purpose — a quota-walled primary comes back
+ * `200` answered by a different model — and says so in response headers. This
+ * lane used to drop the whole `Response` after taking `.body`, so a turn
+ * requested as `claude-sonnet-4-6` and answered by `openai/gpt-5` was recorded
+ * by its caller as Claude: per-model quality scoring blamed the wrong model and
+ * cost used the wrong price basis.
+ *
+ * Map this onto the shell's existing attribution contract rather than inventing
+ * a second channel — `ChatTurnRouteProducer.modelAttribution()` (`/chat-routes`):
+ *
+ *     modelAttribution: () => ({ requestedModel, servedModel, echoReceived: true })
+ *
+ * Leave that contract's `servedSource` unset: its union is sandbox
+ * profile-resolution vocabulary with no router analogue.
+ */
+interface OpenAICompatServedModel {
+    /** The model id this turn asked for (`OpenAICompatStreamTurnOptions.model`). */
+    requestedModel: string;
+    /** The model the router/provider reports having actually served. */
+    servedModel: string;
+    /** Where `servedModel` was read from. The header is the router's own
+     *  substitution signal; the body is the backstop that survives CORS. */
+    source: 'router_header' | 'response_body';
+    /** True when served differs from requested after id folding. Folded, not
+     *  compared raw: the body reports a dated id on EVERY turn, so `!==` would
+     *  claim a substitution every time. */
+    substituted: boolean;
+    /** `x-tangle-failover` `trigger=` — why the router swapped. Absent when the
+     *  router did not inject the substitute (a caller-supplied fallback chain
+     *  sets the served-model header without the failover one). */
+    trigger?: string;
+    /** `x-tangle-failover` `degraded=`. */
+    degraded?: boolean;
+}
 /** Define options for configuring an OpenAI-compatible streaming chat turn including API details and tools */
 interface OpenAICompatStreamTurnOptions {
     /** OpenAI-compat base URL (e.g. the Tangle Router `https://router.tangle.tools/v1`). */
@@ -102,6 +144,16 @@ interface OpenAICompatStreamTurnOptions {
     fetchImpl?: typeof fetch;
     /** Extra body fields (e.g. `max_tokens`). */
     extraBody?: Record<string, unknown>;
+    /**
+     * Called at most ONCE per turn, as soon as the serving model is
+     * determinable, with what actually answered. Never called when neither the
+     * header nor the body names a model — silence means "learned nothing", not
+     * "nothing was substituted".
+     *
+     * `streamTurn` runs once per TOOL turn, so a multi-turn `runAppToolLoop`
+     * fires this once per turn; take the last for row attribution.
+     */
+    onServedModel?: (served: OpenAICompatServedModel) => void;
 }
 /**
  * Build a `streamTurn` that calls an OpenAI-compatible `/chat/completions`
@@ -302,4 +354,4 @@ interface SurfaceMergeBase {
  */
 declare function mergeSurfaceOverlay<TBase extends SurfaceMergeBase>(base: TBase, overlay: SurfaceOverlay): TBase & SurfaceMergeBase;
 
-export { type AnySurfaceKind, type CertifiedDelivery, type CertifiedDeliveryConfig, type LoopEvent, type OpenAICompatStreamTurnOptions, type OpenAIStreamChunk, type ResolvedAgentProfile, type SurfaceKindDefinition, type SurfaceMcpServer, type SurfaceMergeBase, type SurfaceOverlay, type SurfacePermissionValue, type SurfaceRegistry, createCertifiedDelivery, createOpenAICompatStreamTurn, createSurfaceRegistry, defineSurfaceKind, mergeSurfaceOverlay, toLoopEvents };
+export { type AnySurfaceKind, type CertifiedDelivery, type CertifiedDeliveryConfig, type LoopEvent, type OpenAICompatServedModel, type OpenAICompatStreamTurnOptions, type OpenAIStreamChunk, type ResolvedAgentProfile, type SurfaceKindDefinition, type SurfaceMcpServer, type SurfaceMergeBase, type SurfaceOverlay, type SurfacePermissionValue, type SurfaceRegistry, createCertifiedDelivery, createOpenAICompatStreamTurn, createSurfaceRegistry, defineSurfaceKind, mergeSurfaceOverlay, toLoopEvents };

package/dist/runtime/index.js

@@ -62,6 +62,21 @@ function safeParse(s) {
     return {};
   }
 }
+function parseFailoverHeader(raw) {
+  if (!raw) return {};
+  const fields = /* @__PURE__ */ new Map();
+  for (const segment of raw.split(";")) {
+    const eq = segment.indexOf("=");
+    if (eq === -1) continue;
+    fields.set(segment.slice(0, eq).trim().toLowerCase(), segment.slice(eq + 1).trim());
+  }
+  const trigger = fields.get("trigger");
+  const degraded = fields.get("degraded");
+  return {
+    ...trigger ? { trigger } : {},
+    ...degraded != null ? { degraded: degraded === "true" } : {}
+  };
+}
 function createOpenAICompatStreamTurn(opts) {
   const base = opts.baseUrl.replace(/\/+$/, "");
   const doFetch = opts.fetchImpl ?? fetch;
@@ -74,10 +89,10 @@ function createOpenAICompatStreamTurn(opts) {
       ...opts.tools && opts.tools.length > 0 ? { tools: opts.tools } : {},
       ...opts.temperature != null ? { temperature: opts.temperature } : {},
       ...opts.extraBody
-    })
+    }, opts.onServedModel ? { requestedModel: opts.model, report: opts.onServedModel } : void 0)
   );
 }
-async function* streamChatCompletions(doFetch, url, apiKey, body) {
+async function* streamChatCompletions(doFetch, url, apiKey, body, attribution) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json", Accept: "text/event-stream" },
@@ -89,6 +104,24 @@ async function* streamChatCompletions(doFetch, url, apiKey, body) {
     Object.assign(error, { status: res.status });
     throw error;
   }
+  let reported = false;
+  const report = (served) => {
+    if (reported || !attribution) return;
+    reported = true;
+    attribution.report(served);
+  };
+  if (attribution) {
+    const servedHeader = res.headers.get("x-tangle-served-model");
+    if (servedHeader) {
+      report({
+        requestedModel: attribution.requestedModel,
+        servedModel: servedHeader,
+        source: "router_header",
+        substituted: normalizeModelId(servedHeader) !== normalizeModelId(attribution.requestedModel),
+        ...parseFailoverHeader(res.headers.get("x-tangle-failover"))
+      });
+    }
+  }
   const reader = res.body.getReader();
   const decoder = new TextDecoder();
   let buffer = "";
@@ -103,10 +136,21 @@ async function* streamChatCompletions(doFetch, url, apiKey, body) {
       if (!trimmed.startsWith("data:")) continue;
       const data = trimmed.slice(5).trim();
       if (data === "[DONE]") return;
+      let chunk;
       try {
-        yield JSON.parse(data);
+        chunk = JSON.parse(data);
       } catch {
+        continue;
+      }
+      if (attribution && !reported && chunk.model) {
+        report({
+          requestedModel: attribution.requestedModel,
+          servedModel: chunk.model,
+          source: "response_body",
+          substituted: normalizeModelId(chunk.model) !== normalizeModelId(attribution.requestedModel)
+        });
       }
+      yield chunk;
     }
   }
 }

package/dist/runtime/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/runtime/openai-stream.ts","../../src/runtime/certified-delivery.ts","../../src/runtime/surface-profile.ts","../../src/runtime/loop.ts"],"sourcesContent":["/**\n * OpenAI-compatible stream → `LoopEvent` adapter, for NON-sandbox copilots.\n *\n * `streamAppToolLoop` takes a `streamTurn` seam that yields `LoopEvent`s. A\n * sandboxed agent produces those from its container; a browser/edge copilot\n * instead calls a model directly. The Tangle Router, the tcloud SDK, and most\n * providers all speak the OpenAI Chat Completions streaming shape — so the ONE\n * reusable piece is assembling that stream (content deltas + FRAGMENTED\n * tool-call deltas) into `LoopEvent`s. That assembly is the boilerplate every\n * copilot would re-write (and get wrong — OpenAI streams tool-call arguments in\n * pieces across chunks).\n *\n * This does NOT implement an HTTP client beyond a minimal `fetch` + SSE reader\n * (browser/edge/Node-safe, zero deps). For richer transport use the tcloud SDK\n * or the Vercel AI SDK and pipe their stream through {@link toLoopEvents}.\n */\nimport type { LoopEvent, LoopMessage, LoopToolCall } from './loop'\n\n/** Minimal OpenAI Chat Completions streaming chunk (structural — no `openai` dep). */\nexport interface OpenAIStreamChunk {\n  choices?: Array<{\n    delta?: {\n      content?: string | null\n      /** Reasoning deltas — DeepSeek/router use `reasoning_content`; some proxies use `thinking`. */\n      reasoning_content?: string | null\n      thinking?: string | null\n      tool_calls?: Array<{\n        index: number\n        id?: string\n        function?: { name?: string; arguments?: string }\n      }>\n    }\n    finish_reason?: string | null\n  }>\n  /** Final-chunk token accounting (requires `stream_options.include_usage`). */\n  usage?: {\n    prompt_tokens?: number\n    completion_tokens?: number\n  } | null\n}\n\ninterface PartialToolCall {\n  id?: string\n  name: string\n  args: string\n}\n\n/**\n * Map an OpenAI-compat streaming chunk iterator to `LoopEvent`s: each content\n * delta → a `text` event; tool-call deltas are accumulated by index across\n * chunks and emitted as one complete `tool_call` event when the stream finishes\n * (arguments JSON-parsed; an empty/garbled args string yields `{}` rather than\n * throwing). Works for the Tangle Router, tcloud, or any OpenAI-compat source.\n */\nexport async function* toLoopEvents(chunks: AsyncIterable<OpenAIStreamChunk>): AsyncIterable<LoopEvent> {\n  const calls = new Map<number, PartialToolCall>()\n  for await (const chunk of chunks) {\n    // Usage rides the final chunk, which has an empty choices array — handle\n    // it before the choice guard.\n    if (chunk.usage?.prompt_tokens != null || chunk.usage?.completion_tokens != null) {\n      yield {\n        type: 'usage',\n        usage: {\n          promptTokens: chunk.usage.prompt_tokens ?? 0,\n          completionTokens: chunk.usage.completion_tokens ?? 0,\n        },\n      }\n    }\n    const choice = chunk.choices?.[0]\n    if (!choice) continue\n    const content = choice.delta?.content\n    if (content) yield { type: 'text', text: content }\n    const reasoning = choice.delta?.reasoning_content ?? choice.delta?.thinking\n    if (reasoning) yield { type: 'reasoning', text: reasoning }\n    for (const tc of choice.delta?.tool_calls ?? []) {\n      const cur = calls.get(tc.index) ?? { name: '', args: '' }\n      if (tc.id) cur.id = tc.id\n      if (tc.function?.name) cur.name += tc.function.name\n      if (tc.function?.arguments) cur.args += tc.function.arguments\n      calls.set(tc.index, cur)\n    }\n  }\n  for (const [, c] of [...calls.entries()].sort((a, b) => a[0] - b[0])) {\n    if (!c.name) continue\n    yield { type: 'tool_call', call: { toolCallId: c.id, toolName: c.name, args: safeParse(c.args) } satisfies LoopToolCall }\n  }\n}\n\nfunction safeParse(s: string): Record<string, unknown> {\n  if (!s.trim()) return {}\n  try {\n    const v = JSON.parse(s)\n    return v && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : {}\n  } catch {\n    return {}\n  }\n}\n\n/** Define options for configuring an OpenAI-compatible streaming chat turn including API details and tools */\nexport interface OpenAICompatStreamTurnOptions {\n  /** OpenAI-compat base URL (e.g. the Tangle Router `https://router.tangle.tools/v1`). */\n  baseUrl: string\n  apiKey: string\n  model: string\n  /** OpenAI tool definitions — pass `buildAppToolOpenAITools(taxonomy)` so the\n   *  model can call the app tools. Omit for a tool-free copilot. */\n  tools?: unknown[]\n  temperature?: number\n  fetchImpl?: typeof fetch\n  /** Extra body fields (e.g. `max_tokens`). */\n  extraBody?: Record<string, unknown>\n}\n\n/**\n * Build a `streamTurn` that calls an OpenAI-compatible `/chat/completions`\n * endpoint (Tangle Router / tcloud / any compat provider) with `stream: true`\n * and yields `LoopEvent`s via {@link toLoopEvents}. Browser/edge/Node-safe —\n * just `fetch` + an SSE reader. Drop straight into `streamAppToolLoop`:\n *\n *   const cfg = resolveTangleModelConfig()                 // or { baseUrl, apiKey, model }\n *   streamAppToolLoop({ streamTurn: createOpenAICompatStreamTurn({ ...cfg, tools }), executeToolCall, ... })\n */\nexport function createOpenAICompatStreamTurn(\n  opts: OpenAICompatStreamTurnOptions,\n): (messages: LoopMessage[]) => AsyncIterable<LoopEvent> {\n  const base = opts.baseUrl.replace(/\\/+$/, '')\n  const doFetch = opts.fetchImpl ?? fetch\n  return (messages) =>\n    toLoopEvents(\n      streamChatCompletions(doFetch, `${base}/chat/completions`, opts.apiKey, {\n        model: opts.model,\n        messages,\n        stream: true,\n        stream_options: { include_usage: true },\n        ...(opts.tools && opts.tools.length > 0 ? { tools: opts.tools } : {}),\n        ...(opts.temperature != null ? { temperature: opts.temperature } : {}),\n        ...opts.extraBody,\n      }),\n    )\n}\n\n/** Stream + parse an OpenAI-compat SSE response into chunks. Tolerates `data:`\n *  framing, multi-line buffers, and the terminal `[DONE]`. */\nasync function* streamChatCompletions(\n  doFetch: typeof fetch,\n  url: string,\n  apiKey: string,\n  body: Record<string, unknown>,\n): AsyncIterable<OpenAIStreamChunk> {\n  const res = await doFetch(url, {\n    method: 'POST',\n    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json', Accept: 'text/event-stream' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok || !res.body) {\n    const text = res.body ? await res.text().catch(() => '') : ''\n    const error = new Error(`OpenAI-compat stream failed (HTTP ${res.status})${text ? `: ${text.slice(0, 200)}` : ''}`)\n    // Stamp the NUMERIC status. `isUpstreamUnavailable` (`/model-resolution`)\n    // reads a numeric field first and prose only as a backstop, and a\n    // Cloudflare EDGE 502 gives it nothing else to read: `content-type:\n    // text/plain`, a body of `error code: 502`, and none of the router's own\n    // `x-tangle-*` headers, because the origin never ran. Carrying the status\n    // as data keeps THIS path — the browser/edge copilot lane, which calls the\n    // router directly — out of the string-matching business entirely.\n    Object.assign(error, { status: res.status })\n    throw error\n  }\n  const reader = res.body.getReader()\n  const decoder = new TextDecoder()\n  let buffer = ''\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    buffer += decoder.decode(value, { stream: true })\n    const lines = buffer.split('\\n')\n    buffer = lines.pop() ?? ''\n    for (const line of lines) {\n      const trimmed = line.trim()\n      if (!trimmed.startsWith('data:')) continue\n      const data = trimmed.slice(5).trim()\n      if (data === '[DONE]') return\n      try {\n        yield JSON.parse(data) as OpenAIStreamChunk\n      } catch {\n        /* skip a partial/garbled SSE frame */\n      }\n    }\n  }\n}\n","/**\n * `createCertifiedDelivery` — the delivery truck for Tangle Intelligence.\n *\n * Pulls a tenant's CERTIFIED `AgentProfile` from the deployed plane\n * (`GET /v1/profiles/:target/composed`) and applies it to the agent's resolved\n * surfaces each turn, so an approved improvement reaches the running agent with\n * NO redeploy. This is the `composeProfile` transform `createAgentRuntime`\n * accepts — opt-in per product, fail-closed, cached + refreshed.\n *\n * Profile-WIDE by design (not prompt-only): the composed profile carries every\n * promoted artifact type keyed by kind. What's folded where:\n *   - `prompt-surface` + `skill` → the system prompt (via `composeCertifiedPrompt`).\n *   - `tool` artifacts that carry an OpenAI tool definition → `extraTools`\n *     (advertised to the model; the matching executor is supplied by the product\n *     via `executeOtherTool`). Until a `tool` artifact carries a runnable def,\n *     it is surfaced (see `current()`) but not advertised — advertising a tool\n *     with no executor would make the model call into a dead end.\n *   - `mcp` / `memory` / `rag` artifacts materialize as servers/files and deliver\n *     through the SANDBOX-provisioning seam, not this in-process one. The full\n *     certified profile is exposed via `current()` so that seam can consume it.\n *\n * Substrate boundary: THIS module imports `@tangle-network/agent-runtime`; the\n * `createAgentRuntime` core does not (it only consumes the generic transform).\n */\n\nimport {\n  composeCertifiedPrompt,\n  type CertifiedProfile,\n  pullCertified,\n} from '@tangle-network/agent-runtime/intelligence'\nimport type { ResolvedAgentProfile } from './agent'\n\nconst defaultRefreshMs = 300_000\n\n/** Define configuration options for delivering certified artifacts to a specified tenant target */\nexport interface CertifiedDeliveryConfig {\n  /** The tenant target whose certified artifacts to deliver (the agent id). */\n  target: string\n  /** Bearer for the plane. Reads `TANGLE_API_KEY` when omitted. */\n  apiKey?: string\n  /** Plane base URL. Reads `TANGLE_INTELLIGENCE_URL` then the public plane. */\n  baseUrl?: string\n  /** Min interval between certified-profile pulls. Default 5m. */\n  refreshMs?: number\n  /** fetch impl (tests / non-global-fetch runtimes). */\n  fetchImpl?: typeof fetch\n}\n\n/** Resolve and manage certified profiles with refresh and composition capabilities */\nexport interface CertifiedDelivery {\n  /** The `composeProfile` transform to pass to `createAgentRuntime`. Applies the\n   *  cached certified profile to the base surfaces; refreshes on the cadence. */\n  composeProfile(base: ResolvedAgentProfile): Promise<ResolvedAgentProfile>\n  /** Force a pull now (ignores the refresh window). Best-effort. */\n  refresh(): Promise<void>\n  /** The certified profile currently in effect (null = none promoted / pull\n   *  failed). Lets the sandbox-provisioning seam deliver the file/server\n   *  artifact types this in-process seam doesn't. */\n  current(): CertifiedProfile | null\n}\n\n/**\n * Build a certified-delivery transform for one agent target. Fail-closed: a pull\n * error or 404 keeps the last-known certified profile (or null), and the agent\n * runs on its base surfaces — it never breaks because Intelligence is down.\n */\nexport function createCertifiedDelivery(config: CertifiedDeliveryConfig): CertifiedDelivery {\n  const refreshMs = config.refreshMs ?? defaultRefreshMs\n  let certified: CertifiedProfile | null = null\n  let lastPullAt = 0\n  let inflight: Promise<void> | null = null\n\n  async function refresh(force = false): Promise<void> {\n    if (!force && Date.now() - lastPullAt < refreshMs) return\n    if (inflight) return inflight\n    inflight = (async () => {\n      const outcome = await pullCertified({\n        target: config.target,\n        apiKey: config.apiKey,\n        baseUrl: config.baseUrl,\n        fetchImpl: config.fetchImpl,\n      })\n      lastPullAt = Date.now()\n      // Only replace on a real pull; a 404/error keeps the last-known profile.\n      if (outcome.succeeded) certified = outcome.value\n    })()\n    try {\n      await inflight\n    } finally {\n      inflight = null\n    }\n  }\n\n  return {\n    async composeProfile(base) {\n      await refresh()\n      return {\n        // prompt-surface + skill fold into the system prompt.\n        systemPrompt: composeCertifiedPrompt(base.systemPrompt, certified),\n        // Certified `tool` artifacts deliver here once they carry a runnable\n        // OpenAI def + the product wires the executor; until then pass through.\n        extraTools: base.extraTools,\n      }\n    },\n    refresh: () => refresh(true),\n    current: () => certified,\n  }\n}\n","/**\n * Surface-scoped profile overlay — the seam letting any product page (a\n * sequence editor, a brief composer, a dataset view) add MCP servers, a prompt\n * addendum, and permission tightening to the workspace agent profile for turns\n * initiated FROM that surface, without the chat orchestrator knowing any\n * surface's specifics. The orchestrator resolves `(kind, ctx)` through a\n * registry the REQUEST HANDLER constructs per request (construction is a Map\n * build — cheap) and merges the result into the base profile it was about to\n * send to the sandbox. Per-request construction is the trust mechanism, not an\n * optimization target: each `build()` closes over server-trusted request state\n * (env bindings, secrets, the AUTHENTICATED user/workspace), which on Workers\n * exists only per request — a startup-built registry would force identity\n * through the untrusted client `ctx`.\n *\n * SECURITY INVARIANT: the surface `kind` and the ids inside `ctx` arrive on\n * the client request and are pure ROUTING data — never trusted content, never\n * identity. Identity comes from the closure (see above). The registered\n * `build()` runs server-side only: it validates the routing ids against the\n * product's access control, then mints its own URLs and capability tokens from\n * server configuration (`buildHttpMcpServer` + `createCapabilityToken` in\n * ../tools). A client can therefore never inject an arbitrary MCP url, header,\n * or token into the agent profile: the overlay's `mcp` values are typed as\n * {@link SurfaceMcpServer} (= the server-built `AppToolMcpServer` entry shape),\n * and only build() constructs them.\n */\n\nimport type { AppToolMcpServer } from '../tools/mcp'\n\n/** Sandbox permission posture values, ranked deny > ask > allow for merging. */\nexport type SurfacePermissionValue = 'allow' | 'ask' | 'deny'\n\n/** The only MCP entry shape an overlay may carry: the server-built bridge\n *  entry from ../tools/mcp (transport, url, headers, and capability token all\n *  assembled server-side). The alias exists so overlay authors reach for the\n *  builders in ../tools rather than hand-rolling `{ url: ctx.url }` shapes\n *  that would let request data become a dialable endpoint. */\nexport type SurfaceMcpServer = AppToolMcpServer\n\n/** What one surface contributes to the agent profile for a single turn. */\nexport interface SurfaceOverlay {\n  /** MCP servers to mount for this turn, keyed by tool-routing name. Names\n   *  must not collide with the base profile's — see {@link mergeSurfaceOverlay}. */\n  mcp?: Record<string, SurfaceMcpServer>\n  /** Appended to the base system-prompt addendum with a blank-line separator. */\n  promptAddendum?: string\n  /** Per-key posture the surface wants for its turns. Merging is monotone\n   *  fail-closed: the stricter of base/overlay wins, so a surface can tighten\n   *  the workspace posture but never relax it. */\n  permissions?: Record<string, SurfacePermissionValue>\n}\n\n/**\n * One registered surface kind. `TCtx` is the shape build() expects — a CLAIM\n * about the client payload, not a guarantee: the registry hands build() the\n * request's `ctx` unvalidated, so build() must treat every field as an\n * untrusted id (resolve it through access control that throws on a bad or\n * foreign id) before minting anything from it.\n */\nexport interface SurfaceKindDefinition<TCtx> {\n  kind: string\n  build: (ctx: TCtx) => SurfaceOverlay | Promise<SurfaceOverlay>\n}\n\n/** The variance-erased form a registry accepts (`build` is contravariant in\n *  `TCtx`, so every concrete definition is assignable to this). */\nexport type AnySurfaceKind = SurfaceKindDefinition<never>\n\n/**\n * Declare one surface kind. The `kind` string is the client-visible routing\n * key (e.g. `'sequences'`); `build` is the server-side factory that turns a\n * validated ctx into the overlay for one turn.\n */\nexport function defineSurfaceKind<TCtx>(opts: {\n  kind: string\n  build: (ctx: TCtx) => SurfaceOverlay | Promise<SurfaceOverlay>\n}): SurfaceKindDefinition<TCtx> {\n  if (typeof opts.kind !== 'string' || opts.kind.length === 0 || /\\s/.test(opts.kind)) {\n    throw new Error(`surface kind must be a non-empty string without whitespace (got ${JSON.stringify(opts.kind)})`)\n  }\n  if (typeof opts.build !== 'function') {\n    throw new Error(`surface kind '${opts.kind}' requires a build function`)\n  }\n  return { kind: opts.kind, build: opts.build }\n}\n\n/** Resolve and build the overlay for a given surface kind within a turn context */\nexport interface SurfaceRegistry {\n  /** Build the overlay for one turn. Throws on an unknown kind — an unknown\n   *  surface is a routing bug (client and server registries drifted), and\n   *  silently returning an empty overlay would strip the surface's tools from\n   *  the turn with no signal anywhere. Build errors propagate unwrapped. */\n  resolve(kind: string, ctx: unknown): Promise<SurfaceOverlay>\n}\n\n/**\n * Assemble the product's surface registry from its registered kinds. Duplicate\n * kinds throw at construction: two builders behind one routing key would make\n * the mounted toolset depend on registration order.\n */\nexport function createSurfaceRegistry(kinds: readonly AnySurfaceKind[]): SurfaceRegistry {\n  const byKind = new Map<string, AnySurfaceKind>()\n  for (const definition of kinds) {\n    if (byKind.has(definition.kind)) {\n      throw new Error(`duplicate surface kind '${definition.kind}' — each kind must be registered exactly once`)\n    }\n    byKind.set(definition.kind, definition)\n  }\n\n  return {\n    async resolve(kind, ctx) {\n      const definition = byKind.get(kind)\n      if (!definition) {\n        const known = [...byKind.keys()].join(', ') || '(none)'\n        throw new Error(\n          `unknown surface kind '${kind}' — registered kinds: ${known}. ` +\n            'An unknown surface is a routing bug: register the kind via defineSurfaceKind before clients can reference it.',\n        )\n      }\n      // The trust boundary where static ctx typing ends: the request payload is\n      // handed to build() as-is, and build() validates it (see SurfaceKindDefinition).\n      const overlay = await definition.build(ctx as never)\n      assertSurfaceOverlay(overlay, `surface kind '${kind}'`)\n      return overlay\n    },\n  }\n}\n\n/** Base-profile slice the merge reads/writes. Real callers pass their full\n *  profile object; every field outside this slice passes through untouched. */\nexport interface SurfaceMergeBase {\n  mcp?: Record<string, unknown>\n  systemPromptAddendum?: string\n  permissions?: Record<string, SurfacePermissionValue>\n}\n\nconst PERMISSION_SEVERITY: Record<SurfacePermissionValue, number> = { allow: 0, ask: 1, deny: 2 }\n\n/**\n * Merge one surface overlay into a base profile, returning a new object\n * (the base is never mutated; untouched nested records are shared by\n * reference).\n *\n * - `mcp`: overlay servers are added under their own names. A name already\n *   present on the base THROWS — a collision is two servers claiming one\n *   routing name, and renaming either silently would corrupt tool routing for\n *   whichever caller expected the original binding.\n * - `systemPromptAddendum`: the overlay's `promptAddendum` appends after a\n *   blank-line separator (no separator when the base has no addendum).\n * - `permissions`: per key the STRICTER value wins (deny > ask > allow). A\n *   surface can tighten the base posture for its turns; a base 'deny' survives\n *   any overlay.\n */\nexport function mergeSurfaceOverlay<TBase extends SurfaceMergeBase>(\n  base: TBase,\n  overlay: SurfaceOverlay,\n): TBase & SurfaceMergeBase {\n  assertSurfaceOverlay(overlay, 'surface overlay')\n  const merged: SurfaceMergeBase = { ...base }\n\n  if (overlay.mcp && Object.keys(overlay.mcp).length > 0) {\n    const baseMcp = base.mcp ?? {}\n    const collisions = Object.keys(overlay.mcp).filter((name) => name in baseMcp)\n    if (collisions.length > 0) {\n      throw new Error(\n        `surface overlay MCP name collision: ${collisions.map((n) => `'${n}'`).join(', ')} already exist on the base profile. ` +\n          'Two servers cannot claim one name — give the surface server a distinct name.',\n      )\n    }\n    merged.mcp = { ...baseMcp, ...overlay.mcp }\n  }\n\n  if (overlay.promptAddendum !== undefined) {\n    merged.systemPromptAddendum = base.systemPromptAddendum\n      ? `${base.systemPromptAddendum}\\n\\n${overlay.promptAddendum}`\n      : overlay.promptAddendum\n  }\n\n  if (overlay.permissions && Object.keys(overlay.permissions).length > 0) {\n    const permissions: Record<string, SurfacePermissionValue> = { ...(base.permissions ?? {}) }\n    for (const [key, value] of Object.entries(overlay.permissions)) {\n      const existing = permissions[key]\n      permissions[key] =\n        existing === undefined || PERMISSION_SEVERITY[value] > PERMISSION_SEVERITY[existing] ? value : existing\n    }\n    merged.permissions = permissions\n  }\n\n  // merged began as a shallow copy of base; only the three slice fields were\n  // replaced, so the intersection type is the true shape.\n  return merged as TBase & SurfaceMergeBase\n}\n\n/** Reject overlays a build() (or hand-rolled caller) malformed, with the exact\n *  field named: a relative MCP url, a blank addendum, or an off-vocabulary\n *  permission would otherwise surface only as an opaque sandbox failure. */\nfunction assertSurfaceOverlay(overlay: SurfaceOverlay, label: string): void {\n  if (overlay.promptAddendum !== undefined) {\n    if (typeof overlay.promptAddendum !== 'string' || overlay.promptAddendum.trim().length === 0) {\n      throw new Error(`${label}: promptAddendum must be a non-blank string when provided`)\n    }\n  }\n  if (overlay.mcp !== undefined) {\n    for (const [name, server] of Object.entries(overlay.mcp)) {\n      if (name.trim().length === 0) throw new Error(`${label}: MCP server names must be non-empty`)\n      if (server.transport !== 'http') {\n        throw new Error(`${label}: MCP server '${name}' must use transport 'http' (got ${JSON.stringify((server as { transport?: unknown }).transport)})`)\n      }\n      let parsed: URL\n      try {\n        parsed = new URL(server.url)\n      } catch {\n        throw new Error(`${label}: MCP server '${name}' url must be an absolute URL (got ${JSON.stringify(server.url)})`)\n      }\n      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n        throw new Error(`${label}: MCP server '${name}' url must be http(s) (got ${JSON.stringify(server.url)})`)\n      }\n    }\n  }\n  if (overlay.permissions !== undefined) {\n    for (const [key, value] of Object.entries(overlay.permissions)) {\n      if (!(value in PERMISSION_SEVERITY)) {\n        throw new Error(`${label}: permission '${key}' must be 'allow' | 'ask' | 'deny' (got ${JSON.stringify(value)})`)\n      }\n    }\n  }\n}\n","/**\n * The bounded agent tool-loop — owned by `@tangle-network/agent-runtime`.\n *\n * A model turn may emit tool calls (integration-hub actions, the app tools from\n * `../tools`, delegation). The loop streams a turn, collects the executable tool\n * calls, dispatches each, appends the results to history in OpenAI\n * function-calling shape, and re-runs so the model reads them — bounded by\n * `maxToolTurns`, a wall-clock `deadlineMs`, and a `maxCostUsd` budget.\n *\n * The history shape is the OpenAI function-calling contract: the assistant turn\n * that emitted tool calls is preserved as an `assistant` message carrying its\n * `tool_calls` array, and each result is its own `{ role: 'tool', tool_call_id,\n * content }` message keyed to the call. A strict model (Claude, and any\n * OpenAI-compatible provider that validates tool history) needs this to read its\n * own tool use back; folding results into a `user` message makes such models\n * re-issue the same call in a loop.\n *\n * The loop is substrate-owned (`runToolLoop` / `streamToolLoop`); the app\n * supplies `streamTurn` (wrapping its model endpoint) and `executeToolCall`\n * (routing to its integration + app-tool executors). The app-facing names below\n * are 1:1 aliases of the canonical symbols, kept so this package's consumers and\n * the in-package `createAgentRuntime` read against a single, stable vocabulary.\n *\n * This is the LEAF the runtime barrel and its children both import — keeping the\n * tool-loop vocabulary out of any import cycle. The barrel re-exports it.\n */\n\nexport {\n  runToolLoop as runAppToolLoop,\n  streamToolLoop as streamAppToolLoop,\n} from '@tangle-network/agent-runtime/tool-loop'\nexport type {\n  ToolLoopCall as LoopToolCall,\n  ToolLoopAssistantToolCall as LoopAssistantToolCall,\n  ToolLoopMessage as LoopMessage,\n  ToolLoopEvent,\n  ToolLoopStopReason,\n  ToolLoopResult,\n  RunToolLoopOptions as AppToolLoopOptions,\n  StreamToolLoopOptions as StreamAppToolLoopOptions,\n  StreamToolLoopYield as StreamLoopYield,\n} from '@tangle-network/agent-runtime/tool-loop'\n\n/**\n * Events the app's OpenAI-compat stream adapter ({@link toLoopEvents}) yields.\n *\n * This is the app's own `Raw` event type for the streaming loop — the canonical\n * `streamToolLoop<Raw>` is generic over it. It widens the substrate's\n * tool-loop event with `reasoning` (DeepSeek/router `reasoning_content` /\n * `thinking` deltas, rendered as thinking sections) and `usage` (per-message\n * token accounting) — neither belongs in the substrate's loop contract, so they\n * stay here. The adapter maps each into the `streamTurn` seam; `text` and\n * `tool_call` drive the loop, `reasoning` / `usage` pass through to the UI.\n */\nexport type LoopEvent =\n  | { type: 'text'; text: string }\n  | { type: 'reasoning'; text: string }\n  | {\n      type: 'tool_call'\n      call: import('@tangle-network/agent-runtime/tool-loop').ToolLoopCall\n    }\n  | { type: 'usage'; usage: { promptTokens: number; completionTokens: number } }\n  | { type: 'other'; event: unknown }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAsDA,gBAAuB,aAAa,QAAoE;AACtG,QAAM,QAAQ,oBAAI,IAA6B;AAC/C,mBAAiB,SAAS,QAAQ;AAGhC,QAAI,MAAM,OAAO,iBAAiB,QAAQ,MAAM,OAAO,qBAAqB,MAAM;AAChF,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,OAAO;AAAA,UACL,cAAc,MAAM,MAAM,iBAAiB;AAAA,UAC3C,kBAAkB,MAAM,MAAM,qBAAqB;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,UAAU,CAAC;AAChC,QAAI,CAAC,OAAQ;AACb,UAAM,UAAU,OAAO,OAAO;AAC9B,QAAI,QAAS,OAAM,EAAE,MAAM,QAAQ,MAAM,QAAQ;AACjD,UAAM,YAAY,OAAO,OAAO,qBAAqB,OAAO,OAAO;AACnE,QAAI,UAAW,OAAM,EAAE,MAAM,aAAa,MAAM,UAAU;AAC1D,eAAW,MAAM,OAAO,OAAO,cAAc,CAAC,GAAG;AAC/C,YAAM,MAAM,MAAM,IAAI,GAAG,KAAK,KAAK,EAAE,MAAM,IAAI,MAAM,GAAG;AACxD,UAAI,GAAG,GAAI,KAAI,KAAK,GAAG;AACvB,UAAI,GAAG,UAAU,KAAM,KAAI,QAAQ,GAAG,SAAS;AAC/C,UAAI,GAAG,UAAU,UAAW,KAAI,QAAQ,GAAG,SAAS;AACpD,YAAM,IAAI,GAAG,OAAO,GAAG;AAAA,IACzB;AAAA,EACF;AACA,aAAW,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG;AACpE,QAAI,CAAC,EAAE,KAAM;AACb,UAAM,EAAE,MAAM,aAAa,MAAM,EAAE,YAAY,EAAE,IAAI,UAAU,EAAE,MAAM,MAAM,UAAU,EAAE,IAAI,EAAE,EAAyB;AAAA,EAC1H;AACF;AAEA,SAAS,UAAU,GAAoC;AACrD,MAAI,CAAC,EAAE,KAAK,EAAG,QAAO,CAAC;AACvB,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,CAAC;AACtB,WAAO,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAK,IAAgC,CAAC;AAAA,EAC7F,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AA0BO,SAAS,6BACd,MACuD;AACvD,QAAM,OAAO,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC5C,QAAM,UAAU,KAAK,aAAa;AAClC,SAAO,CAAC,aACN;AAAA,IACE,sBAAsB,SAAS,GAAG,IAAI,qBAAqB,KAAK,QAAQ;AAAA,MACtE,OAAO,KAAK;AAAA,MACZ;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB,EAAE,eAAe,KAAK;AAAA,MACtC,GAAI,KAAK,SAAS,KAAK,MAAM,SAAS,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACnE,GAAI,KAAK,eAAe,OAAO,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,MACpE,GAAG,KAAK;AAAA,IACV,CAAC;AAAA,EACH;AACJ;AAIA,gBAAgB,sBACd,SACA,KACA,QACA,MACkC;AAClC,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,oBAAoB,QAAQ,oBAAoB;AAAA,IAC9G,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM;AACxB,UAAM,OAAO,IAAI,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE,IAAI;AAC3D,UAAM,QAAQ,IAAI,MAAM,qCAAqC,IAAI,MAAM,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE;AAQlH,WAAO,OAAO,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC;AAC3C,UAAM;AAAA,EACR;AACA,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,SAAS;AACb,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,cAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAChD,UAAM,QAAQ,OAAO,MAAM,IAAI;AAC/B,aAAS,MAAM,IAAI,KAAK;AACxB,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,CAAC,QAAQ,WAAW,OAAO,EAAG;AAClC,YAAM,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;AACnC,UAAI,SAAS,SAAU;AACvB,UAAI;AACF,cAAM,KAAK,MAAM,IAAI;AAAA,MACvB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACF;;;ACnKA;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAGP,IAAM,mBAAmB;AAkClB,SAAS,wBAAwB,QAAoD;AAC1F,QAAM,YAAY,OAAO,aAAa;AACtC,MAAI,YAAqC;AACzC,MAAI,aAAa;AACjB,MAAI,WAAiC;AAErC,iBAAe,QAAQ,QAAQ,OAAsB;AACnD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,UAAW;AACnD,QAAI,SAAU,QAAO;AACrB,gBAAY,YAAY;AACtB,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO;AAAA,QACf,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,mBAAa,KAAK,IAAI;AAEtB,UAAI,QAAQ,UAAW,aAAY,QAAQ;AAAA,IAC7C,GAAG;AACH,QAAI;AACF,YAAM;AAAA,IACR,UAAE;AACA,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,eAAe,MAAM;AACzB,YAAM,QAAQ;AACd,aAAO;AAAA;AAAA,QAEL,cAAc,uBAAuB,KAAK,cAAc,SAAS;AAAA;AAAA;AAAA,QAGjE,YAAY,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,IACA,SAAS,MAAM,QAAQ,IAAI;AAAA,IAC3B,SAAS,MAAM;AAAA,EACjB;AACF;;;ACnCO,SAAS,kBAAwB,MAGR;AAC9B,MAAI,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,WAAW,KAAK,KAAK,KAAK,KAAK,IAAI,GAAG;AACnF,UAAM,IAAI,MAAM,mEAAmE,KAAK,UAAU,KAAK,IAAI,CAAC,GAAG;AAAA,EACjH;AACA,MAAI,OAAO,KAAK,UAAU,YAAY;AACpC,UAAM,IAAI,MAAM,iBAAiB,KAAK,IAAI,6BAA6B;AAAA,EACzE;AACA,SAAO,EAAE,MAAM,KAAK,MAAM,OAAO,KAAK,MAAM;AAC9C;AAgBO,SAAS,sBAAsB,OAAmD;AACvF,QAAM,SAAS,oBAAI,IAA4B;AAC/C,aAAW,cAAc,OAAO;AAC9B,QAAI,OAAO,IAAI,WAAW,IAAI,GAAG;AAC/B,YAAM,IAAI,MAAM,2BAA2B,WAAW,IAAI,oDAA+C;AAAA,IAC3G;AACA,WAAO,IAAI,WAAW,MAAM,UAAU;AAAA,EACxC;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,MAAM,KAAK;AACvB,YAAM,aAAa,OAAO,IAAI,IAAI;AAClC,UAAI,CAAC,YAAY;AACf,cAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK;AAC/C,cAAM,IAAI;AAAA,UACR,yBAAyB,IAAI,8BAAyB,KAAK;AAAA,QAE7D;AAAA,MACF;AAGA,YAAM,UAAU,MAAM,WAAW,MAAM,GAAY;AACnD,2BAAqB,SAAS,iBAAiB,IAAI,GAAG;AACtD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAUA,IAAM,sBAA8D,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE;AAiBzF,SAAS,oBACd,MACA,SAC0B;AAC1B,uBAAqB,SAAS,iBAAiB;AAC/C,QAAM,SAA2B,EAAE,GAAG,KAAK;AAE3C,MAAI,QAAQ,OAAO,OAAO,KAAK,QAAQ,GAAG,EAAE,SAAS,GAAG;AACtD,UAAM,UAAU,KAAK,OAAO,CAAC;AAC7B,UAAM,aAAa,OAAO,KAAK,QAAQ,GAAG,EAAE,OAAO,CAAC,SAAS,QAAQ,OAAO;AAC5E,QAAI,WAAW,SAAS,GAAG;AACzB,YAAM,IAAI;AAAA,QACR,uCAAuC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,MAEnF;AAAA,IACF;AACA,WAAO,MAAM,EAAE,GAAG,SAAS,GAAG,QAAQ,IAAI;AAAA,EAC5C;AAEA,MAAI,QAAQ,mBAAmB,QAAW;AACxC,WAAO,uBAAuB,KAAK,uBAC/B,GAAG,KAAK,oBAAoB;AAAA;AAAA,EAAO,QAAQ,cAAc,KACzD,QAAQ;AAAA,EACd;AAEA,MAAI,QAAQ,eAAe,OAAO,KAAK,QAAQ,WAAW,EAAE,SAAS,GAAG;AACtE,UAAM,cAAsD,EAAE,GAAI,KAAK,eAAe,CAAC,EAAG;AAC1F,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,GAAG;AAC9D,YAAM,WAAW,YAAY,GAAG;AAChC,kBAAY,GAAG,IACb,aAAa,UAAa,oBAAoB,KAAK,IAAI,oBAAoB,QAAQ,IAAI,QAAQ;AAAA,IACnG;AACA,WAAO,cAAc;AAAA,EACvB;AAIA,SAAO;AACT;AAKA,SAAS,qBAAqB,SAAyB,OAAqB;AAC1E,MAAI,QAAQ,mBAAmB,QAAW;AACxC,QAAI,OAAO,QAAQ,mBAAmB,YAAY,QAAQ,eAAe,KAAK,EAAE,WAAW,GAAG;AAC5F,YAAM,IAAI,MAAM,GAAG,KAAK,2DAA2D;AAAA,IACrF;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ,QAAW;AAC7B,eAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AACxD,UAAI,KAAK,KAAK,EAAE,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,sCAAsC;AAC5F,UAAI,OAAO,cAAc,QAAQ;AAC/B,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,IAAI,oCAAoC,KAAK,UAAW,OAAmC,SAAS,CAAC,GAAG;AAAA,MACnJ;AACA,UAAI;AACJ,UAAI;AACF,iBAAS,IAAI,IAAI,OAAO,GAAG;AAAA,MAC7B,QAAQ;AACN,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,IAAI,sCAAsC,KAAK,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,MAClH;AACA,UAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,IAAI,8BAA8B,KAAK,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,gBAAgB,QAAW;AACrC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,GAAG;AAC9D,UAAI,EAAE,SAAS,sBAAsB;AACnC,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,GAAG,2CAA2C,KAAK,UAAU,KAAK,CAAC,GAAG;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;;;ACtMA;AAAA,EACiB;AAAA,EACG;AAAA,OACb;","names":[]}
+{"version":3,"sources":["../../src/runtime/openai-stream.ts","../../src/runtime/certified-delivery.ts","../../src/runtime/surface-profile.ts","../../src/runtime/loop.ts"],"sourcesContent":["/**\n * OpenAI-compatible stream → `LoopEvent` adapter, for NON-sandbox copilots.\n *\n * `streamAppToolLoop` takes a `streamTurn` seam that yields `LoopEvent`s. A\n * sandboxed agent produces those from its container; a browser/edge copilot\n * instead calls a model directly. The Tangle Router, the tcloud SDK, and most\n * providers all speak the OpenAI Chat Completions streaming shape — so the ONE\n * reusable piece is assembling that stream (content deltas + FRAGMENTED\n * tool-call deltas) into `LoopEvent`s. That assembly is the boilerplate every\n * copilot would re-write (and get wrong — OpenAI streams tool-call arguments in\n * pieces across chunks).\n *\n * This does NOT implement an HTTP client beyond a minimal `fetch` + SSE reader\n * (browser/edge/Node-safe, zero deps). For richer transport use the tcloud SDK\n * or the Vercel AI SDK and pipe their stream through {@link toLoopEvents}.\n */\nimport type { LoopEvent, LoopMessage, LoopToolCall } from './loop'\nimport { normalizeModelId } from './model-catalog'\n\n/** Minimal OpenAI Chat Completions streaming chunk (structural — no `openai` dep). */\nexport interface OpenAIStreamChunk {\n  /** The model that produced this chunk. The Tangle Router reports the DATED\n   *  upstream id here (`gpt-5-2025-08-07`) whether or not it substituted, so\n   *  this is a served-model source only after id folding — see\n   *  {@link OpenAICompatServedModel}. */\n  model?: string\n  choices?: Array<{\n    delta?: {\n      content?: string | null\n      /** Reasoning deltas — DeepSeek/router use `reasoning_content`; some proxies use `thinking`. */\n      reasoning_content?: string | null\n      thinking?: string | null\n      tool_calls?: Array<{\n        index: number\n        id?: string\n        function?: { name?: string; arguments?: string }\n      }>\n    }\n    finish_reason?: string | null\n  }>\n  /** Final-chunk token accounting (requires `stream_options.include_usage`). */\n  usage?: {\n    prompt_tokens?: number\n    completion_tokens?: number\n  } | null\n}\n\ninterface PartialToolCall {\n  id?: string\n  name: string\n  args: string\n}\n\n/**\n * Map an OpenAI-compat streaming chunk iterator to `LoopEvent`s: each content\n * delta → a `text` event; tool-call deltas are accumulated by index across\n * chunks and emitted as one complete `tool_call` event when the stream finishes\n * (arguments JSON-parsed; an empty/garbled args string yields `{}` rather than\n * throwing). Works for the Tangle Router, tcloud, or any OpenAI-compat source.\n */\nexport async function* toLoopEvents(chunks: AsyncIterable<OpenAIStreamChunk>): AsyncIterable<LoopEvent> {\n  const calls = new Map<number, PartialToolCall>()\n  for await (const chunk of chunks) {\n    // Usage rides the final chunk, which has an empty choices array — handle\n    // it before the choice guard.\n    if (chunk.usage?.prompt_tokens != null || chunk.usage?.completion_tokens != null) {\n      yield {\n        type: 'usage',\n        usage: {\n          promptTokens: chunk.usage.prompt_tokens ?? 0,\n          completionTokens: chunk.usage.completion_tokens ?? 0,\n        },\n      }\n    }\n    const choice = chunk.choices?.[0]\n    if (!choice) continue\n    const content = choice.delta?.content\n    if (content) yield { type: 'text', text: content }\n    const reasoning = choice.delta?.reasoning_content ?? choice.delta?.thinking\n    if (reasoning) yield { type: 'reasoning', text: reasoning }\n    for (const tc of choice.delta?.tool_calls ?? []) {\n      const cur = calls.get(tc.index) ?? { name: '', args: '' }\n      if (tc.id) cur.id = tc.id\n      if (tc.function?.name) cur.name += tc.function.name\n      if (tc.function?.arguments) cur.args += tc.function.arguments\n      calls.set(tc.index, cur)\n    }\n  }\n  for (const [, c] of [...calls.entries()].sort((a, b) => a[0] - b[0])) {\n    if (!c.name) continue\n    yield { type: 'tool_call', call: { toolCallId: c.id, toolName: c.name, args: safeParse(c.args) } satisfies LoopToolCall }\n  }\n}\n\nfunction safeParse(s: string): Record<string, unknown> {\n  if (!s.trim()) return {}\n  try {\n    const v = JSON.parse(s)\n    return v && typeof v === 'object' && !Array.isArray(v) ? (v as Record<string, unknown>) : {}\n  } catch {\n    return {}\n  }\n}\n\n/**\n * Which model actually served one direct-router turn.\n *\n * The router substitutes models on purpose — a quota-walled primary comes back\n * `200` answered by a different model — and says so in response headers. This\n * lane used to drop the whole `Response` after taking `.body`, so a turn\n * requested as `claude-sonnet-4-6` and answered by `openai/gpt-5` was recorded\n * by its caller as Claude: per-model quality scoring blamed the wrong model and\n * cost used the wrong price basis.\n *\n * Map this onto the shell's existing attribution contract rather than inventing\n * a second channel — `ChatTurnRouteProducer.modelAttribution()` (`/chat-routes`):\n *\n *     modelAttribution: () => ({ requestedModel, servedModel, echoReceived: true })\n *\n * Leave that contract's `servedSource` unset: its union is sandbox\n * profile-resolution vocabulary with no router analogue.\n */\nexport interface OpenAICompatServedModel {\n  /** The model id this turn asked for (`OpenAICompatStreamTurnOptions.model`). */\n  requestedModel: string\n  /** The model the router/provider reports having actually served. */\n  servedModel: string\n  /** Where `servedModel` was read from. The header is the router's own\n   *  substitution signal; the body is the backstop that survives CORS. */\n  source: 'router_header' | 'response_body'\n  /** True when served differs from requested after id folding. Folded, not\n   *  compared raw: the body reports a dated id on EVERY turn, so `!==` would\n   *  claim a substitution every time. */\n  substituted: boolean\n  /** `x-tangle-failover` `trigger=` — why the router swapped. Absent when the\n   *  router did not inject the substitute (a caller-supplied fallback chain\n   *  sets the served-model header without the failover one). */\n  trigger?: string\n  /** `x-tangle-failover` `degraded=`. */\n  degraded?: boolean\n}\n\n/** Parse `from=…; to=…; trigger=…; degraded=…` down to the fields we report.\n *  Absent/garbled segments are simply omitted — attribution is best-effort and\n *  must never fail a turn that is otherwise streaming fine. */\nfunction parseFailoverHeader(raw: string | null): { trigger?: string; degraded?: boolean } {\n  if (!raw) return {}\n  const fields = new Map<string, string>()\n  for (const segment of raw.split(';')) {\n    const eq = segment.indexOf('=')\n    if (eq === -1) continue\n    fields.set(segment.slice(0, eq).trim().toLowerCase(), segment.slice(eq + 1).trim())\n  }\n  const trigger = fields.get('trigger')\n  const degraded = fields.get('degraded')\n  return {\n    ...(trigger ? { trigger } : {}),\n    ...(degraded != null ? { degraded: degraded === 'true' } : {}),\n  }\n}\n\n/** Define options for configuring an OpenAI-compatible streaming chat turn including API details and tools */\nexport interface OpenAICompatStreamTurnOptions {\n  /** OpenAI-compat base URL (e.g. the Tangle Router `https://router.tangle.tools/v1`). */\n  baseUrl: string\n  apiKey: string\n  model: string\n  /** OpenAI tool definitions — pass `buildAppToolOpenAITools(taxonomy)` so the\n   *  model can call the app tools. Omit for a tool-free copilot. */\n  tools?: unknown[]\n  temperature?: number\n  fetchImpl?: typeof fetch\n  /** Extra body fields (e.g. `max_tokens`). */\n  extraBody?: Record<string, unknown>\n  /**\n   * Called at most ONCE per turn, as soon as the serving model is\n   * determinable, with what actually answered. Never called when neither the\n   * header nor the body names a model — silence means \"learned nothing\", not\n   * \"nothing was substituted\".\n   *\n   * `streamTurn` runs once per TOOL turn, so a multi-turn `runAppToolLoop`\n   * fires this once per turn; take the last for row attribution.\n   */\n  onServedModel?: (served: OpenAICompatServedModel) => void\n}\n\n/**\n * Build a `streamTurn` that calls an OpenAI-compatible `/chat/completions`\n * endpoint (Tangle Router / tcloud / any compat provider) with `stream: true`\n * and yields `LoopEvent`s via {@link toLoopEvents}. Browser/edge/Node-safe —\n * just `fetch` + an SSE reader. Drop straight into `streamAppToolLoop`:\n *\n *   const cfg = resolveTangleModelConfig()                 // or { baseUrl, apiKey, model }\n *   streamAppToolLoop({ streamTurn: createOpenAICompatStreamTurn({ ...cfg, tools }), executeToolCall, ... })\n */\nexport function createOpenAICompatStreamTurn(\n  opts: OpenAICompatStreamTurnOptions,\n): (messages: LoopMessage[]) => AsyncIterable<LoopEvent> {\n  const base = opts.baseUrl.replace(/\\/+$/, '')\n  const doFetch = opts.fetchImpl ?? fetch\n  return (messages) =>\n    toLoopEvents(\n      streamChatCompletions(doFetch, `${base}/chat/completions`, opts.apiKey, {\n        model: opts.model,\n        messages,\n        stream: true,\n        stream_options: { include_usage: true },\n        ...(opts.tools && opts.tools.length > 0 ? { tools: opts.tools } : {}),\n        ...(opts.temperature != null ? { temperature: opts.temperature } : {}),\n        ...opts.extraBody,\n      }, opts.onServedModel ? { requestedModel: opts.model, report: opts.onServedModel } : undefined),\n    )\n}\n\n/** Stream + parse an OpenAI-compat SSE response into chunks. Tolerates `data:`\n *  framing, multi-line buffers, and the terminal `[DONE]`. */\nasync function* streamChatCompletions(\n  doFetch: typeof fetch,\n  url: string,\n  apiKey: string,\n  body: Record<string, unknown>,\n  attribution?: { requestedModel: string; report: (served: OpenAICompatServedModel) => void },\n): AsyncIterable<OpenAIStreamChunk> {\n  const res = await doFetch(url, {\n    method: 'POST',\n    headers: { Authorization: `Bearer ${apiKey}`, 'Content-Type': 'application/json', Accept: 'text/event-stream' },\n    body: JSON.stringify(body),\n  })\n  if (!res.ok || !res.body) {\n    const text = res.body ? await res.text().catch(() => '') : ''\n    const error = new Error(`OpenAI-compat stream failed (HTTP ${res.status})${text ? `: ${text.slice(0, 200)}` : ''}`)\n    // Stamp the NUMERIC status. `isUpstreamUnavailable` (`/model-resolution`)\n    // reads a numeric field first and prose only as a backstop, and a\n    // Cloudflare EDGE 502 gives it nothing else to read: `content-type:\n    // text/plain`, a body of `error code: 502`, and none of the router's own\n    // `x-tangle-*` headers, because the origin never ran. Carrying the status\n    // as data keeps THIS path — the browser/edge copilot lane, which calls the\n    // router directly — out of the string-matching business entirely.\n    Object.assign(error, { status: res.status })\n    throw error\n  }\n  // Served-model attribution, fired at most once, as early as it is knowable.\n  //\n  // The header comes first because it is the router's OWN substitution signal:\n  // `X-Tangle-Served-Model` is set only when the served model differs from the\n  // requested one, so its presence is authoritative and it arrives before the\n  // first byte of content. `X-Tangle-Failover` rides along only when the router\n  // itself picked the substitute (a caller-supplied fallback chain sets the\n  // former without the latter), which is why `trigger`/`degraded` are optional.\n  //\n  // The body is the backstop for when the header cannot reach us. In a BROWSER,\n  // headers are invisible to JS unless the server lists them in\n  // `Access-Control-Expose-Headers` — tangle-router#324 added both, but that\n  // only helps once it is DEPLOYED, and any other OpenAI-compat endpoint\n  // pointed at this client exposes nothing. The chunk `model` field is not\n  // subject to CORS, so it keeps the browser lane attributable regardless.\n  let reported = false\n  const report = (served: OpenAICompatServedModel): void => {\n    if (reported || !attribution) return\n    reported = true\n    attribution.report(served)\n  }\n  if (attribution) {\n    const servedHeader = res.headers.get('x-tangle-served-model')\n    if (servedHeader) {\n      report({\n        requestedModel: attribution.requestedModel,\n        servedModel: servedHeader,\n        source: 'router_header',\n        substituted: normalizeModelId(servedHeader) !== normalizeModelId(attribution.requestedModel),\n        ...parseFailoverHeader(res.headers.get('x-tangle-failover')),\n      })\n    }\n  }\n  const reader = res.body.getReader()\n  const decoder = new TextDecoder()\n  let buffer = ''\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    buffer += decoder.decode(value, { stream: true })\n    const lines = buffer.split('\\n')\n    buffer = lines.pop() ?? ''\n    for (const line of lines) {\n      const trimmed = line.trim()\n      if (!trimmed.startsWith('data:')) continue\n      const data = trimmed.slice(5).trim()\n      if (data === '[DONE]') return\n      let chunk: OpenAIStreamChunk\n      try {\n        chunk = JSON.parse(data) as OpenAIStreamChunk\n      } catch {\n        continue /* skip a partial/garbled SSE frame */\n      }\n      // Body fallback: only when the header said nothing. Fold both ids before\n      // comparing — the router reports the dated upstream id (`gpt-5-2025-08-07`)\n      // for a request of `openai/gpt-5` even with NO substitution, so a raw\n      // `!==` would report a swap on literally every turn.\n      if (attribution && !reported && chunk.model) {\n        report({\n          requestedModel: attribution.requestedModel,\n          servedModel: chunk.model,\n          source: 'response_body',\n          substituted: normalizeModelId(chunk.model) !== normalizeModelId(attribution.requestedModel),\n        })\n      }\n      yield chunk\n    }\n  }\n}\n","/**\n * `createCertifiedDelivery` — the delivery truck for Tangle Intelligence.\n *\n * Pulls a tenant's CERTIFIED `AgentProfile` from the deployed plane\n * (`GET /v1/profiles/:target/composed`) and applies it to the agent's resolved\n * surfaces each turn, so an approved improvement reaches the running agent with\n * NO redeploy. This is the `composeProfile` transform `createAgentRuntime`\n * accepts — opt-in per product, fail-closed, cached + refreshed.\n *\n * Profile-WIDE by design (not prompt-only): the composed profile carries every\n * promoted artifact type keyed by kind. What's folded where:\n *   - `prompt-surface` + `skill` → the system prompt (via `composeCertifiedPrompt`).\n *   - `tool` artifacts that carry an OpenAI tool definition → `extraTools`\n *     (advertised to the model; the matching executor is supplied by the product\n *     via `executeOtherTool`). Until a `tool` artifact carries a runnable def,\n *     it is surfaced (see `current()`) but not advertised — advertising a tool\n *     with no executor would make the model call into a dead end.\n *   - `mcp` / `memory` / `rag` artifacts materialize as servers/files and deliver\n *     through the SANDBOX-provisioning seam, not this in-process one. The full\n *     certified profile is exposed via `current()` so that seam can consume it.\n *\n * Substrate boundary: THIS module imports `@tangle-network/agent-runtime`; the\n * `createAgentRuntime` core does not (it only consumes the generic transform).\n */\n\nimport {\n  composeCertifiedPrompt,\n  type CertifiedProfile,\n  pullCertified,\n} from '@tangle-network/agent-runtime/intelligence'\nimport type { ResolvedAgentProfile } from './agent'\n\nconst defaultRefreshMs = 300_000\n\n/** Define configuration options for delivering certified artifacts to a specified tenant target */\nexport interface CertifiedDeliveryConfig {\n  /** The tenant target whose certified artifacts to deliver (the agent id). */\n  target: string\n  /** Bearer for the plane. Reads `TANGLE_API_KEY` when omitted. */\n  apiKey?: string\n  /** Plane base URL. Reads `TANGLE_INTELLIGENCE_URL` then the public plane. */\n  baseUrl?: string\n  /** Min interval between certified-profile pulls. Default 5m. */\n  refreshMs?: number\n  /** fetch impl (tests / non-global-fetch runtimes). */\n  fetchImpl?: typeof fetch\n}\n\n/** Resolve and manage certified profiles with refresh and composition capabilities */\nexport interface CertifiedDelivery {\n  /** The `composeProfile` transform to pass to `createAgentRuntime`. Applies the\n   *  cached certified profile to the base surfaces; refreshes on the cadence. */\n  composeProfile(base: ResolvedAgentProfile): Promise<ResolvedAgentProfile>\n  /** Force a pull now (ignores the refresh window). Best-effort. */\n  refresh(): Promise<void>\n  /** The certified profile currently in effect (null = none promoted / pull\n   *  failed). Lets the sandbox-provisioning seam deliver the file/server\n   *  artifact types this in-process seam doesn't. */\n  current(): CertifiedProfile | null\n}\n\n/**\n * Build a certified-delivery transform for one agent target. Fail-closed: a pull\n * error or 404 keeps the last-known certified profile (or null), and the agent\n * runs on its base surfaces — it never breaks because Intelligence is down.\n */\nexport function createCertifiedDelivery(config: CertifiedDeliveryConfig): CertifiedDelivery {\n  const refreshMs = config.refreshMs ?? defaultRefreshMs\n  let certified: CertifiedProfile | null = null\n  let lastPullAt = 0\n  let inflight: Promise<void> | null = null\n\n  async function refresh(force = false): Promise<void> {\n    if (!force && Date.now() - lastPullAt < refreshMs) return\n    if (inflight) return inflight\n    inflight = (async () => {\n      const outcome = await pullCertified({\n        target: config.target,\n        apiKey: config.apiKey,\n        baseUrl: config.baseUrl,\n        fetchImpl: config.fetchImpl,\n      })\n      lastPullAt = Date.now()\n      // Only replace on a real pull; a 404/error keeps the last-known profile.\n      if (outcome.succeeded) certified = outcome.value\n    })()\n    try {\n      await inflight\n    } finally {\n      inflight = null\n    }\n  }\n\n  return {\n    async composeProfile(base) {\n      await refresh()\n      return {\n        // prompt-surface + skill fold into the system prompt.\n        systemPrompt: composeCertifiedPrompt(base.systemPrompt, certified),\n        // Certified `tool` artifacts deliver here once they carry a runnable\n        // OpenAI def + the product wires the executor; until then pass through.\n        extraTools: base.extraTools,\n      }\n    },\n    refresh: () => refresh(true),\n    current: () => certified,\n  }\n}\n","/**\n * Surface-scoped profile overlay — the seam letting any product page (a\n * sequence editor, a brief composer, a dataset view) add MCP servers, a prompt\n * addendum, and permission tightening to the workspace agent profile for turns\n * initiated FROM that surface, without the chat orchestrator knowing any\n * surface's specifics. The orchestrator resolves `(kind, ctx)` through a\n * registry the REQUEST HANDLER constructs per request (construction is a Map\n * build — cheap) and merges the result into the base profile it was about to\n * send to the sandbox. Per-request construction is the trust mechanism, not an\n * optimization target: each `build()` closes over server-trusted request state\n * (env bindings, secrets, the AUTHENTICATED user/workspace), which on Workers\n * exists only per request — a startup-built registry would force identity\n * through the untrusted client `ctx`.\n *\n * SECURITY INVARIANT: the surface `kind` and the ids inside `ctx` arrive on\n * the client request and are pure ROUTING data — never trusted content, never\n * identity. Identity comes from the closure (see above). The registered\n * `build()` runs server-side only: it validates the routing ids against the\n * product's access control, then mints its own URLs and capability tokens from\n * server configuration (`buildHttpMcpServer` + `createCapabilityToken` in\n * ../tools). A client can therefore never inject an arbitrary MCP url, header,\n * or token into the agent profile: the overlay's `mcp` values are typed as\n * {@link SurfaceMcpServer} (= the server-built `AppToolMcpServer` entry shape),\n * and only build() constructs them.\n */\n\nimport type { AppToolMcpServer } from '../tools/mcp'\n\n/** Sandbox permission posture values, ranked deny > ask > allow for merging. */\nexport type SurfacePermissionValue = 'allow' | 'ask' | 'deny'\n\n/** The only MCP entry shape an overlay may carry: the server-built bridge\n *  entry from ../tools/mcp (transport, url, headers, and capability token all\n *  assembled server-side). The alias exists so overlay authors reach for the\n *  builders in ../tools rather than hand-rolling `{ url: ctx.url }` shapes\n *  that would let request data become a dialable endpoint. */\nexport type SurfaceMcpServer = AppToolMcpServer\n\n/** What one surface contributes to the agent profile for a single turn. */\nexport interface SurfaceOverlay {\n  /** MCP servers to mount for this turn, keyed by tool-routing name. Names\n   *  must not collide with the base profile's — see {@link mergeSurfaceOverlay}. */\n  mcp?: Record<string, SurfaceMcpServer>\n  /** Appended to the base system-prompt addendum with a blank-line separator. */\n  promptAddendum?: string\n  /** Per-key posture the surface wants for its turns. Merging is monotone\n   *  fail-closed: the stricter of base/overlay wins, so a surface can tighten\n   *  the workspace posture but never relax it. */\n  permissions?: Record<string, SurfacePermissionValue>\n}\n\n/**\n * One registered surface kind. `TCtx` is the shape build() expects — a CLAIM\n * about the client payload, not a guarantee: the registry hands build() the\n * request's `ctx` unvalidated, so build() must treat every field as an\n * untrusted id (resolve it through access control that throws on a bad or\n * foreign id) before minting anything from it.\n */\nexport interface SurfaceKindDefinition<TCtx> {\n  kind: string\n  build: (ctx: TCtx) => SurfaceOverlay | Promise<SurfaceOverlay>\n}\n\n/** The variance-erased form a registry accepts (`build` is contravariant in\n *  `TCtx`, so every concrete definition is assignable to this). */\nexport type AnySurfaceKind = SurfaceKindDefinition<never>\n\n/**\n * Declare one surface kind. The `kind` string is the client-visible routing\n * key (e.g. `'sequences'`); `build` is the server-side factory that turns a\n * validated ctx into the overlay for one turn.\n */\nexport function defineSurfaceKind<TCtx>(opts: {\n  kind: string\n  build: (ctx: TCtx) => SurfaceOverlay | Promise<SurfaceOverlay>\n}): SurfaceKindDefinition<TCtx> {\n  if (typeof opts.kind !== 'string' || opts.kind.length === 0 || /\\s/.test(opts.kind)) {\n    throw new Error(`surface kind must be a non-empty string without whitespace (got ${JSON.stringify(opts.kind)})`)\n  }\n  if (typeof opts.build !== 'function') {\n    throw new Error(`surface kind '${opts.kind}' requires a build function`)\n  }\n  return { kind: opts.kind, build: opts.build }\n}\n\n/** Resolve and build the overlay for a given surface kind within a turn context */\nexport interface SurfaceRegistry {\n  /** Build the overlay for one turn. Throws on an unknown kind — an unknown\n   *  surface is a routing bug (client and server registries drifted), and\n   *  silently returning an empty overlay would strip the surface's tools from\n   *  the turn with no signal anywhere. Build errors propagate unwrapped. */\n  resolve(kind: string, ctx: unknown): Promise<SurfaceOverlay>\n}\n\n/**\n * Assemble the product's surface registry from its registered kinds. Duplicate\n * kinds throw at construction: two builders behind one routing key would make\n * the mounted toolset depend on registration order.\n */\nexport function createSurfaceRegistry(kinds: readonly AnySurfaceKind[]): SurfaceRegistry {\n  const byKind = new Map<string, AnySurfaceKind>()\n  for (const definition of kinds) {\n    if (byKind.has(definition.kind)) {\n      throw new Error(`duplicate surface kind '${definition.kind}' — each kind must be registered exactly once`)\n    }\n    byKind.set(definition.kind, definition)\n  }\n\n  return {\n    async resolve(kind, ctx) {\n      const definition = byKind.get(kind)\n      if (!definition) {\n        const known = [...byKind.keys()].join(', ') || '(none)'\n        throw new Error(\n          `unknown surface kind '${kind}' — registered kinds: ${known}. ` +\n            'An unknown surface is a routing bug: register the kind via defineSurfaceKind before clients can reference it.',\n        )\n      }\n      // The trust boundary where static ctx typing ends: the request payload is\n      // handed to build() as-is, and build() validates it (see SurfaceKindDefinition).\n      const overlay = await definition.build(ctx as never)\n      assertSurfaceOverlay(overlay, `surface kind '${kind}'`)\n      return overlay\n    },\n  }\n}\n\n/** Base-profile slice the merge reads/writes. Real callers pass their full\n *  profile object; every field outside this slice passes through untouched. */\nexport interface SurfaceMergeBase {\n  mcp?: Record<string, unknown>\n  systemPromptAddendum?: string\n  permissions?: Record<string, SurfacePermissionValue>\n}\n\nconst PERMISSION_SEVERITY: Record<SurfacePermissionValue, number> = { allow: 0, ask: 1, deny: 2 }\n\n/**\n * Merge one surface overlay into a base profile, returning a new object\n * (the base is never mutated; untouched nested records are shared by\n * reference).\n *\n * - `mcp`: overlay servers are added under their own names. A name already\n *   present on the base THROWS — a collision is two servers claiming one\n *   routing name, and renaming either silently would corrupt tool routing for\n *   whichever caller expected the original binding.\n * - `systemPromptAddendum`: the overlay's `promptAddendum` appends after a\n *   blank-line separator (no separator when the base has no addendum).\n * - `permissions`: per key the STRICTER value wins (deny > ask > allow). A\n *   surface can tighten the base posture for its turns; a base 'deny' survives\n *   any overlay.\n */\nexport function mergeSurfaceOverlay<TBase extends SurfaceMergeBase>(\n  base: TBase,\n  overlay: SurfaceOverlay,\n): TBase & SurfaceMergeBase {\n  assertSurfaceOverlay(overlay, 'surface overlay')\n  const merged: SurfaceMergeBase = { ...base }\n\n  if (overlay.mcp && Object.keys(overlay.mcp).length > 0) {\n    const baseMcp = base.mcp ?? {}\n    const collisions = Object.keys(overlay.mcp).filter((name) => name in baseMcp)\n    if (collisions.length > 0) {\n      throw new Error(\n        `surface overlay MCP name collision: ${collisions.map((n) => `'${n}'`).join(', ')} already exist on the base profile. ` +\n          'Two servers cannot claim one name — give the surface server a distinct name.',\n      )\n    }\n    merged.mcp = { ...baseMcp, ...overlay.mcp }\n  }\n\n  if (overlay.promptAddendum !== undefined) {\n    merged.systemPromptAddendum = base.systemPromptAddendum\n      ? `${base.systemPromptAddendum}\\n\\n${overlay.promptAddendum}`\n      : overlay.promptAddendum\n  }\n\n  if (overlay.permissions && Object.keys(overlay.permissions).length > 0) {\n    const permissions: Record<string, SurfacePermissionValue> = { ...(base.permissions ?? {}) }\n    for (const [key, value] of Object.entries(overlay.permissions)) {\n      const existing = permissions[key]\n      permissions[key] =\n        existing === undefined || PERMISSION_SEVERITY[value] > PERMISSION_SEVERITY[existing] ? value : existing\n    }\n    merged.permissions = permissions\n  }\n\n  // merged began as a shallow copy of base; only the three slice fields were\n  // replaced, so the intersection type is the true shape.\n  return merged as TBase & SurfaceMergeBase\n}\n\n/** Reject overlays a build() (or hand-rolled caller) malformed, with the exact\n *  field named: a relative MCP url, a blank addendum, or an off-vocabulary\n *  permission would otherwise surface only as an opaque sandbox failure. */\nfunction assertSurfaceOverlay(overlay: SurfaceOverlay, label: string): void {\n  if (overlay.promptAddendum !== undefined) {\n    if (typeof overlay.promptAddendum !== 'string' || overlay.promptAddendum.trim().length === 0) {\n      throw new Error(`${label}: promptAddendum must be a non-blank string when provided`)\n    }\n  }\n  if (overlay.mcp !== undefined) {\n    for (const [name, server] of Object.entries(overlay.mcp)) {\n      if (name.trim().length === 0) throw new Error(`${label}: MCP server names must be non-empty`)\n      if (server.transport !== 'http') {\n        throw new Error(`${label}: MCP server '${name}' must use transport 'http' (got ${JSON.stringify((server as { transport?: unknown }).transport)})`)\n      }\n      let parsed: URL\n      try {\n        parsed = new URL(server.url)\n      } catch {\n        throw new Error(`${label}: MCP server '${name}' url must be an absolute URL (got ${JSON.stringify(server.url)})`)\n      }\n      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {\n        throw new Error(`${label}: MCP server '${name}' url must be http(s) (got ${JSON.stringify(server.url)})`)\n      }\n    }\n  }\n  if (overlay.permissions !== undefined) {\n    for (const [key, value] of Object.entries(overlay.permissions)) {\n      if (!(value in PERMISSION_SEVERITY)) {\n        throw new Error(`${label}: permission '${key}' must be 'allow' | 'ask' | 'deny' (got ${JSON.stringify(value)})`)\n      }\n    }\n  }\n}\n","/**\n * The bounded agent tool-loop — owned by `@tangle-network/agent-runtime`.\n *\n * A model turn may emit tool calls (integration-hub actions, the app tools from\n * `../tools`, delegation). The loop streams a turn, collects the executable tool\n * calls, dispatches each, appends the results to history in OpenAI\n * function-calling shape, and re-runs so the model reads them — bounded by\n * `maxToolTurns`, a wall-clock `deadlineMs`, and a `maxCostUsd` budget.\n *\n * The history shape is the OpenAI function-calling contract: the assistant turn\n * that emitted tool calls is preserved as an `assistant` message carrying its\n * `tool_calls` array, and each result is its own `{ role: 'tool', tool_call_id,\n * content }` message keyed to the call. A strict model (Claude, and any\n * OpenAI-compatible provider that validates tool history) needs this to read its\n * own tool use back; folding results into a `user` message makes such models\n * re-issue the same call in a loop.\n *\n * The loop is substrate-owned (`runToolLoop` / `streamToolLoop`); the app\n * supplies `streamTurn` (wrapping its model endpoint) and `executeToolCall`\n * (routing to its integration + app-tool executors). The app-facing names below\n * are 1:1 aliases of the canonical symbols, kept so this package's consumers and\n * the in-package `createAgentRuntime` read against a single, stable vocabulary.\n *\n * This is the LEAF the runtime barrel and its children both import — keeping the\n * tool-loop vocabulary out of any import cycle. The barrel re-exports it.\n */\n\nexport {\n  runToolLoop as runAppToolLoop,\n  streamToolLoop as streamAppToolLoop,\n} from '@tangle-network/agent-runtime/tool-loop'\nexport type {\n  ToolLoopCall as LoopToolCall,\n  ToolLoopAssistantToolCall as LoopAssistantToolCall,\n  ToolLoopMessage as LoopMessage,\n  ToolLoopEvent,\n  ToolLoopStopReason,\n  ToolLoopResult,\n  RunToolLoopOptions as AppToolLoopOptions,\n  StreamToolLoopOptions as StreamAppToolLoopOptions,\n  StreamToolLoopYield as StreamLoopYield,\n} from '@tangle-network/agent-runtime/tool-loop'\n\n/**\n * Events the app's OpenAI-compat stream adapter ({@link toLoopEvents}) yields.\n *\n * This is the app's own `Raw` event type for the streaming loop — the canonical\n * `streamToolLoop<Raw>` is generic over it. It widens the substrate's\n * tool-loop event with `reasoning` (DeepSeek/router `reasoning_content` /\n * `thinking` deltas, rendered as thinking sections) and `usage` (per-message\n * token accounting) — neither belongs in the substrate's loop contract, so they\n * stay here. The adapter maps each into the `streamTurn` seam; `text` and\n * `tool_call` drive the loop, `reasoning` / `usage` pass through to the UI.\n */\nexport type LoopEvent =\n  | { type: 'text'; text: string }\n  | { type: 'reasoning'; text: string }\n  | {\n      type: 'tool_call'\n      call: import('@tangle-network/agent-runtime/tool-loop').ToolLoopCall\n    }\n  | { type: 'usage'; usage: { promptTokens: number; completionTokens: number } }\n  | { type: 'other'; event: unknown }\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA4DA,gBAAuB,aAAa,QAAoE;AACtG,QAAM,QAAQ,oBAAI,IAA6B;AAC/C,mBAAiB,SAAS,QAAQ;AAGhC,QAAI,MAAM,OAAO,iBAAiB,QAAQ,MAAM,OAAO,qBAAqB,MAAM;AAChF,YAAM;AAAA,QACJ,MAAM;AAAA,QACN,OAAO;AAAA,UACL,cAAc,MAAM,MAAM,iBAAiB;AAAA,UAC3C,kBAAkB,MAAM,MAAM,qBAAqB;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,MAAM,UAAU,CAAC;AAChC,QAAI,CAAC,OAAQ;AACb,UAAM,UAAU,OAAO,OAAO;AAC9B,QAAI,QAAS,OAAM,EAAE,MAAM,QAAQ,MAAM,QAAQ;AACjD,UAAM,YAAY,OAAO,OAAO,qBAAqB,OAAO,OAAO;AACnE,QAAI,UAAW,OAAM,EAAE,MAAM,aAAa,MAAM,UAAU;AAC1D,eAAW,MAAM,OAAO,OAAO,cAAc,CAAC,GAAG;AAC/C,YAAM,MAAM,MAAM,IAAI,GAAG,KAAK,KAAK,EAAE,MAAM,IAAI,MAAM,GAAG;AACxD,UAAI,GAAG,GAAI,KAAI,KAAK,GAAG;AACvB,UAAI,GAAG,UAAU,KAAM,KAAI,QAAQ,GAAG,SAAS;AAC/C,UAAI,GAAG,UAAU,UAAW,KAAI,QAAQ,GAAG,SAAS;AACpD,YAAM,IAAI,GAAG,OAAO,GAAG;AAAA,IACzB;AAAA,EACF;AACA,aAAW,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,MAAM,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG;AACpE,QAAI,CAAC,EAAE,KAAM;AACb,UAAM,EAAE,MAAM,aAAa,MAAM,EAAE,YAAY,EAAE,IAAI,UAAU,EAAE,MAAM,MAAM,UAAU,EAAE,IAAI,EAAE,EAAyB;AAAA,EAC1H;AACF;AAEA,SAAS,UAAU,GAAoC;AACrD,MAAI,CAAC,EAAE,KAAK,EAAG,QAAO,CAAC;AACvB,MAAI;AACF,UAAM,IAAI,KAAK,MAAM,CAAC;AACtB,WAAO,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAK,IAAgC,CAAC;AAAA,EAC7F,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AA2CA,SAAS,oBAAoB,KAA8D;AACzF,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,WAAW,IAAI,MAAM,GAAG,GAAG;AACpC,UAAM,KAAK,QAAQ,QAAQ,GAAG;AAC9B,QAAI,OAAO,GAAI;AACf,WAAO,IAAI,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,QAAQ,MAAM,KAAK,CAAC,EAAE,KAAK,CAAC;AAAA,EACpF;AACA,QAAM,UAAU,OAAO,IAAI,SAAS;AACpC,QAAM,WAAW,OAAO,IAAI,UAAU;AACtC,SAAO;AAAA,IACL,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,GAAI,YAAY,OAAO,EAAE,UAAU,aAAa,OAAO,IAAI,CAAC;AAAA,EAC9D;AACF;AAoCO,SAAS,6BACd,MACuD;AACvD,QAAM,OAAO,KAAK,QAAQ,QAAQ,QAAQ,EAAE;AAC5C,QAAM,UAAU,KAAK,aAAa;AAClC,SAAO,CAAC,aACN;AAAA,IACE,sBAAsB,SAAS,GAAG,IAAI,qBAAqB,KAAK,QAAQ;AAAA,MACtE,OAAO,KAAK;AAAA,MACZ;AAAA,MACA,QAAQ;AAAA,MACR,gBAAgB,EAAE,eAAe,KAAK;AAAA,MACtC,GAAI,KAAK,SAAS,KAAK,MAAM,SAAS,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;AAAA,MACnE,GAAI,KAAK,eAAe,OAAO,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;AAAA,MACpE,GAAG,KAAK;AAAA,IACV,GAAG,KAAK,gBAAgB,EAAE,gBAAgB,KAAK,OAAO,QAAQ,KAAK,cAAc,IAAI,MAAS;AAAA,EAChG;AACJ;AAIA,gBAAgB,sBACd,SACA,KACA,QACA,MACA,aACkC;AAClC,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,oBAAoB,QAAQ,oBAAoB;AAAA,IAC9G,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,MAAM,CAAC,IAAI,MAAM;AACxB,UAAM,OAAO,IAAI,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,EAAE,IAAI;AAC3D,UAAM,QAAQ,IAAI,MAAM,qCAAqC,IAAI,MAAM,IAAI,OAAO,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,EAAE;AAQlH,WAAO,OAAO,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC;AAC3C,UAAM;AAAA,EACR;AAgBA,MAAI,WAAW;AACf,QAAM,SAAS,CAAC,WAA0C;AACxD,QAAI,YAAY,CAAC,YAAa;AAC9B,eAAW;AACX,gBAAY,OAAO,MAAM;AAAA,EAC3B;AACA,MAAI,aAAa;AACf,UAAM,eAAe,IAAI,QAAQ,IAAI,uBAAuB;AAC5D,QAAI,cAAc;AAChB,aAAO;AAAA,QACL,gBAAgB,YAAY;AAAA,QAC5B,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa,iBAAiB,YAAY,MAAM,iBAAiB,YAAY,cAAc;AAAA,QAC3F,GAAG,oBAAoB,IAAI,QAAQ,IAAI,mBAAmB,CAAC;AAAA,MAC7D,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,SAAS;AACb,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,cAAU,QAAQ,OAAO,OAAO,EAAE,QAAQ,KAAK,CAAC;AAChD,UAAM,QAAQ,OAAO,MAAM,IAAI;AAC/B,aAAS,MAAM,IAAI,KAAK;AACxB,eAAW,QAAQ,OAAO;AACxB,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,CAAC,QAAQ,WAAW,OAAO,EAAG;AAClC,YAAM,OAAO,QAAQ,MAAM,CAAC,EAAE,KAAK;AACnC,UAAI,SAAS,SAAU;AACvB,UAAI;AACJ,UAAI;AACF,gBAAQ,KAAK,MAAM,IAAI;AAAA,MACzB,QAAQ;AACN;AAAA,MACF;AAKA,UAAI,eAAe,CAAC,YAAY,MAAM,OAAO;AAC3C,eAAO;AAAA,UACL,gBAAgB,YAAY;AAAA,UAC5B,aAAa,MAAM;AAAA,UACnB,QAAQ;AAAA,UACR,aAAa,iBAAiB,MAAM,KAAK,MAAM,iBAAiB,YAAY,cAAc;AAAA,QAC5F,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;;;AC5RA;AAAA,EACE;AAAA,EAEA;AAAA,OACK;AAGP,IAAM,mBAAmB;AAkClB,SAAS,wBAAwB,QAAoD;AAC1F,QAAM,YAAY,OAAO,aAAa;AACtC,MAAI,YAAqC;AACzC,MAAI,aAAa;AACjB,MAAI,WAAiC;AAErC,iBAAe,QAAQ,QAAQ,OAAsB;AACnD,QAAI,CAAC,SAAS,KAAK,IAAI,IAAI,aAAa,UAAW;AACnD,QAAI,SAAU,QAAO;AACrB,gBAAY,YAAY;AACtB,YAAM,UAAU,MAAM,cAAc;AAAA,QAClC,QAAQ,OAAO;AAAA,QACf,QAAQ,OAAO;AAAA,QACf,SAAS,OAAO;AAAA,QAChB,WAAW,OAAO;AAAA,MACpB,CAAC;AACD,mBAAa,KAAK,IAAI;AAEtB,UAAI,QAAQ,UAAW,aAAY,QAAQ;AAAA,IAC7C,GAAG;AACH,QAAI;AACF,YAAM;AAAA,IACR,UAAE;AACA,iBAAW;AAAA,IACb;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,eAAe,MAAM;AACzB,YAAM,QAAQ;AACd,aAAO;AAAA;AAAA,QAEL,cAAc,uBAAuB,KAAK,cAAc,SAAS;AAAA;AAAA;AAAA,QAGjE,YAAY,KAAK;AAAA,MACnB;AAAA,IACF;AAAA,IACA,SAAS,MAAM,QAAQ,IAAI;AAAA,IAC3B,SAAS,MAAM;AAAA,EACjB;AACF;;;ACnCO,SAAS,kBAAwB,MAGR;AAC9B,MAAI,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,WAAW,KAAK,KAAK,KAAK,KAAK,IAAI,GAAG;AACnF,UAAM,IAAI,MAAM,mEAAmE,KAAK,UAAU,KAAK,IAAI,CAAC,GAAG;AAAA,EACjH;AACA,MAAI,OAAO,KAAK,UAAU,YAAY;AACpC,UAAM,IAAI,MAAM,iBAAiB,KAAK,IAAI,6BAA6B;AAAA,EACzE;AACA,SAAO,EAAE,MAAM,KAAK,MAAM,OAAO,KAAK,MAAM;AAC9C;AAgBO,SAAS,sBAAsB,OAAmD;AACvF,QAAM,SAAS,oBAAI,IAA4B;AAC/C,aAAW,cAAc,OAAO;AAC9B,QAAI,OAAO,IAAI,WAAW,IAAI,GAAG;AAC/B,YAAM,IAAI,MAAM,2BAA2B,WAAW,IAAI,oDAA+C;AAAA,IAC3G;AACA,WAAO,IAAI,WAAW,MAAM,UAAU;AAAA,EACxC;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,MAAM,KAAK;AACvB,YAAM,aAAa,OAAO,IAAI,IAAI;AAClC,UAAI,CAAC,YAAY;AACf,cAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,IAAI,KAAK;AAC/C,cAAM,IAAI;AAAA,UACR,yBAAyB,IAAI,8BAAyB,KAAK;AAAA,QAE7D;AAAA,MACF;AAGA,YAAM,UAAU,MAAM,WAAW,MAAM,GAAY;AACnD,2BAAqB,SAAS,iBAAiB,IAAI,GAAG;AACtD,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAUA,IAAM,sBAA8D,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,EAAE;AAiBzF,SAAS,oBACd,MACA,SAC0B;AAC1B,uBAAqB,SAAS,iBAAiB;AAC/C,QAAM,SAA2B,EAAE,GAAG,KAAK;AAE3C,MAAI,QAAQ,OAAO,OAAO,KAAK,QAAQ,GAAG,EAAE,SAAS,GAAG;AACtD,UAAM,UAAU,KAAK,OAAO,CAAC;AAC7B,UAAM,aAAa,OAAO,KAAK,QAAQ,GAAG,EAAE,OAAO,CAAC,SAAS,QAAQ,OAAO;AAC5E,QAAI,WAAW,SAAS,GAAG;AACzB,YAAM,IAAI;AAAA,QACR,uCAAuC,WAAW,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,CAAC;AAAA,MAEnF;AAAA,IACF;AACA,WAAO,MAAM,EAAE,GAAG,SAAS,GAAG,QAAQ,IAAI;AAAA,EAC5C;AAEA,MAAI,QAAQ,mBAAmB,QAAW;AACxC,WAAO,uBAAuB,KAAK,uBAC/B,GAAG,KAAK,oBAAoB;AAAA;AAAA,EAAO,QAAQ,cAAc,KACzD,QAAQ;AAAA,EACd;AAEA,MAAI,QAAQ,eAAe,OAAO,KAAK,QAAQ,WAAW,EAAE,SAAS,GAAG;AACtE,UAAM,cAAsD,EAAE,GAAI,KAAK,eAAe,CAAC,EAAG;AAC1F,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,GAAG;AAC9D,YAAM,WAAW,YAAY,GAAG;AAChC,kBAAY,GAAG,IACb,aAAa,UAAa,oBAAoB,KAAK,IAAI,oBAAoB,QAAQ,IAAI,QAAQ;AAAA,IACnG;AACA,WAAO,cAAc;AAAA,EACvB;AAIA,SAAO;AACT;AAKA,SAAS,qBAAqB,SAAyB,OAAqB;AAC1E,MAAI,QAAQ,mBAAmB,QAAW;AACxC,QAAI,OAAO,QAAQ,mBAAmB,YAAY,QAAQ,eAAe,KAAK,EAAE,WAAW,GAAG;AAC5F,YAAM,IAAI,MAAM,GAAG,KAAK,2DAA2D;AAAA,IACrF;AAAA,EACF;AACA,MAAI,QAAQ,QAAQ,QAAW;AAC7B,eAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AACxD,UAAI,KAAK,KAAK,EAAE,WAAW,EAAG,OAAM,IAAI,MAAM,GAAG,KAAK,sCAAsC;AAC5F,UAAI,OAAO,cAAc,QAAQ;AAC/B,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,IAAI,oCAAoC,KAAK,UAAW,OAAmC,SAAS,CAAC,GAAG;AAAA,MACnJ;AACA,UAAI;AACJ,UAAI;AACF,iBAAS,IAAI,IAAI,OAAO,GAAG;AAAA,MAC7B,QAAQ;AACN,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,IAAI,sCAAsC,KAAK,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,MAClH;AACA,UAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,IAAI,8BAA8B,KAAK,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,MAC1G;AAAA,IACF;AAAA,EACF;AACA,MAAI,QAAQ,gBAAgB,QAAW;AACrC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,GAAG;AAC9D,UAAI,EAAE,SAAS,sBAAsB;AACnC,cAAM,IAAI,MAAM,GAAG,KAAK,iBAAiB,GAAG,2CAA2C,KAAK,UAAU,KAAK,CAAC,GAAG;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;;;ACtMA;AAAA,EACiB;AAAA,EACG;AAAA,OACb;","names":[]}

package/dist/stream/index.d.ts

@@ -1,6 +1,6 @@
 import { J as JsonRecord } from '../stream-normalizer-CnPnMaTp.js';
 export { M as MISSING_TOOL_TERMINAL_ERROR, b as MISSING_TOOL_TERMINAL_REASON, S as StreamEvent, c as asRecord, d as asString, a as attachmentPartKey, e as collapseRedundantTextParts, f as draftAssistantParts, g as encodeEvent, h as finalizeAssistantParts, i as finalizePendingInteractionParts, j as getPartKey, m as mergePersistedPart, n as normalizePersistedPart, k as normalizeTime, l as normalizeToolEvent, r as resolveToolId, o as resolveToolName, t as terminalizeDanglingAssistantToolUpdates, p as terminalizeDanglingToolPart, q as terminalizeDanglingToolParts } from '../stream-normalizer-CnPnMaTp.js';
-export { B as BufferedTurnEvent, a as BufferedTurnOptions, b as BufferedTurnTap, D as D1LikeForTurns, c as DEFAULT_RUNNING_TURN_LEASE_MS, d as DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS, P as PumpBufferedTurnOptions, R as ReplayTurnEventsOptions, e as TURN_EVENTS_MIGRATION_SQL, f as TURN_STATUS_SCOPE_MIGRATION_SQL, T as TurnEventStore, g as TurnEventStoreOptions, h as TurnStatus, i as coalesceChatStreamEvents, j as coalesceDeltas, k as createBufferedTurnTap, l as createD1TurnEventStore, m as createMemoryTurnEventStore, p as pumpBufferedTurn, r as replayTurnEvents, s as stampReplaySeq } from '../turn-buffer-CFKQlnxf.js';
+export { B as BufferedTurnEvent, a as BufferedTurnOptions, b as BufferedTurnTap, D as D1LikeForTurns, c as DEFAULT_RUNNING_TURN_LEASE_MS, d as DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS, P as PumpBufferedTurnOptions, R as ReplayTurnEventsOptions, e as TURN_EVENTS_MIGRATION_SQL, f as TURN_STATUS_SCOPE_MIGRATION_SQL, T as TurnEventStore, g as TurnEventStoreOptions, h as TurnStatus, i as coalesceChatStreamEvents, j as coalesceDeltas, k as createBufferedTurnTap, l as createD1TurnEventStore, m as createMemoryTurnEventStore, p as pumpBufferedTurn, r as replayTurnEvents, s as stampReplaySeq } from '../turn-buffer-COMQUwO2.js';
 import '../contract-CQNvv5th.js';
 import '@tangle-network/agent-interface';
 

package/dist/stream/index.js

@@ -17,7 +17,7 @@ import {
   pumpBufferedTurn,
   replayTurnEvents,
   stampReplaySeq
-} from "../chunk-6VWA26BV.js";
+} from "../chunk-SDEADFHZ.js";
 import {
   MISSING_TOOL_TERMINAL_ERROR,
   MISSING_TOOL_TERMINAL_REASON,

package/dist/{turn-buffer-CFKQlnxf.d.ts → turn-buffer-COMQUwO2.d.ts}

@@ -88,7 +88,9 @@ interface BufferedTurnOptions {
      *  {@link TurnEventStore.listRunning} can find this turn after a reload. */
     scopeId?: string;
     /** How often to renew the running-turn lease while a producer is alive.
-     *  Default {@link DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS}. */
+     *  The timer is backed up by event-driven renewal when a runtime freezes
+     *  unreferenced timers during remote I/O. Default
+     *  {@link DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS}. */
     runningTurnRenewIntervalMs?: number;
 }
 /** A push-driven buffer for a turn whose producer the caller does NOT own. */

package/dist/turn-stream/index.d.ts

@@ -1,5 +1,5 @@
 import { R as ReconcileStaleTurnLockOptions } from '../stale-turn-lock-DucQzvXu.js';
-import { T as TurnEventStore } from '../turn-buffer-CFKQlnxf.js';
+import { T as TurnEventStore } from '../turn-buffer-COMQUwO2.js';
 
 /**
  * `/turn-stream` core — the pure, substrate-free half of the shared durable

package/dist/turn-stream/index.js

@@ -3,7 +3,7 @@ import {
 } from "../chunk-CCVWR33L.js";
 import {
   DEFAULT_RUNNING_TURN_LEASE_MS
-} from "../chunk-6VWA26BV.js";
+} from "../chunk-SDEADFHZ.js";
 
 // src/turn-stream/core.ts
 function isTerminalRunEvent(type) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-app",
-  "version": "0.44.52",
+  "version": "0.44.54",
   "packageManager": "pnpm@11.17.0",
   "description": "Build agent applications with typed chat, tools, sandboxes, integrations, billing, and evaluation.",
   "keywords": [

package/dist/chunk-6VWA26BV.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/stream/turn-buffer.ts"],"sourcesContent":["/**\n * Resumable chat turns — the router-path answer to \"streams resume on\n * disconnect\" (issue #27). A turn's loop events are teed into a store as they\n * stream; the turn keeps running under `ctx.waitUntil` when the client drops;\n * a reconnecting client replays the buffered tail by sequence number and\n * keeps following until the turn completes.\n *\n *   POST /chat/stream            → pumpBufferedTurn(...) + live NDJSON\n *   GET  /chat/stream/:turnId    → replayTurnEvents({ fromSeq }) → NDJSON\n *\n * Storage is a structural seam ({@link TurnEventStore}); a D1 implementation\n * ships here because that's what Cloudflare products have (KV is unsuitable:\n * eventually consistent cross-isolate). Per-token deltas would mean hundreds\n * of rows per turn, so consecutive text/reasoning deltas are coalesced within\n * a flush window before they are persisted — replay yields slightly chunkier\n * deltas with identical concatenation.\n */\n\nexport type TurnStatus = 'running' | 'complete' | 'error'\n\n/** A running row is a renewable lease, not permanent truth. If the process\n *  driving a turn dies before writing a terminal status, reconnect discovery\n *  must eventually stop returning that abandoned row. */\nexport const DEFAULT_RUNNING_TURN_LEASE_MS = 5 * 60_000\n\n/** Keep a healthy turn's lease comfortably ahead of expiry without turning\n *  per-token streaming into status-write traffic. */\nexport const DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS = 30_000\n\n/** Represent a buffered turn event with a sequence number and serialized event data */\nexport interface BufferedTurnEvent {\n  seq: number\n  /** The serialized event line (JSON string, no trailing newline). */\n  event: string\n}\n\n/** Manage and query turn events and their lifecycle statuses within a scoped event store */\nexport interface TurnEventStore {\n  append(turnId: string, events: BufferedTurnEvent[]): Promise<void>\n  read(turnId: string, fromSeq: number): Promise<BufferedTurnEvent[]>\n  /** Record turn lifecycle. `scopeId` (a thread/session id) is optional and lets\n   *  {@link TurnEventStore.listRunning} rediscover this turn after a client reload\n   *  loses the turnId; stores that don't track scope ignore it. */\n  setStatus(turnId: string, status: TurnStatus, scopeId?: string): Promise<void>\n  getStatus(turnId: string): Promise<TurnStatus | null>\n  /** Unexpired running turnIds for a scope, newest first — so a reloaded client\n   *  (clientRunId lost) can find and resume the in-flight turn without reviving\n   *  a row abandoned by a dead process. Optional: a store records it only if\n   *  `setStatus` was given a `scopeId`. */\n  listRunning?(scopeId: string): Promise<string[]>\n}\n\n/** Configure running-turn lease evaluation. The clock is injectable so store\n *  contract tests do not sleep. Keep the default in production unless a\n *  deployment also tunes the buffer's renewal interval. */\nexport interface TurnEventStoreOptions {\n  runningTurnLeaseMs?: number\n  now?: () => number\n}\n\n// ── coalescing ────────────────────────────────────────────────────────────\n\ntype AnyRecord = Record<string, unknown>\n\nfunction deltaTypeOf(ev: unknown): 'text' | 'reasoning' | null {\n  const e = ev as AnyRecord | null\n  if (!e || typeof e !== 'object') return null\n  const inner = (e.kind === 'event' ? (e.event as AnyRecord | undefined) : e) as AnyRecord | undefined\n  if (!inner || typeof inner !== 'object') return null\n  if ((inner.type === 'text' || inner.type === 'reasoning') && typeof inner.text === 'string') {\n    return inner.type\n  }\n  return null\n}\n\n/** Merge consecutive text/reasoning deltas of the same type into one event.\n *  Concatenation-preserving: replaying the coalesced stream produces the same\n *  accumulated text as the original. */\nexport function coalesceDeltas(events: unknown[]): unknown[] {\n  const out: unknown[] = []\n  for (const ev of events) {\n    const type = deltaTypeOf(ev)\n    const prev = out[out.length - 1]\n    if (type && prev && deltaTypeOf(prev) === type) {\n      const read = (x: unknown): AnyRecord =>\n        ((x as AnyRecord).kind === 'event' ? (x as AnyRecord).event : x) as AnyRecord\n      const merged = JSON.parse(JSON.stringify(prev)) as AnyRecord\n      read(merged).text = String(read(prev).text) + String(read(ev).text)\n      out[out.length - 1] = merged\n      continue\n    }\n    out.push(ev)\n  }\n  return out\n}\n\nfunction asPartUpdate(ev: unknown): { partId: unknown; delta: unknown } | null {\n  const e = ev as AnyRecord | null\n  if (!e || typeof e !== 'object' || e.type !== 'message.part.updated') return null\n  const data = e.data as AnyRecord | undefined\n  if (!data || typeof data !== 'object') return null\n  const part = data.part as AnyRecord | undefined\n  const partId = part?.id ?? data.partId ?? part?.partId ?? null\n  return { partId, delta: data.delta }\n}\n\n/**\n * Coalesce consecutive `message.part.updated` deltas for the SAME part into one\n * event. agent-runtime products stream `ChatStreamEvent` NDJSON\n * (`{type:'message.part.updated', data:{part, delta}}`); pumped through the\n * buffer with the default tool-loop coalescer, every per-token delta persists as\n * its own row because that coalescer never recognizes the shape. Pass this as\n * {@link PumpBufferedTurnOptions.coalesce} instead.\n *\n * Concatenation-preserving for BOTH consumer styles: the merged event keeps the\n * LATEST event's `data.part` (already the cumulative accumulation) and sets\n * `data.delta` to the concatenation of the merged deltas, so a client that\n * appends `delta` and one that reads the cumulative `part` both reconstruct the\n * identical final text.\n */\nexport function coalesceChatStreamEvents(events: unknown[]): unknown[] {\n  const out: unknown[] = []\n  for (const ev of events) {\n    const cur = asPartUpdate(ev)\n    const prevEv = out[out.length - 1]\n    const prev = prevEv ? asPartUpdate(prevEv) : null\n    if (cur && prev && cur.partId != null && cur.partId === prev.partId) {\n      // Base the merged row on the latest event (its `part` is the most complete\n      // accumulation); carry forward the summed delta.\n      const merged = JSON.parse(JSON.stringify(ev)) as AnyRecord\n      ;(merged.data as AnyRecord).delta = String(prev.delta ?? '') + String(cur.delta ?? '')\n      out[out.length - 1] = merged\n      continue\n    }\n    out.push(ev)\n  }\n  return out\n}\n\n// ── buffering core (the tap) ────────────────────────────────────────────────\n\n/** Define options for buffering and flushing turn events with optional live client delivery and event coalescing */\nexport interface BufferedTurnOptions {\n  store: TurnEventStore\n  turnId: string\n  /** Deliver one serialized line to the live client. Throwing here (client\n   *  disconnected) does NOT stop buffering — events keep persisting. */\n  write?: (line: string) => Promise<void> | void\n  /** Flush buffered events to the store at most this often. Default 400ms. */\n  flushIntervalMs?: number\n  /** Per-flush coalescer. Default {@link coalesceDeltas} (tool-loop text/reasoning\n   *  deltas). agent-runtime products streaming `ChatStreamEvent` pass\n   *  {@link coalesceChatStreamEvents} so per-token deltas don't each persist as a\n   *  row. Must be concatenation-preserving. */\n  coalesce?: (events: unknown[]) => unknown[]\n  /** Optional scope (thread/session id) recorded with the turn status, so\n   *  {@link TurnEventStore.listRunning} can find this turn after a reload. */\n  scopeId?: string\n  /** How often to renew the running-turn lease while a producer is alive.\n   *  Default {@link DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS}. */\n  runningTurnRenewIntervalMs?: number\n}\n\n/** A push-driven buffer for a turn whose producer the caller does NOT own. */\nexport interface BufferedTurnTap {\n  /** Buffer one event: persist (coalesced, on the flush window) + best-effort\n   *  live-deliver. Wire to a push source's per-event hook (e.g. agent-runtime\n   *  `handleChatTurn`'s `hooks.onEvent`). Marks the turn 'running' on first call. */\n  onEvent(raw: unknown): Promise<void>\n  /** Settle the turn: final flush + set status. Call after the producer resolves\n   *  ('complete') or rejects ('error'). 'error' flushes what was produced first. */\n  done(status?: Extract<TurnStatus, 'complete' | 'error'>): Promise<void>\n}\n\n/**\n * The buffering core. Sequence-numbers every event, delivers it to `write`\n * (best-effort — a disconnected client never stops buffering), and flushes to\n * the store in coalesced batches. Drives both transports:\n *\n *   • {@link pumpBufferedTurn}     — when you OWN an `AsyncIterable` producer.\n *   • this tap (`onEvent`/`done`)  — when the producer owns iteration and only\n *     hands you a push callback (agent-runtime `handleChatTurn`'s `hooks.onEvent`\n *     + the finished body). Durability stays here in the shell; the engine needs\n *     no `TurnEventStore` seam.\n */\nexport function createBufferedTurnTap(opts: BufferedTurnOptions): BufferedTurnTap {\n  const flushIntervalMs = opts.flushIntervalMs ?? 400\n  const coalesce = opts.coalesce ?? coalesceDeltas\n  const startedAt = Date.now()\n  let seq = 0\n  let clientGone = false\n  let pending: unknown[] = []\n  let lastFlush = Date.now()\n  let started = false\n  let settled = false\n  let renewalTimer: ReturnType<typeof setTimeout> | undefined\n  let renewal: Promise<void> = Promise.resolve()\n\n  function clearRenewalTimer(): void {\n    if (renewalTimer !== undefined) clearTimeout(renewalTimer)\n    renewalTimer = undefined\n  }\n\n  function scheduleRenewal(): void {\n    if (settled || !opts.scopeId) return\n    const intervalMs = Math.max(\n      1,\n      opts.runningTurnRenewIntervalMs ?? DEFAULT_RUNNING_TURN_RENEW_INTERVAL_MS,\n    )\n    renewalTimer = setTimeout(() => {\n      renewalTimer = undefined\n      if (settled) return\n      renewal = opts.store\n        .setStatus(opts.turnId, 'running', opts.scopeId)\n        .catch(() => {})\n        .then(scheduleRenewal)\n    }, intervalMs)\n    // A deliberately abandoned tap in a Node test must not keep the process\n    // alive until the production renewal interval elapses.\n    if (typeof renewalTimer === 'object' && 'unref' in renewalTimer) {\n      renewalTimer.unref()\n    }\n  }\n\n  async function flush(): Promise<void> {\n    if (pending.length === 0) return\n    const batch = coalesce(pending)\n    pending = []\n    const rows = batch.map((ev) => ({ seq: ++seq, event: JSON.stringify(ev) }))\n    await opts.store.append(opts.turnId, rows)\n    lastFlush = Date.now()\n  }\n\n  async function ensureStarted(): Promise<void> {\n    if (started) return\n    started = true\n    await opts.store.setStatus(opts.turnId, 'running', opts.scopeId)\n    scheduleRenewal()\n  }\n\n  return {\n    async onEvent(raw) {\n      await ensureStarted()\n      // Stamp ms-since-turn-start so any stored turn is replayable AND traceable\n      // (see ../trace) from the same buffered rows.\n      const ev = raw && typeof raw === 'object' ? { ...(raw as Record<string, unknown>), _t: Date.now() - startedAt } : raw\n      pending.push(ev)\n      if (!clientGone && opts.write) {\n        try {\n          // Live delivery carries a provisional ordering hint, not the persisted\n          // seq (coalescing changes seq assignment); clients resume with the\n          // seqs from replay, or 0 for \"everything\".\n          await opts.write(JSON.stringify(ev))\n        } catch {\n          clientGone = true\n        }\n      }\n      if (Date.now() - lastFlush >= flushIntervalMs) await flush()\n    },\n    async done(status = 'complete') {\n      await ensureStarted()\n      settled = true\n      clearRenewalTimer()\n      await renewal\n      if (status === 'error') {\n        await flush().catch(() => {})\n        await opts.store.setStatus(opts.turnId, 'error', opts.scopeId).catch(() => {})\n        return\n      }\n      await flush()\n      await opts.store.setStatus(opts.turnId, 'complete', opts.scopeId)\n    },\n  }\n}\n\n// ── pump (producer side) ──────────────────────────────────────────────────\n\n/** Define options to pump data from an asynchronous iterable source with buffered turn control */\nexport interface PumpBufferedTurnOptions extends BufferedTurnOptions {\n  source: AsyncIterable<unknown>\n}\n\n/**\n * Drive a turn to completion regardless of the live client, when you OWN the\n * producer as an `AsyncIterable`. A thin driver over {@link createBufferedTurnTap}.\n * Returns a promise that resolves when the turn finishes — hand it to\n * `ctx.waitUntil` so a disconnect can't kill the turn. Never rejects on\n * client-write failure; a source error marks the turn 'error' (after flushing\n * what was produced) and rethrows.\n */\nexport async function pumpBufferedTurn(opts: PumpBufferedTurnOptions): Promise<void> {\n  const tap = createBufferedTurnTap(opts)\n  try {\n    for await (const raw of opts.source) await tap.onEvent(raw)\n    await tap.done('complete')\n  } catch (err) {\n    await tap.done('error')\n    throw err\n  }\n}\n\n// ── replay (consumer side) ────────────────────────────────────────────────\n\n/** Define options for replaying turn events with control over sequence, polling, and timeout */\nexport interface ReplayTurnEventsOptions {\n  store: TurnEventStore\n  turnId: string\n  /** Replay strictly after this sequence number (0 = from the beginning). */\n  fromSeq?: number\n  /** Poll cadence while the turn is still running. Default 500ms. */\n  pollMs?: number\n  /** Give up following a 'running' turn after this long. Default 120s. */\n  timeoutMs?: number\n}\n\n/**\n * Yield buffered events after `fromSeq`, then keep polling while the turn is\n * still 'running' until it completes, errors, or times out. Terminates with a\n * final `{seq: -1, event: '{\"type\":\"turn_status\",...}'}` marker so clients\n * know why the replay ended.\n */\nexport async function* replayTurnEvents(opts: ReplayTurnEventsOptions): AsyncGenerator<BufferedTurnEvent> {\n  const pollMs = opts.pollMs ?? 500\n  const timeoutMs = opts.timeoutMs ?? 120_000\n  let cursor = opts.fromSeq ?? 0\n  const deadline = Date.now() + timeoutMs\n\n  for (;;) {\n    const batch = await opts.store.read(opts.turnId, cursor)\n    for (const row of batch) {\n      cursor = Math.max(cursor, row.seq)\n      yield row\n    }\n    const status = await opts.store.getStatus(opts.turnId)\n    if (status !== 'running') {\n      yield { seq: -1, event: JSON.stringify({ type: 'turn_status', status: status ?? 'unknown' }) }\n      return\n    }\n    if (Date.now() >= deadline) {\n      yield { seq: -1, event: JSON.stringify({ type: 'turn_status', status: 'timeout' }) }\n      return\n    }\n    await new Promise((r) => setTimeout(r, pollMs))\n  }\n}\n\n/**\n * Serialize a replayed row for the wire, stamping the buffer ordinal ONTO the\n * line so a reconnecting client can continue from `?fromSeq=<lastSeq>`.\n *\n * The seq lives on the {@link BufferedTurnEvent} row wrapper, not inside the\n * serialized event — `flush()` builds `{seq: ++seq, event: JSON.stringify(ev)}`.\n * A route that enqueues `row.event` alone therefore emits lines with no seq at\n * all, and every client cursor silently pins to 0: each reconnect refetches the\n * whole turn and re-applies every delta onto already-rendered state. This\n * restores the contract `web-react/chat-stream` already documents (\"replayed\n * lines carry an extra `seq` — transparently ignored\").\n *\n * The `{seq: -1}` `turn_status` sentinel is passed through unstamped: it is a\n * terminator, not a cursor position, and stamping it would move a client's\n * cursor to -1.\n *\n * Fail-soft by construction — a line that is not a JSON object passes through\n * verbatim. A stamping bug must degrade to today's behaviour, never break a\n * replay.\n */\nexport function stampReplaySeq(row: BufferedTurnEvent): string {\n  if (row.seq <= 0) return row.event\n  const line = row.event\n  // Cheap splice instead of parse+stringify: these rows are already canonical\n  // JSON objects from `JSON.stringify`, and replay is a hot per-event path.\n  if (line.charCodeAt(0) !== 0x7b /* { */) return line\n  const rest = line.slice(1)\n  return rest.trimStart().startsWith('}')\n    ? `{\"seq\":${row.seq}${rest}`\n    : `{\"seq\":${row.seq},${rest}`\n}\n\n// ── D1 store ──────────────────────────────────────────────────────────────\n\n/** Minimal structural D1 contract (Cloudflare `D1Database` satisfies it). */\nexport interface D1LikeForTurns {\n  prepare(sql: string): {\n    bind(...values: unknown[]): {\n      run(): Promise<unknown>\n      all<T = Record<string, unknown>>(): Promise<{ results: T[] }>\n      first<T = Record<string, unknown>>(): Promise<T | null>\n    }\n  }\n}\n\n/** Schema for the D1 store — append to the product's migrations. */\nexport const TURN_EVENTS_MIGRATION_SQL = `\nCREATE TABLE IF NOT EXISTS turn_events (\n  turnId TEXT NOT NULL,\n  seq INTEGER NOT NULL,\n  event TEXT NOT NULL,\n  PRIMARY KEY (turnId, seq)\n);\nCREATE TABLE IF NOT EXISTS turn_status (\n  turnId TEXT PRIMARY KEY,\n  status TEXT NOT NULL,\n  scopeId TEXT,\n  updatedAt TEXT NOT NULL\n);\nCREATE INDEX IF NOT EXISTS idx_turn_status_scope ON turn_status (scopeId, status);\n`\n\n/** For deployments whose `turn_status` table predates `scopeId`/`listRunning` —\n *  run once to add the column (the CREATE above already includes it for new\n *  deployments). SQLite ignores a duplicate-add error if already applied. */\nexport const TURN_STATUS_SCOPE_MIGRATION_SQL = `ALTER TABLE turn_status ADD COLUMN scopeId TEXT;`\n\n/** Resolve a TurnEventStore that appends and reads turn events using a D1-like database interface */\nexport function createD1TurnEventStore(\n  db: D1LikeForTurns,\n  options: TurnEventStoreOptions = {},\n): TurnEventStore {\n  const now = options.now ?? Date.now\n  const runningTurnLeaseMs = Math.max(\n    1,\n    options.runningTurnLeaseMs ?? DEFAULT_RUNNING_TURN_LEASE_MS,\n  )\n  return {\n    async append(turnId, events) {\n      if (!events.length) return\n      // One multi-row insert per flush window keeps write volume bounded.\n      const placeholders = events.map(() => '(?, ?, ?)').join(', ')\n      const values = events.flatMap((e) => [turnId, e.seq, e.event])\n      await db.prepare(`INSERT OR IGNORE INTO turn_events (turnId, seq, event) VALUES ${placeholders}`).bind(...values).run()\n    },\n    async read(turnId, fromSeq) {\n      const { results } = await db\n        .prepare('SELECT seq, event FROM turn_events WHERE turnId = ? AND seq > ? ORDER BY seq ASC')\n        .bind(turnId, fromSeq)\n        .all<{ seq: number; event: string }>()\n      return results\n    },\n    async setStatus(turnId, status, scopeId) {\n      // COALESCE preserves a scopeId set on the initial 'running' write when a\n      // later 'complete'/'error' write passes none.\n      await db\n        .prepare(\n          'INSERT INTO turn_status (turnId, status, scopeId, updatedAt) VALUES (?, ?, ?, ?) ON CONFLICT(turnId) DO UPDATE SET status = excluded.status, scopeId = COALESCE(excluded.scopeId, turn_status.scopeId), updatedAt = excluded.updatedAt',\n        )\n        .bind(turnId, status, scopeId ?? null, new Date(now()).toISOString())\n        .run()\n    },\n    async getStatus(turnId) {\n      const row = await db.prepare('SELECT status FROM turn_status WHERE turnId = ?').bind(turnId).first<{ status: TurnStatus }>()\n      return row?.status ?? null\n    },\n    async listRunning(scopeId) {\n      const { results } = await db\n        .prepare(\n          \"SELECT turnId FROM turn_status WHERE scopeId = ? AND status = 'running' AND updatedAt >= ? ORDER BY updatedAt DESC, rowid DESC\",\n        )\n        .bind(scopeId, new Date(now() - runningTurnLeaseMs).toISOString())\n        .all<{ turnId: string }>()\n      return results.map((r) => r.turnId)\n    },\n  }\n}\n\n/** In-memory store for tests and keyless local dev. */\nexport function createMemoryTurnEventStore(\n  options: TurnEventStoreOptions = {},\n): TurnEventStore {\n  const events = new Map<string, BufferedTurnEvent[]>()\n  const status = new Map<string, TurnStatus>()\n  const scopes = new Map<string, string>()\n  const order: string[] = []\n  const updatedAt = new Map<string, number>()\n  const now = options.now ?? Date.now\n  const runningTurnLeaseMs = Math.max(\n    1,\n    options.runningTurnLeaseMs ?? DEFAULT_RUNNING_TURN_LEASE_MS,\n  )\n  return {\n    async append(turnId, rows) {\n      const list = events.get(turnId) ?? []\n      list.push(...rows)\n      events.set(turnId, list)\n    },\n    async read(turnId, fromSeq) {\n      return (events.get(turnId) ?? []).filter((e) => e.seq > fromSeq)\n    },\n    async setStatus(turnId, s, scopeId) {\n      status.set(turnId, s)\n      if (scopeId) scopes.set(turnId, scopeId)\n      if (!order.includes(turnId)) order.push(turnId)\n      updatedAt.set(turnId, now())\n    },\n    async getStatus(turnId) {\n      return status.get(turnId) ?? null\n    },\n    async listRunning(scopeId) {\n      const cutoff = now() - runningTurnLeaseMs\n      return order\n        .filter(\n          (turnId) =>\n            status.get(turnId) === 'running' &&\n            scopes.get(turnId) === scopeId &&\n            (updatedAt.get(turnId) ?? Number.NEGATIVE_INFINITY) >= cutoff,\n        )\n        .sort((left, right) => {\n          const updatedDelta = (updatedAt.get(right) ?? 0) - (updatedAt.get(left) ?? 0)\n          return updatedDelta || order.indexOf(right) - order.indexOf(left)\n        })\n    },\n  }\n}\n"],"mappings":";AAuBO,IAAM,gCAAgC,IAAI;AAI1C,IAAM,yCAAyC;AAqCtD,SAAS,YAAY,IAA0C;AAC7D,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,OAAO,MAAM,SAAU,QAAO;AACxC,QAAM,QAAS,EAAE,SAAS,UAAW,EAAE,QAAkC;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,OAAK,MAAM,SAAS,UAAU,MAAM,SAAS,gBAAgB,OAAO,MAAM,SAAS,UAAU;AAC3F,WAAO,MAAM;AAAA,EACf;AACA,SAAO;AACT;AAKO,SAAS,eAAe,QAA8B;AAC3D,QAAM,MAAiB,CAAC;AACxB,aAAW,MAAM,QAAQ;AACvB,UAAM,OAAO,YAAY,EAAE;AAC3B,UAAM,OAAO,IAAI,IAAI,SAAS,CAAC;AAC/B,QAAI,QAAQ,QAAQ,YAAY,IAAI,MAAM,MAAM;AAC9C,YAAM,OAAO,CAAC,MACV,EAAgB,SAAS,UAAW,EAAgB,QAAQ;AAChE,YAAM,SAAS,KAAK,MAAM,KAAK,UAAU,IAAI,CAAC;AAC9C,WAAK,MAAM,EAAE,OAAO,OAAO,KAAK,IAAI,EAAE,IAAI,IAAI,OAAO,KAAK,EAAE,EAAE,IAAI;AAClE,UAAI,IAAI,SAAS,CAAC,IAAI;AACtB;AAAA,IACF;AACA,QAAI,KAAK,EAAE;AAAA,EACb;AACA,SAAO;AACT;AAEA,SAAS,aAAa,IAAyD;AAC7E,QAAM,IAAI;AACV,MAAI,CAAC,KAAK,OAAO,MAAM,YAAY,EAAE,SAAS,uBAAwB,QAAO;AAC7E,QAAM,OAAO,EAAE;AACf,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,OAAO,KAAK;AAClB,QAAM,SAAS,MAAM,MAAM,KAAK,UAAU,MAAM,UAAU;AAC1D,SAAO,EAAE,QAAQ,OAAO,KAAK,MAAM;AACrC;AAgBO,SAAS,yBAAyB,QAA8B;AACrE,QAAM,MAAiB,CAAC;AACxB,aAAW,MAAM,QAAQ;AACvB,UAAM,MAAM,aAAa,EAAE;AAC3B,UAAM,SAAS,IAAI,IAAI,SAAS,CAAC;AACjC,UAAM,OAAO,SAAS,aAAa,MAAM,IAAI;AAC7C,QAAI,OAAO,QAAQ,IAAI,UAAU,QAAQ,IAAI,WAAW,KAAK,QAAQ;AAGnE,YAAM,SAAS,KAAK,MAAM,KAAK,UAAU,EAAE,CAAC;AAC3C,MAAC,OAAO,KAAmB,QAAQ,OAAO,KAAK,SAAS,EAAE,IAAI,OAAO,IAAI,SAAS,EAAE;AACrF,UAAI,IAAI,SAAS,CAAC,IAAI;AACtB;AAAA,IACF;AACA,QAAI,KAAK,EAAE;AAAA,EACb;AACA,SAAO;AACT;AAgDO,SAAS,sBAAsB,MAA4C;AAChF,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,YAAY,KAAK,IAAI;AAC3B,MAAI,MAAM;AACV,MAAI,aAAa;AACjB,MAAI,UAAqB,CAAC;AAC1B,MAAI,YAAY,KAAK,IAAI;AACzB,MAAI,UAAU;AACd,MAAI,UAAU;AACd,MAAI;AACJ,MAAI,UAAyB,QAAQ,QAAQ;AAE7C,WAAS,oBAA0B;AACjC,QAAI,iBAAiB,OAAW,cAAa,YAAY;AACzD,mBAAe;AAAA,EACjB;AAEA,WAAS,kBAAwB;AAC/B,QAAI,WAAW,CAAC,KAAK,QAAS;AAC9B,UAAM,aAAa,KAAK;AAAA,MACtB;AAAA,MACA,KAAK,8BAA8B;AAAA,IACrC;AACA,mBAAe,WAAW,MAAM;AAC9B,qBAAe;AACf,UAAI,QAAS;AACb,gBAAU,KAAK,MACZ,UAAU,KAAK,QAAQ,WAAW,KAAK,OAAO,EAC9C,MAAM,MAAM;AAAA,MAAC,CAAC,EACd,KAAK,eAAe;AAAA,IACzB,GAAG,UAAU;AAGb,QAAI,OAAO,iBAAiB,YAAY,WAAW,cAAc;AAC/D,mBAAa,MAAM;AAAA,IACrB;AAAA,EACF;AAEA,iBAAe,QAAuB;AACpC,QAAI,QAAQ,WAAW,EAAG;AAC1B,UAAM,QAAQ,SAAS,OAAO;AAC9B,cAAU,CAAC;AACX,UAAM,OAAO,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,UAAU,EAAE,EAAE,EAAE;AAC1E,UAAM,KAAK,MAAM,OAAO,KAAK,QAAQ,IAAI;AACzC,gBAAY,KAAK,IAAI;AAAA,EACvB;AAEA,iBAAe,gBAA+B;AAC5C,QAAI,QAAS;AACb,cAAU;AACV,UAAM,KAAK,MAAM,UAAU,KAAK,QAAQ,WAAW,KAAK,OAAO;AAC/D,oBAAgB;AAAA,EAClB;AAEA,SAAO;AAAA,IACL,MAAM,QAAQ,KAAK;AACjB,YAAM,cAAc;AAGpB,YAAM,KAAK,OAAO,OAAO,QAAQ,WAAW,EAAE,GAAI,KAAiC,IAAI,KAAK,IAAI,IAAI,UAAU,IAAI;AAClH,cAAQ,KAAK,EAAE;AACf,UAAI,CAAC,cAAc,KAAK,OAAO;AAC7B,YAAI;AAIF,gBAAM,KAAK,MAAM,KAAK,UAAU,EAAE,CAAC;AAAA,QACrC,QAAQ;AACN,uBAAa;AAAA,QACf;AAAA,MACF;AACA,UAAI,KAAK,IAAI,IAAI,aAAa,gBAAiB,OAAM,MAAM;AAAA,IAC7D;AAAA,IACA,MAAM,KAAK,SAAS,YAAY;AAC9B,YAAM,cAAc;AACpB,gBAAU;AACV,wBAAkB;AAClB,YAAM;AACN,UAAI,WAAW,SAAS;AACtB,cAAM,MAAM,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC5B,cAAM,KAAK,MAAM,UAAU,KAAK,QAAQ,SAAS,KAAK,OAAO,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC7E;AAAA,MACF;AACA,YAAM,MAAM;AACZ,YAAM,KAAK,MAAM,UAAU,KAAK,QAAQ,YAAY,KAAK,OAAO;AAAA,IAClE;AAAA,EACF;AACF;AAiBA,eAAsB,iBAAiB,MAA8C;AACnF,QAAM,MAAM,sBAAsB,IAAI;AACtC,MAAI;AACF,qBAAiB,OAAO,KAAK,OAAQ,OAAM,IAAI,QAAQ,GAAG;AAC1D,UAAM,IAAI,KAAK,UAAU;AAAA,EAC3B,SAAS,KAAK;AACZ,UAAM,IAAI,KAAK,OAAO;AACtB,UAAM;AAAA,EACR;AACF;AAsBA,gBAAuB,iBAAiB,MAAkE;AACxG,QAAM,SAAS,KAAK,UAAU;AAC9B,QAAM,YAAY,KAAK,aAAa;AACpC,MAAI,SAAS,KAAK,WAAW;AAC7B,QAAM,WAAW,KAAK,IAAI,IAAI;AAE9B,aAAS;AACP,UAAM,QAAQ,MAAM,KAAK,MAAM,KAAK,KAAK,QAAQ,MAAM;AACvD,eAAW,OAAO,OAAO;AACvB,eAAS,KAAK,IAAI,QAAQ,IAAI,GAAG;AACjC,YAAM;AAAA,IACR;AACA,UAAM,SAAS,MAAM,KAAK,MAAM,UAAU,KAAK,MAAM;AACrD,QAAI,WAAW,WAAW;AACxB,YAAM,EAAE,KAAK,IAAI,OAAO,KAAK,UAAU,EAAE,MAAM,eAAe,QAAQ,UAAU,UAAU,CAAC,EAAE;AAC7F;AAAA,IACF;AACA,QAAI,KAAK,IAAI,KAAK,UAAU;AAC1B,YAAM,EAAE,KAAK,IAAI,OAAO,KAAK,UAAU,EAAE,MAAM,eAAe,QAAQ,UAAU,CAAC,EAAE;AACnF;AAAA,IACF;AACA,UAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAAA,EAChD;AACF;AAsBO,SAAS,eAAe,KAAgC;AAC7D,MAAI,IAAI,OAAO,EAAG,QAAO,IAAI;AAC7B,QAAM,OAAO,IAAI;AAGjB,MAAI,KAAK,WAAW,CAAC,MAAM,IAAc,QAAO;AAChD,QAAM,OAAO,KAAK,MAAM,CAAC;AACzB,SAAO,KAAK,UAAU,EAAE,WAAW,GAAG,IAClC,UAAU,IAAI,GAAG,GAAG,IAAI,KACxB,UAAU,IAAI,GAAG,IAAI,IAAI;AAC/B;AAgBO,IAAM,4BAA4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAmBlC,IAAM,kCAAkC;AAGxC,SAAS,uBACd,IACA,UAAiC,CAAC,GAClB;AAChB,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,qBAAqB,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ,sBAAsB;AAAA,EAChC;AACA,SAAO;AAAA,IACL,MAAM,OAAO,QAAQ,QAAQ;AAC3B,UAAI,CAAC,OAAO,OAAQ;AAEpB,YAAM,eAAe,OAAO,IAAI,MAAM,WAAW,EAAE,KAAK,IAAI;AAC5D,YAAM,SAAS,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;AAC7D,YAAM,GAAG,QAAQ,iEAAiE,YAAY,EAAE,EAAE,KAAK,GAAG,MAAM,EAAE,IAAI;AAAA,IACxH;AAAA,IACA,MAAM,KAAK,QAAQ,SAAS;AAC1B,YAAM,EAAE,QAAQ,IAAI,MAAM,GACvB,QAAQ,kFAAkF,EAC1F,KAAK,QAAQ,OAAO,EACpB,IAAoC;AACvC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,UAAU,QAAQ,QAAQ,SAAS;AAGvC,YAAM,GACH;AAAA,QACC;AAAA,MACF,EACC,KAAK,QAAQ,QAAQ,WAAW,MAAM,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY,CAAC,EACnE,IAAI;AAAA,IACT;AAAA,IACA,MAAM,UAAU,QAAQ;AACtB,YAAM,MAAM,MAAM,GAAG,QAAQ,iDAAiD,EAAE,KAAK,MAAM,EAAE,MAA8B;AAC3H,aAAO,KAAK,UAAU;AAAA,IACxB;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,EAAE,QAAQ,IAAI,MAAM,GACvB;AAAA,QACC;AAAA,MACF,EACC,KAAK,SAAS,IAAI,KAAK,IAAI,IAAI,kBAAkB,EAAE,YAAY,CAAC,EAChE,IAAwB;AAC3B,aAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,MAAM;AAAA,IACpC;AAAA,EACF;AACF;AAGO,SAAS,2BACd,UAAiC,CAAC,GAClB;AAChB,QAAM,SAAS,oBAAI,IAAiC;AACpD,QAAM,SAAS,oBAAI,IAAwB;AAC3C,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,QAAkB,CAAC;AACzB,QAAM,YAAY,oBAAI,IAAoB;AAC1C,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,qBAAqB,KAAK;AAAA,IAC9B;AAAA,IACA,QAAQ,sBAAsB;AAAA,EAChC;AACA,SAAO;AAAA,IACL,MAAM,OAAO,QAAQ,MAAM;AACzB,YAAM,OAAO,OAAO,IAAI,MAAM,KAAK,CAAC;AACpC,WAAK,KAAK,GAAG,IAAI;AACjB,aAAO,IAAI,QAAQ,IAAI;AAAA,IACzB;AAAA,IACA,MAAM,KAAK,QAAQ,SAAS;AAC1B,cAAQ,OAAO,IAAI,MAAM,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,OAAO;AAAA,IACjE;AAAA,IACA,MAAM,UAAU,QAAQ,GAAG,SAAS;AAClC,aAAO,IAAI,QAAQ,CAAC;AACpB,UAAI,QAAS,QAAO,IAAI,QAAQ,OAAO;AACvC,UAAI,CAAC,MAAM,SAAS,MAAM,EAAG,OAAM,KAAK,MAAM;AAC9C,gBAAU,IAAI,QAAQ,IAAI,CAAC;AAAA,IAC7B;AAAA,IACA,MAAM,UAAU,QAAQ;AACtB,aAAO,OAAO,IAAI,MAAM,KAAK;AAAA,IAC/B;AAAA,IACA,MAAM,YAAY,SAAS;AACzB,YAAM,SAAS,IAAI,IAAI;AACvB,aAAO,MACJ;AAAA,QACC,CAAC,WACC,OAAO,IAAI,MAAM,MAAM,aACvB,OAAO,IAAI,MAAM,MAAM,YACtB,UAAU,IAAI,MAAM,KAAK,OAAO,sBAAsB;AAAA,MAC3D,EACC,KAAK,CAAC,MAAM,UAAU;AACrB,cAAM,gBAAgB,UAAU,IAAI,KAAK,KAAK,MAAM,UAAU,IAAI,IAAI,KAAK;AAC3E,eAAO,gBAAgB,MAAM,QAAQ,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MAClE,CAAC;AAAA,IACL;AAAA,EACF;AACF;","names":[]}