@tangle-network/agent-runtime 0.49.0 → 0.51.0

package/dist/platform.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/platform/auth.ts","../src/platform/integrations.ts"],"sourcesContent":["/**\n * Server-side client for the Tangle platform's cross-site SSO bridge.\n *\n * Consumer apps (gtm-agent, tax-agent, legal-agent, creative-agent, …)\n * use this to:\n *   1. Build an /authorize URL that lands the user on id.tangle.tools\n *      and brings them back with a single-use code.\n *   2. Exchange that code for an API key + the user's identity.\n *\n * The platform endpoint contract is documented in\n * `products/platform/api/src/routes/cross-site.ts`. This client only\n * speaks HTTP — no SDK weight, no transitive deps.\n */\n\nexport interface PlatformAuthClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** App id as registered in the platform's TRUSTED_APPS registry. */\n  appId: string\n  /** Override the global fetch (useful for tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface AuthorizeUrlOptions {\n  /** Required CSRF token; the consumer verifies it on the callback. */\n  state: string\n  /**\n   * Final redirect URI. Must be one of the URIs registered for `appId`\n   * on the platform. Omit to use the first registered URI.\n   */\n  redirectUri?: string\n  /** Force the login screen even if a session is already active. */\n  prompt?: 'login'\n  /** Pre-fill the email field on the login screen. */\n  email?: string\n}\n\nexport interface ExchangeCodeResult {\n  apiKey: string\n  user: {\n    id: string\n    email: string\n    name?: string\n  }\n  plan: {\n    tier: string\n  }\n}\n\nexport class PlatformAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformAuthError'\n  }\n}\n\nexport class PlatformAuthClient {\n  private readonly baseUrl: string\n  private readonly appId: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformAuthClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformAuthClient: baseUrl is required')\n    if (!options.appId) throw new Error('PlatformAuthClient: appId is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.appId = options.appId\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /**\n   * Build the URL the user is redirected to in order to start SSO.\n   * The platform redirects back to one of `appId`'s registered\n   * `redirectUris` with `?code=...&app=...&state=...`.\n   */\n  authorizeUrl(options: AuthorizeUrlOptions): string {\n    if (!options.state) {\n      throw new Error('PlatformAuthClient.authorizeUrl: state is required for CSRF')\n    }\n    const url = new URL('/cross-site/authorize', this.baseUrl)\n    url.searchParams.set('app', this.appId)\n    url.searchParams.set('state', options.state)\n    if (options.redirectUri) url.searchParams.set('redirect', options.redirectUri)\n    if (options.prompt) url.searchParams.set('prompt', options.prompt)\n    if (options.email) url.searchParams.set('email', options.email)\n    return url.toString()\n  }\n\n  /**\n   * Exchange a single-use auth code (delivered to the consumer's\n   * callback by the platform) for an API key + the user's identity.\n   * Codes are single-use and expire ~5 minutes after issue.\n   */\n  async exchange(code: string): Promise<ExchangeCodeResult> {\n    if (!code) throw new Error('PlatformAuthClient.exchange: code is required')\n    const res = await this.fetchImpl(`${this.baseUrl}/cross-site/exchange`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ code, app: this.appId }),\n    })\n    const body = await res.json().catch(() => null)\n    if (!res.ok) {\n      const message =\n        body && typeof body === 'object' && 'error' in body && typeof body.error === 'string'\n          ? body.error\n          : `Platform exchange failed (${res.status})`\n      throw new PlatformAuthError(message, res.status, body)\n    }\n    const result = body as Partial<ExchangeCodeResult>\n    if (!result.apiKey || !result.user?.id) {\n      throw new PlatformAuthError(\n        'Platform exchange response is missing apiKey or user',\n        res.status,\n        body,\n      )\n    }\n    return result as ExchangeCodeResult\n  }\n}\n","/**\n * Server-side client for the Tangle platform's integrations hub\n * (`/v1/integrations/*`). Consumer apps use this instead of rolling\n * their own OAuth + connection tables.\n *\n * Auth: the caller supplies a bearer (either the user's API key from\n * cross-site exchange, or a platform service token) on construction.\n * Per-request override via `headers` is supported.\n *\n * Endpoint contract: `products/platform/api/src/routes/integrations.ts`.\n */\n\nexport interface PlatformHubClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** Bearer credential — user API key or service token. */\n  bearer: string\n  /** Override fetch (tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface PlatformConnection {\n  id: string\n  providerId: string\n  connectorId: string\n  status: 'connected' | 'pending' | 'revoked' | 'expired' | string\n  grantedScopes?: string[]\n  account?: { identity?: string; displayName?: string } & Record<string, unknown>\n  metadata?: Record<string, unknown>\n  expiresAt?: string | null\n  createdAt?: string\n  updatedAt?: string\n}\n\nexport interface PlatformCatalogProvider {\n  providerId: string\n  displayName?: string\n  description?: string\n  authMode?: string\n  connectors?: PlatformCatalogConnector[]\n  [k: string]: unknown\n}\n\nexport interface PlatformCatalogConnector {\n  connectorId: string\n  displayName?: string\n  description?: string\n  scopes?: string[]\n  [k: string]: unknown\n}\n\nexport interface StartAuthInput {\n  providerId: string\n  connectorId: string\n  /** Where the platform redirects the user back to after OAuth. */\n  returnUrl: string\n  requestedScopes?: string[]\n  state?: string\n  metadata?: Record<string, unknown>\n  /** Required when the bearer is a service token impersonating a user. */\n  ownerUserId?: string\n}\n\nexport interface StartAuthResult {\n  authorizationUrl: string\n  state: string\n}\n\nexport interface BundleCapabilityInput {\n  manifestId?: string\n  grantIds?: string[]\n  subject: { type: 'user' | 'team' | 'app'; id: string }\n  ttlMs: number\n}\n\nexport interface BundleCapabilityResult {\n  bundle: Record<string, unknown>\n  env: Record<string, string>\n}\n\nexport interface HealthCheck {\n  connectionId: string\n  providerId: string\n  connectorId: string\n  status: 'ok' | 'degraded' | 'failing' | 'unknown' | string\n  checks?: Record<string, unknown>\n  checkedAt?: string\n}\n\nexport class PlatformHubError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string | undefined,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformHubError'\n  }\n}\n\ninterface PlatformEnvelope<T> {\n  success: boolean\n  data?: T\n  error?: { code?: string; message?: string } | string\n}\n\nexport class PlatformHubClient {\n  private readonly baseUrl: string\n  private readonly bearer: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformHubClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformHubClient: baseUrl is required')\n    if (!options.bearer) throw new Error('PlatformHubClient: bearer is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.bearer = options.bearer\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /** List the integration catalog (providers + connectors). */\n  catalog(): Promise<{ providers: PlatformCatalogProvider[] } & Record<string, unknown>> {\n    return this.request('GET', '/v1/integrations/catalog')\n  }\n\n  /** List the calling user's integration connections. */\n  async listConnections(): Promise<PlatformConnection[]> {\n    const data = await this.request<{ connections: PlatformConnection[] }>(\n      'GET',\n      '/v1/integrations/connections',\n    )\n    return data.connections\n  }\n\n  /** Revoke (and disable) a connection by id. */\n  revokeConnection(connectionId: string): Promise<{\n    connection: PlatformConnection\n    revokedGrants: unknown[]\n    providerRevocation: { ok: boolean }\n  }> {\n    return this.request(\n      'DELETE',\n      `/v1/integrations/connections/${encodeURIComponent(connectionId)}`,\n    )\n  }\n\n  /** Begin OAuth — returns the URL to send the user to. */\n  startAuth(input: StartAuthInput): Promise<StartAuthResult> {\n    return this.request('POST', '/v1/integrations/auth/start', input)\n  }\n\n  /** List connection healthchecks (last known state). */\n  async listHealthchecks(): Promise<HealthCheck[]> {\n    const data = await this.request<{ healthchecks: HealthCheck[] }>(\n      'GET',\n      '/v1/integrations/healthchecks',\n    )\n    return data.healthchecks\n  }\n\n  /** Trigger a fresh healthcheck pass. */\n  runHealthchecks(): Promise<{ scheduled: number }> {\n    return this.request('POST', '/v1/integrations/healthchecks/run', {})\n  }\n\n  /**\n   * Mint a sandbox-injectable capability bundle (env vars + scoped\n   * capability tokens) so a sandbox can invoke integrations on the\n   * user's behalf without seeing the underlying provider tokens.\n   */\n  bundleCapabilities(input: BundleCapabilityInput): Promise<BundleCapabilityResult> {\n    return this.request('POST', '/v1/integrations/capabilities/bundle', input)\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'DELETE' | 'PUT',\n    path: string,\n    body?: unknown,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      authorization: `Bearer ${this.bearer}`,\n      accept: 'application/json',\n    }\n    if (body !== undefined) headers['content-type'] = 'application/json'\n\n    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      method,\n      headers,\n      body: body !== undefined ? JSON.stringify(body) : undefined,\n    })\n    const text = await res.text()\n    let parsed: PlatformEnvelope<T> | null = null\n    if (text) {\n      try {\n        parsed = JSON.parse(text)\n      } catch {\n        // fall through to error handling below\n      }\n    }\n    if (!res.ok || (parsed && parsed.success === false)) {\n      const code = parsed?.error && typeof parsed.error === 'object' ? parsed.error.code : undefined\n      const message =\n        (parsed?.error && typeof parsed.error === 'object' && parsed.error.message) ||\n        (typeof parsed?.error === 'string' ? parsed.error : `Platform hub error (${res.status})`)\n      throw new PlatformHubError(message, res.status, code, parsed ?? text)\n    }\n    if (!parsed) {\n      throw new PlatformHubError(\n        `Platform hub returned non-JSON success (${res.status})`,\n        res.status,\n        undefined,\n        text,\n      )\n    }\n    if (parsed.data === undefined) {\n      throw new PlatformHubError(\n        'Platform hub envelope missing `data`',\n        res.status,\n        undefined,\n        parsed,\n      )\n    }\n    return parsed.data\n  }\n}\n"],"mappings":";;;AAiDO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YACE,SACgB,QACA,MAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAKpB;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAoC;AAC9C,QAAI,CAAC,QAAQ,QAAS,OAAM,IAAI,MAAM,yCAAyC;AAC/E,QAAI,CAAC,QAAQ,MAAO,OAAM,IAAI,MAAM,uCAAuC;AAC3E,SAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AACjD,SAAK,QAAQ,QAAQ;AACrB,SAAK,YACH,QAAQ,cACP,CAAC,KAAkC,SAAuC,MAAM,KAAK,IAAI;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,SAAsC;AACjD,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,UAAM,MAAM,IAAI,IAAI,yBAAyB,KAAK,OAAO;AACzD,QAAI,aAAa,IAAI,OAAO,KAAK,KAAK;AACtC,QAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAC3C,QAAI,QAAQ,YAAa,KAAI,aAAa,IAAI,YAAY,QAAQ,WAAW;AAC7E,QAAI,QAAQ,OAAQ,KAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;AACjE,QAAI,QAAQ,MAAO,KAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAC9D,WAAO,IAAI,SAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAS,MAA2C;AACxD,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,+CAA+C;AAC1E,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,OAAO,wBAAwB;AAAA,MACtE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,MAAM,KAAK,KAAK,MAAM,CAAC;AAAA,IAChD,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,UACJ,QAAQ,OAAO,SAAS,YAAY,WAAW,QAAQ,OAAO,KAAK,UAAU,WACzE,KAAK,QACL,6BAA6B,IAAI,MAAM;AAC7C,YAAM,IAAI,kBAAkB,SAAS,IAAI,QAAQ,IAAI;AAAA,IACvD;AACA,UAAM,SAAS;AACf,QAAI,CAAC,OAAO,UAAU,CAAC,OAAO,MAAM,IAAI;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,IAAI;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;AClCO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACgB,QACA,MACA,MAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EANkB;AAAA,EACA;AAAA,EACA;AAKpB;AAQO,IAAM,oBAAN,MAAwB;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAmC;AAC7C,QAAI,CAAC,QAAQ,QAAS,OAAM,IAAI,MAAM,wCAAwC;AAC9E,QAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAC5E,SAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AACjD,SAAK,SAAS,QAAQ;AACtB,SAAK,YACH,QAAQ,cACP,CAAC,KAAkC,SAAuC,MAAM,KAAK,IAAI;AAAA,EAC9F;AAAA;AAAA,EAGA,UAAuF;AACrF,WAAO,KAAK,QAAQ,OAAO,0BAA0B;AAAA,EACvD;AAAA;AAAA,EAGA,MAAM,kBAAiD;AACrD,UAAM,OAAO,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,iBAAiB,cAId;AACD,WAAO,KAAK;AAAA,MACV;AAAA,MACA,gCAAgC,mBAAmB,YAAY,CAAC;AAAA,IAClE;AAAA,EACF;AAAA;AAAA,EAGA,UAAU,OAAiD;AACzD,WAAO,KAAK,QAAQ,QAAQ,+BAA+B,KAAK;AAAA,EAClE;AAAA;AAAA,EAGA,MAAM,mBAA2C;AAC/C,UAAM,OAAO,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,kBAAkD;AAChD,WAAO,KAAK,QAAQ,QAAQ,qCAAqC,CAAC,CAAC;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,mBAAmB,OAA+D;AAChF,WAAO,KAAK,QAAQ,QAAQ,wCAAwC,KAAK;AAAA,EAC3E;AAAA,EAEA,MAAc,QACZ,QACA,MACA,MACY;AACZ,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,IACV;AACA,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAElD,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,OAAO,GAAG,IAAI,IAAI;AAAA,MACzD;AAAA,MACA;AAAA,MACA,MAAM,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI;AAAA,IACpD,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,SAAqC;AACzC,QAAI,MAAM;AACR,UAAI;AACF,iBAAS,KAAK,MAAM,IAAI;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AACA,QAAI,CAAC,IAAI,MAAO,UAAU,OAAO,YAAY,OAAQ;AACnD,YAAM,OAAO,QAAQ,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,OAAO;AACrF,YAAM,UACH,QAAQ,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,YAClE,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ,uBAAuB,IAAI,MAAM;AACvF,YAAM,IAAI,iBAAiB,SAAS,IAAI,QAAQ,MAAM,UAAU,IAAI;AAAA,IACtE;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR,2CAA2C,IAAI,MAAM;AAAA,QACrD,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,SAAS,QAAW;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AACF;","names":[]}
+{"version":3,"sources":["../src/platform/auth.ts","../src/platform/integrations.ts"],"sourcesContent":["/**\n * Server-side client for the Tangle platform's cross-site SSO bridge.\n *\n * Consumer apps (gtm-agent, tax-agent, legal-agent, creative-agent, …)\n * use this to:\n *   1. Build an /authorize URL that lands the user on id.tangle.tools\n *      and brings them back with a single-use code.\n *   2. Exchange that code for an API key + the user's identity.\n *\n * The platform endpoint contract is documented in\n * `products/platform/api/src/routes/cross-site.ts`. This client only\n * speaks HTTP — no SDK weight, no transitive deps.\n */\n\nexport interface PlatformAuthClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** App id as registered in the platform's TRUSTED_APPS registry. */\n  appId: string\n  /** Override the global fetch (useful for tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\nexport interface AuthorizeUrlOptions {\n  /** Required CSRF token; the consumer verifies it on the callback. */\n  state: string\n  /**\n   * Final redirect URI. Must be one of the URIs registered for `appId`\n   * on the platform. Omit to use the first registered URI.\n   */\n  redirectUri?: string\n  /** Force the login screen even if a session is already active. */\n  prompt?: 'login'\n  /** Pre-fill the email field on the login screen. */\n  email?: string\n}\n\nexport interface ExchangeCodeResult {\n  apiKey: string\n  user: {\n    id: string\n    email: string\n    name?: string\n  }\n  plan: {\n    tier: string\n  }\n}\n\nexport class PlatformAuthError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformAuthError'\n  }\n}\n\nexport class PlatformAuthClient {\n  private readonly baseUrl: string\n  private readonly appId: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformAuthClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformAuthClient: baseUrl is required')\n    if (!options.appId) throw new Error('PlatformAuthClient: appId is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.appId = options.appId\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /**\n   * Build the URL the user is redirected to in order to start SSO.\n   * The platform redirects back to one of `appId`'s registered\n   * `redirectUris` with `?code=...&app=...&state=...`.\n   */\n  authorizeUrl(options: AuthorizeUrlOptions): string {\n    if (!options.state) {\n      throw new Error('PlatformAuthClient.authorizeUrl: state is required for CSRF')\n    }\n    const url = new URL('/cross-site/authorize', this.baseUrl)\n    url.searchParams.set('app', this.appId)\n    url.searchParams.set('state', options.state)\n    if (options.redirectUri) url.searchParams.set('redirect', options.redirectUri)\n    if (options.prompt) url.searchParams.set('prompt', options.prompt)\n    if (options.email) url.searchParams.set('email', options.email)\n    return url.toString()\n  }\n\n  /**\n   * Exchange a single-use auth code (delivered to the consumer's\n   * callback by the platform) for an API key + the user's identity.\n   * Codes are single-use and expire ~5 minutes after issue.\n   */\n  async exchange(code: string): Promise<ExchangeCodeResult> {\n    if (!code) throw new Error('PlatformAuthClient.exchange: code is required')\n    const res = await this.fetchImpl(`${this.baseUrl}/cross-site/exchange`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ code, app: this.appId }),\n    })\n    const body = await res.json().catch(() => null)\n    if (!res.ok) {\n      const message =\n        body && typeof body === 'object' && 'error' in body && typeof body.error === 'string'\n          ? body.error\n          : `Platform exchange failed (${res.status})`\n      throw new PlatformAuthError(message, res.status, body)\n    }\n    const result = body as Partial<ExchangeCodeResult>\n    if (!result.apiKey || !result.user?.id) {\n      throw new PlatformAuthError(\n        'Platform exchange response is missing apiKey or user',\n        res.status,\n        body,\n      )\n    }\n    return result as ExchangeCodeResult\n  }\n}\n","/**\n * Server-side client for the Tangle platform's integration hub\n * (`/v1/hub/*`). Consumer apps use this instead of rolling their own\n * OAuth + connection tables.\n *\n * Auth: the caller supplies a bearer (either the user's API key from\n * cross-site exchange, or a platform service token) on construction.\n *\n * Endpoint contract (authoritative): the platform's `src/lib/hub-contract.ts`\n * + `src/routes/hub.ts`. The platform wraps every response in\n * `{ success, data }`; non-2xx or `success:false` surfaces as `PlatformHubError`\n * carrying the real upstream status.\n */\n\nexport interface PlatformHubClientOptions {\n  /** Platform base URL, e.g. `https://id.tangle.tools`. */\n  baseUrl: string\n  /** Bearer credential — user API key or service token. */\n  bearer: string\n  /** Override fetch (tests + edge runtimes). */\n  fetchImpl?: typeof fetch\n}\n\n/** A live integration connection, as returned by `/v1/hub/connections`. */\nexport interface PlatformConnection {\n  id: string\n  providerId: string\n  displayName: string\n  accountDisplay: string | null\n  scopes: string[]\n  status: 'active' | 'revoked' | 'unhealthy' | 'reconnect_required' | (string & {})\n  health: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  createdAt: string\n  updatedAt: string\n  lastUsedAt: string | null\n}\n\n/** A connectable provider in the catalog (`/v1/hub/providers`). */\nexport interface PlatformCatalogProvider {\n  providerId: string\n  title?: string\n  authKind?: string\n  category?: string\n  scopes?: string[]\n  capabilityCount?: number\n  native?: boolean\n  /** Whether the OAuth app's credentials are wired — the UI offers Connect\n   *  only when true. */\n  configured?: boolean\n  [k: string]: unknown\n}\n\nexport interface CatalogResult {\n  providers: PlatformCatalogProvider[]\n  /** Count of substrate-bundled connectors behind the catalog. */\n  substrateBundled?: number\n  [k: string]: unknown\n}\n\nexport interface StartAuthInput {\n  /** The provider to connect (goes in the URL path). */\n  providerId: string\n  /** Accepted for interface compatibility; the platform's start endpoint is\n   *  provider-level and does not consume a connector id. */\n  connectorId?: string\n  /** Where the platform redirects the user back to after OAuth. */\n  returnUrl: string\n  /** Accepted for interface compatibility; not consumed by the start endpoint. */\n  requestedScopes?: string[]\n  /** CLI flow flag — affects the platform's post-auth redirect handling. */\n  cli?: boolean\n}\n\nexport interface StartAuthResult {\n  /** The URL to send the user to. Normalized across the platform's two start\n   *  branches: github returns `authorizationUrl`, substrate returns\n   *  `redirectUrl`. */\n  authorizationUrl: string\n  state: string\n  expiresAt?: string\n  scopes?: string[]\n}\n\nexport interface ConnectionHealth {\n  status: 'unknown' | 'healthy' | 'unhealthy' | 'rate_limited' | (string & {})\n  checkedAt: string\n  error?: { code: string; message: string }\n}\n\nexport interface ConnectionHealthResult {\n  connection: PlatformConnection\n  health: ConnectionHealth\n}\n\n/** Last-known health for a connection, derived from the connection row. */\nexport interface HealthCheck {\n  connectionId: string\n  providerId: string\n  /** Mirrors `PlatformConnection.health`. */\n  status: ConnectionHealth['status']\n  checkedAt?: string\n}\n\nexport interface MintTokenInput {\n  /** The hub action the token authorizes (e.g. `slack.chat.postMessage`). */\n  actionPath: string\n  /** Bind to a specific connection, or … */\n  connectionId?: string\n  /** … resolve the connection by provider for the calling user. */\n  provider?: string\n}\n\nexport interface MintTokenResult {\n  tokenId: string\n  token: string\n  expiresAt: string\n}\n\nexport interface ExecInput {\n  /** The hub action path to execute. */\n  path: string\n  input?: unknown\n  connectionId?: string\n}\n\nexport interface PlatformHubStatus {\n  contract?: unknown\n  principal: { kind: string; userId: string; [k: string]: unknown }\n  connections: { connectedProviderCount: number; unhealthyProviderCount: number }\n}\n\nexport class PlatformHubError extends Error {\n  constructor(\n    message: string,\n    public readonly status: number,\n    public readonly code: string | undefined,\n    public readonly body: unknown,\n  ) {\n    super(message)\n    this.name = 'PlatformHubError'\n  }\n}\n\ninterface PlatformEnvelope<T> {\n  success: boolean\n  data?: T\n  error?: { code?: string; message?: string } | string\n}\n\nexport class PlatformHubClient {\n  private readonly baseUrl: string\n  private readonly bearer: string\n  private readonly fetchImpl: typeof fetch\n\n  constructor(options: PlatformHubClientOptions) {\n    if (!options.baseUrl) throw new Error('PlatformHubClient: baseUrl is required')\n    if (!options.bearer) throw new Error('PlatformHubClient: bearer is required')\n    this.baseUrl = options.baseUrl.replace(/\\/+$/, '')\n    this.bearer = options.bearer\n    this.fetchImpl =\n      options.fetchImpl ??\n      ((url: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => fetch(url, init))\n  }\n\n  /** GET /v1/hub/providers — the connectable provider catalog. */\n  catalog(): Promise<CatalogResult> {\n    return this.request('GET', '/v1/hub/providers')\n  }\n\n  /** GET /v1/hub/connections — the calling user's live connections. */\n  async listConnections(): Promise<PlatformConnection[]> {\n    const data = await this.request<{ connections: PlatformConnection[] }>(\n      'GET',\n      '/v1/hub/connections',\n    )\n    return data.connections\n  }\n\n  /** DELETE /v1/hub/connections/:connectionId — revoke + disable a connection. */\n  revokeConnection(connectionId: string): Promise<{ connection: PlatformConnection }> {\n    return this.request('DELETE', `/v1/hub/connections/${encodeURIComponent(connectionId)}`)\n  }\n\n  /**\n   * POST /v1/hub/connections/:provider/start — begin OAuth/grant. The provider\n   * is taken from the URL; the body carries `returnUrl` (+ `cli`). The platform's\n   * two start branches name the URL field differently (github → `authorizationUrl`,\n   * substrate → `redirectUrl`); this normalizes to `authorizationUrl`.\n   */\n  async startAuth(input: StartAuthInput): Promise<StartAuthResult> {\n    const body: { returnUrl: string; cli?: boolean } = { returnUrl: input.returnUrl }\n    if (input.cli !== undefined) body.cli = input.cli\n    const data = await this.request<{\n      authorizationUrl?: string\n      redirectUrl?: string\n      state: string\n      expiresAt?: string\n      scopes?: string[]\n    }>('POST', `/v1/hub/connections/${encodeURIComponent(input.providerId)}/start`, body)\n    const authorizationUrl = data.authorizationUrl ?? data.redirectUrl\n    if (!authorizationUrl) {\n      throw new PlatformHubError(\n        'Platform hub start response missing an authorization URL',\n        502,\n        'HUB_INVALID_START_RESPONSE',\n        data,\n      )\n    }\n    return { authorizationUrl, state: data.state, expiresAt: data.expiresAt, scopes: data.scopes }\n  }\n\n  /**\n   * Last-known health for every connection. The platform has no global\n   * healthcheck listing — health rides on each connection row — so this derives\n   * the list from `listConnections()` (one request, no extra round-trips).\n   */\n  async listHealthchecks(): Promise<HealthCheck[]> {\n    const connections = await this.listConnections()\n    return connections.map((c) => ({\n      connectionId: c.id,\n      providerId: c.providerId,\n      status: c.health,\n      checkedAt: c.updatedAt,\n    }))\n  }\n\n  /**\n   * POST /v1/hub/connections/:connectionId/health — trigger a fresh health\n   * probe for one connection and return its updated state.\n   */\n  checkConnectionHealth(connectionId: string): Promise<ConnectionHealthResult> {\n    return this.request('POST', `/v1/hub/connections/${encodeURIComponent(connectionId)}/health`)\n  }\n\n  /**\n   * Trigger a fresh health probe across all of the user's connections. The\n   * platform exposes health per-connection only, so this fans out over\n   * `listConnections()`. `scheduled` is the number of probes dispatched.\n   */\n  async runHealthchecks(): Promise<{ scheduled: number }> {\n    const connections = await this.listConnections()\n    await Promise.allSettled(connections.map((c) => this.checkConnectionHealth(c.id)))\n    return { scheduled: connections.length }\n  }\n\n  /** GET /v1/hub/status — principal + aggregate connection counts. */\n  status(): Promise<PlatformHubStatus> {\n    return this.request('GET', '/v1/hub/status')\n  }\n\n  /**\n   * POST /v1/hub/tokens — mint a short-lived, action-scoped capability token a\n   * sandbox can use to invoke one hub action on the user's behalf without\n   * seeing the underlying provider credential.\n   */\n  mintToken(input: MintTokenInput): Promise<MintTokenResult> {\n    return this.request('POST', '/v1/hub/tokens', input)\n  }\n\n  /** POST /v1/hub/exec — execute a hub action and return its result. */\n  async exec(input: ExecInput): Promise<unknown> {\n    const data = await this.request<{ result: unknown }>('POST', '/v1/hub/exec', input)\n    return data.result\n  }\n\n  private async request<T>(\n    method: 'GET' | 'POST' | 'DELETE' | 'PUT',\n    path: string,\n    body?: unknown,\n  ): Promise<T> {\n    const headers: Record<string, string> = {\n      authorization: `Bearer ${this.bearer}`,\n      accept: 'application/json',\n    }\n    if (body !== undefined) headers['content-type'] = 'application/json'\n\n    const res = await this.fetchImpl(`${this.baseUrl}${path}`, {\n      method,\n      headers,\n      body: body !== undefined ? JSON.stringify(body) : undefined,\n    })\n    const text = await res.text()\n    let parsed: PlatformEnvelope<T> | null = null\n    if (text) {\n      try {\n        parsed = JSON.parse(text)\n      } catch {\n        // fall through to error handling below\n      }\n    }\n    if (!res.ok || (parsed && parsed.success === false)) {\n      const code = parsed?.error && typeof parsed.error === 'object' ? parsed.error.code : undefined\n      const message =\n        (parsed?.error && typeof parsed.error === 'object' && parsed.error.message) ||\n        (typeof parsed?.error === 'string' ? parsed.error : `Platform hub error (${res.status})`)\n      throw new PlatformHubError(message, res.status, code, parsed ?? text)\n    }\n    if (!parsed) {\n      throw new PlatformHubError(\n        `Platform hub returned non-JSON success (${res.status})`,\n        res.status,\n        undefined,\n        text,\n      )\n    }\n    if (parsed.data === undefined) {\n      throw new PlatformHubError(\n        'Platform hub envelope missing `data`',\n        res.status,\n        undefined,\n        parsed,\n      )\n    }\n    return parsed.data\n  }\n}\n"],"mappings":";;;AAiDO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YACE,SACgB,QACA,MAChB;AACA,UAAM,OAAO;AAHG;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EALkB;AAAA,EACA;AAKpB;AAEO,IAAM,qBAAN,MAAyB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAoC;AAC9C,QAAI,CAAC,QAAQ,QAAS,OAAM,IAAI,MAAM,yCAAyC;AAC/E,QAAI,CAAC,QAAQ,MAAO,OAAM,IAAI,MAAM,uCAAuC;AAC3E,SAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AACjD,SAAK,QAAQ,QAAQ;AACrB,SAAK,YACH,QAAQ,cACP,CAAC,KAAkC,SAAuC,MAAM,KAAK,IAAI;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAa,SAAsC;AACjD,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,IAAI,MAAM,6DAA6D;AAAA,IAC/E;AACA,UAAM,MAAM,IAAI,IAAI,yBAAyB,KAAK,OAAO;AACzD,QAAI,aAAa,IAAI,OAAO,KAAK,KAAK;AACtC,QAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAC3C,QAAI,QAAQ,YAAa,KAAI,aAAa,IAAI,YAAY,QAAQ,WAAW;AAC7E,QAAI,QAAQ,OAAQ,KAAI,aAAa,IAAI,UAAU,QAAQ,MAAM;AACjE,QAAI,QAAQ,MAAO,KAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;AAC9D,WAAO,IAAI,SAAS;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,SAAS,MAA2C;AACxD,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,+CAA+C;AAC1E,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,OAAO,wBAAwB;AAAA,MACtE,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,MAAM,KAAK,KAAK,MAAM,CAAC;AAAA,IAChD,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAI,CAAC,IAAI,IAAI;AACX,YAAM,UACJ,QAAQ,OAAO,SAAS,YAAY,WAAW,QAAQ,OAAO,KAAK,UAAU,WACzE,KAAK,QACL,6BAA6B,IAAI,MAAM;AAC7C,YAAM,IAAI,kBAAkB,SAAS,IAAI,QAAQ,IAAI;AAAA,IACvD;AACA,UAAM,SAAS;AACf,QAAI,CAAC,OAAO,UAAU,CAAC,OAAO,MAAM,IAAI;AACtC,YAAM,IAAI;AAAA,QACR;AAAA,QACA,IAAI;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;;;ACQO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YACE,SACgB,QACA,MACA,MAChB;AACA,UAAM,OAAO;AAJG;AACA;AACA;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EANkB;AAAA,EACA;AAAA,EACA;AAKpB;AAQO,IAAM,oBAAN,MAAwB;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,SAAmC;AAC7C,QAAI,CAAC,QAAQ,QAAS,OAAM,IAAI,MAAM,wCAAwC;AAC9E,QAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,uCAAuC;AAC5E,SAAK,UAAU,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AACjD,SAAK,SAAS,QAAQ;AACtB,SAAK,YACH,QAAQ,cACP,CAAC,KAAkC,SAAuC,MAAM,KAAK,IAAI;AAAA,EAC9F;AAAA;AAAA,EAGA,UAAkC;AAChC,WAAO,KAAK,QAAQ,OAAO,mBAAmB;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,kBAAiD;AACrD,UAAM,OAAO,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,iBAAiB,cAAmE;AAClF,WAAO,KAAK,QAAQ,UAAU,uBAAuB,mBAAmB,YAAY,CAAC,EAAE;AAAA,EACzF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAU,OAAiD;AAC/D,UAAM,OAA6C,EAAE,WAAW,MAAM,UAAU;AAChF,QAAI,MAAM,QAAQ,OAAW,MAAK,MAAM,MAAM;AAC9C,UAAM,OAAO,MAAM,KAAK,QAMrB,QAAQ,uBAAuB,mBAAmB,MAAM,UAAU,CAAC,UAAU,IAAI;AACpF,UAAM,mBAAmB,KAAK,oBAAoB,KAAK;AACvD,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,kBAAkB,OAAO,KAAK,OAAO,WAAW,KAAK,WAAW,QAAQ,KAAK,OAAO;AAAA,EAC/F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBAA2C;AAC/C,UAAM,cAAc,MAAM,KAAK,gBAAgB;AAC/C,WAAO,YAAY,IAAI,CAAC,OAAO;AAAA,MAC7B,cAAc,EAAE;AAAA,MAChB,YAAY,EAAE;AAAA,MACd,QAAQ,EAAE;AAAA,MACV,WAAW,EAAE;AAAA,IACf,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,sBAAsB,cAAuD;AAC3E,WAAO,KAAK,QAAQ,QAAQ,uBAAuB,mBAAmB,YAAY,CAAC,SAAS;AAAA,EAC9F;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,kBAAkD;AACtD,UAAM,cAAc,MAAM,KAAK,gBAAgB;AAC/C,UAAM,QAAQ,WAAW,YAAY,IAAI,CAAC,MAAM,KAAK,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACjF,WAAO,EAAE,WAAW,YAAY,OAAO;AAAA,EACzC;AAAA;AAAA,EAGA,SAAqC;AACnC,WAAO,KAAK,QAAQ,OAAO,gBAAgB;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU,OAAiD;AACzD,WAAO,KAAK,QAAQ,QAAQ,kBAAkB,KAAK;AAAA,EACrD;AAAA;AAAA,EAGA,MAAM,KAAK,OAAoC;AAC7C,UAAM,OAAO,MAAM,KAAK,QAA6B,QAAQ,gBAAgB,KAAK;AAClF,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,QACZ,QACA,MACA,MACY;AACZ,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK,MAAM;AAAA,MACpC,QAAQ;AAAA,IACV;AACA,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAElD,UAAM,MAAM,MAAM,KAAK,UAAU,GAAG,KAAK,OAAO,GAAG,IAAI,IAAI;AAAA,MACzD;AAAA,MACA;AAAA,MACA,MAAM,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI;AAAA,IACpD,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,QAAI,SAAqC;AACzC,QAAI,MAAM;AACR,UAAI;AACF,iBAAS,KAAK,MAAM,IAAI;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AACA,QAAI,CAAC,IAAI,MAAO,UAAU,OAAO,YAAY,OAAQ;AACnD,YAAM,OAAO,QAAQ,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,OAAO;AACrF,YAAM,UACH,QAAQ,SAAS,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,YAClE,OAAO,QAAQ,UAAU,WAAW,OAAO,QAAQ,uBAAuB,IAAI,MAAM;AACvF,YAAM,IAAI,iBAAiB,SAAS,IAAI,QAAQ,MAAM,UAAU,IAAI;AAAA,IACtE;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,IAAI;AAAA,QACR,2CAA2C,IAAI,MAAM;AAAA,QACrD,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,SAAS,QAAW;AAC7B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,IAAI;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AACF;","names":[]}

package/dist/profiles.d.ts

@@ -1,5 +1,5 @@
-export { C as CoderOutput, b as CoderProfileOptions, a as CoderTask, M as MultiHarnessCoderFanoutOptions, c as coderProfile, d as createCoderValidator, m as multiHarnessCoderFanout } from './coder-CVZNGbyg.js';
-import { S as SandboxClient, O as OutputAdapter, V as Validator, A as AgentRunSpec } from './types-nBMuollC.js';
+export { C as CoderOutput, a as CoderProfileOptions, b as CoderTask, M as MultiHarnessCoderFanoutOptions, c as coderProfile, d as createCoderValidator, m as multiHarnessCoderFanout } from './coder-_YCf3BAK.js';
+import { S as SandboxClient, O as OutputAdapter, V as Validator, A as AgentRunSpec } from './types-BEQsBhOE.js';
 import { a as UiLens, U as UiFinding } from './substrate-CUgk7F7s.js';
 export { b as UI_FINDING_SEVERITIES, c as UI_LENSES, d as UiFindingScreenshot, e as UiFindingSeverity } from './substrate-CUgk7F7s.js';
 import { SandboxEvent, AgentProfile } from '@tangle-network/sandbox';

package/dist/{run-loop-DvD4aGiE.d.ts → run-loop-BIineL1T.d.ts}

@@ -1,5 +1,5 @@
 import { SandboxInstance } from '@tangle-network/sandbox';
-import { D as Driver, A as AgentRunSpec, O as OutputAdapter, V as Validator, E as ExecCtx, I as Iteration, L as LoopWinner, a as LoopLineageOptions, S as SandboxClient, b as LoopResult } from './types-nBMuollC.js';
+import { D as Driver, A as AgentRunSpec, O as OutputAdapter, V as Validator, E as ExecCtx, I as Iteration, L as LoopWinner, a as LoopLineageOptions, S as SandboxClient, b as LoopResult } from './types-BEQsBhOE.js';
 
 /**
  * @experimental

package/dist/runtime.d.ts

@@ -1,16 +1,16 @@
 import { AgentProfile, BackendType, CreateSandboxOptions, SandboxInstance, SandboxEvent } from '@tangle-network/sandbox';
 export { AgentProfile, CreateSandboxOptions, SandboxEvent, SandboxInstance } from '@tangle-network/sandbox';
-import { R as ResultBlobStore, a as SpawnJournal, N as NodeId, b as SpawnEvent, T as TreeView, c as Settled, d as AgentSpec, E as ExecutorRegistry, B as Budget, A as Agent, e as RootHandle, f as SupervisedResult, g as Spend, S as Scope, h as ExecutorFactory, U as UsageEvent, i as Supervisor } from './types-BpDfCPUp.js';
-export { j as Executor, k as ExecutorContext, l as ExecutorResult, H as Handle, m as NodeSnapshot, n as NodeStatus, o as Restart, p as RootSignal, q as Runtime, r as SpawnOpts, s as SupervisorOpts, W as WidenGate } from './types-BpDfCPUp.js';
+import { R as ResultBlobStore, a as SpawnJournal, N as NodeId, b as SpawnEvent, T as TreeView, c as Settled, d as AgentSpec, E as ExecutorRegistry, B as Budget, A as Agent, e as RootHandle, f as SupervisedResult, g as Spend, S as Scope, h as ExecutorFactory, U as UsageEvent, i as Supervisor } from './types-5MGt5KTY.js';
+export { j as Executor, k as ExecutorContext, l as ExecutorResult, H as Handle, m as NodeSnapshot, n as NodeStatus, o as Restart, p as RootSignal, q as Runtime, r as SpawnOpts, s as SupervisorOpts, W as WidenGate } from './types-5MGt5KTY.js';
 import { R as RuntimeHooks } from './runtime-hooks-C7JwKb9E.js';
 import { ChatClient, AnalystFinding, DefaultVerdict, AgentProfile as AgentProfile$1 } from '@tangle-network/agent-eval';
 export { DefaultVerdict } from '@tangle-network/agent-eval';
-export { A as AnalyzeInput, a as CompletionAnalyst, b as CompletionEvidence, c as CompletionPolicy, d as CompletionVerdict, C as CreateDriverOptions, D as DriverDecision, P as PlannerContext, e as TopologyMove, T as TopologyPlanner, f as completionAuthorizes, g as createDriver, h as deterministicCompletion, r as renderAnalyses, s as sentinelCompletion, i as stopSentinel } from './driver-DYU2sgHr.js';
-import { S as SandboxClient, b as LoopResult, c as LoopTokenUsage, R as RuntimeStreamEvent, A as AgentRunSpec, E as ExecCtx, I as Iteration } from './types-nBMuollC.js';
-export { D as Driver, C as LoopDecisionPayload, F as LoopEndedPayload, G as LoopIterationDispatchPayload, H as LoopIterationEndedPayload, J as LoopIterationStartedPayload, a as LoopLineageOptions, M as LoopPlanDescription, N as LoopPlanPayload, f as LoopSandboxPlacement, P as LoopStartedPayload, Q as LoopTeardownFailedPayload, e as LoopTraceEmitter, T as LoopTraceEvent, L as LoopWinner, O as OutputAdapter, U as ValidationCtx, V as Validator } from './types-nBMuollC.js';
+export { A as AnalyzeInput, a as CompletionAnalyst, b as CompletionEvidence, c as CompletionPolicy, d as CompletionVerdict, C as CreateDriverOptions, D as DriverDecision, P as PlannerContext, e as TopologyMove, T as TopologyPlanner, f as completionAuthorizes, g as createDriver, h as deterministicCompletion, r as renderAnalyses, s as sentinelCompletion, i as stopSentinel } from './driver-DLI1io57.js';
+import { S as SandboxClient, b as LoopResult, d as LoopTokenUsage, R as RuntimeStreamEvent, A as AgentRunSpec, E as ExecCtx, I as Iteration } from './types-BEQsBhOE.js';
+export { D as Driver, F as LoopDecisionPayload, G as LoopEndedPayload, H as LoopIterationDispatchPayload, J as LoopIterationEndedPayload, M as LoopIterationStartedPayload, a as LoopLineageOptions, N as LoopPlanDescription, P as LoopPlanPayload, e as LoopSandboxPlacement, Q as LoopStartedPayload, T as LoopTeardownFailedPayload, f as LoopTraceEmitter, g as LoopTraceEvent, L as LoopWinner, O as OutputAdapter, U as ValidationCtx, V as Validator } from './types-BEQsBhOE.js';
 import { Scenario, ProfileDispatchFn } from '@tangle-network/agent-eval/campaign';
-import { R as RunLoopOptions } from './run-loop-DvD4aGiE.js';
-export { c as createSandboxForSpec, d as defaultSelectWinner, r as runLoop } from './run-loop-DvD4aGiE.js';
+import { R as RunLoopOptions } from './run-loop-BIineL1T.js';
+export { c as createSandboxForSpec, d as defaultSelectWinner, r as runLoop } from './run-loop-BIineL1T.js';
 
 /**
  * @experimental
@@ -1996,6 +1996,117 @@ interface UsageSink {
  */
 declare function reportLoopUsage<Task, Output, Decision>(cost: UsageSink, result: Pick<LoopResult<Task, Output, Decision>, 'costUsd' | 'tokenUsage'>, source?: string): void;
 
+/**
+ * The one router chat client: direct OpenAI-compatible completions through the
+ * Tangle router — the cheapest dial, no sandbox. Three layers: `routerChatWithUsage`
+ * (chat-only), `routerChatWithTools` (one completion with function tools), and
+ * `routerToolLoop` (the off-box agentic loop over tool-calling). Shared by the
+ * built-in executors and the bench/lab harnesses.
+ *
+ * Reports REAL token usage so the backend-integrity guard sees a real backend.
+ * Returns `undefined` usage when the provider omitted it — never a fabricated 0
+ * (a phantom 0 reads as a free call downstream, which the gate would act on).
+ */
+interface RouterConfig {
+    routerBaseUrl: string;
+    routerKey: string;
+    model: string;
+}
+interface RouterChatResult {
+    content: string;
+    /** REAL usage, or undefined when the provider reported none. */
+    usage?: {
+        input: number;
+        output: number;
+    };
+    /** Derived from usage via `estimateCost` when the model is priced; else undefined. */
+    costUsd?: number;
+}
+declare function routerChatWithUsage(cfg: RouterConfig, messages: Array<{
+    role: string;
+    content: string;
+}>, opts?: {
+    temperature?: number;
+    signal?: AbortSignal;
+    maxTokens?: number;
+}): Promise<RouterChatResult>;
+/** A tool-call the model emitted (provider-neutral; mirrors the runtime's ToolCallRequest). */
+interface RouterToolCall {
+    id: string;
+    name: string;
+    /** Raw JSON arguments string as emitted by the model. */
+    arguments: string;
+}
+interface RouterChatToolsResult {
+    content: string | null;
+    toolCalls: RouterToolCall[];
+    usage?: {
+        input: number;
+        output: number;
+    };
+    costUsd?: number;
+}
+/**
+ * A router completion WITH tool-calling — the operator driver's LLM seam. Passes OpenAI-shape
+ * `messages` (system/user/assistant-with-tool_calls/tool roles) + function `tools`, and returns the
+ * assistant text plus the tool calls the model wants run. Same fail-loud + real-usage discipline as
+ * `routerChatWithUsage`. `tool_choice: 'auto'` lets the model decide; the driver loops on the result.
+ */
+declare function routerChatWithTools(cfg: RouterConfig, messages: ReadonlyArray<Record<string, unknown>>, tools: ReadonlyArray<{
+    type: 'function';
+    function: {
+        name: string;
+        description?: string;
+        parameters: unknown;
+    };
+}>, opts?: {
+    temperature?: number;
+    signal?: AbortSignal;
+    toolChoice?: 'auto' | 'required' | 'none';
+}): Promise<RouterChatToolsResult>;
+interface ToolSpec {
+    type: 'function';
+    function: {
+        name: string;
+        description?: string;
+        parameters: unknown;
+    };
+}
+interface RouterToolLoopResult {
+    /** The model's final assistant text (the turn where it stopped calling tools, or the budget turn). */
+    final: string;
+    /** Inference turns spent (≤ maxTurns) — the equal-budget unit vs random@k. */
+    turns: number;
+    toolCalls: number;
+    /** The behavior trace: each tool call + its result, in order. What a trace-analyst
+     *  steerer reads (behavior, never the verdict) to diagnose + redirect the next shot. */
+    toolTrace: Array<{
+        name: string;
+        args: string;
+        result: string;
+    }>;
+    usage: {
+        input: number;
+        output: number;
+    };
+}
+/**
+ * The tool-using router backend: a real agentic loop OVER the Tangle router (which
+ * supports tool-calling), off-box — no sandbox. Each turn is one router completion
+ * with `tools`; if the model emits tool_calls, `execute` runs them on the host and
+ * their results are folded back as `tool` messages; the loop repeats until the
+ * model answers without a tool call or the turn budget is hit. One turn = one
+ * inference call, so `maxTurns` is the equal-compute unit against random@k.
+ *
+ * This is the depth substrate for agentic gates (the worker ACTS, observes the real
+ * result, and continues) that the chat-only `routerChatWithUsage` cannot express.
+ */
+declare function routerToolLoop(cfg: RouterConfig, system: string, user: string, tools: ReadonlyArray<ToolSpec>, execute: (name: string, args: Record<string, unknown>) => Promise<string>, opts?: {
+    maxTurns?: number;
+    temperature?: number;
+    signal?: AbortSignal;
+}): Promise<RouterToolLoopResult>;
+
 /**
  * @experimental
  *
@@ -2829,15 +2940,6 @@ interface BridgeSeam {
     agentProfile?: Record<string, unknown>;
     timeoutMs?: number;
 }
-/** An OpenAI-shape function tool the model may call. */
-interface ToolSpec {
-    type: 'function';
-    function: {
-        name: string;
-        description?: string;
-        parameters: unknown;
-    };
-}
 /**
  * Router seam WITH tool use — the tool-using router backend. Same direct
  * OpenAI-compatible endpoint as `RouterSeam`, but each turn passes `tools`; when
@@ -3082,4 +3184,4 @@ declare function gitWorkspace(opts: GitWorkspaceOptions): Workspace;
  *  requires `jj` on the `Shell`'s host. */
 declare function jjWorkspace(opts: GitWorkspaceOptions): Workspace;
 
-export { Agent, AgentRunSpec, AgentSpec, type AgenticOptions, type AgenticRunResult, type AgenticSurface, type AgenticTask, type AgenticTool, type AnytimeReport, type AnytimeStrategySummary, type AnytimeTaskCurve, type ArtifactHandle, type AssertTraceDerivedFindings, type AuditIntentInput, type AuditIntentOptions, type AuthorStrategyOptions, type AuthoredStrategy, type BenchmarkCell, type BenchmarkConfig, type BenchmarkLift, type BenchmarkReport, type BenchmarkStrategySummary, type BenchmarkTaskRow, type BridgeSeam, Budget, type BudgetPool, type BudgetReadout, type ChampionPick, type ChampionPolicy, type CheckpointCapableBox, type CliSeam, type CombinatorShape, type Corpus, type CorpusFilter, type CorpusRecord, type CreateScopeAnalystOptions, type CriuCapableClient, type DefinePersona, type DefinePersonaInput, type Deliverable, type Environment, type EqualKArm, type EqualKOnCost, type EqualKOnCostOptions, type EqualKVerdict, type EvolutionArchiveNode, type EvolutionAuthor, type EvolutionBandInfo, type EvolutionCandidate, type EvolutionGeneration, type EvolutionReport, ExecCtx, type ExecutorConfig, ExecutorFactory, ExecutorRegistry, type Fanout, type FanoutOptions, type FanoutSynthesis, FileCorpus, FileResultBlobStore, FileSpawnJournal, type FlatWidenGate, type ForkCapableBox, type GitWorkspaceOptions, type HarvestCorpusOptions, type HarvestFailure, type HarvestReport, InMemoryCorpus, InMemoryResultBlobStore, InMemorySpawnJournal, type IntentAudit, Iteration, type LoopDispatchOptions, type LoopOptionsForDispatch, LoopResult, type LoopShape, LoopTokenUsage, type LoopUntil, type LoopUntilSpec, type LoopUntilState, type McpEndpoint, type McpEnvironmentOptions, NodeId, type Observation, type ObserveInput, type ObserveOptions, type OpenSandboxRunOptions, type Outcome, type Panel, type PanelJudge, type PanelSpec, type PanelVerdict, type Persona, type PersonaContext, type PersonaExecutors, type Pipeline, type PipelineStage, type PromotionGateOptions, type PromotionVerdict, type RenderCorpusToInstructions, type RenderCorpusToInstructionsOptions, type ReservationTicket, ResultBlobStore, RootHandle, type RouterSeam, type RouterToolsSeam, type RunAgenticOptions, RunLoopOptions, type RunPersonified, type RunPersonifiedOptions, type SandboxCapabilities, SandboxClient, type SandboxLineage, type SandboxLineageHandle, type SandboxRun, type SandboxSeam, Scope, type ScopeAnalyst, type ScopeAnalyzeInput, type ScopeWidenGate, type SessionCapableBox, Settled, type ShapeBudget, type ShapeContext, type ShapeRegistry, type Shell, type ShotPersona, type ShotSpec, SpawnEvent, SpawnJournal, Spend, type SteerContext, type Strategy, type StrategyCtx, type StrategyEvolutionConfig, type StrategyResult, SupervisedResult, Supervisor, type SurfaceScore, type ToolSpec, type TrajectoryNode, type TrajectoryReport, type TrajectoryReportFn, type TrajectoryReportOptions, TreeView, type TurnResult, UsageEvent, type UsageSink, type VerifierEnvironmentOptions, type Verify, type VerifySpec, type WaterfallCollector, type WaterfallReport, type WaterfallSpan, type Widen, type WidenDecision, type WidenLineage, type WidenSpec, type Workspace, type WorkspaceCommit, acquireSandbox, adaptiveRefine, anytimeReport, assertStrategyContract, assertTraceDerivedFindings, auditIntent, authorStrategy, breadthDriver, buildSteerContext, builtinShapes, contentAddress, createBudgetPool, createExecutor, createExecutorRegistry, createMcpEnvironment, createRootHandle, createSandboxLineage, createScope, createScopeAnalyst, createShapeRegistry, createSupervisor, createVerifierEnvironment, createWaterfallCollector, defaultAnalystInstruction, defaultAuditorInstruction, definePersona, defineStrategy, depthDriver, discriminatingMeans, equalKOnCost, extractLlmCallEvent, fanout, flatWidenGate, gitWorkspace, harvestCorpus, inlineSandboxClient, jjWorkspace, localShell, loopDispatch, loopUntil, mapSandboxEvent, materializeTreeView, observe, openSandboxRun, panel, pickChampion, pipeline, printBenchmarkReport, probeSandboxCapabilities, promotionGate, refine, registerShape, renderAnytimeTable, renderCorpusToInstructions, renderReport, replaySpawnTree, reportLoopUsage, runAgentic, runBenchmark, runPersonified, runStrategyEvolution, sample, sampleThenRefine, selectChampion, settledToIteration, spendFromUsageEvents, strategyAuthorContract, trajectoryReport, verify, widen };
+export { Agent, AgentRunSpec, AgentSpec, type AgenticOptions, type AgenticRunResult, type AgenticSurface, type AgenticTask, type AgenticTool, type AnytimeReport, type AnytimeStrategySummary, type AnytimeTaskCurve, type ArtifactHandle, type AssertTraceDerivedFindings, type AuditIntentInput, type AuditIntentOptions, type AuthorStrategyOptions, type AuthoredStrategy, type BenchmarkCell, type BenchmarkConfig, type BenchmarkLift, type BenchmarkReport, type BenchmarkStrategySummary, type BenchmarkTaskRow, type BridgeSeam, Budget, type BudgetPool, type BudgetReadout, type ChampionPick, type ChampionPolicy, type CheckpointCapableBox, type CliSeam, type CombinatorShape, type Corpus, type CorpusFilter, type CorpusRecord, type CreateScopeAnalystOptions, type CriuCapableClient, type DefinePersona, type DefinePersonaInput, type Deliverable, type Environment, type EqualKArm, type EqualKOnCost, type EqualKOnCostOptions, type EqualKVerdict, type EvolutionArchiveNode, type EvolutionAuthor, type EvolutionBandInfo, type EvolutionCandidate, type EvolutionGeneration, type EvolutionReport, ExecCtx, type ExecutorConfig, ExecutorFactory, ExecutorRegistry, type Fanout, type FanoutOptions, type FanoutSynthesis, FileCorpus, FileResultBlobStore, FileSpawnJournal, type FlatWidenGate, type ForkCapableBox, type GitWorkspaceOptions, type HarvestCorpusOptions, type HarvestFailure, type HarvestReport, InMemoryCorpus, InMemoryResultBlobStore, InMemorySpawnJournal, type IntentAudit, Iteration, type LoopDispatchOptions, type LoopOptionsForDispatch, LoopResult, type LoopShape, LoopTokenUsage, type LoopUntil, type LoopUntilSpec, type LoopUntilState, type McpEndpoint, type McpEnvironmentOptions, NodeId, type Observation, type ObserveInput, type ObserveOptions, type OpenSandboxRunOptions, type Outcome, type Panel, type PanelJudge, type PanelSpec, type PanelVerdict, type Persona, type PersonaContext, type PersonaExecutors, type Pipeline, type PipelineStage, type PromotionGateOptions, type PromotionVerdict, type RenderCorpusToInstructions, type RenderCorpusToInstructionsOptions, type ReservationTicket, ResultBlobStore, RootHandle, type RouterChatResult, type RouterChatToolsResult, type RouterConfig, type RouterSeam, type RouterToolCall, type RouterToolLoopResult, type RouterToolsSeam, type RunAgenticOptions, RunLoopOptions, type RunPersonified, type RunPersonifiedOptions, type SandboxCapabilities, SandboxClient, type SandboxLineage, type SandboxLineageHandle, type SandboxRun, type SandboxSeam, Scope, type ScopeAnalyst, type ScopeAnalyzeInput, type ScopeWidenGate, type SessionCapableBox, Settled, type ShapeBudget, type ShapeContext, type ShapeRegistry, type Shell, type ShotPersona, type ShotSpec, SpawnEvent, SpawnJournal, Spend, type SteerContext, type Strategy, type StrategyCtx, type StrategyEvolutionConfig, type StrategyResult, SupervisedResult, Supervisor, type SurfaceScore, type ToolSpec, type TrajectoryNode, type TrajectoryReport, type TrajectoryReportFn, type TrajectoryReportOptions, TreeView, type TurnResult, UsageEvent, type UsageSink, type VerifierEnvironmentOptions, type Verify, type VerifySpec, type WaterfallCollector, type WaterfallReport, type WaterfallSpan, type Widen, type WidenDecision, type WidenLineage, type WidenSpec, type Workspace, type WorkspaceCommit, acquireSandbox, adaptiveRefine, anytimeReport, assertStrategyContract, assertTraceDerivedFindings, auditIntent, authorStrategy, breadthDriver, buildSteerContext, builtinShapes, contentAddress, createBudgetPool, createExecutor, createExecutorRegistry, createMcpEnvironment, createRootHandle, createSandboxLineage, createScope, createScopeAnalyst, createShapeRegistry, createSupervisor, createVerifierEnvironment, createWaterfallCollector, defaultAnalystInstruction, defaultAuditorInstruction, definePersona, defineStrategy, depthDriver, discriminatingMeans, equalKOnCost, extractLlmCallEvent, fanout, flatWidenGate, gitWorkspace, harvestCorpus, inlineSandboxClient, jjWorkspace, localShell, loopDispatch, loopUntil, mapSandboxEvent, materializeTreeView, observe, openSandboxRun, panel, pickChampion, pipeline, printBenchmarkReport, probeSandboxCapabilities, promotionGate, refine, registerShape, renderAnytimeTable, renderCorpusToInstructions, renderReport, replaySpawnTree, reportLoopUsage, routerChatWithTools, routerChatWithUsage, routerToolLoop, runAgentic, runBenchmark, runPersonified, runStrategyEvolution, sample, sampleThenRefine, selectChampion, settledToIteration, spendFromUsageEvents, strategyAuthorContract, trajectoryReport, verify, widen };

package/dist/runtime.js

@@ -66,6 +66,9 @@ import {
   renderReport,
   replaySpawnTree,
   reportLoopUsage,
+  routerChatWithTools,
+  routerChatWithUsage,
+  routerToolLoop,
   runAgentic,
   runBenchmark,
   runLoop,
@@ -82,7 +85,7 @@ import {
   trajectoryReport,
   verify,
   widen
-} from "./chunk-PXUTIMGJ.js";
+} from "./chunk-FQH33M5N.js";
 import {
   extractLlmCallEvent,
   mapSandboxEvent
@@ -158,6 +161,9 @@ export {
   renderReport,
   replaySpawnTree,
   reportLoopUsage,
+  routerChatWithTools,
+  routerChatWithUsage,
+  routerToolLoop,
   runAgentic,
   runBenchmark,
   runLoop,

package/dist/{types-BpDfCPUp.d.ts → types-5MGt5KTY.d.ts}

@@ -1,7 +1,7 @@
 import { DefaultVerdict } from '@tangle-network/agent-eval';
 import { AgentProfile, BackendType } from '@tangle-network/sandbox';
 import { R as RuntimeHooks } from './runtime-hooks-C7JwKb9E.js';
-import { c as LoopTokenUsage } from './types-nBMuollC.js';
+import { d as LoopTokenUsage } from './types-BEQsBhOE.js';
 
 /**
  * @experimental

package/dist/{types-nBMuollC.d.ts → types-BEQsBhOE.d.ts}

@@ -1096,4 +1096,4 @@ interface ExecCtx {
     parentSpanId?: string;
 }
 
-export { type AgentRunSpec as A, type BackendErrorDetail as B, type LoopDecisionPayload as C, type Driver as D, type ExecCtx as E, type LoopEndedPayload as F, type LoopIterationDispatchPayload as G, type LoopIterationEndedPayload as H, type Iteration as I, type LoopIterationStartedPayload as J, type KnowledgeReadinessDecision as K, type LoopWinner as L, type LoopPlanDescription as M, type LoopPlanPayload as N, type OutputAdapter as O, type LoopStartedPayload as P, type LoopTeardownFailedPayload as Q, type RuntimeStreamEvent as R, type SandboxClient as S, type LoopTraceEvent as T, type ValidationCtx as U, type Validator as V, type LoopLineageOptions as a, type LoopResult as b, type LoopTokenUsage as c, type OpenAIChatTool as d, type LoopTraceEmitter as e, type LoopSandboxPlacement as f, type AgentBackendInput as g, type AgentExecutionBackend as h, type OpenAIChatToolChoice as i, type AgentBackendContext as j, type RunAgentTaskOptions as k, type AgentTaskRunResult as l, type RunAgentTaskStreamOptions as m, type AgentRuntimeEvent as n, type AgentTaskStatus as o, type RuntimeSessionStore as p, type RuntimeSession as q, type AgentAdapter as r, type AgentKnowledgeProvider as s, type AgentRuntimeEventSink as t, type AgentTaskContext as u, type AgentTaskSpec as v, type RuntimeRunHandle as w, type RuntimeRunPersistenceAdapter as x, type RuntimeRunRow as y, startRuntimeRun as z };
+export { type AgentRunSpec as A, type BackendErrorDetail as B, startRuntimeRun as C, type Driver as D, type ExecCtx as E, type LoopDecisionPayload as F, type LoopEndedPayload as G, type LoopIterationDispatchPayload as H, type Iteration as I, type LoopIterationEndedPayload as J, type KnowledgeReadinessDecision as K, type LoopWinner as L, type LoopIterationStartedPayload as M, type LoopPlanDescription as N, type OutputAdapter as O, type LoopPlanPayload as P, type LoopStartedPayload as Q, type RuntimeStreamEvent as R, type SandboxClient as S, type LoopTeardownFailedPayload as T, type ValidationCtx as U, type Validator as V, type LoopLineageOptions as a, type LoopResult as b, type OpenAIChatTool as c, type LoopTokenUsage as d, type LoopSandboxPlacement as e, type LoopTraceEmitter as f, type LoopTraceEvent as g, type AgentBackendInput as h, type AgentExecutionBackend as i, type OpenAIChatToolChoice as j, type AgentBackendContext as k, type RunAgentTaskOptions as l, type AgentTaskRunResult as m, type RunAgentTaskStreamOptions as n, type AgentRuntimeEvent as o, type AgentTaskStatus as p, type RuntimeSessionStore as q, type RuntimeSession as r, type AgentAdapter as s, type AgentKnowledgeProvider as t, type AgentRuntimeEventSink as u, type AgentTaskContext as v, type AgentTaskSpec as w, type RuntimeRunHandle as x, type RuntimeRunPersistenceAdapter as y, type RuntimeRunRow as z };

package/dist/workflow.d.ts

@@ -1,6 +1,6 @@
 import { AgentProfile, CreateSandboxOptions, PromptOptions, TaskOptions, SandboxEvent } from '@tangle-network/sandbox';
-import { S as SandboxClient, O as OutputAdapter, f as LoopSandboxPlacement, b as LoopResult } from './types-nBMuollC.js';
-import { R as RunLoopOptions } from './run-loop-DvD4aGiE.js';
+import { S as SandboxClient, O as OutputAdapter, e as LoopSandboxPlacement, b as LoopResult } from './types-BEQsBhOE.js';
+import { R as RunLoopOptions } from './run-loop-BIineL1T.js';
 import '@tangle-network/agent-eval';
 import './runtime-hooks-C7JwKb9E.js';
 

package/dist/workflow.js

@@ -2,7 +2,7 @@ import {
   createSandboxForSpec,
   describeSandboxPlacement,
   runLoop
-} from "./chunk-PXUTIMGJ.js";
+} from "./chunk-FQH33M5N.js";
 import {
   ValidationError,
   extractLlmCallEvent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-runtime",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "description": "Shared task-lifecycle skeleton for agents: a recursive loop kernel for chat turns, one-shot tasks, and multi-attempt loops, with trace capture and eval-gated self-improvement. Domain behavior lives in adapters; scoring and ship-gates in @tangle-network/agent-eval.",
   "homepage": "https://github.com/tangle-network/agent-runtime#readme",
   "repository": {
@@ -39,6 +39,11 @@
       "import": "./dist/agent.js",
       "default": "./dist/agent.js"
     },
+    "./intelligence": {
+      "types": "./dist/intelligence.d.ts",
+      "import": "./dist/intelligence.js",
+      "default": "./dist/intelligence.js"
+    },
     "./runtime": {
       "types": "./dist/runtime.d.ts",
       "import": "./dist/runtime.js",

package/dist/chunk-GHX7XOJ2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/mcp/detached-turn.ts","../src/mcp/executor.ts","../src/mcp/delegates.ts"],"sourcesContent":["/**\n * @experimental\n *\n * Detached delegation turns over the sandbox SDK's `driveTurn` primitive.\n *\n * Two halves of one story:\n *\n *   - {@link runDetachedTurn} — the dispatch side. A single-session delegate\n *     (single-variant coder / researcher) acquires a box, binds the sandbox id\n *     into the record's `detachedSessionRef`, then advances the turn with\n *     repeated `driveTurn` ticks instead of holding a live SSE stream. The\n *     session id is deterministic and supplied at submit time, so a process\n *     crash between ticks loses nothing — the turn keeps running in the box.\n *\n *   - {@link createDriveTurnResumeDriver} — the resume side. A\n *     `DelegationResumeDriver` that re-attaches restored in-flight records to\n *     their detached runs: parse the record's ref, resolve the box, advance the\n *     turn one `driveTurn` pass per `tick()`, and map the SDK's three states\n *     (`completed | running | failed`) onto `DelegationResumeTick`.\n *\n * Both sides type the box structurally ({@link DriveTurnCapableBox}) so tests\n * inject fakes and the module never requires the sandbox SDK at runtime — the\n * SDK stays an optional peer, exactly like the executors' `SandboxClient` seam.\n *\n * Tradeoffs of detached mode (why it is opt-in, not the default): a detached\n * turn yields one terminal payload instead of a live event stream, so per-token\n * loop trace events and kernel token/cost aggregation are not produced for that\n * turn. Multi-variant fanout stays on the streaming `runLoop` path — N\n * concurrent sessions cannot be expressed as one resume key, and winner\n * selection needs every candidate.\n */\n\nimport type { SandboxEvent } from '@tangle-network/sandbox'\nimport { ValidationError } from '../errors'\nimport type { AgentRunSpec, SandboxClient } from '../runtime'\nimport { createSandboxForSpec } from '../runtime'\nimport { deleteBoxSafe, sleep, throwAbort, throwIfAborted } from '../runtime/util'\nimport type { DelegationRecord, DelegationResumeDriver, DelegationResumeTick } from './task-queue'\nimport type { DelegationProgress, DelegationResultPayload } from './types'\n\nconst DEFAULT_TICK_INTERVAL_MS = 5000\n\n/**\n * Structural mirror of the sandbox SDK's `TurnDriveResult` (>= 0.6).\n * Discriminated on `state`; `failed` is terminal and deterministic per the\n * SDK contract — re-invoking with the same ids returns the same outcome.\n *\n * @experimental\n */\nexport type DriveTurnTick =\n  | { state: 'completed'; text: string; result: Record<string, unknown> }\n  | { state: 'running'; startedAt?: Date; elapsedMs?: number }\n  | { state: 'failed'; error: string }\n\n/**\n * The box surface detached turns need. `SandboxInstance`\n * (`@tangle-network/sandbox` >= 0.6) satisfies it structurally; tests pass\n * in-memory fakes. `_sessionCancel` is the SDK's remote-cancellation surface —\n * optional here because older SDKs / fakes may not expose it; when present it\n * is invoked on abort so the remote run actually stops.\n *\n * @experimental\n */\nexport interface DriveTurnCapableBox {\n  driveTurn(\n    message: string,\n    opts: { sessionId: string; turnId?: string; wallCapMs?: number },\n  ): Promise<DriveTurnTick>\n  _sessionCancel?(id: string): Promise<void>\n}\n\n/**\n * Decoded `DelegationRecord.detachedSessionRef`. `sandboxId` is absent between\n * submit and box acquisition — a record restored in that window is not\n * resumable (there is no box to resume on) and the resume driver fails it\n * loud rather than dispatching onto a guessed box.\n *\n * @experimental\n */\nexport interface DetachedSessionRefParts {\n  sessionId: string\n  sandboxId?: string\n}\n\n/**\n * Encode ref parts into the JSON-safe string stored on the record:\n * `session=<id>` before the box exists, `sandbox=<id>;session=<id>` once\n * bound. Ids must not contain the `;`/`=` delimiters.\n *\n * @experimental\n */\nexport function formatDetachedSessionRef(parts: DetachedSessionRefParts): string {\n  assertRefComponent('sessionId', parts.sessionId)\n  if (parts.sandboxId === undefined) return `session=${parts.sessionId}`\n  assertRefComponent('sandboxId', parts.sandboxId)\n  return `sandbox=${parts.sandboxId};session=${parts.sessionId}`\n}\n\n/** @experimental Inverse of {@link formatDetachedSessionRef}; throws `ValidationError` on malformed input. */\nexport function parseDetachedSessionRef(raw: string): DetachedSessionRefParts {\n  const fields = new Map<string, string>()\n  for (const pair of raw.split(';')) {\n    const eq = pair.indexOf('=')\n    const key = eq === -1 ? '' : pair.slice(0, eq)\n    const value = eq === -1 ? '' : pair.slice(eq + 1)\n    if ((key !== 'session' && key !== 'sandbox') || value.length === 0 || fields.has(key)) {\n      throw new ValidationError(\n        `parseDetachedSessionRef: malformed detachedSessionRef ${JSON.stringify(raw)} — expected \"session=<id>\" or \"sandbox=<id>;session=<id>\"`,\n      )\n    }\n    fields.set(key, value)\n  }\n  const sessionId = fields.get('session')\n  if (!sessionId) {\n    throw new ValidationError(\n      `parseDetachedSessionRef: detachedSessionRef ${JSON.stringify(raw)} carries no session id`,\n    )\n  }\n  const sandboxId = fields.get('sandbox')\n  return { sessionId, ...(sandboxId !== undefined ? { sandboxId } : {}) }\n}\n\nfunction assertRefComponent(name: string, value: string): void {\n  if (value.length === 0 || value.includes(';') || value.includes('=')) {\n    throw new ValidationError(\n      `formatDetachedSessionRef: ${name} ${JSON.stringify(value)} must be non-empty and free of \";\" / \"=\"`,\n    )\n  }\n}\n\n/** @experimental The terminal payload of a finished detached turn. */\nexport interface DetachedTurn {\n  /** Final assistant text. */\n  text: string\n  /** The SDK's cached AgentExecutionResult-shape record for the turn. */\n  result: Record<string, unknown>\n}\n\n/**\n * Synthesize the terminal event array a detached turn settles through. Shaped\n * so the existing event-stream output adapters (coder, researcher) parse it:\n * `data.result` for adapters that read a structured terminal record, `data.text`\n * for adapters that scan assistant text for the fenced result block.\n *\n * @experimental\n */\nexport function detachedTurnEvents(sessionId: string, turn: DetachedTurn): SandboxEvent[] {\n  return [\n    {\n      type: 'result',\n      id: sessionId,\n      data: {\n        text: turn.text,\n        finalText: turn.text,\n        success: true,\n        result: turn.result,\n      },\n    } as SandboxEvent,\n  ]\n}\n\n/** @experimental */\nexport interface RunDetachedTurnOptions {\n  /** Sandbox client used to acquire the box (the delegate's executor client). */\n  client: SandboxClient\n  /** Profile + overrides for box acquisition — same spec the streaming path uses. */\n  spec: AgentRunSpec<unknown>\n  /** The full turn prompt; consumed by `driveTurn`'s dispatch leg. */\n  prompt: string\n  /** Deterministic resume key, minted at submit time (`parseDetachedSessionRef(ref).sessionId`). */\n  sessionId: string\n  /**\n   * Called once the box exists, with its sandbox id. Callers persist\n   * `formatDetachedSessionRef({ sandboxId, sessionId })` onto the record here so\n   * a restart can resolve the box again.\n   */\n  bindSandbox(sandboxId: string): void\n  signal: AbortSignal\n  report(progress: DelegationProgress): void\n  /** Delay between `running` ticks (ms). Default 5000. */\n  tickIntervalMs?: number\n  /** Wall-clock cap forwarded to `driveTurn` — the SDK cancels and fails a session past it. */\n  wallCapMs?: number\n}\n\n/**\n * Dispatch one detached turn and advance it to a terminal state with\n * `driveTurn` ticks. The first tick dispatches (idempotent on `sessionId`);\n * subsequent ticks poll. On abort the remote session is cancelled via\n * `_sessionCancel` when the box exposes it. The box is torn down on every\n * in-process exit path (success, failure, abort) — only a process death skips\n * teardown, which is exactly the case the resume driver re-attaches to.\n *\n * @experimental\n */\nexport async function runDetachedTurn(options: RunDetachedTurnOptions): Promise<DetachedTurn> {\n  const intervalMs = options.tickIntervalMs ?? DEFAULT_TICK_INTERVAL_MS\n  const box = await createSandboxForSpec(options.client, options.spec, options.signal)\n  const drive = box as Partial<DriveTurnCapableBox>\n  const onAbort = () => {\n    void drive._sessionCancel?.(options.sessionId).catch(() => {})\n  }\n  try {\n    if (typeof drive.driveTurn !== 'function') {\n      throw new ValidationError(\n        'runDetachedTurn: the acquired sandbox exposes no driveTurn(message, { sessionId }) — ' +\n          'detached dispatch requires @tangle-network/sandbox >= 0.6 and a session-backed ' +\n          'placement (sibling/fleet); disable detached dispatch for this executor.',\n      )\n    }\n    const sandboxId = (box as { id?: unknown }).id\n    if (typeof sandboxId !== 'string' || sandboxId.length === 0) {\n      throw new ValidationError(\n        'runDetachedTurn: the acquired sandbox carries no id — without it the detached run ' +\n          'cannot be resumed after a restart, so refusing to dispatch detached.',\n      )\n    }\n    options.bindSandbox(sandboxId)\n    options.signal.addEventListener('abort', onAbort, { once: true })\n    for (;;) {\n      throwIfAborted(options.signal)\n      const tick = await drive.driveTurn(options.prompt, {\n        sessionId: options.sessionId,\n        turnId: options.sessionId,\n        ...(options.wallCapMs !== undefined ? { wallCapMs: options.wallCapMs } : {}),\n      })\n      throwIfAborted(options.signal)\n      if (tick.state === 'completed') return { text: tick.text, result: tick.result }\n      if (tick.state === 'failed') {\n        throw new Error(`detached turn ${options.sessionId} failed: ${tick.error}`)\n      }\n      options.report({ iteration: 0, phase: detachedRunningPhase(tick.elapsedMs) })\n      await sleep(intervalMs, options.signal)\n    }\n  } finally {\n    options.signal.removeEventListener('abort', onAbort)\n    if (options.signal.aborted) onAbort()\n    await deleteBoxSafe(box)\n  }\n}\n\nfunction detachedRunningPhase(elapsedMs: number | undefined): string {\n  return elapsedMs === undefined\n    ? 'detached-running'\n    : `detached-running ${Math.round(elapsedMs / 1000)}s`\n}\n\n/** @experimental */\nexport interface DriveTurnResumeDriverOptions {\n  /**\n   * Resolve the live box owning a detached session. The bin wires this to the\n   * sandbox client's `get(sandboxId)`; throw when the box no longer exists —\n   * a thrown tick settles the record as failed, which is the truth.\n   */\n  resolveSandbox(sandboxId: string): Promise<DriveTurnCapableBox>\n  /**\n   * Rebuild the turn prompt from the persisted record. Only consumed by\n   * `driveTurn`'s dispatch leg — i.e. when the previous process died after\n   * binding the box but before the session was dispatched. Must reproduce the\n   * prompt the delegate would have sent.\n   */\n  buildMessage(record: DelegationRecord): string\n  /**\n   * Map a completed turn onto the delegation's typed output payload (parse +\n   * validate per profile). Throw when the resumed result does not pass the\n   * profile's gate — the queue settles the record as failed with that error.\n   */\n  settleOutput(\n    turn: DetachedTurn,\n    record: DelegationRecord,\n    ctx: { signal: AbortSignal },\n  ): Promise<DelegationResultPayload['output']> | DelegationResultPayload['output']\n  /** Delay between `running` ticks (ms). Default 5000. */\n  intervalMs?: number\n  /** Wall-clock cap forwarded to `driveTurn` on every tick. */\n  wallCapMs?: number\n}\n\n/**\n * Build the `driveTurn`-backed {@link DelegationResumeDriver}. Each `tick()`\n * is one settle/poll/dispatch pass:\n *\n *   - ref without a sandbox binding → `failed` (`DetachedSessionUnboundError`):\n *     the previous process died before a box existed; there is nothing to resume.\n *   - `driveTurn` `completed` → `settleOutput` → `completed` tick.\n *   - `running` → progress via `ctx.report`, `running` tick (queue re-ticks\n *     after `intervalMs`).\n *   - `failed` → `failed` tick (`DetachedTurnFailedError`) — terminal per the\n *     SDK's deterministic-failure contract.\n *\n * Abort: the queue stops ticking once `cancel()` flips the record, so remote\n * cancellation is hooked onto `ctx.signal` (once per task) and fires\n * `_sessionCancel` when the SDK surface exposes it. The driver never deletes\n * boxes — it cannot know whether `sandboxId` is a disposable sibling or a\n * fleet machine, and destroying a fleet machine would be unrecoverable.\n *\n * @experimental\n */\nexport function createDriveTurnResumeDriver(\n  options: DriveTurnResumeDriverOptions,\n): DelegationResumeDriver {\n  const cancelHooked = new Set<string>()\n  return {\n    intervalMs: options.intervalMs ?? DEFAULT_TICK_INTERVAL_MS,\n    async tick({ record, detachedSessionRef }, ctx): Promise<DelegationResumeTick> {\n      const ref = parseDetachedSessionRef(detachedSessionRef)\n      if (ref.sandboxId === undefined) {\n        return {\n          state: 'failed',\n          error: {\n            message:\n              `detached session \"${ref.sessionId}\" was never bound to a sandbox — the previous ` +\n              'process died before the box was acquired, so the turn was never dispatched and ' +\n              'cannot be resumed',\n            kind: 'DetachedSessionUnboundError',\n          },\n        }\n      }\n      const box = await options.resolveSandbox(ref.sandboxId)\n      if (!cancelHooked.has(record.taskId)) {\n        cancelHooked.add(record.taskId)\n        ctx.signal.addEventListener(\n          'abort',\n          () => {\n            void box._sessionCancel?.(ref.sessionId).catch(() => {})\n          },\n          { once: true },\n        )\n      }\n      if (ctx.signal.aborted) throwAbort()\n      const tick = await box.driveTurn(options.buildMessage(record), {\n        sessionId: ref.sessionId,\n        turnId: ref.sessionId,\n        ...(options.wallCapMs !== undefined ? { wallCapMs: options.wallCapMs } : {}),\n      })\n      if (tick.state === 'completed') {\n        const output = await options.settleOutput(\n          { text: tick.text, result: tick.result },\n          record,\n          {\n            signal: ctx.signal,\n          },\n        )\n        return { state: 'completed', output }\n      }\n      if (tick.state === 'failed') {\n        return {\n          state: 'failed',\n          error: {\n            message: `detached turn ${ref.sessionId} failed: ${tick.error}`,\n            kind: 'DetachedTurnFailedError',\n          },\n        }\n      }\n      ctx.report({ iteration: 0, phase: detachedRunningPhase(tick.elapsedMs) })\n      return { state: 'running' }\n    },\n  }\n}\n","/**\n * @experimental\n *\n * Delegation executors — the layer between MCP delegates and the sandbox\n * substrate. Each executor exposes a {@link SandboxClient} the kernel\n * consumes plus a placement tag so the trace pipeline can correlate workers\n * with their physical placement.\n *\n * Two implementations ship in-box:\n *\n * - {@link createSiblingSandboxExecutor} — every delegation spawns a fresh\n *   sandbox sibling to the caller. Default when the MCP server runs as a\n *   standalone CLI mounted outside a fleet.\n *\n * - {@link createFleetWorkspaceExecutor} — delegations dispatch onto machines\n *   in the caller's existing fleet so worker diffs land directly on the\n *   caller's filesystem (the fleet's shared workspace). Selected when the\n *   parent sandbox passes `TANGLE_FLEET_ID` into the MCP server's env.\n */\n\nimport type { CreateSandboxOptions, SandboxInstance } from '@tangle-network/sandbox'\nimport type { LoopSandboxPlacement, SandboxClient } from '../runtime'\n\n/** @experimental */\nexport interface DelegationExecutor {\n  /** Sandbox client the kernel calls. Returned with `describePlacement` set. */\n  readonly client: SandboxClient\n  /** Best-effort one-liner used in stderr boot logs and diagnostics. */\n  describe(): string\n  /**\n   * Where delegated work physically runs. `sibling` and `fleet` placements are\n   * session-backed (boxes expose `driveTurn`, so detached dispatch + resume\n   * apply); `in-process` spawns local harness CLIs with no sandbox session to\n   * detach. Optional so consumer-implemented executors stay source-compatible;\n   * absent means \"unknown\" and detached dispatch is not enabled for it.\n   */\n  readonly placement?: 'sibling' | 'fleet' | 'in-process'\n}\n\n/** @experimental */\nexport interface SiblingSandboxExecutorOptions {\n  client: SandboxClient\n}\n\n/**\n * Wrap a raw sandbox SDK client so the kernel emits\n * `loop.iteration.dispatch` events with `{ placement: 'sibling', sandboxId }`.\n *\n * The returned client `.create()` delegates to the underlying client; the\n * only added behavior is a `describePlacement` tag the kernel reads.\n *\n * @experimental\n */\nexport function createSiblingSandboxExecutor(\n  options: SiblingSandboxExecutorOptions,\n): DelegationExecutor {\n  const underlying = options.client\n  const client: SandboxClient = {\n    create(opts?: CreateSandboxOptions): Promise<SandboxInstance> {\n      return underlying.create(opts)\n    },\n    describePlacement(box: SandboxInstance): LoopSandboxPlacement {\n      return { kind: 'sibling', sandboxId: readId(box) }\n    },\n  }\n  return {\n    client,\n    placement: 'sibling',\n    describe(): string {\n      return 'sibling-sandbox (each delegation = fresh sandbox via client.create)'\n    },\n  }\n}\n\n/**\n * Minimal `SandboxFleet` surface the fleet executor calls. Declared\n * structurally so tests can pass an in-memory stub without instantiating the\n * sandbox SDK.\n *\n * @experimental\n */\nexport interface FleetHandle {\n  readonly fleetId: string\n  /** Machine ids in dispatch-eligible order. The executor round-robins. */\n  readonly ids: ReadonlyArray<string>\n  /** Resolve a machine id to its `SandboxInstance` — that machine is mounted\n   * on the fleet's shared workspace, so any diff the worker writes lands on\n   * every other fleet machine's filesystem too. */\n  sandbox(machineId: string): Promise<SandboxInstance>\n}\n\n/** @experimental */\nexport interface FleetWorkspaceExecutorOptions {\n  fleet: FleetHandle\n  /**\n   * Override the machine-selection policy. Default = round-robin across\n   * `fleet.ids`, skipping the optional `excludeMachineIds` set (typically the\n   * coordinator machine the MCP server is running on).\n   */\n  selectMachine?: (call: { callIndex: number; ids: ReadonlyArray<string> }) => string\n  /**\n   * Machine ids to skip during default round-robin. Set to the caller's own\n   * machineId so workers don't compete with the orchestrator on the same VM.\n   */\n  excludeMachineIds?: ReadonlyArray<string>\n}\n\n/**\n * Build an executor that resolves each delegated iteration to an existing\n * machine in `fleet`. The fleet's shared-workspace policy means the worker\n * machine sees the caller's filesystem — diffs land in-place with no\n * cross-sandbox copy step.\n *\n * @experimental\n */\nexport function createFleetWorkspaceExecutor(\n  options: FleetWorkspaceExecutorOptions,\n): DelegationExecutor {\n  const fleet = options.fleet\n  const exclude = new Set(options.excludeMachineIds ?? [])\n  let callIndex = 0\n  // machineId-by-sandboxId, populated as we resolve machines so\n  // `describePlacement` can recover the assignment from the SandboxInstance\n  // the kernel hands back.\n  const placementBySandboxId = new Map<string, { machineId: string }>()\n\n  const client: SandboxClient = {\n    async create(): Promise<SandboxInstance> {\n      const ids = fleet.ids.filter((id) => !exclude.has(id))\n      if (ids.length === 0) {\n        throw new Error(\n          `agent-runtime: fleet ${fleet.fleetId} has no eligible worker machines (ids=[${fleet.ids.join(',')}], excluded=[${[...exclude].join(',')}])`,\n        )\n      }\n      const selector = options.selectMachine\n      const machineId = selector ? selector({ callIndex, ids }) : ids[callIndex % ids.length]\n      callIndex += 1\n      if (typeof machineId !== 'string' || machineId.length === 0) {\n        throw new Error('agent-runtime: fleet executor selectMachine returned an empty machine id')\n      }\n      const box = await fleet.sandbox(machineId)\n      const sandboxId = readId(box)\n      if (sandboxId) placementBySandboxId.set(sandboxId, { machineId })\n      return box\n    },\n    describePlacement(box: SandboxInstance): LoopSandboxPlacement {\n      const sandboxId = readId(box)\n      const recorded = sandboxId ? placementBySandboxId.get(sandboxId) : undefined\n      return {\n        kind: 'fleet',\n        sandboxId,\n        fleetId: fleet.fleetId,\n        machineId: recorded?.machineId,\n      }\n    },\n  }\n\n  return {\n    client,\n    placement: 'fleet',\n    describe(): string {\n      const excluded = exclude.size > 0 ? ` (excluded=[${[...exclude].join(',')}])` : ''\n      return `fleet-workspace (fleetId=${fleet.fleetId}, machines=[${fleet.ids.join(',')}]${excluded})`\n    },\n  }\n}\n\nfunction readId(box: SandboxInstance): string | undefined {\n  const raw = (box as unknown as { id?: unknown }).id\n  return typeof raw === 'string' && raw.length > 0 ? raw : undefined\n}\n","/**\n * @experimental\n *\n * Delegate factories — the layer between MCP tool handlers and the\n * underlying `runLoop` runners.\n *\n * The MCP server is profile-agnostic: it owns the task queue + feedback\n * store + transport. Each `*Delegate` is the closure that the queue\n * invokes when a task runs. Consumers can override either delegate to\n * inject custom drivers, mocks, fleet-aware dispatchers, etc.\n *\n * The default coder delegate is wired here because we own\n * `coderProfile` / `multiHarnessCoderFanout`. The default researcher\n * delegate is **not** wired in this file — `agent-knowledge` cannot be\n * imported from `agent-runtime` without inducing a cycle. Consumers\n * pass `researcherDelegate` explicitly when constructing the server.\n */\n\nimport { type CoderOutput, coderProfile, multiHarnessCoderFanout } from '../profiles/coder'\nimport type { AgentRunSpec, Iteration, LoopTraceEmitter, SandboxClient } from '../runtime'\nimport { runLoop } from '../runtime'\nimport {\n  type DetachedTurn,\n  detachedTurnEvents,\n  formatDetachedSessionRef,\n  parseDetachedSessionRef,\n  runDetachedTurn,\n} from './detached-turn'\nimport { createSiblingSandboxExecutor, type DelegationExecutor } from './executor'\nimport type {\n  CoderTask,\n  DelegateCodeArgs,\n  DelegateResearchArgs,\n  DelegateUiAuditArgs,\n  DelegationProgress,\n  ResearchOutputShape,\n  UiAuditorDelegationOutput,\n} from './types'\n\n/** @experimental */\nexport interface DelegateRunCtx {\n  signal: AbortSignal\n  report(progress: DelegationProgress): void\n  /**\n   * Detached-run resume key recorded on the queue record at submit time\n   * (`formatDetachedSessionRef`). Present only when the submit path requested\n   * detached dispatch — its presence is what routes a session-backed delegate\n   * onto the `driveTurn` tick path instead of holding a stream.\n   */\n  detachedSessionRef?: string\n  /** Rebind the record's resume key (e.g. once the sandbox id is known). */\n  updateDetachedSessionRef?(ref: string): void\n}\n\n/** @experimental */\nexport type CoderDelegate = (\n  args: DelegateCodeArgs,\n  ctx: DelegateRunCtx,\n) => Promise<import('../profiles/coder').CoderOutput>\n\n/** @experimental */\nexport type ResearcherDelegate = (\n  args: DelegateResearchArgs,\n  ctx: DelegateRunCtx,\n) => Promise<ResearchOutputShape>\n\n/**\n * UI-auditor delegate — fully consumer-injected. agent-runtime ships no\n * default factory because the inputs are workspace path + judge function\n * + (optionally) a `SandboxClient`, and the judge is the consumer's\n * model seam. See `createInProcessUiAuditClient` + `uiAuditorProfile` in\n * `@tangle-network/agent-runtime/profiles` for the canonical wiring.\n *\n * @experimental\n */\nexport type UiAuditorDelegate = (\n  args: DelegateUiAuditArgs,\n  ctx: DelegateRunCtx,\n) => Promise<UiAuditorDelegationOutput>\n\n/** @experimental Structured review verdict over a coder candidate. */\nexport interface CoderReview {\n  /** Gate: only approved candidates are eligible to win. */\n  approved: boolean\n  /** Reviewer's recommendation — surfaced in traces. */\n  recommendation: 'ship' | 'approve-with-nits' | 'changes-requested' | 'reject'\n  /** Readiness 0..1, used by the `highest-readiness` winner-selection strategy. */\n  readiness: number\n  notes?: string\n}\n\n/**\n * @experimental\n *\n * Optional adversarial reviewer over a coder candidate that already passed\n * mechanical validation (tests/typecheck/forbidden/diff/no-op/secrets). Folded\n * from the ai-trading-blueprint delegation MCP: a candidate is only eligible to\n * win if the reviewer approves it. The reviewer is the consumer's seam — an LLM\n * judge, a `pnpm review` command, anything returning a `CoderReview`.\n */\nexport type CoderReviewer = (\n  output: import('../profiles/coder').CoderOutput,\n  task: CoderTask,\n  ctx: { signal: AbortSignal },\n) => Promise<CoderReview> | CoderReview\n\n/**\n * @experimental Winner-selection strategy among validated (+ reviewed)\n * candidates. `highest-readiness` requires a `reviewer`. Default `highest-score`\n * (the kernel's behavior — preserves backward compatibility).\n */\nexport type CoderWinnerSelection =\n  | 'highest-score'\n  | 'smallest-diff'\n  | 'highest-readiness'\n  | 'first-approved'\n\n/** @experimental */\nexport interface CreateDefaultCoderDelegateOptions {\n  /**\n   * Execution placement. Pass a {@link DelegationExecutor} (sibling or fleet)\n   * to control where worker iterations land. `sandboxClient` is a\n   * convenience shorthand that wraps the client in a sibling executor — pass\n   * one or the other, not both.\n   */\n  executor?: DelegationExecutor\n  /**\n   * Convenience shorthand for sibling placement. Equivalent to\n   * `executor: createSiblingSandboxExecutor({ client: sandboxClient })`.\n   */\n  sandboxClient?: SandboxClient\n  /** Backend harness for the single-coder path. Default comes from `coderProfile`. */\n  harness?: string\n  /** Model override for the single-coder path. */\n  model?: string\n  /** Default `['claude-code', 'codex', 'opencode/zai-coding-plan/glm-5.1']` when variants > 1. */\n  fanoutHarnesses?: string[]\n  /** Optional per-harness model override for `variants > 1`. */\n  fanoutModels?: (string | undefined)[]\n  /** Hard cap on the kernel's per-batch concurrency. Default 4. */\n  maxConcurrency?: number\n  /**\n   * Optional adversarial reviewer. When set, a candidate must pass mechanical\n   * validation AND `reviewer.approved` to be eligible to win — empty/secret/\n   * test-failing patches are already gone; this catches the \"compiles + passes\n   * but wrong/unsafe\" class the deterministic validator can't see.\n   */\n  reviewer?: CoderReviewer\n  /** Winner-selection strategy among eligible candidates. Default `highest-score`. */\n  winnerSelection?: CoderWinnerSelection\n  /**\n   * Loop trace emitter forwarded into every delegated `runLoop`. Wire\n   * `createPropagatingTraceEmitter(readTraceContextFromEnv())` here (the bin\n   * does) so delegated build-loops export their topology spans to the OTLP /\n   * Tangle Intelligence sink when `OTEL_EXPORTER_OTLP_ENDPOINT` is set — and\n   * are a cheap no-op when it isn't. Configurable by construction.\n   *\n   * Detached single-variant turns (taken when `ctx.detachedSessionRef` is set)\n   * bypass `runLoop` and therefore emit no loop trace events for that turn.\n   */\n  traceEmitter?: LoopTraceEmitter\n  /** Tick cadence (ms) for the detached single-variant path. Default 5000. */\n  detachedTickIntervalMs?: number\n  /** Wall-clock cap (ms) forwarded to `driveTurn` for detached turns. */\n  detachedWallCapMs?: number\n}\n\n/**\n * Build a coder delegate that drives `runLoop` against the project's\n * sandbox client + coder profile. When `args.variants > 1` it switches\n * to the multi-harness fanout topology.\n *\n * @experimental\n */\nexport function createDefaultCoderDelegate(\n  options: CreateDefaultCoderDelegateOptions,\n): CoderDelegate {\n  const executor = resolveExecutor(options)\n  const sandboxClient = executor.client\n  const fanoutHarnesses = options.fanoutHarnesses\n  const maxConcurrency = options.maxConcurrency ?? 4\n  const traceEmitter = options.traceEmitter\n  return async (args, ctx) => {\n    const task = coderTaskFromArgs(args)\n    const variants = Math.max(1, Math.trunc(args.variants ?? 1))\n    ctx.report({ iteration: 0, phase: 'starting' })\n    if (variants <= 1) {\n      const { agentRunSpec, output, validator } = coderProfile({\n        task,\n        ...(options.harness ? { harness: options.harness } : {}),\n        ...(options.model ? { model: options.model } : {}),\n      })\n      // Detached dispatch: one session on one box, driven by `driveTurn` ticks\n      // instead of a held stream, so the run survives an MCP-process restart\n      // (the resume driver re-attaches via the persisted ref). Only the\n      // single-variant path detaches — fanout needs N sessions + winner\n      // selection over every candidate, which one resume key cannot express.\n      if (ctx.detachedSessionRef !== undefined && ctx.updateDetachedSessionRef) {\n        const { sessionId } = parseDetachedSessionRef(ctx.detachedSessionRef)\n        const rebind = ctx.updateDetachedSessionRef\n        const turn = await runDetachedTurn({\n          client: sandboxClient,\n          spec: agentRunSpec as AgentRunSpec<unknown>,\n          prompt: agentRunSpec.taskToPrompt(task),\n          sessionId,\n          bindSandbox: (sandboxId) => rebind(formatDetachedSessionRef({ sandboxId, sessionId })),\n          signal: ctx.signal,\n          report: ctx.report,\n          ...(options.detachedTickIntervalMs !== undefined\n            ? { tickIntervalMs: options.detachedTickIntervalMs }\n            : {}),\n          ...(options.detachedWallCapMs !== undefined\n            ? { wallCapMs: options.detachedWallCapMs }\n            : {}),\n        })\n        const chosen = await settleDetachedCoderTurn(turn, {\n          task,\n          sessionId,\n          signal: ctx.signal,\n          ...(options.harness ? { harness: options.harness } : {}),\n          ...(options.model ? { model: options.model } : {}),\n          ...(options.reviewer ? { reviewer: options.reviewer } : {}),\n        })\n        ctx.report({ iteration: 1, phase: 'completed' })\n        return chosen\n      }\n      const result = await runLoop({\n        driver: singleShotDriver,\n        agentRun: agentRunSpec,\n        output,\n        validator,\n        task,\n        ctx: { sandboxClient, signal: ctx.signal, ...(traceEmitter ? { traceEmitter } : {}) },\n        maxIterations: 1,\n        maxConcurrency,\n      })\n      const chosen = await pickCoderWinner({\n        iterations: result.iterations,\n        reviewer: options.reviewer,\n        selection: options.winnerSelection ?? 'highest-score',\n        task,\n        signal: ctx.signal,\n      })\n      if (!chosen) throw new Error(noWinnerMessage(options.reviewer))\n      ctx.report({ iteration: 1, phase: 'completed' })\n      return chosen\n    }\n    const fanout = multiHarnessCoderFanout({\n      ...(fanoutHarnesses && fanoutHarnesses.length > 0\n        ? { harnesses: fanoutHarnesses.slice(0, variants) }\n        : {}),\n      ...(options.fanoutModels ? { models: options.fanoutModels.slice(0, variants) } : {}),\n    })\n    const agentRuns = fanout.agentRuns.slice(0, variants)\n    const result = await runLoop({\n      driver: fanout.driver,\n      agentRuns,\n      output: fanout.output,\n      validator: fanout.validator,\n      task,\n      ctx: { sandboxClient, signal: ctx.signal, ...(traceEmitter ? { traceEmitter } : {}) },\n      maxIterations: variants,\n      maxConcurrency: Math.min(maxConcurrency, variants),\n    })\n    const chosen = await pickCoderWinner({\n      iterations: result.iterations,\n      reviewer: options.reviewer,\n      selection: options.winnerSelection ?? 'highest-score',\n      task,\n      signal: ctx.signal,\n    })\n    if (!chosen) throw new Error(noWinnerMessage(options.reviewer))\n    ctx.report({ iteration: agentRuns.length, phase: 'completed' })\n    return chosen\n  }\n}\n\ninterface PickCoderWinnerArgs {\n  iterations: ReadonlyArray<Iteration<CoderTask, CoderOutput>>\n  reviewer: CoderReviewer | undefined\n  selection: CoderWinnerSelection\n  task: CoderTask\n  signal: AbortSignal\n}\n\ninterface CoderCandidate {\n  index: number\n  output: CoderOutput\n  score: number\n  readiness: number\n}\n\n/**\n * Pick the winning coder candidate from a finished loop's iterations:\n *   1. keep only mechanically-VALID candidates (the validator already gated\n *      tests/typecheck/forbidden/diff/no-op/secrets),\n *   2. if a `reviewer` is wired, keep only those it APPROVES,\n *   3. select among survivors by the chosen strategy.\n * Returns `undefined` when nothing survives — the delegate fails loud.\n */\nasync function pickCoderWinner(args: PickCoderWinnerArgs): Promise<CoderOutput | undefined> {\n  const valid: CoderCandidate[] = []\n  for (const iter of args.iterations) {\n    if (iter.output === undefined || iter.error || iter.verdict?.valid !== true) continue\n    valid.push({\n      index: iter.index,\n      output: iter.output,\n      score: iter.verdict.score ?? 0,\n      readiness: iter.verdict.score ?? 0,\n    })\n  }\n  if (valid.length === 0) return undefined\n\n  let eligible = valid\n  if (args.reviewer) {\n    eligible = []\n    for (const c of valid) {\n      const review = await args.reviewer(c.output, args.task, { signal: args.signal })\n      if (review.approved) eligible.push({ ...c, readiness: review.readiness })\n    }\n    if (eligible.length === 0) return undefined\n  }\n\n  return selectCoderCandidate(eligible, args.selection).output\n}\n\n/** Apply the winner-selection strategy; ties broken by earliest iteration. */\nfunction selectCoderCandidate(\n  candidates: CoderCandidate[],\n  selection: CoderWinnerSelection,\n): CoderCandidate {\n  const diffLines = (c: CoderCandidate) =>\n    c.output.diffStats.insertions + c.output.diffStats.deletions\n  const sorted = [...candidates].sort((a, b) => {\n    switch (selection) {\n      case 'smallest-diff':\n        return diffLines(a) - diffLines(b) || a.index - b.index\n      case 'highest-readiness':\n        return b.readiness - a.readiness || a.index - b.index\n      case 'first-approved':\n        return a.index - b.index\n      default:\n        return b.score - a.score || a.index - b.index\n    }\n  })\n  return sorted[0]!\n}\n\nfunction noWinnerMessage(reviewer: CoderReviewer | undefined): string {\n  return reviewer\n    ? 'coder delegate: no candidate passed validation + review'\n    : 'coder delegate: no candidate passed validation'\n}\n\n/**\n * Canonical `DelegateCodeArgs` → `CoderTask` mapping — the single source for\n * the delegate's live dispatch AND the resume driver's settle/message\n * rebuilding, so a resumed record reproduces exactly the task the original\n * process dispatched.\n *\n * @experimental\n */\nexport function coderTaskFromArgs(args: DelegateCodeArgs): CoderTask {\n  return {\n    goal: buildCoderGoal(args),\n    repoRoot: args.repoRoot,\n    testCmd: args.config?.testCmd,\n    typecheckCmd: args.config?.typecheckCmd,\n    forbiddenPaths: args.config?.forbiddenPaths,\n    maxDiffLines: args.config?.maxDiffLines,\n  }\n}\n\n/** @experimental */\nexport interface SettleDetachedCoderTurnOptions {\n  task: CoderTask\n  /** Session id of the detached turn — used as the synthesized event id. */\n  sessionId: string\n  signal: AbortSignal\n  harness?: string\n  model?: string\n  /** Same gate as the streaming path: an unapproved candidate cannot win. */\n  reviewer?: CoderReviewer\n}\n\n/**\n * Settle a completed detached coder turn through the same gate the streaming\n * path applies: parse the terminal payload with the coder output adapter,\n * run the mechanical validator (tests/typecheck/forbidden/diff/no-op/secrets),\n * then the optional reviewer. Throws when nothing survives — a resumed or\n * detached run must not return an unvalidated patch.\n *\n * @experimental\n */\nexport async function settleDetachedCoderTurn(\n  turn: DetachedTurn,\n  options: SettleDetachedCoderTurnOptions,\n): Promise<CoderOutput> {\n  const { output, validator } = coderProfile({\n    task: options.task,\n    ...(options.harness ? { harness: options.harness } : {}),\n    ...(options.model ? { model: options.model } : {}),\n  })\n  const parsed = output.parse(detachedTurnEvents(options.sessionId, turn))\n  const verdict = await validator.validate(parsed, { iteration: 0, signal: options.signal })\n  if (verdict.valid !== true) throw new Error(noWinnerMessage(options.reviewer))\n  if (options.reviewer) {\n    const review = await options.reviewer(parsed, options.task, { signal: options.signal })\n    if (!review.approved) throw new Error(noWinnerMessage(options.reviewer))\n  }\n  return parsed\n}\n\nfunction buildCoderGoal(args: DelegateCodeArgs): string {\n  if (!args.contextHint) return args.goal\n  return [args.goal, '', '## Context', args.contextHint].join('\\n')\n}\n\nfunction resolveExecutor(options: CreateDefaultCoderDelegateOptions): DelegationExecutor {\n  if (options.executor && options.sandboxClient) {\n    throw new Error('createDefaultCoderDelegate: pass exactly one of `executor` or `sandboxClient`')\n  }\n  if (options.executor) return options.executor\n  if (options.sandboxClient) {\n    return createSiblingSandboxExecutor({ client: options.sandboxClient })\n  }\n  throw new Error('createDefaultCoderDelegate: `executor` or `sandboxClient` is required')\n}\n\n/**\n * Single-shot driver — plan one task on iteration 0, stop after one\n * iteration. Used by the coder delegate when `variants <= 1`. Keeps the\n * runLoop kernel-level accounting (timing, cost, trace emission) while\n * skipping fanout/refine topology overhead.\n */\nconst singleShotDriver = {\n  name: 'mcp-single-shot',\n  async plan<Task>(task: Task, history: ReadonlyArray<unknown>): Promise<Task[]> {\n    return history.length === 0 ? [task] : []\n  },\n  decide(history: ReadonlyArray<unknown>): 'pick-winner' | 'fail' {\n    return history.length > 0 ? 'pick-winner' : 'fail'\n  },\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAwCA,IAAM,2BAA2B;AAmD1B,SAAS,yBAAyB,OAAwC;AAC/E,qBAAmB,aAAa,MAAM,SAAS;AAC/C,MAAI,MAAM,cAAc,OAAW,QAAO,WAAW,MAAM,SAAS;AACpE,qBAAmB,aAAa,MAAM,SAAS;AAC/C,SAAO,WAAW,MAAM,SAAS,YAAY,MAAM,SAAS;AAC9D;AAGO,SAAS,wBAAwB,KAAsC;AAC5E,QAAM,SAAS,oBAAI,IAAoB;AACvC,aAAW,QAAQ,IAAI,MAAM,GAAG,GAAG;AACjC,UAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,UAAM,MAAM,OAAO,KAAK,KAAK,KAAK,MAAM,GAAG,EAAE;AAC7C,UAAM,QAAQ,OAAO,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC;AAChD,QAAK,QAAQ,aAAa,QAAQ,aAAc,MAAM,WAAW,KAAK,OAAO,IAAI,GAAG,GAAG;AACrF,YAAM,IAAI;AAAA,QACR,yDAAyD,KAAK,UAAU,GAAG,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,WAAO,IAAI,KAAK,KAAK;AAAA,EACvB;AACA,QAAM,YAAY,OAAO,IAAI,SAAS;AACtC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI;AAAA,MACR,+CAA+C,KAAK,UAAU,GAAG,CAAC;AAAA,IACpE;AAAA,EACF;AACA,QAAM,YAAY,OAAO,IAAI,SAAS;AACtC,SAAO,EAAE,WAAW,GAAI,cAAc,SAAY,EAAE,UAAU,IAAI,CAAC,EAAG;AACxE;AAEA,SAAS,mBAAmB,MAAc,OAAqB;AAC7D,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,GAAG,KAAK,MAAM,SAAS,GAAG,GAAG;AACpE,UAAM,IAAI;AAAA,MACR,6BAA6B,IAAI,IAAI,KAAK,UAAU,KAAK,CAAC;AAAA,IAC5D;AAAA,EACF;AACF;AAkBO,SAAS,mBAAmB,WAAmB,MAAoC;AACxF,SAAO;AAAA,IACL;AAAA,MACE,MAAM;AAAA,MACN,IAAI;AAAA,MACJ,MAAM;AAAA,QACJ,MAAM,KAAK;AAAA,QACX,WAAW,KAAK;AAAA,QAChB,SAAS;AAAA,QACT,QAAQ,KAAK;AAAA,MACf;AAAA,IACF;AAAA,EACF;AACF;AAoCA,eAAsB,gBAAgB,SAAwD;AAC5F,QAAM,aAAa,QAAQ,kBAAkB;AAC7C,QAAM,MAAM,MAAM,qBAAqB,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,MAAM;AACnF,QAAM,QAAQ;AACd,QAAM,UAAU,MAAM;AACpB,SAAK,MAAM,iBAAiB,QAAQ,SAAS,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC/D;AACA,MAAI;AACF,QAAI,OAAO,MAAM,cAAc,YAAY;AACzC,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,UAAM,YAAa,IAAyB;AAC5C,QAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,YAAM,IAAI;AAAA,QACR;AAAA,MAEF;AAAA,IACF;AACA,YAAQ,YAAY,SAAS;AAC7B,YAAQ,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAChE,eAAS;AACP,qBAAe,QAAQ,MAAM;AAC7B,YAAM,OAAO,MAAM,MAAM,UAAU,QAAQ,QAAQ;AAAA,QACjD,WAAW,QAAQ;AAAA,QACnB,QAAQ,QAAQ;AAAA,QAChB,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,qBAAe,QAAQ,MAAM;AAC7B,UAAI,KAAK,UAAU,YAAa,QAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,KAAK,OAAO;AAC9E,UAAI,KAAK,UAAU,UAAU;AAC3B,cAAM,IAAI,MAAM,iBAAiB,QAAQ,SAAS,YAAY,KAAK,KAAK,EAAE;AAAA,MAC5E;AACA,cAAQ,OAAO,EAAE,WAAW,GAAG,OAAO,qBAAqB,KAAK,SAAS,EAAE,CAAC;AAC5E,YAAM,MAAM,YAAY,QAAQ,MAAM;AAAA,IACxC;AAAA,EACF,UAAE;AACA,YAAQ,OAAO,oBAAoB,SAAS,OAAO;AACnD,QAAI,QAAQ,OAAO,QAAS,SAAQ;AACpC,UAAM,cAAc,GAAG;AAAA,EACzB;AACF;AAEA,SAAS,qBAAqB,WAAuC;AACnE,SAAO,cAAc,SACjB,qBACA,oBAAoB,KAAK,MAAM,YAAY,GAAI,CAAC;AACtD;AAqDO,SAAS,4BACd,SACwB;AACxB,QAAM,eAAe,oBAAI,IAAY;AACrC,SAAO;AAAA,IACL,YAAY,QAAQ,cAAc;AAAA,IAClC,MAAM,KAAK,EAAE,QAAQ,mBAAmB,GAAG,KAAoC;AAC7E,YAAM,MAAM,wBAAwB,kBAAkB;AACtD,UAAI,IAAI,cAAc,QAAW;AAC/B,eAAO;AAAA,UACL,OAAO;AAAA,UACP,OAAO;AAAA,YACL,SACE,qBAAqB,IAAI,SAAS;AAAA,YAGpC,MAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,MAAM,MAAM,QAAQ,eAAe,IAAI,SAAS;AACtD,UAAI,CAAC,aAAa,IAAI,OAAO,MAAM,GAAG;AACpC,qBAAa,IAAI,OAAO,MAAM;AAC9B,YAAI,OAAO;AAAA,UACT;AAAA,UACA,MAAM;AACJ,iBAAK,IAAI,iBAAiB,IAAI,SAAS,EAAE,MAAM,MAAM;AAAA,YAAC,CAAC;AAAA,UACzD;AAAA,UACA,EAAE,MAAM,KAAK;AAAA,QACf;AAAA,MACF;AACA,UAAI,IAAI,OAAO,QAAS,YAAW;AACnC,YAAM,OAAO,MAAM,IAAI,UAAU,QAAQ,aAAa,MAAM,GAAG;AAAA,QAC7D,WAAW,IAAI;AAAA,QACf,QAAQ,IAAI;AAAA,QACZ,GAAI,QAAQ,cAAc,SAAY,EAAE,WAAW,QAAQ,UAAU,IAAI,CAAC;AAAA,MAC5E,CAAC;AACD,UAAI,KAAK,UAAU,aAAa;AAC9B,cAAM,SAAS,MAAM,QAAQ;AAAA,UAC3B,EAAE,MAAM,KAAK,MAAM,QAAQ,KAAK,OAAO;AAAA,UACvC;AAAA,UACA;AAAA,YACE,QAAQ,IAAI;AAAA,UACd;AAAA,QACF;AACA,eAAO,EAAE,OAAO,aAAa,OAAO;AAAA,MACtC;AACA,UAAI,KAAK,UAAU,UAAU;AAC3B,eAAO;AAAA,UACL,OAAO;AAAA,UACP,OAAO;AAAA,YACL,SAAS,iBAAiB,IAAI,SAAS,YAAY,KAAK,KAAK;AAAA,YAC7D,MAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,WAAW,GAAG,OAAO,qBAAqB,KAAK,SAAS,EAAE,CAAC;AACxE,aAAO,EAAE,OAAO,UAAU;AAAA,IAC5B;AAAA,EACF;AACF;;;ACjTO,SAAS,6BACd,SACoB;AACpB,QAAM,aAAa,QAAQ;AAC3B,QAAM,SAAwB;AAAA,IAC5B,OAAO,MAAuD;AAC5D,aAAO,WAAW,OAAO,IAAI;AAAA,IAC/B;AAAA,IACA,kBAAkB,KAA4C;AAC5D,aAAO,EAAE,MAAM,WAAW,WAAW,OAAO,GAAG,EAAE;AAAA,IACnD;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,WAAW;AAAA,IACX,WAAmB;AACjB,aAAO;AAAA,IACT;AAAA,EACF;AACF;AA2CO,SAAS,6BACd,SACoB;AACpB,QAAM,QAAQ,QAAQ;AACtB,QAAM,UAAU,IAAI,IAAI,QAAQ,qBAAqB,CAAC,CAAC;AACvD,MAAI,YAAY;AAIhB,QAAM,uBAAuB,oBAAI,IAAmC;AAEpE,QAAM,SAAwB;AAAA,IAC5B,MAAM,SAAmC;AACvC,YAAM,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;AACrD,UAAI,IAAI,WAAW,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,wBAAwB,MAAM,OAAO,0CAA0C,MAAM,IAAI,KAAK,GAAG,CAAC,gBAAgB,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,CAAC;AAAA,QAC1I;AAAA,MACF;AACA,YAAM,WAAW,QAAQ;AACzB,YAAM,YAAY,WAAW,SAAS,EAAE,WAAW,IAAI,CAAC,IAAI,IAAI,YAAY,IAAI,MAAM;AACtF,mBAAa;AACb,UAAI,OAAO,cAAc,YAAY,UAAU,WAAW,GAAG;AAC3D,cAAM,IAAI,MAAM,0EAA0E;AAAA,MAC5F;AACA,YAAM,MAAM,MAAM,MAAM,QAAQ,SAAS;AACzC,YAAM,YAAY,OAAO,GAAG;AAC5B,UAAI,UAAW,sBAAqB,IAAI,WAAW,EAAE,UAAU,CAAC;AAChE,aAAO;AAAA,IACT;AAAA,IACA,kBAAkB,KAA4C;AAC5D,YAAM,YAAY,OAAO,GAAG;AAC5B,YAAM,WAAW,YAAY,qBAAqB,IAAI,SAAS,IAAI;AACnE,aAAO;AAAA,QACL,MAAM;AAAA,QACN;AAAA,QACA,SAAS,MAAM;AAAA,QACf,WAAW,UAAU;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,WAAW;AAAA,IACX,WAAmB;AACjB,YAAM,WAAW,QAAQ,OAAO,IAAI,eAAe,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,CAAC,OAAO;AAChF,aAAO,4BAA4B,MAAM,OAAO,eAAe,MAAM,IAAI,KAAK,GAAG,CAAC,IAAI,QAAQ;AAAA,IAChG;AAAA,EACF;AACF;AAEA,SAAS,OAAO,KAA0C;AACxD,QAAM,MAAO,IAAoC;AACjD,SAAO,OAAO,QAAQ,YAAY,IAAI,SAAS,IAAI,MAAM;AAC3D;;;ACIO,SAAS,2BACd,SACe;AACf,QAAM,WAAW,gBAAgB,OAAO;AACxC,QAAM,gBAAgB,SAAS;AAC/B,QAAM,kBAAkB,QAAQ;AAChC,QAAM,iBAAiB,QAAQ,kBAAkB;AACjD,QAAM,eAAe,QAAQ;AAC7B,SAAO,OAAO,MAAM,QAAQ;AAC1B,UAAM,OAAO,kBAAkB,IAAI;AACnC,UAAM,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,YAAY,CAAC,CAAC;AAC3D,QAAI,OAAO,EAAE,WAAW,GAAG,OAAO,WAAW,CAAC;AAC9C,QAAI,YAAY,GAAG;AACjB,YAAM,EAAE,cAAc,QAAQ,UAAU,IAAI,aAAa;AAAA,QACvD;AAAA,QACA,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,QACtD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,MAClD,CAAC;AAMD,UAAI,IAAI,uBAAuB,UAAa,IAAI,0BAA0B;AACxE,cAAM,EAAE,UAAU,IAAI,wBAAwB,IAAI,kBAAkB;AACpE,cAAM,SAAS,IAAI;AACnB,cAAM,OAAO,MAAM,gBAAgB;AAAA,UACjC,QAAQ;AAAA,UACR,MAAM;AAAA,UACN,QAAQ,aAAa,aAAa,IAAI;AAAA,UACtC;AAAA,UACA,aAAa,CAAC,cAAc,OAAO,yBAAyB,EAAE,WAAW,UAAU,CAAC,CAAC;AAAA,UACrF,QAAQ,IAAI;AAAA,UACZ,QAAQ,IAAI;AAAA,UACZ,GAAI,QAAQ,2BAA2B,SACnC,EAAE,gBAAgB,QAAQ,uBAAuB,IACjD,CAAC;AAAA,UACL,GAAI,QAAQ,sBAAsB,SAC9B,EAAE,WAAW,QAAQ,kBAAkB,IACvC,CAAC;AAAA,QACP,CAAC;AACD,cAAMA,UAAS,MAAM,wBAAwB,MAAM;AAAA,UACjD;AAAA,UACA;AAAA,UACA,QAAQ,IAAI;AAAA,UACZ,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,UACtD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,UAChD,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;AAAA,QAC3D,CAAC;AACD,YAAI,OAAO,EAAE,WAAW,GAAG,OAAO,YAAY,CAAC;AAC/C,eAAOA;AAAA,MACT;AACA,YAAMC,UAAS,MAAM,QAAQ;AAAA,QAC3B,QAAQ;AAAA,QACR,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,KAAK,EAAE,eAAe,QAAQ,IAAI,QAAQ,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC,EAAG;AAAA,QACpF,eAAe;AAAA,QACf;AAAA,MACF,CAAC;AACD,YAAMD,UAAS,MAAM,gBAAgB;AAAA,QACnC,YAAYC,QAAO;AAAA,QACnB,UAAU,QAAQ;AAAA,QAClB,WAAW,QAAQ,mBAAmB;AAAA,QACtC;AAAA,QACA,QAAQ,IAAI;AAAA,MACd,CAAC;AACD,UAAI,CAACD,QAAQ,OAAM,IAAI,MAAM,gBAAgB,QAAQ,QAAQ,CAAC;AAC9D,UAAI,OAAO,EAAE,WAAW,GAAG,OAAO,YAAY,CAAC;AAC/C,aAAOA;AAAA,IACT;AACA,UAAM,SAAS,wBAAwB;AAAA,MACrC,GAAI,mBAAmB,gBAAgB,SAAS,IAC5C,EAAE,WAAW,gBAAgB,MAAM,GAAG,QAAQ,EAAE,IAChD,CAAC;AAAA,MACL,GAAI,QAAQ,eAAe,EAAE,QAAQ,QAAQ,aAAa,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC;AAAA,IACpF,CAAC;AACD,UAAM,YAAY,OAAO,UAAU,MAAM,GAAG,QAAQ;AACpD,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC3B,QAAQ,OAAO;AAAA,MACf;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,WAAW,OAAO;AAAA,MAClB;AAAA,MACA,KAAK,EAAE,eAAe,QAAQ,IAAI,QAAQ,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC,EAAG;AAAA,MACpF,eAAe;AAAA,MACf,gBAAgB,KAAK,IAAI,gBAAgB,QAAQ;AAAA,IACnD,CAAC;AACD,UAAM,SAAS,MAAM,gBAAgB;AAAA,MACnC,YAAY,OAAO;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ,mBAAmB;AAAA,MACtC;AAAA,MACA,QAAQ,IAAI;AAAA,IACd,CAAC;AACD,QAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,gBAAgB,QAAQ,QAAQ,CAAC;AAC9D,QAAI,OAAO,EAAE,WAAW,UAAU,QAAQ,OAAO,YAAY,CAAC;AAC9D,WAAO;AAAA,EACT;AACF;AAyBA,eAAe,gBAAgB,MAA6D;AAC1F,QAAM,QAA0B,CAAC;AACjC,aAAW,QAAQ,KAAK,YAAY;AAClC,QAAI,KAAK,WAAW,UAAa,KAAK,SAAS,KAAK,SAAS,UAAU,KAAM;AAC7E,UAAM,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,OAAO,KAAK,QAAQ,SAAS;AAAA,MAC7B,WAAW,KAAK,QAAQ,SAAS;AAAA,IACnC,CAAC;AAAA,EACH;AACA,MAAI,MAAM,WAAW,EAAG,QAAO;AAE/B,MAAI,WAAW;AACf,MAAI,KAAK,UAAU;AACjB,eAAW,CAAC;AACZ,eAAW,KAAK,OAAO;AACrB,YAAM,SAAS,MAAM,KAAK,SAAS,EAAE,QAAQ,KAAK,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC;AAC/E,UAAI,OAAO,SAAU,UAAS,KAAK,EAAE,GAAG,GAAG,WAAW,OAAO,UAAU,CAAC;AAAA,IAC1E;AACA,QAAI,SAAS,WAAW,EAAG,QAAO;AAAA,EACpC;AAEA,SAAO,qBAAqB,UAAU,KAAK,SAAS,EAAE;AACxD;AAGA,SAAS,qBACP,YACA,WACgB;AAChB,QAAM,YAAY,CAAC,MACjB,EAAE,OAAO,UAAU,aAAa,EAAE,OAAO,UAAU;AACrD,QAAM,SAAS,CAAC,GAAG,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM;AAC5C,YAAQ,WAAW;AAAA,MACjB,KAAK;AACH,eAAO,UAAU,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE;AAAA,MACpD,KAAK;AACH,eAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE;AAAA,MAClD,KAAK;AACH,eAAO,EAAE,QAAQ,EAAE;AAAA,MACrB;AACE,eAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,IAC5C;AAAA,EACF,CAAC;AACD,SAAO,OAAO,CAAC;AACjB;AAEA,SAAS,gBAAgB,UAA6C;AACpE,SAAO,WACH,4DACA;AACN;AAUO,SAAS,kBAAkB,MAAmC;AACnE,SAAO;AAAA,IACL,MAAM,eAAe,IAAI;AAAA,IACzB,UAAU,KAAK;AAAA,IACf,SAAS,KAAK,QAAQ;AAAA,IACtB,cAAc,KAAK,QAAQ;AAAA,IAC3B,gBAAgB,KAAK,QAAQ;AAAA,IAC7B,cAAc,KAAK,QAAQ;AAAA,EAC7B;AACF;AAuBA,eAAsB,wBACpB,MACA,SACsB;AACtB,QAAM,EAAE,QAAQ,UAAU,IAAI,aAAa;AAAA,IACzC,MAAM,QAAQ;AAAA,IACd,GAAI,QAAQ,UAAU,EAAE,SAAS,QAAQ,QAAQ,IAAI,CAAC;AAAA,IACtD,GAAI,QAAQ,QAAQ,EAAE,OAAO,QAAQ,MAAM,IAAI,CAAC;AAAA,EAClD,CAAC;AACD,QAAM,SAAS,OAAO,MAAM,mBAAmB,QAAQ,WAAW,IAAI,CAAC;AACvE,QAAM,UAAU,MAAM,UAAU,SAAS,QAAQ,EAAE,WAAW,GAAG,QAAQ,QAAQ,OAAO,CAAC;AACzF,MAAI,QAAQ,UAAU,KAAM,OAAM,IAAI,MAAM,gBAAgB,QAAQ,QAAQ,CAAC;AAC7E,MAAI,QAAQ,UAAU;AACpB,UAAM,SAAS,MAAM,QAAQ,SAAS,QAAQ,QAAQ,MAAM,EAAE,QAAQ,QAAQ,OAAO,CAAC;AACtF,QAAI,CAAC,OAAO,SAAU,OAAM,IAAI,MAAM,gBAAgB,QAAQ,QAAQ,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,MAAgC;AACtD,MAAI,CAAC,KAAK,YAAa,QAAO,KAAK;AACnC,SAAO,CAAC,KAAK,MAAM,IAAI,cAAc,KAAK,WAAW,EAAE,KAAK,IAAI;AAClE;AAEA,SAAS,gBAAgB,SAAgE;AACvF,MAAI,QAAQ,YAAY,QAAQ,eAAe;AAC7C,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AACA,MAAI,QAAQ,SAAU,QAAO,QAAQ;AACrC,MAAI,QAAQ,eAAe;AACzB,WAAO,6BAA6B,EAAE,QAAQ,QAAQ,cAAc,CAAC;AAAA,EACvE;AACA,QAAM,IAAI,MAAM,uEAAuE;AACzF;AAQA,IAAM,mBAAmB;AAAA,EACvB,MAAM;AAAA,EACN,MAAM,KAAW,MAAY,SAAkD;AAC7E,WAAO,QAAQ,WAAW,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1C;AAAA,EACA,OAAO,SAAyD;AAC9D,WAAO,QAAQ,SAAS,IAAI,gBAAgB;AAAA,EAC9C;AACF;","names":["chosen","result"]}