npm - @vibesdotdev/tools - Versions diffs - 0.0.0-stage → 1.0.0-rc.4 - Mend

@vibesdotdev/tools 0.0.0-stage → 1.0.0-rc.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2535) hide show

package/dist/agents/tool-provider-runtime.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"tool-provider-runtime.js","sourceRoot":"","sources":["../../src/agents/tool-provider-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAGhB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mDAAmD,CAAC;AAG9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EACN,wBAAwB,EAExB,MAAM,qDAAqD,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAA4B,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EACN,8BAA8B,EAI9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,8BAA8B,EAAE,MAAM,4BAA4B,CAAC;AAE5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE,SAAS,cAAc,CAAC,OAAqB;IAC5C,OAAO,SAAS,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAClD,CAAC;AAID,SAAS,kBAAkB,CAAC,KAAa;IACxC,OAAO,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,OAAO,CAAC;AAClD,CAAC;AAED,4FAA4F;AAC5F,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IACpC,wBAAwB;IACxB,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;CACvF,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,MAAgC;IACzD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE3D,yFAAyF;AACzF,SAAS,iBAAiB,CAAC,OAAyB;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnE,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,CAAC;AAED,kGAAkG;AAClG,SAAS,iBAAiB,CAAC,UAA0B;IACpD,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,OAAO,GAA+B;QAC3C,EAAE,EAAE,UAAU,CAAC,EAAE;QACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACvD,OAAO,EAAE,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC7F,OAAO,EAAE,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;KAC5D,CAAC;IACF,MAAM,cAAc,GAAG,uBAAuB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,UAAU,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IACzE,IAAI,cAAc;QAAE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;IAC5D,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IAChE,IAAI,UAAU,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IACzE,IAAI,UAAU,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;IACzE,IAAI,UAAU,CAAC,gBAAgB,KAAK,SAAS;QAAE,OAAO,CAAC,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;IACtG,IAAI,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;IACpC,IAAI,UAAU,CAAC,OAAO,EAAE,YAAY;QAAE,OAAO,CAAC,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC;IAC7F,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IAChE,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAqB,EAAE,UAA0B;IACrF,OAAO,kBAAkB,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,EAAE;QACnE,OAAO,KAAK,EAAE,OAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC1D,MAAM,GAAG,GAAG;gBACX,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE;gBAChD,MAAM,EAAE,SAAS,CAAC,WAAW,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC;gBACtD,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,OAAO,EAAE,MAAM;aACvB,CAAC;YACF,iEAAiE;YACjE,+DAA+D;YAC/D,0CAA0C;YAC1C,OAAO,UAAU,CAAsB;gBACtC,OAAO;gBACP,MAAM,EAAE,UAAU,CAAC,EAAE;gBACrB,KAAK;gBACL,GAAG;gBACH,SAAS,EAAE,iBAAiB,CAAC,OAAO,CAAC;aACrC,CAAC,CAAC;QACJ,CAAC,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IACvE,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAqB;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAA0B,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,2BAA2B,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACpG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnF,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,OAAO,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAEvF,OAAO;QACN,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS;QAC7B,WAAW,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,WAAW,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,OAAO,CAAkB,MAAc,EAAE,KAAa,EAAE,gBAAmC,EAAE,OAA8B;YAChI,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,eAAe,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,MAAM,wBAAwB,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,gBAAgB,EAAE,EAAE,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;YACtG,2FAA2F;YAC3F,kEAAkE;YAClE,OAAO,MAAiB,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAc;YACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/C,CAAC;KACD,CAAC;AACH,CAAC;AAqBD,SAAS,UAAU,CAAQ,KAAY;IACtC,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAQ,KAAY;IAC/C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/C,UAAU,EAAE,CAAC;SACX,WAAW,CAAC;QACZ,SAAS,EAAE,CAAC;aACV,WAAW,CAAC;YACZ,SAAS,EAAE,CAAC,CAAC,MAAM,CAAsD,mBAAmB,CAAC;YAC7F,kBAAkB,EAAE,CAAC,CAAC,MAAM,CAA4B,UAAU,CAAC;SACnE,CAAC;aACD,QAAQ,EAAE;KACZ,CAAC;SACD,QAAQ,EAAE;IACZ,0BAA0B,EAAE,CAAC;SAC3B,MAAM,CAA+E,UAAU,CAAC;SAChG,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,kCAAkC,CACjD,GAAkD;IAElD,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACvD,KAAmB,EACnB,UAAqD;IAErD,IAAI,CAAC,UAAU,EAAE,SAAS;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;IAC9C,OAAO,8BAA8B,CAAC,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;AACvH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACzC,YAA0B,EAC1B,UAAqD;IAErD,IAAI,CAAC,UAAU,EAAE,SAAS;QAAE,OAAO,YAAY,CAAC;IAEhD,MAAM,gBAAgB,GAAG,MAAM,kCAAkC,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3G,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAEvF,OAAO;QACN,YAAY,EAAE,GAAG,EAAE,CAAC,gBAAgB;QACpC,WAAW,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,WAAW,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE;YAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACnC,MAAM,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,MAAM,mCAAmC,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAc;YAClB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpD,OAAO,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;KACD,CAAC;AACH,CAAC;AAED,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC;IAC/C,YAAY,EAAE,CAAC,CAAC,MAAM,CAA+B,UAAU,CAAC;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,CAA8B,UAAU,CAAC;IAC9D,WAAW,EAAE,CAAC,CAAC,MAAM,CAA8B,UAAU,CAAC;IAC9D,OAAO,EAAE,CAAC,CAAC,MAAM,CAA0B,UAAU,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAuB,UAAU,CAAC;CAChD,CAAC,CAAC;AAEH,SAAS,cAAc,CAAQ,KAAY;IAC1C,OAAO,yBAAyB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,SAAS,2BAA2B,CAAQ,KAAY;IACvD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,OAAO;QACN,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,SAAS;QAChD,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,SAAS;QAC9C,WAAW,EAAE,OAAO,CAAC,WAAW,KAAK,SAAS;QAC9C,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS;QACtC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,SAAS;KAChC,CAAC;AACH,CAAC;AAaD,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAEpF,MAAM,UAAU,kBAAkB,CAAC,QAAkC;IACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,YAA0B,EAAE,gBAA0B;IAC9F,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzF,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,sEAAsE;IACtE,oEAAoE;IACpE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC;IAE1F,OAAO;QACN,cAAc;QACd,YAAY,EAAE,GAAG,EAAE,CAAC,eAAe;QACnC,WAAW,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,WAAW,EAAE,CAAC,EAAU,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE;YACrD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,MAAM,eAAe,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,MAAM,mCAAmC,CAAC,CAAC;YACvG,CAAC;YACD,OAAO,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAChB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,OAAO,SAAS,CAAC;YAClD,OAAO,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,YAA0B,EAAE,gBAA0B;IACjF,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACvG,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CACrF,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,QAAmC;IACzD,MAAM,aAAa,GAAG,4BAA4B,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,eAAe,CACxB,UAAU,QAAQ,CAAC,EAAE,uEAAuE,EAC5F,eAAe,EACf;YACC,MAAM,EAAE,yBAAyB;YACjC,OAAO,EAAE;gBACR,OAAO,EAAE,QAAQ,CAAC,EAAE;gBACpB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAClF;SACD,CACD,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA+C;IAC7E,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;SACzC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC;SAC9C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SAChC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAE1C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,QAA+C,EAC/C,gBAA2B;IAE3B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAQD,KAAK,UAAU,mBAAmB,CAAC,OAAqB;IACvD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAS,8BAA8B,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,WAAW,GAA8B;YAC9C,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC3D,CAAC;QACF,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,IAAI,cAAc,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC9D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,SAAS,CAAC,EAAE,CAAC;AAC5E,CAAC;AAOD,SAAS,kBAAkB,CAAC,OAAqB;IAChD,IAAI,CAAC;QACJ,OAAO,EAAE,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAA6B;YACxC,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC3D,CAAC;QACF,OAAO,MAAM,CAAC;IACf,CAAC;AACF,CAAC;AAED,gFAAgF;AAChF,SAAS,uBAAuB;IAC/B,OAAO;QACN,YAAY,EAAE,GAAG,EAAE,CAAC,EAAE;QACtB,WAAW,EAAE,GAAG,EAAE,CAAC,SAAS;QAC5B,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;QACxB,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACzB,MAAM,eAAe,CACpB,MAAM,EACN,2BAA2B,EAC3B,+CAA+C,MAAM,kEAAkE,CACvH,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;KAC3B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,OAAqB,EACrB,mBAA6B,EAAE,EAC/B,UAA6C,EAAE;IAE/C,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,YAAY,GAAG,WAAW,CAAC,QAAQ,CAAC;IAExC,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAChH,CAAC;SAAM,CAAC;QACP,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YAC9B,MAAM,CAAC,KAAK,CAAC,+EAA+E,EAAE;gBAC7F,OAAO,EAAE,WAAW,CAAC,OAAO;aAC5B,CAAC,CAAC;QACJ,CAAC;aAAM,IAAI,SAAS,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,wFAAwF,EAAE;gBACtG,OAAO,EAAE,WAAW,CAAC,OAAO;aAC5B,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtB,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,gDAAgD;YAChD,MAAM,CAAC,IAAI,CAAC,mEAAmE,EAAE;gBAChF,gBAAgB;gBAChB,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;aACzD,CAAC,CAAC;YACH,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACpD,OAAO,wBAAwB,CAAC,uBAAuB,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC9E,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/G,CAAC;IAED,YAAY,GAAG,MAAM,2BAA2B,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACnF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IAEvD,MAAM,cAAc,GAAG,kBAAkB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAC1E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,0BAA0B,EAAE,CAAC;QACrE,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,0BAA0B,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;QAChG,IAAI,gBAAgB;YAAE,YAAY,GAAG,MAAM,2BAA2B,CAAC,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,yEAAyE;QACzE,yEAAyE;QACzE,iEAAiE;QACjE,MAAM,CAAC,IAAI,CAAC,gFAAgF,EAAE;YAC7F,cAAc,EAAE,MAAM,CAAC,cAAc;SACrC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/agents/tool-provider.context.d.ts ADDED Viewed

@@ -0,0 +1,33 @@
+import type { ToolProvider } from './contracts/tool-provider.ts';
+/** Runtime-local host contribution used to augment the owner runtime tool catalog. */
+export declare const AGENT_TOOL_PROVIDER_CONTEXT_ID = "toolProvider";
+export type AgentToolProviderHostContext = ToolProvider;
+export declare const agentToolProviderContextDescriptor: {
+    id: string;
+    kind: "context";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    valueKind?: "data" | "service" | undefined;
+    valueSchema?: unknown;
+    config?: {
+        sources: ("literal" | "workspace" | "floor")[];
+        subset?: true | undefined;
+    } | undefined;
+};
+//# sourceMappingURL=tool-provider.context.d.ts.map

package/dist/agents/tool-provider.context.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"tool-provider.context.d.ts","sourceRoot":"","sources":["../../src/agents/tool-provider.context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAGjE,sFAAsF;AACtF,eAAO,MAAM,8BAA8B,iBAAiB,CAAC;AAE7D,MAAM,MAAM,4BAA4B,GAAG,YAAY,CAAC;AAExD,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;;CAI7C,CAAC"}

package/dist/agents/tool-provider.context.js ADDED Viewed

@@ -0,0 +1,8 @@
+import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
+/** Runtime-local host contribution used to augment the owner runtime tool catalog. */
+export const AGENT_TOOL_PROVIDER_CONTEXT_ID = 'toolProvider';
+export const agentToolProviderContextDescriptor = createContextDescriptor({
+    id: AGENT_TOOL_PROVIDER_CONTEXT_ID,
+    description: 'Runtime-local host tool provider used to augment the Tools-owned runtime tool catalog.'
+});
+//# sourceMappingURL=tool-provider.context.js.map

package/dist/agents/tool-provider.context.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"tool-provider.context.js","sourceRoot":"","sources":["../../src/agents/tool-provider.context.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAE9E,sFAAsF;AACtF,MAAM,CAAC,MAAM,8BAA8B,GAAG,cAAc,CAAC;AAI7D,MAAM,CAAC,MAAM,kCAAkC,GAAG,uBAAuB,CAAC;IACzE,EAAE,EAAE,8BAA8B;IAClC,WAAW,EACV,wFAAwF;CACzF,CAAC,CAAC"}

package/dist/agents/trusted-context.d.ts ADDED Viewed

@@ -0,0 +1,151 @@
+/**
+ * THE trust boundary for an agent run.
+ *
+ * There are exactly two sources of information in a tool call, and they do not
+ * deserve the same faith:
+ *
+ *   - `ctx.metadata`  — asserted by the SURFACE. A route that verified a session
+ *                       cookie; a worker that verified a job payload; a parent
+ *                       loop threading its own already-verified context down.
+ *                       TRUSTED.
+ *   - the tool INPUT  — authored by a MODEL. In the general case this is
+ *                       attacker-controlled: prompt injection, a poisoned
+ *                       document, a compromised upstream agent. UNTRUSTED.
+ *
+ * Every hole this module exists to close came from mixing those two channels:
+ *
+ *   - `agent-execution` accepted `userId` on its INPUT schema, described as "User
+ *     ID for permission checking". A model could name any user.
+ *   - It accepted `billingContext` on its INPUT schema — `{ accountOrigin,
+ *     callerOrigin }` — which `recordGenerationUsage` turns into
+ *     a `fetch(accountOrigin, ...)` billing call. A model could bill
+ *     someone else, skip billing entirely (free inference), or point the server at
+ *     an origin of its choosing.
+ *   - Model-authored `input.metadata` was spread verbatim into the run's execution
+ *     metadata, which the loop then threads into NESTED tool calls as `ctx.metadata`.
+ *     That is a LAUNDERING path: a model writes `input.metadata.actorUserId`, and one
+ *     hop later it arrives as trusted surface-asserted context. Identity forged by
+ *     round-trip.
+ *
+ * So: trusted keys are read ONLY from `ctx.metadata`. Metadata from an untrusted
+ * channel is reduced to an explicit trace-only allowlist before it can re-enter
+ * the trusted channel. The model may invent any new selector name it likes; an
+ * allowlist means it is still not heard.
+ */
+import * as z from 'zod/v4';
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { ToolCallContext, ToolCallMetadata } from '@vibesdotdev/kernel/schemas/tool-call';
+import { type ExecutionBindings } from './execution-bindings.ts';
+export { dispatchBoundHostTool } from './execution-host.ts';
+export { executionBindingsSchema, executionBindingFields, executionHostTargetSchema, validateExecutionBindings, readExecutionBindings, assertBoundSessionSelector, assertToolAllowedByExecutionBindings, type ExecutionBindings } from './execution-bindings.ts';
+import { type ToolApprovalChannelDescriptor } from '@vibesdotdev/ai-schemas/agents/approval/channel';
+/**
+ * Known keys that carry identity, credentials, routing, or execution authority.
+ *
+ * A model must never be able to set one of these — not directly on a tool input,
+ * and not indirectly by stuffing them into a metadata bag that gets threaded onward.
+ *
+ * This registry documents the current trusted surface and drives regression probes,
+ * but it is deliberately NOT the untrusted-input filter. A denylist made every new
+ * downstream reader forgeable until somebody remembered to add its key here. The
+ * filter below instead admits one inert trace field and rejects everything else.
+ */
+export declare const TRUSTED_METADATA_KEYS: readonly ["actorUserId", "userId", "orgId", "organizationId", "projectId", "invocationSurface", "codeSessionId", "codeSessionHostKind", "executionBindings", "executionHostId", "sessionId", "agentId", "agentName", "agentLoopId", "modelId", "providerId", "maxIterations", "ownerId", "createdById", "credentialId", "credentialReference", "hostId", "hostTarget", "workspaceId", "workspacePath", "cookie", "jwt", "billingContext", "approvalChannel", "toolApprovalMode", "agentCapabilityCeiling", "spawnDepth", "toolProviderOptions"];
+/**
+ * The authoritative registry for metadata accepted from an untrusted channel.
+ *
+ * Anything absent is rejected, including keys nobody reads today. Keep this
+ * intentionally minimal; resource and execution selectors belong to an owning
+ * surface, never to model-authored metadata.
+ */
+export declare const UNTRUSTED_METADATA_ALLOWLIST: readonly ["traceId"];
+/** The metadata an untrusted channel may carry onward: the allowlist's non-empty trace id, nothing else. */
+declare const UntrustedTraceMetadataSchema: z.ZodObject<{
+    traceId: z.ZodString;
+}, z.core.$strip>;
+export type UntrustedTraceMetadata = z.infer<typeof UntrustedTraceMetadataSchema>;
+export interface TrustedRunContext {
+    executionBindings?: ExecutionBindings;
+    /** The actor established by the surface. Authorization compares this to the agent's owner. */
+    actorUserId?: string;
+    /** The legacy identity key that tools and billing metadata read. */
+    userId?: string;
+    /** Active organization established by the surface. */
+    orgId?: string;
+    /** Canonical API spelling of the same active organization. */
+    organizationId?: string;
+    /** Code session bound by the owning surface. Downstream tools treat this as authoritative. */
+    codeSessionId?: string;
+    /** Host selected by the owning surface for the bound code session. */
+    codeSessionHostKind?: 'cloud' | 'host';
+    /**
+     * The run-bound bearer: captured from auth's caller bearer when the run started
+     * (agent-execution), or projected by the direct surface from validated auth
+     * (direct-context). Tools read a bearer through {@link resolveToolCallerBearer},
+     * never from this field directly.
+     */
+    jwt?: string;
+    /** Billing attribution: where usage is recorded, with what credential. */
+    billingContext?: {
+        accountOrigin?: string;
+        callerOrigin?: string;
+    };
+    /** The run's approval channel — serializable identity, resolved by the executor. */
+    approvalChannel?: ToolApprovalChannelDescriptor;
+    /** The run's approval mode (always-ask, auto-approve-safe, …). */
+    toolApprovalMode?: string;
+}
+/**
+ * Read the surface-asserted context for this call.
+ *
+ * The ONLY sanctioned way to learn who a run is for, what it bills, and how it
+ * asks for approval. Never take these from tool input.
+ */
+export declare function readTrustedRunContext(ctx: Pick<ToolCallContext, 'metadata'> | null | undefined): TrustedRunContext;
+/**
+ * A tool call's bearer and where it came from, or why there is none:
+ * `signed-out` (no user on the request, or not signed in) or
+ * `no-active-request` (the call outlived its request and the run carries no bearer).
+ */
+export type ToolCallerBearer = {
+    readonly bearer: string;
+    readonly source: 'invocation' | 'run';
+} | {
+    readonly bearer: null;
+    readonly absence: 'signed-out' | 'no-active-request';
+};
+/**
+ * The caller's bearer for one tool call, in order:
+ *   1. auth's caller bearer for the active invocation (the request principal on a
+ *      server, the device session on the CLI);
+ *   2. the run-bound bearer in the trusted run context, for a run that outlived its request;
+ *   3. a typed absence.
+ * It never reaches a host credential: on a server, auth's caller bearer reads only
+ * the request principal. Any failure other than "not signed in" or "no active
+ * invocation" is thrown.
+ */
+export declare function resolveToolCallerBearer(runtime: Pick<RuntimeRef, 'hasContext' | 'context'>, ctx: Pick<ToolCallContext, 'metadata'> | null | undefined): Promise<ToolCallerBearer>;
+/**
+ * The caller's bearer, or `AUTH_REQUIRED` `not-signed-in` naming the tool. A
+ * reader that requires the user's bearer never falls back to a host credential.
+ */
+export declare function requireToolCallerBearer(runtime: Pick<RuntimeRef, 'hasContext' | 'context'>, ctx: Pick<ToolCallContext, 'metadata'> | null | undefined, toolId: string): Promise<string>;
+/**
+ * Select the complete set of metadata that may cross from an untrusted channel
+ * into nested tool context.
+ *
+ * The allowlist is intentionally tiny: a non-empty string `traceId` is useful for
+ * observability and has no runtime reader that selects an owner, credential,
+ * session, host, model, loop, or execution limit. Everything else is rejected.
+ * This is future-safe: adding a new downstream selector does not silently make it
+ * model-authorable.
+ *
+ * Returns `undefined` when nothing survives, so callers can spread it cleanly.
+ */
+export declare function selectUntrustedTraceMetadata(metadata: ToolCallMetadata | undefined | null): UntrustedTraceMetadata | undefined;
+/**
+ * Compatibility name for callers compiled against the original denylist helper.
+ * Its behavior is now the trace-only allowlist above.
+ */
+export declare const stripTrustedMetadata: typeof selectUntrustedTraceMetadata;
+//# sourceMappingURL=trusted-context.d.ts.map

package/dist/agents/trusted-context.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"trusted-context.d.ts","sourceRoot":"","sources":["../../src/agents/trusted-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAKN,KAAK,UAAU,EACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC/F,OAAO,EAAyB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,oCAAoC,EAAE,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjQ,OAAO,EAEN,KAAK,6BAA6B,EAClC,MAAM,iDAAiD,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,ihBAmExB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,sBAAuB,CAAC;AAEjE,4GAA4G;AAC5G,QAAA,MAAM,4BAA4B;;iBAAqE,CAAC;AACxG,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,WAAW,iBAAiB;IACjC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,8FAA8F;IAC9F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8FAA8F;IAC9F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACvC;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,cAAc,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,oFAAoF;IACpF,eAAe,CAAC,EAAE,6BAA6B,CAAC;IAChD,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAyCD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACpC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,SAAS,GACvD,iBAAiB,CA6BnB;AAaD;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACzB;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,KAAK,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,mBAAmB,CAAA;CAAE,CAAC;AAiBnF;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,GAAG,SAAS,CAAC,EACnD,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,SAAS,GACvD,OAAO,CAAC,gBAAgB,CAAC,CAe3B;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,YAAY,GAAG,SAAS,CAAC,EACnD,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,SAAS,EACzD,MAAM,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,4BAA4B,CAC3C,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GAAG,IAAI,GAC3C,sBAAsB,GAAG,SAAS,CAGpC;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,qCAA+B,CAAC"}

package/dist/agents/trusted-context.js ADDED Viewed

@@ -0,0 +1,294 @@
+/**
+ * THE trust boundary for an agent run.
+ *
+ * There are exactly two sources of information in a tool call, and they do not
+ * deserve the same faith:
+ *
+ *   - `ctx.metadata`  — asserted by the SURFACE. A route that verified a session
+ *                       cookie; a worker that verified a job payload; a parent
+ *                       loop threading its own already-verified context down.
+ *                       TRUSTED.
+ *   - the tool INPUT  — authored by a MODEL. In the general case this is
+ *                       attacker-controlled: prompt injection, a poisoned
+ *                       document, a compromised upstream agent. UNTRUSTED.
+ *
+ * Every hole this module exists to close came from mixing those two channels:
+ *
+ *   - `agent-execution` accepted `userId` on its INPUT schema, described as "User
+ *     ID for permission checking". A model could name any user.
+ *   - It accepted `billingContext` on its INPUT schema — `{ accountOrigin,
+ *     callerOrigin }` — which `recordGenerationUsage` turns into
+ *     a `fetch(accountOrigin, ...)` billing call. A model could bill
+ *     someone else, skip billing entirely (free inference), or point the server at
+ *     an origin of its choosing.
+ *   - Model-authored `input.metadata` was spread verbatim into the run's execution
+ *     metadata, which the loop then threads into NESTED tool calls as `ctx.metadata`.
+ *     That is a LAUNDERING path: a model writes `input.metadata.actorUserId`, and one
+ *     hop later it arrives as trusted surface-asserted context. Identity forged by
+ *     round-trip.
+ *
+ * So: trusted keys are read ONLY from `ctx.metadata`. Metadata from an untrusted
+ * channel is reduced to an explicit trace-only allowlist before it can re-enter
+ * the trusted channel. The model may invent any new selector name it likes; an
+ * allowlist means it is still not heard.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, isCapabilityError } from '@vibesdotdev/kernel';
+import { readExecutionBindings } from "./execution-bindings.js";
+export { dispatchBoundHostTool } from "./execution-host.js";
+export { executionBindingsSchema, executionBindingFields, executionHostTargetSchema, validateExecutionBindings, readExecutionBindings, assertBoundSessionSelector, assertToolAllowedByExecutionBindings } from "./execution-bindings.js";
+import { ToolApprovalChannelDescriptorSchema } from '@vibesdotdev/ai-schemas/agents/approval/channel';
+/**
+ * Known keys that carry identity, credentials, routing, or execution authority.
+ *
+ * A model must never be able to set one of these — not directly on a tool input,
+ * and not indirectly by stuffing them into a metadata bag that gets threaded onward.
+ *
+ * This registry documents the current trusted surface and drives regression probes,
+ * but it is deliberately NOT the untrusted-input filter. A denylist made every new
+ * downstream reader forgeable until somebody remembered to add its key here. The
+ * filter below instead admits one inert trace field and rejects everything else.
+ */
+export const TRUSTED_METADATA_KEYS = [
+    // Identity
+    'actorUserId',
+    // The legacy identity key. Tools and billing metadata read `userId` directly, so
+    // it is every bit as trusted as `actorUserId` and must be equally unforgeable.
+    // (`actorUserId` remains the key AUTHORIZATION reads — see agent-run-metadata.)
+    'userId',
+    // Active organization aliases. Org-scoped integration connections use these
+    // to select the credential; a model choosing either key is identity forgery.
+    'orgId',
+    'organizationId',
+    // Active project authority is distinct from declared seat project membership.
+    'projectId',
+    // Direct CLI/MCP consumer provenance. App-owned tools use this to select an
+    // owner-app cloud seam; model-authored metadata must never impersonate it.
+    'invocationSurface',
+    // Surface-bound code-session routing. Code-session tools treat the session ID
+    // as an authorization boundary and the host kind as an authoritative routing
+    // selector, so neither may originate in model-authored delegated metadata.
+    'codeSessionId',
+    'codeSessionHostKind',
+    'executionBindings',
+    // Fleet's already-dispatched host receipt, never authored by the model.
+    'executionHostId',
+    // Generic session routing/checkpointing is also authoritative. Workboard
+    // escalation and the native loop both consume this key.
+    'sessionId',
+    // Agent/model/loop selection and execution limits. These have live downstream
+    // readers and therefore must come from a descriptor or owning surface.
+    'agentId',
+    'agentName',
+    'agentLoopId',
+    'modelId',
+    'providerId',
+    'maxIterations',
+    // Ownership/credential/host selectors. The positive allowlist below rejects
+    // these even if a reader is added before this documentation registry changes.
+    'ownerId',
+    'createdById',
+    'credentialId',
+    'credentialReference',
+    'hostId',
+    'hostTarget',
+    'workspaceId',
+    'workspacePath',
+    // Credentials. `jwt` is spliced into outbound request headers downstream. `cookie` is a
+    // retired credential (never forwarded, never read); it stays listed so a model-written
+    // copy is still dropped.
+    'cookie',
+    'jwt',
+    // Billing attribution: destination + credential.
+    'billingContext',
+    // Approval authority.
+    'approvalChannel',
+    'toolApprovalMode',
+    // Capability ceiling — approval authority under another name: the tier-enforcement
+    // subscriber gates dangerous tools against it. A model that can set its own ceiling
+    // can widen the privilege of anything it delegates to, which makes "delegation only
+    // narrows privilege" a false claim. The LOOP sets this from the running agent's
+    // descriptor.
+    'agentCapabilityCeiling',
+    // Recursion guard. A model re-emitting depth 0 on every hop resets `maxDepth`
+    // forever and the spawn chain never terminates.
+    'spawnDepth',
+    // Surface-supplied tool visibility options (carries org-scoping resolvers). A
+    // model-authored value here could weaken which tools resolve for the run.
+    'toolProviderOptions'
+];
+/**
+ * The authoritative registry for metadata accepted from an untrusted channel.
+ *
+ * Anything absent is rejected, including keys nobody reads today. Keep this
+ * intentionally minimal; resource and execution selectors belong to an owning
+ * surface, never to model-authored metadata.
+ */
+export const UNTRUSTED_METADATA_ALLOWLIST = ['traceId'];
+/** The metadata an untrusted channel may carry onward: the allowlist's non-empty trace id, nothing else. */
+const UntrustedTraceMetadataSchema = z.object({ [UNTRUSTED_METADATA_ALLOWLIST[0]]: z.string().min(1) });
+/** A trusted string field: non-empty, or absent. Any other value is dropped, never reshaped. */
+const TrustedStringSchema = z.string().min(1).optional().catch(undefined);
+/** Billing attribution as the surface asserted it; a malformed origin is dropped on its own. */
+const TrustedBillingContextSchema = z
+    .object({ accountOrigin: TrustedStringSchema, callerOrigin: TrustedStringSchema })
+    .optional()
+    .catch(undefined);
+/**
+ * The trusted fields of surface-asserted metadata. Each field is read on its own:
+ * a malformed value is REJECTED (absent), not trusted and not reshaped.
+ */
+const TrustedMetadataSchema = z.object({
+    actorUserId: TrustedStringSchema,
+    userId: TrustedStringSchema,
+    orgId: TrustedStringSchema,
+    organizationId: TrustedStringSchema,
+    codeSessionId: TrustedStringSchema,
+    codeSessionHostKind: z.enum(['cloud', 'host']).optional().catch(undefined),
+    jwt: TrustedStringSchema,
+    billingContext: TrustedBillingContextSchema,
+    // Contract (see trusted-context.test.ts): a malformed channel is REJECTED — not
+    // trusted, not reshaped — exactly like every other malformed trusted field here.
+    // The loop and the spawner, which act on a channel, fail loudly instead.
+    approvalChannel: ToolApprovalChannelDescriptorSchema.optional().catch(undefined),
+    toolApprovalMode: TrustedStringSchema
+});
+function trustedBillingContext(billing) {
+    if (!billing?.accountOrigin && !billing?.callerOrigin)
+        return undefined;
+    const context = {};
+    if (billing.accountOrigin)
+        context.accountOrigin = billing.accountOrigin;
+    if (billing.callerOrigin)
+        context.callerOrigin = billing.callerOrigin;
+    return context;
+}
+/**
+ * Read the surface-asserted context for this call.
+ *
+ * The ONLY sanctioned way to learn who a run is for, what it bills, and how it
+ * asks for approval. Never take these from tool input.
+ */
+export function readTrustedRunContext(ctx) {
+    const metadata = ctx?.metadata;
+    const parsed = TrustedMetadataSchema.safeParse(metadata);
+    if (!parsed.success)
+        return {};
+    const fields = parsed.data;
+    // Propagated so a nested run keeps the REAL identity/credentials of its parent.
+    // These are read from ctx (trusted) and re-applied by `buildExecutionOptions`
+    // AFTER model-authored metadata has been stripped of the same keys — so the
+    // values that survive are always the surface's, never the model's.
+    const orgId = fields.orgId ?? fields.organizationId;
+    const billingContext = trustedBillingContext(fields.billingContext);
+    const executionBindings = readExecutionBindings({ metadata });
+    const context = {};
+    if (executionBindings)
+        context.executionBindings = executionBindings;
+    if (fields.actorUserId)
+        context.actorUserId = fields.actorUserId;
+    if (fields.userId)
+        context.userId = fields.userId;
+    if (orgId) {
+        context.orgId = orgId;
+        context.organizationId = orgId;
+    }
+    if (fields.codeSessionId)
+        context.codeSessionId = fields.codeSessionId;
+    if (fields.codeSessionHostKind)
+        context.codeSessionHostKind = fields.codeSessionHostKind;
+    if (fields.jwt)
+        context.jwt = fields.jwt;
+    if (billingContext)
+        context.billingContext = billingContext;
+    if (fields.approvalChannel)
+        context.approvalChannel = fields.approvalChannel;
+    if (fields.toolApprovalMode)
+        context.toolApprovalMode = fields.toolApprovalMode;
+    return context;
+}
+/**
+ * auth's caller-bearer context (`CALLER_BEARER_CONTEXT_ID` in
+ * `@vibesdotdev/auth/caller-bearer`), addressed by id so the packages below
+ * auth read the caller's bearer without importing it.
+ */
+const CALLER_BEARER_CONTEXT_ID = 'auth/caller-bearer';
+/** The context's value: `resolve()` runs auth's `resolveCallerBearer` for the active invocation. */
+const CallerBearerContextSchema = z.looseObject({ resolve: z.function() });
+const InvocationBearerSchema = z.string().min(1).nullable();
+async function attemptInvocationBearer(runtime) {
+    try {
+        const context = CallerBearerContextSchema.parse(await runtime.context(CALLER_BEARER_CONTEXT_ID));
+        return { answered: InvocationBearerSchema.parse(await context.resolve()) };
+    }
+    catch (error) {
+        const failed = { failure: CaughtFailureSchema.parse(error) };
+        return failed;
+    }
+}
+/**
+ * The caller's bearer for one tool call, in order:
+ *   1. auth's caller bearer for the active invocation (the request principal on a
+ *      server, the device session on the CLI);
+ *   2. the run-bound bearer in the trusted run context, for a run that outlived its request;
+ *   3. a typed absence.
+ * It never reaches a host credential: on a server, auth's caller bearer reads only
+ * the request principal. Any failure other than "not signed in" or "no active
+ * invocation" is thrown.
+ */
+export async function resolveToolCallerBearer(runtime, ctx) {
+    let absence = 'signed-out';
+    if (runtime.hasContext(CALLER_BEARER_CONTEXT_ID)) {
+        const attempt = await attemptInvocationBearer(runtime);
+        if ('answered' in attempt) {
+            if (attempt.answered)
+                return { bearer: attempt.answered, source: 'invocation' };
+        }
+        else if (isCapabilityError(attempt.failure) && attempt.failure.reason === 'invocation-inactive') {
+            absence = 'no-active-request';
+        }
+        else if (!isCapabilityError(attempt.failure) || attempt.failure.reason !== 'not-signed-in') {
+            throw attempt.failure;
+        }
+    }
+    const runBound = readTrustedRunContext(ctx).jwt;
+    if (runBound)
+        return { bearer: runBound, source: 'run' };
+    return { bearer: null, absence };
+}
+/**
+ * The caller's bearer, or `AUTH_REQUIRED` `not-signed-in` naming the tool. A
+ * reader that requires the user's bearer never falls back to a host credential.
+ */
+export async function requireToolCallerBearer(runtime, ctx, toolId) {
+    const resolved = await resolveToolCallerBearer(runtime, ctx);
+    if (resolved.bearer !== null)
+        return resolved.bearer;
+    throw new CapabilityError(`${toolId} requires the acting user's bearer.`, 'AUTH_REQUIRED', {
+        reason: 'not-signed-in',
+        retryable: false,
+        details: { toolId, absence: resolved.absence }
+    });
+}
+/**
+ * Select the complete set of metadata that may cross from an untrusted channel
+ * into nested tool context.
+ *
+ * The allowlist is intentionally tiny: a non-empty string `traceId` is useful for
+ * observability and has no runtime reader that selects an owner, credential,
+ * session, host, model, loop, or execution limit. Everything else is rejected.
+ * This is future-safe: adding a new downstream selector does not silently make it
+ * model-authorable.
+ *
+ * Returns `undefined` when nothing survives, so callers can spread it cleanly.
+ */
+export function selectUntrustedTraceMetadata(metadata) {
+    const trace = UntrustedTraceMetadataSchema.safeParse(metadata);
+    return trace.success ? trace.data : undefined;
+}
+/**
+ * Compatibility name for callers compiled against the original denylist helper.
+ * Its behavior is now the trace-only allowlist above.
+ */
+export const stripTrustedMetadata = selectUntrustedTraceMetadata;
+//# sourceMappingURL=trusted-context.js.map

package/dist/agents/trusted-context.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"trusted-context.js","sourceRoot":"","sources":["../../src/agents/trusted-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EACN,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EAGjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAA0B,MAAM,yBAAyB,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,oCAAoC,EAA0B,MAAM,yBAAyB,CAAC;AACjQ,OAAO,EACN,mCAAmC,EAEnC,MAAM,iDAAiD,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,WAAW;IACX,aAAa;IACb,iFAAiF;IACjF,+EAA+E;IAC/E,gFAAgF;IAChF,QAAQ;IACR,4EAA4E;IAC5E,6EAA6E;IAC7E,OAAO;IACP,gBAAgB;IAChB,8EAA8E;IAC9E,WAAW;IACX,4EAA4E;IAC5E,2EAA2E;IAC3E,mBAAmB;IACnB,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,eAAe;IACf,qBAAqB;IACrB,mBAAmB;IACnB,wEAAwE;IACxE,iBAAiB;IACjB,yEAAyE;IACzE,wDAAwD;IACxD,WAAW;IACX,8EAA8E;IAC9E,uEAAuE;IACvE,SAAS;IACT,WAAW;IACX,aAAa;IACb,SAAS;IACT,YAAY;IACZ,eAAe;IACf,4EAA4E;IAC5E,8EAA8E;IAC9E,SAAS;IACT,aAAa;IACb,cAAc;IACd,qBAAqB;IACrB,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,eAAe;IACf,wFAAwF;IACxF,uFAAuF;IACvF,yBAAyB;IACzB,QAAQ;IACR,KAAK;IACL,iDAAiD;IACjD,gBAAgB;IAChB,sBAAsB;IACtB,iBAAiB;IACjB,kBAAkB;IAClB,mFAAmF;IACnF,oFAAoF;IACpF,oFAAoF;IACpF,gFAAgF;IAChF,cAAc;IACd,wBAAwB;IACxB,8EAA8E;IAC9E,gDAAgD;IAChD,YAAY;IACZ,8EAA8E;IAC9E,0EAA0E;IAC1E,qBAAqB;CACZ,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,SAAS,CAAU,CAAC;AAEjE,4GAA4G;AAC5G,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAgCxG,gGAAgG;AAChG,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE1E,gGAAgG;AAChG,MAAM,2BAA2B,GAAG,CAAC;KACnC,MAAM,CAAC,EAAE,aAAa,EAAE,mBAAmB,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAC;KACjF,QAAQ,EAAE;KACV,KAAK,CAAC,SAAS,CAAC,CAAC;AAEnB;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,mBAAmB;IAChC,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,mBAAmB;IAC1B,cAAc,EAAE,mBAAmB;IACnC,aAAa,EAAE,mBAAmB;IAClC,mBAAmB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC1E,GAAG,EAAE,mBAAmB;IACxB,cAAc,EAAE,2BAA2B;IAC3C,gFAAgF;IAChF,iFAAiF;IACjF,yEAAyE;IACzE,eAAe,EAAE,mCAAmC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAChF,gBAAgB,EAAE,mBAAmB;CACrC,CAAC,CAAC;AAEH,SAAS,qBAAqB,CAC7B,OAAoD;IAEpD,IAAI,CAAC,OAAO,EAAE,aAAa,IAAI,CAAC,OAAO,EAAE,YAAY;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,OAAO,GAAqD,EAAE,CAAC;IACrE,IAAI,OAAO,CAAC,aAAa;QAAE,OAAO,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACzE,IAAI,OAAO,CAAC,YAAY;QAAE,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IACtE,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACpC,GAAyD;IAEzD,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,CAAC;IAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAE3B,gFAAgF;IAChF,8EAA8E;IAC9E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,cAAc,CAAC;IACpD,MAAM,cAAc,GAAG,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,IAAI,iBAAiB;QAAE,OAAO,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;IACrE,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IACjE,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClD,IAAI,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,aAAa;QAAE,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IACvE,IAAI,MAAM,CAAC,mBAAmB;QAAE,OAAO,CAAC,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;IACzF,IAAI,MAAM,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACzC,IAAI,cAAc;QAAE,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;IAC5D,IAAI,MAAM,CAAC,eAAe;QAAE,OAAO,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;IAC7E,IAAI,MAAM,CAAC,gBAAgB;QAAE,OAAO,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAChF,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAEtD,oGAAoG;AACpG,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAC3E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAc5D,KAAK,UAAU,uBAAuB,CACrC,OAAmD;IAEnD,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACjG,OAAO,EAAE,QAAQ,EAAE,sBAAsB,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,MAAM,GAA4B,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACtF,OAAO,MAAM,CAAC;IACf,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAmD,EACnD,GAAyD;IAEzD,IAAI,OAAO,GAAuC,YAAY,CAAC;IAC/D,IAAI,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACjF,CAAC;aAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;YACnG,OAAO,GAAG,mBAAmB,CAAC;QAC/B,CAAC;aAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YAC9F,MAAM,OAAO,CAAC,OAAO,CAAC;QACvB,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACzD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAmD,EACnD,GAAyD,EACzD,MAAc;IAEd,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC;IACrD,MAAM,IAAI,eAAe,CAAC,GAAG,MAAM,qCAAqC,EAAE,eAAe,EAAE;QAC1F,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;KAC9C,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,4BAA4B,CAC3C,QAA6C;IAE7C,MAAM,KAAK,GAAG,4BAA4B,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,4BAA4B,CAAC"}