@wildo-ai/saas-backend-lib 1.1.3 → 1.1.4

package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.d.ts

@@ -0,0 +1,77 @@
+/**
+ * What preparing an approve-with-modifications decision resolved to.
+ *
+ * A NAMED discriminant rather than an `ok` boolean, and not merely by convention: this repository
+ * compiles with `strict: false`, under which TypeScript does not narrow a union on a boolean-literal
+ * property at all — a `!result.ok` guard type-checks as if it narrowed nothing, so every field of
+ * the other member reads as an error. A string vocabulary narrows in both modes, and it carries the
+ * three outcomes' meanings in the same place.
+ */
+export declare enum ToolApprovalModificationOutcomeKind {
+    /** The approver's arguments replaced the model's, and the approval was re-signed over them. */
+    MODIFIED = "modified",
+    /**
+     * The edit resolved to the arguments already proposed.
+     *
+     * Distinct from MODIFIED rather than folded into it: resuming through the rewritten array would be
+     * equally correct (the signature is over identical bytes), but recording it would put a claim on
+     * an unscrubbable audit ledger that a person authored arguments they did not.
+     */
+    UNCHANGED = "unchanged",
+    /** The edit could not be applied. The pause is left standing so it can still be answered. */
+    REFUSED = "refused"
+}
+/**
+ * Why a modification could not be applied to a suspended turn's resume payload.
+ *
+ * A named vocabulary rather than free-text strings: each member is a different DIAGNOSIS with a
+ * different remedy, and the approver is shown a message derived from it. `*_NOT_FOUND` members are
+ * structural claims about the SDK's own array — reaching one means the persisted payload is not the
+ * shape the SDK produced, which is a defect rather than a bad edit.
+ */
+export declare enum ToolApprovalModificationRefusal {
+    /** No `tool-approval-request` part in the array carries this `approvalId`. */
+    APPROVAL_REQUEST_NOT_FOUND = "approval_request_not_found",
+    /** The request part named a `toolCallId` no assistant `tool-call` part in the array declares. */
+    TOOL_CALL_NOT_FOUND = "tool_call_not_found",
+    /** The request part carries no signature — the turn was signed with no secret, which Wildo refuses to create. */
+    APPROVAL_REQUEST_UNSIGNED = "approval_request_unsigned"
+}
+/** The rewritten resume payload, plus what the audit trail needs to say executed ≠ proposed. */
+export interface AppliedToolApprovalModification {
+    kind: ToolApprovalModificationOutcomeKind.MODIFIED;
+    /** A NEW array — the caller's is never mutated, so a refused retry still sees the original. */
+    sdkModelMessages: Record<string, unknown>[];
+    toolCallId: string;
+    /** The tool name AS THE ARRAY DECLARES IT, which is what the signature is computed over. */
+    toolName: string;
+    /** What the MODEL asked for. Names-only reaches the audit trail; this is for the caller's digest. */
+    proposedInput: unknown;
+    /**
+     * The argument NAMES whose canonical value differs, sorted. Names only — never values.
+     *
+     * The same split `RESOURCE_OPERATION_PERFORMED` makes, for the same reason: audit rows replicate
+     * to the per-org SIEM and to an immutable ledger that cannot be scrubbed, so copying arbitrary
+     * tool arguments into one would manufacture an unerasable duplicate of whatever a person typed.
+     */
+    modifiedArgumentKeys: string[];
+}
+export type ToolApprovalModificationOutcome = AppliedToolApprovalModification | {
+    kind: ToolApprovalModificationOutcomeKind.REFUSED;
+    refusal: ToolApprovalModificationRefusal;
+    detail: string;
+};
+/**
+ * Locate the pending call in a paused turn's resume payload, replace its input, and re-sign.
+ *
+ * Pure: it returns a new array and reads nothing but its arguments, so the whole mechanism is
+ * testable without a model, a socket or a database.
+ */
+export declare function applyModifiedToolApprovalInput(params: {
+    sdkModelMessages: Record<string, unknown>[];
+    approvalId: string;
+    modifiedInput: Record<string, unknown>;
+    /** The value `deriveToolApprovalSigningKey` produced — the SAME key the suspension signed with. */
+    signingKey: string;
+}): ToolApprovalModificationOutcome;
+//# sourceMappingURL=tool-approval-modification.backend.utils.d.ts.map

package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-approval-modification.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/utils/tool-approval-modification.backend.utils.ts"],"names":[],"mappings":"AAiCA;;;;;;;;GAQG;AACH,oBAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,SAAS,cAAc;IACvB,6FAA6F;IAC7F,OAAO,YAAY;CACpB;AAED;;;;;;;GAOG;AACH,oBAAY,+BAA+B;IACzC,8EAA8E;IAC9E,0BAA0B,+BAA+B;IACzD,iGAAiG;IACjG,mBAAmB,wBAAwB;IAC3C,iHAAiH;IACjH,yBAAyB,8BAA8B;CACxD;AAED,gGAAgG;AAChG,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,mCAAmC,CAAC,QAAQ,CAAC;IACnD,+FAA+F;IAC/F,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,qGAAqG;IACrG,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,MAAM,+BAA+B,GACvC,+BAA+B,GAC/B;IAAE,IAAI,EAAE,mCAAmC,CAAC,OAAO,CAAC;IAAC,OAAO,EAAE,+BAA+B,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAyBpH;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE;IACrD,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,mGAAmG;IACnG,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,+BAA+B,CAoElC"}

package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.js

@@ -0,0 +1,164 @@
+/**
+ * Rewrite a suspended turn's resume payload so the tool call that runs is the one the APPROVER
+ * authored, not the one the model proposed — and re-bind the approval signature to it.
+ *
+ * ## Why this is possible here and nowhere else
+ *
+ * The AI SDK executes the input it finds in the MESSAGE ARRAY at resume time
+ * (`collect-tool-approvals.ts` rebuilds the pending call by matching the `tool-approval-request`
+ * part's `toolCallId` against the assistant `tool-call` parts). In most deployments that array is
+ * client-supplied history, which is exactly what the HMAC defends against. In Wildo it is not: the
+ * array is held server-side on the paused-execution row, and the browser's decision payload carries
+ * only `approvalId`, `approved`, an optional comment and — now — the modified arguments.
+ *
+ * So editing the array is editing server-held state, and re-signing it is Wildo re-stating a binding
+ * over its own key. Neither is a weakening of the SDK's mechanism; both are the mechanism used by
+ * the party that owns the secret.
+ *
+ * ## What still fails closed after this runs
+ *
+ * Everything the SDK already did. `validate-tool-approvals.ts` verifies the signature, re-validates
+ * the input against the tool's `inputSchema`, and re-runs the approval policy — over the MODIFIED
+ * input, because that is what is in the array. This function's caller validates first as well, but
+ * for the HUMAN rather than for safety: the SDK's refusal is an exception mid-resume, which reaches
+ * an approver as a dead turn.
+ *
+ * ## Refusals are never "sign it anyway"
+ *
+ * A request part carrying no signature means the turn was signed with no secret, which Wildo refuses
+ * to create. Minting one here would turn a resume the SDK would have rejected into one it accepts —
+ * inventing a binding for a request nothing ever bound. It is refused instead.
+ */
+import { canonicalJsonForToolApproval, signToolApprovalRequest } from '../../flows-actors/utils/tool-approval-signing.backend.utils.js';
+/**
+ * What preparing an approve-with-modifications decision resolved to.
+ *
+ * A NAMED discriminant rather than an `ok` boolean, and not merely by convention: this repository
+ * compiles with `strict: false`, under which TypeScript does not narrow a union on a boolean-literal
+ * property at all — a `!result.ok` guard type-checks as if it narrowed nothing, so every field of
+ * the other member reads as an error. A string vocabulary narrows in both modes, and it carries the
+ * three outcomes' meanings in the same place.
+ */
+export var ToolApprovalModificationOutcomeKind;
+(function (ToolApprovalModificationOutcomeKind) {
+    /** The approver's arguments replaced the model's, and the approval was re-signed over them. */
+    ToolApprovalModificationOutcomeKind["MODIFIED"] = "modified";
+    /**
+     * The edit resolved to the arguments already proposed.
+     *
+     * Distinct from MODIFIED rather than folded into it: resuming through the rewritten array would be
+     * equally correct (the signature is over identical bytes), but recording it would put a claim on
+     * an unscrubbable audit ledger that a person authored arguments they did not.
+     */
+    ToolApprovalModificationOutcomeKind["UNCHANGED"] = "unchanged";
+    /** The edit could not be applied. The pause is left standing so it can still be answered. */
+    ToolApprovalModificationOutcomeKind["REFUSED"] = "refused";
+})(ToolApprovalModificationOutcomeKind || (ToolApprovalModificationOutcomeKind = {}));
+/**
+ * Why a modification could not be applied to a suspended turn's resume payload.
+ *
+ * A named vocabulary rather than free-text strings: each member is a different DIAGNOSIS with a
+ * different remedy, and the approver is shown a message derived from it. `*_NOT_FOUND` members are
+ * structural claims about the SDK's own array — reaching one means the persisted payload is not the
+ * shape the SDK produced, which is a defect rather than a bad edit.
+ */
+export var ToolApprovalModificationRefusal;
+(function (ToolApprovalModificationRefusal) {
+    /** No `tool-approval-request` part in the array carries this `approvalId`. */
+    ToolApprovalModificationRefusal["APPROVAL_REQUEST_NOT_FOUND"] = "approval_request_not_found";
+    /** The request part named a `toolCallId` no assistant `tool-call` part in the array declares. */
+    ToolApprovalModificationRefusal["TOOL_CALL_NOT_FOUND"] = "tool_call_not_found";
+    /** The request part carries no signature — the turn was signed with no secret, which Wildo refuses to create. */
+    ToolApprovalModificationRefusal["APPROVAL_REQUEST_UNSIGNED"] = "approval_request_unsigned";
+})(ToolApprovalModificationRefusal || (ToolApprovalModificationRefusal = {}));
+/** An assistant message's content parts, or `[]` for the string form the SDK also permits. */
+function contentParts(message) {
+    const content = message?.content;
+    return Array.isArray(content) ? content : [];
+}
+/**
+ * The argument names whose canonical value differs between two inputs.
+ *
+ * Compared through the SIGNATURE's own canonical form rather than by `===` or `JSON.stringify`:
+ * `{a:1,b:2}` and `{b:2,a:1}` are the same argument to the tool and must not read as a change, and
+ * that is precisely the equivalence the digest already defines.
+ */
+function differingArgumentKeys(proposed, modified) {
+    const asRecord = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {});
+    const before = asRecord(proposed);
+    const after = asRecord(modified);
+    return [...new Set([...Object.keys(before), ...Object.keys(after)])]
+        .filter((key) => canonicalJsonForToolApproval(before[key]) !== canonicalJsonForToolApproval(after[key]))
+        .sort();
+}
+/**
+ * Locate the pending call in a paused turn's resume payload, replace its input, and re-sign.
+ *
+ * Pure: it returns a new array and reads nothing but its arguments, so the whole mechanism is
+ * testable without a model, a socket or a database.
+ */
+export function applyModifiedToolApprovalInput(params) {
+    const messages = structuredClone(params.sdkModelMessages);
+    let approvalRequest;
+    for (const message of messages) {
+        for (const part of contentParts(message)) {
+            if (part.type === 'tool-approval-request' && part.approvalId === params.approvalId) {
+                approvalRequest = part;
+            }
+        }
+    }
+    if (!approvalRequest) {
+        return {
+            kind: ToolApprovalModificationOutcomeKind.REFUSED,
+            refusal: ToolApprovalModificationRefusal.APPROVAL_REQUEST_NOT_FOUND,
+            detail: `No tool-approval-request part in the suspended turn carries approval "${params.approvalId}".`,
+        };
+    }
+    if (typeof approvalRequest.signature !== 'string' || approvalRequest.signature.length === 0) {
+        return {
+            kind: ToolApprovalModificationOutcomeKind.REFUSED,
+            refusal: ToolApprovalModificationRefusal.APPROVAL_REQUEST_UNSIGNED,
+            detail: 'The pending approval carries no signature, so it was raised without a signing key. Re-signing it here would create a binding nothing ever made.',
+        };
+    }
+    const toolCallId = typeof approvalRequest.toolCallId === 'string' ? approvalRequest.toolCallId : undefined;
+    let toolCall;
+    if (toolCallId) {
+        for (const message of messages) {
+            for (const part of contentParts(message)) {
+                if (part.type === 'tool-call' && part.toolCallId === toolCallId) {
+                    toolCall = part;
+                }
+            }
+        }
+    }
+    if (!toolCallId || !toolCall) {
+        return {
+            kind: ToolApprovalModificationOutcomeKind.REFUSED,
+            refusal: ToolApprovalModificationRefusal.TOOL_CALL_NOT_FOUND,
+            detail: `The pending approval names tool call "${toolCallId ?? '(none)'}", which the suspended turn does not contain.`,
+        };
+    }
+    // The name the SIGNATURE is computed over is the one in the array, never the paused record's
+    // copy of it: the SDK verifies against `toolCall.toolName`, so signing over anything else
+    // produces a signature that verifies nowhere.
+    const toolName = String(toolCall.toolName ?? '');
+    const proposedInput = toolCall.input;
+    toolCall.input = params.modifiedInput;
+    approvalRequest.signature = signToolApprovalRequest({
+        secret: params.signingKey,
+        approvalId: params.approvalId,
+        toolCallId,
+        toolName,
+        input: params.modifiedInput,
+    });
+    return {
+        kind: ToolApprovalModificationOutcomeKind.MODIFIED,
+        sdkModelMessages: messages,
+        toolCallId,
+        toolName,
+        proposedInput,
+        modifiedArgumentKeys: differingArgumentKeys(proposedInput, params.modifiedInput),
+    };
+}
+//# sourceMappingURL=tool-approval-modification.backend.utils.js.map

package/dist/esm/flows-actors/utils/tool-approval-modification.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-approval-modification.backend.utils.js","sourceRoot":"","sources":["../../../../src/flows-actors/utils/tool-approval-modification.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,2EAA2E,CAAC;AAElJ;;;;;;;;GAQG;AACH,MAAM,CAAN,IAAY,mCAaX;AAbD,WAAY,mCAAmC;IAC7C,+FAA+F;IAC/F,4DAAqB,CAAA;IACrB;;;;;;OAMG;IACH,8DAAuB,CAAA;IACvB,6FAA6F;IAC7F,0DAAmB,CAAA;AACrB,CAAC,EAbW,mCAAmC,KAAnC,mCAAmC,QAa9C;AAED;;;;;;;GAOG;AACH,MAAM,CAAN,IAAY,+BAOX;AAPD,WAAY,+BAA+B;IACzC,8EAA8E;IAC9E,4FAAyD,CAAA;IACzD,iGAAiG;IACjG,8EAA2C,CAAA;IAC3C,iHAAiH;IACjH,0FAAuD,CAAA;AACzD,CAAC,EAPW,+BAA+B,KAA/B,+BAA+B,QAO1C;AA0BD,8FAA8F;AAC9F,SAAS,YAAY,CAAC,OAAgB;IACpC,MAAM,OAAO,GAAI,OAA6C,EAAE,OAAO,CAAC;IACxE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,QAAiB,EAAE,QAAiB;IACjE,MAAM,QAAQ,GAAG,CAAC,KAAc,EAA2B,EAAE,CAC3D,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,4BAA4B,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;SACvG,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAM9C;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE1D,IAAI,eAAoD,CAAC;IACzD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;gBACnF,eAAe,GAAG,IAAI,CAAC;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,mCAAmC,CAAC,OAAO;YACjD,OAAO,EAAE,+BAA+B,CAAC,0BAA0B;YACnE,MAAM,EAAE,yEAAyE,MAAM,CAAC,UAAU,IAAI;SACvG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,eAAe,CAAC,SAAS,KAAK,QAAQ,IAAI,eAAe,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5F,OAAO;YACL,IAAI,EAAE,mCAAmC,CAAC,OAAO;YACjD,OAAO,EAAE,+BAA+B,CAAC,yBAAyB;YAClE,MAAM,EAAE,iJAAiJ;SAC1J,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,eAAe,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,IAAI,QAA6C,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBAChE,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,mCAAmC,CAAC,OAAO;YACjD,OAAO,EAAE,+BAA+B,CAAC,mBAAmB;YAC5D,MAAM,EAAE,yCAAyC,UAAU,IAAI,QAAQ,+CAA+C;SACvH,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,0FAA0F;IAC1F,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC;IAErC,QAAQ,CAAC,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC;IACtC,eAAe,CAAC,SAAS,GAAG,uBAAuB,CAAC;QAClD,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU;QACV,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,aAAa;KAC5B,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,mCAAmC,CAAC,QAAQ;QAClD,gBAAgB,EAAE,QAAQ;QAC1B,UAAU;QACV,QAAQ;QACR,aAAa;QACb,oBAAoB,EAAE,qBAAqB,CAAC,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC;KACjF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Rewrite a suspended turn's resume payload so the tool call that runs is the one the APPROVER\n * authored, not the one the model proposed — and re-bind the approval signature to it.\n *\n * ## Why this is possible here and nowhere else\n *\n * The AI SDK executes the input it finds in the MESSAGE ARRAY at resume time\n * (`collect-tool-approvals.ts` rebuilds the pending call by matching the `tool-approval-request`\n * part's `toolCallId` against the assistant `tool-call` parts). In most deployments that array is\n * client-supplied history, which is exactly what the HMAC defends against. In Wildo it is not: the\n * array is held server-side on the paused-execution row, and the browser's decision payload carries\n * only `approvalId`, `approved`, an optional comment and — now — the modified arguments.\n *\n * So editing the array is editing server-held state, and re-signing it is Wildo re-stating a binding\n * over its own key. Neither is a weakening of the SDK's mechanism; both are the mechanism used by\n * the party that owns the secret.\n *\n * ## What still fails closed after this runs\n *\n * Everything the SDK already did. `validate-tool-approvals.ts` verifies the signature, re-validates\n * the input against the tool's `inputSchema`, and re-runs the approval policy — over the MODIFIED\n * input, because that is what is in the array. This function's caller validates first as well, but\n * for the HUMAN rather than for safety: the SDK's refusal is an exception mid-resume, which reaches\n * an approver as a dead turn.\n *\n * ## Refusals are never \"sign it anyway\"\n *\n * A request part carrying no signature means the turn was signed with no secret, which Wildo refuses\n * to create. Minting one here would turn a resume the SDK would have rejected into one it accepts —\n * inventing a binding for a request nothing ever bound. It is refused instead.\n */\nimport { canonicalJsonForToolApproval, signToolApprovalRequest } from '~wildo-backend-lib/flows-actors/utils/tool-approval-signing.backend.utils';\n\n/**\n * What preparing an approve-with-modifications decision resolved to.\n *\n * A NAMED discriminant rather than an `ok` boolean, and not merely by convention: this repository\n * compiles with `strict: false`, under which TypeScript does not narrow a union on a boolean-literal\n * property at all — a `!result.ok` guard type-checks as if it narrowed nothing, so every field of\n * the other member reads as an error. A string vocabulary narrows in both modes, and it carries the\n * three outcomes' meanings in the same place.\n */\nexport enum ToolApprovalModificationOutcomeKind {\n  /** The approver's arguments replaced the model's, and the approval was re-signed over them. */\n  MODIFIED = 'modified',\n  /**\n   * The edit resolved to the arguments already proposed.\n   *\n   * Distinct from MODIFIED rather than folded into it: resuming through the rewritten array would be\n   * equally correct (the signature is over identical bytes), but recording it would put a claim on\n   * an unscrubbable audit ledger that a person authored arguments they did not.\n   */\n  UNCHANGED = 'unchanged',\n  /** The edit could not be applied. The pause is left standing so it can still be answered. */\n  REFUSED = 'refused',\n}\n\n/**\n * Why a modification could not be applied to a suspended turn's resume payload.\n *\n * A named vocabulary rather than free-text strings: each member is a different DIAGNOSIS with a\n * different remedy, and the approver is shown a message derived from it. `*_NOT_FOUND` members are\n * structural claims about the SDK's own array — reaching one means the persisted payload is not the\n * shape the SDK produced, which is a defect rather than a bad edit.\n */\nexport enum ToolApprovalModificationRefusal {\n  /** No `tool-approval-request` part in the array carries this `approvalId`. */\n  APPROVAL_REQUEST_NOT_FOUND = 'approval_request_not_found',\n  /** The request part named a `toolCallId` no assistant `tool-call` part in the array declares. */\n  TOOL_CALL_NOT_FOUND = 'tool_call_not_found',\n  /** The request part carries no signature — the turn was signed with no secret, which Wildo refuses to create. */\n  APPROVAL_REQUEST_UNSIGNED = 'approval_request_unsigned',\n}\n\n/** The rewritten resume payload, plus what the audit trail needs to say executed ≠ proposed. */\nexport interface AppliedToolApprovalModification {\n  kind: ToolApprovalModificationOutcomeKind.MODIFIED;\n  /** A NEW array — the caller's is never mutated, so a refused retry still sees the original. */\n  sdkModelMessages: Record<string, unknown>[];\n  toolCallId: string;\n  /** The tool name AS THE ARRAY DECLARES IT, which is what the signature is computed over. */\n  toolName: string;\n  /** What the MODEL asked for. Names-only reaches the audit trail; this is for the caller's digest. */\n  proposedInput: unknown;\n  /**\n   * The argument NAMES whose canonical value differs, sorted. Names only — never values.\n   *\n   * The same split `RESOURCE_OPERATION_PERFORMED` makes, for the same reason: audit rows replicate\n   * to the per-org SIEM and to an immutable ledger that cannot be scrubbed, so copying arbitrary\n   * tool arguments into one would manufacture an unerasable duplicate of whatever a person typed.\n   */\n  modifiedArgumentKeys: string[];\n}\n\nexport type ToolApprovalModificationOutcome =\n  | AppliedToolApprovalModification\n  | { kind: ToolApprovalModificationOutcomeKind.REFUSED; refusal: ToolApprovalModificationRefusal; detail: string };\n\n/** An assistant message's content parts, or `[]` for the string form the SDK also permits. */\nfunction contentParts(message: unknown): Record<string, unknown>[] {\n  const content = (message as { content?: unknown } | undefined)?.content;\n  return Array.isArray(content) ? (content as Record<string, unknown>[]) : [];\n}\n\n/**\n * The argument names whose canonical value differs between two inputs.\n *\n * Compared through the SIGNATURE's own canonical form rather than by `===` or `JSON.stringify`:\n * `{a:1,b:2}` and `{b:2,a:1}` are the same argument to the tool and must not read as a change, and\n * that is precisely the equivalence the digest already defines.\n */\nfunction differingArgumentKeys(proposed: unknown, modified: unknown): string[] {\n  const asRecord = (value: unknown): Record<string, unknown> =>\n    (value !== null && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {});\n  const before = asRecord(proposed);\n  const after = asRecord(modified);\n  return [...new Set([...Object.keys(before), ...Object.keys(after)])]\n    .filter((key) => canonicalJsonForToolApproval(before[key]) !== canonicalJsonForToolApproval(after[key]))\n    .sort();\n}\n\n/**\n * Locate the pending call in a paused turn's resume payload, replace its input, and re-sign.\n *\n * Pure: it returns a new array and reads nothing but its arguments, so the whole mechanism is\n * testable without a model, a socket or a database.\n */\nexport function applyModifiedToolApprovalInput(params: {\n  sdkModelMessages: Record<string, unknown>[];\n  approvalId: string;\n  modifiedInput: Record<string, unknown>;\n  /** The value `deriveToolApprovalSigningKey` produced — the SAME key the suspension signed with. */\n  signingKey: string;\n}): ToolApprovalModificationOutcome {\n  const messages = structuredClone(params.sdkModelMessages);\n\n  let approvalRequest: Record<string, unknown> | undefined;\n  for (const message of messages) {\n    for (const part of contentParts(message)) {\n      if (part.type === 'tool-approval-request' && part.approvalId === params.approvalId) {\n        approvalRequest = part;\n      }\n    }\n  }\n  if (!approvalRequest) {\n    return {\n      kind: ToolApprovalModificationOutcomeKind.REFUSED,\n      refusal: ToolApprovalModificationRefusal.APPROVAL_REQUEST_NOT_FOUND,\n      detail: `No tool-approval-request part in the suspended turn carries approval \"${params.approvalId}\".`,\n    };\n  }\n  if (typeof approvalRequest.signature !== 'string' || approvalRequest.signature.length === 0) {\n    return {\n      kind: ToolApprovalModificationOutcomeKind.REFUSED,\n      refusal: ToolApprovalModificationRefusal.APPROVAL_REQUEST_UNSIGNED,\n      detail: 'The pending approval carries no signature, so it was raised without a signing key. Re-signing it here would create a binding nothing ever made.',\n    };\n  }\n\n  const toolCallId = typeof approvalRequest.toolCallId === 'string' ? approvalRequest.toolCallId : undefined;\n  let toolCall: Record<string, unknown> | undefined;\n  if (toolCallId) {\n    for (const message of messages) {\n      for (const part of contentParts(message)) {\n        if (part.type === 'tool-call' && part.toolCallId === toolCallId) {\n          toolCall = part;\n        }\n      }\n    }\n  }\n  if (!toolCallId || !toolCall) {\n    return {\n      kind: ToolApprovalModificationOutcomeKind.REFUSED,\n      refusal: ToolApprovalModificationRefusal.TOOL_CALL_NOT_FOUND,\n      detail: `The pending approval names tool call \"${toolCallId ?? '(none)'}\", which the suspended turn does not contain.`,\n    };\n  }\n\n  // The name the SIGNATURE is computed over is the one in the array, never the paused record's\n  // copy of it: the SDK verifies against `toolCall.toolName`, so signing over anything else\n  // produces a signature that verifies nowhere.\n  const toolName = String(toolCall.toolName ?? '');\n  const proposedInput = toolCall.input;\n\n  toolCall.input = params.modifiedInput;\n  approvalRequest.signature = signToolApprovalRequest({\n    secret: params.signingKey,\n    approvalId: params.approvalId,\n    toolCallId,\n    toolName,\n    input: params.modifiedInput,\n  });\n\n  return {\n    kind: ToolApprovalModificationOutcomeKind.MODIFIED,\n    sdkModelMessages: messages,\n    toolCallId,\n    toolName,\n    proposedInput,\n    modifiedArgumentKeys: differingArgumentKeys(proposedInput, params.modifiedInput),\n  };\n}\n"]}

package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Domain-separation label for the tool-approval signing key.
+ *
+ * The key is derived from the application's primary secret; this label is what makes the derived
+ * key specific to approval signing, so it can never be confused with — or substituted for — any
+ * other key derived from the same secret. Versioned (`:v1`) so a future change to the derivation
+ * is a NEW key rather than a silent reinterpretation of the existing one.
+ *
+ * semantic-literal-boundary: this string is cryptographic key material, not a semantic vocabulary
+ * member. Changing it invalidates every approval signed under the old label — that is the point of
+ * versioning it, and the reason it must never be "tidied".
+ */
+export declare const TOOL_APPROVAL_SIGNING_KEY_LABEL = "wildo:tool-approval-signing:v1";
+/**
+ * Derive the approval-signing key from the application's bootstrap primary secret.
+ *
+ * ONE derivation, shared by the two sites that need it: the turn that SIGNS an approval request
+ * when the tool loop suspends, and the resume that RE-SIGNS it after an approver edited the
+ * arguments. Two copies of this expression would be two keys the day either moved, and the failure
+ * would present as a forged approval rather than as a configuration skew — the same argument the
+ * signing site already makes for refusing an override-if-set second source.
+ */
+export declare function deriveToolApprovalSigningKey(applicationPrimarySecret: string): string;
+/**
+ * Deterministic JSON text, byte-for-byte as `ai@7.0.29`'s `canonicalJSON` produces it: object keys
+ * sorted, arrays in authored order, `JSON.stringify` for everything else, no whitespace.
+ *
+ * Deliberately as permissive as the original, including its handling of values a stricter
+ * serializer would reject. Diverging to "improve" it changes the digest and therefore the
+ * signature.
+ */
+export declare function canonicalJsonForToolApproval(value: unknown): string;
+/** Canonical SHA-256 digest (unpadded base64url) of a tool call's input — the SDK's `hashCanonical`. */
+export declare function hashToolApprovalInput(value: unknown): string;
+/**
+ * The HMAC that binds one approval to one tool call with one exact set of arguments.
+ *
+ * `secret` is the STRING {@link deriveToolApprovalSigningKey} returns — the same value handed to the
+ * SDK as `experimental_toolApprovalSecret`, which imports it as raw UTF-8 key bytes.
+ */
+export declare function signToolApprovalRequest(params: {
+    secret: string;
+    approvalId: string;
+    toolCallId: string;
+    toolName: string;
+    input: unknown;
+}): string;
+//# sourceMappingURL=tool-approval-signing.backend.utils.d.ts.map

package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-approval-signing.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/flows-actors/utils/tool-approval-signing.backend.utils.ts"],"names":[],"mappings":"AAuCA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,+BAA+B,mCAAmC,CAAC;AAEhF;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,wBAAwB,EAAE,MAAM,GAAG,MAAM,CAErF;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAYnE;AAED,wGAAwG;AACxG,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;CAChB,GAAG,MAAM,CAKT"}

package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.js

@@ -0,0 +1,101 @@
+/**
+ * The tool-approval signing key, and a faithful mirror of the model SDK's approval signature.
+ *
+ * ## Why this file exists at all
+ *
+ * The AI SDK (`ai@7.0.29`) binds an approval to a specific tool call with
+ * `HMAC-SHA256(secret, "approvalId\ntoolCallId\ntoolName\n" + hashCanonical(input))`, and it
+ * RE-DERIVES that binding at resume time from the message array it is handed. So the moment an
+ * approver is allowed to change the arguments of the call they are approving, the stored signature
+ * stops describing the call that will run and the resume is refused — correctly, because a binding
+ * that still verifies over changed arguments is a binding that has stopped meaning anything.
+ *
+ * Re-signing is therefore not optional for approve-with-modifications; it IS the feature. Wildo can
+ * do it because Wildo owns the key: {@link deriveToolApprovalSigningKey} produces it from the
+ * application's own primary secret, and the SDK is merely handed the result.
+ *
+ * ## Why it is a MIRROR rather than an import
+ *
+ * `signToolApproval` and `hashCanonical` are internal to `ai` and exported from none of its three
+ * entry points — `.`, `./internal` (whose source index is empty) and `./test`. Verified against the
+ * installed package's `exports` map and `src/index.ts`, not recalled. There is no seam to import,
+ * so the algorithm is reproduced here.
+ *
+ * That is a real cost and it is stated plainly: if a future `ai` release changes either the payload
+ * layout or the canonical form, every MODIFIED approval stops verifying. It fails CLOSED — the SDK
+ * throws `InvalidToolApprovalSignatureError` and the tool does not run — which is the right
+ * direction, but it is silent about the cause. The defence is a BEHAVIOURAL pin that drives a real
+ * resume through the SDK with a re-signed modified call, so the SDK's own verifier is the oracle.
+ * A test that re-derived this algorithm would only prove we agree with ourselves.
+ *
+ * ## Why the canonical serializer here is NOT the repository's other one
+ *
+ * `meta-workflow-canonical-json.backend.utils.ts` implements RFC 8785/JCS and fails closed on values
+ * `JSON.stringify` would coerce. It is a better serializer and it is the WRONG one: this function's
+ * only contract is to produce the same bytes the SDK produces, and a near-match yields a signature
+ * the SDK rejects. Correctness here means agreement, not quality.
+ */
+import { createHash, createHmac } from 'node:crypto';
+/**
+ * Domain-separation label for the tool-approval signing key.
+ *
+ * The key is derived from the application's primary secret; this label is what makes the derived
+ * key specific to approval signing, so it can never be confused with — or substituted for — any
+ * other key derived from the same secret. Versioned (`:v1`) so a future change to the derivation
+ * is a NEW key rather than a silent reinterpretation of the existing one.
+ *
+ * semantic-literal-boundary: this string is cryptographic key material, not a semantic vocabulary
+ * member. Changing it invalidates every approval signed under the old label — that is the point of
+ * versioning it, and the reason it must never be "tidied".
+ */
+export const TOOL_APPROVAL_SIGNING_KEY_LABEL = 'wildo:tool-approval-signing:v1';
+/**
+ * Derive the approval-signing key from the application's bootstrap primary secret.
+ *
+ * ONE derivation, shared by the two sites that need it: the turn that SIGNS an approval request
+ * when the tool loop suspends, and the resume that RE-SIGNS it after an approver edited the
+ * arguments. Two copies of this expression would be two keys the day either moved, and the failure
+ * would present as a forged approval rather than as a configuration skew — the same argument the
+ * signing site already makes for refusing an override-if-set second source.
+ */
+export function deriveToolApprovalSigningKey(applicationPrimarySecret) {
+    return createHmac('sha256', applicationPrimarySecret).update(TOOL_APPROVAL_SIGNING_KEY_LABEL).digest('hex');
+}
+/**
+ * Deterministic JSON text, byte-for-byte as `ai@7.0.29`'s `canonicalJSON` produces it: object keys
+ * sorted, arrays in authored order, `JSON.stringify` for everything else, no whitespace.
+ *
+ * Deliberately as permissive as the original, including its handling of values a stricter
+ * serializer would reject. Diverging to "improve" it changes the digest and therefore the
+ * signature.
+ */
+export function canonicalJsonForToolApproval(value) {
+    if (value === null || value === undefined || typeof value !== 'object') {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalJsonForToolApproval).join(',')}]`;
+    }
+    const record = value;
+    const entries = Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${canonicalJsonForToolApproval(record[key])}`);
+    return `{${entries.join(',')}}`;
+}
+/** Canonical SHA-256 digest (unpadded base64url) of a tool call's input — the SDK's `hashCanonical`. */
+export function hashToolApprovalInput(value) {
+    return createHash('sha256').update(canonicalJsonForToolApproval(value), 'utf8').digest('base64url');
+}
+/**
+ * The HMAC that binds one approval to one tool call with one exact set of arguments.
+ *
+ * `secret` is the STRING {@link deriveToolApprovalSigningKey} returns — the same value handed to the
+ * SDK as `experimental_toolApprovalSecret`, which imports it as raw UTF-8 key bytes.
+ */
+export function signToolApprovalRequest(params) {
+    const inputDigest = hashToolApprovalInput(params.input);
+    return createHmac('sha256', params.secret)
+        .update(`${params.approvalId}\n${params.toolCallId}\n${params.toolName}\n${inputDigest}`, 'utf8')
+        .digest('base64url');
+}
+//# sourceMappingURL=tool-approval-signing.backend.utils.js.map

package/dist/esm/flows-actors/utils/tool-approval-signing.backend.utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-approval-signing.backend.utils.js","sourceRoot":"","sources":["../../../../src/flows-actors/utils/tool-approval-signing.backend.utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,gCAAgC,CAAC;AAEhF;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,wBAAgC;IAC3E,OAAO,UAAU,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAW,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAChC,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,4BAA4B,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClC,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAMvC;IACC,MAAM,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;SACvC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,EAAE,MAAM,CAAC;SAChG,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * The tool-approval signing key, and a faithful mirror of the model SDK's approval signature.\n *\n * ## Why this file exists at all\n *\n * The AI SDK (`ai@7.0.29`) binds an approval to a specific tool call with\n * `HMAC-SHA256(secret, \"approvalId\\ntoolCallId\\ntoolName\\n\" + hashCanonical(input))`, and it\n * RE-DERIVES that binding at resume time from the message array it is handed. So the moment an\n * approver is allowed to change the arguments of the call they are approving, the stored signature\n * stops describing the call that will run and the resume is refused — correctly, because a binding\n * that still verifies over changed arguments is a binding that has stopped meaning anything.\n *\n * Re-signing is therefore not optional for approve-with-modifications; it IS the feature. Wildo can\n * do it because Wildo owns the key: {@link deriveToolApprovalSigningKey} produces it from the\n * application's own primary secret, and the SDK is merely handed the result.\n *\n * ## Why it is a MIRROR rather than an import\n *\n * `signToolApproval` and `hashCanonical` are internal to `ai` and exported from none of its three\n * entry points — `.`, `./internal` (whose source index is empty) and `./test`. Verified against the\n * installed package's `exports` map and `src/index.ts`, not recalled. There is no seam to import,\n * so the algorithm is reproduced here.\n *\n * That is a real cost and it is stated plainly: if a future `ai` release changes either the payload\n * layout or the canonical form, every MODIFIED approval stops verifying. It fails CLOSED — the SDK\n * throws `InvalidToolApprovalSignatureError` and the tool does not run — which is the right\n * direction, but it is silent about the cause. The defence is a BEHAVIOURAL pin that drives a real\n * resume through the SDK with a re-signed modified call, so the SDK's own verifier is the oracle.\n * A test that re-derived this algorithm would only prove we agree with ourselves.\n *\n * ## Why the canonical serializer here is NOT the repository's other one\n *\n * `meta-workflow-canonical-json.backend.utils.ts` implements RFC 8785/JCS and fails closed on values\n * `JSON.stringify` would coerce. It is a better serializer and it is the WRONG one: this function's\n * only contract is to produce the same bytes the SDK produces, and a near-match yields a signature\n * the SDK rejects. Correctness here means agreement, not quality.\n */\nimport { createHash, createHmac } from 'node:crypto';\n\n/**\n * Domain-separation label for the tool-approval signing key.\n *\n * The key is derived from the application's primary secret; this label is what makes the derived\n * key specific to approval signing, so it can never be confused with — or substituted for — any\n * other key derived from the same secret. Versioned (`:v1`) so a future change to the derivation\n * is a NEW key rather than a silent reinterpretation of the existing one.\n *\n * semantic-literal-boundary: this string is cryptographic key material, not a semantic vocabulary\n * member. Changing it invalidates every approval signed under the old label — that is the point of\n * versioning it, and the reason it must never be \"tidied\".\n */\nexport const TOOL_APPROVAL_SIGNING_KEY_LABEL = 'wildo:tool-approval-signing:v1';\n\n/**\n * Derive the approval-signing key from the application's bootstrap primary secret.\n *\n * ONE derivation, shared by the two sites that need it: the turn that SIGNS an approval request\n * when the tool loop suspends, and the resume that RE-SIGNS it after an approver edited the\n * arguments. Two copies of this expression would be two keys the day either moved, and the failure\n * would present as a forged approval rather than as a configuration skew — the same argument the\n * signing site already makes for refusing an override-if-set second source.\n */\nexport function deriveToolApprovalSigningKey(applicationPrimarySecret: string): string {\n  return createHmac('sha256', applicationPrimarySecret).update(TOOL_APPROVAL_SIGNING_KEY_LABEL).digest('hex');\n}\n\n/**\n * Deterministic JSON text, byte-for-byte as `ai@7.0.29`'s `canonicalJSON` produces it: object keys\n * sorted, arrays in authored order, `JSON.stringify` for everything else, no whitespace.\n *\n * Deliberately as permissive as the original, including its handling of values a stricter\n * serializer would reject. Diverging to \"improve\" it changes the digest and therefore the\n * signature.\n */\nexport function canonicalJsonForToolApproval(value: unknown): string {\n  if (value === null || value === undefined || typeof value !== 'object') {\n    return JSON.stringify(value) as string;\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map(canonicalJsonForToolApproval).join(',')}]`;\n  }\n  const record = value as Record<string, unknown>;\n  const entries = Object.keys(record)\n    .sort()\n    .map((key) => `${JSON.stringify(key)}:${canonicalJsonForToolApproval(record[key])}`);\n  return `{${entries.join(',')}}`;\n}\n\n/** Canonical SHA-256 digest (unpadded base64url) of a tool call's input — the SDK's `hashCanonical`. */\nexport function hashToolApprovalInput(value: unknown): string {\n  return createHash('sha256').update(canonicalJsonForToolApproval(value), 'utf8').digest('base64url');\n}\n\n/**\n * The HMAC that binds one approval to one tool call with one exact set of arguments.\n *\n * `secret` is the STRING {@link deriveToolApprovalSigningKey} returns — the same value handed to the\n * SDK as `experimental_toolApprovalSecret`, which imports it as raw UTF-8 key bytes.\n */\nexport function signToolApprovalRequest(params: {\n  secret: string;\n  approvalId: string;\n  toolCallId: string;\n  toolName: string;\n  input: unknown;\n}): string {\n  const inputDigest = hashToolApprovalInput(params.input);\n  return createHmac('sha256', params.secret)\n    .update(`${params.approvalId}\\n${params.toolCallId}\\n${params.toolName}\\n${inputDigest}`, 'utf8')\n    .digest('base64url');\n}\n"]}

package/dist/esm/guidance/batches/dormancy-detection.batch.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dormancy-detection.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/batches/dormancy-detection.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAiD/I,wBAAgB,4BAA4B,CAC1C,YAAY,GAAE,MAAiF,GAC9F,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAqHtD"}
+{"version":3,"file":"dormancy-detection.batch.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/guidance/batches/dormancy-detection.batch.backend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,iCAAiC,EAAE,MAAM,4FAA4F,CAAC;AAiD/I,wBAAgB,4BAA4B,CAC1C,YAAY,GAAE,MAAiF,GAC9F,UAAU,CAAC,OAAO,iCAAiC,CAAC,CAqHtD"}

package/dist/esm/guidance/services/guidance-trigger-evaluator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guidance-trigger-evaluator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/services/guidance-trigger-evaluator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAoB,MAAM,uDAAuD,CAAC;AAE3G,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,sBAAsB,EAAE,CAAC;IACxC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBACa,sCAAsC;IAMZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALhF,OAAO,CAAC,QAAQ,CAA+D;IAC/E,OAAO,CAAC,eAAe,CAAgC;gBAGD,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,gBAAgB;IAMlG;;;;OAIG;IACI,eAAe,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,IAAI;IAK7D;;;OAGG;IACU,oBAAoB,CAAC,MAAM,EAAE;QACxC,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,gGAAgG;QAChG,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC;IAejB;;;;OAIG;IACU,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;CAwExF"}
+{"version":3,"file":"guidance-trigger-evaluator.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/guidance/services/guidance-trigger-evaluator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAO1B,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAoB,MAAM,uDAAuD,CAAC;AAE3G,MAAM,WAAW,6BAA6B;IAC5C,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,sBAAsB,EAAE,CAAC;IACxC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBACa,sCAAsC;IAMZ,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALhF,OAAO,CAAC,QAAQ,CAA+D;IAC/E,OAAO,CAAC,eAAe,CAAgC;gBAGD,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,gBAAgB;IAMlG;;;;OAIG;IACI,eAAe,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,IAAI;IAK7D;;;OAGG;IACU,oBAAoB,CAAC,MAAM,EAAE;QACxC,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,gGAAgG;QAChG,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC;IAejB;;;;OAIG;IACU,oBAAoB,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC;CAwExF"}

package/dist/esm/guidance/services/lifecycle-custom-implementations.backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/services/lifecycle-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAS9F;;;;GAIG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,gCAAgC,EAC3C,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,0BAA0B,GACvC,IAAI,CAIN;AAaD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,gCAAgC,CAOxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAOpD;AA4DD,eAAO,MAAM,8BAA8B,EAAE,0CAA0C,EAEtF,CAAC"}
+{"version":3,"file":"lifecycle-custom-implementations.backend.d.ts","sourceRoot":"","sources":["../../../../src/guidance/services/lifecycle-custom-implementations.backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAEL,KAAK,0CAA0C,EAChD,MAAM,4GAA4G,CAAC;AAEpH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAS9F;;;;GAIG;AACH,wBAAgB,wCAAwC,CACtD,SAAS,EAAE,gCAAgC,EAC3C,MAAM,EAAE,eAAe,EACvB,YAAY,EAAE,0BAA0B,GACvC,IAAI,CAIN;AAaD;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,gCAAgC,CAOxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,CAOpD;AA4DD,eAAO,MAAM,8BAA8B,EAAE,0CAA0C,EAEtF,CAAC"}

package/dist/esm/guidance/services/lifecycle-evaluator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle-evaluator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/services/lifecycle-evaluator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAEL,gBAAgB,EAajB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAEV,eAAe,EAMf,4BAA4B,EAE7B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,uDAAuD,CAAC;AAChH,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAuFrK;;;;;;;;;;;;;GAaG;AACH,qBACa,gCAAgC;IAUN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAVtG,qFAAqF;IACrF,OAAO,CAAC,qBAAqB,CAA6B;IAE1D,OAAO,CAAC,QAAQ,CAA+D;IAE/E,OAAO,CAAC,eAAe,CAA8B;gBAGC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,gBAAgB,EAChB,oBAAoB,EAAE,yCAAyC;IAMjJ,mEAAmE;IAC5D,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAQpE;;;;OAIG;IACU,WAAW,CAAC,MAAM,EAAE;QAC/B,sFAAsF;QACtF,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,OAAO,CAAC;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjB,+GAA+G;YACjG,wBAAwB;IAuHtC;;;yEAGqE;YACvD,+BAA+B;IA4C7C;;;;OAIG;IACU,mBAAmB,CAAC,MAAM,EAAE;QACvC,mBAAmB,EAAE,MAAM,CAAC;QAC5B,4BAA4B,CAAC,EAAE,4BAA4B,CAAC;QAC5D,qEAAqE;QACrE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuEjB;;;OAGG;IACU,mBAAmB,CAC9B,iBAAiB,EAAE,gBAAgB,EACnC,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,OAAO,EACzB,UAAU,CAAC,EAAE,IAAI,GAChB,OAAO,CAAC,IAAI,CAAC;IAoChB;;;OAGG;IACU,kBAAkB,CAC7B,iBAAiB,EAAE,gBAAgB,EACnC,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC;IA0BhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,OAAO,CAAC,uBAAuB;IAsB/B,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,eAAe;IA2CvB;;;;OAIG;YACW,iCAAiC;IA4C/C;;;;;;;OAOG;YACW,8BAA8B;IAgB5C,OAAO,CAAC,oBAAoB;IAM5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;YAWlB,0BAA0B;IA2BxC,OAAO,CAAC,uBAAuB;YA2BjB,0BAA0B;YA4D1B,kBAAkB;YAuBlB,oBAAoB;YAwBpB,oBAAoB;YAuBpB,iBAAiB;IAuB/B,4EAA4E;IAC5E,OAAO,CAAC,eAAe;YAUT,gBAAgB;CA8C/B"}
+{"version":3,"file":"lifecycle-evaluator.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/guidance/services/lifecycle-evaluator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,EAEL,gBAAgB,EAajB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAEV,eAAe,EAMf,4BAA4B,EAE7B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,uDAAuD,CAAC;AAChH,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AAuFrK;;;;;;;;;;;;;GAaG;AACH,qBACa,gCAAgC;IAUN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACb,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAVtG,qFAAqF;IACrF,OAAO,CAAC,qBAAqB,CAA6B;IAE1D,OAAO,CAAC,QAAQ,CAA+D;IAE/E,OAAO,CAAC,eAAe,CAA8B;gBAGC,MAAM,EAAE,aAAa,EACX,gBAAgB,EAAE,gBAAgB,EAChB,oBAAoB,EAAE,yCAAyC;IAMjJ,mEAAmE;IAC5D,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI;IAQpE;;;;OAIG;IACU,WAAW,CAAC,MAAM,EAAE;QAC/B,sFAAsF;QACtF,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,OAAO,CAAC;KAC3B,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjB,+GAA+G;YACjG,wBAAwB;IAuHtC;;;yEAGqE;YACvD,+BAA+B;IA4C7C;;;;OAIG;IACU,mBAAmB,CAAC,MAAM,EAAE;QACvC,mBAAmB,EAAE,MAAM,CAAC;QAC5B,4BAA4B,CAAC,EAAE,4BAA4B,CAAC;QAC5D,qEAAqE;QACrE,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuEjB;;;OAGG;IACU,mBAAmB,CAC9B,iBAAiB,EAAE,gBAAgB,EACnC,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,OAAO,EACzB,UAAU,CAAC,EAAE,IAAI,GAChB,OAAO,CAAC,IAAI,CAAC;IAoChB;;;OAGG;IACU,kBAAkB,CAC7B,iBAAiB,EAAE,gBAAgB,EACnC,OAAO,EAAE,MAAM,EACf,gBAAgB,EAAE,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC;IA0BhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA6BG;IACH,OAAO,CAAC,uBAAuB;IAsB/B,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,eAAe;IA2CvB;;;;OAIG;YACW,iCAAiC;IA4C/C;;;;;;;OAOG;YACW,8BAA8B;IAgB5C,OAAO,CAAC,oBAAoB;IAM5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;YAWlB,0BAA0B;IA2BxC,OAAO,CAAC,uBAAuB;YA2BjB,0BAA0B;YA4D1B,kBAAkB;YAuBlB,oBAAoB;YAwBpB,oBAAoB;YAuBpB,iBAAiB;IAuB/B,4EAA4E;IAC5E,OAAO,CAAC,eAAe;YAUT,gBAAgB;CA8C/B"}

package/dist/esm/guidance/services/lifecycle-scope-id.backend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle-scope-id.backend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/services/lifecycle-scope-id.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,KAAK,gBAAgB,GAAG;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,gBAAgB,EAC9B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,GAAG,SAAS,CAiBpB"}
+{"version":3,"file":"lifecycle-scope-id.backend.utils.d.ts","sourceRoot":"","sources":["../../../../src/guidance/services/lifecycle-scope-id.backend.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,KAAK,gBAAgB,GAAG;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,gBAAgB,EAC9B,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GACzC,MAAM,GAAG,SAAS,CAiBpB"}

package/dist/esm/guidance/services/milestone-condition-registry.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"milestone-condition-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/services/milestone-condition-registry.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAE1E,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACxC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CAClE;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,OAAO,CAAC;AAEnF,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,OAAO,CAAC,UAAU,CAA2C;gBAGP,MAAM,EAAE,aAAa;IAG3E,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,oBAAoB,GAAG,IAAI;IAOvE,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO;IAgBpF,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}
+{"version":3,"file":"milestone-condition-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/guidance/services/milestone-condition-registry.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAE1E,8DAA8D;AAC9D,MAAM,WAAW,yBAAyB;IACxC,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sCAAsC;IACtC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;CAClE;AAED,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,OAAO,CAAC;AAEnF,qBACa,wCAAwC;IAId,OAAO,CAAC,QAAQ,CAAC,MAAM;IAH5D,OAAO,CAAC,UAAU,CAA2C;gBAGP,MAAM,EAAE,aAAa;IAG3E,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,EAAE,EAAE,oBAAoB,GAAG,IAAI;IAOvE,iBAAiB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO;IAgBpF,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAI3C,iBAAiB,IAAI,MAAM,EAAE;CAG9B"}

package/dist/esm/guidance/services/milestone-definition-registry.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"milestone-definition-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/services/milestone-definition-registry.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,kFAAkF,CAAC;AAChJ,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAG/G;;;;;;;;GAQG;AACH,qBACa,yCAAyC;IAOf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACN,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChB,OAAO,CAAC,QAAQ,CAAC,eAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAV3F,OAAO,CAAC,WAAW,CAA+C;IAClE,8FAA8F;IAC9F,OAAO,CAAC,YAAY,CAAiD;IACrE,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACJ,iBAAiB,EAAE,+BAA+B,EACtD,YAAY,EAAE,0BAA0B,EAC3B,eAAe,EAAE,uCAAuC,EAC9D,iBAAiB,EAAE,wCAAwC;IASrI;;;OAGG;IACH,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI;IAOlE,OAAO,CAAC,kBAAkB;IAyB1B;;;OAGG;IACH,mBAAmB,IAAI,IAAI;IAyG3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAsC3B,wFAAwF;IACxF,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAIrF,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAInE,iBAAiB,IAAI,mBAAmB,EAAE;IAQ1C,iBAAiB,IAAI,IAAI;CAmB1B"}
+{"version":3,"file":"milestone-definition-registry.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/guidance/services/milestone-definition-registry.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAGjE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAChI,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kEAAkE,CAAC;AACnH,OAAO,KAAK,EAAE,uCAAuC,EAAE,MAAM,kFAAkF,CAAC;AAChJ,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAG/G;;;;;;;;GAQG;AACH,qBACa,yCAAyC;IAOf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACN,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACtC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAChB,OAAO,CAAC,QAAQ,CAAC,eAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAV3F,OAAO,CAAC,WAAW,CAA+C;IAClE,8FAA8F;IAC9F,OAAO,CAAC,YAAY,CAAiD;IACrE,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACJ,iBAAiB,EAAE,+BAA+B,EACtD,YAAY,EAAE,0BAA0B,EAC3B,eAAe,EAAE,uCAAuC,EAC9D,iBAAiB,EAAE,wCAAwC;IASrI;;;OAGG;IACH,wBAAwB,CAAC,WAAW,EAAE,mBAAmB,EAAE,GAAG,IAAI;IAOlE,OAAO,CAAC,kBAAkB;IAyB1B;;;OAGG;IACH,mBAAmB,IAAI,IAAI;IAyG3B;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAsC3B,wFAAwF;IACxF,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,mBAAmB,EAAE;IAIrF,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAInE,iBAAiB,IAAI,mBAAmB,EAAE;IAQ1C,iBAAiB,IAAI,IAAI;CAmB1B"}

package/dist/esm/guidance/services/milestone-evaluator.backend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"milestone-evaluator.backend.service.d.ts","sourceRoot":"","sources":["../../../../../src/guidance/services/milestone-evaluator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAuB1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,iDAAiD,CAAC;AACjH,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,uDAAuD,CAAC;AAChH,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAGhI,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG;;;;;;;;;;;;;;;;;GAiBG;AACH,qBACa,gCAAgC;IAKN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACF,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAXjG,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACA,iBAAiB,EAAE,yCAAyC,EACvE,gBAAgB,EAAE,gBAAgB,EAChB,oBAAoB,EAAE,yCAAyC,EAC1E,iBAAiB,EAAE,+BAA+B,EAC/C,iBAAiB,EAAE,wCAAwC,EAChE,qBAAqB,EAAE,mCAAmC,EACvD,iBAAiB,EAAE,+BAA+B,EAC5C,kBAAkB,CAAC,EAAE,gCAAgC;IAMnI;;;OAGG;IACU,oBAAoB,CAAC,MAAM,EAAE;QACxC,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC;YAkDH,kBAAkB;IAsIhC,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,kBAAkB;IAS1B;;;;;;OAMG;YACW,sBAAsB;YAmCtB,cAAc;IAgE5B;;OAEG;YACW,aAAa;IA8E3B,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,4BAA4B;IAgBpC,OAAO,CAAC,+BAA+B;IAOvC;;OAEG;YACW,oBAAoB;CAoCnC"}
+{"version":3,"file":"milestone-evaluator.backend.service.d.ts","sourceRoot":"","sources":["../../../../src/guidance/services/milestone-evaluator.backend.service.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAuB1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAC;AAClG,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,iDAAiD,CAAC;AACjH,OAAO,KAAK,EAAE,gBAAgB,EAAoB,MAAM,uDAAuD,CAAC;AAChH,OAAO,KAAK,EAAE,yCAAyC,EAAE,MAAM,qGAAqG,CAAC;AACrK,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,KAAK,EAAE,wCAAwC,EAAE,MAAM,gDAAgD,CAAC;AAC/G,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,yEAAyE,CAAC;AAC/H,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,0EAA0E,CAAC;AAGhI,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,2CAA2C,CAAC;AAErG;;;;;;;;;;;;;;;;;GAiBG;AACH,qBACa,gCAAgC;IAKN,OAAO,CAAC,QAAQ,CAAC,MAAM;IACF,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IACvC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IAXjG,OAAO,CAAC,QAAQ,CAA+D;gBAGzB,MAAM,EAAE,aAAa,EACA,iBAAiB,EAAE,yCAAyC,EACvE,gBAAgB,EAAE,gBAAgB,EAChB,oBAAoB,EAAE,yCAAyC,EAC1E,iBAAiB,EAAE,+BAA+B,EAC/C,iBAAiB,EAAE,wCAAwC,EAChE,qBAAqB,EAAE,mCAAmC,EACvD,iBAAiB,EAAE,+BAA+B,EAC5C,kBAAkB,CAAC,EAAE,gCAAgC;IAMnI;;;OAGG;IACU,oBAAoB,CAAC,MAAM,EAAE;QACxC,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,MAAM,CAAC;QAC5B;;;;WAIG;QACH,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC;YAkDH,kBAAkB;IAsIhC,OAAO,CAAC,iBAAiB;IAmBzB,OAAO,CAAC,kBAAkB;IAS1B;;;;;;OAMG;YACW,sBAAsB;YAmCtB,cAAc;IAgE5B;;OAEG;YACW,aAAa;IA8E3B,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,mBAAmB;IAS3B,OAAO,CAAC,4BAA4B;IAgBpC,OAAO,CAAC,+BAA+B;IAOvC;;OAEG;YACW,oBAAoB;CAoCnC"}