agentfootprint 10.4.0 → 10.5.0

package/dist/identity/requestContext.js

@@ -0,0 +1,139 @@
+"use strict";
+/**
+ * requestContext — the INCOMING REQUEST's secrets, sealed for one run.
+ *
+ * A host that receives a per-request credential (an encrypted token in a
+ * header, a session-bound key) seals it here and hands the handle to the run:
+ *
+ * ```ts
+ * const request = requestContext({ secrets: { mcpToken: req.headers['x-mcp-token'] } });
+ * await agent.run({ message }, { request });
+ * ```
+ *
+ * ── Why a sealed handle and not a plain object ──────────────────────────────
+ * The run's input, its options and its state all travel: input and state into
+ * the commit log, the recorders and every exporter; options into whatever a
+ * host logs. A plain `{ mcpToken: '…' }` would ride all of them. The handle
+ * holds NOTHING an enumeration, `JSON.stringify`, `structuredClone` or an
+ * inspector can reach — the values live in a module-private `WeakMap` keyed by
+ * the handle, and only {@link requestSecretOf} (internal, never on a door)
+ * reads them. So the handle can sit in an options bag, be logged by accident,
+ * or be copied, and nothing secret moves with it.
+ *
+ * ── Who reads it ─────────────────────────────────────────────────────────────
+ * Only a credential provider, through `CredentialRequest.request`, which the
+ * framework fills from the run the call belongs to (`bindRequest`). The model
+ * never sees it, no stage writes it to scope, and a tool reaches what it
+ * vends only as `ctx.credential`.
+ *
+ * ── One request, one run ─────────────────────────────────────────────────────
+ * The framework decides WHICH handle a call carries — the agent's own run, or
+ * the run a composition opened for its members (`core/memberRun.ts`). A call
+ * with no run that carries a request gets none: a request credential then
+ * fails closed (`requestCredentials`), and is never borrowed from another run.
+ *
+ * Pattern: sealed value object (module-private WeakMap). Role: identity, run input.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.bindRequest = exports.requestSecretOf = exports.assertRequestContext = exports.isRequestContext = exports.requestContext = void 0;
+/** The sealed values, keyed by handle. Module-private: nothing else can read them. */
+const sealed = new WeakMap();
+const PLACEHOLDER = '[request context]';
+/**
+ * Seal an incoming request's secrets for one run. Pass the result as
+ * `run(input, { request })` (or `resume(…, { request })`); a credential
+ * provider built by `requestCredentials` reads it there.
+ *
+ * @throws TypeError when `secrets` is not a plain object of non-empty strings.
+ */
+function requestContext(options) {
+    const secrets = options?.secrets;
+    if (secrets === null || typeof secrets !== 'object' || Array.isArray(secrets)) {
+        throw new TypeError('requestContext: `secrets` must be an object of name → string.');
+    }
+    const values = new Map();
+    for (const name of Object.keys(secrets)) {
+        const value = secrets[name];
+        if (name === '')
+            throw new TypeError('requestContext: a secret name must not be empty.');
+        // The NAME is safe to say; the value never is.
+        if (typeof value !== 'string' || value === '') {
+            throw new TypeError(`requestContext: secret '${name}' must be a non-empty string — an absent value is ` +
+                'left out, never passed empty.');
+        }
+        values.set(name, value);
+    }
+    const handle = Object.create(handleProto);
+    Object.freeze(handle);
+    sealed.set(handle, values);
+    return handle;
+}
+exports.requestContext = requestContext;
+/**
+ * The handle's prototype — every reader that might print or copy it gets the
+ * placeholder. No own properties, so `Object.keys`, a spread or
+ * `structuredClone` yields `{}`.
+ */
+const handleProto = Object.freeze({
+    toJSON: () => PLACEHOLDER,
+    toString: () => PLACEHOLDER,
+    [Symbol.toStringTag]: 'RequestContext',
+    [Symbol.for('nodejs.util.inspect.custom')]: () => PLACEHOLDER,
+});
+/** Whether `value` is a handle {@link requestContext} built. */
+function isRequestContext(value) {
+    return typeof value === 'object' && value !== null && sealed.has(value);
+}
+exports.isRequestContext = isRequestContext;
+/**
+ * Refuse a `request` that {@link requestContext} did not build — at the door
+ * the caller used, before anything moves. A plain object would carry its
+ * values wherever the options travel.
+ *
+ * @throws TypeError naming the door.
+ */
+function assertRequestContext(value, door) {
+    if (value === undefined || isRequestContext(value))
+        return;
+    throw new TypeError(`${door}: \`request\` must be built by requestContext({ secrets }) — a plain object is ` +
+        'refused, because its values would travel wherever these options are logged or copied.');
+}
+exports.assertRequestContext = assertRequestContext;
+/**
+ * The secret a sealed request holds under `name`, or `undefined`.
+ *
+ * @internal Never re-exported on a door. The only reader is a credential
+ * provider in this folder, which turns it into a `Credential` for one call.
+ */
+function requestSecretOf(request, name) {
+    if (typeof request !== 'object' || request === null)
+        return undefined;
+    return sealed.get(request)?.get(name);
+}
+exports.requestSecretOf = requestSecretOf;
+/**
+ * The provider a call of ONE run is handed: a `getCredential` for `service` —
+ * the service the calling tool DECLARES in its `needs` — carries that run's
+ * request, and only that run's. A request the caller put on the request
+ * itself is always replaced (or removed), so a tool cannot present another
+ * run's handle through `ctx.credentials`; and a call for any OTHER service
+ * carries no request, so a tool cannot pull a request credential it never
+ * declared. `service` undefined → no call carries a request.
+ *
+ * Every other field passes through untouched; the provider's `id` is kept.
+ *
+ * @internal The framework's binding; not on a door.
+ */
+function bindRequest(provider, request, service) {
+    return {
+        id: provider.id,
+        getCredential(req) {
+            const { request: _presented, ...rest } = req;
+            void _presented;
+            const carries = request !== undefined && service !== undefined && req.service === service;
+            return provider.getCredential(carries ? { ...rest, request } : rest);
+        },
+    };
+}
+exports.bindRequest = bindRequest;
+//# sourceMappingURL=requestContext.js.map

package/dist/identity/requestContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestContext.js","sourceRoot":"","sources":["../../src/identity/requestContext.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;;;AAIH,sFAAsF;AACtF,MAAM,MAAM,GAAG,IAAI,OAAO,EAAuC,CAAC;AAyBlE,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,OAA8B;IAC3D,MAAM,OAAO,GAAI,OAAsD,EAAE,OAAO,CAAC;IACjF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,KAAK,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QACzF,+CAA+C;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,SAAS,CACjB,2BAA2B,IAAI,oDAAoD;gBACjF,+BAA+B,CAClC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAmB,CAAC;IAC5D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAtBD,wCAsBC;AAED;;;;GAIG;AACH,MAAM,WAAW,GAAW,MAAM,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW;IACzB,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW;IAC3B,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,gBAAgB;IACtC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW;CAC9D,CAAC,CAAC;AAEH,gEAAgE;AAChE,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAFD,4CAEC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,KAAc,EAAE,IAAY;IAC/D,IAAI,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO;IAC3D,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,iFAAiF;QACtF,uFAAuF,CAC1F,CAAC;AACJ,CAAC;AAND,oDAMC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,OAAgB,EAAE,IAAY;IAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAHD,0CAGC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,WAAW,CACzB,QAA4B,EAC5B,OAAmC,EACnC,OAA2B;IAE3B,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,aAAa,CAAC,GAAsB;YAClC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;YAC7C,KAAK,UAAU,CAAC;YAChB,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC;YAC1F,OAAO,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAdD,kCAcC"}

package/dist/identity/requestCredentials.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * requestCredentials — a {@link CredentialProvider} fed from the INCOMING
+ * REQUEST: the credential a tool uses is the one this run's caller sent.
+ *
+ * ```ts
+ * import { requestCredentials, requestContext, decodedWith } from 'agentfootprint/security';
+ *
+ * // Once, at boot — no secret in here:
+ * const credentials = requestCredentials({
+ *   services: {
+ *     crm: 'crmToken',                                         // bearer, as sent
+ *     billing: { secret: 'billingKey', as: asApiKey('x-api-key') },
+ *     mcp: { secret: 'mcpToken', as: decodedWith((raw) => decrypt(raw)) },
+ *   },
+ * });
+ * const agent = Agent.create({ provider, credentials }).tool(crmTool).build();
+ *
+ * // Per request:
+ * await agent.run({ message }, { request: requestContext({ secrets: { crmToken, mcpToken } }) });
+ * ```
+ *
+ * A tool declares `needs: { credential: 'crm' }` and reads `ctx.credential`,
+ * exactly as with any other provider. Nothing about the tool changes.
+ *
+ * ── Interface → adapter → strategies ────────────────────────────────────────
+ * The interface is the `CredentialProvider` port. This adapter reads the
+ * secret named for the service from the request the call belongs to
+ * (`CredentialRequest.request`, filled by the framework). A strategy turns the
+ * raw value into a `Credential`: {@link asBearer} (the default),
+ * {@link asApiKey}, or {@link decodedWith} for a value that must be decrypted
+ * or exchanged first.
+ *
+ * ── Fails closed, by name ───────────────────────────────────────────────────
+ * Every refusal is a {@link RequestCredentialError} naming the SERVICE and the
+ * secret's NAME — never a value, and never a strategy's own error text (a
+ * decrypt library may quote its input). A thrown message reaches the model as
+ * the tool result and rides `agentfootprint.credential.failed`.
+ *   - no request on the call (a run started without one, a mount no run
+ *     reaches, a connection-level caller) → `'no-request'`;
+ *   - the request does not carry the secret → `'missing'`;
+ *   - a service this provider was not told about → `'unknown-service'`;
+ *   - the strategy threw or returned no credential → `'undecodable'`.
+ * There is no fallback: a missing per-request credential is never served from
+ * another request, a default, or the process.
+ *
+ * Pattern: Adapter (port) + Strategy (raw value → Credential).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestCredentials = exports.decodedWith = exports.asApiKey = exports.asBearer = exports.RequestCredentialError = void 0;
+const kinds_js_1 = require("./kinds.js");
+const requestContext_js_1 = require("./requestContext.js");
+/**
+ * A request credential that could not be served. Its message names the
+ * service and the secret's name; it never carries a value or a strategy's
+ * own error.
+ */
+class RequestCredentialError extends Error {
+    reason;
+    service;
+    code = 'ERR_REQUEST_CREDENTIAL';
+    constructor(reason, service, message) {
+        super(message);
+        this.reason = reason;
+        this.service = service;
+        this.name = 'RequestCredentialError';
+    }
+}
+exports.RequestCredentialError = RequestCredentialError;
+/** The raw value, as a bearer token (`Authorization: Bearer …`). The default. */
+function asBearer() {
+    return (raw) => (0, kinds_js_1.bearer)(raw);
+}
+exports.asBearer = asBearer;
+/** The raw value, as an API key in one header (default `x-api-key`). */
+function asApiKey(headerName) {
+    return (raw) => (0, kinds_js_1.apiKey)(raw, headerName);
+}
+exports.asApiKey = asApiKey;
+/**
+ * Decode the raw value first — decrypt an encrypted per-request token,
+ * exchange it — then read the result with `then` (default {@link asBearer}).
+ * `decode` may return the plain value or a finished `Credential`. Whatever it
+ * throws is replaced by an `'undecodable'` refusal that quotes nothing.
+ */
+function decodedWith(decode, then = asBearer()) {
+    return async (raw) => {
+        const decoded = await decode(raw);
+        return typeof decoded === 'string' ? then(decoded) : decoded;
+    };
+}
+exports.decodedWith = decodedWith;
+/**
+ * Build the provider. Configuration is checked here, at boot: an empty
+ * service map, an empty secret name or a strategy that is not a function is
+ * refused by name.
+ *
+ * @throws TypeError on a malformed `services` map.
+ */
+function requestCredentials(options) {
+    const sources = readSources(options?.services);
+    return {
+        id: options.id ?? 'request-credentials',
+        async getCredential(req) {
+            const service = req.service;
+            const source = Object.hasOwn(sources, service) ? sources[service] : undefined;
+            if (source === undefined) {
+                throw new RequestCredentialError('unknown-service', service, `requestCredentials: no request credential is declared for service '${service}'.`);
+            }
+            if (req.request === undefined) {
+                throw new RequestCredentialError('no-request', service, `requestCredentials: service '${service}' takes its credential from the incoming ` +
+                    'request, and the call carries none — pass `request: requestContext({ secrets })` ' +
+                    'to the run. A credential is never borrowed from another request.');
+            }
+            const raw = (0, requestContext_js_1.requestSecretOf)(req.request, source.secret);
+            if (raw === undefined) {
+                throw new RequestCredentialError('missing', service, `requestCredentials: the request carries no '${source.secret}' secret for service ` +
+                    `'${service}'.`);
+            }
+            let credential;
+            try {
+                credential = await source.as(raw);
+            }
+            catch {
+                credential = undefined;
+            }
+            if (!isCredential(credential)) {
+                throw new RequestCredentialError('undecodable', service, `requestCredentials: the '${source.secret}' secret for service '${service}' could ` +
+                    'not be read as a credential.');
+            }
+            return { status: 'issued', credential };
+        },
+    };
+}
+exports.requestCredentials = requestCredentials;
+function readSources(services) {
+    if (services === null || typeof services !== 'object' || Array.isArray(services)) {
+        throw new TypeError('requestCredentials: `services` must be an object of service → source.');
+    }
+    const out = Object.create(null);
+    const names = Object.keys(services);
+    if (names.length === 0) {
+        throw new TypeError('requestCredentials: `services` names no service.');
+    }
+    for (const service of names) {
+        const entry = services[service];
+        const secret = typeof entry === 'string' ? entry : entry?.secret;
+        const as = typeof entry === 'string' ? undefined : entry?.as;
+        if (typeof secret !== 'string' || secret === '') {
+            throw new TypeError(`requestCredentials: service '${service}' must name its secret (a non-empty string).`);
+        }
+        if (as !== undefined && typeof as !== 'function') {
+            throw new TypeError(`requestCredentials: service '${service}': \`as\` must be a strategy function.`);
+        }
+        out[service] = { secret, as: as ?? asBearer() };
+    }
+    return out;
+}
+function isCredential(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        typeof value.kind === 'string' &&
+        typeof value.toHeaders === 'function');
+}
+//# sourceMappingURL=requestCredentials.js.map

package/dist/identity/requestCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestCredentials.js","sourceRoot":"","sources":["../../src/identity/requestCredentials.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;;;AAQH,yCAA4C;AAC5C,2DAAsD;AA2BtD;;;;GAIG;AACH,MAAa,sBAAuB,SAAQ,KAAK;IAIpC;IACA;IAJF,IAAI,GAAG,wBAAiC,CAAC;IAElD,YACW,MAAgC,EAChC,OAAe,EACxB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAA0B;QAChC,YAAO,GAAP,OAAO,CAAQ;QAIxB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAXD,wDAWC;AAED,iFAAiF;AACjF,SAAgB,QAAQ;IACtB,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,iBAAM,EAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAFD,4BAEC;AAED,wEAAwE;AACxE,SAAgB,QAAQ,CAAC,UAAmB;IAC1C,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,iBAAM,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAFD,4BAEC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CACzB,MAA2E,EAC3E,OAAkC,QAAQ,EAAE;IAE5C,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AARD,kCAQC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAAC,OAAkC;IACnE,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,qBAAqB;QACvC,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,sBAAsB,CAC9B,iBAAiB,EACjB,OAAO,EACP,sEAAsE,OAAO,IAAI,CAClF,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,CAC9B,YAAY,EACZ,OAAO,EACP,gCAAgC,OAAO,2CAA2C;oBAChF,mFAAmF;oBACnF,kEAAkE,CACrE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,IAAA,mCAAe,EAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACxD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,sBAAsB,CAC9B,SAAS,EACT,OAAO,EACP,+CAA+C,MAAM,CAAC,MAAM,uBAAuB;oBACjF,IAAI,OAAO,IAAI,CAClB,CAAC;YACJ,CAAC;YACD,IAAI,UAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,GAAG,SAAS,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,sBAAsB,CAC9B,aAAa,EACb,OAAO,EACP,4BAA4B,MAAM,CAAC,MAAM,yBAAyB,OAAO,UAAU;oBACjF,8BAA8B,CACjC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAjDD,gDAiDC;AAOD,SAAS,WAAW,CAAC,QAAiB;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,uEAAuE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,GAAG,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAI,QAAoC,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,KAA8B,EAAE,MAAM,CAAC;QAC3F,MAAM,EAAE,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAA0B,EAAE,EAAE,CAAC;QACnF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CACjB,gCAAgC,OAAO,8CAA8C,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,EAAE,KAAK,UAAU,EAAE,CAAC;YACjD,MAAM,IAAI,SAAS,CACjB,gCAAgC,OAAO,wCAAwC,CAChF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAG,EAA4C,IAAI,QAAQ,EAAE,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAAoB,CAAC,IAAI,KAAK,QAAQ;QAC9C,OAAQ,KAAoB,CAAC,SAAS,KAAK,UAAU,CACtD,CAAC;AACJ,CAAC"}

package/dist/identity/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAoGH,yEAAyE;AACzE,SAAgB,kBAAkB,CAAC,CAAmB;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAFD,gDAEC;AAgBD;;;;;;GAMG;AACH,SAAgB,8BAA8B;IAC5C,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,aAAa,CAAC,GAAsB;YAClC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,4DAA4D,GAAG,CAAC,OAAO,QAAQ;gBAC7E,wEAAwE;gBACxE,gEAAgE,CACnE,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAbD,wEAaC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/identity/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;;AAgHH,yEAAyE;AACzE,SAAgB,kBAAkB,CAAC,CAAmB;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;AAC/B,CAAC;AAFD,gDAEC;AAgBD;;;;;;GAMG;AACH,SAAgB,8BAA8B;IAC5C,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,aAAa,CAAC,GAAsB;YAClC,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,4DAA4D,GAAG,CAAC,OAAO,QAAQ;gBAC7E,wEAAwE;gBACxE,gEAAgE,CACnE,CACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAbD,wEAaC"}

package/dist/identity.js

@@ -29,7 +29,7 @@
  * symbols, one door. Import from the door.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IdentityConfigError = exports.identityConfigFromEnv = exports.SCRYPT_FLOOR = exports.SCRYPT_DEFAULT = exports.LocalPasswordConfigError = exports.localPasswords = exports.hashPassword = exports.escapeFilterValue = exports.adSubCodeName = exports.MissingLdaptsError = exports.ldapDirectory = exports.directoryPasswords = exports.identityFromConfig = exports.oidcSignIn = exports.OidcSignInSetupError = exports.MissingOpenIdClientError = exports.oidcIdentity = exports.MissingJwksSupportError = exports.jwksIdentity = exports.AZURE_COGNITIVE_SERVICES_SCOPE = exports.AZURE_MANAGEMENT_SCOPE = exports.AZURE_AI_SCOPE = exports.entraIdentity = exports.CLOUD_PLATFORM_SCOPE = exports.googleIdentity = exports.vaultCredentials = exports.completeAgentCoreAuthorization = exports.agentCoreIdentity = exports.withCredentialRetry = exports.CredentialConsentRequiredError = exports.staticTokens = exports.headers = exports.basic = exports.apiKey = exports.bearer = exports.unconfiguredCredentialProvider = exports.isCredentialIssued = void 0;
+exports.IdentityConfigError = exports.identityConfigFromEnv = exports.SCRYPT_FLOOR = exports.SCRYPT_DEFAULT = exports.LocalPasswordConfigError = exports.localPasswords = exports.hashPassword = exports.escapeFilterValue = exports.adSubCodeName = exports.MissingLdaptsError = exports.ldapDirectory = exports.directoryPasswords = exports.identityFromConfig = exports.oidcSignIn = exports.OidcSignInSetupError = exports.MissingOpenIdClientError = exports.oidcIdentity = exports.MissingJwksSupportError = exports.jwksIdentity = exports.AZURE_COGNITIVE_SERVICES_SCOPE = exports.AZURE_MANAGEMENT_SCOPE = exports.AZURE_AI_SCOPE = exports.entraIdentity = exports.CLOUD_PLATFORM_SCOPE = exports.googleIdentity = exports.vaultCredentials = exports.completeAgentCoreAuthorization = exports.agentCoreIdentity = exports.withCredentialRetry = exports.CredentialConsentRequiredError = exports.RequestCredentialError = exports.decodedWith = exports.asApiKey = exports.asBearer = exports.requestCredentials = exports.isRequestContext = exports.requestContext = exports.staticTokens = exports.headers = exports.basic = exports.apiKey = exports.bearer = exports.unconfiguredCredentialProvider = exports.isCredentialIssued = void 0;
 var types_js_1 = require("./identity/types.js");
 Object.defineProperty(exports, "isCredentialIssued", { enumerable: true, get: function () { return types_js_1.isCredentialIssued; } });
 Object.defineProperty(exports, "unconfiguredCredentialProvider", { enumerable: true, get: function () { return types_js_1.unconfiguredCredentialProvider; } });
@@ -40,6 +40,18 @@ Object.defineProperty(exports, "basic", { enumerable: true, get: function () { r
 Object.defineProperty(exports, "headers", { enumerable: true, get: function () { return kinds_js_1.headers; } });
 var staticTokens_js_1 = require("./identity/staticTokens.js");
 Object.defineProperty(exports, "staticTokens", { enumerable: true, get: function () { return staticTokens_js_1.staticTokens; } });
+// Credentials from the INCOMING REQUEST: the host seals the request's secrets
+// per run (`requestContext`), and `requestCredentials` vends them to a tool's
+// declared `needs` — only for the run that carries them, failing closed by name.
+var requestContext_js_1 = require("./identity/requestContext.js");
+Object.defineProperty(exports, "requestContext", { enumerable: true, get: function () { return requestContext_js_1.requestContext; } });
+Object.defineProperty(exports, "isRequestContext", { enumerable: true, get: function () { return requestContext_js_1.isRequestContext; } });
+var requestCredentials_js_1 = require("./identity/requestCredentials.js");
+Object.defineProperty(exports, "requestCredentials", { enumerable: true, get: function () { return requestCredentials_js_1.requestCredentials; } });
+Object.defineProperty(exports, "asBearer", { enumerable: true, get: function () { return requestCredentials_js_1.asBearer; } });
+Object.defineProperty(exports, "asApiKey", { enumerable: true, get: function () { return requestCredentials_js_1.asApiKey; } });
+Object.defineProperty(exports, "decodedWith", { enumerable: true, get: function () { return requestCredentials_js_1.decodedWith; } });
+Object.defineProperty(exports, "RequestCredentialError", { enumerable: true, get: function () { return requestCredentials_js_1.RequestCredentialError; } });
 var CredentialConsentRequiredError_js_1 = require("./identity/CredentialConsentRequiredError.js");
 Object.defineProperty(exports, "CredentialConsentRequiredError", { enumerable: true, get: function () { return CredentialConsentRequiredError_js_1.CredentialConsentRequiredError; } });
 var withCredentialRetry_js_1 = require("./identity/withCredentialRetry.js");

package/dist/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAWH,gDAAyF;AAAhF,8GAAA,kBAAkB,OAAA;AAAE,0HAAA,8BAA8B,OAAA;AAC3D,gDAS6B;AAR3B,kGAAA,MAAM,OAAA;AACN,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,mGAAA,OAAO,OAAA;AAMT,8DAAoF;AAA3E,+GAAA,YAAY,OAAA;AAKrB,kGAGsD;AAFpD,mJAAA,8BAA8B,OAAA;AAGhC,4EAG2C;AAFzC,6HAAA,mBAAmB,OAAA;AAGrB,iEAU0C;AATxC,iHAAA,iBAAiB,OAAA;AACjB,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,8HAAA,8BAA8B,OAAA;AAMhC,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,yDAA8F;AAArF,4GAAA,gBAAgB,OAAA;AAEzB,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,2DAMuC;AALrC,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAMtB,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,yDASsC;AARpC,yGAAA,aAAa,OAAA;AACb,0GAAA,cAAc,OAAA;AACd,kHAAA,sBAAsB,OAAA;AACtB,0HAAA,8BAA8B,OAAA;AAOhC,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,uDAOqC;AANnC,uGAAA,YAAY,OAAA;AACZ,kHAAA,uBAAuB,OAAA;AAOzB,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,4BAA4B;AAC5B,uDAMqC;AALnC,uGAAA,YAAY,OAAA;AAOd,sEAAsE;AACtE,+EAA+E;AAC/E,iFAAiF;AACjF,mEAO2C;AANzC,yHAAA,wBAAwB,OAAA;AACxB,qHAAA,oBAAoB,OAAA;AACpB,2GAAA,UAAU,OAAA;AAKZ,sEAKkD;AAJhD,+GAAA,kBAAkB,OAAA;AAKpB,qEAAqE;AACrE,6EAA6E;AAC7E,6FAG6D;AAF3D,2HAAA,kBAAkB,OAAA;AAGpB,mFAKwD;AAJtD,iHAAA,aAAa,OAAA;AACb,sHAAA,kBAAkB,OAAA;AAIpB,iEAQ+C;AAP7C,wGAAA,aAAa,OAAA;AACb,4GAAA,iBAAiB,OAAA;AAOnB,8EAA8E;AAC9E,wEAAwE;AACxE,yEAO8C;AAN5C,gHAAA,YAAY,OAAA;AACZ,kHAAA,cAAc,OAAA;AACd,4HAAA,wBAAwB,OAAA;AACxB,kHAAA,cAAc,OAAA;AACd,gHAAA,YAAY,OAAA;AAGd,sEAIkD;AAHhD,kHAAA,qBAAqB,OAAA;AACrB,gHAAA,mBAAmB,OAAA"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;;;AAWH,gDAAyF;AAAhF,8GAAA,kBAAkB,OAAA;AAAE,0HAAA,8BAA8B,OAAA;AAC3D,gDAS6B;AAR3B,kGAAA,MAAM,OAAA;AACN,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,mGAAA,OAAO,OAAA;AAMT,8DAAoF;AAA3E,+GAAA,YAAY,OAAA;AACrB,8EAA8E;AAC9E,8EAA8E;AAC9E,iFAAiF;AACjF,kEAKsC;AAJpC,mHAAA,cAAc,OAAA;AACd,qHAAA,gBAAgB,OAAA;AAIlB,0EAU0C;AATxC,2HAAA,kBAAkB,OAAA;AAClB,iHAAA,QAAQ,OAAA;AACR,iHAAA,QAAQ,OAAA;AACR,oHAAA,WAAW,OAAA;AACX,+HAAA,sBAAsB,OAAA;AAUxB,kGAGsD;AAFpD,mJAAA,8BAA8B,OAAA;AAGhC,4EAG2C;AAFzC,6HAAA,mBAAmB,OAAA;AAGrB,iEAU0C;AATxC,iHAAA,iBAAiB,OAAA;AACjB,6EAA6E;AAC7E,wEAAwE;AACxE,gDAAgD;AAChD,8HAAA,8BAA8B,OAAA;AAMhC,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,yDAA8F;AAArF,4GAAA,gBAAgB,OAAA;AAEzB,4EAA4E;AAC5E,uEAAuE;AACvE,6EAA6E;AAC7E,6DAA6D;AAC7D,2DAMuC;AALrC,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AAMtB,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,0EAA0E;AAC1E,gEAAgE;AAChE,yDASsC;AARpC,yGAAA,aAAa,OAAA;AACb,0GAAA,cAAc,OAAA;AACd,kHAAA,sBAAsB,OAAA;AACtB,0HAAA,8BAA8B,OAAA;AAOhC,8EAA8E;AAC9E,iEAAiE;AACjE,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,uDAOqC;AANnC,uGAAA,YAAY,OAAA;AACZ,kHAAA,uBAAuB,OAAA;AAOzB,4EAA4E;AAC5E,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,+EAA+E;AAC/E,4BAA4B;AAC5B,uDAMqC;AALnC,uGAAA,YAAY,OAAA;AAOd,sEAAsE;AACtE,+EAA+E;AAC/E,iFAAiF;AACjF,mEAO2C;AANzC,yHAAA,wBAAwB,OAAA;AACxB,qHAAA,oBAAoB,OAAA;AACpB,2GAAA,UAAU,OAAA;AAKZ,sEAKkD;AAJhD,+GAAA,kBAAkB,OAAA;AAKpB,qEAAqE;AACrE,6EAA6E;AAC7E,6FAG6D;AAF3D,2HAAA,kBAAkB,OAAA;AAGpB,mFAKwD;AAJtD,iHAAA,aAAa,OAAA;AACb,sHAAA,kBAAkB,OAAA;AAIpB,iEAQ+C;AAP7C,wGAAA,aAAa,OAAA;AACb,4GAAA,iBAAiB,OAAA;AAOnB,8EAA8E;AAC9E,wEAAwE;AACxE,yEAO8C;AAN5C,gHAAA,YAAY,OAAA;AACZ,kHAAA,cAAc,OAAA;AACd,4HAAA,wBAAwB,OAAA;AACxB,kHAAA,cAAc,OAAA;AACd,gHAAA,YAAY,OAAA;AAGd,sEAIkD;AAHhD,kHAAA,qBAAqB,OAAA;AACrB,gHAAA,mBAAmB,OAAA"}

package/dist/index.js

@@ -27,10 +27,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.StaleDecisionError = exports.DecisionRequiredError = exports.pauseDemandsDecision = exports.isAskPause = exports.isCheckInPause = exports.isPaused = exports.isPauseRequest = exports.isInputPause = exports.requestInput = exports.askHuman = exports.pauseHere = exports.makeRunId = exports.RunnerBase = exports.BASELINE_SOURCES = exports.ENGINEERED_SOURCES = exports.isBaselineSource = exports.isEngineeredSource = exports.contextEngineering = exports.COMPOSITION_KEYS = exports.UNGAPPED_FIELDS = exports.SERVED_GAPS = exports.TRANSFORM_HASH_PREFIX = exports.RECEIPT_BOUNDARY = exports.transformHashOf = exports.servedViews = exports.servedAt = exports.receiptHash = exports.receiptAt = exports.toolDigestInput = exports.messageDigestInput = exports.keyedFold = exports.epochLocations = exports.epochAt = exports.milestoneStopsStrategy = exports.milestoneStops = exports.milestoneOf = exports.isReservedSubflowSegment = exports.RESERVED_SUBFLOW_PREFIX = exports.milestoneFromTags = exports.milestoneTagsFor = exports.milestoneTags = exports.milestoneTag = exports.MILESTONE_LABEL_TAG_PREFIX = exports.MILESTONE_TAG_PREFIX = exports.MILESTONE_KINDS = exports.milestoneFor = exports.stageRole = exports.isInjectionKey = exports.injectionKeyForSlot = exports.INJECTION_KEYS = void 0;
 exports.PRIOR_TURN_EVIDENCE_CEILING = exports.assertResultColumns = exports.COLUMN_TYPES = exports.readRowset = exports.COLUMN_TYPE_CEILING = exports.EMPTY_LOOKUP_CEILING = exports.isTruncatedToolResult = exports.LIBRARY_NOTE_OPENING = exports.LIBRARY_AUTHORED_PREFIXES = exports.isSaidByPerson = exports.isLibraryAuthoredFrame = exports.tokenBudget = exports.summarizeOldest = exports.slidingWindow = exports.isDropNotice = exports.isCompactedSummary = exports.foldedSpanFor = exports.foldedMessages = exports.DROP_NOTICE_PREFIX = exports.COMPACTED_FRAME_PREFIX = exports.CompactionUnmeasurableError = exports.AgentBuilder = exports.Agent = exports.buildAgentMessageApiChart = exports.LLMCallBuilder = exports.LLMCall = exports.selectCommentaryKey = exports.renderCommentary = exports.extractCommentaryVars = exports.extractAgentName = exports.defaultCommentaryTemplates = exports.CheckInRecorder = exports.minimalEvidenceAssembler = exports.standardEvidenceAssembler = exports.lexicalDriverScorer = exports.isCheckInDecision = exports.checkInDeclined = exports.checkInApproved = exports.ACT_KEYS = exports.actKeyFor = exports.LOOP_MOMENTS = exports.MessageDeniedError = exports.deny = exports.ask = exports.allow = exports.InvalidAskComponentError = exports.assertAskComponent = exports.readAskComponent = exports.InputRequestError = exports.PauseAnswerRequiredError = void 0;
-exports.explainStatusOnlyNearMiss = exports.warnIfInvalidToolName = exports.assertValidToolName = exports.assertGates = exports.assertComposedOf = exports.assertResultKind = exports.assertResultClass = exports.assertResultCeiling = exports.defineTool = exports.verdictRowsOf = exports.VERDICT_RENDER_NOTE = exports.RunbookAbsenceSignal = exports.runbookAsTool = exports.renderVerdictTable = exports.recordingDispatch = exports.projectWalk = exports.probeDispatch = exports.PANEL_RENDER_NOTE = exports.DEFAULT_WALK_CAP = exports.DEFAULT_RECORDING_MAX_BYTES = exports.DEFAULT_MAX_ROWS = exports.DECLINED_VERDICT = exports.absenceSignalOf = exports.flowchartAsTool = exports.ParentRunRefusedError = exports.MemberIdentityError = exports.RunInFlightError = exports.ResumeRedactionError = exports.ResumeIdentityConflictError = exports.PendingQuestionError = exports.NoConversationError = exports.isContextWindowExceeded = exports.ERR_CONTEXT_WINDOW_EXCEEDED = exports.ContextWindowExceededError = exports.DEFAULT_SESSION_STORAGE_KEY = exports.browserSessionId = exports.RunCheckpointError = exports.ConversationMismatchError = exports.canResume = exports.UnsupportedValuesError = exports.EVIDENCE_CHECK_FRAME_PREFIX = exports.isSchemaCheckMessage = exports.SCHEMA_TOOL_NAME = exports.SCHEMA_CHECK_FRAME_PREFIX = exports.InvalidRunInputError = exports.TOOL_CHOICE_QUESTION = exports.ALWAYS_SERVED_TOOLS = exports.RESERVED_ARGUMENT = exports.applyOutputSchema = exports.OutputSchemaError = void 0;
-exports.gcsArtifacts = exports.fileArtifacts = exports.DEFAULT_IN_MEMORY_ARTIFACT_RETENTION = exports.UnserializableRecordingError = exports.chartWalkPutInput = exports.CHART_WALK_ARTIFACT_KIND = exports.recordingPutInput = exports.RECORDING_MEDIA_TYPE = exports.RECORDING_ARTIFACT_KIND = exports.bindArtifacts = exports.ArtifactIntegrityError = exports.ARTIFACT_REF_PREFIX = exports.formatToolContractCheckup = exports.toolContractCheckup = exports.TOOL_SESSIONS = exports.toolSessionsOf = exports.codeRunsOf = exports.codeShape = exports.codeRunnerTool = exports.TOOL_TEARDOWN_TIMEOUT_MS = exports.ToolTeardownTimeoutError = exports.hashSessionKey = exports.toolSessionKey = exports.semanticsForModel = exports.SEMANTICS_NOTE = exports.SEMANTICS_MARKER = exports.RESULT_CLASSES = exports.readSemantics = exports.isCounterLookingAggregation = exports.explainSemantics = exports.describedResult = exports.COUNTER_AGGREGATION_WORDS = exports.composeNotCovered = exports.IN_PROGRESS_WIRE = exports.IN_PROGRESS_SECTION_LABEL = exports.IN_PROGRESS_CLAUSE = exports.periodVerdict = exports.PERIOD_WIRE = exports.readCoverageResult = exports.readCoverageLedger = exports.readAbsence = exports.COVERAGE_NOTE = exports.COVERAGE_MARKER = exports.COVERAGE_BLOCK_HEADING = exports.coverage = exports.absent = exports.ABSENCE_NOTE = exports.ABSENCE_MARKER = exports.TOOL_RESULT_STATUSES = exports.readToolResultEnvelope = void 0;
-exports.topK = exports.indexDocuments = exports.DEFAULT_CORPUS_IDENTITY = exports.defineRAG = exports.providerFromEnv = exports.Graph = exports.graph = exports.Workflow = exports.workflow = exports.LoopBuilder = exports.Loop = exports.ConditionalBuilder = exports.Conditional = exports.ParallelBuilder = exports.Parallel = exports.SequenceBuilder = exports.Sequence = exports.PRESENT_TOOL_NAME = exports.placedResultKind = exports.isPlacedToolResult = exports.assertToolWants = exports.runArtifactStoreConformance = exports.runArtifactStoreCase = exports.formatArtifactStoreReport = exports.artifactStoreConformance = exports.canStreamArtifacts = exports.canPutArtifactStream = exports.canGetArtifactStream = exports.elicitationOf = exports.answerFromElicitation = exports.defaultTimeAskMessages = exports.englishTimeReader = exports.TIME_AXIS_UNITS = exports.TIME_AXIS_AGGREGATES = exports.timeAxisIssues = exports.readTimeAxis = exports.normaliseInstants = exports.describeTimeAxis = exports.stageDatasetArtifacts = exports.withDatasetArtifacts = exports.UnreadableArtifactStoreError = exports.UnreadableArtifactFileError = exports.UnknownParentRefError = exports.unconfiguredArtifacts = exports.sqliteArtifacts = exports.s3Artifacts = exports.mintArtifactRef = exports.isArtifactRef = exports.InvalidArtifactError = exports.inMemoryArtifacts = void 0;
-exports.AnswerValidationError = void 0;
+exports.fromCredential = exports.hostFilled = exports.assertGates = exports.assertComposedOf = exports.assertResultKind = exports.assertResultClass = exports.assertResultCeiling = exports.defineTool = exports.verdictRowsOf = exports.VERDICT_RENDER_NOTE = exports.RunbookAbsenceSignal = exports.runbookAsTool = exports.renderVerdictTable = exports.recordingDispatch = exports.projectWalk = exports.probeDispatch = exports.PANEL_RENDER_NOTE = exports.DEFAULT_WALK_CAP = exports.DEFAULT_RECORDING_MAX_BYTES = exports.DEFAULT_MAX_ROWS = exports.DECLINED_VERDICT = exports.absenceSignalOf = exports.flowchartAsTool = exports.ResumeRequestConflictError = exports.ParentRunRefusedError = exports.MemberIdentityError = exports.RunInFlightError = exports.ResumeRedactionError = exports.ResumeIdentityConflictError = exports.PendingQuestionError = exports.NoConversationError = exports.isContextWindowExceeded = exports.ERR_CONTEXT_WINDOW_EXCEEDED = exports.ContextWindowExceededError = exports.DEFAULT_SESSION_STORAGE_KEY = exports.browserSessionId = exports.RunCheckpointError = exports.ConversationMismatchError = exports.canResume = exports.UnsupportedValuesError = exports.EVIDENCE_CHECK_FRAME_PREFIX = exports.isSchemaCheckMessage = exports.SCHEMA_TOOL_NAME = exports.SCHEMA_CHECK_FRAME_PREFIX = exports.InvalidRunInputError = exports.TOOL_CHOICE_QUESTION = exports.ALWAYS_SERVED_TOOLS = exports.RESERVED_ARGUMENT = exports.applyOutputSchema = exports.OutputSchemaError = void 0;
+exports.RECORDING_MEDIA_TYPE = exports.RECORDING_ARTIFACT_KIND = exports.bindArtifacts = exports.ArtifactIntegrityError = exports.ARTIFACT_REF_PREFIX = exports.formatToolContractCheckup = exports.toolContractCheckup = exports.TOOL_SESSIONS = exports.toolSessionsOf = exports.codeRunsOf = exports.codeShape = exports.codeRunnerTool = exports.TOOL_TEARDOWN_TIMEOUT_MS = exports.ToolTeardownTimeoutError = exports.hashSessionKey = exports.toolSessionKey = exports.semanticsForModel = exports.SEMANTICS_NOTE = exports.SEMANTICS_MARKER = exports.RESULT_CLASSES = exports.readSemantics = exports.isCounterLookingAggregation = exports.explainSemantics = exports.describedResult = exports.COUNTER_AGGREGATION_WORDS = exports.composeNotCovered = exports.IN_PROGRESS_WIRE = exports.IN_PROGRESS_SECTION_LABEL = exports.IN_PROGRESS_CLAUSE = exports.periodVerdict = exports.PERIOD_WIRE = exports.readCoverageResult = exports.readCoverageLedger = exports.readAbsence = exports.COVERAGE_NOTE = exports.COVERAGE_MARKER = exports.COVERAGE_BLOCK_HEADING = exports.coverage = exports.absent = exports.ABSENCE_NOTE = exports.ABSENCE_MARKER = exports.TOOL_RESULT_STATUSES = exports.readToolResultEnvelope = exports.explainStatusOnlyNearMiss = exports.warnIfInvalidToolName = exports.assertValidToolName = exports.HOST_FILLED_PLACEHOLDER = exports.HostFilledValueMissingError = exports.HostFilledArgumentError = exports.fromIdentity = void 0;
+exports.Workflow = exports.workflow = exports.LoopBuilder = exports.Loop = exports.ConditionalBuilder = exports.Conditional = exports.ParallelBuilder = exports.Parallel = exports.SequenceBuilder = exports.Sequence = exports.PRESENT_TOOL_NAME = exports.placedResultKind = exports.isPlacedToolResult = exports.assertToolWants = exports.runArtifactStoreConformance = exports.runArtifactStoreCase = exports.formatArtifactStoreReport = exports.artifactStoreConformance = exports.canStreamArtifacts = exports.canPutArtifactStream = exports.canGetArtifactStream = exports.elicitationOf = exports.answerFromElicitation = exports.defaultTimeAskMessages = exports.englishTimeReader = exports.TIME_AXIS_UNITS = exports.TIME_AXIS_AGGREGATES = exports.timeAxisIssues = exports.readTimeAxis = exports.normaliseInstants = exports.describeTimeAxis = exports.stageDatasetArtifacts = exports.withDatasetArtifacts = exports.UnreadableArtifactStoreError = exports.UnreadableArtifactFileError = exports.UnknownParentRefError = exports.unconfiguredArtifacts = exports.sqliteArtifacts = exports.s3Artifacts = exports.mintArtifactRef = exports.isArtifactRef = exports.InvalidArtifactError = exports.inMemoryArtifacts = exports.gcsArtifacts = exports.fileArtifacts = exports.DEFAULT_IN_MEMORY_ARTIFACT_RETENTION = exports.UnserializableRecordingError = exports.chartWalkPutInput = exports.CHART_WALK_ARTIFACT_KIND = exports.recordingPutInput = void 0;
+exports.AnswerValidationError = exports.topK = exports.indexDocuments = exports.DEFAULT_CORPUS_IDENTITY = exports.defineRAG = exports.providerFromEnv = exports.Graph = exports.graph = void 0;
 // Adapter interfaces (ports)
 __exportStar(require("./provider-contract/types.js"), exports);
 // Injection keys + recorder authoring helpers — needed by anyone writing
@@ -412,6 +412,7 @@ Object.defineProperty(exports, "RunInFlightError", { enumerable: true, get: func
 var memberRun_js_1 = require("./core/memberRun.js");
 Object.defineProperty(exports, "MemberIdentityError", { enumerable: true, get: function () { return memberRun_js_1.MemberIdentityError; } });
 Object.defineProperty(exports, "ParentRunRefusedError", { enumerable: true, get: function () { return memberRun_js_1.ParentRunRefusedError; } });
+Object.defineProperty(exports, "ResumeRequestConflictError", { enumerable: true, get: function () { return memberRun_js_1.ResumeRequestConflictError; } });
 var flowchartAsTool_js_1 = require("./core/flowchartAsTool.js");
 Object.defineProperty(exports, "flowchartAsTool", { enumerable: true, get: function () { return flowchartAsTool_js_1.flowchartAsTool; } });
 // runbookAsTool (9.76.0) — the STANDARD bridge from a footprintjs procedure
@@ -455,6 +456,16 @@ Object.defineProperty(exports, "assertResultKind", { enumerable: true, get: func
 // consumers assembling `Tool` objects by hand.
 Object.defineProperty(exports, "assertComposedOf", { enumerable: true, get: function () { return tools_js_1.assertComposedOf; } });
 Object.defineProperty(exports, "assertGates", { enumerable: true, get: function () { return tools_js_1.assertGates; } });
+// Host-filled tool arguments: a field the HOST fills from the call's credential
+// or the caller's identity — removed from the model's schema, a model-sent
+// value refused by name, the credential scrubbed from what comes back.
+var hostFilled_js_1 = require("./tools/hostFilled.js");
+Object.defineProperty(exports, "hostFilled", { enumerable: true, get: function () { return hostFilled_js_1.hostFilled; } });
+Object.defineProperty(exports, "fromCredential", { enumerable: true, get: function () { return hostFilled_js_1.fromCredential; } });
+Object.defineProperty(exports, "fromIdentity", { enumerable: true, get: function () { return hostFilled_js_1.fromIdentity; } });
+Object.defineProperty(exports, "HostFilledArgumentError", { enumerable: true, get: function () { return hostFilled_js_1.HostFilledArgumentError; } });
+Object.defineProperty(exports, "HostFilledValueMissingError", { enumerable: true, get: function () { return hostFilled_js_1.HostFilledValueMissingError; } });
+Object.defineProperty(exports, "HOST_FILLED_PLACEHOLDER", { enumerable: true, get: function () { return hostFilled_js_1.HOST_FILLED_PLACEHOLDER; } });
 // The tool-name law (`lib/toolName.ts`): the strict check and the dev-mode
 // warning `defineTool` runs, for consumers assembling `Tool` objects by hand.
 var toolName_js_1 = require("./lib/toolName.js");

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;AAsCH,6BAA6B;AAC7B,+DAA6C;AAE7C,yEAAyE;AACzE,uDAAuD;AACvD,uDAqC8B;AApC5B,gHAAA,cAAc,OAAA;AACd,qHAAA,mBAAmB,OAAA;AACnB,gHAAA,cAAc,OAAA;AAEd,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,gBAAgB;AAChB,2GAAA,SAAS,OAAA;AAET,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,6DAA6D;AAC7D,8GAAA,YAAY,OAAA;AAGZ,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,iHAAA,eAAe,OAAA;AACf,sHAAA,oBAAoB,OAAA;AACpB,4HAAA,0BAA0B,OAAA;AAC1B,8GAAA,YAAY,OAAA;AACZ,+GAAA,aAAa,OAAA;AACb,kHAAA,gBAAgB,OAAA;AAChB,mHAAA,iBAAiB,OAAA;AACjB,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,uCAAuC;AACvC,yHAAA,uBAAuB,OAAA;AACvB,0HAAA,wBAAwB,OAAA;AAE1B,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,2CAA2C;AAC3C,mDAA6F;AAApF,uGAAA,WAAW,OAAA;AAAE,0GAAA,cAAc,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AAC5D,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,yEAAyE;AACzE,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,mEAAmE;AACnE,mDAiCgC;AAhC9B,mGAAA,OAAO,OAAA;AACP,0GAAA,cAAc,OAAA;AACd,qGAAA,SAAS,OAAA;AACT,8GAAA,kBAAkB,OAAA;AAClB,2GAAA,eAAe,OAAA;AACf,qGAAA,SAAS,OAAA;AACT,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA;AACR,uGAAA,WAAW,OAAA;AACX,2GAAA,eAAe,OAAA;AACf,4GAAA,gBAAgB,OAAA;AAChB,iHAAA,qBAAqB,OAAA;AACrB,uGAAA,WAAW,OAAA;AACX,2GAAA,eAAe,OAAA;AAoBjB,oEAAoE;AACpE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,kDAAkD;AAClD,sDAOmC;AANjC,4GAAA,gBAAgB,OAAA;AAWlB,yCAAyC;AACzC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,2EAA2E;AAC3E,8EAA8E;AAC9E,0DAA0D;AAC1D,gFAUgD;AAT9C,2HAAA,kBAAkB,OAAA;AAClB,2HAAA,kBAAkB,OAAA;AAClB,yHAAA,gBAAgB,OAAA;AAChB,2HAAA,kBAAkB,OAAA;AAClB,yHAAA,gBAAgB,OAAA;AASlB,sDAA6D;AAApD,2GAAA,UAAU,OAAA;AAAE,0GAAA,SAAS,OAAA;AAc9B,sEAAsE;AACtE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,4CA0ByB;AAzBvB,qGAAA,SAAS,OAAA;AACT,oGAAA,QAAQ,OAAA;AACR,wGAAA,YAAY,OAAA;AACZ,wGAAA,YAAY,OAAA;AACZ,0GAAA,cAAc,OAAA;AACd,oGAAA,QAAQ,OAAA;AACR,0GAAA,cAAc,OAAA;AACd,sGAAA,UAAU,OAAA;AACV,wEAAwE;AACxE,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,sDAAsD;AACtD,gHAAA,oBAAoB,OAAA;AACpB,iHAAA,qBAAqB,OAAA;AACrB,8GAAA,kBAAkB,OAAA;AAClB,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,sBAAsB;AACtB,oHAAA,wBAAwB,OAAA;AAiB1B,2DAA4D;AAAnD,oHAAA,iBAAiB,OAAA;AAE1B,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,kFAAkF;AAClF,4DAA4D;AAC5D,uEAAuE;AACvE,oEAAoE;AACpE,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,2DAMiC;AAL/B,mHAAA,gBAAgB,OAAA;AAChB,qHAAA,kBAAkB,OAAA;AAClB,2HAAA,wBAAwB,OAAA;AAK1B,mEAAmE;AACnE,wDAAwD;AACxD,2EAA2E;AAC3E,iCAAiC;AACjC,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,8BAA8B;AAC9B,6DAqB0C;AApBxC,iGAAA,KAAK,OAAA;AACL,+FAAA,GAAG,OAAA;AACH,gGAAA,IAAI,OAAA;AACJ,8GAAA,kBAAkB,OAAA;AAmBpB,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,mBAAmB;AACnB,+CAAyF;AAAhF,0GAAA,YAAY,OAAA;AAAE,uGAAA,SAAS,OAAA;AAChC,8CAAgE;AAAvD,kGAAA,QAAQ,OAAA;AAcjB,uEAAuE;AACvE,6EAA6E;AAC7E,mEAAmE;AACnE,0EAA0E;AAC1E,oFAAoF;AACpF,gDAuB2B;AAtBzB,6GAAA,eAAe,OAAA;AACf,6GAAA,eAAe,OAAA;AACf,+GAAA,iBAAiB,OAAA;AACjB,iHAAA,mBAAmB,OAAA;AACnB,uHAAA,yBAAyB,OAAA;AACzB,sHAAA,wBAAwB,OAAA;AAuB1B,6EAA6E;AAC7E,0EAK6C;AAJ3C,qHAAA,eAAe,OAAA;AAgBjB,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,sGAWqE;AAVnE,oIAAA,0BAA0B,OAAA;AAC1B,kEAAkE;AAClE,mEAAmE;AACnE,oDAAoD;AACpD,0HAAA,gBAAgB,OAAA;AAChB,+HAAA,qBAAqB,OAAA;AACrB,0HAAA,gBAAgB,OAAA;AAChB,6HAAA,mBAAmB,OAAA;AAKrB,gEAAgE;AAChE,sEAAsE;AACtE,uDAAuD;AACvD,sEAAsE;AACtE,+DAA+D;AAC/D,gEAAgE;AAChE,wEAAwE;AACxE,mCAAmC;AAEnC,qBAAqB;AACrB,gDAM2B;AALzB,qGAAA,OAAO,OAAA;AACP,4GAAA,cAAc,OAAA;AAWhB,2EAA2E;AAC3E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,0FAGmD;AAFjD,yIAAA,yBAAyB,OAAA;AAG3B,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAClD,0EAA0E;AAAjE,2GAAA,KAAK,OAAA;AAAE,kHAAA,YAAY,OAAA;AA0B5B,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,iEAAiE;AACjE,oFAAoF;AACpF,4DAA4D;AAC5D,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,2BAA2B;AAC3B,yDAgCsC;AA/BpC,uHAAA,2BAA2B,OAAA;AAC3B,kHAAA,sBAAsB,OAAA;AACtB,8GAAA,kBAAkB,OAAA;AAClB,0GAAA,cAAc,OAAA;AACd,yGAAA,aAAa,OAAA;AACb,8GAAA,kBAAkB,OAAA;AAClB,wGAAA,YAAY,OAAA;AACZ,yGAAA,aAAa,OAAA;AACb,2GAAA,eAAe,OAAA;AACf,uGAAA,WAAW,OAAA;AAuBb,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,yDAM+B;AAL7B,yHAAA,sBAAsB,OAAA;AACtB,iHAAA,cAAc,OAAA;AACd,4HAAA,yBAAyB,OAAA;AACzB,uHAAA,oBAAoB,OAAA;AAgBtB,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,qCAAqC;AACrC,kEAAgG;AAAvF,yHAAA,qBAAqB,OAAA;AAc9B,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,yDAAyD;AACzD,8DAAmG;AAA1F,gHAAA,oBAAoB,OAAA;AAC7B,6DAA6D;AAC7D,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,mEAAmE;AACnE,wBAAwB;AACxB,8DAM2C;AALzC,+GAAA,mBAAmB,OAAA;AACnB,sGAAA,UAAU,OAAA;AAKZ,2EAA2E;AAC3E,sEAAsE;AACtE,8DAM2C;AALzC,wGAAA,YAAY,OAAA;AACZ,+GAAA,mBAAmB,OAAA;AAKrB,8DAA8D;AAC9D,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,qEAGkD;AAFhD,uHAAA,2BAA2B,OAAA;AAG7B,uEAM6C;AAL3C,oHAAA,iBAAiB,OAAA;AACjB,oHAAA,iBAAiB,OAAA;AAKnB,gEAAgE;AAChE,kEAAkE;AAClE,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,2DA0BwC;AAzBtC,6GAAA,iBAAiB,OAAA;AAiCnB,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,6DAU0C;AATxC,+GAAA,mBAAmB,OAAA;AACnB,gHAAA,oBAAoB,OAAA;AAStB,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,0DAA0D;AAC1D,kDAA0D;AAAjD,mHAAA,oBAAoB,OAAA;AAC7B,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAK2C;AAJzC,iIAAA,yBAAyB,OAAA;AACzB,wHAAA,gBAAgB,OAAA;AAChB,4HAAA,oBAAoB,OAAA;AAItB,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,2DAQwC;AAPtC,uHAAA,2BAA2B,OAAA;AAQ7B,6DAGyC;AAFvC,mHAAA,sBAAsB,OAAA;AAGxB,4DAKiC;AAJ/B,6GAAA,SAAS,OAAA;AACT,6HAAA,yBAAyB,OAAA;AACzB,sHAAA,kBAAkB,OAAA;AAGpB,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,gFAAgF;AAChF,iEAIqC;AAHnC,qHAAA,gBAAgB,OAAA;AAChB,gIAAA,2BAA2B,OAAA;AAG7B,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,2DAA2D;AAC3D,yEAI8C;AAH5C,8HAAA,0BAA0B,OAAA;AAC1B,+HAAA,2BAA2B,OAAA;AAC3B,2HAAA,uBAAuB,OAAA;AAEzB,6EAA6E;AAC7E,+EAA+E;AAC/E,sCAAsC;AACtC,0DAQgC;AAP9B,sHAAA,mBAAmB,OAAA;AAEnB,uHAAA,oBAAoB,OAAA;AACpB,8HAAA,2BAA2B,OAAA;AAC3B,uHAAA,oBAAoB,OAAA;AAEpB,mHAAA,gBAAgB,OAAA;AAElB,+EAA+E;AAC/E,yCAAyC;AACzC,oDAAiF;AAAxE,mHAAA,mBAAmB,OAAA;AAAE,qHAAA,qBAAqB,OAAA;AACnD,gEAKmC;AAJjC,qHAAA,eAAe,OAAA;AAKjB,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,mCAAmC;AACnC,oDAiCiC;AAhC/B,2GAAA,eAAe,OAAA;AACf,4GAAA,gBAAgB,OAAA;AAChB,4GAAA,gBAAgB,OAAA;AAChB,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,0CAA0C;AAC1C,uHAAA,2BAA2B,OAAA;AAC3B,4GAAA,gBAAgB,OAAA;AAChB,6GAAA,iBAAiB,OAAA;AACjB,yGAAA,aAAa,OAAA;AACb,uGAAA,WAAW,OAAA;AACX,6GAAA,iBAAiB,OAAA;AACjB,8GAAA,kBAAkB,OAAA;AAClB,yGAAA,aAAa,OAAA;AACb,gHAAA,oBAAoB,OAAA;AACpB,+GAAA,mBAAmB,OAAA;AACnB,yGAAA,aAAa,OAAA;AAoCf,6CAe0B;AAdxB,sGAAA,UAAU,OAAA;AACV,+GAAA,mBAAmB,OAAA;AACnB,6GAAA,iBAAiB,OAAA;AACjB,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,mDAAmD;AACnD,4GAAA,gBAAgB,OAAA;AAChB,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,+CAA+C;AAC/C,4GAAA,gBAAgB,OAAA;AAChB,uGAAA,WAAW,OAAA;AAEb,2EAA2E;AAC3E,8EAA8E;AAC9E,iDAA+E;AAAtE,kHAAA,mBAAmB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACnD,yEAAyE;AACzE,yEAAyE;AACzE,4EAA4E;AAC5E,oEAAoE;AACpE,wDAAwD;AACxD,6DAWoC;AAVlC,2HAAA,yBAAyB,OAAA;AACzB,wHAAA,sBAAsB,OAAA;AACtB,sHAAA,oBAAoB,OAAA;AAUtB,6EAA6E;AAC7E,uDAAuD;AACvD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,mEAAmE;AACnE,uEAAuE;AACvE,sCAAsC;AACtC,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,cAAc;AACd,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,kDAAkD;AAClD,0DAyBuC;AAxBrC,0GAAA,cAAc,OAAA;AACd,wGAAA,YAAY,OAAA;AACZ,kGAAA,MAAM,OAAA;AACN,oGAAA,QAAQ,OAAA;AACR,kHAAA,sBAAsB,OAAA;AACtB,2GAAA,eAAe,OAAA;AACf,yGAAA,aAAa,OAAA;AACb,uGAAA,WAAW,OAAA;AACX,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAgBpB,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,4DAKwC;AAJtC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AAIf,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,oEAI4C;AAH1C,mHAAA,kBAAkB,OAAA;AAClB,0HAAA,yBAAyB,OAAA;AACzB,iHAAA,gBAAgB,OAAA;AAGlB,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,kEAAkE;AAClE,uEAAuE;AACvE,4CAA4C;AAC5C,iDAwB8B;AAvB5B,6GAAA,iBAAiB,OAAA;AACjB,qHAAA,yBAAyB,OAAA;AACzB,2GAAA,eAAe,OAAA;AACf,4GAAA,gBAAgB,OAAA;AAChB,uHAAA,2BAA2B,OAAA;AAC3B,yGAAA,aAAa,OAAA;AACb,0GAAA,cAAc,OAAA;AACd,4GAAA,gBAAgB,OAAA;AAChB,0GAAA,cAAc,OAAA;AACd,6GAAA,iBAAiB,OAAA;AAenB,6EAA6E;AAC7E,gFAAgF;AAChF,gEAAgE;AAChE,2DAQiC;AAP/B,iHAAA,cAAc,OAAA;AACd,iHAAA,cAAc,OAAA;AACd,2HAAA,wBAAwB,OAAA;AACxB,2HAAA,wBAAwB,OAAA;AAK1B,8DAUkC;AAThC,mHAAA,cAAc,OAAA;AACd,8GAAA,SAAS,OAAA;AACT,+GAAA,UAAU,OAAA;AACV,mHAAA,cAAc,OAAA;AACd,kHAAA,aAAa,OAAA;AAMf,2DAOiC;AAN/B,sHAAA,mBAAmB,OAAA;AACnB,4HAAA,yBAAyB,OAAA;AAM3B,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,qEAAqE;AACrE,8EAA8E;AAC9E,8CAA8C;AAC9C,iDAiF8B;AAhF5B,+GAAA,mBAAmB,OAAA;AACnB,kHAAA,sBAAsB,OAAA;AACtB,yGAAA,aAAa,OAAA;AACb,uDAAuD;AACvD,2EAA2E;AAC3E,0EAA0E;AAC1E,mHAAA,uBAAuB,OAAA;AACvB,gHAAA,oBAAoB,OAAA;AACpB,6GAAA,iBAAiB,OAAA;AACjB,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,oHAAA,wBAAwB,OAAA;AACxB,6GAAA,iBAAiB,OAAA;AACjB,wHAAA,4BAA4B,OAAA;AAC5B,gIAAA,oCAAoC,OAAA;AACpC,yGAAA,aAAa,OAAA;AACb,wGAAA,YAAY,OAAA;AACZ,6GAAA,iBAAiB,OAAA;AACjB,gHAAA,oBAAoB,OAAA;AACpB,yGAAA,aAAa,OAAA;AACb,2GAAA,eAAe,OAAA;AACf,uGAAA,WAAW,OAAA;AACX,2GAAA,eAAe,OAAA;AACf,iHAAA,qBAAqB,OAAA;AACrB,iHAAA,qBAAqB,OAAA;AACrB,uHAAA,2BAA2B,OAAA;AAC3B,wHAAA,4BAA4B,OAAA;AA6B5B,gHAAA,oBAAoB,OAAA;AACpB,iHAAA,qBAAqB,OAAA;AAMrB,4GAAA,gBAAgB,OAAA;AAChB,6GAAA,iBAAiB,OAAA;AACjB,wGAAA,YAAY,OAAA;AACZ,0GAAA,cAAc,OAAA;AACd,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AAyDjB,4EAA4E;AAC5E,gFAAgF;AAChF,wDAA8D;AAArD,+GAAA,iBAAiB,OAAA;AAyB1B,mDAA8D;AAArD,oHAAA,sBAAsB,OAAA;AAC/B,uDAK8B;AAJ5B,uHAAA,qBAAqB,OAAA;AACrB,+GAAA,aAAa,OAAA;AAIf,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,kDAO8B;AAN5B,iHAAA,oBAAoB,OAAA;AACpB,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAKpB,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,gEAAgE;AAChE,kDAa8B;AAZ5B,qHAAA,wBAAwB,OAAA;AACxB,sHAAA,yBAAyB,OAAA;AACzB,iHAAA,oBAAoB,OAAA;AACpB,wHAAA,2BAA2B,OAAA;AAU7B,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,2CAA2C;AAC3C,kDAU8B;AAT5B,4GAAA,eAAe,OAAA;AACf,+GAAA,kBAAkB,OAAA;AAClB,6GAAA,gBAAgB,OAAA;AAChB,8GAAA,iBAAiB,OAAA;AAQnB,iEAAiE;AACjE,yDAAyD;AACzD,kEAAkE;AAClE,6DAA6D;AAC7D,wEAAwE;AACxE,kEAAkE;AAClE,2DAA2D;AAC3D,sEAAsE;AAEtE,4BAA4B;AAC5B,uDAMiC;AAL/B,uGAAA,QAAQ,OAAA;AACR,8GAAA,eAAe,OAAA;AAKjB,uDAWiC;AAV/B,uGAAA,QAAQ,OAAA;AACR,8GAAA,eAAe,OAAA;AAUjB,6DAOoC;AANlC,6GAAA,WAAW,OAAA;AACX,oHAAA,kBAAkB,OAAA;AAMpB,+CAO6B;AAN3B,+FAAA,IAAI,OAAA;AACJ,sGAAA,WAAW,OAAA;AAMb,uDAKiC;AAJ/B,uGAAA,QAAQ,OAAA;AACR,uGAAA,QAAQ,OAAA;AAIV,iDAQ8B;AAP5B,iGAAA,KAAK,OAAA;AACL,iGAAA,KAAK,OAAA;AAQP,2BAA2B;AAC3B,8EAA8E;AAC9E,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,wEAAwE;AACxE,gEAAgE;AAChE,gEAAgE;AAChE,6CAA6C;AAC7C,EAAE;AACF,2FAA2F;AAC3F,wFAAwF;AAExF,sEAK0C;AAJxC,oHAAA,eAAe,OAAA;AAMjB,+DAA+D;AAE/D,oEAAoE;AACpE,gEAAgE;AAEhE,qEAAqE;AACrE,0DAA0D;AAC1D,sDAAoC;AAEpC,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,8CAA8C;AAE9C,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,sDAOkC;AANhC,sGAAA,SAAS,OAAA;AACT,oHAAA,uBAAuB,OAAA;AAEvB,2GAAA,cAAc,OAAA;AAKhB,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,iEAAiE;AACjE,yDAOqC;AANnC,iGAAA,IAAI,OAAA;AAQN,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,yDAAyD;AACzD,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AACxE,gEAAgE;AAEhE,wEAAwE;AACxE,wEAAwE;AACxE,uDAAuD;AAEvD,mEAAmE;AACnE,oEAAoE;AACpE,sDAAsD;AAEtD,2EAA2E;AAC3E,0DAMsC;AALpC,kHAAA,qBAAqB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;;;;;;;;;;;;;;;;;;;;AAsCH,6BAA6B;AAC7B,+DAA6C;AAE7C,yEAAyE;AACzE,uDAAuD;AACvD,uDAqC8B;AApC5B,gHAAA,cAAc,OAAA;AACd,qHAAA,mBAAmB,OAAA;AACnB,gHAAA,cAAc,OAAA;AAEd,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,gBAAgB;AAChB,2GAAA,SAAS,OAAA;AAET,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,6DAA6D;AAC7D,8GAAA,YAAY,OAAA;AAGZ,8EAA8E;AAC9E,2EAA2E;AAC3E,4EAA4E;AAC5E,0EAA0E;AAC1E,iHAAA,eAAe,OAAA;AACf,sHAAA,oBAAoB,OAAA;AACpB,4HAAA,0BAA0B,OAAA;AAC1B,8GAAA,YAAY,OAAA;AACZ,+GAAA,aAAa,OAAA;AACb,kHAAA,gBAAgB,OAAA;AAChB,mHAAA,iBAAiB,OAAA;AACjB,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,uCAAuC;AACvC,yHAAA,uBAAuB,OAAA;AACvB,0HAAA,wBAAwB,OAAA;AAE1B,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,oEAAoE;AACpE,2EAA2E;AAC3E,2CAA2C;AAC3C,mDAA6F;AAApF,uGAAA,WAAW,OAAA;AAAE,0GAAA,cAAc,OAAA;AAAE,kHAAA,sBAAsB,OAAA;AAC5D,gFAAgF;AAChF,8EAA8E;AAC9E,wEAAwE;AACxE,8EAA8E;AAC9E,yEAAyE;AACzE,yEAAyE;AACzE,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,mEAAmE;AACnE,mDAiCgC;AAhC9B,mGAAA,OAAO,OAAA;AACP,0GAAA,cAAc,OAAA;AACd,qGAAA,SAAS,OAAA;AACT,8GAAA,kBAAkB,OAAA;AAClB,2GAAA,eAAe,OAAA;AACf,qGAAA,SAAS,OAAA;AACT,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA;AACR,uGAAA,WAAW,OAAA;AACX,2GAAA,eAAe,OAAA;AACf,4GAAA,gBAAgB,OAAA;AAChB,iHAAA,qBAAqB,OAAA;AACrB,uGAAA,WAAW,OAAA;AACX,2GAAA,eAAe,OAAA;AAoBjB,oEAAoE;AACpE,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,kDAAkD;AAClD,sDAOmC;AANjC,4GAAA,gBAAgB,OAAA;AAWlB,yCAAyC;AACzC,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,oEAAoE;AACpE,qEAAqE;AACrE,2EAA2E;AAC3E,8EAA8E;AAC9E,0DAA0D;AAC1D,gFAUgD;AAT9C,2HAAA,kBAAkB,OAAA;AAClB,2HAAA,kBAAkB,OAAA;AAClB,yHAAA,gBAAgB,OAAA;AAChB,2HAAA,kBAAkB,OAAA;AAClB,yHAAA,gBAAgB,OAAA;AASlB,sDAA6D;AAApD,2GAAA,UAAU,OAAA;AAAE,0GAAA,SAAS,OAAA;AAc9B,sEAAsE;AACtE,wEAAwE;AACxE,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,4CA0ByB;AAzBvB,qGAAA,SAAS,OAAA;AACT,oGAAA,QAAQ,OAAA;AACR,wGAAA,YAAY,OAAA;AACZ,wGAAA,YAAY,OAAA;AACZ,0GAAA,cAAc,OAAA;AACd,oGAAA,QAAQ,OAAA;AACR,0GAAA,cAAc,OAAA;AACd,sGAAA,UAAU,OAAA;AACV,wEAAwE;AACxE,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,sDAAsD;AACtD,gHAAA,oBAAoB,OAAA;AACpB,iHAAA,qBAAqB,OAAA;AACrB,8GAAA,kBAAkB,OAAA;AAClB,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,sBAAsB;AACtB,oHAAA,wBAAwB,OAAA;AAiB1B,2DAA4D;AAAnD,oHAAA,iBAAiB,OAAA;AAE1B,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,kFAAkF;AAClF,4DAA4D;AAC5D,uEAAuE;AACvE,oEAAoE;AACpE,2EAA2E;AAC3E,wEAAwE;AACxE,4EAA4E;AAC5E,2DAMiC;AAL/B,mHAAA,gBAAgB,OAAA;AAChB,qHAAA,kBAAkB,OAAA;AAClB,2HAAA,wBAAwB,OAAA;AAK1B,mEAAmE;AACnE,wDAAwD;AACxD,2EAA2E;AAC3E,iCAAiC;AACjC,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,8BAA8B;AAC9B,6DAqB0C;AApBxC,iGAAA,KAAK,OAAA;AACL,+FAAA,GAAG,OAAA;AACH,gGAAA,IAAI,OAAA;AACJ,8GAAA,kBAAkB,OAAA;AAmBpB,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,6EAA6E;AAC7E,mBAAmB;AACnB,+CAAyF;AAAhF,0GAAA,YAAY,OAAA;AAAE,uGAAA,SAAS,OAAA;AAChC,8CAAgE;AAAvD,kGAAA,QAAQ,OAAA;AAcjB,uEAAuE;AACvE,6EAA6E;AAC7E,mEAAmE;AACnE,0EAA0E;AAC1E,oFAAoF;AACpF,gDAuB2B;AAtBzB,6GAAA,eAAe,OAAA;AACf,6GAAA,eAAe,OAAA;AACf,+GAAA,iBAAiB,OAAA;AACjB,iHAAA,mBAAmB,OAAA;AACnB,uHAAA,yBAAyB,OAAA;AACzB,sHAAA,wBAAwB,OAAA;AAuB1B,6EAA6E;AAC7E,0EAK6C;AAJ3C,qHAAA,eAAe,OAAA;AAgBjB,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,sGAWqE;AAVnE,oIAAA,0BAA0B,OAAA;AAC1B,kEAAkE;AAClE,mEAAmE;AACnE,oDAAoD;AACpD,0HAAA,gBAAgB,OAAA;AAChB,+HAAA,qBAAqB,OAAA;AACrB,0HAAA,gBAAgB,OAAA;AAChB,6HAAA,mBAAmB,OAAA;AAKrB,gEAAgE;AAChE,sEAAsE;AACtE,uDAAuD;AACvD,sEAAsE;AACtE,+DAA+D;AAC/D,gEAAgE;AAChE,wEAAwE;AACxE,mCAAmC;AAEnC,qBAAqB;AACrB,gDAM2B;AALzB,qGAAA,OAAO,OAAA;AACP,4GAAA,cAAc,OAAA;AAWhB,2EAA2E;AAC3E,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,0FAGmD;AAFjD,yIAAA,yBAAyB,OAAA;AAG3B,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,kDAAkD;AAClD,0EAA0E;AAAjE,2GAAA,KAAK,OAAA;AAAE,kHAAA,YAAY,OAAA;AA0B5B,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,EAAE;AACF,iEAAiE;AACjE,oFAAoF;AACpF,4DAA4D;AAC5D,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,2BAA2B;AAC3B,yDAgCsC;AA/BpC,uHAAA,2BAA2B,OAAA;AAC3B,kHAAA,sBAAsB,OAAA;AACtB,8GAAA,kBAAkB,OAAA;AAClB,0GAAA,cAAc,OAAA;AACd,yGAAA,aAAa,OAAA;AACb,8GAAA,kBAAkB,OAAA;AAClB,wGAAA,YAAY,OAAA;AACZ,yGAAA,aAAa,OAAA;AACb,2GAAA,eAAe,OAAA;AACf,uGAAA,WAAW,OAAA;AAuBb,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,yDAM+B;AAL7B,yHAAA,sBAAsB,OAAA;AACtB,iHAAA,cAAc,OAAA;AACd,4HAAA,yBAAyB,OAAA;AACzB,uHAAA,oBAAoB,OAAA;AAgBtB,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,qCAAqC;AACrC,kEAAgG;AAAvF,yHAAA,qBAAqB,OAAA;AAc9B,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,yDAAyD;AACzD,8DAAmG;AAA1F,gHAAA,oBAAoB,OAAA;AAC7B,6DAA6D;AAC7D,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,mEAAmE;AACnE,wBAAwB;AACxB,8DAM2C;AALzC,+GAAA,mBAAmB,OAAA;AACnB,sGAAA,UAAU,OAAA;AAKZ,2EAA2E;AAC3E,sEAAsE;AACtE,8DAM2C;AALzC,wGAAA,YAAY,OAAA;AACZ,+GAAA,mBAAmB,OAAA;AAKrB,8DAA8D;AAC9D,wEAAwE;AACxE,0EAA0E;AAC1E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,sEAAsE;AACtE,qEAGkD;AAFhD,uHAAA,2BAA2B,OAAA;AAG7B,uEAM6C;AAL3C,oHAAA,iBAAiB,OAAA;AACjB,oHAAA,iBAAiB,OAAA;AAKnB,gEAAgE;AAChE,kEAAkE;AAClE,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,2DA0BwC;AAzBtC,6GAAA,iBAAiB,OAAA;AAiCnB,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,6DAU0C;AATxC,+GAAA,mBAAmB,OAAA;AACnB,gHAAA,oBAAoB,OAAA;AAStB,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,0DAA0D;AAC1D,kDAA0D;AAAjD,mHAAA,oBAAoB,OAAA;AAC7B,4EAA4E;AAC5E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,0EAK2C;AAJzC,iIAAA,yBAAyB,OAAA;AACzB,wHAAA,gBAAgB,OAAA;AAChB,4HAAA,oBAAoB,OAAA;AAItB,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,2DAQwC;AAPtC,uHAAA,2BAA2B,OAAA;AAQ7B,6DAGyC;AAFvC,mHAAA,sBAAsB,OAAA;AAGxB,4DAKiC;AAJ/B,6GAAA,SAAS,OAAA;AACT,6HAAA,yBAAyB,OAAA;AACzB,sHAAA,kBAAkB,OAAA;AAGpB,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,2EAA2E;AAC3E,gFAAgF;AAChF,iEAIqC;AAHnC,qHAAA,gBAAgB,OAAA;AAChB,gIAAA,2BAA2B,OAAA;AAG7B,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,2DAA2D;AAC3D,yEAI8C;AAH5C,8HAAA,0BAA0B,OAAA;AAC1B,+HAAA,2BAA2B,OAAA;AAC3B,2HAAA,uBAAuB,OAAA;AAEzB,6EAA6E;AAC7E,+EAA+E;AAC/E,sCAAsC;AACtC,0DAQgC;AAP9B,sHAAA,mBAAmB,OAAA;AAEnB,uHAAA,oBAAoB,OAAA;AACpB,8HAAA,2BAA2B,OAAA;AAC3B,uHAAA,oBAAoB,OAAA;AAEpB,mHAAA,gBAAgB,OAAA;AAElB,+EAA+E;AAC/E,yCAAyC;AACzC,oDAI6B;AAH3B,mHAAA,mBAAmB,OAAA;AACnB,qHAAA,qBAAqB,OAAA;AACrB,0HAAA,0BAA0B,OAAA;AAE5B,gEAKmC;AAJjC,qHAAA,eAAe,OAAA;AAKjB,4EAA4E;AAC5E,0EAA0E;AAC1E,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,mCAAmC;AACnC,oDAiCiC;AAhC/B,2GAAA,eAAe,OAAA;AACf,4GAAA,gBAAgB,OAAA;AAChB,4GAAA,gBAAgB,OAAA;AAChB,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,0CAA0C;AAC1C,uHAAA,2BAA2B,OAAA;AAC3B,4GAAA,gBAAgB,OAAA;AAChB,6GAAA,iBAAiB,OAAA;AACjB,yGAAA,aAAa,OAAA;AACb,uGAAA,WAAW,OAAA;AACX,6GAAA,iBAAiB,OAAA;AACjB,8GAAA,kBAAkB,OAAA;AAClB,yGAAA,aAAa,OAAA;AACb,gHAAA,oBAAoB,OAAA;AACpB,+GAAA,mBAAmB,OAAA;AACnB,yGAAA,aAAa,OAAA;AAoCf,6CAe0B;AAdxB,sGAAA,UAAU,OAAA;AACV,+GAAA,mBAAmB,OAAA;AACnB,6GAAA,iBAAiB,OAAA;AACjB,0EAA0E;AAC1E,4EAA4E;AAC5E,yEAAyE;AACzE,mDAAmD;AACnD,4GAAA,gBAAgB,OAAA;AAChB,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,+CAA+C;AAC/C,4GAAA,gBAAgB,OAAA;AAChB,uGAAA,WAAW,OAAA;AAEb,gFAAgF;AAChF,2EAA2E;AAC3E,uEAAuE;AACvE,uDAW+B;AAV7B,2GAAA,UAAU,OAAA;AACV,+GAAA,cAAc,OAAA;AACd,6GAAA,YAAY,OAAA;AACZ,wHAAA,uBAAuB,OAAA;AACvB,4HAAA,2BAA2B,OAAA;AAC3B,wHAAA,uBAAuB,OAAA;AAMzB,2EAA2E;AAC3E,8EAA8E;AAC9E,iDAA+E;AAAtE,kHAAA,mBAAmB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACnD,yEAAyE;AACzE,yEAAyE;AACzE,4EAA4E;AAC5E,oEAAoE;AACpE,wDAAwD;AACxD,6DAWoC;AAVlC,2HAAA,yBAAyB,OAAA;AACzB,wHAAA,sBAAsB,OAAA;AACtB,sHAAA,oBAAoB,OAAA;AAUtB,6EAA6E;AAC7E,uDAAuD;AACvD,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,mEAAmE;AACnE,uEAAuE;AACvE,sCAAsC;AACtC,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,cAAc;AACd,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,kDAAkD;AAClD,0DAyBuC;AAxBrC,0GAAA,cAAc,OAAA;AACd,wGAAA,YAAY,OAAA;AACZ,kGAAA,MAAM,OAAA;AACN,oGAAA,QAAQ,OAAA;AACR,kHAAA,sBAAsB,OAAA;AACtB,2GAAA,eAAe,OAAA;AACf,yGAAA,aAAa,OAAA;AACb,uGAAA,WAAW,OAAA;AACX,8GAAA,kBAAkB,OAAA;AAClB,8GAAA,kBAAkB,OAAA;AAgBpB,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,4DAKwC;AAJtC,wGAAA,WAAW,OAAA;AACX,0GAAA,aAAa,OAAA;AAIf,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,yEAAyE;AACzE,oEAI4C;AAH1C,mHAAA,kBAAkB,OAAA;AAClB,0HAAA,yBAAyB,OAAA;AACzB,iHAAA,gBAAgB,OAAA;AAGlB,6EAA6E;AAC7E,2EAA2E;AAC3E,0EAA0E;AAC1E,mEAAmE;AACnE,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,kEAAkE;AAClE,uEAAuE;AACvE,4CAA4C;AAC5C,iDAwB8B;AAvB5B,6GAAA,iBAAiB,OAAA;AACjB,qHAAA,yBAAyB,OAAA;AACzB,2GAAA,eAAe,OAAA;AACf,4GAAA,gBAAgB,OAAA;AAChB,uHAAA,2BAA2B,OAAA;AAC3B,yGAAA,aAAa,OAAA;AACb,0GAAA,cAAc,OAAA;AACd,4GAAA,gBAAgB,OAAA;AAChB,0GAAA,cAAc,OAAA;AACd,6GAAA,iBAAiB,OAAA;AAenB,6EAA6E;AAC7E,gFAAgF;AAChF,gEAAgE;AAChE,2DAQiC;AAP/B,iHAAA,cAAc,OAAA;AACd,iHAAA,cAAc,OAAA;AACd,2HAAA,wBAAwB,OAAA;AACxB,2HAAA,wBAAwB,OAAA;AAK1B,8DAUkC;AAThC,mHAAA,cAAc,OAAA;AACd,8GAAA,SAAS,OAAA;AACT,+GAAA,UAAU,OAAA;AACV,mHAAA,cAAc,OAAA;AACd,kHAAA,aAAa,OAAA;AAMf,2DAOiC;AAN/B,sHAAA,mBAAmB,OAAA;AACnB,4HAAA,yBAAyB,OAAA;AAM3B,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AACtE,6EAA6E;AAC7E,6EAA6E;AAC7E,qEAAqE;AACrE,8EAA8E;AAC9E,8CAA8C;AAC9C,iDAiF8B;AAhF5B,+GAAA,mBAAmB,OAAA;AACnB,kHAAA,sBAAsB,OAAA;AACtB,yGAAA,aAAa,OAAA;AACb,uDAAuD;AACvD,2EAA2E;AAC3E,0EAA0E;AAC1E,mHAAA,uBAAuB,OAAA;AACvB,gHAAA,oBAAoB,OAAA;AACpB,6GAAA,iBAAiB,OAAA;AACjB,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,oHAAA,wBAAwB,OAAA;AACxB,6GAAA,iBAAiB,OAAA;AACjB,wHAAA,4BAA4B,OAAA;AAC5B,gIAAA,oCAAoC,OAAA;AACpC,yGAAA,aAAa,OAAA;AACb,wGAAA,YAAY,OAAA;AACZ,6GAAA,iBAAiB,OAAA;AACjB,gHAAA,oBAAoB,OAAA;AACpB,yGAAA,aAAa,OAAA;AACb,2GAAA,eAAe,OAAA;AACf,uGAAA,WAAW,OAAA;AACX,2GAAA,eAAe,OAAA;AACf,iHAAA,qBAAqB,OAAA;AACrB,iHAAA,qBAAqB,OAAA;AACrB,uHAAA,2BAA2B,OAAA;AAC3B,wHAAA,4BAA4B,OAAA;AA6B5B,gHAAA,oBAAoB,OAAA;AACpB,iHAAA,qBAAqB,OAAA;AAMrB,4GAAA,gBAAgB,OAAA;AAChB,6GAAA,iBAAiB,OAAA;AACjB,wGAAA,YAAY,OAAA;AACZ,0GAAA,cAAc,OAAA;AACd,gHAAA,oBAAoB,OAAA;AACpB,2GAAA,eAAe,OAAA;AAyDjB,4EAA4E;AAC5E,gFAAgF;AAChF,wDAA8D;AAArD,+GAAA,iBAAiB,OAAA;AAyB1B,mDAA8D;AAArD,oHAAA,sBAAsB,OAAA;AAC/B,uDAK8B;AAJ5B,uHAAA,qBAAqB,OAAA;AACrB,+GAAA,aAAa,OAAA;AAIf,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,kDAO8B;AAN5B,iHAAA,oBAAoB,OAAA;AACpB,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAKpB,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,gEAAgE;AAChE,kDAa8B;AAZ5B,qHAAA,wBAAwB,OAAA;AACxB,sHAAA,yBAAyB,OAAA;AACzB,iHAAA,oBAAoB,OAAA;AACpB,wHAAA,2BAA2B,OAAA;AAU7B,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,2CAA2C;AAC3C,kDAU8B;AAT5B,4GAAA,eAAe,OAAA;AACf,+GAAA,kBAAkB,OAAA;AAClB,6GAAA,gBAAgB,OAAA;AAChB,8GAAA,iBAAiB,OAAA;AAQnB,iEAAiE;AACjE,yDAAyD;AACzD,kEAAkE;AAClE,6DAA6D;AAC7D,wEAAwE;AACxE,kEAAkE;AAClE,2DAA2D;AAC3D,sEAAsE;AAEtE,4BAA4B;AAC5B,uDAMiC;AAL/B,uGAAA,QAAQ,OAAA;AACR,8GAAA,eAAe,OAAA;AAKjB,uDAWiC;AAV/B,uGAAA,QAAQ,OAAA;AACR,8GAAA,eAAe,OAAA;AAUjB,6DAOoC;AANlC,6GAAA,WAAW,OAAA;AACX,oHAAA,kBAAkB,OAAA;AAMpB,+CAO6B;AAN3B,+FAAA,IAAI,OAAA;AACJ,sGAAA,WAAW,OAAA;AAMb,uDAKiC;AAJ/B,uGAAA,QAAQ,OAAA;AACR,uGAAA,QAAQ,OAAA;AAIV,iDAQ8B;AAP5B,iGAAA,KAAK,OAAA;AACL,iGAAA,KAAK,OAAA;AAQP,2BAA2B;AAC3B,8EAA8E;AAC9E,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,wEAAwE;AACxE,gEAAgE;AAChE,gEAAgE;AAChE,6CAA6C;AAC7C,EAAE;AACF,2FAA2F;AAC3F,wFAAwF;AAExF,sEAK0C;AAJxC,oHAAA,eAAe,OAAA;AAMjB,+DAA+D;AAE/D,oEAAoE;AACpE,gEAAgE;AAEhE,qEAAqE;AACrE,0DAA0D;AAC1D,sDAAoC;AAEpC,uEAAuE;AACvE,uEAAuE;AACvE,oEAAoE;AACpE,sEAAsE;AACtE,8CAA8C;AAE9C,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,sDAOkC;AANhC,sGAAA,SAAS,OAAA;AACT,oHAAA,uBAAuB,OAAA;AAEvB,2GAAA,cAAc,OAAA;AAKhB,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,iEAAiE;AACjE,yDAOqC;AANnC,iGAAA,IAAI,OAAA;AAQN,qEAAqE;AACrE,wEAAwE;AACxE,uEAAuE;AACvE,oEAAoE;AACpE,yDAAyD;AACzD,wEAAwE;AACxE,gDAAgD;AAChD,wEAAwE;AACxE,gEAAgE;AAEhE,wEAAwE;AACxE,wEAAwE;AACxE,uDAAuD;AAEvD,mEAAmE;AACnE,oEAAoE;AACpE,sDAAsD;AAEtD,2EAA2E;AAC3E,0DASsC;AARpC,kHAAA,qBAAqB,OAAA"}

package/dist/injection-engine/buildInjectionEngineSubflow.js

@@ -80,10 +80,17 @@ exports.EMPTY_ACTIVE_BY_SLOT = {
  */
 function buildInjectionEngineSubflow(config) {
     const injections = config.injections;
-    return (0, footprintjs_1.flowChart)('Gather', gatherStage, 'gather', {
+    const resolveHidden = config.hiddenSkillIds;
+    const gather = resolveHidden === undefined
+        ? gatherStage
+        : async (scope) => {
+            gatherStage(scope);
+            scope.$setValue('hiddenSkillIds', await hiddenSkillIdsOf(resolveHidden, scope));
+        };
+    return (0, footprintjs_1.flowChart)('Gather', gather, 'gather', {
         description: "Snapshot this turn's injection inputs (iteration, history, last tool, LLM-activated)",
     })
-        .addFunction('Evaluate', makeEvaluateStage(injections, config.nextSkill, config.explainNextSkill, config.supersededEntries, config.stepPlanFor, config.reachableSkills, config.engagement), 'evaluate', 'Evaluate every Injection trigger; produce activeInjections + metadata')
+        .addFunction('Evaluate', makeEvaluateStage(injections, config.nextSkill, config.explainNextSkill, config.supersededEntries, config.stepPlanFor, config.reachableSkills, config.engagement, resolveHidden !== undefined), 'evaluate', 'Evaluate every Injection trigger; produce activeInjections + metadata')
         .addFunction('Route', routeStage, 'route', 'Partition active injections into per-slot buckets (system-prompt / messages / tools)')
         .addFunction('Delta', deltaStage, 'delta', 'Per-slot delta vs last turn: what activated / deactivated / stayed')
         .build();
@@ -100,8 +107,28 @@ function gatherStage(scope) {
         activatedInjectionCount: args.activatedInjectionIds?.length ?? 0,
     });
 }
+// FOLD · the one owner of scope.hiddenSkillIds — which skill ids this caller's role may not see, this iteration
+// consumers read this and never re-derive it: the Evaluate stage below (cursor + activation, via
+// `types.ts` · isHiddenSkill), and, through the mount's outputMapper, the tools slot's read_skill offer,
+// toolCalls.ts · dispatchRoster, the read_skill gate, the propose-transition refusal, callLLM's ontology piece.
+// detached: yes — a plain string[].
+/**
+ * Resolve the role-hidden skill ids for this pass. Resolved HERE, at the top
+ * of the engine, because activation is decided on this pass and nothing may
+ * decide before the answer is in. Its errors are NOT swallowed: the agent's
+ * resolver already hides a skill whose check throws, and a resolver that
+ * fails as a whole fails the iteration — nothing is composed or activated
+ * from a policy that did not answer.
+ */
+async function hiddenSkillIdsOf(resolve, scope) {
+    const asked = resolve(scope);
+    return [...(asked instanceof Promise ? await asked : asked)];
+}
 // ── Stage 2: Evaluate (logic identical to the old single stage) ──────────
-function makeEvaluateStage(injections, nextSkill, explainNextSkill, supersededEntries, stepPlanFor, reachableSkills, engagementPlan) {
+function makeEvaluateStage(injections, nextSkill, explainNextSkill, supersededEntries, stepPlanFor, reachableSkills, engagementPlan, 
+/** Gather published `hiddenSkillIds` this pass. Read only then, so an agent
+ *  without per-role visibility records exactly the reads it always did. */
+readsHidden = false) {
     return (scope) => {
         const args = scope.$getArgs();
         // The accepted transition proposal (9.19.0), VALID only on the iteration
@@ -113,6 +140,9 @@ function makeEvaluateStage(injections, nextSkill, explainNextSkill, supersededEn
             args.pendingToolTransition.iteration + 1 === iteration
             ? args.pendingToolTransition
             : undefined;
+        const hidden = readsHidden
+            ? scope.$getValue('hiddenSkillIds')
+            : undefined;
         const baseCtx = {
             iteration,
             // The action budget, as ONE fact with two spellings (9.57.0). Written
@@ -135,6 +165,9 @@ function makeEvaluateStage(injections, nextSkill, explainNextSkill, supersededEn
             ...(args.entryScores !== undefined && { entryScores: args.entryScores }),
             ...(args.entryScorer !== undefined && { entryScorer: args.entryScorer }),
             ...(args.turnRoute !== undefined && { turnRoute: args.turnRoute }),
+            // Role visibility for this pass, resolved by Gather — read by the cursor
+            // resolver and the evaluator alike, so neither can activate a hidden skill.
+            ...(hidden !== undefined && hidden.length > 0 && { hiddenSkillIds: hidden }),
         };
         // KEYSTONE cursor advance — derive the next cursor from the SAME ctx the
         // route triggers gate on (`nextSkill(ctx) === id`), so the active set and the
@@ -281,7 +314,8 @@ function makeEvaluateStage(injections, nextSkill, explainNextSkill, supersededEn
             // as SEPARATE fields, the reason, and the way back named as a concrete
             // call. Built from the state that was just advanced, so the card and
             // the suppression are two views of one decision.
-            parkCardText = (0, parkCard_js_1.parkCard)(engagementPlan, advance.next);
+            // Filtered by the role: the card never names a member skill this caller may not read.
+            parkCardText = (0, parkCard_js_1.parkCard)(engagementPlan, advance.next, (id) => !(0, types_js_1.isHiddenSkill)(ctx, id));
             // Tools come off the wire on the ENGAGEMENT axis, independently of
             // `scopeTools` — see `EngagementAdvance.parkedToolNames`.
             scope.$setValue('parkedToolNames', advance.parkedToolNames);