agentfootprint 13.0.0 → 14.0.0

package/dist/core/agent/stages/toolCalls/execution/callStart.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCallStart = void 0;
+const toolSecurityEvents_js_1 = require("../../../toolSecurityEvents.js");
+const ledger_js_1 = require("../../../findings/ledger.js");
+const contingent_js_1 = require("../../../findings/contingent.js");
+const frozenCopy_js_1 = require("../../../../../lib/frozenCopy.js");
+/** Start one call with its original proposal, frozen views, records and clock. */
+function buildCallStart(deps, links) {
+    const beginDispatchCall = (scope, tc, iteration, towers, callIndex, toolCalls, findingsRefusals, frozenTurn, callbackHistory, frozenArgsAt) => {
+        const { resolveTool, peelCall, programOfCall, turnStampOf, emitToolStart } = links;
+        const emitSecurity = (0, toolSecurityEvents_js_1.bindToolSecurityEvents)(scope, { toolCallId: tc.id, iteration });
+        const resolved = resolveTool(tc.name);
+        const tool = resolved.tool;
+        // ── THE PEEL (9.101.0, `.findings()`) — the FIRST read of `tc.args`
+        // in this loop. `args` is what the call runs with: `tool_start`, the
+        // permission context and `callArgs` all read it, so `_findings`
+        // never reaches middleware, `validateToolArgs` (a tool with
+        // `additionalProperties: false` would refuse it under 'enforce'),
+        // check-in evidence, wants, credentials, execute or a pause carrier.
+        // A tool that OWNS the name keeps the value (`peelCall`). Unarmed the
+        // same reference — `tc.args` — and not one byte moves.
+        const peeled = peelCall(tc);
+        const args = peeled.args;
+        // The script record's proposal (`deps.scriptRecord`): the declared
+        // argument's value, read as the call arrives — before any rule or tool
+        // code runs. `undefined` unarmed.
+        const proposedProgram = programOfCall(tool, args);
+        // ── THE BASIS ROW — immediately, so it precedes `tool_start` in the
+        // event log and every pause `return` in program order (a paused
+        // call's row is on the pre-pause partial commit; a denied call keeps
+        // its row — the declaration is a fact about the emission). Filed only
+        // when the model DECLARED a basis; never inferred.
+        if (deps.findings === true && peeled.findings?.basis !== undefined) {
+            (0, ledger_js_1.recordFindings)(scope, [(0, ledger_js_1.basisRowFrom)(tc, peeled.findings, iteration, peeled.malformed)], turnStampOf(scope));
+        }
+        // ── THE CONTINGENT ROWS FOR THIS CALL (9.110.0) — after the basis
+        // row, before `tool_start`: the DATA values of the peeled arguments
+        // that a set-aside result was the only source of. A fact about the
+        // emission, filed whether or not the call then runs.
+        if (towers !== undefined) {
+            (0, ledger_js_1.recordFindings)(scope, (0, contingent_js_1.contingentRowsOf)((0, contingent_js_1.groundedArgumentValues)(args, towers.gate, towers.corpus, towers.exempt), towers.corpus, towers.standingOf, { toolCallId: tc.id }, iteration), turnStampOf(scope));
+        }
+        // ── THIS CALL'S SHARED FROZEN COPY — `tool_start`, the permission
+        // checker, a capability check and the check-in predicate (and, on a
+        // pause, the request shown and its evidence assembler) all read ONE
+        // frozen copy of the arguments, never the arguments the tool runs
+        // with. The batch's copy when `args` is the call's own object;
+        // remade only when the arguments are replaced, and after the
+        // middleware chain (its links are handed the live arguments, by
+        // contract, and may have edited them in place). Shared only while
+        // freezing SEALED it (`isSealed` — every JSON value): arguments that
+        // hold a `Map`, a `Set`, a `Date` or a typed array get a new copy for
+        // each callback, so one cannot change what the next one judges.
+        let viewed;
+        let view;
+        /** The batch's copy still shows these arguments — until a link could have edited them. */
+        let batchCopyCurrent = true;
+        const viewOf = (source) => {
+            if (source === viewed && view !== undefined)
+                return view;
+            const batchCopy = batchCopyCurrent && source === tc.args ? frozenArgsAt(callIndex) : undefined;
+            const copy = batchCopy ?? (0, frozenCopy_js_1.frozenView)(source);
+            const shareable = copy !== undefined && (0, frozenCopy_js_1.isSealed)(copy);
+            viewed = shareable ? source : undefined;
+            view = shareable ? copy : undefined;
+            return copy;
+        };
+        /** The history this call's callbacks are handed — made once per call when sealed. */
+        let callHistory;
+        const historyForCallbacks = () => {
+            if (callHistory !== undefined)
+                return callHistory;
+            const made = callbackHistory();
+            if (frozenTurn === undefined || (0, frozenCopy_js_1.isSealed)(frozenTurn))
+                callHistory = made;
+            return made;
+        };
+        emitToolStart(scope, {
+            toolName: tc.name,
+            toolCallId: tc.id,
+            args: viewOf(args) ?? args,
+            ...(toolCalls.length > 1 && { parallelCount: toolCalls.length }),
+        });
+        const startMs = Date.now();
+        const findingsRefusal = findingsRefusals[callIndex];
+        const invalidateViews = () => {
+            viewed = undefined;
+            batchCopyCurrent = false;
+        };
+        return {
+            emitSecurity,
+            resolved,
+            tool,
+            args,
+            proposedProgram,
+            viewOf,
+            historyForCallbacks,
+            startMs,
+            findingsRefusal,
+            invalidateViews,
+        };
+    };
+    return { beginDispatchCall };
+}
+exports.buildCallStart = buildCallStart;
+//# sourceMappingURL=callStart.js.map

package/dist/core/agent/stages/toolCalls/execution/callStart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"callStart.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/execution/callStart.ts"],"names":[],"mappings":";;;AAQA,0EAAwE;AAExE,2DAA2E;AAC3E,mEAA2F;AAC3F,oEAAwE;AAcxE,kFAAkF;AAClF,SAAgB,cAAc,CAC5B,IAA4C,EAC5C,KAAqB;IAErB,MAAM,iBAAiB,GAAG,CACxB,KAA6B,EAC7B,EAAgB,EAChB,SAAiB,EACjB,MAAoC,EACpC,SAAiB,EACjB,SAAkC,EAClC,gBAAwE,EACxE,UAAkC,EAClC,eAAmC,EACnC,YAAkD,EAClD,EAAE;QACF,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,KAAK,CAAC;QACnF,MAAM,YAAY,GAAG,IAAA,8CAAsB,EAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC3B,qEAAqE;QACrE,qEAAqE;QACrE,gEAAgE;QAChE,4DAA4D;QAC5D,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,uDAAuD;QACvD,MAAM,MAAM,GAAkB,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAa,MAAM,CAAC,IAAI,CAAC;QACnC,mEAAmE;QACnE,uEAAuE;QACvE,kCAAkC;QAClC,MAAM,eAAe,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,qEAAqE;QACrE,gEAAgE;QAChE,qEAAqE;QACrE,sEAAsE;QACtE,mDAAmD;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;YACnE,IAAA,0BAAc,EACZ,KAAK,EACL,CAAC,IAAA,wBAAY,EAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,EAChE,WAAW,CAAC,KAAK,CAAC,CACnB,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,qDAAqD;QACrD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAA,0BAAc,EACZ,KAAK,EACL,IAAA,gCAAgB,EACd,IAAA,sCAAsB,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EACvE,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,UAAU,EACjB,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE,EACrB,SAAS,CACV,EACD,WAAW,CAAC,KAAK,CAAC,CACnB,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,+DAA+D;QAC/D,6DAA6D;QAC7D,gEAAgE;QAChE,kEAAkE;QAClE,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,MAA4B,CAAC;QACjC,IAAI,IAA0B,CAAC;QAC/B,0FAA0F;QAC1F,IAAI,gBAAgB,GAAG,IAAI,CAAC;QAC5B,MAAM,MAAM,GAAG,CAAC,MAAgB,EAAwB,EAAE;YACxD,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACzD,MAAM,SAAS,GACb,gBAAgB,IAAI,MAAM,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/E,MAAM,IAAI,GAAG,SAAS,IAAI,IAAA,0BAAU,EAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,IAAI,KAAK,SAAS,IAAI,IAAA,wBAAQ,EAAC,IAAI,CAAC,CAAC;YACvD,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACxC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,qFAAqF;QACrF,IAAI,WAAqC,CAAC;QAC1C,MAAM,mBAAmB,GAAG,GAAiB,EAAE;YAC7C,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAC;YAClD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;YAC/B,IAAI,UAAU,KAAK,SAAS,IAAI,IAAA,wBAAQ,EAAC,UAAU,CAAC;gBAAE,WAAW,GAAG,IAAI,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,aAAa,CAAC,KAAK,EAAE;YACnB,QAAQ,EAAE,EAAE,CAAC,IAAI;YACjB,UAAU,EAAE,EAAE,CAAC,EAAE;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI;YAC1B,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;SACjE,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,eAAe,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,GAAS,EAAE;YACjC,MAAM,GAAG,SAAS,CAAC;YACnB,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC,CAAC;QACF,OAAO;YACL,YAAY;YACZ,QAAQ;YACR,IAAI;YACJ,IAAI;YACJ,eAAe;YACf,MAAM;YACN,mBAAmB;YACnB,OAAO;YACP,eAAe;YACf,eAAe;SAChB,CAAC;IACJ,CAAC,CAAC;IACF,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAC/B,CAAC;AA1HD,wCA0HC"}

package/dist/core/agent/stages/toolCalls/execution/catalogOperations.js

@@ -0,0 +1,200 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildToolCatalogOperations = void 0;
+const periodWarnings_js_1 = require("../helpers/periodWarnings.js");
+const reserved_js_1 = require("../../../findings/reserved.js");
+const declare_js_1 = require("../../../../../tools/declare.js");
+const typedEmit_js_1 = require("../../../../../recorders/core/typedEmit.js");
+const skillSteps_js_1 = require("../../../../../injection-engine/skillSteps.js");
+const types_js_1 = require("../../../../../maps/engagement/types.js");
+const spokenIds_js_1 = require("../../../../../lib/spokenIds.js");
+const sourceNote_js_1 = require("../helpers/sourceNote.js");
+/** Compose the existing catalog callbacks once for this handler. */
+function buildToolCatalogOperations(deps, links) {
+    const lookupTool = (toolName, pinned) => links.resolveTool(toolName, pinned).tool;
+    /**
+     * FAIL CLOSED (honesty layer 2, adopted Q14): with the inputs layer NOT
+     * mounted, a call whose tool declares argument rules is refused rather than
+     * run unruled — configured-and-inert looks exactly like
+     * configured-and-working. Only a ToolProvider-served tool can reach here
+     * (a registered ruled tool arms the layer at build). `undefined` —
+     * synchronously, no microtask — for every tool that declares nothing, and
+     * for every call on an armed agent; only a ruled tool on an agent without
+     * the layer loads the layer's dispatch half, for the sentence and the
+     * warning (`arguments/dispatch.ts` · `unmountedRefusal`).
+     */
+    const unmountedRules = (tool, toolName) => {
+        if (deps.inputsLayer === true || tool === undefined)
+            return undefined;
+        if (tool.askOrAssume === undefined && tool.period === undefined)
+            return undefined;
+        return Promise.resolve().then(() => __importStar(require('../../../arguments/dispatch.js'))).then((m) => m.unmountedRefusal(toolName));
+    };
+    /**
+     * The results layer's twin (honesty layer 3): with the layer NOT mounted, a
+     * call whose tool declares a `ToolPeriod` still runs — its VERDICT needs the
+     * layer, the call does not — so dev mode says, once per tool, that none will
+     * be filed (`warnToolPeriodUnjudged`). Nothing for a tool that declares none,
+     * or on an armed agent.
+     */
+    const warnUnmountedToolPeriod = (tool, toolName) => {
+        if (deps.resultsLayer !== true && tool?.period !== undefined) {
+            (0, periodWarnings_js_1.warnToolPeriodUnjudged)(toolName);
+        }
+    };
+    /**
+     * The honesty layers' TURN STAMP (adopted Q6): while an honesty layer is
+     * armed (the inputs layer, the results layer, the answer layer), every row
+     * this handler files through the one writer carries the conversation turn —
+     * the ledger crosses turns on a continued conversation and `iteration`
+     * restarts at 1 every run. `turnNumber` is read only then.
+     */
+    // While ANY honesty layer is armed, the one writer stamps the turn (adopted
+    // Q6) — the inputs layer, or the results layer (step 7b).
+    const turnStampOf = (scope) => deps.inputsLayer === true || deps.resultsLayer === true || deps.answerLayer === true
+        ? { turn: scope.turnNumber }
+        : undefined;
+    /**
+     * THE PER-CALL PEEL (9.101.0, `.findings()`). Under the arm the reserved
+     * `_findings` argument is taken off a call's args — UNLESS the tool that
+     * answers the name OWNS the property (`findings/reserved.ts ·
+     * ownsReservedArgument`). Such a schema was served undecorated
+     * (`withFindingsArgument` returns it by reference; a REGISTRY schema doing
+     * the same was refused at build, so this is a provider- or MCP-ingested
+     * tool), and the model's value on that call is the author's argument: it
+     * runs with the call and files no row, exactly as the committed schema
+     * says. DECLARED SOURCES WITHOUT THE LEDGER (`.inputsLayer({
+     * argumentSources: true })`, no `.findings()`) plant the argument on RULED
+     * tools only (`withSourcesArgument`), so only those calls are peeled — by
+     * the same rule the tools slot decorated with (`tools/declare.ts` ·
+     * `carriesRules`). Unarmed: `tc.args` itself, by reference — not one byte
+     * moves.
+     */
+    const peelsReserved = (tool) => !(0, reserved_js_1.ownsReservedArgument)(tool?.schema) &&
+        (deps.findings === true || (deps.argumentSources === true && (0, declare_js_1.carriesRules)(tool)));
+    const peelCall = (tc) => peelsReserved(links.resolveTool(tc.name).tool)
+        ? (0, reserved_js_1.splitFindings)(tc.args, links.peelArms)
+        : { args: tc.args };
+    /**
+     * The inputs layer's note options: under declared sources an answered
+     * clause says a later call may cite the answer in `_findings.from` — only
+     * for a tool whose served schema CARRIES it. A tool whose author owns
+     * `_findings` was served undecorated and its calls are not peeled
+     * (`peelsReserved`'s rule, `ownsReservedArgument`; a registered one is
+     * refused at build), so its note is the step-4 note. Absent → the step-3/4
+     * note.
+     */
+    const noteOptionsFor = (tool) => deps.argumentSources === true && !(0, reserved_js_1.ownsReservedArgument)(tool?.schema) ? sourceNote_js_1.SOURCES_NOTE : undefined;
+    /** The record of an off-wire dispatch — once per such call, before it runs. */
+    const noteOffWire = (scope, resolved, call) => {
+        if (resolved.offWire !== true || resolved.party === undefined)
+            return;
+        (0, typedEmit_js_1.typedEmit)(scope, 'agentfootprint.tools.answered_off_wire', {
+            toolName: call.toolName,
+            toolCallId: call.toolCallId,
+            iteration: call.iteration,
+            answeredBy: resolved.party.channel,
+            ...(resolved.party.id !== undefined && { answeredById: resolved.party.id }),
+        });
+    };
+    const frameworkSkipStepAnswered = (name, answered) => links.frameworkSkipStep !== undefined &&
+        name === skillSteps_js_1.SKIP_STEP_TOOL_NAME &&
+        answered === links.frameworkSkipStep;
+    /**
+     * Every member id of every map the kernel currently holds PARKED (9.86.0
+     * fix pass) — asked of `parkedMemberIds`, the kernel's own owner of the fact.
+     *
+     * ONE reader for TWO gates. The `skill_read` permission gate and the graph's
+     * dispatch gate both have to tell a stay from a re-engagement, and they sit
+     * 480 lines apart; the second computed this and the first did not, which is
+     * exactly how a role-hidden parked member became re-activatable. Answers with
+     * `undefined` when no engagement plan is mounted, which is every agent that
+     * never called `.maps()`.
+     */
+    const parkedNow = (scope) => deps.engagementPlan === undefined
+        ? undefined
+        : (0, types_js_1.parkedMemberIds)(deps.engagementPlan, scope.mapEngagement);
+    // FOLD · the one owner of "which tool names this caller may be told exist" for one iteration
+    // consumers read this and never re-derive it: `toolCalls/helpers/dispatchRefusals.ts` · unknownToolResult, called at both dispatch doors
+    // detached: yes — a fresh SpokenIds; the named half leaves through spoken().
+    /**
+     * Every name `lookupTool` would resolve, in resolution order, through the
+     * role filter (9.86.0) — the roster `unknownToolResult` names.
+     *
+     * Derived from the SAME two sources the lookup reads, so a name it reports is
+     * a name that resolved. Then filtered by the SAME fact every other sentence in
+     * this stage filters by: `scope.hiddenSkillIds`, the per-iteration answer to
+     * "which skills may this caller be told about". The first draft applied
+     * neither, and named a hidden skill's tool to a role that may not see the
+     * skill — the leak the `read_skill` refusals had just closed, reappearing one
+     * sentence over because the roster read the dispatch map raw.
+     *
+     * A tool is unnameable only when EVERY skill declaring it is hidden
+     * (`deps.toolDeclaringSkills`, the build-time owner of that fact). A tool two
+     * skills share is still named when either is visible — the same
+     * sole-owner rule the step hold-out uses, for the same reason: a shared name
+     * is somebody's escape hatch. Names nobody declares from a skill — static
+     * `.tool()` registrations, `read_skill`, `skip_step`, provider-delivered
+     * tools — have no owning skill and are never filtered.
+     *
+     * DISPATCH IS UNTOUCHED. `lookupTool` still resolves every name in the map:
+     * a narrowing may take a name out of a sentence, never out of the dispatch
+     * map. This filter governs only what the model is TOLD.
+     */
+    const dispatchRoster = (scope) => {
+        const names = [...links.registryByName.keys()];
+        const seen = new Set(names);
+        for (const t of links.externalToolProvider ? links.providerToolCache?.current ?? [] : []) {
+            if (seen.has(t.schema.name))
+                continue;
+            seen.add(t.schema.name);
+            names.push(t.schema.name);
+        }
+        const hidden = new Set(scope.hiddenSkillIds ?? []);
+        if (hidden.size === 0)
+            return { named: names, held: names.length > 0 };
+        const declaredBy = deps.toolDeclaringSkills;
+        return (0, spokenIds_js_1.spoken)(names, (name) => {
+            const owners = declaredBy?.get(name);
+            return owners === undefined || owners.some((id) => !hidden.has(id));
+        });
+    };
+    return {
+        lookupTool,
+        unmountedRules,
+        warnUnmountedToolPeriod,
+        turnStampOf,
+        peelsReserved,
+        peelCall,
+        noteOptionsFor,
+        noteOffWire,
+        frameworkSkipStepAnswered,
+        parkedNow,
+        dispatchRoster,
+    };
+}
+exports.buildToolCatalogOperations = buildToolCatalogOperations;
+//# sourceMappingURL=catalogOperations.js.map

package/dist/core/agent/stages/toolCalls/execution/catalogOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogOperations.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/execution/catalogOperations.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAIA,oEAAsE;AAItE,+DAIuC;AACvC,gEAA+D;AAE/D,6EAAuE;AACvE,iFAAoF;AACpF,sEAA8F;AAC9F,kEAAyE;AAEzE,4DAAwD;AAWxD,oEAAoE;AACpE,SAAgB,0BAA0B,CACxC,IASC,EACD,KAAiC;IAEjC,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,MAAkB,EAAoB,EAAE,CAC5E,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;IAE3C;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,CACrB,IAAsB,EACtB,QAAgB,EACa,EAAE;QAC/B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACtE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAClF,OAAO,kDAAO,gCAAgC,IAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,uBAAuB,GAAG,CAAC,IAAsB,EAAE,QAAgB,EAAQ,EAAE;QACjF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7D,IAAA,0CAAsB,EAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,4EAA4E;IAC5E,0DAA0D;IAC1D,MAAM,WAAW,GAAG,CAAC,KAA6B,EAAyB,EAAE,CAC3E,IAAI,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;QAClF,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAoB,EAAE;QACtC,CAAC,CAAC,SAAS,CAAC;IAEhB;;;;;;;;;;;;;;;OAeG;IACH,MAAM,aAAa,GAAG,CAAC,IAAsB,EAAW,EAAE,CACxD,CAAC,IAAA,kCAAoB,EAAC,IAAI,EAAE,MAAM,CAAC;QACnC,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,IAAA,yBAAY,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEpF,MAAM,QAAQ,GAAG,CAAC,EAGjB,EAAiB,EAAE,CAClB,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QAC5C,CAAC,CAAC,IAAA,2BAAa,EAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAExB;;;;;;;;OAQG;IACH,MAAM,cAAc,GAAG,CAAC,IAAsB,EAA0C,EAAE,CACxF,IAAI,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,IAAA,kCAAoB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,4BAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAElG,+EAA+E;IAC/E,MAAM,WAAW,GAAG,CAClB,KAA6B,EAC7B,QAAoB,EACpB,IAA4F,EACtF,EAAE;QACR,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACtE,IAAA,wBAAS,EAAC,KAAK,EAAE,wCAAwC,EAAE;YACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;YAClC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,yBAAyB,GAAG,CAAC,IAAY,EAAE,QAA0B,EAAW,EAAE,CACtF,KAAK,CAAC,iBAAiB,KAAK,SAAS;QACrC,IAAI,KAAK,mCAAmB;QAC5B,QAAQ,KAAK,KAAK,CAAC,iBAAiB,CAAC;IAEvC;;;;;;;;;;OAUG;IACH,MAAM,SAAS,GAAG,CAAC,KAA6B,EAAmC,EAAE,CACnF,IAAI,CAAC,cAAc,KAAK,SAAS;QAC/B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAA,0BAAe,EAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,aAA0C,CAAC,CAAC;IAE7F,6FAA6F;IAC7F,yIAAyI;IACzI,6EAA6E;IAC7E;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,cAAc,GAAG,CAAC,KAA6B,EAAa,EAAE;QAClE,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACzF,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,SAAS;YACtC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAE,KAAK,CAAC,cAAgD,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC5C,OAAO,IAAA,qBAAM,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;YAC5B,MAAM,MAAM,GAAG,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,cAAc;QACd,uBAAuB;QACvB,WAAW;QACX,aAAa;QACb,QAAQ;QACR,cAAc;QACd,WAAW;QACX,yBAAyB;QACzB,SAAS;QACT,cAAc;KACf,CAAC;AACJ,CAAC;AArMD,gEAqMC"}

package/dist/core/agent/stages/toolCalls/execution/contextOperations.js

@@ -0,0 +1,190 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildToolContextOperations = void 0;
+const typedEmit_js_1 = require("../../../../../recorders/core/typedEmit.js");
+const capability_js_1 = require("../../../../../artifacts/capability.js");
+const toolDispatch_js_1 = require("../../../toolDispatch.js");
+const runRedaction_js_1 = require("../../../../../redaction/runRedaction.js");
+const reportingCredentials_js_1 = require("../decorators/reportingCredentials.js");
+const toolSecurityEvents_js_1 = require("../../../toolSecurityEvents.js");
+const requestEvidence_js_1 = require("../../../../../tools/requestEvidence.js");
+const mcpClientUse_js_1 = require("../../../../../tools/mcpClientUse.js");
+const sourceClock_js_1 = require("../evidence/sourceClock.js");
+const madeInRun_js_1 = require("../evidence/madeInRun.js");
+/** Compose the existing context callbacks once for this handler. */
+function buildToolContextOperations(deps, links) {
+    /**
+     * `ctx.artifacts` + `ctx.hasArtifacts` for one dispatch — the claim-check
+     * capability, shaped exactly like `ctx.credentials` (9.21.0).
+     *
+     * The SCOPE is `scope.runIdentity` — the tuple the seed stage committed and
+     * memory already scopes on (an anonymous run isolates to its own runId, a
+     * session-bound run to its sessionId, an identity-carrying run to the
+     * caller's tenant/principal). Composed HERE, where the tool cannot reach:
+     * the capability closes over it, so a ref alone opens nothing and a tool
+     * can never widen the scope it resolves under. Detached to a plain object
+     * so the store never holds a live scope proxy.
+     *
+     * Every fact the capability reports rides the ordinary emit channel via
+     * `typedEmit`, mid-stage, carrying the real runtimeStageId — collected
+     * during traversal, exactly like `credential.failed`. Payload bytes never
+     * enter an event; the facts are meta only.
+     *
+     * The binding owns WHOSE RUN its facts are for: the run context is captured
+     * here, when it is built. A fact that lands after that run ended — a tool
+     * that fired a `put` without awaiting it, finishing during a later run on a
+     * shared agent — goes out through `deps.emitForRun` stamped with the run it
+     * was made in, never with whichever run is live then (which would put one
+     * person's upload into another person's recording).
+     *
+     * With NO store attached the capability is the fail-closed teacher and no
+     * runIdentity read happens — a storeless agent's trace stays byte-identical.
+     */
+    const toolArtifacts = (scope, toolName, toolCallId) => {
+        const bindRun = links.runFactsOf(scope);
+        const emitFact = (type, payload) => {
+            const madeIn = bindRun?.runContext;
+            const emitForRun = deps.emitForRun;
+            if (madeIn !== undefined &&
+                emitForRun !== undefined &&
+                (deps.isRunRetired() || deps.currentRun?.().runId !== madeIn.runId)) {
+                emitForRun(type, payload, madeIn);
+                return;
+            }
+            (0, typedEmit_js_1.typedEmit)(scope, type, payload);
+        };
+        const onEvent = (fact) => {
+            switch (fact.type) {
+                case 'minted': {
+                    const meta = fact.meta;
+                    emitFact('agentfootprint.artifacts.minted', {
+                        ref: meta.ref,
+                        kind: meta.kind,
+                        mediaType: meta.mediaType,
+                        bytes: meta.bytes,
+                        ...(meta.label !== undefined && { label: meta.label }),
+                        ...(meta.digest !== undefined && { digest: meta.digest }),
+                        ...(meta.expiresAt !== undefined && { expiresAt: meta.expiresAt }),
+                        ...(meta.origin !== undefined && { origin: meta.origin }),
+                        ...(meta.parentRefs !== undefined && { parentRefs: meta.parentRefs }),
+                        ...(meta.timeAxis !== undefined && { timeAxis: meta.timeAxis }),
+                        tool: toolName,
+                    });
+                    // Under `.time()` (step T8): a dataset whose declared axis names a
+                    // zone is a wall-clock source — one `source-clock` row per call and
+                    // zone, for the limits block's `Clocks` lines. Only in the run the
+                    // binding was made in (a late mint's run has ended).
+                    const zone = meta.timeAxis?.zone;
+                    if (deps.time !== undefined &&
+                        zone !== undefined &&
+                        !deps.isRunRetired() &&
+                        ((0, madeInRun_js_1.madeInRun)(bindRun) === undefined || (0, madeInRun_js_1.madeInRun)(bindRun) === deps.currentRun?.().runId)) {
+                        (0, sourceClock_js_1.recordSourceClock)(scope, { toolCallId, toolName }, zone);
+                    }
+                    return;
+                }
+                case 'resolved':
+                    emitFact('agentfootprint.artifacts.resolved', {
+                        ref: fact.ref,
+                        via: fact.via,
+                        kind: fact.kind,
+                        bytes: fact.bytes,
+                        tool: toolName,
+                    });
+                    return;
+                case 'expired':
+                    emitFact('agentfootprint.artifacts.expired', {
+                        ref: fact.swept.ref,
+                        reason: fact.swept.reason,
+                        kind: fact.swept.kind,
+                        bytes: fact.swept.bytes,
+                        tool: toolName,
+                    });
+                    return;
+                case 'refused':
+                    emitFact('agentfootprint.artifacts.refused', {
+                        op: fact.op,
+                        reason: fact.reason,
+                        ...(fact.ref !== undefined && { ref: fact.ref }),
+                        ...(fact.detail !== undefined && { detail: fact.detail }),
+                        tool: toolName,
+                    });
+                    return;
+            }
+        };
+        const store = deps.artifactStore;
+        if (store === undefined) {
+            return { artifacts: (0, capability_js_1.unconfiguredArtifacts)(onEvent), hasArtifacts: false };
+        }
+        const artifacts = (0, capability_js_1.bindArtifacts)(store, runScopeOf(scope), {
+            origin: { ...(bindRun?.runId !== undefined && { runId: bindRun.runId }), toolCallId },
+            onEvent,
+        });
+        return { artifacts, hasArtifacts: true };
+    };
+    /**
+     * `ctx.tools` for one dispatch (9.76.0) — the run's own tool dispatch, so a
+     * composed tool (runbookAsTool's procedure stages, or any tool that
+     * composes) calls its ingredient tools through the SAME map the model
+     * dispatches by, instead of importing modules and building a second query
+     * stack.
+     *
+     * The inner context is the OUTER call's own facts with two deliberate
+     * overrides: `hasArtifacts: false` with the fail-closed capability (an
+     * inner tool must not mint claim tickets competing with the composed
+     * answer's own — the one-chip-per-answer discipline), and a DERIVED
+     * `toolCallId` (`<outer>#inner-<n>`) so an inner tool's progress reports
+     * and kept records name the call they belong to without ever being
+     * mistaken for a call the model made. No `tool_start`/`tool_end` fires for
+     * an inner call — it is the outer call's work; `ctx.progress` is its
+     * visible channel and the composed envelope its record.
+     */
+    const toolDispatchCtx = (scope, call, signal) => ({
+        tools: (0, toolDispatch_js_1.agentToolDispatch)({
+            lookup: (name) => links.registryByName.get(name),
+            innerContext: (name, seq) => {
+                const innerId = `${call.toolCallId}#inner-${seq}`;
+                // An inner call runs inside the same run, under the same policy.
+                const redact = (0, runRedaction_js_1.policyInForce)(scope);
+                return {
+                    toolCallId: innerId,
+                    iteration: call.iteration,
+                    ...(signal && { signal }),
+                    ...(redact !== undefined && { redact }),
+                    credentials: (0, reportingCredentials_js_1.reportingCredentials)(links.credentialsIn(scope, links.registryByName.get(name)?.needs?.credential), (0, toolSecurityEvents_js_1.bindToolSecurityEvents)(scope, { toolCallId: innerId, iteration: call.iteration }), name),
+                    hasCredentials: links.hasCredentials,
+                    artifacts: (0, capability_js_1.unconfiguredArtifacts)(),
+                    hasArtifacts: false,
+                    ...links.toolProgress(scope, {
+                        toolName: name,
+                        toolCallId: innerId,
+                        iteration: call.iteration,
+                    }),
+                    ...(0, requestEvidence_js_1.requestEvidenceFor)(scope, {
+                        toolName: name,
+                        toolCallId: innerId,
+                        iteration: call.iteration,
+                    }),
+                    ...(0, mcpClientUse_js_1.mcpClientUseFor)(scope, { toolCallId: innerId }),
+                };
+            },
+        }),
+    });
+    /**
+     * The run's artifact scope — `scope.runIdentity`, detached to a plain
+     * object so no store or resolver ever holds a live scope proxy. ONE
+     * composition shared by the capability binding, `wants` resolution,
+     * `present`, and placement: four doors, one isolation rule, no drift.
+     */
+    const runScopeOf = (scope) => {
+        const identity = scope.runIdentity;
+        return {
+            conversationId: identity.conversationId,
+            ...(identity.tenant !== undefined && { tenant: identity.tenant }),
+            ...(identity.principal !== undefined && { principal: identity.principal }),
+        };
+    };
+    return { toolArtifacts, toolDispatchCtx, runScopeOf };
+}
+exports.buildToolContextOperations = buildToolContextOperations;
+//# sourceMappingURL=contextOperations.js.map

package/dist/core/agent/stages/toolCalls/execution/contextOperations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contextOperations.js","sourceRoot":"","sources":["../../../../../../src/core/agent/stages/toolCalls/execution/contextOperations.ts"],"names":[],"mappings":";;;AAQA,6EAAuE;AACvE,0EAKgD;AAChD,8DAA6D;AAC7D,8EAAyE;AACzE,mFAA6E;AAC7E,0EAAwE;AACxE,gFAA6E;AAC7E,0EAAuE;AAMvE,+DAA+D;AAC/D,2DAAqD;AAUrD,oEAAoE;AACpE,SAAgB,0BAA0B,CACxC,IAGC,EACD,KAAiC;IAEjC;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,MAAM,aAAa,GAAG,CACpB,KAA6B,EAC7B,QAAgB,EAChB,UAAkB,EACwC,EAAE;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CACf,IAAO,EACP,OAA6C,EACvC,EAAE;YACR,MAAM,MAAM,GAAG,OAAO,EAAE,UAAU,CAAC;YACnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,IACE,MAAM,KAAK,SAAS;gBACpB,UAAU,KAAK,SAAS;gBACxB,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,EACnE,CAAC;gBACD,UAAU,CAAC,IAAI,EAAE,OAA6C,EAAE,MAAM,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YACD,IAAA,wBAAS,EAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,CAAC,IAAuB,EAAQ,EAAE;YAChD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,QAAQ,CAAC,CAAC,CAAC;oBACd,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;oBACvB,QAAQ,CAAC,iCAAiC,EAAE;wBAC1C,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,SAAS,EAAE,IAAI,CAAC,SAAS;wBACzB,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;wBACtD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;wBACzD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;wBAClE,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;wBACzD,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAC/D,IAAI,EAAE,QAAQ;qBACf,CAAC,CAAC;oBACH,mEAAmE;oBACnE,oEAAoE;oBACpE,mEAAmE;oBACnE,qDAAqD;oBACrD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;oBACjC,IACE,IAAI,CAAC,IAAI,KAAK,SAAS;wBACvB,IAAI,KAAK,SAAS;wBAClB,CAAC,IAAI,CAAC,YAAY,EAAE;wBACpB,CAAC,IAAA,wBAAS,EAAC,OAAO,CAAC,KAAK,SAAS,IAAI,IAAA,wBAAS,EAAC,OAAO,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,CAAC,EACtF,CAAC;wBACD,IAAA,kCAAiB,EAAC,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,CAAC,CAAC;oBAC3D,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,KAAK,UAAU;oBACb,QAAQ,CAAC,mCAAmC,EAAE;wBAC5C,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,GAAG,EAAE,IAAI,CAAC,GAAG;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,KAAK,EAAE,IAAI,CAAC,KAAK;wBACjB,IAAI,EAAE,QAAQ;qBACf,CAAC,CAAC;oBACH,OAAO;gBACT,KAAK,SAAS;oBACZ,QAAQ,CAAC,kCAAkC,EAAE;wBAC3C,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG;wBACnB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;wBACzB,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;wBACrB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK;wBACvB,IAAI,EAAE,QAAQ;qBACf,CAAC,CAAC;oBACH,OAAO;gBACT,KAAK,SAAS;oBACZ,QAAQ,CAAC,kCAAkC,EAAE;wBAC3C,EAAE,EAAE,IAAI,CAAC,EAAE;wBACX,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;wBAChD,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;wBACzD,IAAI,EAAE,QAAQ;qBACf,CAAC,CAAC;oBACH,OAAO;YACX,CAAC;QACH,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,SAAS,GAAkB,IAAA,6BAAa,EAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE;YACvE,MAAM,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE;YACrF,OAAO;SACR,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,eAAe,GAAG,CACtB,KAA6B,EAC7B,IAIC,EACD,MAAoB,EACiB,EAAE,CAAC,CAAC;QACzC,KAAK,EAAE,IAAA,mCAAiB,EAAC;YACvB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;YAChD,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;gBAC1B,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,UAAU,UAAU,GAAG,EAAE,CAAC;gBAClD,iEAAiE;gBACjE,MAAM,MAAM,GAAG,IAAA,+BAAa,EAAC,KAAK,CAAC,CAAC;gBACpC,OAAO;oBACL,UAAU,EAAE,OAAO;oBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;oBACzB,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;oBACvC,WAAW,EAAE,IAAA,8CAAoB,EAC/B,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,EAC7E,IAAA,8CAAsB,EAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EACjF,IAAI,CACL;oBACD,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,SAAS,EAAE,IAAA,qCAAqB,GAAE;oBAClC,YAAY,EAAE,KAAK;oBACnB,GAAG,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE;wBAC3B,QAAQ,EAAE,IAAI;wBACd,UAAU,EAAE,OAAO;wBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;qBAC1B,CAAC;oBACF,GAAG,IAAA,uCAAkB,EAAC,KAAK,EAAE;wBAC3B,QAAQ,EAAE,IAAI;wBACd,UAAU,EAAE,OAAO;wBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;qBAC1B,CAAC;oBACF,GAAG,IAAA,iCAAe,EAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;iBACnD,CAAC;YACJ,CAAC;SACF,CAAC;KACH,CAAC,CAAC;IAEH;;;;;OAKG;IACH,MAAM,UAAU,GAAG,CAAC,KAA6B,EAAiB,EAAE;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC;QACnC,OAAO;YACL,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjE,GAAG,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;SAC3E,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC;AA7MD,gEA6MC"}