agentfootprint 7.17.0 → 7.18.0

package/dist/esm/core/agent/middleware/runChain.d.ts

@@ -0,0 +1,104 @@
+/**
+ * middleware/runChain — INTERNAL. The one place a chain is walked.
+ *
+ * Pattern: Chain of Responsibility driver.
+ * Role:    core/ layer. Both stages (tool dispatch, message boundary) and
+ *          the MCP server call in here, so the ordering law, the
+ *          throw-is-a-denial law and the ledger row shape are written once
+ *          and cannot drift between the three callers.
+ * Emits:   N/A — it RETURNS rows; the caller commits and emits them, so a
+ *          middleware still never touches scope.
+ *
+ * ## The rules this file implements
+ *
+ * **Order is declaration order.** The chain is walked front to back, and
+ * each link is handed the previous link's output — so a scrubber placed
+ * first is a scrubber every later rule sees the effect of.
+ *
+ * **The first non-allow answer wins.** A deny or an ask stops the walk;
+ * the links behind it do not run. There is no "second opinion" pass,
+ * because a refusal that a later middleware could overturn is not a
+ * refusal.
+ *
+ * **A middleware that throws is a denial, never a pass.** The thrown
+ * message becomes the reason. This is the same deny-by-default the
+ * permission gate has always applied to a checker that throws: a
+ * governance layer whose failure mode is "allow" is not a governance
+ * layer.
+ */
+import type { LLMMessage } from '../../../adapters/types.js';
+import type { MemoryIdentity } from '../../../memory/identity/types.js';
+import type { AskPayload, MessageMiddleware, MiddlewareDecision, ToolMiddleware } from './types.js';
+/** Tool args, as they travel the chain. */
+export type ToolArgs = Readonly<Record<string, unknown>>;
+/**
+ * What to do when a middleware answers `ask` somewhere that cannot pause.
+ *
+ * `'pause'` — the caller will checkpoint (the normal dispatch path).
+ * `'refuse'` — the ask is converted into a deny naming the middleware. Used
+ * on the resume path (footprintjs's `PausableHandler.resume` returns void,
+ * so a resumed dispatch cannot suspend a second time) and by `mcpServe`
+ * (MCP is request/response — there is no pause to carry the ask).
+ */
+export type AskPolicy = 'pause' | 'refuse';
+export type ToolChainResult = {
+    readonly kind: 'allow';
+    readonly args: ToolArgs;
+    readonly decisions: MiddlewareDecision[];
+} | {
+    readonly kind: 'deny';
+    readonly reason: string;
+    readonly middleware: string;
+    readonly args: ToolArgs;
+    readonly decisions: MiddlewareDecision[];
+} | {
+    readonly kind: 'ask';
+    readonly payload: AskPayload;
+    readonly middleware: string;
+    /** Index of the link that asked — resume continues from `index + 1`. */
+    readonly index: number;
+    /** Args as transformed up to the ask. These ride the checkpoint. */
+    readonly args: ToolArgs;
+    readonly decisions: MiddlewareDecision[];
+};
+export interface ToolChainInput {
+    readonly toolName: string;
+    readonly toolCallId: string;
+    readonly iteration: number;
+    readonly args: ToolArgs;
+    readonly history: readonly LLMMessage[];
+    readonly identity?: MemoryIdentity;
+    readonly signal?: AbortSignal;
+    /**
+     * Where to start walking. `0` for a fresh dispatch; `n` on resume, to
+     * continue the chain AFTER the link that asked without re-running the
+     * links whose decisions the checkpoint already carries.
+     */
+    readonly startIndex?: number;
+    readonly askPolicy?: AskPolicy;
+}
+/** Walk the tool chain. Never throws — a throwing link becomes a denial. */
+export declare function runToolChain(chain: readonly ToolMiddleware[], input: ToolChainInput): Promise<ToolChainResult>;
+export type MessageChainResult = {
+    readonly kind: 'allow';
+    readonly content: string;
+    readonly decisions: MiddlewareDecision[];
+} | {
+    readonly kind: 'deny';
+    readonly reason: string;
+    readonly middleware: string;
+    /** Content as transformed by the links BEFORE the refusal. */
+    readonly content: string;
+    readonly decisions: MiddlewareDecision[];
+};
+export interface MessageChainInput {
+    readonly phase: 'input' | 'output';
+    readonly content: string;
+    readonly history: readonly LLMMessage[];
+    /** ReAct iteration for the ledger row. `0` at `'input'` (before iter 1). */
+    readonly iteration: number;
+    readonly identity?: MemoryIdentity;
+    readonly signal?: AbortSignal;
+}
+/** Walk the message chain. Never throws — a throwing link becomes a denial. */
+export declare function runMessageChain(chain: readonly MessageMiddleware[], input: MessageChainInput): Promise<MessageChainResult>;

package/dist/esm/core/agent/middleware/runChain.js

@@ -0,0 +1,139 @@
+/**
+ * middleware/runChain — INTERNAL. The one place a chain is walked.
+ *
+ * Pattern: Chain of Responsibility driver.
+ * Role:    core/ layer. Both stages (tool dispatch, message boundary) and
+ *          the MCP server call in here, so the ordering law, the
+ *          throw-is-a-denial law and the ledger row shape are written once
+ *          and cannot drift between the three callers.
+ * Emits:   N/A — it RETURNS rows; the caller commits and emits them, so a
+ *          middleware still never touches scope.
+ *
+ * ## The rules this file implements
+ *
+ * **Order is declaration order.** The chain is walked front to back, and
+ * each link is handed the previous link's output — so a scrubber placed
+ * first is a scrubber every later rule sees the effect of.
+ *
+ * **The first non-allow answer wins.** A deny or an ask stops the walk;
+ * the links behind it do not run. There is no "second opinion" pass,
+ * because a refusal that a later middleware could overturn is not a
+ * refusal.
+ *
+ * **A middleware that throws is a denial, never a pass.** The thrown
+ * message becomes the reason. This is the same deny-by-default the
+ * permission gate has always applied to a checker that throws: a
+ * governance layer whose failure mode is "allow" is not a governance
+ * layer.
+ */
+/** Walk the tool chain. Never throws — a throwing link becomes a denial. */
+export async function runToolChain(chain, input) {
+    const decisions = [];
+    const askPolicy = input.askPolicy ?? 'pause';
+    let args = input.args;
+    for (let i = input.startIndex ?? 0; i < chain.length; i++) {
+        const mw = chain[i];
+        const row = (extra) => ({
+            middleware: mw.name,
+            at: 'tool',
+            toolName: input.toolName,
+            toolCallId: input.toolCallId,
+            iteration: input.iteration,
+            outcome: 'allow',
+            changed: false,
+            ...extra,
+        });
+        let outcome;
+        try {
+            outcome = await mw.onToolCall({
+                toolName: input.toolName,
+                toolCallId: input.toolCallId,
+                iteration: input.iteration,
+                args,
+                history: input.history,
+                ...(input.identity && { identity: input.identity }),
+                ...(input.signal && { signal: input.signal }),
+            });
+        }
+        catch (err) {
+            const reason = `middleware '${mw.name}' threw: ${err instanceof Error ? err.message : String(err)}`;
+            decisions.push(row({ outcome: 'deny', why: reason }));
+            return { kind: 'deny', reason, middleware: mw.name, args, decisions };
+        }
+        if (outcome.kind === 'deny') {
+            decisions.push(row({ outcome: 'deny', why: outcome.reason }));
+            return { kind: 'deny', reason: outcome.reason, middleware: mw.name, args, decisions };
+        }
+        if (outcome.kind === 'ask') {
+            if (askPolicy === 'refuse') {
+                const reason = `middleware '${mw.name}' asked a person to decide, and there is no pause here to ` +
+                    `carry that ask: ${outcome.payload.question}`;
+                decisions.push(row({ outcome: 'deny', why: reason }));
+                return { kind: 'deny', reason, middleware: mw.name, args, decisions };
+            }
+            decisions.push(row({ outcome: 'ask', why: outcome.payload.question }));
+            return {
+                kind: 'ask',
+                payload: outcome.payload,
+                middleware: mw.name,
+                index: i,
+                args,
+                decisions,
+            };
+        }
+        if (outcome.value !== undefined) {
+            const before = args;
+            args = outcome.value;
+            decisions.push(row({ changed: true, ...(outcome.why && { why: outcome.why }), before, after: args }));
+        }
+        else {
+            decisions.push(row({}));
+        }
+    }
+    return { kind: 'allow', args, decisions };
+}
+/** Walk the message chain. Never throws — a throwing link becomes a denial. */
+export async function runMessageChain(chain, input) {
+    const decisions = [];
+    let content = input.content;
+    for (const mw of chain) {
+        const row = (extra) => ({
+            middleware: mw.name,
+            at: 'message',
+            phase: input.phase,
+            iteration: input.iteration,
+            outcome: 'allow',
+            changed: false,
+            ...extra,
+        });
+        let outcome;
+        try {
+            outcome = await mw.onMessage({
+                phase: input.phase,
+                content,
+                history: input.history,
+                ...(input.identity && { identity: input.identity }),
+                ...(input.signal && { signal: input.signal }),
+            });
+        }
+        catch (err) {
+            const reason = `middleware '${mw.name}' threw: ${err instanceof Error ? err.message : String(err)}`;
+            decisions.push(row({ outcome: 'deny', why: reason }));
+            return { kind: 'deny', reason, middleware: mw.name, content, decisions };
+        }
+        if (outcome.kind === 'deny') {
+            decisions.push(row({ outcome: 'deny', why: outcome.reason }));
+            return { kind: 'deny', reason: outcome.reason, middleware: mw.name, content, decisions };
+        }
+        if (outcome.value !== undefined) {
+            const before = content;
+            content = outcome.value;
+            decisions.push(row({ changed: true, ...(outcome.why && { why: outcome.why }), before, after: content }));
+        }
+        else {
+            decisions.push(row({}));
+        }
+    }
+    return { kind: 'allow', content, decisions };
+}
+//# sourceMappingURL=runChain.js.map

package/dist/esm/core/agent/middleware/runChain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runChain.js","sourceRoot":"","sources":["../../../../../src/core/agent/middleware/runChain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAgEH,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAgC,EAChC,KAAqB;IAErB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC;IAC7C,IAAI,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAEtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACrB,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,EAAE,EAAE,MAAM;YACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,IAAI;gBACJ,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxE,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACxF,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,MAAM,GACV,eAAe,EAAE,CAAC,IAAI,4DAA4D;oBAClF,mBAAmB,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAChD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;gBACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACxE,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YACvE,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,EAAE,CAAC,IAAI;gBACnB,KAAK,EAAE,CAAC;gBACR,IAAI;gBACJ,SAAS;aACV,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,IAAI,CAAC;YACpB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC;YACrB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CACtF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAyBD,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAmC,EACnC,KAAwB;IAExB,MAAM,SAAS,GAAyB,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,CAAC,KAAkC,EAAsB,EAAE,CAAC,CAAC;YACvE,UAAU,EAAE,EAAE,CAAC,IAAI;YACnB,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,OAAO;YAChB,OAAO,EAAE,KAAK;YACd,GAAG,KAAK;SACT,CAAC,CAAC;QAEH,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC;gBAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO;gBACP,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnD,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC,IAAI,YACnC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QAC3F,CAAC;QAED,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,OAAO,CAAC;YACvB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;YACxB,SAAS,CAAC,IAAI,CACZ,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CACzF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC/C,CAAC"}

package/dist/esm/core/agent/middleware/types.d.ts

@@ -0,0 +1,191 @@
+/**
+ * middleware/types — PUBLIC. The shape of a governance chain.
+ *
+ * Pattern: Chain of Responsibility (GoF), with the one dangerous answer
+ *          removed at the type level.
+ * Role:    core/ layer. Two chains, one vocabulary:
+ *
+ *            `toolMiddleware`     wraps every tool dispatch
+ *            `messageMiddleware`  wraps the message boundary — the input
+ *                                 before the model sees it, the output
+ *                                 before the caller receives it
+ *
+ * Emits:   N/A. A middleware is a pure decision. It never touches scope,
+ *          never emits and never writes — the stage does all of that, so
+ *          "record everything that happened" lives in ONE place rather
+ *          than being re-implemented per middleware.
+ *
+ * ## The law that shapes these types
+ *
+ * **A middleware cannot answer for the tool.** The outcome union has three
+ * arms — allow, deny, ask — and no `result` arm. There is no spelling of
+ * "here is what the tool would have returned". Whatever the chain decides,
+ * the answer the model finally reads is the real tool's output or a
+ * refusal. That is not a convention a reviewer has to enforce; it is the
+ * absence of a field.
+ *
+ * **A transform declares itself.** `allow(value, why)` requires a reason
+ * whenever it changes something, and the stage commits BOTH the original
+ * and the transformed value into the run's ledger. A prompt scrubbed by a
+ * middleware that hid its own scrubbing would poison every slice taken
+ * afterwards: the trace would show text nobody ever sent.
+ *
+ * **`ask` exists only where a pause exists.** `ToolOutcome` has it because
+ * tool dispatch runs inside a footprintjs pausable stage — the same door
+ * `checkIn` and `askHuman` already go through. `MessageOutcome` does not,
+ * because the message boundary is a plain stage, and inventing a second
+ * pause to give it one would be a worse answer than not offering it.
+ */
+import type { LLMMessage } from '../../../adapters/types.js';
+import type { MemoryIdentity } from '../../../memory/identity/types.js';
+/**
+ * Let the call through — optionally with a replacement for what the chain
+ * carries forward.
+ *
+ * `allow()` passes the value along untouched. `allow(value, why)` replaces
+ * it and says why; the `why` is not decoration, it is the row the ledger
+ * shows a person asking "who changed this, and what did it look like
+ * before?".
+ */
+export interface AllowOutcome<T> {
+    readonly kind: 'allow';
+    /** The replacement value. Absent = pass through unchanged. */
+    readonly value?: T;
+    /** Why the value changed. Present whenever `value` is. */
+    readonly why?: string;
+}
+/**
+ * Refuse the call. For a tool, `reason` reaches the model verbatim as the
+ * tool result and the run continues — a denial is data the agent can adapt
+ * to, not a crash. For a message, `reason` surfaces as a
+ * `MessageDeniedError` at the API boundary.
+ */
+export interface DenyOutcome {
+    readonly kind: 'deny';
+    readonly reason: string;
+}
+/** Suspend the run and put the question to a person. Tool dispatch only. */
+export interface AskOutcome {
+    readonly kind: 'ask';
+    readonly payload: AskPayload;
+}
+/** What a person is being asked. Carried verbatim to the checkpoint. */
+export interface AskPayload {
+    /** The question, in your own words. Shown to whoever answers. */
+    readonly question: string;
+    /** Anything else the answering UI should render. Never interpreted here. */
+    readonly detail?: unknown;
+}
+/**
+ * Everything a tool middleware may answer. Closed, and every arm has a
+ * home in this codebase: allow rides the normal dispatch, deny rides the
+ * synthetic tool result every other gate already uses, ask rides the
+ * pausable-stage checkpoint that `checkIn` rides.
+ */
+export type ToolOutcome = AllowOutcome<Readonly<Record<string, unknown>>> | DenyOutcome | AskOutcome;
+/** Everything a message middleware may answer. No `ask` — see the header. */
+export type MessageOutcome = AllowOutcome<string> | DenyOutcome;
+/** The call a tool middleware is deciding about. */
+export interface ToolMiddlewareContext {
+    readonly toolName: string;
+    /** Matches `stream.tool_start.toolCallId` for this dispatch. */
+    readonly toolCallId: string;
+    /** ReAct iteration this call belongs to. */
+    readonly iteration: number;
+    /**
+     * The args as THIS middleware sees them — every earlier transform in the
+     * chain already applied. The first middleware sees what the model asked
+     * for; the last sees what the tool is about to receive.
+     */
+    readonly args: Readonly<Record<string, unknown>>;
+    /** Conversation so far, including the assistant turn that made this call. */
+    readonly history: readonly LLMMessage[];
+    /** Multi-tenant run identity, when the run carried one. */
+    readonly identity?: MemoryIdentity;
+    /** Abort signal from `run({ env: { signal } })`. */
+    readonly signal?: AbortSignal;
+}
+/** The message a message middleware is deciding about. */
+export interface MessageMiddlewareContext {
+    /**
+     * `'input'` runs at the very top of the run, BEFORE the user's message is
+     * committed — so the window strategies, the injections, the slots, the
+     * request bytes and every later slice all see the transformed text and
+     * agree with each other. `'output'` runs where the final answer is
+     * captured, so the record and the caller receive the same string.
+     */
+    readonly phase: 'input' | 'output';
+    /** The content as THIS middleware sees it — earlier transforms applied. */
+    readonly content: string;
+    /** Conversation so far. Empty at `'input'`. */
+    readonly history: readonly LLMMessage[];
+    readonly identity?: MemoryIdentity;
+    readonly signal?: AbortSignal;
+}
+/**
+ * One link in the tool-dispatch chain.
+ *
+ * @example
+ * ```ts
+ * const noProdWrites: ToolMiddleware = {
+ *   name: 'no-prod-writes',
+ *   onToolCall: (call) =>
+ *     call.args.env === 'prod' ? deny('writes to prod need a change ticket') : allow(),
+ * };
+ * ```
+ */
+export interface ToolMiddleware {
+    /** Identifies this middleware in every ledger row and event it produces. */
+    readonly name: string;
+    onToolCall(call: ToolMiddlewareContext): ToolOutcome | Promise<ToolOutcome>;
+}
+/**
+ * One link in the message chain. Runs at both phases unless it decides
+ * otherwise by reading `msg.phase`.
+ *
+ * @example
+ * ```ts
+ * const scrubSSNs: MessageMiddleware = {
+ *   name: 'scrub-ssns',
+ *   onMessage: (msg) => {
+ *     const clean = msg.content.replace(/\b\d{3}-\d{2}-\d{4}\b/g, '[ssn]');
+ *     return clean === msg.content ? allow() : allow(clean, 'masked a US SSN');
+ *   },
+ * };
+ * ```
+ */
+export interface MessageMiddleware {
+    readonly name: string;
+    onMessage(msg: MessageMiddlewareContext): MessageOutcome | Promise<MessageOutcome>;
+}
+/**
+ * One row per middleware decision, committed to `scope.middlewareDecisions`.
+ *
+ * Every decision files a row, including the pass-throughs. A chain that
+ * only recorded its refusals would leave you unable to tell "the middleware
+ * looked and was fine with it" apart from "the middleware never ran" — and
+ * those are different facts about a run.
+ */
+export interface MiddlewareDecision {
+    /** The middleware's `name`. */
+    readonly middleware: string;
+    /** Which chain this row came from. */
+    readonly at: 'tool' | 'message';
+    /** Message chain only. */
+    readonly phase?: 'input' | 'output';
+    /** Tool chain only. */
+    readonly toolName?: string;
+    /** Tool chain only. */
+    readonly toolCallId?: string;
+    /** ReAct iteration. `0` for the `'input'` phase, which runs before iter 1. */
+    readonly iteration: number;
+    readonly outcome: 'allow' | 'deny' | 'ask';
+    /** True when this row changed the value the chain carries forward. */
+    readonly changed: boolean;
+    /** The transform's `why`, the denial's `reason`, or the ask's `question`. */
+    readonly why?: string;
+    /** The value before this middleware. Present only when `changed`. */
+    readonly before?: unknown;
+    /** The value after this middleware. Present only when `changed`. */
+    readonly after?: unknown;
+}

package/dist/esm/core/agent/middleware/types.js

@@ -0,0 +1,40 @@
+/**
+ * middleware/types — PUBLIC. The shape of a governance chain.
+ *
+ * Pattern: Chain of Responsibility (GoF), with the one dangerous answer
+ *          removed at the type level.
+ * Role:    core/ layer. Two chains, one vocabulary:
+ *
+ *            `toolMiddleware`     wraps every tool dispatch
+ *            `messageMiddleware`  wraps the message boundary — the input
+ *                                 before the model sees it, the output
+ *                                 before the caller receives it
+ *
+ * Emits:   N/A. A middleware is a pure decision. It never touches scope,
+ *          never emits and never writes — the stage does all of that, so
+ *          "record everything that happened" lives in ONE place rather
+ *          than being re-implemented per middleware.
+ *
+ * ## The law that shapes these types
+ *
+ * **A middleware cannot answer for the tool.** The outcome union has three
+ * arms — allow, deny, ask — and no `result` arm. There is no spelling of
+ * "here is what the tool would have returned". Whatever the chain decides,
+ * the answer the model finally reads is the real tool's output or a
+ * refusal. That is not a convention a reviewer has to enforce; it is the
+ * absence of a field.
+ *
+ * **A transform declares itself.** `allow(value, why)` requires a reason
+ * whenever it changes something, and the stage commits BOTH the original
+ * and the transformed value into the run's ledger. A prompt scrubbed by a
+ * middleware that hid its own scrubbing would poison every slice taken
+ * afterwards: the trace would show text nobody ever sent.
+ *
+ * **`ask` exists only where a pause exists.** `ToolOutcome` has it because
+ * tool dispatch runs inside a footprintjs pausable stage — the same door
+ * `checkIn` and `askHuman` already go through. `MessageOutcome` does not,
+ * because the message boundary is a plain stage, and inventing a second
+ * pause to give it one would be a worse answer than not offering it.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/esm/core/agent/middleware/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/core/agent/middleware/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG"}

package/dist/esm/core/agent/stages/prepareFinal.d.ts

@@ -13,6 +13,16 @@
  *
  * Pure function — no closure over Agent class state. Imported and
  * passed directly to `flowChart(...)` in buildAgentChart.
+ *
+ * NOT the seam for `messageMiddleware`'s `'output'` half, deliberately.
+ * This stage runs inside the Final BRANCH subflow, whose state does not
+ * merge back into the run (a branch mount hands its outputMapper the
+ * branch's RESULT, not its scope). Rows filed here would land in an
+ * isolated commit log and never reach `snapshot.sharedState`, splitting
+ * one ledger across two places. The chain runs one stage earlier instead
+ * — in the Route decider, in the main chart — and rewrites
+ * `llmLatestContent`, which is the value this stage copies. See
+ * `stages/route.ts`.
  */
 import type { TypedScope } from 'footprintjs';
 import type { AgentState } from '../types.js';

package/dist/esm/core/agent/stages/prepareFinal.js

@@ -13,6 +13,16 @@
  *
  * Pure function — no closure over Agent class state. Imported and
  * passed directly to `flowChart(...)` in buildAgentChart.
+ *
+ * NOT the seam for `messageMiddleware`'s `'output'` half, deliberately.
+ * This stage runs inside the Final BRANCH subflow, whose state does not
+ * merge back into the run (a branch mount hands its outputMapper the
+ * branch's RESULT, not its scope). Rows filed here would land in an
+ * isolated commit log and never reach `snapshot.sharedState`, splitting
+ * one ledger across two places. The chain runs one stage earlier instead
+ * — in the Route decider, in the main chart — and rewrites
+ * `llmLatestContent`, which is the value this stage copies. See
+ * `stages/route.ts`.
  */
 import { typedEmit } from '../../../recorders/core/typedEmit.js';
 export const prepareFinalStage = (scope) => {

package/dist/esm/core/agent/stages/prepareFinal.js.map

@@ -1 +1 @@
-{"version":3,"file":"prepareFinal.js","sourceRoot":"","sources":["../../../../../src/core/agent/stages/prepareFinal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAGjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA6B,EAAQ,EAAE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC5C,gEAAgE;IAChE,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,+DAA+D;IAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,6DAA6D;IAC7D,wCAAwC;IACxC,KAAK,CAAC,WAAW,GAAG;QAClB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE;QAC5C;YACE,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,KAAK,CAAC,YAAY;YAC3B,GAAG,CAAC,WAAW,IAAI,EAAE,cAAc,EAAE,CAAC;SACvC;KACF,CAAC;IAEF,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;QACrD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,EAAE,+BAA+B,EAAE;QAChD,SAAS,EAAE,CAAC;QACZ,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW;KAC3C,CAAC,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"prepareFinal.js","sourceRoot":"","sources":["../../../../../src/core/agent/stages/prepareFinal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAGjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA6B,EAAQ,EAAE;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,gBAAgB,CAAC;IAC5C,gEAAgE;IAChE,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,+DAA+D;IAC/D,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9E,6DAA6D;IAC7D,wCAAwC;IACxC,KAAK,CAAC,WAAW,GAAG;QAClB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE;QAC5C;YACE,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,KAAK,CAAC,YAAY;YAC3B,GAAG,CAAC,WAAW,IAAI,EAAE,cAAc,EAAE,CAAC;SACvC;KACF,CAAC;IAEF,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;QACrD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,SAAS;QACpB,aAAa,EAAE,CAAC;KACjB,CAAC,CAAC;IACH,SAAS,CAAC,KAAK,EAAE,+BAA+B,EAAE;QAChD,SAAS,EAAE,CAAC;QACZ,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,cAAc,EAAE,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,WAAW;KAC3C,CAAC,CAAC;AACL,CAAC,CAAC"}

package/dist/esm/core/agent/stages/route.d.ts

@@ -14,5 +14,34 @@
  */
 import type { TypedScope } from 'footprintjs';
 import type { AgentState } from '../types.js';
+import type { MessageMiddleware } from '../middleware/types.js';
 export type RouteBranch = 'tool-calls' | 'final';
 export declare const routeDeciderStage: (scope: TypedScope<AgentState>) => RouteBranch;
+/**
+ * Build the Route decider, optionally carrying the `'output'` half of the
+ * message chain.
+ *
+ * ## Why the chain runs HERE and not in PrepareFinal
+ *
+ * PrepareFinal is where `finalContent` is set, which makes it look like the
+ * output seam. It is not, for one structural reason: it lives inside the Final
+ * BRANCH subflow, and a branch mount hands its `outputMapper` the branch's
+ * RESULT, not its scope — so nothing that stage writes reaches the run's
+ * shared state. Ledger rows filed there would sit in an isolated commit log,
+ * and one ledger would be split across two places a reader has to know about.
+ *
+ * The decider is one stage earlier, in the main chart, and it is the first
+ * moment the run KNOWS this turn is the final answer. Its writes commit before
+ * the branch resolves (footprintjs commits a decider stage ahead of matching
+ * the branch), and the value it rewrites — `llmLatestContent` — is exactly
+ * what PrepareFinal copies into `finalContent`. So the caller, the committed
+ * record, the `newMessages` the memory writes persist, and the ledger row all
+ * carry the same string. One seam, one answer.
+ *
+ * The `'tool-calls'` path is untouched: a turn that is still calling tools has
+ * not produced an answer, and running an output rule over a half-finished turn
+ * would be running it over something that is not the output.
+ *
+ * Empty chain → the exact synchronous decider this file has always exported.
+ */
+export declare function buildRouteDeciderStage(messageMiddleware?: readonly MessageMiddleware[]): (scope: TypedScope<AgentState>) => RouteBranch | Promise<RouteBranch>;

package/dist/esm/core/agent/stages/route.js

@@ -13,6 +13,8 @@
  * passed directly to `addDeciderFunction(...)` in buildAgentChart.
  */
 import { typedEmit } from '../../../recorders/core/typedEmit.js';
+import { runMessageChain } from '../middleware/runChain.js';
+import { recordDecisions } from '../middleware/ledger.js';
 export const routeDeciderStage = (scope) => {
     const toolCalls = scope.llmLatestToolCalls;
     const iteration = scope.iteration;
@@ -29,4 +31,62 @@ export const routeDeciderStage = (scope) => {
     });
     return chosen;
 };
+/**
+ * Build the Route decider, optionally carrying the `'output'` half of the
+ * message chain.
+ *
+ * ## Why the chain runs HERE and not in PrepareFinal
+ *
+ * PrepareFinal is where `finalContent` is set, which makes it look like the
+ * output seam. It is not, for one structural reason: it lives inside the Final
+ * BRANCH subflow, and a branch mount hands its `outputMapper` the branch's
+ * RESULT, not its scope — so nothing that stage writes reaches the run's
+ * shared state. Ledger rows filed there would sit in an isolated commit log,
+ * and one ledger would be split across two places a reader has to know about.
+ *
+ * The decider is one stage earlier, in the main chart, and it is the first
+ * moment the run KNOWS this turn is the final answer. Its writes commit before
+ * the branch resolves (footprintjs commits a decider stage ahead of matching
+ * the branch), and the value it rewrites — `llmLatestContent` — is exactly
+ * what PrepareFinal copies into `finalContent`. So the caller, the committed
+ * record, the `newMessages` the memory writes persist, and the ledger row all
+ * carry the same string. One seam, one answer.
+ *
+ * The `'tool-calls'` path is untouched: a turn that is still calling tools has
+ * not produced an answer, and running an output rule over a half-finished turn
+ * would be running it over something that is not the output.
+ *
+ * Empty chain → the exact synchronous decider this file has always exported.
+ */
+export function buildRouteDeciderStage(messageMiddleware) {
+    const chain = messageMiddleware ?? [];
+    if (chain.length === 0)
+        return routeDeciderStage;
+    return async (scope) => {
+        const chosen = routeDeciderStage(scope);
+        if (chosen !== 'final')
+            return chosen;
+        const verdict = await runMessageChain(chain, {
+            phase: 'output',
+            content: scope.llmLatestContent,
+            history: [...scope.history],
+            iteration: scope.iteration,
+            ...(scope.runIdentity && { identity: scope.runIdentity }),
+        });
+        recordDecisions(scope, verdict.decisions);
+        if (verdict.kind === 'deny') {
+            // The answer is NOT released. It stays in the commit log where the run
+            // put it, under whatever redaction the run configured, and the boundary
+            // raises instead of returning — handing the caller a refusal in place of
+            // an answer is the one substitution they must never make unknowingly.
+            scope.messageDeniedReason = verdict.reason;
+            scope.messageDeniedPhase = 'output';
+            scope.messageDeniedBy = verdict.middleware;
+        }
+        // Committed either way: on a refusal this is what was withheld, and the
+        // ledger row beside it says who withheld it and why.
+        scope.llmLatestContent = verdict.content;
+        return chosen;
+    };
+}
 //# sourceMappingURL=route.js.map

package/dist/esm/core/agent/stages/route.js.map

@@ -1 +1 @@
-{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/core/agent/stages/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAKjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA6B,EAAe,EAAE;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAiD,CAAC;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAmB,CAAC;IAC5C,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;IAEnF,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;QACrD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,SAAS;QACpB,MAAM;QACN,SAAS,EACP,MAAM,KAAK,YAAY;YACrB,CAAC,CAAC,iBAAiB,SAAS,CAAC,MAAM,eAAe;YAClD,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa;gBAClC,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,2CAA2C;KAClD,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}
+{"version":3,"file":"route.js","sourceRoot":"","sources":["../../../../../src/core/agent/stages/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,sCAAsC,CAAC;AAIjE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAA6B,EAAe,EAAE;IAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,kBAAiD,CAAC;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAmB,CAAC;IAC5C,MAAM,MAAM,GACV,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;IAEnF,SAAS,CAAC,KAAK,EAAE,oCAAoC,EAAE;QACrD,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,SAAS;QACpB,MAAM;QACN,SAAS,EACP,MAAM,KAAK,YAAY;YACrB,CAAC,CAAC,iBAAiB,SAAS,CAAC,MAAM,eAAe;YAClD,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa;gBAClC,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,2CAA2C;KAClD,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,sBAAsB,CACpC,iBAAgD;IAEhD,MAAM,KAAK,GAAG,iBAAiB,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACjD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC;QAEtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE;YAC3C,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,OAAO,EAAE,CAAC,GAAI,KAAK,CAAC,OAAiC,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,uEAAuE;YACvE,wEAAwE;YACxE,yEAAyE;YACzE,sEAAsE;YACtE,KAAK,CAAC,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC;YAC3C,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;YACpC,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;QAC7C,CAAC;QACD,wEAAwE;QACxE,qDAAqD;QACrD,KAAK,CAAC,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}