agentfootprint 8.5.0 → 8.7.0

package/dist/esm/events/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/events/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA4EH,yEAAyE;AACzE,gEAAgE;AAChE,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW,EAAE;QACX,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,uCAAuC;QAClD,cAAc,EAAE,4CAA4C;QAC5D,QAAQ,EAAE,sCAAsC;QAChD,YAAY,EAAE,0CAA0C;QACxD,cAAc,EAAE,4CAA4C;QAC5D,aAAa,EAAE,2CAA2C;KAC3D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,+BAA+B;QACxC,cAAc,EAAE,sCAAsC;QACtD,YAAY,EAAE,oCAAoC;QAClD,YAAY,EAAE,oCAAoC;QAClD,OAAO,EAAE,8BAA8B;QACvC,4BAA4B,EAAE,sDAAsD;QACpF,iBAAiB,EAAE,0CAA0C;QAC7D,mBAAmB,EAAE,4CAA4C;KAClE;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,iCAAiC;QAC3C,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,6BAA6B;QACpC,SAAS,EAAE,kCAAkC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,aAAa,EAAE,sCAAsC;QACrD,WAAW,EAAE,oCAAoC;KAClD;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,iCAAiC;QAC3C,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,sCAAsC;QACpD,cAAc,EAAE,wCAAwC;QACxD,SAAS,EAAE,kCAAkC;KAC9C;IACD,MAAM,EAAE;QACN,eAAe,EAAE,wCAAwC;QACzD,QAAQ,EAAE,gCAAgC;QAC1C,QAAQ,EAAE,gCAAgC;QAC1C,OAAO,EAAE,+BAA+B;KACzC;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,gBAAgB,EAAE,wCAAwC;QAC1D,kBAAkB,EAAE,0CAA0C;QAC9D,eAAe,EAAE,uCAAuC;KACzD;IACD,KAAK,EAAE;QACL,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,+BAA+B;QACzC,iBAAiB,EAAE,yCAAyC;KAC7D;IACD,UAAU,EAAE;QACV,WAAW,EAAE,wCAAwC;KACtD;IACD,UAAU,EAAE;QACV,KAAK,EAAE,iCAAiC;QACxC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,uCAAuC;QACnD,IAAI,EAAE,gCAAgC;KACvC;IACD,UAAU,EAAE;QACV,SAAS,EAAE,qCAAqC;QAChD,QAAQ,EAAE,oCAAoC;QAC9C,qBAAqB,EAAE,kDAAkD;QACzE,MAAM,EAAE,kCAAkC;KAC3C;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,6BAA6B;KACvC;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,mCAAmC;KAC/C;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,+BAA+B;KAC1C;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,2BAA2B;QAClC,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,4BAA4B;KACpC;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,sCAAsC;QAChD,OAAO,EAAE,oCAAoC;QAC7C,SAAS,EAAE,sCAAsC;KAClD;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,6BAA6B;KACtC;IACD,OAAO,EAAE;QACP,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,iCAAiC;KAC5C;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,oCAAoC;KAC/C;IACD,SAAS,EAAE;QACT,SAAS,EAAE,oCAAoC;KAChD;CACO,CAAC;AAyTX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,4CAA4C;IAC5C,sCAAsC;IACtC,0CAA0C;IAC1C,4CAA4C;IAC5C,2CAA2C;IAC3C,iCAAiC;IACjC,+BAA+B;IAC/B,sCAAsC;IACtC,oCAAoC;IACpC,oCAAoC;IACpC,8BAA8B;IAC9B,sDAAsD;IACtD,0CAA0C;IAC1C,4CAA4C;IAC5C,iCAAiC;IACjC,+BAA+B;IAC/B,6BAA6B;IAC7B,kCAAkC;IAClC,gCAAgC;IAChC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,gCAAgC;IAChC,sCAAsC;IACtC,wCAAwC;IACxC,kCAAkC;IAClC,wCAAwC;IACxC,gCAAgC;IAChC,gCAAgC;IAChC,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,wCAAwC;IACxC,0CAA0C;IAC1C,uCAAuC;IACvC,wCAAwC;IACxC,gCAAgC;IAChC,kCAAkC;IAClC,+BAA+B;IAC/B,yCAAyC;IACzC,iCAAiC;IACjC,uCAAuC;IACvC,uCAAuC;IACvC,gCAAgC;IAChC,qCAAqC;IACrC,oCAAoC;IACpC,kDAAkD;IAClD,kCAAkC;IAClC,6BAA6B;IAC7B,mCAAmC;IACnC,0BAA0B;IAC1B,+BAA+B;IAC/B,2BAA2B;IAC3B,uCAAuC;IACvC,8BAA8B;IAC9B,gCAAgC;IAChC,4BAA4B;IAC5B,sCAAsC;IACtC,oCAAoC;IACpC,sCAAsC;IACtC,8BAA8B;IAC9B,6BAA6B;IAC7B,gCAAgC;IAChC,iCAAiC;IACjC,oCAAoC;IACpC,oCAAoC;CAC5B,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/events/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA6EH,yEAAyE;AACzE,gEAAgE;AAChE,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW,EAAE;QACX,KAAK,EAAE,kCAAkC;QACzC,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,uCAAuC;QAClD,cAAc,EAAE,4CAA4C;QAC5D,QAAQ,EAAE,sCAAsC;QAChD,YAAY,EAAE,0CAA0C;QACxD,cAAc,EAAE,4CAA4C;QAC5D,aAAa,EAAE,2CAA2C;KAC3D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,iCAAiC;QAC5C,OAAO,EAAE,+BAA+B;QACxC,cAAc,EAAE,sCAAsC;QACtD,YAAY,EAAE,oCAAoC;QAClD,YAAY,EAAE,oCAAoC;QAClD,OAAO,EAAE,8BAA8B;QACvC,4BAA4B,EAAE,sDAAsD;QACpF,iBAAiB,EAAE,0CAA0C;QAC7D,mBAAmB,EAAE,4CAA4C;KAClE;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,iCAAiC;QAC3C,MAAM,EAAE,+BAA+B;QACvC,KAAK,EAAE,6BAA6B;QACpC,SAAS,EAAE,kCAAkC;QAC7C,OAAO,EAAE,gCAAgC;QACzC,aAAa,EAAE,sCAAsC;QACrD,WAAW,EAAE,oCAAoC;KAClD;IACD,OAAO,EAAE;QACP,QAAQ,EAAE,iCAAiC;QAC3C,OAAO,EAAE,gCAAgC;QACzC,YAAY,EAAE,sCAAsC;QACpD,cAAc,EAAE,wCAAwC;QACxD,SAAS,EAAE,kCAAkC;KAC9C;IACD,MAAM,EAAE;QACN,eAAe,EAAE,wCAAwC;QACzD,QAAQ,EAAE,gCAAgC;QAC1C,QAAQ,EAAE,gCAAgC;QAC1C,OAAO,EAAE,+BAA+B;KACzC;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,gBAAgB,EAAE,wCAAwC;QAC1D,kBAAkB,EAAE,0CAA0C;QAC9D,eAAe,EAAE,uCAAuC;QACxD,QAAQ,EAAE,+BAA+B;KAC1C;IACD,KAAK,EAAE;QACL,SAAS,EAAE,gCAAgC;QAC3C,WAAW,EAAE,kCAAkC;QAC/C,QAAQ,EAAE,+BAA+B;QACzC,iBAAiB,EAAE,yCAAyC;KAC7D;IACD,UAAU,EAAE;QACV,WAAW,EAAE,wCAAwC;KACtD;IACD,UAAU,EAAE;QACV,KAAK,EAAE,iCAAiC;QACxC,UAAU,EAAE,uCAAuC;QACnD,UAAU,EAAE,uCAAuC;QACnD,IAAI,EAAE,gCAAgC;KACvC;IACD,UAAU,EAAE;QACV,SAAS,EAAE,qCAAqC;QAChD,QAAQ,EAAE,oCAAoC;QAC9C,qBAAqB,EAAE,kDAAkD;QACzE,MAAM,EAAE,kCAAkC;KAC3C;IACD,IAAI,EAAE;QACJ,OAAO,EAAE,6BAA6B;KACvC;IACD,QAAQ,EAAE;QACR,SAAS,EAAE,mCAAmC;KAC/C;IACD,IAAI,EAAE;QACJ,IAAI,EAAE,0BAA0B;QAChC,QAAQ,EAAE,+BAA+B;KAC1C;IACD,IAAI,EAAE;QACJ,KAAK,EAAE,2BAA2B;QAClC,gBAAgB,EAAE,uCAAuC;KAC1D;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,gCAAgC;QAC3C,KAAK,EAAE,4BAA4B;KACpC;IACD,WAAW,EAAE;QACX,QAAQ,EAAE,sCAAsC;QAChD,OAAO,EAAE,oCAAoC;QAC7C,SAAS,EAAE,sCAAsC;KAClD;IACD,KAAK,EAAE;QACL,OAAO,EAAE,8BAA8B;QACvC,MAAM,EAAE,6BAA6B;KACtC;IACD,OAAO,EAAE;QACP,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,iCAAiC;KAC5C;IACD,UAAU,EAAE;QACV,QAAQ,EAAE,oCAAoC;KAC/C;IACD,SAAS,EAAE;QACT,SAAS,EAAE,oCAAoC;KAChD;CACO,CAAC;AA6TX;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,kCAAkC;IAClC,iCAAiC;IACjC,uCAAuC;IACvC,4CAA4C;IAC5C,sCAAsC;IACtC,0CAA0C;IAC1C,4CAA4C;IAC5C,2CAA2C;IAC3C,iCAAiC;IACjC,+BAA+B;IAC/B,sCAAsC;IACtC,oCAAoC;IACpC,oCAAoC;IACpC,8BAA8B;IAC9B,sDAAsD;IACtD,0CAA0C;IAC1C,4CAA4C;IAC5C,iCAAiC;IACjC,+BAA+B;IAC/B,6BAA6B;IAC7B,kCAAkC;IAClC,gCAAgC;IAChC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,gCAAgC;IAChC,sCAAsC;IACtC,wCAAwC;IACxC,kCAAkC;IAClC,wCAAwC;IACxC,gCAAgC;IAChC,gCAAgC;IAChC,+BAA+B;IAC/B,8BAA8B;IAC9B,gCAAgC;IAChC,kCAAkC;IAClC,wCAAwC;IACxC,0CAA0C;IAC1C,uCAAuC;IACvC,+BAA+B;IAC/B,wCAAwC;IACxC,gCAAgC;IAChC,kCAAkC;IAClC,+BAA+B;IAC/B,yCAAyC;IACzC,iCAAiC;IACjC,uCAAuC;IACvC,uCAAuC;IACvC,gCAAgC;IAChC,qCAAqC;IACrC,oCAAoC;IACpC,kDAAkD;IAClD,kCAAkC;IAClC,6BAA6B;IAC7B,mCAAmC;IACnC,0BAA0B;IAC1B,+BAA+B;IAC/B,2BAA2B;IAC3B,uCAAuC;IACvC,8BAA8B;IAC9B,gCAAgC;IAChC,4BAA4B;IAC5B,sCAAsC;IACtC,oCAAoC;IACpC,sCAAsC;IACtC,8BAA8B;IAC9B,6BAA6B;IAC7B,gCAAgC;IAChC,iCAAiC;IACjC,oCAAoC;IACpC,oCAAoC;CAC5B,CAAC"}

package/dist/esm/identity/CredentialConsentRequiredError.d.ts

@@ -0,0 +1,63 @@
+/**
+ * CredentialConsentRequiredError — typed error thrown by `Agent.run()` under
+ * `onAuthorizationRequired: 'tell-model'` when a turn finished while a tool's
+ * DECLARED credential was never obtained.
+ *
+ * Pattern: Typed Error (parallel to `PolicyHaltError` / `MessageDeniedError`).
+ * Role:    The honesty terminal for the non-pausing mode. `'tell-model'` lets
+ *          the model adapt in-loop after a consent block — but a turn that
+ *          returned a plain answer string would be claiming a completion it
+ *          did not earn, because the tool never ran. `AgentOutput` is a bare
+ *          string with nowhere to hang "…and a consent is still outstanding",
+ *          so the fact is surfaced as an error instead of being dropped.
+ * Emits:   N/A (this file DEFINES the class; `agentfootprint.credential.
+ *          authorization_required` fires from the toolCalls handler at the
+ *          moment the block resolves, and carries `{ service, sessionId }`
+ *          only — never the URL).
+ *
+ * **The `authorizationUrl` on this error is a bearer capability.** It carries a
+ * session-correlating `state` parameter: whoever holds the URL can complete the
+ * consent flow. It reaches the caller HERE and on `PendingAsk` under
+ * `'pause'` — and deliberately nowhere else. It is never written to the
+ * conversation, the snapshot, the narrative, the typed event stream, or a
+ * recording. Treat it like the token it stands in for: hand it to the person
+ * who must click it, and do not log it.
+ *
+ * Under the default `onAuthorizationRequired: 'pause'` this error never fires —
+ * the run pauses at the block instead and the same three fields ride
+ * `PendingAsk`.
+ *
+ * @example
+ *   try {
+ *     await agent.run({ message: 'pay invoice INV-42' });
+ *   } catch (e) {
+ *     if (e instanceof CredentialConsentRequiredError) {
+ *       // Show the URL to the PERSON. Never log it.
+ *       await notifyUser(e.service, e.authorizationUrl);
+ *     } else {
+ *       throw e;
+ *     }
+ *   }
+ */
+export interface CredentialConsentRequiredContext {
+    /** Downstream service id the tool declared, e.g. 'github', 'billing'. */
+    readonly service: string;
+    /** The 3LO consent URL. A BEARER CAPABILITY — see the class note. */
+    readonly authorizationUrl: string;
+    /** Correlates the authorization session with the provider. */
+    readonly sessionId: string;
+    /** The tool whose declared credential was refused. */
+    readonly tool: string;
+    /** ReAct iteration the block fired on. */
+    readonly iteration: number;
+}
+export declare class CredentialConsentRequiredError extends Error {
+    readonly code: "ERR_CREDENTIAL_CONSENT_REQUIRED";
+    readonly service: string;
+    /** The 3LO consent URL. A BEARER CAPABILITY — see the class note. */
+    readonly authorizationUrl: string;
+    readonly sessionId: string;
+    readonly tool: string;
+    readonly iteration: number;
+    constructor(ctx: CredentialConsentRequiredContext);
+}

package/dist/esm/identity/CredentialConsentRequiredError.js

@@ -0,0 +1,65 @@
+/**
+ * CredentialConsentRequiredError — typed error thrown by `Agent.run()` under
+ * `onAuthorizationRequired: 'tell-model'` when a turn finished while a tool's
+ * DECLARED credential was never obtained.
+ *
+ * Pattern: Typed Error (parallel to `PolicyHaltError` / `MessageDeniedError`).
+ * Role:    The honesty terminal for the non-pausing mode. `'tell-model'` lets
+ *          the model adapt in-loop after a consent block — but a turn that
+ *          returned a plain answer string would be claiming a completion it
+ *          did not earn, because the tool never ran. `AgentOutput` is a bare
+ *          string with nowhere to hang "…and a consent is still outstanding",
+ *          so the fact is surfaced as an error instead of being dropped.
+ * Emits:   N/A (this file DEFINES the class; `agentfootprint.credential.
+ *          authorization_required` fires from the toolCalls handler at the
+ *          moment the block resolves, and carries `{ service, sessionId }`
+ *          only — never the URL).
+ *
+ * **The `authorizationUrl` on this error is a bearer capability.** It carries a
+ * session-correlating `state` parameter: whoever holds the URL can complete the
+ * consent flow. It reaches the caller HERE and on `PendingAsk` under
+ * `'pause'` — and deliberately nowhere else. It is never written to the
+ * conversation, the snapshot, the narrative, the typed event stream, or a
+ * recording. Treat it like the token it stands in for: hand it to the person
+ * who must click it, and do not log it.
+ *
+ * Under the default `onAuthorizationRequired: 'pause'` this error never fires —
+ * the run pauses at the block instead and the same three fields ride
+ * `PendingAsk`.
+ *
+ * @example
+ *   try {
+ *     await agent.run({ message: 'pay invoice INV-42' });
+ *   } catch (e) {
+ *     if (e instanceof CredentialConsentRequiredError) {
+ *       // Show the URL to the PERSON. Never log it.
+ *       await notifyUser(e.service, e.authorizationUrl);
+ *     } else {
+ *       throw e;
+ *     }
+ *   }
+ */
+export class CredentialConsentRequiredError extends Error {
+    code = 'ERR_CREDENTIAL_CONSENT_REQUIRED';
+    service;
+    /** The 3LO consent URL. A BEARER CAPABILITY — see the class note. */
+    authorizationUrl;
+    sessionId;
+    tool;
+    iteration;
+    constructor(ctx) {
+        // The MESSAGE deliberately omits the URL. An error message is the one
+        // string that reliably reaches a log line, and this class exists to keep
+        // a capability out of logs.
+        super(`Authorization required for '${ctx.service}' (tool='${ctx.tool}', ` +
+            `iteration=${ctx.iteration}). The tool did not run. Read ` +
+            `\`error.authorizationUrl\` to send the person to consent.`);
+        this.name = 'CredentialConsentRequiredError';
+        this.service = ctx.service;
+        this.authorizationUrl = ctx.authorizationUrl;
+        this.sessionId = ctx.sessionId;
+        this.tool = ctx.tool;
+        this.iteration = ctx.iteration;
+    }
+}
+//# sourceMappingURL=CredentialConsentRequiredError.js.map

package/dist/esm/identity/CredentialConsentRequiredError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialConsentRequiredError.js","sourceRoot":"","sources":["../../../src/identity/CredentialConsentRequiredError.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAeH,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IAC9C,IAAI,GAAG,iCAA0C,CAAC;IAClD,OAAO,CAAS;IACzB,qEAAqE;IAC5D,gBAAgB,CAAS;IACzB,SAAS,CAAS;IAClB,IAAI,CAAS;IACb,SAAS,CAAS;IAE3B,YAAY,GAAqC;QAC/C,sEAAsE;QACtE,yEAAyE;QACzE,4BAA4B;QAC5B,KAAK,CACH,+BAA+B,GAAG,CAAC,OAAO,YAAY,GAAG,CAAC,IAAI,KAAK;YACjE,aAAa,GAAG,CAAC,SAAS,gCAAgC;YAC1D,2DAA2D,CAC9D,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC;QAC7C,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IACjC,CAAC;CACF"}

package/dist/esm/identity/consent.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The 3LO consent vocabulary — one place, because four surfaces must agree on
+ * it and three of them are security boundaries.
+ *
+ * A `CredentialProvider` that answers `authorization-required` is saying: a
+ * PERSON has to click a link before this tool can run. Two things follow, and
+ * they are the whole of this module.
+ *
+ * **1. The URL is a bearer capability, not a message.** It carries a
+ * session-correlating `state` parameter; whoever holds it can complete the
+ * consent flow. It goes to the CALLER — on `PendingAsk` under `'pause'`, on
+ * `CredentialConsentRequiredError` under `'tell-model'` — and to nowhere else.
+ * Before 8.6.0 it was interpolated into the tool-result string, which put it in
+ * the conversation and therefore in every channel built to preserve tool output
+ * (history, `stream.tool_end`, `agent.iteration_end`, `context.injected`, the
+ * commit log, the snapshot, the narrative's `rawValue`, and any recording).
+ * `modelRefusal()` is the URL-free replacement, and it is why the interpolation
+ * has no remaining call site.
+ *
+ * **2. The model is the one party that cannot act on it.** So what the model
+ * reads names the service, says a person is handling it, and tells it what to
+ * do instead — the same shape as the `[permission denied: …]` refusal it
+ * already knows how to read.
+ */
+/**
+ * What a run does when a tool's declared credential needs consent.
+ *
+ * - `'pause'` (default) — the run stops at the block. `agent.run()` returns a
+ *   pause outcome, a host answers 202 with `{ awaiting }`, and
+ *   `agent.resume(checkpoint)` re-resolves the credential and runs the tool
+ *   that was waiting. The model is never told; nothing is fabricated.
+ * - `'tell-model'` — the model reads {@link modelRefusal} and may route around
+ *   the block. The turn still cannot report a clean completion: it raises
+ *   `CredentialConsentRequiredError`.
+ */
+export type AuthorizationRequiredMode = 'pause' | 'tell-model';
+/**
+ * The key under which a consent request rides `pauseData` (and therefore
+ * `PendingAsk.pauseData`). Named, rather than free-form, for one reason:
+ * `agentfootprint.pause.request` mirrors the WHOLE `pauseData` into its
+ * `questionPayload`, so the emitter has to be able to find this block and
+ * withhold the URL from the event stream. A free-form shape could not be
+ * bounded by name, and the URL would have leaked into every observer again.
+ *
+ * @see redactConsentUrlForEvent
+ */
+export declare const CONSENT_PAUSE_KEY = "authorization";
+/** The consent block handed to the CALLER on `pauseData` / `PendingAsk`. */
+export interface ConsentRequest {
+    readonly service: string;
+    /** BEARER CAPABILITY. Show it to the person; never log it. */
+    readonly authorizationUrl: string;
+    readonly sessionId: string;
+}
+/** Placeholder written where the consent URL is deliberately withheld. */
+export declare const CONSENT_URL_WITHHELD = "[withheld: consent URL is caller-only]";
+/**
+ * What the MODEL reads when a declared credential needs consent. Never the URL.
+ *
+ * Bracketed like the permission-gate refusal, because it is the same kind of
+ * fact: the call did not happen and the model must adapt. It names the service
+ * (so the model can reason about what is unavailable), says a person is on it
+ * (so it does not invent a way to authorize itself), and offers the two honest
+ * continuations.
+ */
+export declare function modelRefusal(service: string): string;
+/** The plain-words question a host shows the person, via `PendingAsk.question`. */
+export declare function consentQuestion(service: string, tool: string): string;
+/**
+ * Strip the consent URL out of a `pause.request` payload.
+ *
+ * `RunnerBase.emitPauseRequest` copies the whole `pauseData` into
+ * `PauseRequestPayload.questionPayload`, which is right for a check-in's
+ * evidence pack and wrong for a bearer URL. This withholds exactly one field by
+ * name and leaves every other pause shape untouched — the same discipline the
+ * audit adapter's `BOUND_FIELDS` already applies to `tool_end.result`.
+ *
+ * Returns the input unchanged (same reference) when there is no consent block,
+ * so no existing pause pays for this.
+ */
+export declare function redactConsentUrlForEvent(payload: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;

package/dist/esm/identity/consent.js

@@ -0,0 +1,85 @@
+/**
+ * The 3LO consent vocabulary — one place, because four surfaces must agree on
+ * it and three of them are security boundaries.
+ *
+ * A `CredentialProvider` that answers `authorization-required` is saying: a
+ * PERSON has to click a link before this tool can run. Two things follow, and
+ * they are the whole of this module.
+ *
+ * **1. The URL is a bearer capability, not a message.** It carries a
+ * session-correlating `state` parameter; whoever holds it can complete the
+ * consent flow. It goes to the CALLER — on `PendingAsk` under `'pause'`, on
+ * `CredentialConsentRequiredError` under `'tell-model'` — and to nowhere else.
+ * Before 8.6.0 it was interpolated into the tool-result string, which put it in
+ * the conversation and therefore in every channel built to preserve tool output
+ * (history, `stream.tool_end`, `agent.iteration_end`, `context.injected`, the
+ * commit log, the snapshot, the narrative's `rawValue`, and any recording).
+ * `modelRefusal()` is the URL-free replacement, and it is why the interpolation
+ * has no remaining call site.
+ *
+ * **2. The model is the one party that cannot act on it.** So what the model
+ * reads names the service, says a person is handling it, and tells it what to
+ * do instead — the same shape as the `[permission denied: …]` refusal it
+ * already knows how to read.
+ */
+/**
+ * The key under which a consent request rides `pauseData` (and therefore
+ * `PendingAsk.pauseData`). Named, rather than free-form, for one reason:
+ * `agentfootprint.pause.request` mirrors the WHOLE `pauseData` into its
+ * `questionPayload`, so the emitter has to be able to find this block and
+ * withhold the URL from the event stream. A free-form shape could not be
+ * bounded by name, and the URL would have leaked into every observer again.
+ *
+ * @see redactConsentUrlForEvent
+ */
+export const CONSENT_PAUSE_KEY = 'authorization';
+/** Placeholder written where the consent URL is deliberately withheld. */
+export const CONSENT_URL_WITHHELD = '[withheld: consent URL is caller-only]';
+/**
+ * What the MODEL reads when a declared credential needs consent. Never the URL.
+ *
+ * Bracketed like the permission-gate refusal, because it is the same kind of
+ * fact: the call did not happen and the model must adapt. It names the service
+ * (so the model can reason about what is unavailable), says a person is on it
+ * (so it does not invent a way to authorize itself), and offers the two honest
+ * continuations.
+ */
+export function modelRefusal(service) {
+    return (`[authorization required: '${service}' — a person must consent before this ` +
+        `tool can run. The caller has been told; you cannot do it yourself. ` +
+        `Continue with work that does not need '${service}', or say plainly that ` +
+        `you could not finish this step.]`);
+}
+/** The plain-words question a host shows the person, via `PendingAsk.question`. */
+export function consentQuestion(service, tool) {
+    return `Authorize access to '${service}' so '${tool}' can run.`;
+}
+/**
+ * Strip the consent URL out of a `pause.request` payload.
+ *
+ * `RunnerBase.emitPauseRequest` copies the whole `pauseData` into
+ * `PauseRequestPayload.questionPayload`, which is right for a check-in's
+ * evidence pack and wrong for a bearer URL. This withholds exactly one field by
+ * name and leaves every other pause shape untouched — the same discipline the
+ * audit adapter's `BOUND_FIELDS` already applies to `tool_end.result`.
+ *
+ * Returns the input unchanged (same reference) when there is no consent block,
+ * so no existing pause pays for this.
+ */
+export function redactConsentUrlForEvent(payload) {
+    const block = payload[CONSENT_PAUSE_KEY];
+    if (typeof block !== 'object' ||
+        block === null ||
+        !('authorizationUrl' in block) ||
+        typeof block.authorizationUrl !== 'string') {
+        return payload;
+    }
+    return {
+        ...payload,
+        [CONSENT_PAUSE_KEY]: {
+            ...block,
+            authorizationUrl: CONSENT_URL_WITHHELD,
+        },
+    };
+}
+//# sourceMappingURL=consent.js.map

package/dist/esm/identity/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../../src/identity/consent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAeH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAUjD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,wCAAwC,CAAC;AAE7E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,CACL,6BAA6B,OAAO,wCAAwC;QAC5E,qEAAqE;QACrE,0CAA0C,OAAO,yBAAyB;QAC1E,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,IAAY;IAC3D,OAAO,wBAAwB,OAAO,SAAS,IAAI,YAAY,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAA0C;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzC,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,CAAC,kBAAkB,IAAI,KAAK,CAAC;QAC9B,OAAQ,KAAuC,CAAC,gBAAgB,KAAK,QAAQ,EAC7E,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO;QACL,GAAG,OAAO;QACV,CAAC,iBAAiB,CAAC,EAAE;YACnB,GAAI,KAAiC;YACrC,gBAAgB,EAAE,oBAAoB;SACvC;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/identity.d.ts

@@ -31,5 +31,7 @@ export type { Credential, CredentialProvider, CredentialRequest, CredentialResul
 export { isCredentialIssued, unconfiguredCredentialProvider } from './identity/types.js';
 export { bearer, apiKey, basic, headers, type BearerCredential, type ApiKeyCredential, type BasicCredential, type HeadersCredential, } from './identity/kinds.js';
 export { staticTokens, type StaticTokensOptions } from './identity/staticTokens.js';
+export type { AuthorizationRequiredMode, ConsentRequest } from './identity/consent.js';
+export { CredentialConsentRequiredError, type CredentialConsentRequiredContext, } from './identity/CredentialConsentRequiredError.js';
 export { withCredentialRetry, type WithCredentialRetryOptions, } from './identity/withCredentialRetry.js';
 export { agentCoreIdentity, type AgentCoreIdentityOptions, type AgentCoreIdentityClientLike, type AgentCoreOauthResponse, } from './adapters/identity/agentcore.js';

package/dist/esm/identity.js

@@ -30,6 +30,7 @@
 export { isCredentialIssued, unconfiguredCredentialProvider } from './identity/types.js';
 export { bearer, apiKey, basic, headers, } from './identity/kinds.js';
 export { staticTokens } from './identity/staticTokens.js';
+export { CredentialConsentRequiredError, } from './identity/CredentialConsentRequiredError.js';
 export { withCredentialRetry, } from './identity/withCredentialRetry.js';
 export { agentCoreIdentity, } from './adapters/identity/agentcore.js';
 //# sourceMappingURL=identity.js.map

package/dist/esm/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAWH,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EACL,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,GAKR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAA4B,MAAM,4BAA4B,CAAC;AACpF,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,GAIlB,MAAM,kCAAkC,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAWH,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,qBAAqB,CAAC;AACzF,OAAO,EACL,MAAM,EACN,MAAM,EACN,KAAK,EACL,OAAO,GAKR,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAA4B,MAAM,4BAA4B,CAAC;AAKpF,OAAO,EACL,8BAA8B,GAE/B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,iBAAiB,GAIlB,MAAM,kCAAkC,CAAC"}

package/dist/esm/lib/injection-engine/factories/defineRelevanceHint.d.ts

@@ -23,4 +23,19 @@ export interface RelevanceHintOptions {
      */
     readonly threshold?: number;
 }
+/**
+ * The metadata marker that says "this injection reads `ctx.entryScores`" (8.7.0).
+ *
+ * Only `.entryBy()` / `.entryByRelevance()` ever write `entryScores` — the PickEntry
+ * stage runs a scorer and stamps them. Mounted on a graph with no scorer, the hint's
+ * trigger simply can never be true, and nothing said so: the injection registered,
+ * evaluated false on every iteration for the life of the agent, and the author saw a
+ * feature that was configured and inert.
+ *
+ * A marker rather than an id match, because the id is the caller's to choose
+ * (`defineRelevanceHint({ id })`) — matching on `'relevance-hint'` would miss every
+ * renamed one and would false-positive on anybody else's injection of that name.
+ * `AgentBuilder.build()` reads it and dev-warns.
+ */
+export declare const READS_ENTRY_SCORES_METADATA_KEY: "readsEntryScores";
 export declare function defineRelevanceHint(options?: RelevanceHintOptions): Injection;

package/dist/esm/lib/injection-engine/factories/defineRelevanceHint.js

@@ -13,6 +13,21 @@
  *
  * Add it explicitly: `Agent.create(...).skillGraph(graph).injection(defineRelevanceHint())`.
  */
+/**
+ * The metadata marker that says "this injection reads `ctx.entryScores`" (8.7.0).
+ *
+ * Only `.entryBy()` / `.entryByRelevance()` ever write `entryScores` — the PickEntry
+ * stage runs a scorer and stamps them. Mounted on a graph with no scorer, the hint's
+ * trigger simply can never be true, and nothing said so: the injection registered,
+ * evaluated false on every iteration for the life of the agent, and the author saw a
+ * feature that was configured and inert.
+ *
+ * A marker rather than an id match, because the id is the caller's to choose
+ * (`defineRelevanceHint({ id })`) — matching on `'relevance-hint'` would miss every
+ * renamed one and would false-positive on anybody else's injection of that name.
+ * `AgentBuilder.build()` reads it and dev-warns.
+ */
+export const READS_ENTRY_SCORES_METADATA_KEY = 'readsEntryScores';
 /** Is the top entry a near-tie with the runner-up? */
 function isNearTie(scores, threshold) {
     if (!scores || scores.length < 2)
@@ -30,6 +45,7 @@ export function defineRelevanceHint(options = {}) {
             kind: 'rule',
             activeWhen: (ctx) => ctx.iteration === 1 && isNearTie(ctx.entryScores, threshold),
         },
+        metadata: { [READS_ENTRY_SCORES_METADATA_KEY]: true },
         inject: {
             systemPrompt: 'Note: an offline relevance scorer found two or more starting skills nearly tied for ' +
                 'this request. That scorer only matches description keywords and cannot see the ' +

package/dist/esm/lib/injection-engine/factories/defineRelevanceHint.js.map

@@ -1 +1 @@
-{"version":3,"file":"defineRelevanceHint.js","sourceRoot":"","sources":["../../../../../src/lib/injection-engine/factories/defineRelevanceHint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH,sDAAsD;AACtD,SAAS,SAAS,CAAC,MAAuC,EAAE,SAAiB;IAC3E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,GAAG,SAAS,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAgC,EAAE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,gBAAgB;QAClC,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE;YACP,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;SAClF;QACD,MAAM,EAAE;YACN,YAAY,EACV,sFAAsF;gBACtF,iFAAiF;gBACjF,sFAAsF;gBACtF,uFAAuF;gBACvF,uBAAuB;SAC1B;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"defineRelevanceHint.js","sourceRoot":"","sources":["../../../../../src/lib/injection-engine/factories/defineRelevanceHint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,kBAA2B,CAAC;AAE3E,sDAAsD;AACtD,SAAS,SAAS,CAAC,MAAuC,EAAE,SAAiB;IAC3E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,SAAS,GAAG,SAAS,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,UAAgC,EAAE;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,gBAAgB;QAClC,MAAM,EAAE,cAAc;QACtB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE;YACP,IAAI,EAAE,MAAM;YACZ,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC;SAClF;QACD,QAAQ,EAAE,EAAE,CAAC,+BAA+B,CAAC,EAAE,IAAI,EAAE;QACrD,MAAM,EAAE;YACN,YAAY,EACV,sFAAsF;gBACtF,iFAAiF;gBACjF,sFAAsF;gBACtF,uFAAuF;gBACvF,uBAAuB;SAC1B;KACF,CAAC;AACJ,CAAC"}

package/dist/esm/lib/injection-engine/factories/defineSkill.d.ts

@@ -91,6 +91,15 @@ export interface DefineSkillOptions {
      * Override the activation tool name. Defaults to `'read_skill'`.
      * Multiple Skills sharing one activation tool is the common pattern;
      * the LLM picks WHICH skill via the tool's argument.
+     *
+     * @deprecated Since 8.7.0 — `'read_skill'` is the only value that has ever worked,
+     * and anything else is now REFUSED when the skill is mounted on an agent. No tool is
+     * built from this name: the evaluator activates an `llm-activated` skill by matching
+     * `ctx.activatedInjectionIds`, which only `read_skill` writes, and it never reads
+     * this field. A skill declaring another name activated through `read_skill` exactly
+     * like every other skill, so the declaration described a door that does not exist.
+     * Drop it — skills already share ONE activation tool and the model picks which skill
+     * by id. Removed in 9.0.0.
      */
     readonly viaToolName?: string;
     /**

package/dist/esm/lib/injection-engine/factories/defineSkill.js.map

@@ -1 +1 @@
-{"version":3,"file":"defineSkill.js","sourceRoot":"","sources":["../../../../../src/lib/injection-engine/factories/defineSkill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AA0HxE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAc;IACjE,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;QACtB,2CAA2C;QAC3C,4CAA4C;QAC5C,+EAA+E;QAC/E,gFAAgF;QAChF,IAAI,KAAK,IAAI,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,EAAE,0EAA0E,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,OAAgB;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,eAAwB;YAC9B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,YAAY;SAC9C;QACD,MAAM,EAAE;YACN,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAClE;QACD,iEAAiE;QACjE,oEAAoE;QACpE,iEAAiE;QACjE,mCAAmC;QACnC,EAAE;QACF,iEAAiE;QACjE,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM;YACvC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7D,KAAK,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAyB,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"defineSkill.js","sourceRoot":"","sources":["../../../../../src/lib/injection-engine/factories/defineSkill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAmIxE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,KAAc;IACjE,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;QACtB,2CAA2C;QAC3C,4CAA4C;QAC5C,+EAA+E;QAC/E,gFAAgF;QAChF,IAAI,KAAK,IAAI,iEAAiE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,eAAe,IAAI,CAAC,EAAE,0EAA0E,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,MAAM,EAAE,OAAgB;QACxB,OAAO,EAAE;YACP,IAAI,EAAE,eAAwB;YAC9B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,YAAY;SAC9C;QACD,MAAM,EAAE;YACN,YAAY,EAAE,IAAI,CAAC,IAAI;YACvB,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAClE;QACD,iEAAiE;QACjE,oEAAoE;QACpE,iEAAiE;QACjE,mCAAmC;QACnC,EAAE;QACF,iEAAiE;QACjE,iEAAiE;QACjE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,MAAM;YACvC,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7D,KAAK,EAAE,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC;SAC/C,CAAC;KACH,CAAyB,CAAC;AAC7B,CAAC"}

package/dist/esm/lib/injection-engine/index.d.ts

@@ -10,7 +10,7 @@ export { projectActiveInjection } from './types.js';
 export { evaluateInjections } from './evaluator.js';
 export { buildInjectionEngineSubflow, type InjectionEngineConfig, } from './buildInjectionEngineSubflow.js';
 export { defineInstruction, type DefineInstructionOptions } from './factories/defineInstruction.js';
-export { defineRelevanceHint, type RelevanceHintOptions } from './factories/defineRelevanceHint.js';
+export { defineRelevanceHint, READS_ENTRY_SCORES_METADATA_KEY, type RelevanceHintOptions, } from './factories/defineRelevanceHint.js';
 export { defineSkill, resolveSurfaceMode, type DefineSkillOptions, type SurfaceMode, type RefreshPolicy, type AutoActivateMode, } from './factories/defineSkill.js';
 export { SkillRegistry, type SkillRegistryOptions } from './SkillRegistry.js';
 export { skillsFromDir, type SkillsFromDirOptions } from './skillsFromDir.js';
@@ -18,6 +18,6 @@ export { buildListSkillsTool, buildReadSkillTool, type SkillToolPair } from './s
 export { defineSteering, type DefineSteeringOptions } from './factories/defineSteering.js';
 export { defineFact, type DefineFactOptions } from './factories/defineFact.js';
 export { defineInjection, type DefineInjectionOptions, type InjectionFlavor, } from './factories/defineInjection.js';
-export { skillGraph, decideSkill, SKILL_GRAPH_METADATA_KEY, type SkillGraph, type SkillGraphBuilder, type SkillRouteOptions, type SkillEntryOptions, type TreeOptions, type SkillEdge, type SkillEdgeKind, type SkillNode, type DecisionNode, type SkillRouting, type SkillRoutingStep, type CursorMove, type CursorMoveCause, type EntryScore, type EntryScoring, type SkillGraphConfig, type SkillGraphFlatConfig, type SkillGraphTreeConfig, type SkillGraphStart, type SkillGraphStep, type BuildOptions, type GraphCheckMode, type GraphCheckup, type GraphProblem, type GraphProblemCode, } from './skillGraph.js';
+export { skillGraph, decideSkill, formatCheckup, SKILL_GRAPH_METADATA_KEY, type SkillGraph, type SkillGraphBuilder, type SkillRouteOptions, type SkillEntryOptions, type TreeOptions, type SkillEdge, type SkillEdgeKind, type SkillNode, type DecisionNode, type SkillRouting, type SkillRoutingStep, type CursorMove, type CursorMoveCause, type EntryScore, type EntryScoring, type SkillGraphConfig, type SkillGraphFlatConfig, type SkillGraphTreeConfig, type SkillGraphStart, type SkillGraphStep, type BuildOptions, type CheckupOptions, type GraphCheckMode, type GraphCheckup, type GraphProblem, type GraphProblemCode, } from './skillGraph.js';
 export { keywordScorer, embeddingScorer, rankEntries, type EntryScorer, type EntryScorerInput, type EntryCandidate, } from './entryScorer.js';
-export { checkSkillContract, checkSkillContracts, skillToolNames } from './skillContract.js';
+export { checkSkillContract, checkSkillContracts, skillToolNames, type SkillContractOptions, } from './skillContract.js';

package/dist/esm/lib/injection-engine/index.js

@@ -12,7 +12,7 @@ export { evaluateInjections } from './evaluator.js';
 export { buildInjectionEngineSubflow, } from './buildInjectionEngineSubflow.js';
 // Sugar factories — Ships four; more flavors planned (RAG / Memory / Guardrail)
 export { defineInstruction } from './factories/defineInstruction.js';
-export { defineRelevanceHint } from './factories/defineRelevanceHint.js';
+export { defineRelevanceHint, READS_ENTRY_SCORES_METADATA_KEY, } from './factories/defineRelevanceHint.js';
 export { defineSkill, resolveSurfaceMode, } from './factories/defineSkill.js';
 export { SkillRegistry } from './SkillRegistry.js';
 // File-authored skills — a loader over `defineSkill`, not a second mechanism.
@@ -32,7 +32,12 @@ export { defineFact } from './factories/defineFact.js';
 export { defineInjection, } from './factories/defineInjection.js';
 // Declarative skill graph (proposal 002) — declare skills + routing edges →
 // graph-derived triggers + a drawable topology. Sugar over the trigger model.
-export { skillGraph, decideSkill, SKILL_GRAPH_METADATA_KEY, } from './skillGraph.js';
+export { skillGraph, decideSkill, 
+// 8.7.0 — render a `graph.checkup()` for a log line or a CI failure. The formatter
+// the library itself uses; without it every consumer wrote their own. `checkupGraph`
+// stays private: its input is the graph's internal wiring shape, and `graph.checkup()`
+// is already the door to it.
+formatCheckup, SKILL_GRAPH_METADATA_KEY, } from './skillGraph.js';
 export { keywordScorer, embeddingScorer, rankEntries, } from './entryScorer.js';
-export { checkSkillContract, checkSkillContracts, skillToolNames } from './skillContract.js';
+export { checkSkillContract, checkSkillContracts, skillToolNames, } from './skillContract.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/lib/injection-engine/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/injection-engine/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,+DAA+D;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EACL,2BAA2B,GAE5B,MAAM,kCAAkC,CAAC;AAE1C,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAiC,MAAM,kCAAkC,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAA6B,MAAM,oCAAoC,CAAC;AAEpG,OAAO,EACL,WAAW,EACX,kBAAkB,GAKnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAE9E,8EAA8E;AAC9E,+EAA+E;AAC/E,6DAA6D;AAC7D,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAE9E,wEAAwE;AACxE,sEAAsE;AACtE,iEAAiE;AACjE,+BAA+B;AAC/B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAsB,MAAM,iBAAiB,CAAC;AAE9F,OAAO,EAAE,cAAc,EAA8B,MAAM,+BAA+B,CAAC;AAE3F,OAAO,EAAE,UAAU,EAA0B,MAAM,2BAA2B,CAAC;AAE/E,6EAA6E;AAC7E,0EAA0E;AAC1E,qDAAqD;AACrD,OAAO,EACL,eAAe,GAGhB,MAAM,gCAAgC,CAAC;AAExC,4EAA4E;AAC5E,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,WAAW,EACX,wBAAwB,GA4BzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,GAIZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/injection-engine/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,+DAA+D;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEpD,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EACL,2BAA2B,GAE5B,MAAM,kCAAkC,CAAC;AAE1C,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAiC,MAAM,kCAAkC,CAAC;AACpG,OAAO,EACL,mBAAmB,EACnB,+BAA+B,GAEhC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,WAAW,EACX,kBAAkB,GAKnB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAE9E,8EAA8E;AAC9E,+EAA+E;AAC/E,6DAA6D;AAC7D,OAAO,EAAE,aAAa,EAA6B,MAAM,oBAAoB,CAAC;AAE9E,wEAAwE;AACxE,sEAAsE;AACtE,iEAAiE;AACjE,+BAA+B;AAC/B,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAsB,MAAM,iBAAiB,CAAC;AAE9F,OAAO,EAAE,cAAc,EAA8B,MAAM,+BAA+B,CAAC;AAE3F,OAAO,EAAE,UAAU,EAA0B,MAAM,2BAA2B,CAAC;AAE/E,6EAA6E;AAC7E,0EAA0E;AAC1E,qDAAqD;AACrD,OAAO,EACL,eAAe,GAGhB,MAAM,gCAAgC,CAAC;AAExC,4EAA4E;AAC5E,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,WAAW;AACX,mFAAmF;AACnF,qFAAqF;AACrF,uFAAuF;AACvF,6BAA6B;AAC7B,aAAa,EACb,wBAAwB,GA6BzB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,aAAa,EACb,eAAe,EACf,WAAW,GAIZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GAEf,MAAM,oBAAoB,CAAC"}

package/dist/esm/lib/injection-engine/skillContract.d.ts

@@ -16,6 +16,27 @@ import type { Injection } from './types.js';
 import type { GraphProblem } from './skillGraphCheckup.js';
 /** The tool names a skill unlocks (`inject.tools[].schema.name`). */
 export declare function skillToolNames(skill: Injection): readonly string[];
+/**
+ * Tools that are callable from EVERY skill — the agent's baseline (`.tool()` /
+ * `.tools()` registrations, an always-on `ToolProvider`). Both checks below need
+ * them, and need them differently, which is why they are a third set rather than
+ * more entries in `knownToolNames` (8.7.0):
+ *
+ *   • `body-unknown-tool` must treat them as KNOWN — `lookup_order(id)` in a body is
+ *     not a typo when the agent really registers `lookup_order`;
+ *   • `body-foreign-tool` must EXCLUDE them — that check means "a tool that belongs
+ *     to another skill and is therefore not callable here", and a baseline tool is
+ *     callable here. Folding them into `knownToolNames` alone would have swapped one
+ *     false warning for another.
+ */
+export interface SkillContractOptions {
+    /**
+     * Tool names the agent exposes to every skill (`.tool()`, `.tools()`, a baseline
+     * provider). Pass `agent`-level names when checking a graph whose skills rely on
+     * them: `graph.checkup({ knownTools: ['lookup_order'] })`.
+     */
+    readonly knownTools?: readonly string[];
+}
 /**
  * Check ONE skill's body against its tool contract. Pure + side-effect-free.
  *
@@ -23,7 +44,9 @@ export declare function skillToolNames(skill: Injection): readonly string[];
  * @param knownToolNames  every tool name reachable in the wider graph/agent (lets
  *                        the check tell a cross-skill HANDOFF from a typo). Omit to
  *                        check a skill in isolation (only its own tools are "known").
+ * @param options         `knownTools` — baseline tools callable from every skill.
+ *                        See {@link SkillContractOptions}.
  */
-export declare function checkSkillContract(skill: Injection, knownToolNames?: ReadonlySet<string>): GraphProblem[];
+export declare function checkSkillContract(skill: Injection, knownToolNames?: ReadonlySet<string>, options?: SkillContractOptions): GraphProblem[];
 /** Run the contract check across many skills with a shared known-tool set. Pure. */
-export declare function checkSkillContracts(skills: readonly Injection[]): GraphProblem[];
+export declare function checkSkillContracts(skills: readonly Injection[], options?: SkillContractOptions): GraphProblem[];

package/dist/esm/lib/injection-engine/skillContract.js

@@ -30,12 +30,15 @@ export function skillToolNames(skill) {
  * @param knownToolNames  every tool name reachable in the wider graph/agent (lets
  *                        the check tell a cross-skill HANDOFF from a typo). Omit to
  *                        check a skill in isolation (only its own tools are "known").
+ * @param options         `knownTools` — baseline tools callable from every skill.
+ *                        See {@link SkillContractOptions}.
  */
-export function checkSkillContract(skill, knownToolNames) {
+export function checkSkillContract(skill, knownToolNames, options = {}) {
     const id = skill.id;
     const body = skill.inject?.systemPrompt ?? '';
     if (body.length === 0)
         return [];
+    const baseline = new Set(options.knownTools ?? []);
     const own = new Set(skillToolNames(skill));
     const known = knownToolNames ?? own;
     const problems = [];
@@ -46,6 +49,8 @@ export function checkSkillContract(skill, knownToolNames) {
     for (const name of known) {
         if (own.has(name))
             continue;
+        if (baseline.has(name))
+            continue; // callable from every skill — not foreign
         if (new RegExp(`\\b${escapeRegExp(name)}\\b`).test(body)) {
             problems.push({
                 kind: 'warning',
@@ -63,7 +68,7 @@ export function checkSkillContract(skill, knownToolNames) {
     const seen = new Set();
     for (const m of body.matchAll(TOOL_CALL_RE)) {
         const name = m[1];
-        if (seen.has(name) || own.has(name) || known.has(name))
+        if (seen.has(name) || own.has(name) || known.has(name) || baseline.has(name))
             continue;
         seen.add(name);
         problems.push({
@@ -78,11 +83,13 @@ export function checkSkillContract(skill, knownToolNames) {
     return problems;
 }
 /** Run the contract check across many skills with a shared known-tool set. Pure. */
-export function checkSkillContracts(skills) {
+export function checkSkillContracts(skills, options = {}) {
     const known = new Set();
     for (const s of skills)
         for (const n of skillToolNames(s))
             known.add(n);
-    return skills.flatMap((s) => checkSkillContract(s, known));
+    for (const n of options.knownTools ?? [])
+        known.add(n);
+    return skills.flatMap((s) => checkSkillContract(s, known, options));
 }
 //# sourceMappingURL=skillContract.js.map

package/dist/esm/lib/injection-engine/skillContract.js.map

@@ -1 +1 @@
-{"version":3,"file":"skillContract.js","sourceRoot":"","sources":["../../../../src/lib/injection-engine/skillContract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,wFAAwF;AACxF,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,KAAK,GAAI,KAA0E,CAAC,MAAM;QAC9F,EAAE,KAAK,CAAC;IACV,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAgB,EAChB,cAAoC;IAEpC,MAAM,EAAE,GAAI,KAAwB,CAAC,EAAE,CAAC;IACxC,MAAM,IAAI,GAAI,KAAgD,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,cAAc,IAAI,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,iFAAiF;IACjF,mFAAmF;IACnF,iFAAiF;IACjF,8EAA8E;IAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5B,IAAI,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,UAAU,EAAE,yBAAyB,IAAI,iCAAiC;oBAC1E,qFAAqF;oBACrF,gFAAgF;gBAClF,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,qFAAqF;IACrF,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACjE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,UAAU,EAAE,sBAAsB,IAAI,4BAA4B,IAAI,WAAW;gBACjF,oFAAoF;gBACpF,2CAA2C;YAC7C,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,MAA4B;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"skillContract.js","sourceRoot":"","sources":["../../../../src/lib/injection-engine/skillContract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,wFAAwF;AACxF,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAE/D,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,MAAM,KAAK,GAAI,KAA0E,CAAC,MAAM;QAC9F,EAAE,KAAK,CAAC;IACV,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAwBD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAgB,EAChB,cAAoC,EACpC,UAAgC,EAAE;IAElC,MAAM,EAAE,GAAI,KAAwB,CAAC,EAAE,CAAC;IACxC,MAAM,IAAI,GAAI,KAAgD,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC;IAC1F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,cAAc,IAAI,GAAG,CAAC;IACpC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,iFAAiF;IACjF,mFAAmF;IACnF,iFAAiF;IACjF,8EAA8E;IAC9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5B,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,0CAA0C;QAC5E,IAAI,IAAI,MAAM,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EACL,UAAU,EAAE,yBAAyB,IAAI,iCAAiC;oBAC1E,qFAAqF;oBACrF,gFAAgF;gBAClF,KAAK,EAAE,EAAE;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,qFAAqF;IACrF,yEAAyE;IACzE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACvF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,mBAAmB;YACzB,OAAO,EACL,UAAU,EAAE,sBAAsB,IAAI,4BAA4B,IAAI,WAAW;gBACjF,oFAAoF;gBACpF,2CAA2C;YAC7C,KAAK,EAAE,EAAE;SACV,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CACjC,MAA4B,EAC5B,UAAgC,EAAE;IAElC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC"}