agentfootprint 9.73.0 → 9.75.0

package/AGENTS.md

@@ -524,7 +524,7 @@ files `agentfootprint.tools.coverage_declared`; with
 to the final answer, which is how a limit survives a model that would rather not
 mention it.
 
-### Observability — 108 typed events across 24 domains
+### Observability — 109 typed events across 24 domains
 
 ```typescript
 agent.on('agentfootprint.context.injected', (e) =>

package/CHANGELOG.md

@@ -7,6 +7,207 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.75.0] - 2026-08-28
+
+### Added
+
+- **Grounded numbers: the staged-refs nudge, and a revise correction that
+  names the route.** The field failure this closes, from a consumer's recorded
+  run: four tool results carried real numbers, a compute tool that could sum
+  them was registered — with `wants` declared over the staged dataset kind —
+  and the app's prompt said to use it. The model summed the numbers in its
+  head anyway and stated the total; the evidence gate recorded *"appears in no
+  tool result"* and the answer shipped, because the posture only observed. The
+  app patched it with more prose. The library-shaped fix is two mechanisms it
+  already owns, on the one dial it already has:
+
+  **`nudge: true` on `.namesAndNumbersFromEvidence()`** — when an iteration's
+  context holds a tool result staged by reference (an `artifacts.placement`
+  ticket) AND a tool the model can currently call declares `wants` over that
+  ticket's kind, ONE short line is appended at the very END of that request,
+  naming the refs and the spender tool by its registered name: derived numbers
+  come from the tool, not from mental arithmetic. Composed entirely from
+  declarations (`Tool.resultKind`, `Tool.wants`, matched by the exact-string
+  law dispatch uses — never by tool name); no prose surface for apps. The
+  placement is the point: the measured failure was recency — the app's own
+  instruction sat at the top of a long context and the numbers at the bottom,
+  so this one sits beside the data. Request-only (never history, so it never
+  enters the gate's exempt corpus), recomposed per iteration so it exists
+  exactly while both conditions hold, judged against the tools REALLY served
+  this call (the wrap-up's withheld surface arms nothing). Each firing lands
+  as `agentfootprint.agent.grounding_nudged` (event 109) with refs and tools
+  as data — the line's one record, since the line itself is not conversation.
+
+  ```ts
+  const agent = Agent.create({ provider, model, artifacts: { store, placement } })
+    .tool(exportRows) // resultKind: 'dataset/rows' — staged over the threshold
+    .tool(compute) //    wants: { dataset: 'dataset/rows' } — the declared spender
+    .namesAndNumbersFromEvidence({ posture: 'guard', nudge: true })
+    .build();
+  ```
+
+  **The guarantee stays the postures the gate has had since 9.35.0** — the
+  existing value extraction is THE detector, unchanged: `'assist'` records,
+  `'guard'` allows the one bounded revision then delivers with both attempts
+  on the record, `'rails'` refuses with `UnsupportedValuesError`. What the
+  revision gains: when the flagged turn holds staged refs a served `wants`
+  tool can spend, the correction now names them — *"pass 'art_…'
+  (dataset/rows) to `compute` — compute the number there and answer with what
+  it returns"* — inside the authored frame, so the quoted values still come
+  last and the exempt-corpus fence is untouched. The `revision-asked`
+  `evidence_checked` event carries the same facts additively (`stagedRefs`,
+  `spenderTools`). Absent everything — no gate, `nudge` unset, or no
+  `wants`-declaring tool — every request, record and correction keeps its
+  exact bytes, pinned by test.
+
+### Changed
+
+- **A `guard`/`rails` agent that also registers a `wants`-declaring tool will
+  see its evidence correction gain the refs clause above when staged refs are
+  in context.** That is the fix, not a side effect: a correction that says
+  "call the tool that provides it" without naming WHICH tool over WHICH ref
+  leaves the model to head-math again. Agents without a `wants` tool — or
+  without staged refs in the flagged turn — keep the exact 9.35.0 sentence.
+
+## [9.74.0] - 2026-08-27
+
+### Added
+
+- **The Azure/Foundry column exists — keyless auth and both Microsoft inference
+  doors, cloud and on-device.** AWS and GCP each had a full adapter column;
+  Azure had a static api-key string and nothing else. This release fills the
+  auth + inference tier, and every piece is a vendor adapter over ports that
+  did not change — the same seams the AWS and GCP columns already use.
+
+  **`foundry()` — the project-endpoint provider** (`agentfootprint/providers`).
+  The JS answer to Microsoft's `FoundryChatClient(project_endpoint, model,
+  credential)`: point it at a Foundry project endpoint (or let the hosted
+  platform's auto-injected `FOUNDRY_PROJECT_ENDPOINT` supply it), name the
+  deployment (`AZURE_AI_MODEL_DEPLOYMENT_NAME ?? MODEL_NAME`), and auth is an
+  Entra `TokenCredential`, an api key, or — given neither — the platform's own
+  blessed default, `DefaultAzureCredential` from the optional `@azure/identity`
+  peer. Inference rides the GA api-version-free `/openai/v1` route derived from
+  the project endpoint; the deployment name travels as the `model` field; the
+  token scope is `https://ai.azure.com/.default` (the management audience is a
+  different token — the docs say so out loud). Rotating tokens reuse the
+  per-request key-callback seam `openai()` has had since 9.29.0: the client is
+  rebuilt only when the token string actually changes.
+
+  ```ts
+  import { foundry } from 'agentfootprint/providers';
+  // In a Foundry hosted container: zero config — endpoint injected, identity ambient.
+  const llm = foundry();
+  // Locally: az login, then name the project.
+  const local = foundry({
+    projectEndpoint: 'https://acct.services.ai.azure.com/api/projects/my-project',
+    deployment: 'gpt-4.1-mini',
+  });
+  ```
+
+  **`foundryLocal()` — the on-device door.** Fetch-only, zero dependencies, the
+  `ollama()` discipline applied to Foundry Local's OpenAI-compatible `/v1`
+  wire: an alias like `qwen2.5-0.5b` resolves to a concrete variant through the
+  service's own catalog (`GET /foundry/list`, priority order, first wins;
+  cached per provider), a full variant id skips the catalog entirely, and the
+  typed `FoundryLocalUnavailableError` tells the truth a local runtime needs
+  telling — `foundry server start` to start it, `foundry server status` to find
+  the dynamic port, `foundry model run <alias>` when the model is the missing
+  piece, with the machine's actual model list attached when the service could
+  answer. No API key is sent because none exists. Streamed usage is read off
+  the final empty-choices frame — the exact bug class 9.73.0 fixed, pinned here
+  from day one.
+
+  **`entraIdentity()` — Azure credentials for tools**
+  (`agentfootprint/security`). The `googleIdentity` anatomy, law for law:
+  vends the deployment's identity as a bearer via any `TokenCredential`
+  (default: `DefaultAzureCredential`'s chain — env service principal, workload
+  identity, managed identity, VS Code, az CLI), scopes the request's way or
+  `AZURE_AI_SCOPE` by default, refuses `mode: 'user'` and per-request user
+  tokens BY NAME until an OBO surface exists, refuses services outside the
+  allowlist, and never lets an SDK's failure text — which echoes request
+  detail — reach a thrown message. `AZURE_AI_SCOPE` and
+  `AZURE_MANAGEMENT_SCOPE` are both exported because the audiences are not
+  interchangeable, and pretending there is one "azure scope" would be a lie
+  that 401s at runtime.
+
+  **`azureOpenai({ credential })` — the existing Azure door goes keyless.** An
+  Entra credential now rides the SDK's `azureADTokenProvider`; the static
+  api-key path is byte-identical to before; both given at once is refused by
+  name as the config bug it is. The docs' old caveat — "azureOpenai is the
+  wrong door for bearer auth" — is retired. Each keyless door defaults to the
+  audience ITS route documents: this one asks for
+  `https://cognitiveservices.azure.com/.default` (the classic deployment-scoped
+  route's own documented audience, `AZURE_COGNITIVE_SERVICES_SCOPE`), while
+  `foundry()` asks for `https://ai.azure.com/.default` (`AZURE_AI_SCOPE`, the
+  v1/project route's) — both overridable via `scope`, both pinned on the wire
+  by tests that record what the credential was actually asked for.
+
+  **`openai({ legacyEndpoint })` — the dialect dial goes public.** `baseURL`
+  has always implied the legacy dialect (`max_tokens`, no `stream_options`)
+  because most OpenAI-compatible servers are behind; `legacyEndpoint: false`
+  now declares "this baseURL speaks the current dialect" — which is exactly
+  what the Azure v1 route is. Default unchanged: `!!baseURL`.
+
+  **`providerFromEnv` learns both doors — upgrade-safely.** `FOUNDRY_LOCAL_MODEL`
+  slots directly after `OLLAMA_MODEL` (a model name you typed for a local
+  runtime — the same name-beats-leftover-credential law), and
+  `FOUNDRY_PROJECT_ENDPOINT` + `AZURE_AI_MODEL_DEPLOYMENT_NAME` — a pair of
+  product-specific spellings nobody exports by accident — outranks the
+  lingering-credential arms. Two guards keep an upgrade from breaking a
+  working environment, because the hosted platform auto-injects the endpoint
+  into every container, Foundry-bound or not: an endpoint with **no**
+  deployment named HOLDS its refusal (every arm below answers exactly as it
+  did before this arm existed, and the held refusal is raised only when
+  nothing else resolves), and the generic `MODEL_NAME` alone never carries the
+  endpoint past a bootable Azure config — choosing Foundry over working Azure
+  takes the deliberate spelling. Every existing precedence is pinned
+  untouched; each guard has its own test.
+
+  New from `agentfootprint/providers`: `foundry`, `foundryInferenceUrl`,
+  `FoundryProviderOptions`, `foundryLocal`, `FoundryLocalProvider`,
+  `FoundryLocalUnavailableError`, `FoundryLocalProviderOptions`,
+  `TokenCredentialLike`, `AccessTokenLike`. New from `agentfootprint/security`:
+  `entraIdentity`, `AZURE_AI_SCOPE`, `AZURE_MANAGEMENT_SCOPE`,
+  `AZURE_COGNITIVE_SERVICES_SCOPE`, `EntraIdentityOptions`,
+  `TokenCredentialLike`, `AccessTokenLike`, `AzureIdentitySdkModule`. New
+  optional peer: `@azure/identity`. Pinned by 178 new test cases (counted in
+  the diff, not the runner) across
+  `test/adapters/identity/entra-identity.test.ts`,
+  `test/adapters/unit/FoundryProvider.test.ts`,
+  `test/adapters/unit/FoundryLocalProvider.test.ts`,
+  `test/adapters/integration/foundry-wire.test.ts` (a real `openai` SDK against
+  a local fake of the `/openai/v1` wire — Bearer header, `max_completion_tokens`,
+  token rotation, and the audience each door asks its credential for, all
+  asserted on the wire, not assumed), the extended Azure env/wire suites, and
+  the fix pins from the adversarial review below. Deliberately NOT in this train: the App Insights sink,
+  Azure AI Search, the Toolbox MCP transport (next trains), and every
+  preview-only surface (A2A door, browser/computer-use, managed memory) —
+  refusing to ship against previews we cannot verify is a feature.
+
+  The whole train was adversarially reviewed before release (five lenses, every
+  serious finding independently re-verified with a reproduction): 1 blocker and
+  9 should-fix findings were confirmed and every one is fixed and pinned in
+  this release — including a mid-stream failure frame that `foundryLocal()`
+  would have reported as a clean stop, an abort signal that never reached a
+  streaming body, and an env-detection arm that would have broken working
+  deployments on upgrade.
+
+### Fixed
+
+- **`ollama()` inherited four stream/abort defects — found by reviewing the new
+  Foundry Local adapter, fixed at the root.** The adversarial review of
+  `foundryLocal()` proved its four streaming defects were byte-twin shapes
+  copied from `OllamaProvider`, which had shipped them for months: a caller's
+  already-aborted `AbortSignal` still sent the request; an abort after headers
+  never reached the streaming body (generation ran on, un-stoppable); an early
+  `break` leaked the response body (the reader was never cancelled); and a
+  mid-stream `{"error": …}` frame was silently dropped, reporting a failed
+  generation as a clean stop. All four now match the fixed Foundry Local
+  shapes — same helper names, Ollama's NDJSON wire. 10 of the 12 new pinning
+  tests fail against the previous source (proven by restoring it); no public
+  API change; `OllamaUnavailableError` is byte-identical.
+
+
 ## [9.73.0] - 2026-08-27
 
 ### Fixed

package/CLAUDE.md

@@ -47,6 +47,7 @@ not in this table, search `src/index.ts` for the nearest noun before writing cod
 | a value that must say how it knows itself — an unknown count that can never render as zero | `Claim<T>` (`known`/`unknown`/`notApplicable`) | `src/lib/claim/claim.ts` | 9.58.0 |
 | asking a debugging model "what did this run contradict itself about, and why?" — the Context Integrity findings, joined to the step that filed them | `find_context_errors` | `src/lib/trace-toolpack/traceToolpack.ts` | 9.61.0 |
 | counting a HUMAN-VERIFIED value as ground for the choice-seam check — the person clicked a row, the app verified the cells against the artifact, and the id the model takes from that selection is not fabricated; the source label travels onto the record | `externalGrounds` + `ExternalGround` + `external_ground_used` | `src/integrity/unsupported-argument/check.ts` | 9.72.0 |
+| a model head-mathing a total from tool-result numbers while a compute tool sits unused on the wire — a LATE line each iteration naming the staged refs and the `wants` tool that spends them (recency working FOR the instruction), plus the revise correction naming the same route | `nudge: true` + `stagedRefsNudgeLine` + `findStagedRefs` + `grounding_nudged` | `src/core/agent/stagedRefs.ts` | 9.75.0 |
 | a tool answering "I looked and found nothing", routably | `absent` | `src/core/agent/coverage/absent.ts` | 9.43.0 |
 | stating what a clean answer does NOT rule out | `coverage` | `src/core/agent/coverage/ledger.ts` | 9.43.0 |
 | minting one of those shapes from a tool that is NOT JavaScript — the canonical note sentences and reserved marker keys as DATA, so a Python/Go/Rust sidecar reads a file instead of regex-scraping `dist/esm` (which a consumer really did) | `canonical-notes.json` at the package root + the `./canonical-notes.json` exports entry, GENERATED from the built barrel by `scripts/gen-canonical-notes.mjs` | `scripts/gen-canonical-notes.mjs` | 9.70.0 |
@@ -133,7 +134,7 @@ Traps: `src/observability/` holds the finder IMPLEMENTATIONS (canonical home; `d
 - **Recordings as artifacts (9.26.0)**: `artifacts: { store, recordings: true | { label } }`. `Agent.startRunRecording()` calls the SAME `recordRun` (before `createExecutor` — `attach()` collects for the executor not yet built); `fileRunRecording` mints AFTER `finalizeResult`, awaited, every failure contained to `artifacts.refused`. Pure half in artifacts/recordingArtifact.ts; payload is the recording's JSON TEXT (a live snapshot handed to an in-process store would be a live view into a finished run). No new wire op — `artifact-get` serves it.
 - **Code staging-in (9.26.0)**: `CodeSession.stageInputs?(inputs) → StagedCodeInput[]` — OPTIONAL, feature-detected via `canStageCodeInputs`, and its contract is TWO promises: the payloads are readable at the returned paths, AND every later `execute` exposes the manifest as `STAGED_INPUTS_ENV` (`AF_STAGED_INPUTS`, `name → path`). `CodeInput.name` is the MANIFEST KEY (the wants arg name, so a static description can name it) and `fileName` is the on-disk name — separate fields so the two cannot drift. `codeRunnerTool({ wants })` composes the schema properties + the description clause and refuses BY NAME on a non-staging runner. Implemented by localCodeRunner only.
 - **Repeated-call nudge (9.26.0)**: `core/agent/repeatedCall.ts` (pure `noteRepeatedCall` + `repeatedCallLedgers()`) + the ONE batch-loop hook in toolCalls. Fingerprints (FNV-1a) of stable-stringified args and the tool's OWN delivered result — never values. **The counters are NOT tracked state**: they live in a bounded run-keyed map held by `buildToolCallsHandler` and keyed by `deps.currentRun().runId`, so a turn that repeats nothing is byte-identical in state, commit log, narrative and recordings (a scope key would have changed all four for every agent that merely upgraded); the repeat itself rides `agentfootprint.tools.repeated_call`, the emit channel per-attempt facts belong on. A resume mints a new runId ⇒ counting restarts. Fires at the SECOND identical landing, once. `AgentOptions.repeatedCallNudge: false` disables (threaded value-conditionally; ON is the default). Deliberately NOT applied on the pause-resume dispatch paths.
-- **Evidence gate (9.35.0)** — `.namesAndNumbersFromEvidence({ posture, shapes, exempt, minDigits })`: every name/number in the final answer must appear in a `role:'tool'` result. Postures reuse the routing VOCABULARY (`assist`|`guard`|`rails`) as a SEPARATE option — routing authority ≠ evidence discipline, and overloading `skillGraphCascade.strictness` would deny "strict routing, loose evidence". Wiring is the stepNudge blast radius verbatim: `ResolvedEvidenceGate` (builder-resolved, refusals at the CALL SITE) → Agent ctor trailing param → `buildRouteDeciderStage`'s 4th arg (`judgeEvidence` runs LAST of the three judges — schema > steps > evidence — and NOT on a denied or schema-exhausted answer) → `evidenceRecheckStage` branch (`{loopTo}`, mounted only for a revising posture) → `STAGE_IDS.EVIDENCE_RECHECK` + BOUNDARY_LOCAL_IDS + milestoneFor. TWO deps flags, and the second is the one a reader misses: `evidenceRecheckStage` (branch) AND `hasEvidenceGate` (bubbles `systemPromptInjections` out of sf-llm-call in the GROUPED chart — without it the gate flags the app's own prompt). Per-check facts ride `agentfootprint.agent.evidence_checked` (emit channel); only the terminal verdict is committed (`unsupportedValues`), because the boundary raises off it. `UnsupportedValuesError` joins the TERMINAL-typed-error list in `run()`'s catch (a verdict is not a crash — no retry handle for a wall).
+- **Evidence gate (9.35.0)** — `.namesAndNumbersFromEvidence({ posture, shapes, exempt, minDigits })`: every name/number in the final answer must appear in a `role:'tool'` result. Postures reuse the routing VOCABULARY (`assist`|`guard`|`rails`) as a SEPARATE option — routing authority ≠ evidence discipline, and overloading `skillGraphCascade.strictness` would deny "strict routing, loose evidence". Wiring is the stepNudge blast radius verbatim: `ResolvedEvidenceGate` (builder-resolved, refusals at the CALL SITE) → Agent ctor trailing param → `buildRouteDeciderStage`'s 4th arg (`judgeEvidence` runs LAST of the three judges — schema > steps > evidence — and NOT on a denied or schema-exhausted answer) → `evidenceRecheckStage` branch (`{loopTo}`, mounted only for a revising posture) → `STAGE_IDS.EVIDENCE_RECHECK` + BOUNDARY_LOCAL_IDS + milestoneFor. TWO deps flags, and the second is the one a reader misses: `evidenceRecheckStage` (branch) AND `hasEvidenceGate` (bubbles `systemPromptInjections` out of sf-llm-call in the GROUPED chart — without it the gate flags the app's own prompt). Per-check facts ride `agentfootprint.agent.evidence_checked` (emit channel); only the terminal verdict is committed (`unsupportedValues`), because the boundary raises off it. `UnsupportedValuesError` joins the TERMINAL-typed-error list in `run()`'s catch (a verdict is not a crash — no retry handle for a wall). **Grounded numbers (9.75.0)** rides the SAME dial: `nudge: true` arms the staged-refs nudge — `toolWantsOf` harvests `Tool.wants` beside the `toolGrounding` harvest in `Agent.buildChart` (same ToolProvider blindness), callLLM appends ONE request-only late line when a placed ticket's kind matches a SERVED `wants` tool (judged on `registeredToolSchemas`, so wrap-up's withheld surface arms nothing; history untouched ⇒ never in the exempt corpus), recorded as `agent.grounding_nudged`; and the recheck correction names the same refs+spender via `buildEvidenceCorrection`'s third arg — threaded whenever a `wants` tool exists, NOT gated on `nudge`, clause INSIDE the authored frame so `isLibraryAuthoredTurn`'s prefix match and values-last both hold.
 - **Coverage primitives (this release)** — `absent()` / `coverage()`, both copied from FIELD USE. THE argument is the direction of the error: a *nothing-found* misread as an *outage* costs an investigation, an *outage* misread as *nothing-found* declares a system healthy that was never checked — so the two must not share a shape. Blast radius, and it is the `resultCeiling` radius verbatim: `readCoverageResult` called by `declareCoverage` at BOTH execute boundaries in toolCalls.ts (batch loop + `resolveCredentialAndExecute`), on the UNWRAPPED content and BEFORE the ceiling. FOUR downstream changes and no more: (1) `ToolResultStatus` gained a SEVENTH word `'absent'` — routable by `onToolStatus`, because folding it into `'failure'` is the confusion itself and into `'success'` leaves nothing to route on; (2) two events (`tools.absent`, `tools.coverage_declared`); (3) tracked `AgentState.coverageDeclared` — a limit is a fact about the ANSWER, not about an attempt, which is why it is state and the repeated-call counters are not; (4) the evidence corpus indexes an absence's COVERAGE ONLY (`coverage/evidence.ts` — a failed lookup is the cheapest laundering machine, and `absent()` would have made it cheaper: this is frames.ts's argument on the tool side). Deliberately UNCHANGED: no `error: true`, no retry, no refusal, no gate flag. Survival into the answer is `.limitsTravelWithTheAnswer()` → `attachCoverageLimits` dep → BOTH builders swap the final branch's first stage for `prepareFinalWithLimitsStage` (same id, same position). It APPENDS rather than judges: a check for "did the model state its limits?" needs a second model to decide what counts, which is what evidence/README.md forbids.
 - **Out-of-budget wrap-up (9.56.0)** — `wrapUpAtMaxIterations` (AgentOptions, default ON, `repeatedCallNudge`'s opt-out grammar): the FOURTH Route branch, and the SchemaRetry mechanism verbatim — `STAGE_IDS.WRAP_UP` + same `{loopTo}`, so the last call is one ordinary turn with its own `iteration_start`/`llm_start`/`cost.tick`. Two things are its own: (1) the tools are WITHHELD at REQUEST ASSEMBLY in callLLM (`scope.wrapUpAsked`, the `schemaTool` seam's mirror — the schema tool still rides, so an output contract survives), which is what makes the call terminal BY CONSTRUCTION rather than by a rule, and is why it is exempt from `maxIterations`; (2) the CONDITIONAL MOUNT is on the agent having a TOOL SURFACE (`registryByName.size > 0 || externalToolProvider`) — a limit only cuts a turn short when tool calls were pending, so a toolless agent's chart must not grow a box that can never run. `decideBranch` treats a spent wrap-up as cut-short for every downstream judge (`toolCalls.length > 0 || scope.wrapUpAsked`), or a step nudge / evidence revision would loop past the limit that fired. `wrapUpAsked` is deliberately NOT seeded — a turn that finishes inside its budget commits the exact key set it always did. The record is FOUR channels: `stoppedEarly` (now with `wrappedUp`, corrected on the pass after so `answerWasEmpty` describes the answer the caller GOT), `cost.limit_hit` (unchanged), the new `agent.budget_exhausted {action: 'wrapped-up'|'cut-short'}`, and an optional `turn_end.stoppedEarly` projection.
 - **Closed seams**: Agent chart internals (AgentChartDeps not exported — extend via injections/tools/memory/thinking, never by adding a ReAct stage); ContextSlot (3 slots fixed); ProviderKind factory; dormant ports with no consumer (ContextSourceAdapter, EmbeddingProvider, RiskDetector — adapters/types.ts only); reserved tool names under selfExplain — 8.16.0 made the list DERIVED: `TRACE_TOOL_NAMES` (traceToolpack.ts, 11 names since 9.61.0: run_overview/find_context_errors/find_in_trace/trace_node/trace_slice/backtrack/who_wrote/get_value/inspect_tool_call/inspect_tool_run/read_narrative) is what AgentBuilder.ts:~1560 reserves in inline mode (`explain_run` in delegate mode), so a NEW toolpack tool joins ONE list and the reservation follows — but it must ALSO join the lazy template's mounted set (lazyToolpack builds over `{narrative: [], events: []}` so the catalog shape is fixed at build time) and the count assertion in test/lib/trace-toolpack/selfExplainAgent.test.ts. **8.17.0 `inspect_tool_run`** is the descent THROUGH the tool boundary: `flowchartAsTool({ keepRecord: true })` files each invocation's record in a bounded LRU store (lib/trace-toolpack/innerRunRecords.ts) keyed by the executing `ctx.toolCallId`, riding the `Tool` under the `INNER_RUN_RECORDS` registry symbol; `AgentBuilder.build()` → `collectInnerRuns(registry, injections)` → `SelfExplainSource.getInnerRuns` → `TraceToolpackArtifacts.innerRuns`. The inner views are the pack ITSELF re-run over `openRecording(record.recording)` — do not add a second query implementation. Provider-delivered tools are NOT collected (no build-time list); inner runtimeStageIds are a SEPARATE namespace and only `inspect_tool_run` accepts them. **9.61.0 `find_context_errors`** is the Context Integrity read-out: it reads `agentfootprint.integrity.context_error` + `…disposition` off the artifacts' EVENT TAIL (never re-running a check), joins each finding to the step it was filed at, and mounts UNCONDITIONALLY — a tool that vanished with the tail could not say the evidence channel is ABSENT, which is the one sentence this family forbids collapsing into "no errors found".
@@ -145,7 +146,7 @@ Traps: `src/observability/` holds the finder IMPLEMENTATIONS (canonical home; `d
 - **Embedder fingerprint** (8.9.0) → `Embedder.id` (optional; every shipped embedder sets one, and NONE include dims — the store appends `@<dims>` itself, so an id carrying its own size double-stamps) + `indexDocuments` defaulting `embedderId` to it + `SqliteVectorStore.reconcileFingerprint` (the only comparison site). Rule: dimensions ALWAYS decide, model ids decide only when BOTH sides named themselves — refusing on an absent name would block the majority of callers who never pass `embedderId`.
 - **Retrieval record** (8.8.0) → FOUR stages write one object in sequence: `loadRelevant` (candidates+scores+threshold verdicts) → `pickByBudget` (re-marks admitted→over-budget/over-max-entries) → `formatDefault` (`promptFragment` + `promptPosition`) → the read mount's outputMapper lifts it to root as `retrievalEvidence_<id>`. `memoryRecallInjections` then splits ONE recall into one ActiveInjection PER CHUNK — guarded by a byte-equality check (`fragments.join('\n\n') === systemContent`) that falls back to the single injection rather than change the prompt. `rank` (score order) and `promptPosition` (picker order) are DIFFERENT and both load-bearing: joining fragments in rank order reproduces the right bytes in a sequence the model never saw.
 - **AgentState** → all 8 stages/ files, both builders' mappers, memory-wire STRING-TYPED keys ('runIdentity'/'turnNumber'/… buildAgentChart.ts:177-180 — not refactor-safe), finalizeResult's `reliabilityFail*`/`policyHalt*` reads (rename silently kills the typed errors).
-- **events/** → 108 typed events across 24 domains (counts anti-drift-tested against this file — update BOTH when adding events): ALL_EVENT_TYPES exhaustiveness tests, DomainWildcard hand-list, ~42 importers (recorders, strategies, stream, commentary).
+- **events/** → 109 typed events across 24 domains (counts anti-drift-tested against this file — update BOTH when adding events): ALL_EVENT_TYPES exhaustiveness tests, DomainWildcard hand-list, ~42 importers (recorders, strategies, stream, commentary).
 - **Run-configuration manifest (9.41.0)** → `agentfootprint.agent.run_configured`, the JOIN KEY that turns N runs into N labelled ARMS: one event naming the adapters/strategies in play (provider+model, reactMode, each memory's declared strategy/retrieval/embedder, window, graph posture+classifier, evidence posture, artifacts-present). Composed by the PURE `core/agent/runManifest.ts`, dispatched from `Agent.emitRunManifest()` at the END of `createExecutor` — the ONE funnel `run()` AND `resume()` share, both of which mint a fresh runId. Direct `dispatcher.dispatch` with a STATED pseudo-stage (`run-configured#0`), the `emitToolSessionReport` precedent — there is no stage yet, and `minimalMeta()` would make the one joinable-by-design event unjoinable. TWO laws, both tested: NAMES ONLY (a store is reported PRESENT and unnamed rather than identified by a directory/endpoint — `MemoryStore` and `ArtifactStore` declare no id), and ABSENT means "not configured", never a guessed `'default'`. Graph presence is read off `skillGraphNextSkill`, NOT `skillGraphCascade` (a 9.16-style mount sets no cascade and would read as "no graph"). `MemoryDefinition` gained `strategy`/`retrieval`/`embedderId` for it — declared names the compiled pipeline had closed over, the `store`-in-the-open precedent.
 - **adapters/types.ts LLMMessage/LLMRequest** → 62 importers: tool_use round-trip (toolCalls.ts:115-135), wire assembly (callLLM.ts:150-160), providers, cache strategies, security/extractSequence, reliability loop.
 - **Cache** → strategy registration is a MODULE SIDE EFFECT (src/index.ts:15-17); an entry point skipping that import silently falls back to NoOp. Resolved once per Agent at construction (Agent.ts:347).

package/ai-instructions/claude-code/SKILL.md

@@ -252,7 +252,7 @@ const agent = Agent.create({ provider, model })
 agent.on('agentfootprint.context.evaluated', (e) => console.log(e.payload.activeIds));
 ```
 
-**108 typed events across 24 domains.** Two subscription shapes and no third:
+**109 typed events across 24 domains.** Two subscription shapes and no third:
 `'*'` (every event) and `'agentfootprint.<domain>.*'` (one domain). **`'agentfootprint.*'`
 is not a pattern** — TypeScript rejects it, and at runtime it would match nothing.
 

package/dist/adapters/identity/azure.js

@@ -0,0 +1,306 @@
+"use strict";
+/**
+ * entraIdentity — the {@link CredentialProvider} port over Microsoft Entra ID
+ * (peer-dep `@azure/identity`).
+ *
+ *   import { entraIdentity } from 'agentfootprint/security';
+ *   const credentials = entraIdentity();
+ *
+ * ── What it is, and what it deliberately is not ─────────────────────────────
+ * This is the **narrow** adapter: it vends *Entra* access tokens for *Azure*
+ * APIs, from whatever credential the environment already has — the
+ * DefaultAzureCredential chain walks environment service principal, workload
+ * identity, managed identity, VS Code, Azure CLI, Azure PowerShell and the
+ * Azure Developer CLI, in that order. That is one job and it is done
+ * completely.
+ *
+ * It is **not** a user-delegation surface. Entra's on-behalf-of flow (and any
+ * 3-legged consent dance) needs a confidential client app registration that
+ * this adapter does not hold, so `mode: 'user'` is **refused by name** rather
+ * than quietly served with a machine token. A machine token returned where a
+ * user token was asked for is the exact silent downgrade the port exists to
+ * prevent: the call succeeds, the data comes back, and it was the agent's
+ * access rather than the person's. OBO is a later train; when it lands it will
+ * be its own provider, not a flag here.
+ *
+ * ── The audience split, and where it bites ──────────────────────────────────
+ * Azure tokens are minted for ONE audience. {@link AZURE_AI_SCOPE}
+ * (`https://ai.azure.com/.default`) is the data plane — every Foundry and
+ * Azure OpenAI inference call takes it. {@link AZURE_MANAGEMENT_SCOPE}
+ * (`https://management.azure.com/.default`) is the ARM control plane —
+ * listing deployments, creating resources. A token for one audience is a 401
+ * on the other, which is why BOTH are exported by name instead of leaving the
+ * caller to guess a string. The default here is the data-plane scope, because
+ * vending inference credentials is what an agent runtime does all day.
+ *
+ * ── Caching: the credential, never a token ──────────────────────────────────
+ * One `DefaultAzureCredential` is constructed for the life of the provider and
+ * every `getToken` call goes through it. MSAL — the machinery underneath
+ * `@azure/identity` — caches and proactively refreshes tokens internally, so
+ * caching a token HERE would mean owning an expiry this adapter did not
+ * compute and cannot see revoked. Unlike the Google adapter (where scopes are
+ * fixed at client construction and a different scope set needs its own
+ * client), Azure scopes travel per `getToken` call, so the ONE cached
+ * credential serves every scope set.
+ *
+ * ── Secrets ─────────────────────────────────────────────────────────────────
+ * The `sdkFailure` law, same as every other credential-touching adapter here:
+ * the library's own message never comes through, because auth libraries echo
+ * request detail into 401/403 text and a message thrown from a
+ * `CredentialProvider` reaches the LLM as a tool result AND rides
+ * `agentfootprint.credential.failed` to every sink. What comes through is the
+ * operation that failed and the error's NAME. The original is not attached as
+ * `cause` — a cause travels into every serializer that walks own properties,
+ * which would undo all of it in one `JSON.stringify`.
+ *
+ * Pattern: Adapter (GoF) + lazy peer-dep load — `@azure/identity` is required
+ * the first time `getCredential` runs, or never if you inject a credential.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entraIdentity = exports.AZURE_COGNITIVE_SERVICES_SCOPE = exports.AZURE_MANAGEMENT_SCOPE = exports.AZURE_AI_SCOPE = void 0;
+const lazyRequire_js_1 = require("../../lib/lazyRequire.js");
+const kinds_js_1 = require("../../identity/kinds.js");
+const ADAPTER = 'entraIdentity';
+/**
+ * The data-plane scope for ALL Foundry / Azure OpenAI inference
+ * (`https://ai.azure.com/.default`). This is the default scope this provider
+ * requests.
+ *
+ * The audience split matters: a token minted for this scope does NOT work on
+ * the ARM control plane, and a {@link AZURE_MANAGEMENT_SCOPE} token does not
+ * work here — Azure validates the audience on every call. Both are exported by
+ * name so nobody has to remember which string is which.
+ */
+exports.AZURE_AI_SCOPE = 'https://ai.azure.com/.default';
+/**
+ * The ARM control-plane scope (`https://management.azure.com/.default`) —
+ * listing deployments, managing resources. A DIFFERENT audience from
+ * {@link AZURE_AI_SCOPE}: a token for one is a 401 on the other, which is why
+ * both are named rather than leaving the caller to guess.
+ */
+exports.AZURE_MANAGEMENT_SCOPE = 'https://management.azure.com/.default';
+/**
+ * The CLASSIC Azure OpenAI data-plane scope
+ * (`https://cognitiveservices.azure.com/.default`) — the audience Microsoft's
+ * own keyless guidance names for the older deployment-scoped route
+ * (`{endpoint}/openai/deployments/{d}/…`), which is the route `azureOpenai()`
+ * builds and therefore its default. Current resources widely accept
+ * {@link AZURE_AI_SCOPE} too, but an older `*.openai.azure.com` resource may
+ * not — and a door should default to the audience ITS route documents, not the
+ * one its sibling uses. (Azure Government spells this
+ * `https://cognitiveservices.azure.us/.default`.)
+ */
+exports.AZURE_COGNITIVE_SERVICES_SCOPE = 'https://cognitiveservices.azure.com/.default';
+/**
+ * Vend Entra access tokens from whatever credential this environment has —
+ * the DefaultAzureCredential chain: environment service principal, workload
+ * identity, managed identity, VS Code, Azure CLI, Azure PowerShell, Azure
+ * Developer CLI. (`AZURE_TOKEN_CREDENTIALS` can restrict the chain; that is
+ * the SDK's own dial and this adapter does not second-guess it.)
+ *
+ * @throws when `mode: 'user'` is requested — no user-delegation surface is
+ *   wired for Entra yet (on-behalf-of is a later train), and a machine token
+ *   returned in its place would be a silent downgrade.
+ * @throws when `services` is configured and the request names another one.
+ *
+ * @example  A tool that calls an Azure API with the deployment's own identity
+ *   const agent = Agent.create({ provider, credentials: entraIdentity() })
+ *     .tool(defineTool({
+ *       name: 'ask_foundry',
+ *       needs: [{ credential: 'azure-ai' }],
+ *       execute: async (args, ctx) =>
+ *         fetch(url, { headers: ctx.credential!.toHeaders() }).then((r) => r.text()),
+ *     }))
+ *     .build();
+ *
+ * @example  A control-plane token, without touching the data-plane default
+ *   entraIdentity({ scopes: [AZURE_MANAGEMENT_SCOPE] });
+ */
+function entraIdentity(options = {}) {
+    const defaultScopes = options.scopes ?? [exports.AZURE_AI_SCOPE];
+    const allowed = options.services === undefined ? undefined : new Set(options.services);
+    const cache = {};
+    const resolveCredential = () => {
+        if (options._credential)
+            return options._credential;
+        // ONE credential for the life of the provider — scopes ride on getToken
+        // per call (unlike Google, where they are fixed at client construction),
+        // so no per-scope keying is needed. MSAL underneath caches and refreshes
+        // tokens on its own; we cache the CREDENTIAL, never a token.
+        if (cache.credential)
+            return cache.credential;
+        const mod = loadIdentitySdk(options._sdk);
+        if (typeof mod.DefaultAzureCredential !== 'function') {
+            throw new Error(`${ADAPTER}: \`@azure/identity\` is installed but exports no ` +
+                `\`DefaultAzureCredential\`. This adapter is built against the 4.x package — ` +
+                `update it, or pass \`_credential\`.`);
+        }
+        cache.credential = new mod.DefaultAzureCredential();
+        return cache.credential;
+    };
+    return {
+        id: options.id ?? 'entra-identity',
+        async getCredential(req) {
+            if (req.mode === 'user') {
+                throw new Error(`${ADAPTER}: a \`mode: 'user'\` request arrived for '${req.service}', and this ` +
+                    `provider cannot serve one.\n` +
+                    `  It vends the DEPLOYMENT's Entra credential (the DefaultAzureCredential ` +
+                    `chain — environment service principal, workload identity, managed identity, ` +
+                    `or a developer's \`az login\`). No user-delegation surface is wired for Entra ` +
+                    `yet — the on-behalf-of flow is a later train.\n` +
+                    `  Returning a machine token here would succeed and be wrong: the call would ` +
+                    `run with the AGENT's access rather than the person's, and nothing downstream ` +
+                    `could tell.\n` +
+                    `  Fix:  declare \`mode: 'machine'\` if the deployment's own identity is really ` +
+                    `what you want, or vend the user's token from a provider that holds one.`);
+            }
+            if (req.userToken !== undefined) {
+                // A user's signed token handed to a provider that cannot exchange it.
+                // Named rather than ignored: without a confidential client app
+                // registration there is no on-behalf-of exchange to perform, and
+                // silently dropping somebody's proof and vending machine access is
+                // the same downgrade in a quieter costume.
+                throw new Error(`${ADAPTER}: a \`userToken\` arrived for '${req.service}', but this provider has ` +
+                    `nothing to exchange it against — the on-behalf-of flow needs a confidential ` +
+                    `client app registration, and this provider vends the deployment's own Entra ` +
+                    `credential.\n` +
+                    `  Ignoring it would hand back agent-scoped access while holding the user's ` +
+                    `proof. Drop the token, or use a provider that can exchange one.`);
+            }
+            if (allowed !== undefined && !allowed.has(req.service)) {
+                throw new Error(`${ADAPTER}: this provider is configured for [${[...allowed].join(', ')}] and was ` +
+                    `asked for '${req.service}'.\n` +
+                    `  It vends ENTRA access tokens; handing one to a tool that wanted a different ` +
+                    `service's credential would fail downstream as a puzzling 401 instead of here ` +
+                    `as a wiring error.\n` +
+                    `  Fix:  add '${req.service}' to 'services', or attach a provider that serves it.`);
+            }
+            let credential;
+            try {
+                credential = resolveCredential();
+            }
+            catch (err) {
+                // A refusal this adapter authored (a missing peer dependency, a
+                // too-old SDK) is already the right diagnosis; rewriting it through
+                // sdkFailure would send the reader chasing Entra sign-in logs for a
+                // problem `npm install` fixes. Wrong diagnoses are their own kind of
+                // silently-wrong.
+                if (isOwnRefusal(err))
+                    throw err;
+                throw sdkFailure('new DefaultAzureCredential', err);
+            }
+            // A request's own non-empty scopes win over the provider's default.
+            // The array goes to getToken as-is — Azure scopes are per-call, and
+            // `.default` scopes are single-element by convention anyway.
+            const scopes = req.scopes !== undefined && req.scopes.length > 0 ? req.scopes : defaultScopes;
+            let answer;
+            try {
+                answer = await credential.getToken(scopes);
+            }
+            catch (err) {
+                throw sdkFailure('getToken', err);
+            }
+            const token = answer?.token;
+            if (typeof token !== 'string' || token.trim() === '') {
+                // The SCOPES are quoted; nothing else is. An audience URI is public,
+                // and it is the datum most often wrong here — "could not mint for the
+                // requested scope" is useless when the reader cannot see WHICH scope
+                // was requested (a tool that declares `needs` without `scopes` gets
+                // this provider's default, which it never typed anywhere). The token
+                // response's own fields stay withheld: every one of them is a secret.
+                // Same conclusion `entraBearerToken` reached out loud in
+                // src/adapters/llm/OpenAIProvider.ts — the two siblings now agree.
+                throw new Error(`${ADAPTER}: the credential resolved but vended no access token for ` +
+                    `'${req.service}' at scope${scopes.length === 1 ? '' : 's'} ` +
+                    `[${scopes.join(', ')}] — ${answer === null
+                        ? '`getToken` returned null, the SDK\'s spelling of "no token available"'
+                        : "the response's `token` field was empty"}.\n` +
+                    `  No token value is quoted here on purpose — every field of a token response is ` +
+                    `a secret. This usually means the chain found a credential source that could not ` +
+                    `actually mint for THAT audience.\n` +
+                    `  Fix:  check the audience first — inference is ${exports.AZURE_AI_SCOPE} and the ARM ` +
+                    `control plane is ${exports.AZURE_MANAGEMENT_SCOPE}; name the right one in the request's ` +
+                    `\`scopes\` or this provider's \`scopes\` option. If it is already right, sign in as ` +
+                    `an identity that can mint for it (\`az login\`, or a managed identity with the role).`);
+            }
+            // The SDK records expiry in unix MILLISECONDS; the port reports unix
+            // SECONDS. Reported when known and omitted when not — an invented
+            // expiry is worse than none, because a caller would cache against it.
+            // (`answer` cannot be null past the token guard; the optional chain is
+            // for the compiler, which does not carry the narrowing across fields.)
+            const expiryMs = answer?.expiresOnTimestamp;
+            const expiresAt = typeof expiryMs === 'number' && Number.isFinite(expiryMs) && expiryMs > 0
+                ? Math.floor(expiryMs / 1000)
+                : undefined;
+            return {
+                status: 'issued',
+                credential: (0, kinds_js_1.bearer)(token),
+                ...(expiresAt !== undefined && { expiresAt }),
+            };
+        },
+    };
+}
+exports.entraIdentity = entraIdentity;
+// ─── Internals ───────────────────────────────────────────────────────
+function loadIdentitySdk(injected) {
+    if (injected)
+        return injected;
+    try {
+        return (0, lazyRequire_js_1.lazyRequire)('@azure/identity');
+    }
+    catch {
+        throw new Error(`${ADAPTER} requires the \`@azure/identity\` peer dependency.\n` +
+            `  Install:  npm install @azure/identity\n` +
+            `  It is optional and loaded only when this provider first vends, so nothing else ` +
+            `in this library pays for it.`);
+    }
+}
+/**
+ * "There is no usable credential here" — the most common real failure, given
+ * the fix instead of the library's own text. `@azure/identity` names it
+ * `CredentialUnavailableError` (one rung) or `AggregateAuthenticationError`
+ * (the whole chain came up empty); both mean the same thing to the reader.
+ */
+function credentialsUnavailable(name) {
+    const failure = new Error(`${ADAPTER}: could not acquire an Entra token in this environment — ${name}.\n` +
+        `  The underlying message is withheld: auth libraries echo request detail into ` +
+        `failure text, and this message reaches the model as a tool result.\n` +
+        `  Every rung of the DefaultAzureCredential chain was tried: environment service ` +
+        `principal, workload identity, managed identity, VS Code, Azure CLI, Azure ` +
+        `PowerShell, Azure Developer CLI.\n` +
+        `  Fix:  run \`az login\`, or set AZURE_CLIENT_ID / AZURE_TENANT_ID / ` +
+        `AZURE_CLIENT_SECRET, or run where a managed identity exists, or pass \`_credential\`.`);
+    failure.name = 'AzureCredentialsUnavailableError';
+    return failure;
+}
+/** Re-raise without the library's text. See the module header for why. */
+function sdkFailure(operation, err) {
+    const name = errorName(err);
+    // The no-credential names get the fix, not just the diagnosis — but ONLY
+    // those names. Everything else is reported as what it is.
+    if (name === 'CredentialUnavailableError' || name === 'AggregateAuthenticationError') {
+        return credentialsUnavailable(name);
+    }
+    const failure = new Error(`${ADAPTER}: ${operation} failed — ${name}.\n` +
+        `  The underlying message is withheld: this call handles an access token, and auth ` +
+        `libraries echo request detail into failure text. Check the Entra sign-in logs for ` +
+        `the full error.`);
+    failure.name = 'AzureCredentialError';
+    return failure;
+}
+/**
+ * Did THIS adapter write this error?
+ *
+ * Every refusal authored here opens with the adapter's own name — both as the
+ * marker and because it is what makes the message readable ("entraIdentity:
+ * …", "entraIdentity requires …"). A library's own failure never does, so the
+ * prefix is a reliable discriminator without an error subclass per refusal.
+ */
+function isOwnRefusal(err) {
+    return err instanceof Error && err.message.startsWith(ADAPTER);
+}
+function errorName(err) {
+    const name = err?.name;
+    return typeof name === 'string' && name.length > 0 ? name : 'an unnamed failure';
+}
+//# sourceMappingURL=azure.js.map

package/dist/adapters/identity/azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure.js","sourceRoot":"","sources":["../../../src/adapters/identity/azure.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;;;AAEH,6DAAuD;AACvD,sDAAiD;AAOjD,MAAM,OAAO,GAAG,eAAe,CAAC;AAEhC;;;;;;;;;GASG;AACU,QAAA,cAAc,GAAG,+BAA+B,CAAC;AAE9D;;;;;GAKG;AACU,QAAA,sBAAsB,GAAG,uCAAuC,CAAC;AAE9E;;;;;;;;;;GAUG;AACU,QAAA,8BAA8B,GAAG,8CAA8C,CAAC;AA6F7F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,aAAa,CAAC,UAAgC,EAAE;IAC9D,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,sBAAc,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvF,MAAM,KAAK,GAA0B,EAAE,CAAC;IAExC,MAAM,iBAAiB,GAAG,GAAwB,EAAE;QAClD,IAAI,OAAO,CAAC,WAAW;YAAE,OAAO,OAAO,CAAC,WAAW,CAAC;QACpD,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,6DAA6D;QAC7D,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,CAAC;QAC9C,MAAM,GAAG,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,GAAG,CAAC,sBAAsB,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,oDAAoD;gBAC5D,8EAA8E;gBAC9E,qCAAqC,CACxC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,sBAAsB,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,gBAAgB;QAElC,KAAK,CAAC,aAAa,CAAC,GAAsB;YACxC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,6CAA6C,GAAG,CAAC,OAAO,cAAc;oBAC9E,8BAA8B;oBAC9B,2EAA2E;oBAC3E,8EAA8E;oBAC9E,gFAAgF;oBAChF,iDAAiD;oBACjD,8EAA8E;oBAC9E,+EAA+E;oBAC/E,eAAe;oBACf,iFAAiF;oBACjF,yEAAyE,CAC5E,CAAC;YACJ,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAChC,sEAAsE;gBACtE,+DAA+D;gBAC/D,iEAAiE;gBACjE,mEAAmE;gBACnE,2CAA2C;gBAC3C,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,kCAAkC,GAAG,CAAC,OAAO,2BAA2B;oBAChF,8EAA8E;oBAC9E,8EAA8E;oBAC9E,eAAe;oBACf,6EAA6E;oBAC7E,iEAAiE,CACpE,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,sCAAsC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY;oBACjF,cAAc,GAAG,CAAC,OAAO,MAAM;oBAC/B,gFAAgF;oBAChF,+EAA+E;oBAC/E,sBAAsB;oBACtB,gBAAgB,GAAG,CAAC,OAAO,uDAAuD,CACrF,CAAC;YACJ,CAAC;YAED,IAAI,UAA+B,CAAC;YACpC,IAAI,CAAC;gBACH,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACnC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,gEAAgE;gBAChE,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,kBAAkB;gBAClB,IAAI,YAAY,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;gBACjC,MAAM,UAAU,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;YAED,oEAAoE;YACpE,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;YAE9F,IAAI,MAA8B,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACpC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,CAAC;YAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,qEAAqE;gBACrE,sEAAsE;gBACtE,qEAAqE;gBACrE,oEAAoE;gBACpE,qEAAqE;gBACrE,sEAAsE;gBACtE,yDAAyD;gBACzD,mEAAmE;gBACnE,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,2DAA2D;oBACnE,IAAI,GAAG,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG;oBAC7D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OACnB,MAAM,KAAK,IAAI;wBACb,CAAC,CAAC,uEAAuE;wBACzE,CAAC,CAAC,wCACN,KAAK;oBACL,kFAAkF;oBAClF,kFAAkF;oBAClF,oCAAoC;oBACpC,mDAAmD,sBAAc,eAAe;oBAChF,oBAAoB,8BAAsB,wCAAwC;oBAClF,sFAAsF;oBACtF,uFAAuF,CAC1F,CAAC;YACJ,CAAC;YAED,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,MAAM,QAAQ,GAAG,MAAM,EAAE,kBAAkB,CAAC;YAC5C,MAAM,SAAS,GACb,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;gBAC7B,CAAC,CAAC,SAAS,CAAC;YAEhB,OAAO;gBACL,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,IAAA,iBAAM,EAAC,KAAK,CAAC;gBACzB,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC;aAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AA5ID,sCA4IC;AAED,wEAAwE;AAExE,SAAS,eAAe,CAAC,QAA4C;IACnE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,IAAA,4BAAW,EAAyB,iBAAiB,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,sDAAsD;YAC9D,2CAA2C;YAC3C,mFAAmF;YACnF,8BAA8B,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,GAAG,OAAO,4DAA4D,IAAI,KAAK;QAC7E,gFAAgF;QAChF,sEAAsE;QACtE,kFAAkF;QAClF,4EAA4E;QAC5E,oCAAoC;QACpC,uEAAuE;QACvE,uFAAuF,CAC1F,CAAC;IACF,OAAO,CAAC,IAAI,GAAG,kCAAkC,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,0EAA0E;AAC1E,SAAS,UAAU,CAAC,SAAiB,EAAE,GAAY;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5B,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,IAAI,KAAK,4BAA4B,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;QACrF,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,GAAG,OAAO,KAAK,SAAS,aAAa,IAAI,KAAK;QAC5C,oFAAoF;QACpF,oFAAoF;QACpF,iBAAiB,CACpB,CAAC;IACF,OAAO,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,GAAY;IAChC,OAAO,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACnF,CAAC"}