attenu-guard 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -6,7 +6,275 @@ follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-## [0.4.0] — 2026-08-31
+## [0.6.0] - 2026-09-02
+
+### Added
+- **The bundle-level interop test vectors, and the structured failures they are scored
+  against.** The delegation-chain vectors under `test/fixtures/vectors/` have always let this
+  package score its own *token* verifier against the Python reference. There was no equivalent
+  for the *bundle* verifier, which is where the offline-verifiability claim actually lands: an
+  auditor checks a published ledger with no engine, no service and no vendor in the loop.
+  `test/fixtures/vectors/bundles/bundle_vectors_v1.json` is that file, copied byte for byte from
+  the Python repository (`tests/vectors/bundles/bundle_vectors_v1.json`, whose single writer is
+  `tests/vectors/generate_bundles.py`). Eight cases, every one derived from a single valid
+  schema-v2 bundle by exactly ONE change so each isolates one rule: `valid_bundle_v2` (accept),
+  `reject_params_mismatch`, `reject_outcome_without_allow`, `reject_outcome_before_allow`,
+  `reject_duplicate_outcome`, `reject_duplicate_call_id`, `reject_rehashed_chain` (one entry
+  edited and every later hash recomputed — the rewrite a hash chain alone cannot catch, which
+  only the signed anchor does) and `reject_tampered_entry` (the same edit with nothing
+  re-hashed, which fails AT that entry). All eight score here exactly as they score in Python,
+  with byte-identical `failures` strings. `tools/gen_fixtures.py` re-copies the file from the
+  installed Python package once a release ships it, so CI's existing fixture-drift check starts
+  guarding it with no workflow edit.
+- **`verifyBundle()` reports `failure_details`, the structured twin of `failures`** (additive;
+  `failures` is byte-identical to before, because other implementations parse those strings).
+  One entry per string, same order, same count: `{reason, seq, node, call_id, detail}`, so a
+  conformance suite can assert WHICH check failed and WHERE instead of matching prose. `reason`
+  is the token before the colon in the message, except at the two historical sites whose message
+  names a node there (`unreadable_authority`, `unreadable_granted`), which state their reason
+  explicitly. Positions match the Python implementation's: the second sighting for a re-used
+  `call_id`, the `outcome` entry for every allow/outcome binding failure, and null for a
+  genuinely chain-level failure such as a signed anchor that no longer matches the ledger head.
+  Every failure in `src/evidence.ts` now goes through one collector, so a message cannot be
+  added without its twin — `test/bundle-vectors.test.ts` asserts the two lists stay in step at
+  every failure site in the module (including the ones no vector exercises) and traps a direct
+  append. The `execution_binding` sub-report's own shape is unchanged: the twins ride alongside
+  it, never inside it.
+
+## [0.5.0] - 2026-08-31
+
+### Fixed
+- **Adapter mirror of the Python batch-1/batch-2 adversarial review.** The TS package ships
+  exactly one adapter surface (`src/adapters/langgraph.ts` — `package.json`'s `exports` map
+  declares nothing besides `.` and `./adapters/langgraph`; no A2A, no generic wrapper, no
+  separate LangChain.js seam), and execution binding was already fully wired into both
+  `guardNode` and `guardTool` as of 0.4.0. Each Python defect class was checked against this
+  specific adapter, against pinned `@langchain/core@1.2.9`/`@langchain/langgraph@1.4.13` source
+  (installed and grepped directly, not assumed), rather than ported by analogy — see the module
+  doc comment's own "Adversarial review" section for the full per-class evidence. Six of the
+  seven classes came back genuinely inapplicable to this adapter's architecture (no composable
+  middleware chain in either pinned framework package; one wrapper per call, no second gate; no
+  cross-hook correlation map to collide or grow unbounded; `isDeferredResult` already covers
+  JavaScript's whole lazy-result landscape; no external multi-phase hook dispatch to lose an
+  event across; `src/`'s only runtime import is a lazy `@langchain/langgraph`, correctly
+  undeclared as a hard dependency, matching the README's own "zero runtime dependencies" claim).
+  One real, TS-specific gap was found in the snapshot-commitment family and fixed:
+  - `snapshotParams`/`snapshotToolParams`'s fallback, taken when `structuredClone` cannot clone
+    the value being snapshotted (a function, a class instance it refuses, anything sharing an
+    object graph with one of those), was a bare shallow copy — `{args: [...args]}` makes a fresh
+    OUTER array, but every element INSIDE it is the same live reference as the real call
+    arguments. Reproduced directly before fixing: `snapshot.args[0] === liveArg` was `true`, and
+    a mutation of `liveArg` after the call was visible through the "snapshot" — violating the
+    adapter's own documented guarantee ("an IMMUTABLE snapshot... taken BEFORE the wrapped
+    callable runs"). Checked the specific `toJSON` vector first: `structuredClone` does NOT
+    consult a `toJSON` method or any other user-overridable protocol the way Python's
+    `copy.deepcopy` consults `__deepcopy__` (verified empirically — a hostile class's own
+    `toJSON` returning fabricated data is simply ignored, and the clone is never the same
+    OBJECT reference for that specific case); only the FAILURE path aliased for a hostile
+    `toJSON`. See the release-gate correction below for why "a successful clone never aliases"
+    was still wrong as a general claim (a `SharedArrayBuffer` clones "successfully" to a
+    DIFFERENT object that shares the SAME underlying memory).
+  - Fixed with a new `freeze()` function (exported for direct testing, the same reason every
+    Python adapter's own `_freeze()` is imported directly by its tests — the audit log never
+    exposes the raw snapshot value, only its hash, so "does this alias" is not otherwise
+    observable): safe JSON-primitive leaves pass through verbatim, plain objects/arrays are
+    rebuilt fresh and recursively, and anything else (a function, a class instance, a
+    `Map`/`Set`/`Date`/`RegExp`, a `Symbol`, a `BigInt`) becomes a safe string representation —
+    never the live reference. This is `structuredClone`'s support matrix happening to overlap
+    with what the audit log's own JCS canonicalizer (`params.ts`) can hash, unconditionally,
+    matching the same invariant every Python adapter's `_freeze()` already holds, rather than
+    scoped narrowly to only the cases proven to reach a hash mismatch. Guards a circular
+    reference with a `WeakSet` (`structuredClone` handles cycles natively; the whole point of
+    this function is the cases it could NOT handle, one of which could still be cyclic). A
+    welcome side effect: because `freeze()` sanitizes an otherwise-unsupported value BEFORE it
+    is ever handed to `params.ts`'s `commit()`, a call that used to commit no hash at all
+    (`paramsHashReason: "unsupported"`) now commits a real, verifiable one.
+  - Tests added in `test/adapter-langgraph.test.ts`: two direct unit tests on `freeze()` itself
+    (never aliases the unclonable value's own case; never aliases a mutable SIBLING sharing the
+    same object graph as an unclonable value — the mixed case), one guarding the circular
+    reference, and one end-to-end test per wrapper (`guardNode`, `guardTool`) driving an
+    unclonable argument through the real call path and asserting a genuine, matching
+    `authorizedParamsHash`/`invokedParamsHash` pair is committed rather than `"unsupported"`.
+  - **Delta review, two more edits to `freeze()` itself:**
+    - **Medium-low, required:** the plain-object branch built the rebuilt object with an
+      `out[k] = freeze(v, seen)` accumulation loop. A plain `JSON.parse('{"__proto__": {...}}')`
+      result genuinely has `"__proto__"` as an OWN, ENUMERABLE data property (`Object.keys`
+      lists it — JSON has no notion of prototypes, so this is reachable from ordinary untrusted
+      input, not a contrived shape) — but assigning through `out[k] = v` for that specific key
+      name does not create a data property at all; it sets the accumulator's own `[[Prototype]]`
+      via `Object.prototype`'s own `__proto__` accessor instead. The key then vanished from the
+      rebuilt object's own enumerable keys entirely — a params-commitment completeness gap
+      (substitution on that key would be invisible to a params mismatch) that `structuredClone`'s
+      own success path, and Python's `_freeze()`, do not have. Fixed with
+      `Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, freeze(v, seen)]))`, which
+      always defines genuine data properties, `__proto__` included. Test added: a
+      `JSON.parse`-created `__proto__` own key beside an unclonable sibling (forcing the
+      fallback) — the key survives into the snapshot with its value, and the rebuilt object's
+      own prototype is unaffected.
+    - **Nit, ride-along:** the array branch used `value.map((v) => freeze(v, seen))` —
+      `Array.prototype.map` SKIPS a hole in a sparse array rather than visiting it, so a hole
+      would survive into the snapshot as a hole too, unlike every other absent value `freeze()`
+      turns into a plain `null`. Fixed with `Array.from(value, (v) => freeze(v, seen))`, which
+      visits every index up to `.length`, densifying a hole to `undefined` (then `null`, same as
+      any other `undefined`). Test added: `freeze([1, , 3])` equals `[1, null, 3]`, with a real
+      (densified) element at index 1, not a hole.
+  - **Release-gate correction (CRITICAL + HIGH): `freeze()` was still only a FALLBACK, run only
+    when `structuredClone` THREW — a successful clone bypassed it entirely, and "a successful
+    clone never aliases" (asserted above) was not actually true.** Three bypasses, each
+    reproduced directly before fixing: (1) a circular object clones successfully —
+    `structuredClone` handles cycles natively — so `freeze()` never ran on it at all; the
+    circularity then reached `params.ts`'s own hash-commitment walk, which has NO cycle guard,
+    and crashed with `RangeError: Maximum call stack size exceeded` before authorization or the
+    tool body ever ran. (2) A sparse array clones successfully too, holes preserved, bypassing
+    `freeze()`'s own densification (added above) entirely — it reached `params.ts` as
+    `paramsHashReason: "unsupported"` instead of a real, densified, hashable snapshot. (3) A
+    `SharedArrayBuffer` clones to a DISTINCT wrapper object that shares the SAME underlying
+    memory, by design — a "successful" clone that is not independent at all. Fixed by making
+    `freeze()` the ONLY snapshot path, unconditionally: `structuredClone` is no longer called
+    anywhere in this adapter. Also fixed in the same pass: the cycle guard (`seen`) was a
+    single, MUTABLE `WeakSet` shared across the whole call, added to but never removed from —
+    so a DAG's repeated sibling reference (the SAME object appearing twice as two different
+    keys' values, never as its own ancestor) was wrongly reported `"<circular>"` on its second
+    occurrence, reproduced directly: `freeze({a: shared, b: shared})` came back
+    `{"a": {...}, "b": "<circular>"}`. Renamed to `active`, a PATH-ACTIVE `ReadonlySet` — a
+    fresh `Set` unioned in at each recursive call, never mutated in place or shared across
+    sibling branches. Separately, HIGH: the array and object branches (`Array.from`/`.map()` and
+    `Object.entries()`) invoke the value's OWN protocols — a hostile `[Symbol.iterator]`
+    override can yield ANYTHING regardless of an array's real indexed properties (reproduced:
+    `[1, , 3]` with a hostile iterator froze as `[999]`), and a getter is INVOKED by
+    `Object.entries()`, with no guarantee of being invoked only once (reproduced: with an
+    unclonable sibling forcing the old fallback, a getter with a side effect was observed three
+    times across the old clone-attempt/freeze/body sequence, and the committed snapshot was the
+    SECOND of three observations, not the first). Fixed: both branches now walk
+    `Object.getOwnPropertyDescriptor` directly (arrays by a `.length`-bounded index loop, objects
+    by `Object.keys`) — pure introspection, never invoking user code — and an accessor property
+    (`.get`/`.set` present) is encoded as the literal string `"<accessor>"` rather than read at
+    all. **A regression caught and fixed before this same commit landed:** rewriting the
+    object branch's write-back re-introduced the EXACT `out[key] = value` bug the `__proto__`
+    fix above had already closed (a bracket assignment to the literal key `"__proto__"` sets the
+    accumulator's prototype instead of a data property) — caught by running the existing
+    `__proto__` test against the rewrite, not assumed fixed; corrected with
+    `Object.defineProperty` in the loop instead. Six new tests added, each driving the REAL
+    wrapper (`guardNode`/`guardTool`), not `freeze()` directly — the earlier circular test
+    guarded the wrong path (it passed even while the actual wrapper crashed): circular input,
+    sparse array, hostile custom iterator, getter, `SharedArrayBuffer`, and a DAG's repeated
+    reference, all via `test/adapter-langgraph.test.ts`.
+  - **Release-gate correction (HIGH): `isDeferredResult` missed a plain `AsyncIterable`.** The
+    async branch required the result to have its OWN `.next` method, matching a self-iterating
+    async generator — but the JavaScript async-iterable protocol only requires a callable
+    `[Symbol.asyncIterator]()`, which can return a SEPARATE object that has `.next`, without the
+    iterable itself ever having one. Reproduced directly before fixing: a plain object
+    implementing only `[Symbol.asyncIterator]()` was recorded `BodyState.RETURNED`, not
+    `DEFERRED`. Fixed: the async check no longer requires an own `.next` (the sync check, which
+    DOES require it, was deliberately left alone — dropping it there would misdetect a plain
+    `Array`/`Set`/`Map` as deferred, since those implement `Symbol.iterator` too without their
+    contents being lazily produced; there is no equivalent JavaScript built-in that implements
+    `Symbol.asyncIterator` over already-computed values, so this asymmetry is not itself a gap).
+    The module doc comment's own "whole lazy-result landscape" claim is narrowed to list exactly
+    what `isDeferredResult` checks, rather than asserting completeness. Two tests added: the
+    async-iterable case now scores `DEFERRED`; a plain array result is confirmed to still score
+    `RETURNED` (pinning that the sync branch's requirement was deliberately kept).
+  - **Release-gate correction (HIGH): three disagreeing version fields.** `package.json` said
+    `0.4.0`; `package-lock.json`'s root `"version"` said `0.3.1` (stale since before the 0.4.0
+    bump — `npm install` never re-synced it); `src/version.ts`'s exported `VERSION` — the
+    constant `guard.ts` and both `adapters/langgraph.ts` wrappers use to attribute every v2
+    ledger entry's `adapter.version` field — said `0.3.0`. The release workflow
+    (`.github/workflows/release.yml`) only ever checks the pushed tag against `package.json`, so
+    it would have published while shipped ledger attribution was still wrong. Every v2 ledger
+    entry produced by the shipped 0.4.0 release has been misreporting `adapter.version` as
+    `"0.3.0"`. Fixed: all three aligned to the CURRENT `0.4.0` (no version bump as part of this
+    fix — that is the operator's call at release time). Added
+    `test/version-consistency.test.ts`, a new CI-run test (not only a release-time check)
+    asserting `package.json`, `package-lock.json`'s root version (both the top-level field and
+    its `packages[""].version` copy, which have drifted independently before), and the exported
+    `VERSION` all agree, every run, not only at tag time.
+  - **Release-gate finding, MEDIUM: `test/wire-vectors.test.ts` enumerated and scored 19 of the
+    20 published interop vectors, silently.** `reject_unsafe_integer` — anticipated in this
+    package's own `[0.3.1]` CHANGELOG entry below ("will show 20 vectors... once the Python
+    package ships them") and shipped by Python's own `[0.9.0]` — has had its fixture file
+    present on disk (byte-identical to Python's) since, but `VECTOR_NAMES` itself was never
+    updated to include it, and the test's own count assertion (`19`) masked the omission rather
+    than catching it. Fixed: added to `VECTOR_NAMES`, the count and test name updated to `20`,
+    and the stale `.github/workflows/ci.yml` comment ("19-vector... >=0.8 ships this") corrected
+    to `20-vector`/`>=0.9` (Python's own `[0.9.0]` CHANGELOG entry is where
+    `reject_unsafe_integer.json` shipped, matching the pip constraint
+    `attenu-guard>=0.9,<0.10` already pinned two lines below that comment).
+  - **Release-gate finding, LOW: the interop matrix had no early warning for the NEXT Python
+    minor.** `ci.yml`'s `interop` job pins `attenu-guard>=0.9,<0.10` deliberately — the committed
+    fixtures match that release, and the job's own last step re-generates and diffs them, so
+    pinning to it is correct, not stale. But nothing in this repo would notice a 0.10.0 that
+    breaks wire compatibility until someone widened that pin by hand. Added a second job,
+    `interop-next`, that runs the same cross-language suite against `attenu-guard>=0.10,<0.11` —
+    gated on a `pip index versions` check so it reports success without running anything while
+    0.10.0 is unpublished (confirmed against the live PyPI index: 0.9.0 is current, no 0.10.x
+    yet), and starts actually exercising the suite the moment the operator ships it, with no
+    workflow edit required either way.
+- **D14 — `Guard.check()` registered a `PRE_HOOK_ONLY` allow as pending, wedging `complete()`
+  forever.** Mirrors the fix landing in the Python `attenu-guard` reference implementation
+  (`guard.py`, same defect, same root cause): `registerPending` ran unconditionally for every
+  `schemaVersion: 2` allow, in both the normal commit path and the `CommittedAuditError` path,
+  with no regard for `capture`. A bare `check()` (or any explicit `capture: Capture.PRE_HOOK_ONLY`)
+  is an honest promise of NO terminal observation — nothing is ever going to call `recordOutcome`
+  for it — yet it was registered pending exactly like a `WRAPPER_SYNC`/`WRAPPER_ASYNC`/
+  `FRAMEWORK_POST_HOOK` allow, so `complete()` refused forever for a node with only
+  `PRE_HOOK_ONLY` calls. The offline verifier already treated a missing `PRE_HOOK_ONLY` outcome
+  as merely `unobserved` (`evidence.ts`'s execution-binding report), so runtime and offline
+  semantics disagreed. Fixed: a call is now registered pending only when its capture is one of
+  `WRAPPER_SYNC`/`WRAPPER_ASYNC`/`FRAMEWORK_POST_HOOK` — in both the normal path and the
+  `CommittedAuditError` path. A bare/`PRE_HOOK_ONLY` allow never enters the pending set, so
+  `complete()` finalizes immediately, and the verifier's `unobserved` classification for it now
+  matches the runtime's own view.
+- **Re-gate correction (HIGH): `freeze()` still executed attacker-controlled code BEFORE
+  authorization, on three separate exotic-value paths, all reproduced directly before this fix.**
+  (1) A `Proxy` is not inert under reflection: `Object.getPrototypeOf`, `Object.keys`, and
+  `Object.getOwnPropertyDescriptor` are each real, user-definable traps — walking an ordinary
+  Proxy through the property-descriptor logic fired four of them before authorization was ever
+  decided, and `Array.isArray` on a REVOKED Proxy throws `TypeError` outright rather than
+  degrading cleanly. (2) The bottom fallback still called `String(value)` for anything not a
+  plain object/array — a boxed primitive (`new Number(...)`) with a hostile `Symbol.toPrimitive`,
+  or a `TypedArray` with a hostile own `toString`, each ran attacker code exactly once per
+  snapshot. (3) No general safety net: an unanticipated reflection failure would have propagated
+  an exception out of a snapshot taken before authorization, rather than degrading. None of this
+  was an aliasing or authorization-bypass defect — ordinary frozen/accessor-only objects never
+  leaked references, and policy evaluation still fully controlled whether the wrapped body ran —
+  the defect was pre-authorization code execution and exception propagation. Fixed: `freeze()`
+  now recognizes a Proxy FIRST, via `util.types.isProxy` (an internal engine-slot check that
+  invokes nothing, live or revoked — verified directly), before `Array.isArray` or any other
+  reflection; every value that is not a safe JSON primitive and not a plain object/array (a
+  Proxy, a boxed primitive, a TypedArray/`ArrayBuffer`/`SharedArrayBuffer`/`DataView`, a
+  `Map`/`Set`/`Date`/`RegExp`, a function, a `Symbol`, a `BigInt`, or anything else) becomes the
+  new `FREEZE_UNSUPPORTED` sentinel instead of a string — never `String()`, never any other
+  protocol; the whole reflective walk runs inside one `try`/`catch`, degrading any other
+  reflection failure the same way. `paramsHashReason: "unsupported"` for the whole call, never a
+  partial commitment — the same degradation this library already uses for an out-of-domain
+  number, not a new failure mode.
+- **Re-gate correction (MEDIUM): `"<accessor>"` was a real commitment collision, and so was
+  `"<circular>"` by the identical reasoning.** Two real wrapper calls — one with an enumerable
+  getter, one with the literal string `"<accessor>"` as an ordinary value — produced the
+  IDENTICAL `authorizedParamsHash`, reproduced directly: an evidence-integrity ambiguity in a
+  supposedly cryptographic commitment (two materially different inputs, one commitment), even
+  though the getter itself correctly stayed uninvoked and this was never an authorization
+  bypass. Audited the sibling sentinel `"<circular>"` for the exact same collision class rather
+  than leaving it unexamined — it has the identical problem (a genuinely circular object and a
+  plain object holding the literal string `"<circular>"` produce the same commitment); there is
+  no reason a cycle's position makes the collision infeasible, so it gets the same fix. Both an
+  accessor property and a genuine cycle now become `FREEZE_UNSUPPORTED` (above) — the same
+  private `Symbol` every other unrepresentable value degrades to, which cannot equal any real
+  call argument by construction. Regression test added: zero getter calls, no hash,
+  `params_hash_reason: "unsupported"`; plus a direct test that a real getter-bearing object and
+  the old literal-string sentinel no longer freeze to the same shape.
+- **Re-gate correction (MEDIUM): `interop-next`'s "is 0.10.x published yet?" check failed OPEN.**
+  `set -eu` alone does not catch a failing `pip index versions` inside an
+  `if PIPE | grep -q ...; then` compound command — a compound `if` condition is exempt from
+  `set -e` by design, and without `pipefail` a pipeline's exit status is its LAST command's
+  only. Reproduced directly: a simulated exit 42 from the query flowed straight through to
+  `published=false`, the same output as "0.10.x genuinely does not exist yet" — a PyPI outage
+  silently read as a fact about what has been released, with the step still exiting 0. Fixed by
+  extracting the check into `tools/check-next-python-published.sh`, which captures the query's
+  exit code in its own statement (not inside an `if`) and exits non-zero — without ever printing
+  `false` — before reaching the match logic. Added a probe step to `ci.yml`'s `interop-next` job,
+  run on every CI invocation, that points the script at a stub `python3` simulating a query
+  failure and asserts the script fails rather than reporting `false`.
 
 ### Added
 - **Execution binding**, opt-in per chain via `Guard.issue(agentId, authority, {schemaVersion: 2})`

package/README.md

@@ -178,6 +178,17 @@ dual-signing mode. The 19 committed interop vectors include the separating cases
 for number spelling, raw Unicode, UTF-16 member ordering, large integers,
 duplicates, non-finite values and an unmarked canonical header.
 
+`test/fixtures/vectors/bundles/bundle_vectors_v1.json` is the second, bundle-level
+suite: whole evidence bundles for `verifyBundle`, the check an auditor runs on a
+published ledger with no engine and no vendor in the loop. The token vectors pin
+what a delegation token means; these pin what the LEDGER of a run has to satisfy.
+A bundle verifier reports a LIST of failures rather than one reject reason, so
+each rejecting case declares the minimal set of `{reason, seq, node}` that MUST
+appear, at that exact position. A conformant verifier may report more, never
+fewer and never elsewhere. `verifyBundle` returns those positions as
+`failure_details`, the structured twin of `failures`: one
+`{reason, seq, node, call_id, detail}` entry per string, in the same order.
+
 ## What it does not do
 
 - It does not decide what permissions a task needs. You state them; this library

package/dist/cjs/adapters/langgraph.d.ts

@@ -51,6 +51,69 @@
  * adapter behaves exactly as it did before 0.9.0: no `capture`/`authorizedParams`, no
  * `recordOutcome` call. Every other framework adapter is unchanged in this release.
  *
+ * ## Adversarial review: the Python batch-1/batch-2 defect classes, checked against this
+ * adapter specifically (not assumed absent by analogy)
+ *
+ * The Python `attenu-guard` adapters went through two rounds of adversarial review that found
+ * several defect classes across their (many) framework adapters. This TS package ships exactly
+ * ONE adapter surface (this file — verified against `package.json`'s own `exports` map, which
+ * declares nothing besides `.` and `./adapters/langgraph`), so each class was checked against
+ * THIS adapter specifically, not inherited by assumption:
+ *
+ * - **Composable middleware / sibling short-circuit or retry** (a sibling wrapper positioned
+ *   closer to the tool body than this one, able to fabricate or repeat what it observes) — NOT
+ *   APPLICABLE. Verified directly against pinned `@langchain/core@1.2.9` and
+ *   `@langchain/langgraph@1.4.13` (installed and grepped, not read off documentation): zero
+ *   `"middleware"` hits anywhere near tool invocation in either package, and
+ *   `ToolNode.prototype.runTool` (`dist/prebuilt/tool_node.js`) calls `tool.invoke(toolCall,
+ *   runtime)` directly — `guardTool`'s `Proxy` IS what gets called, nothing sits between it and
+ *   `ToolNode`. Neither framework has a composable per-call hook chain the way LangChain-Python's
+ *   `create_agent(middleware=[...])` or AG2's `FunctionTool.register()` do.
+ * - **Double authorization via a second, independent gate** (e.g. Python's `claude_sdk`
+ *   adapter's `can_use_tool` calling `authorize()` a second time for the same call) — NOT
+ *   APPLICABLE. There is no second entry point here: `guardNode`/`guardTool` are each the ONLY
+ *   caller-facing wrapper for their call, and there is nothing in either framework analogous to
+ *   a second permission callback for a call this adapter already gated.
+ * - **Snapshot double-evaluation / narrow-projection commitment** — NOT APPLICABLE in the
+ *   double-evaluation shape (`snapshotParams`/`snapshotToolParams` already compute ONE snapshot,
+ *   reused unchanged for both `authorizedParams` and `invokedParams`), but a DIFFERENT,
+ *   TS-specific gap in the same family was found and fixed — see `freeze()`'s own doc comment
+ *   above and the CHANGELOG.
+ * - **Correlation-key collision across hooks** (e.g. Python's `claude_sdk` `tool_use_id`
+ *   collision) — NOT APPLICABLE. `guard.recordOutcome` is called synchronously inside the same
+ *   closure that owns the whole call, from `authorize()`'s own returned `Decision.callId` — no
+ *   external pending-map keyed by a framework-supplied correlation id exists to collide on.
+ * - **Lazy-result detection gaps** (e.g. Python's `smolagents` adapter missing a coroutine or a
+ *   `concurrent.futures.Future`) — `isDeferredResult` catches generators (an object with its own
+ *   `.next` AND `[Symbol.iterator]` — "self-iterating", the shape a native generator has, but
+ *   deliberately NOT the shape a plain `Array`/`Set`/`Map` has, since those implement
+ *   `[Symbol.iterator]` too without an own `.next`, and their contents are already fully
+ *   computed), a genuine ASYNC ITERABLE (anything implementing a callable
+ *   `[Symbol.asyncIterator]`, self-iterating async generators included — see the RELEASE-GATE
+ *   CORRECTION on this function's own body for why this does NOT require an own `.next` the way
+ *   the sync branch does), and anything thenable. A plain (non-`async`) function that manually
+ *   returns a bare `Promise` is also caught correctly, via the thenable check, in the sync
+ *   branch of both wrappers. This is NOT a claim of covering "the whole lazy-result landscape" —
+ *   only what this function's own checks actually implement, listed above; a class implementing
+ *   some OTHER deferred-consumption protocol this function does not check for would not be
+ *   caught.
+ * - **Lost-terminal-event / "fires unconditionally" false claims** (e.g. Python's `strands`
+ *   adapter's before-hook interrupt paths) — NOT APPLICABLE. There is no external, multi-phase
+ *   hook-dispatch loop for an event to be lost across; one wrapper function's own `try`/`catch`
+ *   (or `await`ed async path) owns authorize-through-`recordOutcome` for the whole call
+ *   synchronously. Structurally this adapter was already closest to Python's own `langgraph.py`
+ *   reference wiring, not any of the adapters that needed this class of fix.
+ * - **Unbounded correlation cache** (Python's `claude_sdk` `_recentVerdicts`) — NOT APPLICABLE,
+ *   for the same reason as the correlation-collision point above: no cache or pending-map exists
+ *   in this adapter to bound.
+ * - **Wrong dependency declaration** (Python's `semantic-kernel` `protobuf` lesson: check what
+ *   the RESOLVED version actually requires, not what is assumed) — checked: `src/` imports only
+ *   `@langchain/langgraph` (lazily, in `isLangGraphAvailable()`); it never imports
+ *   `@langchain/core` at all (only this file's own tests do, to build fixtures). `package.json`
+ *   declares zero `dependencies` and no `peerDependencies` — matching the README's own "zero
+ *   runtime dependencies" claim — and both `@langchain/core`/`@langchain/langgraph` are correctly
+ *   `devDependencies`-only. Nothing this package's `src/` needs at runtime is undeclared.
+ *
  * ## Delegation
  *
  * Handing work to a sub-agent is the delegation moment. `delegateTo` mints the
@@ -67,6 +130,7 @@
  */
 import { type Guard } from "../guard.js";
 import type { Authority } from "../authority.js";
+import type { Json } from "../canonical.js";
 import type { Context } from "../ceilings.js";
 import { type Decision } from "../reasons.js";
 /** Options shared by every guarded wrapper. */
@@ -90,6 +154,129 @@ export type GuardedNode<F extends (...args: any[]) => any> = F & {
     readonly toolScope: string;
     readonly unwrapped: F;
 };
+/**
+ * A private, freeze()-only sentinel for "could not be represented as a JSON leaf" — a Proxy, an
+ * accessor property, a genuine cycle, a boxed primitive, a TypedArray, a function, or anything
+ * else this module does not know how to rebuild as plain JSON. NEVER a JSON-representable
+ * value (a string, `null`, …): a second release-gate finding showed a literal string sentinel
+ * (`"<accessor>"`) genuinely COLLIDES — a real getter-bearing object and a plain object holding
+ * the literal string `"<accessor>"` produced the IDENTICAL `authorizedParamsHash`, an
+ * evidence-integrity ambiguity in a supposedly cryptographic commitment (two materially
+ * different inputs, one commitment). A fresh, private `Symbol` cannot equal any real call
+ * argument, so it cannot collide with one — and it makes the SAME degradation apply uniformly
+ * everywhere this function cannot represent something, rather than inventing a new
+ * JSON-shaped sentinel (with its own collision risk) per case.
+ *
+ * Declared as `Json` even though a `Symbol` is not one — a deliberate escape from that type's
+ * nominal domain, not an oversight: `canonical.ts`'s own JCS `serialize()` already runtime-checks
+ * `typeof` for exactly this reason (its switch handles `"undefined"`/`"bigint"`/`"symbol"`/
+ * `"function"` despite `CJson`'s declared type not admitting any of them either), because the
+ * type system cannot fully describe this module's actual runtime domain. Once this sentinel
+ * reaches `params.ts`'s `commit()` — inside a plain object or array, same as any other frozen
+ * leaf — `canonicalBytes` hits that `"symbol"` case, throws `UnsupportedTypeError`, and `commit()`
+ * turns that into `paramsHashReason: "unsupported"` for the WHOLE params value, never a partial
+ * or per-field one: there is no such thing as "this one nested field is unsupported," only
+ * "this whole call's arguments are, or are not, representable."
+ *
+ * Exported for the same reason `freeze` itself is: not part of this adapter's semantic
+ * contract, but its own tests need to assert directly that a given leaf became this exact
+ * sentinel (by identity — nothing else can equal it) rather than inferring it indirectly.
+ */
+export declare const FREEZE_UNSUPPORTED: Json;
+/**
+ * A genuinely immutable, fully decoupled rebuild of `value` — the ONE, UNCONDITIONAL sanitizer
+ * every snapshot in this adapter goes through. Safe JSON-primitive leaves
+ * (`string`/`number`/`boolean`/`null`) pass through verbatim; plain objects and arrays are
+ * rebuilt fresh, recursively, by inspecting their REAL own property descriptors directly
+ * (`Object.getOwnPropertyDescriptor`), never by invoking anything the value itself controls (a
+ * getter, an iterator, a copy protocol, a Proxy trap, a `toString`/`valueOf`/`Symbol.toPrimitive`
+ * override); anything this function cannot represent becomes `UNSUPPORTED` (above) — never a
+ * string, never the live object.
+ *
+ * RELEASE-GATE CORRECTION (CRITICAL): this used to run ONLY as a fallback, after
+ * `structuredClone` had already been tried and had THROWN — the previous revision of this
+ * comment documented that carefully, but never asked whether `structuredClone` SUCCEEDING was
+ * itself a sufficient guarantee. It is not, on three counts, each reproduced directly before
+ * that fix: (1) a circular object clones successfully — `structuredClone` handles cycles
+ * natively — so this function never ran on it at all, and the circularity later reached
+ * `params.ts`'s own cycle-guard-less hash walk and crashed with `RangeError`; (2) a sparse
+ * array clones successfully too, bypassing this function's own densification; (3) a
+ * `SharedArrayBuffer` clones to a DISTINCT wrapper object sharing the SAME underlying memory —
+ * a "successful" clone that is not independent at all. Fixed by making this function the ONLY
+ * snapshot path, unconditionally — `structuredClone` is not called anywhere in this adapter.
+ *
+ * A SECOND release-gate pass then found that "pure introspection" was not fully true either —
+ * three more code-execution paths, all reproduced directly before this fix:
+ *
+ *   1. A `Proxy` is not inert under reflection. `Object.getPrototypeOf`, `Object.keys`
+ *      (`[[OwnPropertyKeys]]` + a `[[GetOwnProperty]]` per key to check enumerability), and
+ *      `Object.getOwnPropertyDescriptor` are each real, user-definable traps — reproduced
+ *      directly: walking an ordinary handler-tracked Proxy through the OLD version of this
+ *      function fired four separate traps before authorization was ever decided. `Array.isArray`
+ *      is worse: called on a REVOKED Proxy, it throws `TypeError` outright (its spec algorithm,
+ *      `IsArray`, unwraps `[[ProxyTarget]]`, which does not exist on a revoked handle) —
+ *      reproduced directly. Fixed: `require("node:util").types.isProxy(value)` recognizes a
+ *      Proxy — live OR revoked — via an internal engine slot, invoking NOTHING (verified
+ *      directly: zero trap calls, no throw on a revoked handle either) — checked FIRST, before
+ *      `Array.isArray` or any other reflection, and routed straight to `UNSUPPORTED`.
+ *   2. The bottom fallback used `String(value)` for anything not a plain object/array — a boxed
+ *      primitive (`new Number(...)`) with a hostile `Symbol.toPrimitive`, or a `TypedArray` with
+ *      a hostile own `toString`, each ran attacker code exactly once per snapshot, reproduced
+ *      directly both ways — BEFORE `Guard.check` had decided allow or deny. The same is true, in
+ *      principle, of ANY object-typed exotic value (a function's own `.toString` is just as
+ *      overridable) — there is no way to distinguish "safe to stringify" from "hostile" by
+ *      inspection alone, so none of them are stringified any more. Fixed: every value that is
+ *      not a safe JSON primitive and not a plain object/array — a Proxy, a boxed primitive, a
+ *      TypedArray/`ArrayBuffer`/`SharedArrayBuffer`/`DataView`, a `Map`/`Set`/`Date`/`RegExp`, a
+ *      function, a `Symbol`, a `BigInt`, anything else — becomes `UNSUPPORTED` (never `String()`,
+ *      never any other protocol) — see the confirmed-good note above: stringification itself
+ *      was never unsafe as a RESULT (a `SharedArrayBuffer` never retained live memory as a
+ *      string), the defect was invoking attacker-controlled code to PRODUCE that string before
+ *      authorization ran, and `UNSUPPORTED` avoids that entirely rather than picking a "safer"
+ *      string.
+ *   3. Any OTHER reflection failure — an exotic value this pass did not specifically anticipate,
+ *      still throwing from `Object.getPrototypeOf`/`Object.keys`/`Object.getOwnPropertyDescriptor`
+ *      despite the Proxy check above — must degrade the same way, not propagate an exception out
+ *      of a snapshot taken before authorization. The whole reflective walk (everything past the
+ *      Proxy/primitive fast paths) runs inside one `try`/`catch`; any throw there becomes
+ *      `UNSUPPORTED` too.
+ *
+ * `active` is the PATH-ACTIVE cycle guard: the set of containers on the CURRENT recursion path,
+ * passed as a NEW `Set` at each recursive call rather than mutated in place and shared across
+ * sibling branches (an earlier revision DID share one mutable `WeakSet` across the whole call,
+ * which meant a DAG's repeated reference — the SAME object appearing twice as sibling values,
+ * never as its own ancestor — was wrongly flagged on its second occurrence; reproduced directly
+ * before that fix too). A genuine cycle's own leaf value is `UNSUPPORTED`, not a literal string
+ * `"<circular>"` — audited for the same collision class as `"<accessor>"` below, and it has the
+ * identical problem: a self-referential object and a plain object holding the literal string
+ * `"<circular>"` would otherwise produce the same commitment. There is no position-based reason
+ * a cycle's collision is any less real than an accessor's, so it gets the same fix.
+ *
+ * The property-descriptor walk ALSO closes a separate, protocol-driven gap: the previous
+ * revision used `Array.from`/`.map()` (which invoke `[Symbol.iterator]()` — a hostile array's
+ * own override can yield ANYTHING regardless of its real indexed properties; reproduced
+ * directly: `[1, , 3]` with a hostile iterator froze as `[999]`) and `Object.entries()` (which
+ * reads each property's VALUE directly, invoking a getter if one is defined there — reproduced
+ * directly: a getter with a side effect was observed three times across the old clone-attempt/
+ * freeze/body sequence, and the committed snapshot was the SECOND of three observations, not the
+ * first). `Object.getOwnPropertyDescriptor` and a `.length`-bounded index loop are pure
+ * introspection — they never invoke user code — and an accessor property (`.get`/`.set` present)
+ * becomes `UNSUPPORTED` rather than read at all: a getter can have arbitrary side effects, throw,
+ * or return something different on every call, so there is no single "correct" observation of it
+ * to commit, and (release-gate correction) the earlier `"<accessor>"` string sentinel this
+ * function used instead genuinely collided — reproduced directly: a real getter-bearing object
+ * and a plain object holding the literal string `"<accessor>"` produced the identical
+ * `authorizedParamsHash`. Both now degrade the same commitment to `unsupported` via `UNSUPPORTED`
+ * (see its own doc comment above), never a JSON-representable stand-in.
+ *
+ * Exported — not part of this adapter's semantic contract (it is an internal sanitizer, not a
+ * feature callers configure), but its own aliasing-safety invariant is worth a direct unit
+ * test in isolation, the same way every Python adapter's `_freeze()` is imported directly by
+ * its own tests: the audit log never exposes the raw snapshot value it produces (only its
+ * hash — see `params.ts`'s own doc comment), so "does this alias a live mutable object" is
+ * not otherwise observable from outside this module.
+ */
+export declare function freeze(value: unknown, active?: ReadonlySet<unknown>): Json;
 /**
  * Wrap a callable so every call is authorized through `guard` first.
  *

package/dist/cjs/adapters/langgraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAqC,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGlE,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IACxC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG;IAC/D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;CACvB,CAAC;AAgEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACzD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAsGhB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC9D,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAIhB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,CAAC,EACP,OAAO,GAAE,gBAAqB,GAC7B,CAAC,CAkIH;AAED,8EAA8E;AAC9E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAC3C,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,CAAC,EAAE,CAUL;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMxD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,CAEzE;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}
+{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiIG;AAIH,OAAO,EAAqC,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAOlE,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IACxC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG;IAC/D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,kBAAkB,EAA2D,IAAI,CAAC;AAG/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,GAAE,WAAW,CAAC,OAAO,CAAa,GAAG,IAAI,CA+ErF;AA4FD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACzD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAsGhB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC9D,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAIhB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,CAAC,EACP,OAAO,GAAE,gBAAqB,GAC7B,CAAC,CA8HH;AAED,8EAA8E;AAC9E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAC3C,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,CAAC,EAAE,CAUL;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMxD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,CAEzE;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}