autotel-genai 0.1.0 → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Jag Reehal 2025
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -66,6 +66,8 @@ export const chat = traceGenAI({
 | **Attributes** | `autotel-genai` | typed builders → canonical attribute maps |
 | **Events** | `autotel-genai/events` | opt-in content + `inference.operation.details` / `evaluation.result` |
 | **Trace** | `autotel-genai/trace` | `traceGenAI()`, `recordGenAiResponse/Usage` |
+| **Guard** | `autotel-genai/guard` | inline cost/token/loop kill-switch — `createGenAiBudget`, `createGenAiGuard`, `parseGuardRules` |
+| **Streaming** | `autotel-genai/streaming` | TTFC, throughput, inter-chunk distribution — `createStreamTimer`, `recordStreamTiming` |
 | **AI SDK** | `autotel-genai/ai-sdk` | Vercel `ai.*` → `gen_ai.*` mapping + cost |
 | **Agents** | `autotel-genai/agent` | identity, delegation, policy, audit, privacy, non-repudiation |
 
@@ -94,6 +96,84 @@ Re-buckets `gen_ai.client.operation.duration`, `…time_to_first_chunk`,
 `…time_per_output_chunk`, `gen_ai.client.token.usage`, and the autotel
 `gen_ai.client.cost.usd` extension for LLM-shaped distributions.
 
+### Guard / budget (kill-switch)
+
+Most tracing tells you what an agent _did_, after the bill. A **guard** runs
+_during_ the run: feed it each step, it accumulates cost / tokens / loop state,
+and halts the run when a rule crosses its threshold — aborting an `AbortSignal`
+and (by default) throwing a `GEN_AI_GUARD_STOP` structured error.
+
+```ts
+import { createGenAiBudget } from 'autotel-genai/guard';
+import { estimateLLMCost } from 'autotel-genai/cost';
+
+const budget = createGenAiBudget({ maxCostUsd: 5, warnAtUsd: 4 });
+
+for (const task of tasks) {
+  if (budget.stopped) break;
+  const res = await model.chat(task);
+  budget.record(
+    { kind: 'llm', usage: { costUsd: estimateLLMCost('gpt-4o', res.usage) } },
+    ctx, // optional TraceContext → records gen_ai.guard.* + gen_ai.session.* telemetry
+  ); // throws once total cost > $5
+}
+```
+
+Rules can also come from a shorthand string — cost ceilings, token ceilings,
+spin-loop detection (`N identical calls in a window of M`), error loops,
+tool-call / step caps, wall-clock timeouts, and context-window budgets:
+
+```ts
+import { createGenAiGuard, parseGuardRules } from 'autotel-genai/guard';
+
+const guard = createGenAiGuard({
+  rules: parseGuardRules('budget:$2,loop:3/10,max-tools:50,timeout:5m'),
+});
+
+guard.record({ kind: 'tool', name: 'search', signature: JSON.stringify(args) });
+```
+
+Each rule fires once; `onStop` chooses `throw` (default), `abort` (signal only),
+or `silent` (record only). All logic is deterministic — no LLM in the loop.
+
+### Streaming performance
+
+Streaming latency is two numbers: **time to first chunk** (the wait before
+anything appears) and **throughput** (how fast tokens then arrive). A single
+duration hides both. `createStreamTimer` captures the full picture and records
+the headline values as `gen_ai.response.*` attributes.
+
+```ts
+import { createStreamTimer, recordStreamTiming } from 'autotel-genai/streaming';
+
+const timer = createStreamTimer();
+let text = '';
+for await (const chunk of stream) {
+  timer.chunk(); // first call also marks time-to-first-chunk
+  text += chunk;
+}
+recordStreamTiming(ctx, timer.finish({ outputTokens: countTokens(text) }));
+// → gen_ai.response.time_to_first_chunk / .time_to_finish /
+//   .output_tokens_per_second / .time_per_output_chunk (seconds)
+```
+
+`computeStreamTiming` is the pure function underneath (TTFC, total time, steady
+throughput, and an inter-chunk gap distribution `{min,p10,median,avg,p90,max}`).
+
+### Content capture & warnings
+
+`setGenAiContent` now gates input/output independently and base64-encodes binary
+(image/audio/file) parts instead of letting `JSON.stringify` corrupt them:
+
+```ts
+import { setGenAiContent, recordModelWarnings } from 'autotel-genai';
+
+setGenAiContent(ctx, { inputMessages, outputMessages },
+  { recordInputs: false, recordOutputs: true }); // keep prompts out of telemetry
+
+recordModelWarnings(ctx, result.warnings); // surface provider warnings vendors only log
+```
+
 ### Agents & tools
 
 ```ts
@@ -132,6 +212,57 @@ const canonical = mapAiSdkAttributes(span.attributes); // ai.* → gen_ai.*
 recordAiSdkCost(ctx, span.attributes);                 // sets gen_ai.usage.cost.usd
 ```
 
+### Observer (event-stream → spans)
+
+When you instrument a framework that emits its own lifecycle stream (agent
+runtimes, durable workflows) rather than wrapping calls with `traceGenAI`,
+subscribe an observer and feed every event through it. It rebuilds the span
+tree, estimates cost, and force-closes any child whose end never arrives:
+
+```ts
+import { createGenAiObserver } from 'autotel-genai/observer';
+
+const observe = createGenAiObserver({
+  // Content (messages, tool args/results) is omitted unless you opt in here.
+  exportContent: (event) => redact(event),
+});
+
+observe({ type: 'agent.start', id: 'a1', agent: { name: 'planner' } });
+observe({ type: 'chat.start', id: 'c1', parentId: 'a1',
+          request: { provider: 'openai', model: 'gpt-4o' } });
+observe({ type: 'chat.end', id: 'c1', response: { model: 'gpt-4o' },
+          usage: { inputTokens: 412, outputTokens: 87 } });
+observe({ type: 'agent.end', id: 'a1' }); // closes c1 too if it never ended
+```
+
+Token usage lands on leaf `chat` spans only — aggregate `agent`/`workflow`
+spans never carry `gen_ai.usage.*`, so summing usage across a trace counts each
+call exactly once.
+
+**Framework glue** ships with the observer:
+
+```ts
+import {
+  createGenAiObserver,
+  createLangChainObserver, // LangChain / LangGraph callback handler
+  observeAiSdkResult,      // Vercel AI SDK result walker
+} from 'autotel-genai/observer';
+
+const observe = createGenAiObserver();
+
+// LangChain / LangGraph — one handler, runId/parentRunId → span tree:
+await graph.invoke(input, { callbacks: [createLangChainObserver(observe)] });
+
+// Vercel AI SDK — walk a generateText/streamText result:
+observeAiSdkResult(observe, await generateText({ model, prompt }), {
+  id: 'gen-1',
+  provider: 'openai',
+  model: 'gpt-4o',
+});
+```
+
+See `apps/example-langchain-observer` for a runnable LangGraph + Ollama demo.
+
 ## Semantic conventions
 
 Aligned to the `semantic-conventions-genai` snapshot. Span names follow the

package/dist/agent/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_agent = require('../agent-eo4jY4Xg.cjs');
+const require_agent = require('../agent-CiG_LZL8.cjs');
 
 exports.AGENT_AUDIT_SCHEMA_VERSION = require_agent.AGENT_AUDIT_SCHEMA_VERSION;
 exports.canonicalizeForHash = require_agent.canonicalizeForHash;

package/dist/agent/index.d.cts

@@ -1,3 +1,3 @@
-import { $ as ToolCallMetadata, A as AgentAuditEventEnvelope, B as AgentSessionActionMetadata, C as flattenAgentAttributes, D as AgentActionMetadata, E as AgentActionFactory, F as AgentIdentityRecord, G as AiLifecycleStage, H as AgentSessionStatus, I as AgentIdentityRegistry, J as PolicyDecision, K as DelegationContext, L as AgentIdentityStatus, M as AgentEventKind, N as AgentHandler, O as AgentActionOptions, P as AgentIdentity, Q as ScopedToolDefinition, R as AgentMetadataInput, S as recordAgentHandoff, T as createAgentAuditMetadata, U as AgentToolCallActionMetadata, V as AgentSessionMetadata, W as AgentToolCallOptions, X as PrivacyProfile, Y as PolicyMetadata, Z as PrivacyProfileName, _ as withAgentAction, a as PrivacyProfileInput, at as AGENT_AUDIT_SCHEMA_VERSION, b as RecordAgentHandoffMetadata, c as ProvisionAgentIdentityInput, d as createAgentIdentityRegistry, et as ToolStatus, f as withAgentSession, g as recordPolicyDecision, h as recordDecisionBasis, i as verifyEventEnvelopeHash, it as hashPayload, j as AgentDecisionMetadata, k as AgentAiMetadata, l as RevokeAgentIdentityInput, m as defineAgentToolCall, n as CreateSignedEventEnvelopeOptions, nt as HashPayloadOptions, o as resolvePrivacyProfile, p as defineAgentAction, q as GovernanceMetadata, r as createSignedEventEnvelope, rt as canonicalizeForHash, s as sanitizeAuditPayload, t as withScopedTool, tt as AgentContext, u as RotateAgentIdentityInput, v as withAgentToolCall, w as setAgentAttributes, x as delegateToAgent, y as DelegateToAgentInput, z as AgentOutcome } from "../index-DtjGz80V.cjs";
+import { $ as ToolCallMetadata, A as AgentAuditEventEnvelope, B as AgentSessionActionMetadata, C as flattenAgentAttributes, D as AgentActionMetadata, E as AgentActionFactory, F as AgentIdentityRecord, G as AiLifecycleStage, H as AgentSessionStatus, I as AgentIdentityRegistry, J as PolicyDecision, K as DelegationContext, L as AgentIdentityStatus, M as AgentEventKind, N as AgentHandler, O as AgentActionOptions, P as AgentIdentity, Q as ScopedToolDefinition, R as AgentMetadataInput, S as recordAgentHandoff, T as createAgentAuditMetadata, U as AgentToolCallActionMetadata, V as AgentSessionMetadata, W as AgentToolCallOptions, X as PrivacyProfile, Y as PolicyMetadata, Z as PrivacyProfileName, _ as withAgentAction, a as PrivacyProfileInput, at as AGENT_AUDIT_SCHEMA_VERSION, b as RecordAgentHandoffMetadata, c as ProvisionAgentIdentityInput, d as createAgentIdentityRegistry, et as ToolStatus, f as withAgentSession, g as recordPolicyDecision, h as recordDecisionBasis, i as verifyEventEnvelopeHash, it as hashPayload, j as AgentDecisionMetadata, k as AgentAiMetadata, l as RevokeAgentIdentityInput, m as defineAgentToolCall, n as CreateSignedEventEnvelopeOptions, nt as HashPayloadOptions, o as resolvePrivacyProfile, p as defineAgentAction, q as GovernanceMetadata, r as createSignedEventEnvelope, rt as canonicalizeForHash, s as sanitizeAuditPayload, t as withScopedTool, tt as AgentContext, u as RotateAgentIdentityInput, v as withAgentToolCall, w as setAgentAttributes, x as delegateToAgent, y as DelegateToAgentInput, z as AgentOutcome } from "../index-DMz730Z-.cjs";
 import { a as TokenUsage, i as ModelPricing } from "../cost-DXTkBUUW.cjs";
 export { AGENT_AUDIT_SCHEMA_VERSION, type AgentActionFactory, type AgentActionMetadata, type AgentActionOptions, type AgentAiMetadata, type AgentAuditEventEnvelope, type AgentContext, type AgentDecisionMetadata, type AgentEventKind, type AgentHandler, type AgentIdentity, type AgentIdentityRecord, type AgentIdentityRegistry, type AgentIdentityStatus, type AgentMetadataInput, type AgentOutcome, type AgentSessionActionMetadata, type AgentSessionMetadata, type AgentSessionStatus, type AgentToolCallActionMetadata, type AgentToolCallOptions, type AiLifecycleStage, type CreateSignedEventEnvelopeOptions, type DelegateToAgentInput, type DelegationContext, type GovernanceMetadata, type HashPayloadOptions, type ModelPricing, type PolicyDecision, type PolicyMetadata, type PrivacyProfile, type PrivacyProfileInput, type PrivacyProfileName, type ProvisionAgentIdentityInput, type RecordAgentHandoffMetadata, type RevokeAgentIdentityInput, type RotateAgentIdentityInput, type ScopedToolDefinition, type TokenUsage, type ToolCallMetadata, type ToolStatus, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createSignedEventEnvelope, defineAgentAction, defineAgentToolCall, delegateToAgent, flattenAgentAttributes, hashPayload, recordAgentHandoff, recordDecisionBasis, recordPolicyDecision, resolvePrivacyProfile, sanitizeAuditPayload, setAgentAttributes, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };

package/dist/agent/index.d.ts

@@ -1,3 +1,3 @@
-import { $ as ToolCallMetadata, A as AgentAuditEventEnvelope, B as AgentSessionActionMetadata, C as flattenAgentAttributes, D as AgentActionMetadata, E as AgentActionFactory, F as AgentIdentityRecord, G as AiLifecycleStage, H as AgentSessionStatus, I as AgentIdentityRegistry, J as PolicyDecision, K as DelegationContext, L as AgentIdentityStatus, M as AgentEventKind, N as AgentHandler, O as AgentActionOptions, P as AgentIdentity, Q as ScopedToolDefinition, R as AgentMetadataInput, S as recordAgentHandoff, T as createAgentAuditMetadata, U as AgentToolCallActionMetadata, V as AgentSessionMetadata, W as AgentToolCallOptions, X as PrivacyProfile, Y as PolicyMetadata, Z as PrivacyProfileName, _ as withAgentAction, a as PrivacyProfileInput, at as AGENT_AUDIT_SCHEMA_VERSION, b as RecordAgentHandoffMetadata, c as ProvisionAgentIdentityInput, d as createAgentIdentityRegistry, et as ToolStatus, f as withAgentSession, g as recordPolicyDecision, h as recordDecisionBasis, i as verifyEventEnvelopeHash, it as hashPayload, j as AgentDecisionMetadata, k as AgentAiMetadata, l as RevokeAgentIdentityInput, m as defineAgentToolCall, n as CreateSignedEventEnvelopeOptions, nt as HashPayloadOptions, o as resolvePrivacyProfile, p as defineAgentAction, q as GovernanceMetadata, r as createSignedEventEnvelope, rt as canonicalizeForHash, s as sanitizeAuditPayload, t as withScopedTool, tt as AgentContext, u as RotateAgentIdentityInput, v as withAgentToolCall, w as setAgentAttributes, x as delegateToAgent, y as DelegateToAgentInput, z as AgentOutcome } from "../index-D1gH80Xd.js";
+import { $ as ToolCallMetadata, A as AgentAuditEventEnvelope, B as AgentSessionActionMetadata, C as flattenAgentAttributes, D as AgentActionMetadata, E as AgentActionFactory, F as AgentIdentityRecord, G as AiLifecycleStage, H as AgentSessionStatus, I as AgentIdentityRegistry, J as PolicyDecision, K as DelegationContext, L as AgentIdentityStatus, M as AgentEventKind, N as AgentHandler, O as AgentActionOptions, P as AgentIdentity, Q as ScopedToolDefinition, R as AgentMetadataInput, S as recordAgentHandoff, T as createAgentAuditMetadata, U as AgentToolCallActionMetadata, V as AgentSessionMetadata, W as AgentToolCallOptions, X as PrivacyProfile, Y as PolicyMetadata, Z as PrivacyProfileName, _ as withAgentAction, a as PrivacyProfileInput, at as AGENT_AUDIT_SCHEMA_VERSION, b as RecordAgentHandoffMetadata, c as ProvisionAgentIdentityInput, d as createAgentIdentityRegistry, et as ToolStatus, f as withAgentSession, g as recordPolicyDecision, h as recordDecisionBasis, i as verifyEventEnvelopeHash, it as hashPayload, j as AgentDecisionMetadata, k as AgentAiMetadata, l as RevokeAgentIdentityInput, m as defineAgentToolCall, n as CreateSignedEventEnvelopeOptions, nt as HashPayloadOptions, o as resolvePrivacyProfile, p as defineAgentAction, q as GovernanceMetadata, r as createSignedEventEnvelope, rt as canonicalizeForHash, s as sanitizeAuditPayload, t as withScopedTool, tt as AgentContext, u as RotateAgentIdentityInput, v as withAgentToolCall, w as setAgentAttributes, x as delegateToAgent, y as DelegateToAgentInput, z as AgentOutcome } from "../index-CedOJ0OP.js";
 import { a as TokenUsage, i as ModelPricing } from "../cost-DXTkBUUW.js";
 export { AGENT_AUDIT_SCHEMA_VERSION, type AgentActionFactory, type AgentActionMetadata, type AgentActionOptions, type AgentAiMetadata, type AgentAuditEventEnvelope, type AgentContext, type AgentDecisionMetadata, type AgentEventKind, type AgentHandler, type AgentIdentity, type AgentIdentityRecord, type AgentIdentityRegistry, type AgentIdentityStatus, type AgentMetadataInput, type AgentOutcome, type AgentSessionActionMetadata, type AgentSessionMetadata, type AgentSessionStatus, type AgentToolCallActionMetadata, type AgentToolCallOptions, type AiLifecycleStage, type CreateSignedEventEnvelopeOptions, type DelegateToAgentInput, type DelegationContext, type GovernanceMetadata, type HashPayloadOptions, type ModelPricing, type PolicyDecision, type PolicyMetadata, type PrivacyProfile, type PrivacyProfileInput, type PrivacyProfileName, type ProvisionAgentIdentityInput, type RecordAgentHandoffMetadata, type RevokeAgentIdentityInput, type RotateAgentIdentityInput, type ScopedToolDefinition, type TokenUsage, type ToolCallMetadata, type ToolStatus, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createSignedEventEnvelope, defineAgentAction, defineAgentToolCall, delegateToAgent, flattenAgentAttributes, hashPayload, recordAgentHandoff, recordDecisionBasis, recordPolicyDecision, resolvePrivacyProfile, sanitizeAuditPayload, setAgentAttributes, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };

package/dist/agent/index.js

@@ -1,3 +1,3 @@
-import { _ as setAgentAttributes, a as sanitizeAuditPayload, b as hashPayload, c as delegateToAgent, d as defineAgentToolCall, f as recordDecisionBasis, g as flattenAgentAttributes, h as withAgentToolCall, i as resolvePrivacyProfile, l as recordAgentHandoff, m as withAgentAction, n as createSignedEventEnvelope, o as createAgentIdentityRegistry, p as recordPolicyDecision, r as verifyEventEnvelopeHash, s as withAgentSession, t as withScopedTool, u as defineAgentAction, v as createAgentAuditMetadata, x as AGENT_AUDIT_SCHEMA_VERSION, y as canonicalizeForHash } from "../agent-CqXauTpC.js";
+import { _ as setAgentAttributes, a as sanitizeAuditPayload, b as hashPayload, c as delegateToAgent, d as defineAgentToolCall, f as recordDecisionBasis, g as flattenAgentAttributes, h as withAgentToolCall, i as resolvePrivacyProfile, l as recordAgentHandoff, m as withAgentAction, n as createSignedEventEnvelope, o as createAgentIdentityRegistry, p as recordPolicyDecision, r as verifyEventEnvelopeHash, s as withAgentSession, t as withScopedTool, u as defineAgentAction, v as createAgentAuditMetadata, x as AGENT_AUDIT_SCHEMA_VERSION, y as canonicalizeForHash } from "../agent-DZL-uNAc.js";
 
 export { AGENT_AUDIT_SCHEMA_VERSION, canonicalizeForHash, createAgentAuditMetadata, createAgentIdentityRegistry, createSignedEventEnvelope, defineAgentAction, defineAgentToolCall, delegateToAgent, flattenAgentAttributes, hashPayload, recordAgentHandoff, recordDecisionBasis, recordPolicyDecision, resolvePrivacyProfile, sanitizeAuditPayload, setAgentAttributes, verifyEventEnvelopeHash, withAgentAction, withAgentSession, withAgentToolCall, withScopedTool };

package/dist/{agent-eo4jY4Xg.cjs → agent-CiG_LZL8.cjs}

@@ -1,5 +1,5 @@
 const require_cost = require('./cost.cjs');
-const require_attributes = require('./attributes-DB35Boji.cjs');
+const require_attributes = require('./attributes-dxuRzqXC.cjs');
 let autotel = require("autotel");
 let node_crypto = require("node:crypto");
 let autotel_audit = require("autotel-audit");
@@ -1073,4 +1073,4 @@ Object.defineProperty(exports, 'withScopedTool', {
     return withScopedTool;
   }
 });
-//# sourceMappingURL=agent-eo4jY4Xg.cjs.map
+//# sourceMappingURL=agent-CiG_LZL8.cjs.map

package/dist/{agent-eo4jY4Xg.cjs.map → agent-CiG_LZL8.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"agent-eo4jY4Xg.cjs","names":["otelTrace","genAiRequestAttributes","genAiResponseAttributes","estimateLLMCost","genAiUsageAttributes","toIsoString","toIsoString","normalizeScopes"],"sources":["../src/agent/constants.ts","../src/agent/hash.ts","../src/agent/metadata.ts","../src/agent/context.ts","../src/agent/attributes.ts","../src/agent/runtime.ts","../src/agent/delegation.ts","../src/agent/session.ts","../src/agent/identity-registry.ts","../src/agent/privacy.ts","../src/agent/non-repudiation.ts","../src/agent/scoped-tool.ts"],"sourcesContent":["export const AGENT_AUDIT_SCHEMA_VERSION = '1.1.0';\n","import { createHash } from 'node:crypto';\n\nexport interface HashPayloadOptions {\n  algorithm?: 'sha256';\n}\n\nfunction canonicalize(value: unknown): unknown {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n\n  if (typeof value === 'bigint') {\n    return value.toString(10);\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((entry) => canonicalize(entry));\n  }\n\n  if (value && typeof value === 'object') {\n    // `toSorted()` would need ES2023 lib types; keep runtime output ES2022-friendly.\n    const entries = Object.entries(value as Record<string, unknown>);\n    entries.sort(([left], [right]) => left.localeCompare(right));\n    return Object.fromEntries(\n      entries.map(([key, entryValue]) => [key, canonicalize(entryValue)]),\n    );\n  }\n\n  return value;\n}\n\nexport function canonicalizeForHash(value: unknown): string {\n  return JSON.stringify(canonicalize(value));\n}\n\nexport function hashPayload(\n  value: unknown,\n  options: HashPayloadOptions = {},\n): string {\n  const algorithm = options.algorithm ?? 'sha256';\n  const canonical = canonicalizeForHash(value);\n  const digest = createHash(algorithm).update(canonical).digest('hex');\n  return `${algorithm}:${digest}`;\n}\n","import { AGENT_AUDIT_SCHEMA_VERSION } from './constants.js';\nimport { hashPayload } from './hash.js';\nimport type {\n  AgentActionMetadata,\n  AgentDecisionMetadata,\n  AgentEventKind,\n  GovernanceMetadata,\n  ToolCallMetadata,\n} from './types.js';\n\ninterface AuditMetadataLike {\n  action: string;\n  resource?: string;\n  actorId?: string;\n  category?: string;\n  outcome?: string;\n  [key: string]: unknown;\n}\n\nexport function defaultEventKind(\n  metadata: AgentActionMetadata,\n): AgentEventKind {\n  if (metadata.eventKind) return metadata.eventKind;\n  if (metadata.tool) return 'tool_call';\n  if (metadata.policy) return 'policy_decision';\n  return 'action';\n}\n\nexport function normalizeTool(\n  tool?: ToolCallMetadata,\n): ToolCallMetadata | undefined {\n  if (!tool) return undefined;\n\n  return {\n    name: tool.name,\n    ...(tool.callId !== undefined && { callId: tool.callId }),\n    inputHash:\n      tool.input === undefined\n        ? tool.inputHash\n        : (tool.inputHash ?? hashPayload(tool.input)),\n    outputHash:\n      tool.output === undefined\n        ? tool.outputHash\n        : (tool.outputHash ?? hashPayload(tool.output)),\n    ...(tool.status !== undefined && { status: tool.status }),\n    ...(tool.executionMs !== undefined && { executionMs: tool.executionMs }),\n  };\n}\n\nexport function sanitizeTool(\n  tool?: ToolCallMetadata,\n): ToolCallMetadata | undefined {\n  if (!tool) return undefined;\n\n  return {\n    name: tool.name,\n    ...(tool.callId !== undefined && { callId: tool.callId }),\n    ...(tool.inputHash !== undefined && { inputHash: tool.inputHash }),\n    ...(tool.outputHash !== undefined && { outputHash: tool.outputHash }),\n    ...(tool.status !== undefined && { status: tool.status }),\n    ...(tool.executionMs !== undefined && { executionMs: tool.executionMs }),\n  };\n}\n\nexport function sanitizeGovernance(\n  governance?: GovernanceMetadata,\n): GovernanceMetadata | undefined {\n  if (!governance) return undefined;\n  return {\n    ...(governance.reviewRequired !== undefined && {\n      reviewRequired: governance.reviewRequired,\n    }),\n    ...(governance.reviewerId !== undefined && {\n      reviewerId: governance.reviewerId,\n    }),\n    ...(governance.controlId !== undefined && {\n      controlId: governance.controlId,\n    }),\n    ...(governance.documentationUrl !== undefined && {\n      documentationUrl: governance.documentationUrl,\n    }),\n    ...(governance.lifecycleStage !== undefined && {\n      lifecycleStage: governance.lifecycleStage,\n    }),\n    ...(governance.framework !== undefined && {\n      framework: governance.framework,\n    }),\n  };\n}\n\nfunction normalizeDecision(\n  decision?: AgentDecisionMetadata,\n  reasoningSummary?: string,\n): AgentDecisionMetadata | undefined {\n  if (decision) {\n    return {\n      ...decision,\n      summary: decision.summary ?? reasoningSummary ?? '',\n    };\n  }\n\n  if (reasoningSummary === undefined) return undefined;\n\n  return {\n    summary: reasoningSummary,\n  };\n}\n\nexport function createAgentAuditMetadata(\n  metadata: AgentActionMetadata,\n): AgentActionMetadata {\n  const eventKind = defaultEventKind(metadata);\n\n  if (eventKind === 'tool_call' && !metadata.tool) {\n    throw new Error(\n      '[autotel-genai] eventKind \"tool_call\" requires metadata.tool.',\n    );\n  }\n\n  if (eventKind === 'policy_decision' && !metadata.policy) {\n    throw new Error(\n      '[autotel-genai] eventKind \"policy_decision\" requires metadata.policy.',\n    );\n  }\n\n  if (eventKind === 'handoff' && !metadata.delegation) {\n    throw new Error(\n      '[autotel-genai] eventKind \"handoff\" requires metadata.delegation.',\n    );\n  }\n\n  const delegation =\n    metadata.delegation &&\n    (\n      metadata.delegation.authorityLineageHash === undefined ||\n      metadata.delegation.depth === undefined\n    )\n      ? {\n          ...metadata.delegation,\n          ...(metadata.delegation.authorityLineage && {\n            authorityLineageHash:\n              metadata.delegation.authorityLineageHash ??\n              hashPayload(metadata.delegation.authorityLineage),\n            depth:\n              metadata.delegation.depth ??\n              Math.max(metadata.delegation.authorityLineage.length - 1, 0),\n          }),\n        }\n      : metadata.delegation;\n\n  return {\n    ...metadata,\n    schemaVersion: metadata.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n    eventKind,\n    decision: normalizeDecision(metadata.decision, metadata.reasoningSummary),\n    ...(delegation !== undefined && { delegation }),\n  };\n}\n\nexport function normalizeMetadata(\n  metadata: AgentActionMetadata,\n): AgentActionMetadata {\n  const normalized = createAgentAuditMetadata(metadata);\n  return {\n    ...normalized,\n    tool: normalizeTool(normalized.tool),\n  };\n}\n\nexport function buildAuditMetadata(\n  metadata: AgentActionMetadata,\n): AuditMetadataLike {\n  return {\n    action: metadata.action,\n    ...(metadata.resource !== undefined && { resource: metadata.resource }),\n    actorId:\n      metadata.actorId ??\n      metadata.delegation?.parentIdentity ??\n      metadata.agent.id,\n    category: metadata.category ?? 'agent',\n    ...(metadata.outcome !== undefined && { outcome: metadata.outcome }),\n    agentId: metadata.agent.id,\n    agentEventKind: metadata.eventKind,\n    agentAuditVersion: metadata.schemaVersion,\n    ...(metadata.agent.version !== undefined && {\n      agentVersion: metadata.agent.version,\n    }),\n    ...(metadata.tool?.name !== undefined && { toolName: metadata.tool.name }),\n    ...(metadata.policy?.decision !== undefined && {\n      policyDecision: metadata.policy.decision,\n    }),\n    ...(metadata.session?.status !== undefined && {\n      sessionStatus: metadata.session.status,\n    }),\n  };\n}\n\nexport function buildLoggerContext(\n  metadata: AgentActionMetadata,\n): Record<string, unknown> {\n  const tool = sanitizeTool(metadata.tool);\n  const governance = sanitizeGovernance(metadata.governance);\n\n  const context: Record<string, unknown> = {\n    agent: {\n      ...metadata.agent,\n      ...(metadata.resource !== undefined && { resource: metadata.resource }),\n      ...(metadata.outcome !== undefined && { outcome: metadata.outcome }),\n      ...(metadata.reasoningSummary !== undefined && {\n        reasoningSummary: metadata.reasoningSummary,\n      }),\n      schemaVersion: metadata.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n      eventKind: metadata.eventKind ?? defaultEventKind(metadata),\n    },\n    ...(metadata.delegation !== undefined && {\n      delegation: metadata.delegation,\n    }),\n    ...(tool !== undefined && { tool }),\n    ...(metadata.policy !== undefined && { policy: metadata.policy }),\n    ...(governance !== undefined && { governance }),\n    ...(metadata.session !== undefined && { session: metadata.session }),\n    ...(metadata.decision !== undefined && { decision: metadata.decision }),\n  };\n\n  // Hand the request logger an independent copy. `logger.set()` deep-merges and\n  // intentionally *concatenates* array fields across calls (autotel wide-event\n  // semantics). Agent lifecycles call `.set()` more than once per action with\n  // the same `delegation`/`decision` objects, so sharing references would let\n  // the merge mutate arrays (e.g. `authority_lineage`) in place — which would\n  // then leak onto the span via `setAgentAttributes`. Cloning keeps the\n  // span-bound metadata pristine.\n  return structuredClone(context);\n}\n\n/**\n * Context for the *completion* `logger.set()` of a specialized lifecycle\n * wrapper. Carries only the domain state that finished mutating — tool or\n * session status. Outcome is owned by `withAgentAction`, which wraps every\n * variant and stamps it on both span and log. This deliberately omits the\n * request-level `delegation`/`decision` blocks: those were set once at the\n * start, and re-sending them would concatenate their array fields into the\n * wide event (see `buildLoggerContext`).\n */\nexport function buildLifecycleUpdateContext(\n  metadata: AgentActionMetadata,\n): Record<string, unknown> {\n  const tool = sanitizeTool(metadata.tool);\n  return {\n    ...(tool !== undefined && { tool }),\n    ...(metadata.session !== undefined && {\n      session: structuredClone(metadata.session),\n    }),\n  };\n}\n","import { getTraceContext, otelTrace } from 'autotel';\n\nexport interface AgentContext {\n  traceId: string;\n  spanId: string;\n  correlationId: string;\n  setAttribute(key: string, value: string | number | boolean): void;\n  setAttributes(\n    attrs: Record<string, string | number | boolean | string[] | number[] | boolean[]>,\n  ): void;\n}\n\nexport const MISSING_CONTEXT_MESSAGE =\n  '[autotel-genai] No active trace context. Wrap the call in trace()/instrument(), pass options.ctx, ' +\n  'or set options.onMissingContext to \"warn\"/\"skip\" to degrade gracefully instead of throwing.';\n\n/**\n * Resolve an agent context without throwing. Returns `null` when no trace context\n * is available, so callers can degrade gracefully (best-effort instrumentation).\n */\nconst INVALID_TRACE_ID = '00000000000000000000000000000000';\n\nexport function resolveContextSafe(ctx?: AgentContext): AgentContext | null {\n  if (ctx) return ctx;\n\n  const span = otelTrace.getActiveSpan();\n  if (!span) return null;\n\n  // Resolve trace ids from autotel's context when available, otherwise from the\n  // active OTel span itself. This makes agent audit work in *any* OTel setup —\n  // @effect/opentelemetry, a vanilla NodeSDK, autotel-cloudflare's instrumented\n  // fetch handler — not just inside autotel's own `trace()`.\n  const ids = getTraceContext();\n  const sc = span.spanContext();\n  const traceId = ids?.traceId ?? sc.traceId;\n  if (!traceId || traceId === INVALID_TRACE_ID) return null;\n\n  return {\n    traceId,\n    spanId: ids?.spanId ?? sc.spanId,\n    correlationId: ids?.correlationId ?? traceId.slice(0, 16),\n    setAttribute: (key, value) => span.setAttribute(key, value),\n    setAttributes: (attrs) => span.setAttributes(attrs),\n  };\n}\n\nexport function resolveContext(ctx?: AgentContext): AgentContext {\n  const resolved = resolveContextSafe(ctx);\n  if (resolved) return resolved;\n  throw new Error(MISSING_CONTEXT_MESSAGE);\n}\n\nconst warnedMissingContext = new Set<string>();\n\n/** Warn (once per action) that an agent action is running without a trace context. */\nexport function warnMissingContextOnce(action: string): void {\n  if (warnedMissingContext.has(action)) return;\n  warnedMissingContext.add(action);\n  console.warn(\n    `[autotel-genai] No active trace context for \"${action}\" — running un-audited. ` +\n      'Wrap the call in trace()/instrument() or pass options.ctx to capture agent audit telemetry. ' +\n      '(set options.onMissingContext: \"throw\" to fail fast, or \"skip\" to silence this warning)',\n  );\n}\n\n/** A no-op {@link AgentContext} whose attribute setters do nothing. */\nexport function noopAgentContext(): AgentContext {\n  return {\n    traceId: '',\n    spanId: '',\n    correlationId: '',\n    setAttribute() {},\n    setAttributes() {},\n  };\n}\n\nexport function toAttributeValue(\n  value: unknown,\n): string | number | boolean | string[] | number[] | boolean[] | undefined {\n  if (\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  ) {\n    return value;\n  }\n\n  if (Array.isArray(value)) {\n    if (value.every((entry) => typeof entry === 'string')) {\n      return value;\n    }\n\n    if (value.every((entry) => typeof entry === 'number')) {\n      return value;\n    }\n\n    if (value.every((entry) => typeof entry === 'boolean')) {\n      return value;\n    }\n\n    try {\n      return JSON.stringify(value);\n    } catch {\n      return '<serialization-failed>';\n    }\n  }\n\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n\n  if (typeof value === 'bigint') {\n    return value.toString(10);\n  }\n\n  if (value === null || value === undefined) {\n    return undefined;\n  }\n\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return '<serialization-failed>';\n  }\n}\n","import { AGENT_AUDIT_SCHEMA_VERSION } from './constants.js';\nimport { resolveContext, toAttributeValue, type AgentContext } from './context.js';\nimport { defaultEventKind, normalizeMetadata } from './metadata.js';\nimport type {\n  AgentActionMetadata,\n  AgentDecisionMetadata,\n  AgentIdentity,\n  AgentSessionMetadata,\n  DelegationContext,\n  GovernanceMetadata,\n  PolicyMetadata,\n  ToolCallMetadata,\n} from './types.js';\n\ntype AttributeValue =\n  | string\n  | number\n  | boolean\n  | string[]\n  | number[]\n  | boolean[];\n\ntype AttributeMap = Record<string, AttributeValue>;\n\nfunction setIfPresent(target: AttributeMap, key: string, value: unknown): void {\n  const attr = toAttributeValue(value);\n  if (attr !== undefined) {\n    target[key] = attr;\n  }\n}\n\nfunction appendIdentityAttributes(attrs: AttributeMap, agent: AgentIdentity): void {\n  setIfPresent(attrs, 'agent.id', agent.id);\n  setIfPresent(attrs, 'agent.version', agent.version);\n  setIfPresent(attrs, 'agent.framework', agent.framework);\n  setIfPresent(attrs, 'agent.model', agent.model);\n  setIfPresent(attrs, 'agent.role', agent.role);\n  setIfPresent(attrs, 'agent.session.id', agent.sessionId);\n  setIfPresent(attrs, 'agent.conversation.id', agent.conversationId);\n}\n\nfunction appendDelegationAttributes(\n  attrs: AttributeMap,\n  delegation?: DelegationContext,\n): void {\n  if (!delegation) return;\n  setIfPresent(attrs, 'delegation.parent_identity', delegation.parentIdentity);\n  setIfPresent(attrs, 'delegation.scope', delegation.scope);\n  setIfPresent(attrs, 'delegation.token_id', delegation.tokenId);\n  setIfPresent(attrs, 'delegation.id', delegation.delegationId);\n  setIfPresent(attrs, 'delegation.authority_lineage', delegation.authorityLineage);\n  setIfPresent(\n    attrs,\n    'delegation.authority_lineage_hash',\n    delegation.authorityLineageHash,\n  );\n  setIfPresent(attrs, 'delegation.depth', delegation.depth);\n  setIfPresent(attrs, 'delegation.issued_at', delegation.issuedAt);\n  setIfPresent(attrs, 'delegation.expires_at', delegation.expiresAt);\n}\n\nfunction appendToolAttributes(attrs: AttributeMap, tool?: ToolCallMetadata): void {\n  if (!tool) return;\n  setIfPresent(attrs, 'tool.name', tool.name);\n  setIfPresent(attrs, 'tool.call.id', tool.callId);\n  setIfPresent(attrs, 'tool.input_hash', tool.inputHash);\n  setIfPresent(attrs, 'tool.output_hash', tool.outputHash);\n  setIfPresent(attrs, 'tool.status', tool.status);\n  setIfPresent(attrs, 'tool.execution_ms', tool.executionMs);\n}\n\nfunction appendPolicyAttributes(attrs: AttributeMap, policy?: PolicyMetadata): void {\n  if (!policy) return;\n  setIfPresent(attrs, 'policy.decision', policy.decision);\n  setIfPresent(attrs, 'policy.id', policy.policyId);\n  setIfPresent(attrs, 'policy.risk_score', policy.riskScore);\n  setIfPresent(attrs, 'policy.reason', policy.reason);\n}\n\nfunction appendGovernanceAttributes(\n  attrs: AttributeMap,\n  governance?: GovernanceMetadata,\n): void {\n  if (!governance) return;\n  setIfPresent(attrs, 'governance.review_required', governance.reviewRequired);\n  setIfPresent(attrs, 'governance.reviewer_id', governance.reviewerId);\n  setIfPresent(attrs, 'governance.control_id', governance.controlId);\n  setIfPresent(attrs, 'governance.documentation_url', governance.documentationUrl);\n  setIfPresent(attrs, 'governance.lifecycle_stage', governance.lifecycleStage);\n  setIfPresent(attrs, 'governance.framework', governance.framework);\n}\n\nfunction appendSessionAttributes(\n  attrs: AttributeMap,\n  session?: AgentSessionMetadata,\n): void {\n  if (!session) return;\n  setIfPresent(attrs, 'agent.session.status', session.status);\n  setIfPresent(attrs, 'agent.session.started_at', session.startedAt);\n  setIfPresent(attrs, 'agent.session.ended_at', session.endedAt);\n  setIfPresent(attrs, 'agent.session.delegated_by', session.delegatedBy);\n}\n\nfunction appendDecisionAttributes(\n  attrs: AttributeMap,\n  decision?: AgentDecisionMetadata,\n): void {\n  if (!decision) return;\n  setIfPresent(attrs, 'decision.summary', decision.summary);\n  setIfPresent(attrs, 'decision.input_hash', decision.inputHash);\n  setIfPresent(attrs, 'decision.policy_ids', decision.policyIds);\n  setIfPresent(attrs, 'decision.justification_codes', decision.justificationCodes);\n  setIfPresent(attrs, 'decision.evidence_ids', decision.evidenceIds);\n  setIfPresent(attrs, 'decision.review_required', decision.reviewRequired);\n  setIfPresent(attrs, 'decision.confidence', decision.confidence);\n}\n\nexport function flattenAgentAttributes(\n  metadata: AgentActionMetadata,\n): AttributeMap {\n  const normalized = normalizeMetadata(metadata);\n  const attrs: AttributeMap = {\n    'autotel.agent': true,\n    'agent.action': normalized.action,\n    'agent.audit.version':\n      normalized.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n    'agent.event.kind': normalized.eventKind ?? defaultEventKind(normalized),\n  };\n\n  setIfPresent(attrs, 'agent.resource', normalized.resource);\n  setIfPresent(attrs, 'agent.outcome', normalized.outcome);\n  setIfPresent(attrs, 'reasoning.summary', normalized.reasoningSummary);\n  appendIdentityAttributes(attrs, normalized.agent);\n  appendDelegationAttributes(attrs, normalized.delegation);\n  appendToolAttributes(attrs, normalized.tool);\n  appendPolicyAttributes(attrs, normalized.policy);\n  appendGovernanceAttributes(attrs, normalized.governance);\n  appendSessionAttributes(attrs, normalized.session);\n  appendDecisionAttributes(attrs, normalized.decision);\n\n  return attrs;\n}\n\nexport function setAgentAttributes(\n  metadata: AgentActionMetadata,\n  ctx?: AgentContext,\n): void {\n  const traceCtx = resolveContext(ctx);\n  traceCtx.setAttributes(flattenAgentAttributes(metadata));\n}\n\n/**\n * Stamp only the terminal outcome on the active span. Used by lifecycle\n * wrappers on completion so they don't re-flatten (and clobber) richer state a\n * nested step already wrote — e.g. a tool call's `tool.status=complete`.\n */\nexport function setAgentOutcome(\n  outcome: AgentActionMetadata['outcome'] & string,\n  ctx?: AgentContext,\n): void {\n  resolveContext(ctx).setAttribute('agent.outcome', outcome);\n}\n","import {\n  createNoopRequestLogger,\n  getRequestLoggerSafe,\n  type RequestLogger,\n} from 'autotel';\nimport { forceKeepAuditEvent, withAudit } from 'autotel-audit';\nimport { estimateLLMCost, type TokenUsage } from '../cost.js';\nimport {\n  genAiRequestAttributes,\n  genAiResponseAttributes,\n  genAiUsageAttributes,\n  type GenAiAttributeMap,\n} from '../attributes.js';\nimport { setAgentAttributes, setAgentOutcome } from './attributes.js';\nimport {\n  buildLoggerContext,\n  buildLifecycleUpdateContext,\n  buildAuditMetadata,\n  normalizeMetadata,\n} from './metadata.js';\nimport {\n  MISSING_CONTEXT_MESSAGE,\n  resolveContextSafe,\n  warnMissingContextOnce,\n  type AgentContext,\n} from './context.js';\nimport { hashPayload } from './hash.js';\nimport type {\n  AgentActionFactory,\n  AgentActionMetadata,\n  AgentAiMetadata,\n  AgentActionOptions,\n  AgentHandler,\n  AgentMetadataInput,\n  AgentToolCallActionMetadata,\n  AgentToolCallOptions,\n  ToolCallMetadata,\n} from './types.js';\n\n/**\n * Record canonical OpenTelemetry GenAI semantic attributes for an LLM-backed\n * agent action, reusing the local cost model. Best-effort: anything unknown is\n * simply omitted. `gen_ai.request.model` is always recorded; token counts and\n * the estimated `gen_ai.usage.cost.usd` are recorded when `usage` is available\n * (up front via metadata, or post-call via `options.extractUsage`).\n *\n * Emits canonical v1.42.0 keys only — no `gen_ai.usage.total_tokens` (not a\n * registry attribute) and no legacy `gen.ai.*` names.\n */\nfunction recordAiTelemetry(\n  ctx: AgentContext,\n  ai: AgentAiMetadata,\n  usage?: TokenUsage,\n): void {\n  const attrs: GenAiAttributeMap = {\n    ...genAiRequestAttributes({\n      operation: ai.operation,\n      provider: ai.provider,\n      model: ai.model,\n    }),\n    ...genAiResponseAttributes({\n      model: ai.responseModel,\n      id: ai.responseId,\n      finishReasons: ai.finishReasons,\n    }),\n  };\n  if (usage) {\n    const cost = estimateLLMCost(\n      ai.model,\n      usage,\n      ai.pricing ? { pricing: ai.pricing } : undefined,\n    );\n    Object.assign(attrs, genAiUsageAttributes({ ...usage, costUsd: cost }));\n  }\n  ctx.setAttributes(attrs);\n}\n\nexport async function withAgentAction<T>(\n  metadata: AgentActionMetadata,\n  fn: AgentHandler<T>,\n  options: AgentActionOptions = {},\n): Promise<T> {\n  const normalized = normalizeMetadata(metadata);\n\n  return withAudit(\n    buildAuditMetadata(normalized),\n    async (ctx: AgentContext, logger: RequestLogger) => {\n      setAgentAttributes(normalized, ctx);\n      logger.set(buildLoggerContext(normalized));\n\n      try {\n        const result = await fn(ctx as AgentContext, logger);\n        const outcome = normalized.outcome ?? 'success';\n        setAgentOutcome(outcome, ctx);\n        logger.set({ agent: { outcome } });\n        if (normalized.ai) {\n          recordAiTelemetry(\n            ctx,\n            normalized.ai,\n            options.extractUsage?.(result) ?? normalized.ai.usage,\n          );\n        }\n        return result;\n      } catch (error) {\n        setAgentOutcome('failure', ctx);\n        logger.set({ agent: { outcome: 'failure' } });\n        if (normalized.ai) recordAiTelemetry(ctx, normalized.ai);\n        throw error;\n      }\n    },\n    options,\n  );\n}\n\nexport function recordPolicyDecision(\n  metadata: AgentActionMetadata,\n  options: AgentActionOptions = {},\n): void {\n  const normalized = normalizeMetadata(metadata);\n  const traceCtx = resolveContextSafe(options.ctx);\n\n  // No trace context: degrade per onMissingContext instead of throwing into\n  // business logic. A policy decision we couldn't record is not worth a crash.\n  if (!traceCtx) {\n    const mode = options.onMissingContext ?? 'warn';\n    if (mode === 'throw') {\n      throw new Error(MISSING_CONTEXT_MESSAGE);\n    }\n    if (mode === 'warn') {\n      warnMissingContextOnce(normalized.action);\n    }\n    return;\n  }\n\n  const logger =\n    options.logger ?? getRequestLoggerSafe() ?? createNoopRequestLogger();\n\n  if (options.forceKeep !== false) {\n    forceKeepAuditEvent(traceCtx);\n  }\n\n  setAgentAttributes(normalized, traceCtx);\n  logger.set(buildLoggerContext(normalized));\n\n  if (options.emitNow) {\n    logger.emitNow();\n  }\n}\n\nexport function recordDecisionBasis(\n  metadata: AgentActionMetadata,\n  options: AgentActionOptions = {},\n): void {\n  if (!metadata.decision && !metadata.reasoningSummary) {\n    throw new Error(\n      '[autotel-genai] recordDecisionBasis requires metadata.decision or metadata.reasoningSummary.',\n    );\n  }\n\n  recordPolicyDecision(metadata, options);\n}\n\n/**\n * Define a reusable, instrumented agent action — the `trace()`-style factory\n * companion to `withAgentAction`. Declare it once at module scope and call the\n * returned function many times; each call opens its own audit scope.\n *\n * `metadata` may be a static object or a function of the call arguments, so\n * call-specific fields can be derived per invocation.\n *\n * @example\n * ```ts\n * const planTrip = defineAgentAction(\n *   (req: TripRequest) => ({\n *     action: 'agent.trip.plan',\n *     agent: { id: 'planner' },\n *     delegation: { parentIdentity: req.userId, scope: ['trip:plan'] },\n *   }),\n *   (ctx) => async (req: TripRequest) => planItinerary(req),\n * );\n *\n * await planTrip({ userId: 'usr_1', destination: 'Lisbon' });\n * ```\n */\nexport function defineAgentAction<TArgs extends unknown[], TResult>(\n  metadata: AgentMetadataInput<TArgs, AgentActionMetadata>,\n  factory: AgentActionFactory<TArgs, TResult>,\n  options: AgentActionOptions = {},\n): (...args: TArgs) => Promise<TResult> {\n  return (...args: TArgs): Promise<TResult> => {\n    const resolved =\n      typeof metadata === 'function' ? metadata(...args) : metadata;\n    return withAgentAction(\n      resolved,\n      (ctx, logger) => factory(ctx, logger)(...args),\n      options,\n    );\n  };\n}\n\n/**\n * Define a reusable, instrumented agent tool call — the `trace()`-style factory\n * companion to `withAgentToolCall`. Declare it once and call it per invocation;\n * tool inputs/results are hashed (never attached raw) on every call.\n *\n * Pass `metadata` as a function of the arguments when `tool.input` (or any other\n * field) depends on the call, so each invocation hashes its own input.\n *\n * @example\n * ```ts\n * const handleRefund = defineAgentToolCall(\n *   (req: RefundRequest) => ({\n *     action: 'agent.refund.tool_call',\n *     resource: 'stripe_refund_v3',\n *     agent: { id: 'refunds-specialist' },\n *     tool: { name: 'stripe_refund_v3', input: { refundId: req.refundId } },\n *   }),\n *   (ctx) => async (req: RefundRequest) => stripe.refunds.create(req),\n * );\n *\n * await handleRefund({ refundId: 're_123' });\n * ```\n */\nexport function defineAgentToolCall<TArgs extends unknown[], TResult>(\n  metadata: AgentMetadataInput<TArgs, AgentToolCallActionMetadata>,\n  factory: AgentActionFactory<TArgs, TResult>,\n  options: AgentToolCallOptions = {},\n): (...args: TArgs) => Promise<TResult> {\n  return (...args: TArgs): Promise<TResult> => {\n    const resolved =\n      typeof metadata === 'function' ? metadata(...args) : metadata;\n    return withAgentToolCall(\n      resolved,\n      (ctx, logger) => factory(ctx, logger)(...args),\n      options,\n    );\n  };\n}\n\nexport async function withAgentToolCall<T>(\n  metadata: AgentActionMetadata & { tool: ToolCallMetadata },\n  fn: AgentHandler<T>,\n  options: AgentToolCallOptions = {},\n): Promise<T> {\n  const start = Date.now();\n  const normalized = normalizeMetadata({\n    ...metadata,\n    tool: {\n      ...metadata.tool,\n      status: metadata.tool?.status ?? 'planned',\n    } as ToolCallMetadata,\n  });\n\n  return withAgentAction(\n    normalized,\n    async (ctx, logger) => {\n      try {\n        const result = await fn(ctx, logger);\n        const executionMs = Date.now() - start;\n        const completed: AgentActionMetadata = {\n          ...normalized,\n          outcome: normalized.outcome ?? 'success',\n          tool: {\n            ...metadata.tool,\n            inputHash: normalized.tool?.inputHash,\n            outputHash:\n              normalized.tool?.outputHash ??\n              (options.hashResult === false ? undefined : hashPayload(result)),\n            status: 'complete',\n            executionMs,\n          },\n        };\n        setAgentAttributes(completed, ctx);\n        logger.set(buildLifecycleUpdateContext(normalizeMetadata(completed)));\n        return result;\n      } catch (error) {\n        const failed: AgentActionMetadata = {\n          ...normalized,\n          outcome: 'failure',\n          tool: {\n            ...metadata.tool,\n            inputHash: normalized.tool?.inputHash,\n            status: 'error',\n            executionMs: Date.now() - start,\n          },\n        };\n        setAgentAttributes(failed, ctx);\n        logger.set(buildLifecycleUpdateContext(normalizeMetadata(failed)));\n        throw error;\n      }\n    },\n    options,\n  );\n}\n","import { hashPayload } from './hash.js';\nimport { recordPolicyDecision } from './runtime.js';\nimport type {\n  AgentActionOptions,\n  AgentIdentity,\n  DelegationContext,\n  GovernanceMetadata,\n} from './types.js';\n\nfunction buildAuthorityLineage(\n  parentIdentity: string,\n  agentId: string,\n  existingLineage?: string[],\n): string[] {\n  const lineage = existingLineage ? [...existingLineage] : [parentIdentity];\n  if (lineage.at(-1) !== agentId) {\n    lineage.push(agentId);\n  }\n  return lineage;\n}\n\nexport interface DelegateToAgentInput {\n  parentIdentity: string;\n  targetAgentId: string;\n  scope?: string | string[];\n  tokenId?: string;\n  delegationId?: string;\n  authorityLineage?: string[];\n  issuedAt?: string | Date;\n  expiresAt?: string | Date;\n}\n\nexport interface RecordAgentHandoffMetadata {\n  action: string;\n  fromAgent: AgentIdentity;\n  toAgent: AgentIdentity;\n  parentIdentity: string;\n  resource?: string;\n  scope?: string | string[];\n  tokenId?: string;\n  delegationId?: string;\n  authorityLineage?: string[];\n  governance?: GovernanceMetadata;\n}\n\nexport function delegateToAgent(input: DelegateToAgentInput): DelegationContext {\n  const authorityLineage = buildAuthorityLineage(\n    input.parentIdentity,\n    input.targetAgentId,\n    input.authorityLineage,\n  );\n\n  return {\n    parentIdentity: input.parentIdentity,\n    ...(input.scope !== undefined && { scope: input.scope }),\n    ...(input.tokenId !== undefined && { tokenId: input.tokenId }),\n    ...(input.delegationId !== undefined && { delegationId: input.delegationId }),\n    authorityLineage,\n    authorityLineageHash: hashPayload(authorityLineage),\n    depth: Math.max(authorityLineage.length - 1, 0),\n    issuedAt: input.issuedAt ?? new Date().toISOString(),\n    ...(input.expiresAt !== undefined && { expiresAt: input.expiresAt }),\n  };\n}\n\nexport function recordAgentHandoff(\n  metadata: RecordAgentHandoffMetadata,\n  options: AgentActionOptions = {},\n): void {\n  // Seed the lineage with the source agent when the caller didn't supply one,\n  // so the \"from\" side of the handoff is recorded in the canonical, queryable\n  // `delegation.authority_lineage` (and its hash) rather than surviving only in\n  // the free-text reasoningSummary.\n  const authorityLineage =\n    metadata.authorityLineage ?? [metadata.parentIdentity, metadata.fromAgent.id];\n\n  const delegation = delegateToAgent({\n    parentIdentity: metadata.parentIdentity,\n    targetAgentId: metadata.toAgent.id,\n    scope: metadata.scope,\n    tokenId: metadata.tokenId,\n    delegationId: metadata.delegationId,\n    authorityLineage,\n  });\n\n  recordPolicyDecision(\n    {\n      action: metadata.action,\n      resource: metadata.resource,\n      eventKind: 'handoff',\n      agent: metadata.toAgent,\n      delegation,\n      governance: metadata.governance,\n      reasoningSummary: `Control passed from ${metadata.fromAgent.id} to ${metadata.toAgent.id}.`,\n    },\n    options,\n  );\n}\n","import { buildLifecycleUpdateContext } from './metadata.js';\nimport { setAgentAttributes } from './attributes.js';\nimport { withAgentAction } from './runtime.js';\nimport type {\n  AgentActionOptions,\n  AgentHandler,\n  AgentSessionActionMetadata,\n} from './types.js';\n\nfunction toIsoString(value?: string | Date): string {\n  if (!value) return new Date().toISOString();\n  return value instanceof Date ? value.toISOString() : value;\n}\n\nexport async function withAgentSession<T>(\n  metadata: AgentSessionActionMetadata,\n  fn: AgentHandler<T>,\n  options: AgentActionOptions = {},\n): Promise<T> {\n  const startedAt = toIsoString(metadata.session?.startedAt);\n\n  return withAgentAction(\n    {\n      ...metadata,\n      category: metadata.category ?? 'agent_session',\n      session: {\n        ...metadata.session,\n        status: metadata.session?.status ?? 'active',\n        startedAt,\n      },\n    },\n    async (ctx, logger) => {\n      try {\n        const result = await fn(ctx, logger);\n        const completed = {\n          ...metadata,\n          outcome: metadata.outcome ?? 'success',\n          session: {\n            ...metadata.session,\n            status: 'completed' as const,\n            startedAt,\n            endedAt: new Date().toISOString(),\n          },\n        };\n        setAgentAttributes(completed, ctx);\n        logger.set(buildLifecycleUpdateContext(completed));\n        return result;\n      } catch (error) {\n        const failed = {\n          ...metadata,\n          outcome: 'failure' as const,\n          session: {\n            ...metadata.session,\n            status: 'failed' as const,\n            startedAt,\n            endedAt: new Date().toISOString(),\n          },\n        };\n        setAgentAttributes(failed, ctx);\n        logger.set(buildLifecycleUpdateContext(failed));\n        throw error;\n      }\n    },\n    options,\n  );\n}\n","import { hashPayload } from './hash.js';\nimport { delegateToAgent } from './delegation.js';\nimport type {\n  AgentIdentity,\n  AgentIdentityRegistry,\n  AgentIdentityRecord,\n  AgentIdentityStatus,\n  DelegationContext,\n} from './types.js';\n\nfunction toIsoString(value?: string | Date): string | undefined {\n  if (!value) return undefined;\n  return value instanceof Date ? value.toISOString() : value;\n}\n\nfunction normalizeScopes(scope?: string | string[]): string[] {\n  if (!scope) return [];\n  return Array.isArray(scope) ? [...scope] : [scope];\n}\n\nfunction isExpired(record: AgentIdentityRecord, at: string): boolean {\n  return record.expiresAt !== undefined && record.expiresAt < at;\n}\n\nexport interface ProvisionAgentIdentityInput {\n  agent: AgentIdentity;\n  scopes?: string[];\n  tokenId?: string;\n  delegatedBy?: string;\n  provisionedAt?: string | Date;\n  expiresAt?: string | Date;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface RotateAgentIdentityInput {\n  scopes?: string[];\n  tokenId?: string;\n  delegatedBy?: string;\n  rotatedAt?: string | Date;\n  expiresAt?: string | Date;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface RevokeAgentIdentityInput {\n  reason: string;\n  revokedAt?: string | Date;\n}\n\nexport function createAgentIdentityRegistry(\n  initial: ProvisionAgentIdentityInput[] = [],\n): AgentIdentityRegistry {\n  const records = new Map<string, AgentIdentityRecord>();\n\n  const provisionIdentity = (\n    input: ProvisionAgentIdentityInput,\n  ): AgentIdentityRecord => {\n    const now = toIsoString(input.provisionedAt) ?? new Date().toISOString();\n    const record: AgentIdentityRecord = {\n      agent: input.agent,\n      scopes: input.scopes ?? [],\n      status: 'active',\n      tokenId: input.tokenId,\n      tokenHash:\n        input.tokenId === undefined ? undefined : hashPayload(input.tokenId),\n      delegatedBy: input.delegatedBy,\n      provisionedAt: now,\n      expiresAt: toIsoString(input.expiresAt),\n      metadata: input.metadata,\n    };\n    records.set(input.agent.id, record);\n    return record;\n  };\n\n  for (const item of initial) {\n    provisionIdentity(item);\n  }\n\n  return {\n    provisionIdentity,\n    rotateIdentity(agentId: string, input: RotateAgentIdentityInput = {}) {\n      const existing = records.get(agentId);\n      if (!existing) {\n        throw new Error(\n          `[autotel-genai] Cannot rotate unknown agent identity \"${agentId}\".`,\n        );\n      }\n\n      const rotatedAt = toIsoString(input.rotatedAt) ?? new Date().toISOString();\n      const record: AgentIdentityRecord = {\n        ...existing,\n        scopes: input.scopes ?? existing.scopes,\n        status: 'rotated',\n        tokenId: input.tokenId ?? existing.tokenId,\n        tokenHash:\n          input.tokenId === undefined\n            ? existing.tokenHash\n            : hashPayload(input.tokenId),\n        delegatedBy: input.delegatedBy ?? existing.delegatedBy,\n        rotatedAt,\n        expiresAt: toIsoString(input.expiresAt) ?? existing.expiresAt,\n        metadata: input.metadata ?? existing.metadata,\n      };\n      records.set(agentId, record);\n      return record;\n    },\n    revokeIdentity(agentId: string, input: RevokeAgentIdentityInput) {\n      const existing = records.get(agentId);\n      if (!existing) {\n        throw new Error(\n          `[autotel-genai] Cannot revoke unknown agent identity \"${agentId}\".`,\n        );\n      }\n\n      const revokedAt = toIsoString(input.revokedAt) ?? new Date().toISOString();\n      const record: AgentIdentityRecord = {\n        ...existing,\n        status: 'revoked',\n        revokedAt,\n        revocationReason: input.reason,\n      };\n      records.set(agentId, record);\n      return record;\n    },\n    getIdentity(agentId: string) {\n      return records.get(agentId);\n    },\n    getIdentityStatus(agentId: string, at = new Date().toISOString()) {\n      const record = records.get(agentId);\n      if (!record) return;\n      return isExpired(record, at) ? 'expired' : record.status;\n    },\n    assertUsable(agentId: string, at = new Date().toISOString()) {\n      const record = records.get(agentId);\n      if (!record) {\n        throw new Error(\n          `[autotel-genai] Unknown agent identity \"${agentId}\". Provision it before use.`,\n        );\n      }\n\n      const status: AgentIdentityStatus = isExpired(record, at)\n        ? 'expired'\n        : record.status;\n\n      if (status !== 'active' && status !== 'rotated') {\n        throw new Error(\n          `[autotel-genai] Agent identity \"${agentId}\" is ${status} and cannot execute delegated work.`,\n        );\n      }\n\n      return record;\n    },\n    assertScopes(agentId: string, requiredScopes: string[]) {\n      const record = this.assertUsable(agentId);\n      const missing = requiredScopes.filter(\n        (scope) => !record.scopes.includes(scope),\n      );\n\n      if (missing.length > 0) {\n        throw new Error(\n          `[autotel-genai] Agent identity \"${agentId}\" is missing delegated scopes: ${missing.join(', ')}.`,\n        );\n      }\n\n      return record;\n    },\n    issueDelegation(agentId: string, input) {\n      const record = this.assertUsable(agentId);\n      const scope = normalizeScopes(input.scope);\n      if (scope.length > 0) {\n        this.assertScopes(agentId, scope);\n      }\n\n      return delegateToAgent({\n        parentIdentity: input.parentIdentity,\n        targetAgentId: record.agent.id,\n        scope: input.scope ?? record.scopes,\n        tokenId: input.tokenId ?? record.tokenId,\n        delegationId: input.delegationId,\n        authorityLineage: input.authorityLineage,\n        issuedAt: input.issuedAt,\n        expiresAt: input.expiresAt ?? record.expiresAt,\n      }) satisfies DelegationContext;\n    },\n    list() {\n      return [...records.values()];\n    },\n  };\n}\n","import { hashPayload } from './hash.js';\nimport type { PrivacyProfile, PrivacyProfileName } from './types.js';\n\nexport type PrivacyProfileInput = PrivacyProfileName | PrivacyProfile;\n\nconst PRIVACY_PROFILES: Record<PrivacyProfileName, PrivacyProfile> = {\n  strict: {\n    name: 'strict',\n    hashKeys: [\n      /email/i,\n      /phone/i,\n      /user_?id/i,\n      /account/i,\n      /customer/i,\n      /card/i,\n      /iban/i,\n      /tax/i,\n    ],\n    dropKeys: [\n      /secret/i,\n      /token/i,\n      /api[_-]?key/i,\n      /authorization/i,\n      /cookie/i,\n      /password/i,\n      /bearer/i,\n    ],\n    maskKeys: [/name/i, /address/i, /prompt/i, /message/i, /content/i],\n    maxStringLength: 256,\n  },\n  pci: {\n    name: 'pci',\n    hashKeys: [/card/i, /pan/i, /account/i, /customer/i, /email/i],\n    dropKeys: [/cvv/i, /cvc/i, /secret/i, /token/i, /api[_-]?key/i],\n    maskKeys: [/name/i, /address/i],\n    maxStringLength: 128,\n  },\n  healthcare: {\n    name: 'healthcare',\n    hashKeys: [/patient/i, /mrn/i, /member/i, /email/i, /phone/i],\n    dropKeys: [/diagnosis/i, /notes/i, /secret/i, /token/i, /password/i],\n    maskKeys: [/name/i, /address/i, /symptom/i],\n    maxStringLength: 128,\n  },\n};\n\nfunction maskValue(value: unknown): unknown {\n  if (typeof value !== 'string') {\n    return '<masked>';\n  }\n\n  if (value.length <= 6) return '***';\n  return `${value.slice(0, 3)}***${value.slice(-3)}`;\n}\n\nfunction matches(patterns: RegExp[] | undefined, key: string): boolean {\n  return patterns?.some((pattern) => pattern.test(key)) ?? false;\n}\n\nfunction truncateString(value: string, maxLength?: number): string {\n  if (maxLength === undefined || value.length <= maxLength) {\n    return value;\n  }\n\n  return `${value.slice(0, maxLength)}…`;\n}\n\nfunction sanitizeNode(\n  value: unknown,\n  profile: PrivacyProfile,\n  keyPath: string,\n): unknown {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n\n  const lowered = keyPath.toLowerCase();\n\n  if (matches(profile.dropKeys, lowered)) {\n    return '<redacted>';\n  }\n\n  if (matches(profile.hashKeys, lowered)) {\n    return hashPayload(value);\n  }\n\n  if (matches(profile.maskKeys, lowered)) {\n    return maskValue(value);\n  }\n\n  if (typeof value === 'string') {\n    return truncateString(value, profile.maxStringLength);\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((entry, index) =>\n      sanitizeNode(entry, profile, `${keyPath}[${index}]`),\n    );\n  }\n\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>).map(([key, entry]) => [\n        key,\n        sanitizeNode(entry, profile, keyPath ? `${keyPath}.${key}` : key),\n      ]),\n    );\n  }\n\n  if (typeof value === 'bigint') {\n    return value.toString(10);\n  }\n\n  return value;\n}\n\nexport function resolvePrivacyProfile(\n  profile: PrivacyProfileInput = 'strict',\n): PrivacyProfile {\n  return typeof profile === 'string' ? PRIVACY_PROFILES[profile] : profile;\n}\n\nexport function sanitizeAuditPayload(\n  value: unknown,\n  profile: PrivacyProfileInput = 'strict',\n): unknown {\n  return sanitizeNode(value, resolvePrivacyProfile(profile), '');\n}\n","import { AGENT_AUDIT_SCHEMA_VERSION } from './constants.js';\nimport { canonicalizeForHash, hashPayload } from './hash.js';\nimport { normalizeMetadata } from './metadata.js';\nimport { sanitizeAuditPayload, type PrivacyProfileInput } from './privacy.js';\nimport type {\n  AgentActionMetadata,\n  AgentAuditEventEnvelope,\n} from './types.js';\n\nfunction toIsoString(value?: string | Date): string {\n  if (!value) return new Date().toISOString();\n  return value instanceof Date ? value.toISOString() : value;\n}\n\nexport interface CreateSignedEventEnvelopeOptions {\n  emittedAt?: string | Date;\n  previousEventHash?: string;\n  evidence?: unknown;\n  privacyProfile?: PrivacyProfileInput;\n  signer?: (serialized: string) => string | Promise<string>;\n}\n\nexport async function createSignedEventEnvelope(\n  metadata: AgentActionMetadata,\n  options: CreateSignedEventEnvelopeOptions = {},\n): Promise<AgentAuditEventEnvelope> {\n  const normalized = normalizeMetadata(metadata);\n  const envelopeBase = {\n    schemaVersion: normalized.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n    emittedAt: toIsoString(options.emittedAt),\n    ...(options.previousEventHash !== undefined && {\n      previousEventHash: options.previousEventHash,\n    }),\n    metadata: normalized,\n    ...(options.evidence !== undefined && {\n      evidence: sanitizeAuditPayload(\n        options.evidence,\n        options.privacyProfile ?? 'strict',\n      ),\n    }),\n  };\n\n  const eventHash = hashPayload(envelopeBase);\n  const signature = options.signer\n    ? await options.signer(canonicalizeForHash(envelopeBase))\n    : undefined;\n\n  return {\n    ...envelopeBase,\n    eventHash,\n    ...(signature !== undefined && { signature }),\n  };\n}\n\nexport function verifyEventEnvelopeHash(\n  envelope: AgentAuditEventEnvelope,\n): boolean {\n  const expected = hashPayload({\n    schemaVersion: envelope.schemaVersion,\n    emittedAt: envelope.emittedAt,\n    ...(envelope.previousEventHash !== undefined && {\n      previousEventHash: envelope.previousEventHash,\n    }),\n    metadata: envelope.metadata,\n    ...(envelope.evidence !== undefined && {\n      evidence: envelope.evidence,\n    }),\n  });\n  return envelope.eventHash === expected;\n}\n","import { createStructuredError } from 'autotel';\nimport { sanitizeAuditPayload, type PrivacyProfileInput } from './privacy.js';\nimport { recordDecisionBasis, recordPolicyDecision, withAgentToolCall } from './runtime.js';\nimport { hashPayload } from './hash.js';\nimport type {\n  AgentActionOptions,\n  AgentDecisionMetadata,\n  AgentHandler,\n  AgentToolCallOptions,\n  DelegationContext,\n  GovernanceMetadata,\n  PolicyMetadata,\n  ScopedToolDefinition,\n} from './types.js';\n\nfunction normalizeScopes(scope?: string | string[]): string[] {\n  if (!scope) return [];\n  return Array.isArray(scope) ? scope : [scope];\n}\n\nfunction missingScopes(\n  delegated: string[],\n  required: string[],\n): string[] {\n  return required.filter((scope) => !delegated.includes(scope));\n}\n\ninterface ScopeDenial {\n  scopes: string[];\n  reason: string;\n  why: string;\n}\n\n/**\n * Decide whether a scoped tool call must be denied.\n *\n * When the identity is registry-backed, the registry is authoritative: a\n * delegation may only *narrow* the stored grant, never widen it. Scopes a\n * caller claims that the registry never granted are a forged escalation and are\n * denied before any missing-scope check — otherwise passing an explicit\n * `delegation.scope` could grant access the registry record does not allow.\n */\nfunction resolveScopeDenial(\n  claimedScopes: string[],\n  requiredScopes: string[],\n  registryScopes: string[] | undefined,\n): ScopeDenial | undefined {\n  const unauthorized = registryScopes\n    ? claimedScopes.filter((scope) => !registryScopes.includes(scope))\n    : [];\n  if (unauthorized.length > 0) {\n    return {\n      scopes: unauthorized,\n      reason: `unauthorized_scope:${unauthorized.join(',')}`,\n      why: `Delegation claims scopes the identity was never granted: ${unauthorized.join(', ')}`,\n    };\n  }\n\n  const missing = missingScopes(claimedScopes, requiredScopes);\n  if (missing.length > 0) {\n    return {\n      scopes: missing,\n      reason: `missing_scope:${missing.join(',')}`,\n      why: `Missing delegated scopes: ${missing.join(', ')}`,\n    };\n  }\n\n  return undefined;\n}\n\nfunction resolveDelegation(\n  definition: Pick<ScopedToolDefinition<unknown>, 'agent' | 'delegation' | 'identityRegistry'>,\n): DelegationContext | undefined {\n  const registry = definition.identityRegistry;\n  if (registry) {\n    registry.assertUsable(definition.agent.id);\n  }\n\n  return definition.delegation;\n}\n\nfunction buildGovernance(\n  governance: GovernanceMetadata | undefined,\n  reviewRequired: boolean | undefined,\n): GovernanceMetadata | undefined {\n  if (!governance && reviewRequired === undefined) return governance;\n  return {\n    ...governance,\n    ...(reviewRequired !== undefined && { reviewRequired }),\n  };\n}\n\nfunction buildDecision(\n  input: unknown,\n  decision: AgentDecisionMetadata | undefined,\n  privacyProfile: PrivacyProfileInput | undefined,\n): AgentDecisionMetadata | undefined {\n  if (!decision) return undefined;\n\n  const sanitizedInput = sanitizeAuditPayload(input, privacyProfile ?? 'strict');\n  return {\n    ...decision,\n    inputHash: decision.inputHash ?? hashPayload(sanitizedInput),\n  };\n}\n\nexport async function withScopedTool<TInput, TOutput>(\n  definition: ScopedToolDefinition<TInput>,\n  input: TInput,\n  fn: AgentHandler<TOutput>,\n  options: AgentToolCallOptions & AgentActionOptions = {},\n): Promise<TOutput> {\n  const requiredScopes = definition.requiredScopes ?? [];\n  const delegation = resolveDelegation(definition);\n  const registryScopes = definition.identityRegistry?.getIdentity(\n    definition.agent.id,\n  )?.scopes;\n  const claimedScopes = normalizeScopes(delegation?.scope ?? registryScopes);\n  const denial = resolveScopeDenial(\n    claimedScopes,\n    requiredScopes,\n    registryScopes,\n  );\n  const policy: PolicyMetadata | undefined =\n    definition.policyId || definition.riskScore !== undefined || denial\n      ? {\n          decision: denial ? 'deny' : 'permit',\n          ...(definition.policyId !== undefined && {\n            policyId: definition.policyId,\n          }),\n          ...(definition.riskScore !== undefined && {\n            riskScore: definition.riskScore,\n          }),\n          ...(denial && { reason: denial.reason }),\n        }\n      : undefined;\n\n  const governance = buildGovernance(\n    definition.governance,\n    definition.reviewRequired,\n  );\n\n  if (policy && policy.decision === 'deny' && denial) {\n    recordPolicyDecision(\n      {\n        action: definition.action,\n        resource: definition.resource ?? definition.tool.name,\n        category: definition.category,\n        agent: definition.agent,\n        delegation,\n        policy,\n        governance,\n        decision: buildDecision(\n          input,\n          definition.decision,\n          definition.privacyProfile,\n        ),\n      },\n      options,\n    );\n\n    throw createStructuredError({\n      status: 403,\n      code: 'AGENT_SCOPE_DENIED',\n      message: `Agent \"${definition.agent.id}\" cannot invoke ${definition.tool.name}.`,\n      why: denial.why,\n      fix: 'Grant the missing scopes or route the task to an agent with the required delegation.',\n    });\n  }\n\n  if (policy) {\n    recordPolicyDecision(\n      {\n        action: `${definition.action}.policy`,\n        resource: definition.resource ?? definition.tool.name,\n        category: definition.category,\n        agent: definition.agent,\n        delegation,\n        policy,\n        governance,\n      },\n      options,\n    );\n  }\n\n  if (definition.decision) {\n    recordDecisionBasis(\n      {\n        action: `${definition.action}.decision`,\n        resource: definition.resource ?? definition.tool.name,\n        category: definition.category,\n        agent: definition.agent,\n        delegation,\n        governance,\n        decision: buildDecision(\n          input,\n          definition.decision,\n          definition.privacyProfile,\n        ),\n      },\n      options,\n    );\n  }\n\n  return withAgentToolCall(\n    {\n      action: definition.action,\n      resource: definition.resource ?? definition.tool.name,\n      category: definition.category,\n      agent: definition.agent,\n      delegation,\n      governance,\n      tool: {\n        ...definition.tool,\n        input,\n      },\n    },\n    fn,\n    options,\n  );\n}\n"],"mappings":";;;;;;;AAAA,MAAa,6BAA6B;;;;ACM1C,SAAS,aAAa,OAAyB;CAC7C,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAG3B,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,SAAS,EAAE;CAG1B,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,UAAU,aAAa,KAAK,CAAC;CAGjD,IAAI,SAAS,OAAO,UAAU,UAAU;EAEtC,MAAM,UAAU,OAAO,QAAQ,KAAgC;EAC/D,QAAQ,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC;EAC3D,OAAO,OAAO,YACZ,QAAQ,KAAK,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAAa,UAAU,CAAC,CAAC,CACpE;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAwB;CAC1D,OAAO,KAAK,UAAU,aAAa,KAAK,CAAC;AAC3C;AAEA,SAAgB,YACd,OACA,UAA8B,CAAC,GACvB;CACR,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,YAAY,oBAAoB,KAAK;CAE3C,OAAO,GAAG,UAAU,+BADM,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAClC;AAC9B;;;;ACxBA,SAAgB,iBACd,UACgB;CAChB,IAAI,SAAS,WAAW,OAAO,SAAS;CACxC,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,SAAS,QAAQ,OAAO;CAC5B,OAAO;AACT;AAEA,SAAgB,cACd,MAC8B;CAC9B,IAAI,CAAC,MAAM,OAAO;CAElB,OAAO;EACL,MAAM,KAAK;EACX,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,WACE,KAAK,UAAU,SACX,KAAK,YACJ,KAAK,aAAa,YAAY,KAAK,KAAK;EAC/C,YACE,KAAK,WAAW,SACZ,KAAK,aACJ,KAAK,cAAc,YAAY,KAAK,MAAM;EACjD,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,GAAI,KAAK,gBAAgB,UAAa,EAAE,aAAa,KAAK,YAAY;CACxE;AACF;AAEA,SAAgB,aACd,MAC8B;CAC9B,IAAI,CAAC,MAAM,OAAO;CAElB,OAAO;EACL,MAAM,KAAK;EACX,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;EAChE,GAAI,KAAK,eAAe,UAAa,EAAE,YAAY,KAAK,WAAW;EACnE,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,GAAI,KAAK,gBAAgB,UAAa,EAAE,aAAa,KAAK,YAAY;CACxE;AACF;AAEA,SAAgB,mBACd,YACgC;CAChC,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO;EACL,GAAI,WAAW,mBAAmB,UAAa,EAC7C,gBAAgB,WAAW,eAC7B;EACA,GAAI,WAAW,eAAe,UAAa,EACzC,YAAY,WAAW,WACzB;EACA,GAAI,WAAW,cAAc,UAAa,EACxC,WAAW,WAAW,UACxB;EACA,GAAI,WAAW,qBAAqB,UAAa,EAC/C,kBAAkB,WAAW,iBAC/B;EACA,GAAI,WAAW,mBAAmB,UAAa,EAC7C,gBAAgB,WAAW,eAC7B;EACA,GAAI,WAAW,cAAc,UAAa,EACxC,WAAW,WAAW,UACxB;CACF;AACF;AAEA,SAAS,kBACP,UACA,kBACmC;CACnC,IAAI,UACF,OAAO;EACL,GAAG;EACH,SAAS,SAAS,WAAW,oBAAoB;CACnD;CAGF,IAAI,qBAAqB,QAAW,OAAO;CAE3C,OAAO,EACL,SAAS,iBACX;AACF;AAEA,SAAgB,yBACd,UACqB;CACrB,MAAM,YAAY,iBAAiB,QAAQ;CAE3C,IAAI,cAAc,eAAe,CAAC,SAAS,MACzC,MAAM,IAAI,MACR,iEACF;CAGF,IAAI,cAAc,qBAAqB,CAAC,SAAS,QAC/C,MAAM,IAAI,MACR,yEACF;CAGF,IAAI,cAAc,aAAa,CAAC,SAAS,YACvC,MAAM,IAAI,MACR,qEACF;CAGF,MAAM,aACJ,SAAS,eAEP,SAAS,WAAW,yBAAyB,UAC7C,SAAS,WAAW,UAAU,UAE5B;EACE,GAAG,SAAS;EACZ,GAAI,SAAS,WAAW,oBAAoB;GAC1C,sBACE,SAAS,WAAW,wBACpB,YAAY,SAAS,WAAW,gBAAgB;GAClD,OACE,SAAS,WAAW,SACpB,KAAK,IAAI,SAAS,WAAW,iBAAiB,SAAS,GAAG,CAAC;EAC/D;CACF,IACA,SAAS;CAEf,OAAO;EACL,GAAG;EACH,eAAe,SAAS;EACxB;EACA,UAAU,kBAAkB,SAAS,UAAU,SAAS,gBAAgB;EACxE,GAAI,eAAe,UAAa,EAAE,WAAW;CAC/C;AACF;AAEA,SAAgB,kBACd,UACqB;CACrB,MAAM,aAAa,yBAAyB,QAAQ;CACpD,OAAO;EACL,GAAG;EACH,MAAM,cAAc,WAAW,IAAI;CACrC;AACF;AAEA,SAAgB,mBACd,UACmB;CACnB,OAAO;EACL,QAAQ,SAAS;EACjB,GAAI,SAAS,aAAa,UAAa,EAAE,UAAU,SAAS,SAAS;EACrE,SACE,SAAS,WACT,SAAS,YAAY,kBACrB,SAAS,MAAM;EACjB,UAAU,SAAS,YAAY;EAC/B,GAAI,SAAS,YAAY,UAAa,EAAE,SAAS,SAAS,QAAQ;EAClE,SAAS,SAAS,MAAM;EACxB,gBAAgB,SAAS;EACzB,mBAAmB,SAAS;EAC5B,GAAI,SAAS,MAAM,YAAY,UAAa,EAC1C,cAAc,SAAS,MAAM,QAC/B;EACA,GAAI,SAAS,MAAM,SAAS,UAAa,EAAE,UAAU,SAAS,KAAK,KAAK;EACxE,GAAI,SAAS,QAAQ,aAAa,UAAa,EAC7C,gBAAgB,SAAS,OAAO,SAClC;EACA,GAAI,SAAS,SAAS,WAAW,UAAa,EAC5C,eAAe,SAAS,QAAQ,OAClC;CACF;AACF;AAEA,SAAgB,mBACd,UACyB;CACzB,MAAM,OAAO,aAAa,SAAS,IAAI;CACvC,MAAM,aAAa,mBAAmB,SAAS,UAAU;CAEzD,MAAM,UAAmC;EACvC,OAAO;GACL,GAAG,SAAS;GACZ,GAAI,SAAS,aAAa,UAAa,EAAE,UAAU,SAAS,SAAS;GACrE,GAAI,SAAS,YAAY,UAAa,EAAE,SAAS,SAAS,QAAQ;GAClE,GAAI,SAAS,qBAAqB,UAAa,EAC7C,kBAAkB,SAAS,iBAC7B;GACA,eAAe,SAAS;GACxB,WAAW,SAAS,aAAa,iBAAiB,QAAQ;EAC5D;EACA,GAAI,SAAS,eAAe,UAAa,EACvC,YAAY,SAAS,WACvB;EACA,GAAI,SAAS,UAAa,EAAE,KAAK;EACjC,GAAI,SAAS,WAAW,UAAa,EAAE,QAAQ,SAAS,OAAO;EAC/D,GAAI,eAAe,UAAa,EAAE,WAAW;EAC7C,GAAI,SAAS,YAAY,UAAa,EAAE,SAAS,SAAS,QAAQ;EAClE,GAAI,SAAS,aAAa,UAAa,EAAE,UAAU,SAAS,SAAS;CACvE;CASA,OAAO,gBAAgB,OAAO;AAChC;;;;;;;;;;AAWA,SAAgB,4BACd,UACyB;CACzB,MAAM,OAAO,aAAa,SAAS,IAAI;CACvC,OAAO;EACL,GAAI,SAAS,UAAa,EAAE,KAAK;EACjC,GAAI,SAAS,YAAY,UAAa,EACpC,SAAS,gBAAgB,SAAS,OAAO,EAC3C;CACF;AACF;;;;ACjPA,MAAa,0BACX;;;;;AAOF,MAAM,mBAAmB;AAEzB,SAAgB,mBAAmB,KAAyC;CAC1E,IAAI,KAAK,OAAO;CAEhB,MAAM,OAAOA,kBAAU,cAAc;CACrC,IAAI,CAAC,MAAM,OAAO;CAMlB,MAAM,mCAAsB;CAC5B,MAAM,KAAK,KAAK,YAAY;CAC5B,MAAM,UAAU,KAAK,WAAW,GAAG;CACnC,IAAI,CAAC,WAAW,YAAY,kBAAkB,OAAO;CAErD,OAAO;EACL;EACA,QAAQ,KAAK,UAAU,GAAG;EAC1B,eAAe,KAAK,iBAAiB,QAAQ,MAAM,GAAG,EAAE;EACxD,eAAe,KAAK,UAAU,KAAK,aAAa,KAAK,KAAK;EAC1D,gBAAgB,UAAU,KAAK,cAAc,KAAK;CACpD;AACF;AAEA,SAAgB,eAAe,KAAkC;CAC/D,MAAM,WAAW,mBAAmB,GAAG;CACvC,IAAI,UAAU,OAAO;CACrB,MAAM,IAAI,MAAM,uBAAuB;AACzC;AAEA,MAAM,uCAAuB,IAAI,IAAY;;AAG7C,SAAgB,uBAAuB,QAAsB;CAC3D,IAAI,qBAAqB,IAAI,MAAM,GAAG;CACtC,qBAAqB,IAAI,MAAM;CAC/B,QAAQ,KACN,gDAAgD,OAAO,4MAGzD;AACF;AAaA,SAAgB,iBACd,OACyE;CACzE,IACE,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,WAEjB,OAAO;CAGT,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,IAAI,MAAM,OAAO,UAAU,OAAO,UAAU,QAAQ,GAClD,OAAO;EAGT,IAAI,MAAM,OAAO,UAAU,OAAO,UAAU,QAAQ,GAClD,OAAO;EAGT,IAAI,MAAM,OAAO,UAAU,OAAO,UAAU,SAAS,GACnD,OAAO;EAGT,IAAI;GACF,OAAO,KAAK,UAAU,KAAK;EAC7B,QAAQ;GACN,OAAO;EACT;CACF;CAEA,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAG3B,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,SAAS,EAAE;CAG1B,IAAI,UAAU,QAAQ,UAAU,QAC9B;CAGF,IAAI;EACF,OAAO,KAAK,UAAU,KAAK;CAC7B,QAAQ;EACN,OAAO;CACT;AACF;;;;ACpGA,SAAS,aAAa,QAAsB,KAAa,OAAsB;CAC7E,MAAM,OAAO,iBAAiB,KAAK;CACnC,IAAI,SAAS,QACX,OAAO,OAAO;AAElB;AAEA,SAAS,yBAAyB,OAAqB,OAA4B;CACjF,aAAa,OAAO,YAAY,MAAM,EAAE;CACxC,aAAa,OAAO,iBAAiB,MAAM,OAAO;CAClD,aAAa,OAAO,mBAAmB,MAAM,SAAS;CACtD,aAAa,OAAO,eAAe,MAAM,KAAK;CAC9C,aAAa,OAAO,cAAc,MAAM,IAAI;CAC5C,aAAa,OAAO,oBAAoB,MAAM,SAAS;CACvD,aAAa,OAAO,yBAAyB,MAAM,cAAc;AACnE;AAEA,SAAS,2BACP,OACA,YACM;CACN,IAAI,CAAC,YAAY;CACjB,aAAa,OAAO,8BAA8B,WAAW,cAAc;CAC3E,aAAa,OAAO,oBAAoB,WAAW,KAAK;CACxD,aAAa,OAAO,uBAAuB,WAAW,OAAO;CAC7D,aAAa,OAAO,iBAAiB,WAAW,YAAY;CAC5D,aAAa,OAAO,gCAAgC,WAAW,gBAAgB;CAC/E,aACE,OACA,qCACA,WAAW,oBACb;CACA,aAAa,OAAO,oBAAoB,WAAW,KAAK;CACxD,aAAa,OAAO,wBAAwB,WAAW,QAAQ;CAC/D,aAAa,OAAO,yBAAyB,WAAW,SAAS;AACnE;AAEA,SAAS,qBAAqB,OAAqB,MAA+B;CAChF,IAAI,CAAC,MAAM;CACX,aAAa,OAAO,aAAa,KAAK,IAAI;CAC1C,aAAa,OAAO,gBAAgB,KAAK,MAAM;CAC/C,aAAa,OAAO,mBAAmB,KAAK,SAAS;CACrD,aAAa,OAAO,oBAAoB,KAAK,UAAU;CACvD,aAAa,OAAO,eAAe,KAAK,MAAM;CAC9C,aAAa,OAAO,qBAAqB,KAAK,WAAW;AAC3D;AAEA,SAAS,uBAAuB,OAAqB,QAA+B;CAClF,IAAI,CAAC,QAAQ;CACb,aAAa,OAAO,mBAAmB,OAAO,QAAQ;CACtD,aAAa,OAAO,aAAa,OAAO,QAAQ;CAChD,aAAa,OAAO,qBAAqB,OAAO,SAAS;CACzD,aAAa,OAAO,iBAAiB,OAAO,MAAM;AACpD;AAEA,SAAS,2BACP,OACA,YACM;CACN,IAAI,CAAC,YAAY;CACjB,aAAa,OAAO,8BAA8B,WAAW,cAAc;CAC3E,aAAa,OAAO,0BAA0B,WAAW,UAAU;CACnE,aAAa,OAAO,yBAAyB,WAAW,SAAS;CACjE,aAAa,OAAO,gCAAgC,WAAW,gBAAgB;CAC/E,aAAa,OAAO,8BAA8B,WAAW,cAAc;CAC3E,aAAa,OAAO,wBAAwB,WAAW,SAAS;AAClE;AAEA,SAAS,wBACP,OACA,SACM;CACN,IAAI,CAAC,SAAS;CACd,aAAa,OAAO,wBAAwB,QAAQ,MAAM;CAC1D,aAAa,OAAO,4BAA4B,QAAQ,SAAS;CACjE,aAAa,OAAO,0BAA0B,QAAQ,OAAO;CAC7D,aAAa,OAAO,8BAA8B,QAAQ,WAAW;AACvE;AAEA,SAAS,yBACP,OACA,UACM;CACN,IAAI,CAAC,UAAU;CACf,aAAa,OAAO,oBAAoB,SAAS,OAAO;CACxD,aAAa,OAAO,uBAAuB,SAAS,SAAS;CAC7D,aAAa,OAAO,uBAAuB,SAAS,SAAS;CAC7D,aAAa,OAAO,gCAAgC,SAAS,kBAAkB;CAC/E,aAAa,OAAO,yBAAyB,SAAS,WAAW;CACjE,aAAa,OAAO,4BAA4B,SAAS,cAAc;CACvE,aAAa,OAAO,uBAAuB,SAAS,UAAU;AAChE;AAEA,SAAgB,uBACd,UACc;CACd,MAAM,aAAa,kBAAkB,QAAQ;CAC7C,MAAM,QAAsB;EAC1B,iBAAiB;EACjB,gBAAgB,WAAW;EAC3B,uBACE,WAAW;EACb,oBAAoB,WAAW,aAAa,iBAAiB,UAAU;CACzE;CAEA,aAAa,OAAO,kBAAkB,WAAW,QAAQ;CACzD,aAAa,OAAO,iBAAiB,WAAW,OAAO;CACvD,aAAa,OAAO,qBAAqB,WAAW,gBAAgB;CACpE,yBAAyB,OAAO,WAAW,KAAK;CAChD,2BAA2B,OAAO,WAAW,UAAU;CACvD,qBAAqB,OAAO,WAAW,IAAI;CAC3C,uBAAuB,OAAO,WAAW,MAAM;CAC/C,2BAA2B,OAAO,WAAW,UAAU;CACvD,wBAAwB,OAAO,WAAW,OAAO;CACjD,yBAAyB,OAAO,WAAW,QAAQ;CAEnD,OAAO;AACT;AAEA,SAAgB,mBACd,UACA,KACM;CAEN,AADiB,eAAe,GACzB,CAAC,CAAC,cAAc,uBAAuB,QAAQ,CAAC;AACzD;;;;;;AAOA,SAAgB,gBACd,SACA,KACM;CACN,eAAe,GAAG,CAAC,CAAC,aAAa,iBAAiB,OAAO;AAC3D;;;;;;;;;;;;;;AChHA,SAAS,kBACP,KACA,IACA,OACM;CACN,MAAM,QAA2B;EAC/B,GAAGC,0CAAuB;GACxB,WAAW,GAAG;GACd,UAAU,GAAG;GACb,OAAO,GAAG;EACZ,CAAC;EACD,GAAGC,2CAAwB;GACzB,OAAO,GAAG;GACV,IAAI,GAAG;GACP,eAAe,GAAG;EACpB,CAAC;CACH;CACA,IAAI,OAAO;EACT,MAAM,OAAOC,6BACX,GAAG,OACH,OACA,GAAG,UAAU,EAAE,SAAS,GAAG,QAAQ,IAAI,MACzC;EACA,OAAO,OAAO,OAAOC,wCAAqB;GAAE,GAAG;GAAO,SAAS;EAAK,CAAC,CAAC;CACxE;CACA,IAAI,cAAc,KAAK;AACzB;AAEA,eAAsB,gBACpB,UACA,IACA,UAA8B,CAAC,GACnB;CACZ,MAAM,aAAa,kBAAkB,QAAQ;CAE7C,oCACE,mBAAmB,UAAU,GAC7B,OAAO,KAAmB,WAA0B;EAClD,mBAAmB,YAAY,GAAG;EAClC,OAAO,IAAI,mBAAmB,UAAU,CAAC;EAEzC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAqB,MAAM;GACnD,MAAM,UAAU,WAAW,WAAW;GACtC,gBAAgB,SAAS,GAAG;GAC5B,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;GACjC,IAAI,WAAW,IACb,kBACE,KACA,WAAW,IACX,QAAQ,eAAe,MAAM,KAAK,WAAW,GAAG,KAClD;GAEF,OAAO;EACT,SAAS,OAAO;GACd,gBAAgB,WAAW,GAAG;GAC9B,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;GAC5C,IAAI,WAAW,IAAI,kBAAkB,KAAK,WAAW,EAAE;GACvD,MAAM;EACR;CACF,GACA,OACF;AACF;AAEA,SAAgB,qBACd,UACA,UAA8B,CAAC,GACzB;CACN,MAAM,aAAa,kBAAkB,QAAQ;CAC7C,MAAM,WAAW,mBAAmB,QAAQ,GAAG;CAI/C,IAAI,CAAC,UAAU;EACb,MAAM,OAAO,QAAQ,oBAAoB;EACzC,IAAI,SAAS,SACX,MAAM,IAAI,MAAM,uBAAuB;EAEzC,IAAI,SAAS,QACX,uBAAuB,WAAW,MAAM;EAE1C;CACF;CAEA,MAAM,SACJ,QAAQ,4CAA+B,0CAA6B;CAEtE,IAAI,QAAQ,cAAc,OACxB,uCAAoB,QAAQ;CAG9B,mBAAmB,YAAY,QAAQ;CACvC,OAAO,IAAI,mBAAmB,UAAU,CAAC;CAEzC,IAAI,QAAQ,SACV,OAAO,QAAQ;AAEnB;AAEA,SAAgB,oBACd,UACA,UAA8B,CAAC,GACzB;CACN,IAAI,CAAC,SAAS,YAAY,CAAC,SAAS,kBAClC,MAAM,IAAI,MACR,8FACF;CAGF,qBAAqB,UAAU,OAAO;AACxC;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBACd,UACA,SACA,UAA8B,CAAC,GACO;CACtC,QAAQ,GAAG,SAAkC;EAG3C,OAAO,gBADL,OAAO,aAAa,aAAa,SAAS,GAAG,IAAI,IAAI,WAGpD,KAAK,WAAW,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,IAAI,GAC7C,OACF;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,oBACd,UACA,SACA,UAAgC,CAAC,GACK;CACtC,QAAQ,GAAG,SAAkC;EAG3C,OAAO,kBADL,OAAO,aAAa,aAAa,SAAS,GAAG,IAAI,IAAI,WAGpD,KAAK,WAAW,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,IAAI,GAC7C,OACF;CACF;AACF;AAEA,eAAsB,kBACpB,UACA,IACA,UAAgC,CAAC,GACrB;CACZ,MAAM,QAAQ,KAAK,IAAI;CACvB,MAAM,aAAa,kBAAkB;EACnC,GAAG;EACH,MAAM;GACJ,GAAG,SAAS;GACZ,QAAQ,SAAS,MAAM,UAAU;EACnC;CACF,CAAC;CAED,OAAO,gBACL,YACA,OAAO,KAAK,WAAW;EACrB,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,MAAM;GACnC,MAAM,cAAc,KAAK,IAAI,IAAI;GACjC,MAAM,YAAiC;IACrC,GAAG;IACH,SAAS,WAAW,WAAW;IAC/B,MAAM;KACJ,GAAG,SAAS;KACZ,WAAW,WAAW,MAAM;KAC5B,YACE,WAAW,MAAM,eAChB,QAAQ,eAAe,QAAQ,SAAY,YAAY,MAAM;KAChE,QAAQ;KACR;IACF;GACF;GACA,mBAAmB,WAAW,GAAG;GACjC,OAAO,IAAI,4BAA4B,kBAAkB,SAAS,CAAC,CAAC;GACpE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,SAA8B;IAClC,GAAG;IACH,SAAS;IACT,MAAM;KACJ,GAAG,SAAS;KACZ,WAAW,WAAW,MAAM;KAC5B,QAAQ;KACR,aAAa,KAAK,IAAI,IAAI;IAC5B;GACF;GACA,mBAAmB,QAAQ,GAAG;GAC9B,OAAO,IAAI,4BAA4B,kBAAkB,MAAM,CAAC,CAAC;GACjE,MAAM;EACR;CACF,GACA,OACF;AACF;;;;AC5RA,SAAS,sBACP,gBACA,SACA,iBACU;CACV,MAAM,UAAU,kBAAkB,CAAC,GAAG,eAAe,IAAI,CAAC,cAAc;CACxE,IAAI,QAAQ,GAAG,EAAE,MAAM,SACrB,QAAQ,KAAK,OAAO;CAEtB,OAAO;AACT;AA0BA,SAAgB,gBAAgB,OAAgD;CAC9E,MAAM,mBAAmB,sBACvB,MAAM,gBACN,MAAM,eACN,MAAM,gBACR;CAEA,OAAO;EACL,gBAAgB,MAAM;EACtB,GAAI,MAAM,UAAU,UAAa,EAAE,OAAO,MAAM,MAAM;EACtD,GAAI,MAAM,YAAY,UAAa,EAAE,SAAS,MAAM,QAAQ;EAC5D,GAAI,MAAM,iBAAiB,UAAa,EAAE,cAAc,MAAM,aAAa;EAC3E;EACA,sBAAsB,YAAY,gBAAgB;EAClD,OAAO,KAAK,IAAI,iBAAiB,SAAS,GAAG,CAAC;EAC9C,UAAU,MAAM,6BAAY,IAAI,KAAK,EAAC,CAAC,YAAY;EACnD,GAAI,MAAM,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;CACpE;AACF;AAEA,SAAgB,mBACd,UACA,UAA8B,CAAC,GACzB;CAKN,MAAM,mBACJ,SAAS,oBAAoB,CAAC,SAAS,gBAAgB,SAAS,UAAU,EAAE;CAE9E,MAAM,aAAa,gBAAgB;EACjC,gBAAgB,SAAS;EACzB,eAAe,SAAS,QAAQ;EAChC,OAAO,SAAS;EAChB,SAAS,SAAS;EAClB,cAAc,SAAS;EACvB;CACF,CAAC;CAED,qBACE;EACE,QAAQ,SAAS;EACjB,UAAU,SAAS;EACnB,WAAW;EACX,OAAO,SAAS;EAChB;EACA,YAAY,SAAS;EACrB,kBAAkB,uBAAuB,SAAS,UAAU,GAAG,MAAM,SAAS,QAAQ,GAAG;CAC3F,GACA,OACF;AACF;;;;ACxFA,SAASC,cAAY,OAA+B;CAClD,IAAI,CAAC,OAAO,wBAAO,IAAI,KAAK,EAAC,CAAC,YAAY;CAC1C,OAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAEA,eAAsB,iBACpB,UACA,IACA,UAA8B,CAAC,GACnB;CACZ,MAAM,YAAYA,cAAY,SAAS,SAAS,SAAS;CAEzD,OAAO,gBACL;EACE,GAAG;EACH,UAAU,SAAS,YAAY;EAC/B,SAAS;GACP,GAAG,SAAS;GACZ,QAAQ,SAAS,SAAS,UAAU;GACpC;EACF;CACF,GACA,OAAO,KAAK,WAAW;EACrB,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,MAAM;GACnC,MAAM,YAAY;IAChB,GAAG;IACH,SAAS,SAAS,WAAW;IAC7B,SAAS;KACP,GAAG,SAAS;KACZ,QAAQ;KACR;KACA,0BAAS,IAAI,KAAK,EAAC,CAAC,YAAY;IAClC;GACF;GACA,mBAAmB,WAAW,GAAG;GACjC,OAAO,IAAI,4BAA4B,SAAS,CAAC;GACjD,OAAO;EACT,SAAS,OAAO;GACd,MAAM,SAAS;IACb,GAAG;IACH,SAAS;IACT,SAAS;KACP,GAAG,SAAS;KACZ,QAAQ;KACR;KACA,0BAAS,IAAI,KAAK,EAAC,CAAC,YAAY;IAClC;GACF;GACA,mBAAmB,QAAQ,GAAG;GAC9B,OAAO,IAAI,4BAA4B,MAAM,CAAC;GAC9C,MAAM;EACR;CACF,GACA,OACF;AACF;;;;ACvDA,SAASC,cAAY,OAA2C;CAC9D,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAEA,SAASC,kBAAgB,OAAqC;CAC5D,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,OAAO,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK;AACnD;AAEA,SAAS,UAAU,QAA6B,IAAqB;CACnE,OAAO,OAAO,cAAc,UAAa,OAAO,YAAY;AAC9D;AA0BA,SAAgB,4BACd,UAAyC,CAAC,GACnB;CACvB,MAAM,0BAAU,IAAI,IAAiC;CAErD,MAAM,qBACJ,UACwB;EACxB,MAAM,MAAMD,cAAY,MAAM,aAAa,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY;EACvE,MAAM,SAA8B;GAClC,OAAO,MAAM;GACb,QAAQ,MAAM,UAAU,CAAC;GACzB,QAAQ;GACR,SAAS,MAAM;GACf,WACE,MAAM,YAAY,SAAY,SAAY,YAAY,MAAM,OAAO;GACrE,aAAa,MAAM;GACnB,eAAe;GACf,WAAWA,cAAY,MAAM,SAAS;GACtC,UAAU,MAAM;EAClB;EACA,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM;EAClC,OAAO;CACT;CAEA,KAAK,MAAM,QAAQ,SACjB,kBAAkB,IAAI;CAGxB,OAAO;EACL;EACA,eAAe,SAAiB,QAAkC,CAAC,GAAG;GACpE,MAAM,WAAW,QAAQ,IAAI,OAAO;GACpC,IAAI,CAAC,UACH,MAAM,IAAI,MACR,yDAAyD,QAAQ,GACnE;GAGF,MAAM,YAAYA,cAAY,MAAM,SAAS,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY;GACzE,MAAM,SAA8B;IAClC,GAAG;IACH,QAAQ,MAAM,UAAU,SAAS;IACjC,QAAQ;IACR,SAAS,MAAM,WAAW,SAAS;IACnC,WACE,MAAM,YAAY,SACd,SAAS,YACT,YAAY,MAAM,OAAO;IAC/B,aAAa,MAAM,eAAe,SAAS;IAC3C;IACA,WAAWA,cAAY,MAAM,SAAS,KAAK,SAAS;IACpD,UAAU,MAAM,YAAY,SAAS;GACvC;GACA,QAAQ,IAAI,SAAS,MAAM;GAC3B,OAAO;EACT;EACA,eAAe,SAAiB,OAAiC;GAC/D,MAAM,WAAW,QAAQ,IAAI,OAAO;GACpC,IAAI,CAAC,UACH,MAAM,IAAI,MACR,yDAAyD,QAAQ,GACnE;GAGF,MAAM,YAAYA,cAAY,MAAM,SAAS,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY;GACzE,MAAM,SAA8B;IAClC,GAAG;IACH,QAAQ;IACR;IACA,kBAAkB,MAAM;GAC1B;GACA,QAAQ,IAAI,SAAS,MAAM;GAC3B,OAAO;EACT;EACA,YAAY,SAAiB;GAC3B,OAAO,QAAQ,IAAI,OAAO;EAC5B;EACA,kBAAkB,SAAiB,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY,GAAG;GAChE,MAAM,SAAS,QAAQ,IAAI,OAAO;GAClC,IAAI,CAAC,QAAQ;GACb,OAAO,UAAU,QAAQ,EAAE,IAAI,YAAY,OAAO;EACpD;EACA,aAAa,SAAiB,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY,GAAG;GAC3D,MAAM,SAAS,QAAQ,IAAI,OAAO;GAClC,IAAI,CAAC,QACH,MAAM,IAAI,MACR,2CAA2C,QAAQ,4BACrD;GAGF,MAAM,SAA8B,UAAU,QAAQ,EAAE,IACpD,YACA,OAAO;GAEX,IAAI,WAAW,YAAY,WAAW,WACpC,MAAM,IAAI,MACR,mCAAmC,QAAQ,OAAO,OAAO,oCAC3D;GAGF,OAAO;EACT;EACA,aAAa,SAAiB,gBAA0B;GACtD,MAAM,SAAS,KAAK,aAAa,OAAO;GACxC,MAAM,UAAU,eAAe,QAC5B,UAAU,CAAC,OAAO,OAAO,SAAS,KAAK,CAC1C;GAEA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MACR,mCAAmC,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,EAAE,EACjG;GAGF,OAAO;EACT;EACA,gBAAgB,SAAiB,OAAO;GACtC,MAAM,SAAS,KAAK,aAAa,OAAO;GACxC,MAAM,QAAQC,kBAAgB,MAAM,KAAK;GACzC,IAAI,MAAM,SAAS,GACjB,KAAK,aAAa,SAAS,KAAK;GAGlC,OAAO,gBAAgB;IACrB,gBAAgB,MAAM;IACtB,eAAe,OAAO,MAAM;IAC5B,OAAO,MAAM,SAAS,OAAO;IAC7B,SAAS,MAAM,WAAW,OAAO;IACjC,cAAc,MAAM;IACpB,kBAAkB,MAAM;IACxB,UAAU,MAAM;IAChB,WAAW,MAAM,aAAa,OAAO;GACvC,CAAC;EACH;EACA,OAAO;GACL,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC;EAC7B;CACF;AACF;;;;ACtLA,MAAM,mBAA+D;CACnE,QAAQ;EACN,MAAM;EACN,UAAU;GACR;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,UAAU;GACR;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,UAAU;GAAC;GAAS;GAAY;GAAW;GAAY;EAAU;EACjE,iBAAiB;CACnB;CACA,KAAK;EACH,MAAM;EACN,UAAU;GAAC;GAAS;GAAQ;GAAY;GAAa;EAAQ;EAC7D,UAAU;GAAC;GAAQ;GAAQ;GAAW;GAAU;EAAc;EAC9D,UAAU,CAAC,SAAS,UAAU;EAC9B,iBAAiB;CACnB;CACA,YAAY;EACV,MAAM;EACN,UAAU;GAAC;GAAY;GAAQ;GAAW;GAAU;EAAQ;EAC5D,UAAU;GAAC;GAAc;GAAU;GAAW;GAAU;EAAW;EACnE,UAAU;GAAC;GAAS;GAAY;EAAU;EAC1C,iBAAiB;CACnB;AACF;AAEA,SAAS,UAAU,OAAyB;CAC1C,IAAI,OAAO,UAAU,UACnB,OAAO;CAGT,IAAI,MAAM,UAAU,GAAG,OAAO;CAC9B,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,MAAM,MAAM,EAAE;AACjD;AAEA,SAAS,QAAQ,UAAgC,KAAsB;CACrE,OAAO,UAAU,MAAM,YAAY,QAAQ,KAAK,GAAG,CAAC,KAAK;AAC3D;AAEA,SAAS,eAAe,OAAe,WAA4B;CACjE,IAAI,cAAc,UAAa,MAAM,UAAU,WAC7C,OAAO;CAGT,OAAO,GAAG,MAAM,MAAM,GAAG,SAAS,EAAE;AACtC;AAEA,SAAS,aACP,OACA,SACA,SACS;CACT,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAG3B,MAAM,UAAU,QAAQ,YAAY;CAEpC,IAAI,QAAQ,QAAQ,UAAU,OAAO,GACnC,OAAO;CAGT,IAAI,QAAQ,QAAQ,UAAU,OAAO,GACnC,OAAO,YAAY,KAAK;CAG1B,IAAI,QAAQ,QAAQ,UAAU,OAAO,GACnC,OAAO,UAAU,KAAK;CAGxB,IAAI,OAAO,UAAU,UACnB,OAAO,eAAe,OAAO,QAAQ,eAAe;CAGtD,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,OAAO,UACvB,aAAa,OAAO,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CACrD;CAGF,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAgC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CACrE,KACA,aAAa,OAAO,SAAS,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAClE,CAAC,CACH;CAGF,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,SAAS,EAAE;CAG1B,OAAO;AACT;AAEA,SAAgB,sBACd,UAA+B,UACf;CAChB,OAAO,OAAO,YAAY,WAAW,iBAAiB,WAAW;AACnE;AAEA,SAAgB,qBACd,OACA,UAA+B,UACtB;CACT,OAAO,aAAa,OAAO,sBAAsB,OAAO,GAAG,EAAE;AAC/D;;;;ACtHA,SAAS,YAAY,OAA+B;CAClD,IAAI,CAAC,OAAO,wBAAO,IAAI,KAAK,EAAC,CAAC,YAAY;CAC1C,OAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAUA,eAAsB,0BACpB,UACA,UAA4C,CAAC,GACX;CAClC,MAAM,aAAa,kBAAkB,QAAQ;CAC7C,MAAM,eAAe;EACnB,eAAe,WAAW;EAC1B,WAAW,YAAY,QAAQ,SAAS;EACxC,GAAI,QAAQ,sBAAsB,UAAa,EAC7C,mBAAmB,QAAQ,kBAC7B;EACA,UAAU;EACV,GAAI,QAAQ,aAAa,UAAa,EACpC,UAAU,qBACR,QAAQ,UACR,QAAQ,kBAAkB,QAC5B,EACF;CACF;CAEA,MAAM,YAAY,YAAY,YAAY;CAC1C,MAAM,YAAY,QAAQ,SACtB,MAAM,QAAQ,OAAO,oBAAoB,YAAY,CAAC,IACtD;CAEJ,OAAO;EACL,GAAG;EACH;EACA,GAAI,cAAc,UAAa,EAAE,UAAU;CAC7C;AACF;AAEA,SAAgB,wBACd,UACS;CACT,MAAM,WAAW,YAAY;EAC3B,eAAe,SAAS;EACxB,WAAW,SAAS;EACpB,GAAI,SAAS,sBAAsB,UAAa,EAC9C,mBAAmB,SAAS,kBAC9B;EACA,UAAU,SAAS;EACnB,GAAI,SAAS,aAAa,UAAa,EACrC,UAAU,SAAS,SACrB;CACF,CAAC;CACD,OAAO,SAAS,cAAc;AAChC;;;;ACtDA,SAAS,gBAAgB,OAAqC;CAC5D,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAC9C;AAEA,SAAS,cACP,WACA,UACU;CACV,OAAO,SAAS,QAAQ,UAAU,CAAC,UAAU,SAAS,KAAK,CAAC;AAC9D;;;;;;;;;;AAiBA,SAAS,mBACP,eACA,gBACA,gBACyB;CACzB,MAAM,eAAe,iBACjB,cAAc,QAAQ,UAAU,CAAC,eAAe,SAAS,KAAK,CAAC,IAC/D,CAAC;CACL,IAAI,aAAa,SAAS,GACxB,OAAO;EACL,QAAQ;EACR,QAAQ,sBAAsB,aAAa,KAAK,GAAG;EACnD,KAAK,4DAA4D,aAAa,KAAK,IAAI;CACzF;CAGF,MAAM,UAAU,cAAc,eAAe,cAAc;CAC3D,IAAI,QAAQ,SAAS,GACnB,OAAO;EACL,QAAQ;EACR,QAAQ,iBAAiB,QAAQ,KAAK,GAAG;EACzC,KAAK,6BAA6B,QAAQ,KAAK,IAAI;CACrD;AAIJ;AAEA,SAAS,kBACP,YAC+B;CAC/B,MAAM,WAAW,WAAW;CAC5B,IAAI,UACF,SAAS,aAAa,WAAW,MAAM,EAAE;CAG3C,OAAO,WAAW;AACpB;AAEA,SAAS,gBACP,YACA,gBACgC;CAChC,IAAI,CAAC,cAAc,mBAAmB,QAAW,OAAO;CACxD,OAAO;EACL,GAAG;EACH,GAAI,mBAAmB,UAAa,EAAE,eAAe;CACvD;AACF;AAEA,SAAS,cACP,OACA,UACA,gBACmC;CACnC,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,iBAAiB,qBAAqB,OAAO,kBAAkB,QAAQ;CAC7E,OAAO;EACL,GAAG;EACH,WAAW,SAAS,aAAa,YAAY,cAAc;CAC7D;AACF;AAEA,eAAsB,eACpB,YACA,OACA,IACA,UAAqD,CAAC,GACpC;CAClB,MAAM,iBAAiB,WAAW,kBAAkB,CAAC;CACrD,MAAM,aAAa,kBAAkB,UAAU;CAC/C,MAAM,iBAAiB,WAAW,kBAAkB,YAClD,WAAW,MAAM,EACnB,CAAC,EAAE;CAEH,MAAM,SAAS,mBADO,gBAAgB,YAAY,SAAS,cAE7C,GACZ,gBACA,cACF;CACA,MAAM,SACJ,WAAW,YAAY,WAAW,cAAc,UAAa,SACzD;EACE,UAAU,SAAS,SAAS;EAC5B,GAAI,WAAW,aAAa,UAAa,EACvC,UAAU,WAAW,SACvB;EACA,GAAI,WAAW,cAAc,UAAa,EACxC,WAAW,WAAW,UACxB;EACA,GAAI,UAAU,EAAE,QAAQ,OAAO,OAAO;CACxC,IACA;CAEN,MAAM,aAAa,gBACjB,WAAW,YACX,WAAW,cACb;CAEA,IAAI,UAAU,OAAO,aAAa,UAAU,QAAQ;EAClD,qBACE;GACE,QAAQ,WAAW;GACnB,UAAU,WAAW,YAAY,WAAW,KAAK;GACjD,UAAU,WAAW;GACrB,OAAO,WAAW;GAClB;GACA;GACA;GACA,UAAU,cACR,OACA,WAAW,UACX,WAAW,cACb;EACF,GACA,OACF;EAEA,yCAA4B;GAC1B,QAAQ;GACR,MAAM;GACN,SAAS,UAAU,WAAW,MAAM,GAAG,kBAAkB,WAAW,KAAK,KAAK;GAC9E,KAAK,OAAO;GACZ,KAAK;EACP,CAAC;CACH;CAEA,IAAI,QACF,qBACE;EACE,QAAQ,GAAG,WAAW,OAAO;EAC7B,UAAU,WAAW,YAAY,WAAW,KAAK;EACjD,UAAU,WAAW;EACrB,OAAO,WAAW;EAClB;EACA;EACA;CACF,GACA,OACF;CAGF,IAAI,WAAW,UACb,oBACE;EACE,QAAQ,GAAG,WAAW,OAAO;EAC7B,UAAU,WAAW,YAAY,WAAW,KAAK;EACjD,UAAU,WAAW;EACrB,OAAO,WAAW;EAClB;EACA;EACA,UAAU,cACR,OACA,WAAW,UACX,WAAW,cACb;CACF,GACA,OACF;CAGF,OAAO,kBACL;EACE,QAAQ,WAAW;EACnB,UAAU,WAAW,YAAY,WAAW,KAAK;EACjD,UAAU,WAAW;EACrB,OAAO,WAAW;EAClB;EACA;EACA,MAAM;GACJ,GAAG,WAAW;GACd;EACF;CACF,GACA,IACA,OACF;AACF"}
+{"version":3,"file":"agent-CiG_LZL8.cjs","names":["otelTrace","genAiRequestAttributes","genAiResponseAttributes","estimateLLMCost","genAiUsageAttributes","toIsoString","toIsoString","normalizeScopes"],"sources":["../src/agent/constants.ts","../src/agent/hash.ts","../src/agent/metadata.ts","../src/agent/context.ts","../src/agent/attributes.ts","../src/agent/runtime.ts","../src/agent/delegation.ts","../src/agent/session.ts","../src/agent/identity-registry.ts","../src/agent/privacy.ts","../src/agent/non-repudiation.ts","../src/agent/scoped-tool.ts"],"sourcesContent":["export const AGENT_AUDIT_SCHEMA_VERSION = '1.1.0';\n","import { createHash } from 'node:crypto';\n\nexport interface HashPayloadOptions {\n  algorithm?: 'sha256';\n}\n\nfunction canonicalize(value: unknown): unknown {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n\n  if (typeof value === 'bigint') {\n    return value.toString(10);\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((entry) => canonicalize(entry));\n  }\n\n  if (value && typeof value === 'object') {\n    // `toSorted()` would need ES2023 lib types; keep runtime output ES2022-friendly.\n    const entries = Object.entries(value as Record<string, unknown>);\n    entries.sort(([left], [right]) => left.localeCompare(right));\n    return Object.fromEntries(\n      entries.map(([key, entryValue]) => [key, canonicalize(entryValue)]),\n    );\n  }\n\n  return value;\n}\n\nexport function canonicalizeForHash(value: unknown): string {\n  return JSON.stringify(canonicalize(value));\n}\n\nexport function hashPayload(\n  value: unknown,\n  options: HashPayloadOptions = {},\n): string {\n  const algorithm = options.algorithm ?? 'sha256';\n  const canonical = canonicalizeForHash(value);\n  const digest = createHash(algorithm).update(canonical).digest('hex');\n  return `${algorithm}:${digest}`;\n}\n","import { AGENT_AUDIT_SCHEMA_VERSION } from './constants.js';\nimport { hashPayload } from './hash.js';\nimport type {\n  AgentActionMetadata,\n  AgentDecisionMetadata,\n  AgentEventKind,\n  GovernanceMetadata,\n  ToolCallMetadata,\n} from './types.js';\n\ninterface AuditMetadataLike {\n  action: string;\n  resource?: string;\n  actorId?: string;\n  category?: string;\n  outcome?: string;\n  [key: string]: unknown;\n}\n\nexport function defaultEventKind(\n  metadata: AgentActionMetadata,\n): AgentEventKind {\n  if (metadata.eventKind) return metadata.eventKind;\n  if (metadata.tool) return 'tool_call';\n  if (metadata.policy) return 'policy_decision';\n  return 'action';\n}\n\nexport function normalizeTool(\n  tool?: ToolCallMetadata,\n): ToolCallMetadata | undefined {\n  if (!tool) return undefined;\n\n  return {\n    name: tool.name,\n    ...(tool.callId !== undefined && { callId: tool.callId }),\n    inputHash:\n      tool.input === undefined\n        ? tool.inputHash\n        : (tool.inputHash ?? hashPayload(tool.input)),\n    outputHash:\n      tool.output === undefined\n        ? tool.outputHash\n        : (tool.outputHash ?? hashPayload(tool.output)),\n    ...(tool.status !== undefined && { status: tool.status }),\n    ...(tool.executionMs !== undefined && { executionMs: tool.executionMs }),\n  };\n}\n\nexport function sanitizeTool(\n  tool?: ToolCallMetadata,\n): ToolCallMetadata | undefined {\n  if (!tool) return undefined;\n\n  return {\n    name: tool.name,\n    ...(tool.callId !== undefined && { callId: tool.callId }),\n    ...(tool.inputHash !== undefined && { inputHash: tool.inputHash }),\n    ...(tool.outputHash !== undefined && { outputHash: tool.outputHash }),\n    ...(tool.status !== undefined && { status: tool.status }),\n    ...(tool.executionMs !== undefined && { executionMs: tool.executionMs }),\n  };\n}\n\nexport function sanitizeGovernance(\n  governance?: GovernanceMetadata,\n): GovernanceMetadata | undefined {\n  if (!governance) return undefined;\n  return {\n    ...(governance.reviewRequired !== undefined && {\n      reviewRequired: governance.reviewRequired,\n    }),\n    ...(governance.reviewerId !== undefined && {\n      reviewerId: governance.reviewerId,\n    }),\n    ...(governance.controlId !== undefined && {\n      controlId: governance.controlId,\n    }),\n    ...(governance.documentationUrl !== undefined && {\n      documentationUrl: governance.documentationUrl,\n    }),\n    ...(governance.lifecycleStage !== undefined && {\n      lifecycleStage: governance.lifecycleStage,\n    }),\n    ...(governance.framework !== undefined && {\n      framework: governance.framework,\n    }),\n  };\n}\n\nfunction normalizeDecision(\n  decision?: AgentDecisionMetadata,\n  reasoningSummary?: string,\n): AgentDecisionMetadata | undefined {\n  if (decision) {\n    return {\n      ...decision,\n      summary: decision.summary ?? reasoningSummary ?? '',\n    };\n  }\n\n  if (reasoningSummary === undefined) return undefined;\n\n  return {\n    summary: reasoningSummary,\n  };\n}\n\nexport function createAgentAuditMetadata(\n  metadata: AgentActionMetadata,\n): AgentActionMetadata {\n  const eventKind = defaultEventKind(metadata);\n\n  if (eventKind === 'tool_call' && !metadata.tool) {\n    throw new Error(\n      '[autotel-genai] eventKind \"tool_call\" requires metadata.tool.',\n    );\n  }\n\n  if (eventKind === 'policy_decision' && !metadata.policy) {\n    throw new Error(\n      '[autotel-genai] eventKind \"policy_decision\" requires metadata.policy.',\n    );\n  }\n\n  if (eventKind === 'handoff' && !metadata.delegation) {\n    throw new Error(\n      '[autotel-genai] eventKind \"handoff\" requires metadata.delegation.',\n    );\n  }\n\n  const delegation =\n    metadata.delegation &&\n    (\n      metadata.delegation.authorityLineageHash === undefined ||\n      metadata.delegation.depth === undefined\n    )\n      ? {\n          ...metadata.delegation,\n          ...(metadata.delegation.authorityLineage && {\n            authorityLineageHash:\n              metadata.delegation.authorityLineageHash ??\n              hashPayload(metadata.delegation.authorityLineage),\n            depth:\n              metadata.delegation.depth ??\n              Math.max(metadata.delegation.authorityLineage.length - 1, 0),\n          }),\n        }\n      : metadata.delegation;\n\n  return {\n    ...metadata,\n    schemaVersion: metadata.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n    eventKind,\n    decision: normalizeDecision(metadata.decision, metadata.reasoningSummary),\n    ...(delegation !== undefined && { delegation }),\n  };\n}\n\nexport function normalizeMetadata(\n  metadata: AgentActionMetadata,\n): AgentActionMetadata {\n  const normalized = createAgentAuditMetadata(metadata);\n  return {\n    ...normalized,\n    tool: normalizeTool(normalized.tool),\n  };\n}\n\nexport function buildAuditMetadata(\n  metadata: AgentActionMetadata,\n): AuditMetadataLike {\n  return {\n    action: metadata.action,\n    ...(metadata.resource !== undefined && { resource: metadata.resource }),\n    actorId:\n      metadata.actorId ??\n      metadata.delegation?.parentIdentity ??\n      metadata.agent.id,\n    category: metadata.category ?? 'agent',\n    ...(metadata.outcome !== undefined && { outcome: metadata.outcome }),\n    agentId: metadata.agent.id,\n    agentEventKind: metadata.eventKind,\n    agentAuditVersion: metadata.schemaVersion,\n    ...(metadata.agent.version !== undefined && {\n      agentVersion: metadata.agent.version,\n    }),\n    ...(metadata.tool?.name !== undefined && { toolName: metadata.tool.name }),\n    ...(metadata.policy?.decision !== undefined && {\n      policyDecision: metadata.policy.decision,\n    }),\n    ...(metadata.session?.status !== undefined && {\n      sessionStatus: metadata.session.status,\n    }),\n  };\n}\n\nexport function buildLoggerContext(\n  metadata: AgentActionMetadata,\n): Record<string, unknown> {\n  const tool = sanitizeTool(metadata.tool);\n  const governance = sanitizeGovernance(metadata.governance);\n\n  const context: Record<string, unknown> = {\n    agent: {\n      ...metadata.agent,\n      ...(metadata.resource !== undefined && { resource: metadata.resource }),\n      ...(metadata.outcome !== undefined && { outcome: metadata.outcome }),\n      ...(metadata.reasoningSummary !== undefined && {\n        reasoningSummary: metadata.reasoningSummary,\n      }),\n      schemaVersion: metadata.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n      eventKind: metadata.eventKind ?? defaultEventKind(metadata),\n    },\n    ...(metadata.delegation !== undefined && {\n      delegation: metadata.delegation,\n    }),\n    ...(tool !== undefined && { tool }),\n    ...(metadata.policy !== undefined && { policy: metadata.policy }),\n    ...(governance !== undefined && { governance }),\n    ...(metadata.session !== undefined && { session: metadata.session }),\n    ...(metadata.decision !== undefined && { decision: metadata.decision }),\n  };\n\n  // Hand the request logger an independent copy. `logger.set()` deep-merges and\n  // intentionally *concatenates* array fields across calls (autotel wide-event\n  // semantics). Agent lifecycles call `.set()` more than once per action with\n  // the same `delegation`/`decision` objects, so sharing references would let\n  // the merge mutate arrays (e.g. `authority_lineage`) in place — which would\n  // then leak onto the span via `setAgentAttributes`. Cloning keeps the\n  // span-bound metadata pristine.\n  return structuredClone(context);\n}\n\n/**\n * Context for the *completion* `logger.set()` of a specialized lifecycle\n * wrapper. Carries only the domain state that finished mutating — tool or\n * session status. Outcome is owned by `withAgentAction`, which wraps every\n * variant and stamps it on both span and log. This deliberately omits the\n * request-level `delegation`/`decision` blocks: those were set once at the\n * start, and re-sending them would concatenate their array fields into the\n * wide event (see `buildLoggerContext`).\n */\nexport function buildLifecycleUpdateContext(\n  metadata: AgentActionMetadata,\n): Record<string, unknown> {\n  const tool = sanitizeTool(metadata.tool);\n  return {\n    ...(tool !== undefined && { tool }),\n    ...(metadata.session !== undefined && {\n      session: structuredClone(metadata.session),\n    }),\n  };\n}\n","import { getTraceContext, otelTrace } from 'autotel';\n\nexport interface AgentContext {\n  traceId: string;\n  spanId: string;\n  correlationId: string;\n  setAttribute(key: string, value: string | number | boolean): void;\n  setAttributes(\n    attrs: Record<string, string | number | boolean | string[] | number[] | boolean[]>,\n  ): void;\n}\n\nexport const MISSING_CONTEXT_MESSAGE =\n  '[autotel-genai] No active trace context. Wrap the call in trace()/instrument(), pass options.ctx, ' +\n  'or set options.onMissingContext to \"warn\"/\"skip\" to degrade gracefully instead of throwing.';\n\n/**\n * Resolve an agent context without throwing. Returns `null` when no trace context\n * is available, so callers can degrade gracefully (best-effort instrumentation).\n */\nconst INVALID_TRACE_ID = '00000000000000000000000000000000';\n\nexport function resolveContextSafe(ctx?: AgentContext): AgentContext | null {\n  if (ctx) return ctx;\n\n  const span = otelTrace.getActiveSpan();\n  if (!span) return null;\n\n  // Resolve trace ids from autotel's context when available, otherwise from the\n  // active OTel span itself. This makes agent audit work in *any* OTel setup —\n  // @effect/opentelemetry, a vanilla NodeSDK, autotel-cloudflare's instrumented\n  // fetch handler — not just inside autotel's own `trace()`.\n  const ids = getTraceContext();\n  const sc = span.spanContext();\n  const traceId = ids?.traceId ?? sc.traceId;\n  if (!traceId || traceId === INVALID_TRACE_ID) return null;\n\n  return {\n    traceId,\n    spanId: ids?.spanId ?? sc.spanId,\n    correlationId: ids?.correlationId ?? traceId.slice(0, 16),\n    setAttribute: (key, value) => span.setAttribute(key, value),\n    setAttributes: (attrs) => span.setAttributes(attrs),\n  };\n}\n\nexport function resolveContext(ctx?: AgentContext): AgentContext {\n  const resolved = resolveContextSafe(ctx);\n  if (resolved) return resolved;\n  throw new Error(MISSING_CONTEXT_MESSAGE);\n}\n\nconst warnedMissingContext = new Set<string>();\n\n/** Warn (once per action) that an agent action is running without a trace context. */\nexport function warnMissingContextOnce(action: string): void {\n  if (warnedMissingContext.has(action)) return;\n  warnedMissingContext.add(action);\n  console.warn(\n    `[autotel-genai] No active trace context for \"${action}\" — running un-audited. ` +\n      'Wrap the call in trace()/instrument() or pass options.ctx to capture agent audit telemetry. ' +\n      '(set options.onMissingContext: \"throw\" to fail fast, or \"skip\" to silence this warning)',\n  );\n}\n\n/** A no-op {@link AgentContext} whose attribute setters do nothing. */\nexport function noopAgentContext(): AgentContext {\n  return {\n    traceId: '',\n    spanId: '',\n    correlationId: '',\n    setAttribute() {},\n    setAttributes() {},\n  };\n}\n\nexport function toAttributeValue(\n  value: unknown,\n): string | number | boolean | string[] | number[] | boolean[] | undefined {\n  if (\n    typeof value === 'string' ||\n    typeof value === 'number' ||\n    typeof value === 'boolean'\n  ) {\n    return value;\n  }\n\n  if (Array.isArray(value)) {\n    if (value.every((entry) => typeof entry === 'string')) {\n      return value;\n    }\n\n    if (value.every((entry) => typeof entry === 'number')) {\n      return value;\n    }\n\n    if (value.every((entry) => typeof entry === 'boolean')) {\n      return value;\n    }\n\n    try {\n      return JSON.stringify(value);\n    } catch {\n      return '<serialization-failed>';\n    }\n  }\n\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n\n  if (typeof value === 'bigint') {\n    return value.toString(10);\n  }\n\n  if (value === null || value === undefined) {\n    return undefined;\n  }\n\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return '<serialization-failed>';\n  }\n}\n","import { AGENT_AUDIT_SCHEMA_VERSION } from './constants.js';\nimport { resolveContext, toAttributeValue, type AgentContext } from './context.js';\nimport { defaultEventKind, normalizeMetadata } from './metadata.js';\nimport type {\n  AgentActionMetadata,\n  AgentDecisionMetadata,\n  AgentIdentity,\n  AgentSessionMetadata,\n  DelegationContext,\n  GovernanceMetadata,\n  PolicyMetadata,\n  ToolCallMetadata,\n} from './types.js';\n\ntype AttributeValue =\n  | string\n  | number\n  | boolean\n  | string[]\n  | number[]\n  | boolean[];\n\ntype AttributeMap = Record<string, AttributeValue>;\n\nfunction setIfPresent(target: AttributeMap, key: string, value: unknown): void {\n  const attr = toAttributeValue(value);\n  if (attr !== undefined) {\n    target[key] = attr;\n  }\n}\n\nfunction appendIdentityAttributes(attrs: AttributeMap, agent: AgentIdentity): void {\n  setIfPresent(attrs, 'agent.id', agent.id);\n  setIfPresent(attrs, 'agent.version', agent.version);\n  setIfPresent(attrs, 'agent.framework', agent.framework);\n  setIfPresent(attrs, 'agent.model', agent.model);\n  setIfPresent(attrs, 'agent.role', agent.role);\n  setIfPresent(attrs, 'agent.session.id', agent.sessionId);\n  setIfPresent(attrs, 'agent.conversation.id', agent.conversationId);\n}\n\nfunction appendDelegationAttributes(\n  attrs: AttributeMap,\n  delegation?: DelegationContext,\n): void {\n  if (!delegation) return;\n  setIfPresent(attrs, 'delegation.parent_identity', delegation.parentIdentity);\n  setIfPresent(attrs, 'delegation.scope', delegation.scope);\n  setIfPresent(attrs, 'delegation.token_id', delegation.tokenId);\n  setIfPresent(attrs, 'delegation.id', delegation.delegationId);\n  setIfPresent(attrs, 'delegation.authority_lineage', delegation.authorityLineage);\n  setIfPresent(\n    attrs,\n    'delegation.authority_lineage_hash',\n    delegation.authorityLineageHash,\n  );\n  setIfPresent(attrs, 'delegation.depth', delegation.depth);\n  setIfPresent(attrs, 'delegation.issued_at', delegation.issuedAt);\n  setIfPresent(attrs, 'delegation.expires_at', delegation.expiresAt);\n}\n\nfunction appendToolAttributes(attrs: AttributeMap, tool?: ToolCallMetadata): void {\n  if (!tool) return;\n  setIfPresent(attrs, 'tool.name', tool.name);\n  setIfPresent(attrs, 'tool.call.id', tool.callId);\n  setIfPresent(attrs, 'tool.input_hash', tool.inputHash);\n  setIfPresent(attrs, 'tool.output_hash', tool.outputHash);\n  setIfPresent(attrs, 'tool.status', tool.status);\n  setIfPresent(attrs, 'tool.execution_ms', tool.executionMs);\n}\n\nfunction appendPolicyAttributes(attrs: AttributeMap, policy?: PolicyMetadata): void {\n  if (!policy) return;\n  setIfPresent(attrs, 'policy.decision', policy.decision);\n  setIfPresent(attrs, 'policy.id', policy.policyId);\n  setIfPresent(attrs, 'policy.risk_score', policy.riskScore);\n  setIfPresent(attrs, 'policy.reason', policy.reason);\n}\n\nfunction appendGovernanceAttributes(\n  attrs: AttributeMap,\n  governance?: GovernanceMetadata,\n): void {\n  if (!governance) return;\n  setIfPresent(attrs, 'governance.review_required', governance.reviewRequired);\n  setIfPresent(attrs, 'governance.reviewer_id', governance.reviewerId);\n  setIfPresent(attrs, 'governance.control_id', governance.controlId);\n  setIfPresent(attrs, 'governance.documentation_url', governance.documentationUrl);\n  setIfPresent(attrs, 'governance.lifecycle_stage', governance.lifecycleStage);\n  setIfPresent(attrs, 'governance.framework', governance.framework);\n}\n\nfunction appendSessionAttributes(\n  attrs: AttributeMap,\n  session?: AgentSessionMetadata,\n): void {\n  if (!session) return;\n  setIfPresent(attrs, 'agent.session.status', session.status);\n  setIfPresent(attrs, 'agent.session.started_at', session.startedAt);\n  setIfPresent(attrs, 'agent.session.ended_at', session.endedAt);\n  setIfPresent(attrs, 'agent.session.delegated_by', session.delegatedBy);\n}\n\nfunction appendDecisionAttributes(\n  attrs: AttributeMap,\n  decision?: AgentDecisionMetadata,\n): void {\n  if (!decision) return;\n  setIfPresent(attrs, 'decision.summary', decision.summary);\n  setIfPresent(attrs, 'decision.input_hash', decision.inputHash);\n  setIfPresent(attrs, 'decision.policy_ids', decision.policyIds);\n  setIfPresent(attrs, 'decision.justification_codes', decision.justificationCodes);\n  setIfPresent(attrs, 'decision.evidence_ids', decision.evidenceIds);\n  setIfPresent(attrs, 'decision.review_required', decision.reviewRequired);\n  setIfPresent(attrs, 'decision.confidence', decision.confidence);\n}\n\nexport function flattenAgentAttributes(\n  metadata: AgentActionMetadata,\n): AttributeMap {\n  const normalized = normalizeMetadata(metadata);\n  const attrs: AttributeMap = {\n    'autotel.agent': true,\n    'agent.action': normalized.action,\n    'agent.audit.version':\n      normalized.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n    'agent.event.kind': normalized.eventKind ?? defaultEventKind(normalized),\n  };\n\n  setIfPresent(attrs, 'agent.resource', normalized.resource);\n  setIfPresent(attrs, 'agent.outcome', normalized.outcome);\n  setIfPresent(attrs, 'reasoning.summary', normalized.reasoningSummary);\n  appendIdentityAttributes(attrs, normalized.agent);\n  appendDelegationAttributes(attrs, normalized.delegation);\n  appendToolAttributes(attrs, normalized.tool);\n  appendPolicyAttributes(attrs, normalized.policy);\n  appendGovernanceAttributes(attrs, normalized.governance);\n  appendSessionAttributes(attrs, normalized.session);\n  appendDecisionAttributes(attrs, normalized.decision);\n\n  return attrs;\n}\n\nexport function setAgentAttributes(\n  metadata: AgentActionMetadata,\n  ctx?: AgentContext,\n): void {\n  const traceCtx = resolveContext(ctx);\n  traceCtx.setAttributes(flattenAgentAttributes(metadata));\n}\n\n/**\n * Stamp only the terminal outcome on the active span. Used by lifecycle\n * wrappers on completion so they don't re-flatten (and clobber) richer state a\n * nested step already wrote — e.g. a tool call's `tool.status=complete`.\n */\nexport function setAgentOutcome(\n  outcome: AgentActionMetadata['outcome'] & string,\n  ctx?: AgentContext,\n): void {\n  resolveContext(ctx).setAttribute('agent.outcome', outcome);\n}\n","import {\n  createNoopRequestLogger,\n  getRequestLoggerSafe,\n  type RequestLogger,\n} from 'autotel';\nimport { forceKeepAuditEvent, withAudit } from 'autotel-audit';\nimport { estimateLLMCost, type TokenUsage } from '../cost.js';\nimport {\n  genAiRequestAttributes,\n  genAiResponseAttributes,\n  genAiUsageAttributes,\n  type GenAiAttributeMap,\n} from '../attributes.js';\nimport { setAgentAttributes, setAgentOutcome } from './attributes.js';\nimport {\n  buildLoggerContext,\n  buildLifecycleUpdateContext,\n  buildAuditMetadata,\n  normalizeMetadata,\n} from './metadata.js';\nimport {\n  MISSING_CONTEXT_MESSAGE,\n  resolveContextSafe,\n  warnMissingContextOnce,\n  type AgentContext,\n} from './context.js';\nimport { hashPayload } from './hash.js';\nimport type {\n  AgentActionFactory,\n  AgentActionMetadata,\n  AgentAiMetadata,\n  AgentActionOptions,\n  AgentHandler,\n  AgentMetadataInput,\n  AgentToolCallActionMetadata,\n  AgentToolCallOptions,\n  ToolCallMetadata,\n} from './types.js';\n\n/**\n * Record canonical OpenTelemetry GenAI semantic attributes for an LLM-backed\n * agent action, reusing the local cost model. Best-effort: anything unknown is\n * simply omitted. `gen_ai.request.model` is always recorded; token counts and\n * the estimated `gen_ai.usage.cost.usd` are recorded when `usage` is available\n * (up front via metadata, or post-call via `options.extractUsage`).\n *\n * Emits canonical v1.42.0 keys only — no `gen_ai.usage.total_tokens` (not a\n * registry attribute) and no legacy `gen.ai.*` names.\n */\nfunction recordAiTelemetry(\n  ctx: AgentContext,\n  ai: AgentAiMetadata,\n  usage?: TokenUsage,\n): void {\n  const attrs: GenAiAttributeMap = {\n    ...genAiRequestAttributes({\n      operation: ai.operation,\n      provider: ai.provider,\n      model: ai.model,\n    }),\n    ...genAiResponseAttributes({\n      model: ai.responseModel,\n      id: ai.responseId,\n      finishReasons: ai.finishReasons,\n    }),\n  };\n  if (usage) {\n    const cost = estimateLLMCost(\n      ai.model,\n      usage,\n      ai.pricing ? { pricing: ai.pricing } : undefined,\n    );\n    Object.assign(attrs, genAiUsageAttributes({ ...usage, costUsd: cost }));\n  }\n  ctx.setAttributes(attrs);\n}\n\nexport async function withAgentAction<T>(\n  metadata: AgentActionMetadata,\n  fn: AgentHandler<T>,\n  options: AgentActionOptions = {},\n): Promise<T> {\n  const normalized = normalizeMetadata(metadata);\n\n  return withAudit(\n    buildAuditMetadata(normalized),\n    async (ctx: AgentContext, logger: RequestLogger) => {\n      setAgentAttributes(normalized, ctx);\n      logger.set(buildLoggerContext(normalized));\n\n      try {\n        const result = await fn(ctx as AgentContext, logger);\n        const outcome = normalized.outcome ?? 'success';\n        setAgentOutcome(outcome, ctx);\n        logger.set({ agent: { outcome } });\n        if (normalized.ai) {\n          recordAiTelemetry(\n            ctx,\n            normalized.ai,\n            options.extractUsage?.(result) ?? normalized.ai.usage,\n          );\n        }\n        return result;\n      } catch (error) {\n        setAgentOutcome('failure', ctx);\n        logger.set({ agent: { outcome: 'failure' } });\n        if (normalized.ai) recordAiTelemetry(ctx, normalized.ai);\n        throw error;\n      }\n    },\n    options,\n  );\n}\n\nexport function recordPolicyDecision(\n  metadata: AgentActionMetadata,\n  options: AgentActionOptions = {},\n): void {\n  const normalized = normalizeMetadata(metadata);\n  const traceCtx = resolveContextSafe(options.ctx);\n\n  // No trace context: degrade per onMissingContext instead of throwing into\n  // business logic. A policy decision we couldn't record is not worth a crash.\n  if (!traceCtx) {\n    const mode = options.onMissingContext ?? 'warn';\n    if (mode === 'throw') {\n      throw new Error(MISSING_CONTEXT_MESSAGE);\n    }\n    if (mode === 'warn') {\n      warnMissingContextOnce(normalized.action);\n    }\n    return;\n  }\n\n  const logger =\n    options.logger ?? getRequestLoggerSafe() ?? createNoopRequestLogger();\n\n  if (options.forceKeep !== false) {\n    forceKeepAuditEvent(traceCtx);\n  }\n\n  setAgentAttributes(normalized, traceCtx);\n  logger.set(buildLoggerContext(normalized));\n\n  if (options.emitNow) {\n    logger.emitNow();\n  }\n}\n\nexport function recordDecisionBasis(\n  metadata: AgentActionMetadata,\n  options: AgentActionOptions = {},\n): void {\n  if (!metadata.decision && !metadata.reasoningSummary) {\n    throw new Error(\n      '[autotel-genai] recordDecisionBasis requires metadata.decision or metadata.reasoningSummary.',\n    );\n  }\n\n  recordPolicyDecision(metadata, options);\n}\n\n/**\n * Define a reusable, instrumented agent action — the `trace()`-style factory\n * companion to `withAgentAction`. Declare it once at module scope and call the\n * returned function many times; each call opens its own audit scope.\n *\n * `metadata` may be a static object or a function of the call arguments, so\n * call-specific fields can be derived per invocation.\n *\n * @example\n * ```ts\n * const planTrip = defineAgentAction(\n *   (req: TripRequest) => ({\n *     action: 'agent.trip.plan',\n *     agent: { id: 'planner' },\n *     delegation: { parentIdentity: req.userId, scope: ['trip:plan'] },\n *   }),\n *   (ctx) => async (req: TripRequest) => planItinerary(req),\n * );\n *\n * await planTrip({ userId: 'usr_1', destination: 'Lisbon' });\n * ```\n */\nexport function defineAgentAction<TArgs extends unknown[], TResult>(\n  metadata: AgentMetadataInput<TArgs, AgentActionMetadata>,\n  factory: AgentActionFactory<TArgs, TResult>,\n  options: AgentActionOptions = {},\n): (...args: TArgs) => Promise<TResult> {\n  return (...args: TArgs): Promise<TResult> => {\n    const resolved =\n      typeof metadata === 'function' ? metadata(...args) : metadata;\n    return withAgentAction(\n      resolved,\n      (ctx, logger) => factory(ctx, logger)(...args),\n      options,\n    );\n  };\n}\n\n/**\n * Define a reusable, instrumented agent tool call — the `trace()`-style factory\n * companion to `withAgentToolCall`. Declare it once and call it per invocation;\n * tool inputs/results are hashed (never attached raw) on every call.\n *\n * Pass `metadata` as a function of the arguments when `tool.input` (or any other\n * field) depends on the call, so each invocation hashes its own input.\n *\n * @example\n * ```ts\n * const handleRefund = defineAgentToolCall(\n *   (req: RefundRequest) => ({\n *     action: 'agent.refund.tool_call',\n *     resource: 'stripe_refund_v3',\n *     agent: { id: 'refunds-specialist' },\n *     tool: { name: 'stripe_refund_v3', input: { refundId: req.refundId } },\n *   }),\n *   (ctx) => async (req: RefundRequest) => stripe.refunds.create(req),\n * );\n *\n * await handleRefund({ refundId: 're_123' });\n * ```\n */\nexport function defineAgentToolCall<TArgs extends unknown[], TResult>(\n  metadata: AgentMetadataInput<TArgs, AgentToolCallActionMetadata>,\n  factory: AgentActionFactory<TArgs, TResult>,\n  options: AgentToolCallOptions = {},\n): (...args: TArgs) => Promise<TResult> {\n  return (...args: TArgs): Promise<TResult> => {\n    const resolved =\n      typeof metadata === 'function' ? metadata(...args) : metadata;\n    return withAgentToolCall(\n      resolved,\n      (ctx, logger) => factory(ctx, logger)(...args),\n      options,\n    );\n  };\n}\n\nexport async function withAgentToolCall<T>(\n  metadata: AgentActionMetadata & { tool: ToolCallMetadata },\n  fn: AgentHandler<T>,\n  options: AgentToolCallOptions = {},\n): Promise<T> {\n  const start = Date.now();\n  const normalized = normalizeMetadata({\n    ...metadata,\n    tool: {\n      ...metadata.tool,\n      status: metadata.tool?.status ?? 'planned',\n    } as ToolCallMetadata,\n  });\n\n  return withAgentAction(\n    normalized,\n    async (ctx, logger) => {\n      try {\n        const result = await fn(ctx, logger);\n        const executionMs = Date.now() - start;\n        const completed: AgentActionMetadata = {\n          ...normalized,\n          outcome: normalized.outcome ?? 'success',\n          tool: {\n            ...metadata.tool,\n            inputHash: normalized.tool?.inputHash,\n            outputHash:\n              normalized.tool?.outputHash ??\n              (options.hashResult === false ? undefined : hashPayload(result)),\n            status: 'complete',\n            executionMs,\n          },\n        };\n        setAgentAttributes(completed, ctx);\n        logger.set(buildLifecycleUpdateContext(normalizeMetadata(completed)));\n        return result;\n      } catch (error) {\n        const failed: AgentActionMetadata = {\n          ...normalized,\n          outcome: 'failure',\n          tool: {\n            ...metadata.tool,\n            inputHash: normalized.tool?.inputHash,\n            status: 'error',\n            executionMs: Date.now() - start,\n          },\n        };\n        setAgentAttributes(failed, ctx);\n        logger.set(buildLifecycleUpdateContext(normalizeMetadata(failed)));\n        throw error;\n      }\n    },\n    options,\n  );\n}\n","import { hashPayload } from './hash.js';\nimport { recordPolicyDecision } from './runtime.js';\nimport type {\n  AgentActionOptions,\n  AgentIdentity,\n  DelegationContext,\n  GovernanceMetadata,\n} from './types.js';\n\nfunction buildAuthorityLineage(\n  parentIdentity: string,\n  agentId: string,\n  existingLineage?: string[],\n): string[] {\n  const lineage = existingLineage ? [...existingLineage] : [parentIdentity];\n  if (lineage.at(-1) !== agentId) {\n    lineage.push(agentId);\n  }\n  return lineage;\n}\n\nexport interface DelegateToAgentInput {\n  parentIdentity: string;\n  targetAgentId: string;\n  scope?: string | string[];\n  tokenId?: string;\n  delegationId?: string;\n  authorityLineage?: string[];\n  issuedAt?: string | Date;\n  expiresAt?: string | Date;\n}\n\nexport interface RecordAgentHandoffMetadata {\n  action: string;\n  fromAgent: AgentIdentity;\n  toAgent: AgentIdentity;\n  parentIdentity: string;\n  resource?: string;\n  scope?: string | string[];\n  tokenId?: string;\n  delegationId?: string;\n  authorityLineage?: string[];\n  governance?: GovernanceMetadata;\n}\n\nexport function delegateToAgent(input: DelegateToAgentInput): DelegationContext {\n  const authorityLineage = buildAuthorityLineage(\n    input.parentIdentity,\n    input.targetAgentId,\n    input.authorityLineage,\n  );\n\n  return {\n    parentIdentity: input.parentIdentity,\n    ...(input.scope !== undefined && { scope: input.scope }),\n    ...(input.tokenId !== undefined && { tokenId: input.tokenId }),\n    ...(input.delegationId !== undefined && { delegationId: input.delegationId }),\n    authorityLineage,\n    authorityLineageHash: hashPayload(authorityLineage),\n    depth: Math.max(authorityLineage.length - 1, 0),\n    issuedAt: input.issuedAt ?? new Date().toISOString(),\n    ...(input.expiresAt !== undefined && { expiresAt: input.expiresAt }),\n  };\n}\n\nexport function recordAgentHandoff(\n  metadata: RecordAgentHandoffMetadata,\n  options: AgentActionOptions = {},\n): void {\n  // Seed the lineage with the source agent when the caller didn't supply one,\n  // so the \"from\" side of the handoff is recorded in the canonical, queryable\n  // `delegation.authority_lineage` (and its hash) rather than surviving only in\n  // the free-text reasoningSummary.\n  const authorityLineage =\n    metadata.authorityLineage ?? [metadata.parentIdentity, metadata.fromAgent.id];\n\n  const delegation = delegateToAgent({\n    parentIdentity: metadata.parentIdentity,\n    targetAgentId: metadata.toAgent.id,\n    scope: metadata.scope,\n    tokenId: metadata.tokenId,\n    delegationId: metadata.delegationId,\n    authorityLineage,\n  });\n\n  recordPolicyDecision(\n    {\n      action: metadata.action,\n      resource: metadata.resource,\n      eventKind: 'handoff',\n      agent: metadata.toAgent,\n      delegation,\n      governance: metadata.governance,\n      reasoningSummary: `Control passed from ${metadata.fromAgent.id} to ${metadata.toAgent.id}.`,\n    },\n    options,\n  );\n}\n","import { buildLifecycleUpdateContext } from './metadata.js';\nimport { setAgentAttributes } from './attributes.js';\nimport { withAgentAction } from './runtime.js';\nimport type {\n  AgentActionOptions,\n  AgentHandler,\n  AgentSessionActionMetadata,\n} from './types.js';\n\nfunction toIsoString(value?: string | Date): string {\n  if (!value) return new Date().toISOString();\n  return value instanceof Date ? value.toISOString() : value;\n}\n\nexport async function withAgentSession<T>(\n  metadata: AgentSessionActionMetadata,\n  fn: AgentHandler<T>,\n  options: AgentActionOptions = {},\n): Promise<T> {\n  const startedAt = toIsoString(metadata.session?.startedAt);\n\n  return withAgentAction(\n    {\n      ...metadata,\n      category: metadata.category ?? 'agent_session',\n      session: {\n        ...metadata.session,\n        status: metadata.session?.status ?? 'active',\n        startedAt,\n      },\n    },\n    async (ctx, logger) => {\n      try {\n        const result = await fn(ctx, logger);\n        const completed = {\n          ...metadata,\n          outcome: metadata.outcome ?? 'success',\n          session: {\n            ...metadata.session,\n            status: 'completed' as const,\n            startedAt,\n            endedAt: new Date().toISOString(),\n          },\n        };\n        setAgentAttributes(completed, ctx);\n        logger.set(buildLifecycleUpdateContext(completed));\n        return result;\n      } catch (error) {\n        const failed = {\n          ...metadata,\n          outcome: 'failure' as const,\n          session: {\n            ...metadata.session,\n            status: 'failed' as const,\n            startedAt,\n            endedAt: new Date().toISOString(),\n          },\n        };\n        setAgentAttributes(failed, ctx);\n        logger.set(buildLifecycleUpdateContext(failed));\n        throw error;\n      }\n    },\n    options,\n  );\n}\n","import { hashPayload } from './hash.js';\nimport { delegateToAgent } from './delegation.js';\nimport type {\n  AgentIdentity,\n  AgentIdentityRegistry,\n  AgentIdentityRecord,\n  AgentIdentityStatus,\n  DelegationContext,\n} from './types.js';\n\nfunction toIsoString(value?: string | Date): string | undefined {\n  if (!value) return undefined;\n  return value instanceof Date ? value.toISOString() : value;\n}\n\nfunction normalizeScopes(scope?: string | string[]): string[] {\n  if (!scope) return [];\n  return Array.isArray(scope) ? [...scope] : [scope];\n}\n\nfunction isExpired(record: AgentIdentityRecord, at: string): boolean {\n  return record.expiresAt !== undefined && record.expiresAt < at;\n}\n\nexport interface ProvisionAgentIdentityInput {\n  agent: AgentIdentity;\n  scopes?: string[];\n  tokenId?: string;\n  delegatedBy?: string;\n  provisionedAt?: string | Date;\n  expiresAt?: string | Date;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface RotateAgentIdentityInput {\n  scopes?: string[];\n  tokenId?: string;\n  delegatedBy?: string;\n  rotatedAt?: string | Date;\n  expiresAt?: string | Date;\n  metadata?: Record<string, unknown>;\n}\n\nexport interface RevokeAgentIdentityInput {\n  reason: string;\n  revokedAt?: string | Date;\n}\n\nexport function createAgentIdentityRegistry(\n  initial: ProvisionAgentIdentityInput[] = [],\n): AgentIdentityRegistry {\n  const records = new Map<string, AgentIdentityRecord>();\n\n  const provisionIdentity = (\n    input: ProvisionAgentIdentityInput,\n  ): AgentIdentityRecord => {\n    const now = toIsoString(input.provisionedAt) ?? new Date().toISOString();\n    const record: AgentIdentityRecord = {\n      agent: input.agent,\n      scopes: input.scopes ?? [],\n      status: 'active',\n      tokenId: input.tokenId,\n      tokenHash:\n        input.tokenId === undefined ? undefined : hashPayload(input.tokenId),\n      delegatedBy: input.delegatedBy,\n      provisionedAt: now,\n      expiresAt: toIsoString(input.expiresAt),\n      metadata: input.metadata,\n    };\n    records.set(input.agent.id, record);\n    return record;\n  };\n\n  for (const item of initial) {\n    provisionIdentity(item);\n  }\n\n  return {\n    provisionIdentity,\n    rotateIdentity(agentId: string, input: RotateAgentIdentityInput = {}) {\n      const existing = records.get(agentId);\n      if (!existing) {\n        throw new Error(\n          `[autotel-genai] Cannot rotate unknown agent identity \"${agentId}\".`,\n        );\n      }\n\n      const rotatedAt = toIsoString(input.rotatedAt) ?? new Date().toISOString();\n      const record: AgentIdentityRecord = {\n        ...existing,\n        scopes: input.scopes ?? existing.scopes,\n        status: 'rotated',\n        tokenId: input.tokenId ?? existing.tokenId,\n        tokenHash:\n          input.tokenId === undefined\n            ? existing.tokenHash\n            : hashPayload(input.tokenId),\n        delegatedBy: input.delegatedBy ?? existing.delegatedBy,\n        rotatedAt,\n        expiresAt: toIsoString(input.expiresAt) ?? existing.expiresAt,\n        metadata: input.metadata ?? existing.metadata,\n      };\n      records.set(agentId, record);\n      return record;\n    },\n    revokeIdentity(agentId: string, input: RevokeAgentIdentityInput) {\n      const existing = records.get(agentId);\n      if (!existing) {\n        throw new Error(\n          `[autotel-genai] Cannot revoke unknown agent identity \"${agentId}\".`,\n        );\n      }\n\n      const revokedAt = toIsoString(input.revokedAt) ?? new Date().toISOString();\n      const record: AgentIdentityRecord = {\n        ...existing,\n        status: 'revoked',\n        revokedAt,\n        revocationReason: input.reason,\n      };\n      records.set(agentId, record);\n      return record;\n    },\n    getIdentity(agentId: string) {\n      return records.get(agentId);\n    },\n    getIdentityStatus(agentId: string, at = new Date().toISOString()) {\n      const record = records.get(agentId);\n      if (!record) return;\n      return isExpired(record, at) ? 'expired' : record.status;\n    },\n    assertUsable(agentId: string, at = new Date().toISOString()) {\n      const record = records.get(agentId);\n      if (!record) {\n        throw new Error(\n          `[autotel-genai] Unknown agent identity \"${agentId}\". Provision it before use.`,\n        );\n      }\n\n      const status: AgentIdentityStatus = isExpired(record, at)\n        ? 'expired'\n        : record.status;\n\n      if (status !== 'active' && status !== 'rotated') {\n        throw new Error(\n          `[autotel-genai] Agent identity \"${agentId}\" is ${status} and cannot execute delegated work.`,\n        );\n      }\n\n      return record;\n    },\n    assertScopes(agentId: string, requiredScopes: string[]) {\n      const record = this.assertUsable(agentId);\n      const missing = requiredScopes.filter(\n        (scope) => !record.scopes.includes(scope),\n      );\n\n      if (missing.length > 0) {\n        throw new Error(\n          `[autotel-genai] Agent identity \"${agentId}\" is missing delegated scopes: ${missing.join(', ')}.`,\n        );\n      }\n\n      return record;\n    },\n    issueDelegation(agentId: string, input) {\n      const record = this.assertUsable(agentId);\n      const scope = normalizeScopes(input.scope);\n      if (scope.length > 0) {\n        this.assertScopes(agentId, scope);\n      }\n\n      return delegateToAgent({\n        parentIdentity: input.parentIdentity,\n        targetAgentId: record.agent.id,\n        scope: input.scope ?? record.scopes,\n        tokenId: input.tokenId ?? record.tokenId,\n        delegationId: input.delegationId,\n        authorityLineage: input.authorityLineage,\n        issuedAt: input.issuedAt,\n        expiresAt: input.expiresAt ?? record.expiresAt,\n      }) satisfies DelegationContext;\n    },\n    list() {\n      return [...records.values()];\n    },\n  };\n}\n","import { hashPayload } from './hash.js';\nimport type { PrivacyProfile, PrivacyProfileName } from './types.js';\n\nexport type PrivacyProfileInput = PrivacyProfileName | PrivacyProfile;\n\nconst PRIVACY_PROFILES: Record<PrivacyProfileName, PrivacyProfile> = {\n  strict: {\n    name: 'strict',\n    hashKeys: [\n      /email/i,\n      /phone/i,\n      /user_?id/i,\n      /account/i,\n      /customer/i,\n      /card/i,\n      /iban/i,\n      /tax/i,\n    ],\n    dropKeys: [\n      /secret/i,\n      /token/i,\n      /api[_-]?key/i,\n      /authorization/i,\n      /cookie/i,\n      /password/i,\n      /bearer/i,\n    ],\n    maskKeys: [/name/i, /address/i, /prompt/i, /message/i, /content/i],\n    maxStringLength: 256,\n  },\n  pci: {\n    name: 'pci',\n    hashKeys: [/card/i, /pan/i, /account/i, /customer/i, /email/i],\n    dropKeys: [/cvv/i, /cvc/i, /secret/i, /token/i, /api[_-]?key/i],\n    maskKeys: [/name/i, /address/i],\n    maxStringLength: 128,\n  },\n  healthcare: {\n    name: 'healthcare',\n    hashKeys: [/patient/i, /mrn/i, /member/i, /email/i, /phone/i],\n    dropKeys: [/diagnosis/i, /notes/i, /secret/i, /token/i, /password/i],\n    maskKeys: [/name/i, /address/i, /symptom/i],\n    maxStringLength: 128,\n  },\n};\n\nfunction maskValue(value: unknown): unknown {\n  if (typeof value !== 'string') {\n    return '<masked>';\n  }\n\n  if (value.length <= 6) return '***';\n  return `${value.slice(0, 3)}***${value.slice(-3)}`;\n}\n\nfunction matches(patterns: RegExp[] | undefined, key: string): boolean {\n  return patterns?.some((pattern) => pattern.test(key)) ?? false;\n}\n\nfunction truncateString(value: string, maxLength?: number): string {\n  if (maxLength === undefined || value.length <= maxLength) {\n    return value;\n  }\n\n  return `${value.slice(0, maxLength)}…`;\n}\n\nfunction sanitizeNode(\n  value: unknown,\n  profile: PrivacyProfile,\n  keyPath: string,\n): unknown {\n  if (value instanceof Date) {\n    return value.toISOString();\n  }\n\n  const lowered = keyPath.toLowerCase();\n\n  if (matches(profile.dropKeys, lowered)) {\n    return '<redacted>';\n  }\n\n  if (matches(profile.hashKeys, lowered)) {\n    return hashPayload(value);\n  }\n\n  if (matches(profile.maskKeys, lowered)) {\n    return maskValue(value);\n  }\n\n  if (typeof value === 'string') {\n    return truncateString(value, profile.maxStringLength);\n  }\n\n  if (Array.isArray(value)) {\n    return value.map((entry, index) =>\n      sanitizeNode(entry, profile, `${keyPath}[${index}]`),\n    );\n  }\n\n  if (value && typeof value === 'object') {\n    return Object.fromEntries(\n      Object.entries(value as Record<string, unknown>).map(([key, entry]) => [\n        key,\n        sanitizeNode(entry, profile, keyPath ? `${keyPath}.${key}` : key),\n      ]),\n    );\n  }\n\n  if (typeof value === 'bigint') {\n    return value.toString(10);\n  }\n\n  return value;\n}\n\nexport function resolvePrivacyProfile(\n  profile: PrivacyProfileInput = 'strict',\n): PrivacyProfile {\n  return typeof profile === 'string' ? PRIVACY_PROFILES[profile] : profile;\n}\n\nexport function sanitizeAuditPayload(\n  value: unknown,\n  profile: PrivacyProfileInput = 'strict',\n): unknown {\n  return sanitizeNode(value, resolvePrivacyProfile(profile), '');\n}\n","import { AGENT_AUDIT_SCHEMA_VERSION } from './constants.js';\nimport { canonicalizeForHash, hashPayload } from './hash.js';\nimport { normalizeMetadata } from './metadata.js';\nimport { sanitizeAuditPayload, type PrivacyProfileInput } from './privacy.js';\nimport type {\n  AgentActionMetadata,\n  AgentAuditEventEnvelope,\n} from './types.js';\n\nfunction toIsoString(value?: string | Date): string {\n  if (!value) return new Date().toISOString();\n  return value instanceof Date ? value.toISOString() : value;\n}\n\nexport interface CreateSignedEventEnvelopeOptions {\n  emittedAt?: string | Date;\n  previousEventHash?: string;\n  evidence?: unknown;\n  privacyProfile?: PrivacyProfileInput;\n  signer?: (serialized: string) => string | Promise<string>;\n}\n\nexport async function createSignedEventEnvelope(\n  metadata: AgentActionMetadata,\n  options: CreateSignedEventEnvelopeOptions = {},\n): Promise<AgentAuditEventEnvelope> {\n  const normalized = normalizeMetadata(metadata);\n  const envelopeBase = {\n    schemaVersion: normalized.schemaVersion ?? AGENT_AUDIT_SCHEMA_VERSION,\n    emittedAt: toIsoString(options.emittedAt),\n    ...(options.previousEventHash !== undefined && {\n      previousEventHash: options.previousEventHash,\n    }),\n    metadata: normalized,\n    ...(options.evidence !== undefined && {\n      evidence: sanitizeAuditPayload(\n        options.evidence,\n        options.privacyProfile ?? 'strict',\n      ),\n    }),\n  };\n\n  const eventHash = hashPayload(envelopeBase);\n  const signature = options.signer\n    ? await options.signer(canonicalizeForHash(envelopeBase))\n    : undefined;\n\n  return {\n    ...envelopeBase,\n    eventHash,\n    ...(signature !== undefined && { signature }),\n  };\n}\n\nexport function verifyEventEnvelopeHash(\n  envelope: AgentAuditEventEnvelope,\n): boolean {\n  const expected = hashPayload({\n    schemaVersion: envelope.schemaVersion,\n    emittedAt: envelope.emittedAt,\n    ...(envelope.previousEventHash !== undefined && {\n      previousEventHash: envelope.previousEventHash,\n    }),\n    metadata: envelope.metadata,\n    ...(envelope.evidence !== undefined && {\n      evidence: envelope.evidence,\n    }),\n  });\n  return envelope.eventHash === expected;\n}\n","import { createStructuredError } from 'autotel';\nimport { sanitizeAuditPayload, type PrivacyProfileInput } from './privacy.js';\nimport { recordDecisionBasis, recordPolicyDecision, withAgentToolCall } from './runtime.js';\nimport { hashPayload } from './hash.js';\nimport type {\n  AgentActionOptions,\n  AgentDecisionMetadata,\n  AgentHandler,\n  AgentToolCallOptions,\n  DelegationContext,\n  GovernanceMetadata,\n  PolicyMetadata,\n  ScopedToolDefinition,\n} from './types.js';\n\nfunction normalizeScopes(scope?: string | string[]): string[] {\n  if (!scope) return [];\n  return Array.isArray(scope) ? scope : [scope];\n}\n\nfunction missingScopes(\n  delegated: string[],\n  required: string[],\n): string[] {\n  return required.filter((scope) => !delegated.includes(scope));\n}\n\ninterface ScopeDenial {\n  scopes: string[];\n  reason: string;\n  why: string;\n}\n\n/**\n * Decide whether a scoped tool call must be denied.\n *\n * When the identity is registry-backed, the registry is authoritative: a\n * delegation may only *narrow* the stored grant, never widen it. Scopes a\n * caller claims that the registry never granted are a forged escalation and are\n * denied before any missing-scope check — otherwise passing an explicit\n * `delegation.scope` could grant access the registry record does not allow.\n */\nfunction resolveScopeDenial(\n  claimedScopes: string[],\n  requiredScopes: string[],\n  registryScopes: string[] | undefined,\n): ScopeDenial | undefined {\n  const unauthorized = registryScopes\n    ? claimedScopes.filter((scope) => !registryScopes.includes(scope))\n    : [];\n  if (unauthorized.length > 0) {\n    return {\n      scopes: unauthorized,\n      reason: `unauthorized_scope:${unauthorized.join(',')}`,\n      why: `Delegation claims scopes the identity was never granted: ${unauthorized.join(', ')}`,\n    };\n  }\n\n  const missing = missingScopes(claimedScopes, requiredScopes);\n  if (missing.length > 0) {\n    return {\n      scopes: missing,\n      reason: `missing_scope:${missing.join(',')}`,\n      why: `Missing delegated scopes: ${missing.join(', ')}`,\n    };\n  }\n\n  return undefined;\n}\n\nfunction resolveDelegation(\n  definition: Pick<ScopedToolDefinition<unknown>, 'agent' | 'delegation' | 'identityRegistry'>,\n): DelegationContext | undefined {\n  const registry = definition.identityRegistry;\n  if (registry) {\n    registry.assertUsable(definition.agent.id);\n  }\n\n  return definition.delegation;\n}\n\nfunction buildGovernance(\n  governance: GovernanceMetadata | undefined,\n  reviewRequired: boolean | undefined,\n): GovernanceMetadata | undefined {\n  if (!governance && reviewRequired === undefined) return governance;\n  return {\n    ...governance,\n    ...(reviewRequired !== undefined && { reviewRequired }),\n  };\n}\n\nfunction buildDecision(\n  input: unknown,\n  decision: AgentDecisionMetadata | undefined,\n  privacyProfile: PrivacyProfileInput | undefined,\n): AgentDecisionMetadata | undefined {\n  if (!decision) return undefined;\n\n  const sanitizedInput = sanitizeAuditPayload(input, privacyProfile ?? 'strict');\n  return {\n    ...decision,\n    inputHash: decision.inputHash ?? hashPayload(sanitizedInput),\n  };\n}\n\nexport async function withScopedTool<TInput, TOutput>(\n  definition: ScopedToolDefinition<TInput>,\n  input: TInput,\n  fn: AgentHandler<TOutput>,\n  options: AgentToolCallOptions & AgentActionOptions = {},\n): Promise<TOutput> {\n  const requiredScopes = definition.requiredScopes ?? [];\n  const delegation = resolveDelegation(definition);\n  const registryScopes = definition.identityRegistry?.getIdentity(\n    definition.agent.id,\n  )?.scopes;\n  const claimedScopes = normalizeScopes(delegation?.scope ?? registryScopes);\n  const denial = resolveScopeDenial(\n    claimedScopes,\n    requiredScopes,\n    registryScopes,\n  );\n  const policy: PolicyMetadata | undefined =\n    definition.policyId || definition.riskScore !== undefined || denial\n      ? {\n          decision: denial ? 'deny' : 'permit',\n          ...(definition.policyId !== undefined && {\n            policyId: definition.policyId,\n          }),\n          ...(definition.riskScore !== undefined && {\n            riskScore: definition.riskScore,\n          }),\n          ...(denial && { reason: denial.reason }),\n        }\n      : undefined;\n\n  const governance = buildGovernance(\n    definition.governance,\n    definition.reviewRequired,\n  );\n\n  if (policy && policy.decision === 'deny' && denial) {\n    recordPolicyDecision(\n      {\n        action: definition.action,\n        resource: definition.resource ?? definition.tool.name,\n        category: definition.category,\n        agent: definition.agent,\n        delegation,\n        policy,\n        governance,\n        decision: buildDecision(\n          input,\n          definition.decision,\n          definition.privacyProfile,\n        ),\n      },\n      options,\n    );\n\n    throw createStructuredError({\n      status: 403,\n      code: 'AGENT_SCOPE_DENIED',\n      message: `Agent \"${definition.agent.id}\" cannot invoke ${definition.tool.name}.`,\n      why: denial.why,\n      fix: 'Grant the missing scopes or route the task to an agent with the required delegation.',\n    });\n  }\n\n  if (policy) {\n    recordPolicyDecision(\n      {\n        action: `${definition.action}.policy`,\n        resource: definition.resource ?? definition.tool.name,\n        category: definition.category,\n        agent: definition.agent,\n        delegation,\n        policy,\n        governance,\n      },\n      options,\n    );\n  }\n\n  if (definition.decision) {\n    recordDecisionBasis(\n      {\n        action: `${definition.action}.decision`,\n        resource: definition.resource ?? definition.tool.name,\n        category: definition.category,\n        agent: definition.agent,\n        delegation,\n        governance,\n        decision: buildDecision(\n          input,\n          definition.decision,\n          definition.privacyProfile,\n        ),\n      },\n      options,\n    );\n  }\n\n  return withAgentToolCall(\n    {\n      action: definition.action,\n      resource: definition.resource ?? definition.tool.name,\n      category: definition.category,\n      agent: definition.agent,\n      delegation,\n      governance,\n      tool: {\n        ...definition.tool,\n        input,\n      },\n    },\n    fn,\n    options,\n  );\n}\n"],"mappings":";;;;;;;AAAA,MAAa,6BAA6B;;;;ACM1C,SAAS,aAAa,OAAyB;CAC7C,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAG3B,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,SAAS,EAAE;CAG1B,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,UAAU,aAAa,KAAK,CAAC;CAGjD,IAAI,SAAS,OAAO,UAAU,UAAU;EAEtC,MAAM,UAAU,OAAO,QAAQ,KAAgC;EAC/D,QAAQ,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,cAAc,KAAK,CAAC;EAC3D,OAAO,OAAO,YACZ,QAAQ,KAAK,CAAC,KAAK,gBAAgB,CAAC,KAAK,aAAa,UAAU,CAAC,CAAC,CACpE;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,oBAAoB,OAAwB;CAC1D,OAAO,KAAK,UAAU,aAAa,KAAK,CAAC;AAC3C;AAEA,SAAgB,YACd,OACA,UAA8B,CAAC,GACvB;CACR,MAAM,YAAY,QAAQ,aAAa;CACvC,MAAM,YAAY,oBAAoB,KAAK;CAE3C,OAAO,GAAG,UAAU,+BADM,SAAS,CAAC,CAAC,OAAO,SAAS,CAAC,CAAC,OAAO,KAClC;AAC9B;;;;ACxBA,SAAgB,iBACd,UACgB;CAChB,IAAI,SAAS,WAAW,OAAO,SAAS;CACxC,IAAI,SAAS,MAAM,OAAO;CAC1B,IAAI,SAAS,QAAQ,OAAO;CAC5B,OAAO;AACT;AAEA,SAAgB,cACd,MAC8B;CAC9B,IAAI,CAAC,MAAM,OAAO;CAElB,OAAO;EACL,MAAM,KAAK;EACX,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,WACE,KAAK,UAAU,SACX,KAAK,YACJ,KAAK,aAAa,YAAY,KAAK,KAAK;EAC/C,YACE,KAAK,WAAW,SACZ,KAAK,aACJ,KAAK,cAAc,YAAY,KAAK,MAAM;EACjD,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,GAAI,KAAK,gBAAgB,UAAa,EAAE,aAAa,KAAK,YAAY;CACxE;AACF;AAEA,SAAgB,aACd,MAC8B;CAC9B,IAAI,CAAC,MAAM,OAAO;CAElB,OAAO;EACL,MAAM,KAAK;EACX,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,GAAI,KAAK,cAAc,UAAa,EAAE,WAAW,KAAK,UAAU;EAChE,GAAI,KAAK,eAAe,UAAa,EAAE,YAAY,KAAK,WAAW;EACnE,GAAI,KAAK,WAAW,UAAa,EAAE,QAAQ,KAAK,OAAO;EACvD,GAAI,KAAK,gBAAgB,UAAa,EAAE,aAAa,KAAK,YAAY;CACxE;AACF;AAEA,SAAgB,mBACd,YACgC;CAChC,IAAI,CAAC,YAAY,OAAO;CACxB,OAAO;EACL,GAAI,WAAW,mBAAmB,UAAa,EAC7C,gBAAgB,WAAW,eAC7B;EACA,GAAI,WAAW,eAAe,UAAa,EACzC,YAAY,WAAW,WACzB;EACA,GAAI,WAAW,cAAc,UAAa,EACxC,WAAW,WAAW,UACxB;EACA,GAAI,WAAW,qBAAqB,UAAa,EAC/C,kBAAkB,WAAW,iBAC/B;EACA,GAAI,WAAW,mBAAmB,UAAa,EAC7C,gBAAgB,WAAW,eAC7B;EACA,GAAI,WAAW,cAAc,UAAa,EACxC,WAAW,WAAW,UACxB;CACF;AACF;AAEA,SAAS,kBACP,UACA,kBACmC;CACnC,IAAI,UACF,OAAO;EACL,GAAG;EACH,SAAS,SAAS,WAAW,oBAAoB;CACnD;CAGF,IAAI,qBAAqB,QAAW,OAAO;CAE3C,OAAO,EACL,SAAS,iBACX;AACF;AAEA,SAAgB,yBACd,UACqB;CACrB,MAAM,YAAY,iBAAiB,QAAQ;CAE3C,IAAI,cAAc,eAAe,CAAC,SAAS,MACzC,MAAM,IAAI,MACR,iEACF;CAGF,IAAI,cAAc,qBAAqB,CAAC,SAAS,QAC/C,MAAM,IAAI,MACR,yEACF;CAGF,IAAI,cAAc,aAAa,CAAC,SAAS,YACvC,MAAM,IAAI,MACR,qEACF;CAGF,MAAM,aACJ,SAAS,eAEP,SAAS,WAAW,yBAAyB,UAC7C,SAAS,WAAW,UAAU,UAE5B;EACE,GAAG,SAAS;EACZ,GAAI,SAAS,WAAW,oBAAoB;GAC1C,sBACE,SAAS,WAAW,wBACpB,YAAY,SAAS,WAAW,gBAAgB;GAClD,OACE,SAAS,WAAW,SACpB,KAAK,IAAI,SAAS,WAAW,iBAAiB,SAAS,GAAG,CAAC;EAC/D;CACF,IACA,SAAS;CAEf,OAAO;EACL,GAAG;EACH,eAAe,SAAS;EACxB;EACA,UAAU,kBAAkB,SAAS,UAAU,SAAS,gBAAgB;EACxE,GAAI,eAAe,UAAa,EAAE,WAAW;CAC/C;AACF;AAEA,SAAgB,kBACd,UACqB;CACrB,MAAM,aAAa,yBAAyB,QAAQ;CACpD,OAAO;EACL,GAAG;EACH,MAAM,cAAc,WAAW,IAAI;CACrC;AACF;AAEA,SAAgB,mBACd,UACmB;CACnB,OAAO;EACL,QAAQ,SAAS;EACjB,GAAI,SAAS,aAAa,UAAa,EAAE,UAAU,SAAS,SAAS;EACrE,SACE,SAAS,WACT,SAAS,YAAY,kBACrB,SAAS,MAAM;EACjB,UAAU,SAAS,YAAY;EAC/B,GAAI,SAAS,YAAY,UAAa,EAAE,SAAS,SAAS,QAAQ;EAClE,SAAS,SAAS,MAAM;EACxB,gBAAgB,SAAS;EACzB,mBAAmB,SAAS;EAC5B,GAAI,SAAS,MAAM,YAAY,UAAa,EAC1C,cAAc,SAAS,MAAM,QAC/B;EACA,GAAI,SAAS,MAAM,SAAS,UAAa,EAAE,UAAU,SAAS,KAAK,KAAK;EACxE,GAAI,SAAS,QAAQ,aAAa,UAAa,EAC7C,gBAAgB,SAAS,OAAO,SAClC;EACA,GAAI,SAAS,SAAS,WAAW,UAAa,EAC5C,eAAe,SAAS,QAAQ,OAClC;CACF;AACF;AAEA,SAAgB,mBACd,UACyB;CACzB,MAAM,OAAO,aAAa,SAAS,IAAI;CACvC,MAAM,aAAa,mBAAmB,SAAS,UAAU;CAEzD,MAAM,UAAmC;EACvC,OAAO;GACL,GAAG,SAAS;GACZ,GAAI,SAAS,aAAa,UAAa,EAAE,UAAU,SAAS,SAAS;GACrE,GAAI,SAAS,YAAY,UAAa,EAAE,SAAS,SAAS,QAAQ;GAClE,GAAI,SAAS,qBAAqB,UAAa,EAC7C,kBAAkB,SAAS,iBAC7B;GACA,eAAe,SAAS;GACxB,WAAW,SAAS,aAAa,iBAAiB,QAAQ;EAC5D;EACA,GAAI,SAAS,eAAe,UAAa,EACvC,YAAY,SAAS,WACvB;EACA,GAAI,SAAS,UAAa,EAAE,KAAK;EACjC,GAAI,SAAS,WAAW,UAAa,EAAE,QAAQ,SAAS,OAAO;EAC/D,GAAI,eAAe,UAAa,EAAE,WAAW;EAC7C,GAAI,SAAS,YAAY,UAAa,EAAE,SAAS,SAAS,QAAQ;EAClE,GAAI,SAAS,aAAa,UAAa,EAAE,UAAU,SAAS,SAAS;CACvE;CASA,OAAO,gBAAgB,OAAO;AAChC;;;;;;;;;;AAWA,SAAgB,4BACd,UACyB;CACzB,MAAM,OAAO,aAAa,SAAS,IAAI;CACvC,OAAO;EACL,GAAI,SAAS,UAAa,EAAE,KAAK;EACjC,GAAI,SAAS,YAAY,UAAa,EACpC,SAAS,gBAAgB,SAAS,OAAO,EAC3C;CACF;AACF;;;;ACjPA,MAAa,0BACX;;;;;AAOF,MAAM,mBAAmB;AAEzB,SAAgB,mBAAmB,KAAyC;CAC1E,IAAI,KAAK,OAAO;CAEhB,MAAM,OAAOA,kBAAU,cAAc;CACrC,IAAI,CAAC,MAAM,OAAO;CAMlB,MAAM,mCAAsB;CAC5B,MAAM,KAAK,KAAK,YAAY;CAC5B,MAAM,UAAU,KAAK,WAAW,GAAG;CACnC,IAAI,CAAC,WAAW,YAAY,kBAAkB,OAAO;CAErD,OAAO;EACL;EACA,QAAQ,KAAK,UAAU,GAAG;EAC1B,eAAe,KAAK,iBAAiB,QAAQ,MAAM,GAAG,EAAE;EACxD,eAAe,KAAK,UAAU,KAAK,aAAa,KAAK,KAAK;EAC1D,gBAAgB,UAAU,KAAK,cAAc,KAAK;CACpD;AACF;AAEA,SAAgB,eAAe,KAAkC;CAC/D,MAAM,WAAW,mBAAmB,GAAG;CACvC,IAAI,UAAU,OAAO;CACrB,MAAM,IAAI,MAAM,uBAAuB;AACzC;AAEA,MAAM,uCAAuB,IAAI,IAAY;;AAG7C,SAAgB,uBAAuB,QAAsB;CAC3D,IAAI,qBAAqB,IAAI,MAAM,GAAG;CACtC,qBAAqB,IAAI,MAAM;CAC/B,QAAQ,KACN,gDAAgD,OAAO,4MAGzD;AACF;AAaA,SAAgB,iBACd,OACyE;CACzE,IACE,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,WAEjB,OAAO;CAGT,IAAI,MAAM,QAAQ,KAAK,GAAG;EACxB,IAAI,MAAM,OAAO,UAAU,OAAO,UAAU,QAAQ,GAClD,OAAO;EAGT,IAAI,MAAM,OAAO,UAAU,OAAO,UAAU,QAAQ,GAClD,OAAO;EAGT,IAAI,MAAM,OAAO,UAAU,OAAO,UAAU,SAAS,GACnD,OAAO;EAGT,IAAI;GACF,OAAO,KAAK,UAAU,KAAK;EAC7B,QAAQ;GACN,OAAO;EACT;CACF;CAEA,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAG3B,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,SAAS,EAAE;CAG1B,IAAI,UAAU,QAAQ,UAAU,QAC9B;CAGF,IAAI;EACF,OAAO,KAAK,UAAU,KAAK;CAC7B,QAAQ;EACN,OAAO;CACT;AACF;;;;ACpGA,SAAS,aAAa,QAAsB,KAAa,OAAsB;CAC7E,MAAM,OAAO,iBAAiB,KAAK;CACnC,IAAI,SAAS,QACX,OAAO,OAAO;AAElB;AAEA,SAAS,yBAAyB,OAAqB,OAA4B;CACjF,aAAa,OAAO,YAAY,MAAM,EAAE;CACxC,aAAa,OAAO,iBAAiB,MAAM,OAAO;CAClD,aAAa,OAAO,mBAAmB,MAAM,SAAS;CACtD,aAAa,OAAO,eAAe,MAAM,KAAK;CAC9C,aAAa,OAAO,cAAc,MAAM,IAAI;CAC5C,aAAa,OAAO,oBAAoB,MAAM,SAAS;CACvD,aAAa,OAAO,yBAAyB,MAAM,cAAc;AACnE;AAEA,SAAS,2BACP,OACA,YACM;CACN,IAAI,CAAC,YAAY;CACjB,aAAa,OAAO,8BAA8B,WAAW,cAAc;CAC3E,aAAa,OAAO,oBAAoB,WAAW,KAAK;CACxD,aAAa,OAAO,uBAAuB,WAAW,OAAO;CAC7D,aAAa,OAAO,iBAAiB,WAAW,YAAY;CAC5D,aAAa,OAAO,gCAAgC,WAAW,gBAAgB;CAC/E,aACE,OACA,qCACA,WAAW,oBACb;CACA,aAAa,OAAO,oBAAoB,WAAW,KAAK;CACxD,aAAa,OAAO,wBAAwB,WAAW,QAAQ;CAC/D,aAAa,OAAO,yBAAyB,WAAW,SAAS;AACnE;AAEA,SAAS,qBAAqB,OAAqB,MAA+B;CAChF,IAAI,CAAC,MAAM;CACX,aAAa,OAAO,aAAa,KAAK,IAAI;CAC1C,aAAa,OAAO,gBAAgB,KAAK,MAAM;CAC/C,aAAa,OAAO,mBAAmB,KAAK,SAAS;CACrD,aAAa,OAAO,oBAAoB,KAAK,UAAU;CACvD,aAAa,OAAO,eAAe,KAAK,MAAM;CAC9C,aAAa,OAAO,qBAAqB,KAAK,WAAW;AAC3D;AAEA,SAAS,uBAAuB,OAAqB,QAA+B;CAClF,IAAI,CAAC,QAAQ;CACb,aAAa,OAAO,mBAAmB,OAAO,QAAQ;CACtD,aAAa,OAAO,aAAa,OAAO,QAAQ;CAChD,aAAa,OAAO,qBAAqB,OAAO,SAAS;CACzD,aAAa,OAAO,iBAAiB,OAAO,MAAM;AACpD;AAEA,SAAS,2BACP,OACA,YACM;CACN,IAAI,CAAC,YAAY;CACjB,aAAa,OAAO,8BAA8B,WAAW,cAAc;CAC3E,aAAa,OAAO,0BAA0B,WAAW,UAAU;CACnE,aAAa,OAAO,yBAAyB,WAAW,SAAS;CACjE,aAAa,OAAO,gCAAgC,WAAW,gBAAgB;CAC/E,aAAa,OAAO,8BAA8B,WAAW,cAAc;CAC3E,aAAa,OAAO,wBAAwB,WAAW,SAAS;AAClE;AAEA,SAAS,wBACP,OACA,SACM;CACN,IAAI,CAAC,SAAS;CACd,aAAa,OAAO,wBAAwB,QAAQ,MAAM;CAC1D,aAAa,OAAO,4BAA4B,QAAQ,SAAS;CACjE,aAAa,OAAO,0BAA0B,QAAQ,OAAO;CAC7D,aAAa,OAAO,8BAA8B,QAAQ,WAAW;AACvE;AAEA,SAAS,yBACP,OACA,UACM;CACN,IAAI,CAAC,UAAU;CACf,aAAa,OAAO,oBAAoB,SAAS,OAAO;CACxD,aAAa,OAAO,uBAAuB,SAAS,SAAS;CAC7D,aAAa,OAAO,uBAAuB,SAAS,SAAS;CAC7D,aAAa,OAAO,gCAAgC,SAAS,kBAAkB;CAC/E,aAAa,OAAO,yBAAyB,SAAS,WAAW;CACjE,aAAa,OAAO,4BAA4B,SAAS,cAAc;CACvE,aAAa,OAAO,uBAAuB,SAAS,UAAU;AAChE;AAEA,SAAgB,uBACd,UACc;CACd,MAAM,aAAa,kBAAkB,QAAQ;CAC7C,MAAM,QAAsB;EAC1B,iBAAiB;EACjB,gBAAgB,WAAW;EAC3B,uBACE,WAAW;EACb,oBAAoB,WAAW,aAAa,iBAAiB,UAAU;CACzE;CAEA,aAAa,OAAO,kBAAkB,WAAW,QAAQ;CACzD,aAAa,OAAO,iBAAiB,WAAW,OAAO;CACvD,aAAa,OAAO,qBAAqB,WAAW,gBAAgB;CACpE,yBAAyB,OAAO,WAAW,KAAK;CAChD,2BAA2B,OAAO,WAAW,UAAU;CACvD,qBAAqB,OAAO,WAAW,IAAI;CAC3C,uBAAuB,OAAO,WAAW,MAAM;CAC/C,2BAA2B,OAAO,WAAW,UAAU;CACvD,wBAAwB,OAAO,WAAW,OAAO;CACjD,yBAAyB,OAAO,WAAW,QAAQ;CAEnD,OAAO;AACT;AAEA,SAAgB,mBACd,UACA,KACM;CAEN,AADiB,eAAe,GACzB,CAAC,CAAC,cAAc,uBAAuB,QAAQ,CAAC;AACzD;;;;;;AAOA,SAAgB,gBACd,SACA,KACM;CACN,eAAe,GAAG,CAAC,CAAC,aAAa,iBAAiB,OAAO;AAC3D;;;;;;;;;;;;;;AChHA,SAAS,kBACP,KACA,IACA,OACM;CACN,MAAM,QAA2B;EAC/B,GAAGC,0CAAuB;GACxB,WAAW,GAAG;GACd,UAAU,GAAG;GACb,OAAO,GAAG;EACZ,CAAC;EACD,GAAGC,2CAAwB;GACzB,OAAO,GAAG;GACV,IAAI,GAAG;GACP,eAAe,GAAG;EACpB,CAAC;CACH;CACA,IAAI,OAAO;EACT,MAAM,OAAOC,6BACX,GAAG,OACH,OACA,GAAG,UAAU,EAAE,SAAS,GAAG,QAAQ,IAAI,MACzC;EACA,OAAO,OAAO,OAAOC,wCAAqB;GAAE,GAAG;GAAO,SAAS;EAAK,CAAC,CAAC;CACxE;CACA,IAAI,cAAc,KAAK;AACzB;AAEA,eAAsB,gBACpB,UACA,IACA,UAA8B,CAAC,GACnB;CACZ,MAAM,aAAa,kBAAkB,QAAQ;CAE7C,oCACE,mBAAmB,UAAU,GAC7B,OAAO,KAAmB,WAA0B;EAClD,mBAAmB,YAAY,GAAG;EAClC,OAAO,IAAI,mBAAmB,UAAU,CAAC;EAEzC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAqB,MAAM;GACnD,MAAM,UAAU,WAAW,WAAW;GACtC,gBAAgB,SAAS,GAAG;GAC5B,OAAO,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;GACjC,IAAI,WAAW,IACb,kBACE,KACA,WAAW,IACX,QAAQ,eAAe,MAAM,KAAK,WAAW,GAAG,KAClD;GAEF,OAAO;EACT,SAAS,OAAO;GACd,gBAAgB,WAAW,GAAG;GAC9B,OAAO,IAAI,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;GAC5C,IAAI,WAAW,IAAI,kBAAkB,KAAK,WAAW,EAAE;GACvD,MAAM;EACR;CACF,GACA,OACF;AACF;AAEA,SAAgB,qBACd,UACA,UAA8B,CAAC,GACzB;CACN,MAAM,aAAa,kBAAkB,QAAQ;CAC7C,MAAM,WAAW,mBAAmB,QAAQ,GAAG;CAI/C,IAAI,CAAC,UAAU;EACb,MAAM,OAAO,QAAQ,oBAAoB;EACzC,IAAI,SAAS,SACX,MAAM,IAAI,MAAM,uBAAuB;EAEzC,IAAI,SAAS,QACX,uBAAuB,WAAW,MAAM;EAE1C;CACF;CAEA,MAAM,SACJ,QAAQ,4CAA+B,0CAA6B;CAEtE,IAAI,QAAQ,cAAc,OACxB,uCAAoB,QAAQ;CAG9B,mBAAmB,YAAY,QAAQ;CACvC,OAAO,IAAI,mBAAmB,UAAU,CAAC;CAEzC,IAAI,QAAQ,SACV,OAAO,QAAQ;AAEnB;AAEA,SAAgB,oBACd,UACA,UAA8B,CAAC,GACzB;CACN,IAAI,CAAC,SAAS,YAAY,CAAC,SAAS,kBAClC,MAAM,IAAI,MACR,8FACF;CAGF,qBAAqB,UAAU,OAAO;AACxC;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,kBACd,UACA,SACA,UAA8B,CAAC,GACO;CACtC,QAAQ,GAAG,SAAkC;EAG3C,OAAO,gBADL,OAAO,aAAa,aAAa,SAAS,GAAG,IAAI,IAAI,WAGpD,KAAK,WAAW,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,IAAI,GAC7C,OACF;CACF;AACF;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,oBACd,UACA,SACA,UAAgC,CAAC,GACK;CACtC,QAAQ,GAAG,SAAkC;EAG3C,OAAO,kBADL,OAAO,aAAa,aAAa,SAAS,GAAG,IAAI,IAAI,WAGpD,KAAK,WAAW,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,IAAI,GAC7C,OACF;CACF;AACF;AAEA,eAAsB,kBACpB,UACA,IACA,UAAgC,CAAC,GACrB;CACZ,MAAM,QAAQ,KAAK,IAAI;CACvB,MAAM,aAAa,kBAAkB;EACnC,GAAG;EACH,MAAM;GACJ,GAAG,SAAS;GACZ,QAAQ,SAAS,MAAM,UAAU;EACnC;CACF,CAAC;CAED,OAAO,gBACL,YACA,OAAO,KAAK,WAAW;EACrB,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,MAAM;GACnC,MAAM,cAAc,KAAK,IAAI,IAAI;GACjC,MAAM,YAAiC;IACrC,GAAG;IACH,SAAS,WAAW,WAAW;IAC/B,MAAM;KACJ,GAAG,SAAS;KACZ,WAAW,WAAW,MAAM;KAC5B,YACE,WAAW,MAAM,eAChB,QAAQ,eAAe,QAAQ,SAAY,YAAY,MAAM;KAChE,QAAQ;KACR;IACF;GACF;GACA,mBAAmB,WAAW,GAAG;GACjC,OAAO,IAAI,4BAA4B,kBAAkB,SAAS,CAAC,CAAC;GACpE,OAAO;EACT,SAAS,OAAO;GACd,MAAM,SAA8B;IAClC,GAAG;IACH,SAAS;IACT,MAAM;KACJ,GAAG,SAAS;KACZ,WAAW,WAAW,MAAM;KAC5B,QAAQ;KACR,aAAa,KAAK,IAAI,IAAI;IAC5B;GACF;GACA,mBAAmB,QAAQ,GAAG;GAC9B,OAAO,IAAI,4BAA4B,kBAAkB,MAAM,CAAC,CAAC;GACjE,MAAM;EACR;CACF,GACA,OACF;AACF;;;;AC5RA,SAAS,sBACP,gBACA,SACA,iBACU;CACV,MAAM,UAAU,kBAAkB,CAAC,GAAG,eAAe,IAAI,CAAC,cAAc;CACxE,IAAI,QAAQ,GAAG,EAAE,MAAM,SACrB,QAAQ,KAAK,OAAO;CAEtB,OAAO;AACT;AA0BA,SAAgB,gBAAgB,OAAgD;CAC9E,MAAM,mBAAmB,sBACvB,MAAM,gBACN,MAAM,eACN,MAAM,gBACR;CAEA,OAAO;EACL,gBAAgB,MAAM;EACtB,GAAI,MAAM,UAAU,UAAa,EAAE,OAAO,MAAM,MAAM;EACtD,GAAI,MAAM,YAAY,UAAa,EAAE,SAAS,MAAM,QAAQ;EAC5D,GAAI,MAAM,iBAAiB,UAAa,EAAE,cAAc,MAAM,aAAa;EAC3E;EACA,sBAAsB,YAAY,gBAAgB;EAClD,OAAO,KAAK,IAAI,iBAAiB,SAAS,GAAG,CAAC;EAC9C,UAAU,MAAM,6BAAY,IAAI,KAAK,EAAC,CAAC,YAAY;EACnD,GAAI,MAAM,cAAc,UAAa,EAAE,WAAW,MAAM,UAAU;CACpE;AACF;AAEA,SAAgB,mBACd,UACA,UAA8B,CAAC,GACzB;CAKN,MAAM,mBACJ,SAAS,oBAAoB,CAAC,SAAS,gBAAgB,SAAS,UAAU,EAAE;CAE9E,MAAM,aAAa,gBAAgB;EACjC,gBAAgB,SAAS;EACzB,eAAe,SAAS,QAAQ;EAChC,OAAO,SAAS;EAChB,SAAS,SAAS;EAClB,cAAc,SAAS;EACvB;CACF,CAAC;CAED,qBACE;EACE,QAAQ,SAAS;EACjB,UAAU,SAAS;EACnB,WAAW;EACX,OAAO,SAAS;EAChB;EACA,YAAY,SAAS;EACrB,kBAAkB,uBAAuB,SAAS,UAAU,GAAG,MAAM,SAAS,QAAQ,GAAG;CAC3F,GACA,OACF;AACF;;;;ACxFA,SAASC,cAAY,OAA+B;CAClD,IAAI,CAAC,OAAO,wBAAO,IAAI,KAAK,EAAC,CAAC,YAAY;CAC1C,OAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAEA,eAAsB,iBACpB,UACA,IACA,UAA8B,CAAC,GACnB;CACZ,MAAM,YAAYA,cAAY,SAAS,SAAS,SAAS;CAEzD,OAAO,gBACL;EACE,GAAG;EACH,UAAU,SAAS,YAAY;EAC/B,SAAS;GACP,GAAG,SAAS;GACZ,QAAQ,SAAS,SAAS,UAAU;GACpC;EACF;CACF,GACA,OAAO,KAAK,WAAW;EACrB,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,KAAK,MAAM;GACnC,MAAM,YAAY;IAChB,GAAG;IACH,SAAS,SAAS,WAAW;IAC7B,SAAS;KACP,GAAG,SAAS;KACZ,QAAQ;KACR;KACA,0BAAS,IAAI,KAAK,EAAC,CAAC,YAAY;IAClC;GACF;GACA,mBAAmB,WAAW,GAAG;GACjC,OAAO,IAAI,4BAA4B,SAAS,CAAC;GACjD,OAAO;EACT,SAAS,OAAO;GACd,MAAM,SAAS;IACb,GAAG;IACH,SAAS;IACT,SAAS;KACP,GAAG,SAAS;KACZ,QAAQ;KACR;KACA,0BAAS,IAAI,KAAK,EAAC,CAAC,YAAY;IAClC;GACF;GACA,mBAAmB,QAAQ,GAAG;GAC9B,OAAO,IAAI,4BAA4B,MAAM,CAAC;GAC9C,MAAM;EACR;CACF,GACA,OACF;AACF;;;;ACvDA,SAASC,cAAY,OAA2C;CAC9D,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAEA,SAASC,kBAAgB,OAAqC;CAC5D,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,OAAO,MAAM,QAAQ,KAAK,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,KAAK;AACnD;AAEA,SAAS,UAAU,QAA6B,IAAqB;CACnE,OAAO,OAAO,cAAc,UAAa,OAAO,YAAY;AAC9D;AA0BA,SAAgB,4BACd,UAAyC,CAAC,GACnB;CACvB,MAAM,0BAAU,IAAI,IAAiC;CAErD,MAAM,qBACJ,UACwB;EACxB,MAAM,MAAMD,cAAY,MAAM,aAAa,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY;EACvE,MAAM,SAA8B;GAClC,OAAO,MAAM;GACb,QAAQ,MAAM,UAAU,CAAC;GACzB,QAAQ;GACR,SAAS,MAAM;GACf,WACE,MAAM,YAAY,SAAY,SAAY,YAAY,MAAM,OAAO;GACrE,aAAa,MAAM;GACnB,eAAe;GACf,WAAWA,cAAY,MAAM,SAAS;GACtC,UAAU,MAAM;EAClB;EACA,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM;EAClC,OAAO;CACT;CAEA,KAAK,MAAM,QAAQ,SACjB,kBAAkB,IAAI;CAGxB,OAAO;EACL;EACA,eAAe,SAAiB,QAAkC,CAAC,GAAG;GACpE,MAAM,WAAW,QAAQ,IAAI,OAAO;GACpC,IAAI,CAAC,UACH,MAAM,IAAI,MACR,yDAAyD,QAAQ,GACnE;GAGF,MAAM,YAAYA,cAAY,MAAM,SAAS,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY;GACzE,MAAM,SAA8B;IAClC,GAAG;IACH,QAAQ,MAAM,UAAU,SAAS;IACjC,QAAQ;IACR,SAAS,MAAM,WAAW,SAAS;IACnC,WACE,MAAM,YAAY,SACd,SAAS,YACT,YAAY,MAAM,OAAO;IAC/B,aAAa,MAAM,eAAe,SAAS;IAC3C;IACA,WAAWA,cAAY,MAAM,SAAS,KAAK,SAAS;IACpD,UAAU,MAAM,YAAY,SAAS;GACvC;GACA,QAAQ,IAAI,SAAS,MAAM;GAC3B,OAAO;EACT;EACA,eAAe,SAAiB,OAAiC;GAC/D,MAAM,WAAW,QAAQ,IAAI,OAAO;GACpC,IAAI,CAAC,UACH,MAAM,IAAI,MACR,yDAAyD,QAAQ,GACnE;GAGF,MAAM,YAAYA,cAAY,MAAM,SAAS,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY;GACzE,MAAM,SAA8B;IAClC,GAAG;IACH,QAAQ;IACR;IACA,kBAAkB,MAAM;GAC1B;GACA,QAAQ,IAAI,SAAS,MAAM;GAC3B,OAAO;EACT;EACA,YAAY,SAAiB;GAC3B,OAAO,QAAQ,IAAI,OAAO;EAC5B;EACA,kBAAkB,SAAiB,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY,GAAG;GAChE,MAAM,SAAS,QAAQ,IAAI,OAAO;GAClC,IAAI,CAAC,QAAQ;GACb,OAAO,UAAU,QAAQ,EAAE,IAAI,YAAY,OAAO;EACpD;EACA,aAAa,SAAiB,sBAAK,IAAI,KAAK,EAAC,CAAC,YAAY,GAAG;GAC3D,MAAM,SAAS,QAAQ,IAAI,OAAO;GAClC,IAAI,CAAC,QACH,MAAM,IAAI,MACR,2CAA2C,QAAQ,4BACrD;GAGF,MAAM,SAA8B,UAAU,QAAQ,EAAE,IACpD,YACA,OAAO;GAEX,IAAI,WAAW,YAAY,WAAW,WACpC,MAAM,IAAI,MACR,mCAAmC,QAAQ,OAAO,OAAO,oCAC3D;GAGF,OAAO;EACT;EACA,aAAa,SAAiB,gBAA0B;GACtD,MAAM,SAAS,KAAK,aAAa,OAAO;GACxC,MAAM,UAAU,eAAe,QAC5B,UAAU,CAAC,OAAO,OAAO,SAAS,KAAK,CAC1C;GAEA,IAAI,QAAQ,SAAS,GACnB,MAAM,IAAI,MACR,mCAAmC,QAAQ,iCAAiC,QAAQ,KAAK,IAAI,EAAE,EACjG;GAGF,OAAO;EACT;EACA,gBAAgB,SAAiB,OAAO;GACtC,MAAM,SAAS,KAAK,aAAa,OAAO;GACxC,MAAM,QAAQC,kBAAgB,MAAM,KAAK;GACzC,IAAI,MAAM,SAAS,GACjB,KAAK,aAAa,SAAS,KAAK;GAGlC,OAAO,gBAAgB;IACrB,gBAAgB,MAAM;IACtB,eAAe,OAAO,MAAM;IAC5B,OAAO,MAAM,SAAS,OAAO;IAC7B,SAAS,MAAM,WAAW,OAAO;IACjC,cAAc,MAAM;IACpB,kBAAkB,MAAM;IACxB,UAAU,MAAM;IAChB,WAAW,MAAM,aAAa,OAAO;GACvC,CAAC;EACH;EACA,OAAO;GACL,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC;EAC7B;CACF;AACF;;;;ACtLA,MAAM,mBAA+D;CACnE,QAAQ;EACN,MAAM;EACN,UAAU;GACR;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,UAAU;GACR;GACA;GACA;GACA;GACA;GACA;GACA;EACF;EACA,UAAU;GAAC;GAAS;GAAY;GAAW;GAAY;EAAU;EACjE,iBAAiB;CACnB;CACA,KAAK;EACH,MAAM;EACN,UAAU;GAAC;GAAS;GAAQ;GAAY;GAAa;EAAQ;EAC7D,UAAU;GAAC;GAAQ;GAAQ;GAAW;GAAU;EAAc;EAC9D,UAAU,CAAC,SAAS,UAAU;EAC9B,iBAAiB;CACnB;CACA,YAAY;EACV,MAAM;EACN,UAAU;GAAC;GAAY;GAAQ;GAAW;GAAU;EAAQ;EAC5D,UAAU;GAAC;GAAc;GAAU;GAAW;GAAU;EAAW;EACnE,UAAU;GAAC;GAAS;GAAY;EAAU;EAC1C,iBAAiB;CACnB;AACF;AAEA,SAAS,UAAU,OAAyB;CAC1C,IAAI,OAAO,UAAU,UACnB,OAAO;CAGT,IAAI,MAAM,UAAU,GAAG,OAAO;CAC9B,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,MAAM,MAAM,EAAE;AACjD;AAEA,SAAS,QAAQ,UAAgC,KAAsB;CACrE,OAAO,UAAU,MAAM,YAAY,QAAQ,KAAK,GAAG,CAAC,KAAK;AAC3D;AAEA,SAAS,eAAe,OAAe,WAA4B;CACjE,IAAI,cAAc,UAAa,MAAM,UAAU,WAC7C,OAAO;CAGT,OAAO,GAAG,MAAM,MAAM,GAAG,SAAS,EAAE;AACtC;AAEA,SAAS,aACP,OACA,SACA,SACS;CACT,IAAI,iBAAiB,MACnB,OAAO,MAAM,YAAY;CAG3B,MAAM,UAAU,QAAQ,YAAY;CAEpC,IAAI,QAAQ,QAAQ,UAAU,OAAO,GACnC,OAAO;CAGT,IAAI,QAAQ,QAAQ,UAAU,OAAO,GACnC,OAAO,YAAY,KAAK;CAG1B,IAAI,QAAQ,QAAQ,UAAU,OAAO,GACnC,OAAO,UAAU,KAAK;CAGxB,IAAI,OAAO,UAAU,UACnB,OAAO,eAAe,OAAO,QAAQ,eAAe;CAGtD,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,OAAO,UACvB,aAAa,OAAO,SAAS,GAAG,QAAQ,GAAG,MAAM,EAAE,CACrD;CAGF,IAAI,SAAS,OAAO,UAAU,UAC5B,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAgC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CACrE,KACA,aAAa,OAAO,SAAS,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAClE,CAAC,CACH;CAGF,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,SAAS,EAAE;CAG1B,OAAO;AACT;AAEA,SAAgB,sBACd,UAA+B,UACf;CAChB,OAAO,OAAO,YAAY,WAAW,iBAAiB,WAAW;AACnE;AAEA,SAAgB,qBACd,OACA,UAA+B,UACtB;CACT,OAAO,aAAa,OAAO,sBAAsB,OAAO,GAAG,EAAE;AAC/D;;;;ACtHA,SAAS,YAAY,OAA+B;CAClD,IAAI,CAAC,OAAO,wBAAO,IAAI,KAAK,EAAC,CAAC,YAAY;CAC1C,OAAO,iBAAiB,OAAO,MAAM,YAAY,IAAI;AACvD;AAUA,eAAsB,0BACpB,UACA,UAA4C,CAAC,GACX;CAClC,MAAM,aAAa,kBAAkB,QAAQ;CAC7C,MAAM,eAAe;EACnB,eAAe,WAAW;EAC1B,WAAW,YAAY,QAAQ,SAAS;EACxC,GAAI,QAAQ,sBAAsB,UAAa,EAC7C,mBAAmB,QAAQ,kBAC7B;EACA,UAAU;EACV,GAAI,QAAQ,aAAa,UAAa,EACpC,UAAU,qBACR,QAAQ,UACR,QAAQ,kBAAkB,QAC5B,EACF;CACF;CAEA,MAAM,YAAY,YAAY,YAAY;CAC1C,MAAM,YAAY,QAAQ,SACtB,MAAM,QAAQ,OAAO,oBAAoB,YAAY,CAAC,IACtD;CAEJ,OAAO;EACL,GAAG;EACH;EACA,GAAI,cAAc,UAAa,EAAE,UAAU;CAC7C;AACF;AAEA,SAAgB,wBACd,UACS;CACT,MAAM,WAAW,YAAY;EAC3B,eAAe,SAAS;EACxB,WAAW,SAAS;EACpB,GAAI,SAAS,sBAAsB,UAAa,EAC9C,mBAAmB,SAAS,kBAC9B;EACA,UAAU,SAAS;EACnB,GAAI,SAAS,aAAa,UAAa,EACrC,UAAU,SAAS,SACrB;CACF,CAAC;CACD,OAAO,SAAS,cAAc;AAChC;;;;ACtDA,SAAS,gBAAgB,OAAqC;CAC5D,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AAC9C;AAEA,SAAS,cACP,WACA,UACU;CACV,OAAO,SAAS,QAAQ,UAAU,CAAC,UAAU,SAAS,KAAK,CAAC;AAC9D;;;;;;;;;;AAiBA,SAAS,mBACP,eACA,gBACA,gBACyB;CACzB,MAAM,eAAe,iBACjB,cAAc,QAAQ,UAAU,CAAC,eAAe,SAAS,KAAK,CAAC,IAC/D,CAAC;CACL,IAAI,aAAa,SAAS,GACxB,OAAO;EACL,QAAQ;EACR,QAAQ,sBAAsB,aAAa,KAAK,GAAG;EACnD,KAAK,4DAA4D,aAAa,KAAK,IAAI;CACzF;CAGF,MAAM,UAAU,cAAc,eAAe,cAAc;CAC3D,IAAI,QAAQ,SAAS,GACnB,OAAO;EACL,QAAQ;EACR,QAAQ,iBAAiB,QAAQ,KAAK,GAAG;EACzC,KAAK,6BAA6B,QAAQ,KAAK,IAAI;CACrD;AAIJ;AAEA,SAAS,kBACP,YAC+B;CAC/B,MAAM,WAAW,WAAW;CAC5B,IAAI,UACF,SAAS,aAAa,WAAW,MAAM,EAAE;CAG3C,OAAO,WAAW;AACpB;AAEA,SAAS,gBACP,YACA,gBACgC;CAChC,IAAI,CAAC,cAAc,mBAAmB,QAAW,OAAO;CACxD,OAAO;EACL,GAAG;EACH,GAAI,mBAAmB,UAAa,EAAE,eAAe;CACvD;AACF;AAEA,SAAS,cACP,OACA,UACA,gBACmC;CACnC,IAAI,CAAC,UAAU,OAAO;CAEtB,MAAM,iBAAiB,qBAAqB,OAAO,kBAAkB,QAAQ;CAC7E,OAAO;EACL,GAAG;EACH,WAAW,SAAS,aAAa,YAAY,cAAc;CAC7D;AACF;AAEA,eAAsB,eACpB,YACA,OACA,IACA,UAAqD,CAAC,GACpC;CAClB,MAAM,iBAAiB,WAAW,kBAAkB,CAAC;CACrD,MAAM,aAAa,kBAAkB,UAAU;CAC/C,MAAM,iBAAiB,WAAW,kBAAkB,YAClD,WAAW,MAAM,EACnB,CAAC,EAAE;CAEH,MAAM,SAAS,mBADO,gBAAgB,YAAY,SAAS,cAE7C,GACZ,gBACA,cACF;CACA,MAAM,SACJ,WAAW,YAAY,WAAW,cAAc,UAAa,SACzD;EACE,UAAU,SAAS,SAAS;EAC5B,GAAI,WAAW,aAAa,UAAa,EACvC,UAAU,WAAW,SACvB;EACA,GAAI,WAAW,cAAc,UAAa,EACxC,WAAW,WAAW,UACxB;EACA,GAAI,UAAU,EAAE,QAAQ,OAAO,OAAO;CACxC,IACA;CAEN,MAAM,aAAa,gBACjB,WAAW,YACX,WAAW,cACb;CAEA,IAAI,UAAU,OAAO,aAAa,UAAU,QAAQ;EAClD,qBACE;GACE,QAAQ,WAAW;GACnB,UAAU,WAAW,YAAY,WAAW,KAAK;GACjD,UAAU,WAAW;GACrB,OAAO,WAAW;GAClB;GACA;GACA;GACA,UAAU,cACR,OACA,WAAW,UACX,WAAW,cACb;EACF,GACA,OACF;EAEA,yCAA4B;GAC1B,QAAQ;GACR,MAAM;GACN,SAAS,UAAU,WAAW,MAAM,GAAG,kBAAkB,WAAW,KAAK,KAAK;GAC9E,KAAK,OAAO;GACZ,KAAK;EACP,CAAC;CACH;CAEA,IAAI,QACF,qBACE;EACE,QAAQ,GAAG,WAAW,OAAO;EAC7B,UAAU,WAAW,YAAY,WAAW,KAAK;EACjD,UAAU,WAAW;EACrB,OAAO,WAAW;EAClB;EACA;EACA;CACF,GACA,OACF;CAGF,IAAI,WAAW,UACb,oBACE;EACE,QAAQ,GAAG,WAAW,OAAO;EAC7B,UAAU,WAAW,YAAY,WAAW,KAAK;EACjD,UAAU,WAAW;EACrB,OAAO,WAAW;EAClB;EACA;EACA,UAAU,cACR,OACA,WAAW,UACX,WAAW,cACb;CACF,GACA,OACF;CAGF,OAAO,kBACL;EACE,QAAQ,WAAW;EACnB,UAAU,WAAW,YAAY,WAAW,KAAK;EACjD,UAAU,WAAW;EACrB,OAAO,WAAW;EAClB;EACA;EACA,MAAM;GACJ,GAAG,WAAW;GACd;EACF;CACF,GACA,IACA,OACF;AACF"}

package/dist/{agent-CqXauTpC.js → agent-DZL-uNAc.js}

@@ -1,5 +1,5 @@
 import { estimateLLMCost } from "./cost.js";
-import { i as genAiResponseAttributes, r as genAiRequestAttributes, s as genAiUsageAttributes } from "./attributes--Pdezjj6.js";
+import { i as genAiResponseAttributes, r as genAiRequestAttributes, s as genAiUsageAttributes } from "./attributes-DU-PmLqZ.js";
 import { createNoopRequestLogger, createStructuredError, getRequestLoggerSafe, getTraceContext, otelTrace } from "autotel";
 import { createHash } from "node:crypto";
 import { forceKeepAuditEvent, withAudit } from "autotel-audit";
@@ -948,4 +948,4 @@ async function withScopedTool(definition, input, fn, options = {}) {
 
 //#endregion
 export { setAgentAttributes as _, sanitizeAuditPayload as a, hashPayload as b, delegateToAgent as c, defineAgentToolCall as d, recordDecisionBasis as f, flattenAgentAttributes as g, withAgentToolCall as h, resolvePrivacyProfile as i, recordAgentHandoff as l, withAgentAction as m, createSignedEventEnvelope as n, createAgentIdentityRegistry as o, recordPolicyDecision as p, verifyEventEnvelopeHash as r, withAgentSession as s, withScopedTool as t, defineAgentAction as u, createAgentAuditMetadata as v, AGENT_AUDIT_SCHEMA_VERSION as x, canonicalizeForHash as y };
-//# sourceMappingURL=agent-CqXauTpC.js.map
+//# sourceMappingURL=agent-DZL-uNAc.js.map