avantgate 1.6.0 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/README.md +61 -5
  2. package/dist/agent/index.js +97 -24
  3. package/dist/agent/index.mjs +5 -2
  4. package/dist/agent/isolated-tool.d.ts +8 -3
  5. package/dist/agent/isolated-tool.d.ts.map +1 -1
  6. package/dist/agent/types.d.ts +16 -0
  7. package/dist/agent/types.d.ts.map +1 -1
  8. package/dist/{chunk-CO26LNFD.mjs → chunk-36ULFTM2.mjs} +8 -8
  9. package/dist/{chunk-4XWO3NZW.mjs → chunk-AH5XXSS4.mjs} +1 -1
  10. package/dist/{chunk-5VA3EKPJ.mjs → chunk-W27A25DK.mjs} +97 -25
  11. package/dist/chunk-Y6FXYEAI.mjs +10 -0
  12. package/dist/client/index.mjs +2 -0
  13. package/dist/control-layer.d.ts +7 -7
  14. package/dist/control-layer.d.ts.map +1 -1
  15. package/dist/finance/index.js +6 -6
  16. package/dist/finance/index.mjs +2 -1
  17. package/dist/finance/normalizer.d.ts +2 -2
  18. package/dist/finance/normalizer.d.ts.map +1 -1
  19. package/dist/index.d.ts +1 -0
  20. package/dist/index.d.ts.map +1 -1
  21. package/dist/index.js +421 -130
  22. package/dist/index.mjs +318 -103
  23. package/dist/input-guard.d.ts +2 -2
  24. package/dist/input-guard.d.ts.map +1 -1
  25. package/dist/pricing.d.ts +17 -16
  26. package/dist/pricing.d.ts.map +1 -1
  27. package/dist/providers/http-client.d.ts +2 -2
  28. package/dist/providers/http-client.d.ts.map +1 -1
  29. package/dist/response-validator.d.ts +2 -2
  30. package/dist/response-validator.d.ts.map +1 -1
  31. package/dist/sanitizer.d.ts +1 -1
  32. package/dist/sanitizer.d.ts.map +1 -1
  33. package/dist/sqlite-pricing-adapter.d.ts +87 -0
  34. package/dist/sqlite-pricing-adapter.d.ts.map +1 -0
  35. package/dist/workflow/index.js +92 -24
  36. package/dist/workflow/index.mjs +3 -2
  37. package/package.json +20 -3
package/README.md CHANGED
@@ -33,13 +33,54 @@ flowchart LR
33
33
 
34
34
  ---
35
35
 
36
- ## ☁️ GateWall Platform — Enterprise AI-WAF & Corporate DLP *(Coming Soon)*
36
+ ## 🖥️ GateWall Cockpit — Self-Hosted AI-WAF & Governance Console (`gatewall/`)
37
37
 
38
- While the open-source **AvantGate SDK** provides lightweight, in-process control and PII redaction, **GateWall Platform** is the enterprise AI Application Firewall (AI-WAF) and Corporate DLP gateway engineered for regulated industries (Fintech, Banking, Legaltech, and Listed Scale-ups).
38
+ While the **AvantGate SDK** provides zero-infrastructure, in-process control inside your application runtime, the included **GateWall Cockpit** (`gatewall/`) provides a full-featured, self-hosted visual control plane, real-time audit inspector, and Human-in-the-Loop approval.
39
39
 
40
- Available as a **Managed Cloud Control Plane** or an **Out-of-Process High-Availability Sidecar/Proxy**:
40
+ ```mermaid
41
+ flowchart LR
42
+ Agent[🤖 AvantGate Agent / SDK] -- "POST /api/v1/ingest/events<br/>(Async Telemetry)" --> GateWall["🛡️ GateWall Cockpit<br/>(Next.js + SQLite)"]
43
+ GateWall -- "SSE /api/v1/realtime" --> Browser["💻 Web Dashboard<br/>(http://localhost:3000)"]
44
+ Browser -- "POST /api/v1/approvals<br/>(Approve / Reject)" --> GateWall
45
+ ```
46
+
47
+ ### 🚀 Quickstart: Run GateWall Cockpit
48
+
49
+ #### Option 1: One-Line Docker Compose (Recommended)
50
+ ```bash
51
+ docker compose up -d
52
+ # or: npm run gatewall:docker
53
+ ```
54
+ Open **`http://localhost:3000`** in your browser 🎉. Traces and audit sessions are automatically persisted.
55
+
56
+ #### Option 2: Run with Bun or Node.js
57
+ ```bash
58
+ cd gatewall
59
+ bun install # or npm install
60
+ bun run dev # or npm run dev
61
+ ```
62
+
63
+ ---
41
64
 
42
- > 🚀 **Interested in private preview, enterprise VPC, or On-Premise deployment?** Contact our team at [contact@gatewall.fr](mailto:contact@gatewall.fr) for early access.
65
+ ### 🛡️ Cockpit Capabilities & Modules
66
+
67
+ | Module | Description |
68
+ |---|---|
69
+ | **🔒 Dual-Channel PII Inspector** | Visually compare the sequestered local escrow (`rawPayload`) against the redacted summary dispatched to the model (`llmSummary`). Highlights detected PII (emails, API keys, IBANs, phone numbers). |
70
+ | **🧑‍⚖️ Human-in-the-Loop (HITL) Queue** | Real-time queue intercepting high-impact tool executions (`WAITING_APPROVAL`) with an interactive dashboard to inspect parameters and click **Approve** or **Reject**. |
71
+ | **⚡ Real-Time Streaming (SSE)** | Low-latency Server-Sent Events (`/api/v1/realtime`) updating session trees, metrics, and alerts dynamically without manual page refresh. |
72
+ | **💰 FinOps & Token Tracking** | Automated token cost estimation and USD burn tracking across providers (GPT-4o, Claude 3.5 Sonnet, DeepSeek, etc.). |
73
+ | **🛡️ Loop Shield (Anti-Cycle Guard)** | Early visual detection of recursive agent loops and aberrant repetitive tool execution cycles. |
74
+ | **💾 Zero-External-DB SQLite Storage** | Zero setup overhead: persistent storage uses embedded SQLite (`gatewall/data/gatewall.db`) without requiring PostgreSQL, Redis, or ClickHouse. |
75
+
76
+ > 💡 **Agent Integration Recipes:** See [Connecting an Agent to GateWall Cockpit](docs/examples.md#12-connecting-an-agent-to-gatewall-cockpit-gatewall) in `docs/examples.md` for complete code recipes using `HttpTelemetryExporter` (`avantgate/agent`), direct HTTP ingestion, and React front-end streaming (`avantgate/client`).
77
+
78
+ ---
79
+
80
+ ### ☁️ Enterprise & Managed Cloud
81
+
82
+ Looking for enterprise multi-tenant RBAC, SSO/SAML, managed VPC sidecars, or on-premise air-gapped compliance?
83
+ Contact our team at [contact@gatewall.fr](mailto:contact@gatewall.fr) for private previews and enterprise deployment options.
43
84
 
44
85
  ---
45
86
 
@@ -49,7 +90,7 @@ Available as a **Managed Cloud Control Plane** or an **Out-of-Process High-Avail
49
90
  - 🔒 **Zero-Egress Data Loss Prevention (DLP)**: Automated local redaction of emails, phone numbers, IBAN/BIC, and French/EU identifiers (NIR SSN, SPI tax ID) before network egress.
50
91
  - ⚡ **Deterministic Workflow Engine (`avantgate/workflow`)**: In-process sequential state machine for multi-step agent orchestrations. Features automatic reverse compensation (Saga Pattern), non-blocking Human-in-the-Loop checkpoints, and safe-by-default AI tool conversion (`asTool()`).
51
92
  - 🎭 **Dual-Channel Tool Isolation (`avantgate/agent`)**: Decouples sensitive database records (streamed out-of-band directly to client UIs) from minimal cognitive LLM context (`llmDto`), keeping confidential fields out of context windows.
52
- - 🛑 **Anti-IDOR & Access Governance**: Enforces Row-Level Security (`dataAccessGuard`), business domain partitioning, and granular role-based permissions at the agent tool boundary.
93
+ - 🛑 **Anti-IDOR & Multi-Tenant Defense**: Strict Row-Level Security, compile-time tenant tool enforcement (`createTenantTool`), post-fetch runtime assertions (`assertTenant`, `assertOwnership`), and native RBAC authorization at the agent tool boundary. See the [Anti-IDOR Architecture Guide](docs/anti-idor.md).
53
94
  - 💰 **Denial-of-Wallet & Pre-Flight Budgeting**: Enforces strict token and cent-level USD budget limits, rejecting abusive requests before paying for upstream inference.
54
95
  - 🔀 **Zero-Downtime Multi-Model Failover**: Seamless client-side failover to fallback providers (or local zero-cost Ollama) when upstream APIs return HTTP 429/500 errors.
55
96
  - 🔧 **Self-Repairing Structured Outputs**: Strict Zod schema compliance with automated heuristic markdown/JSON repair if the model hallucinates formatting.
@@ -59,6 +100,20 @@ Available as a **Managed Cloud Control Plane** or an **Out-of-Process High-Avail
59
100
 
60
101
  ---
61
102
 
103
+ ## 📚 Documentation & Guides
104
+
105
+ | Category | In-Depth Guides |
106
+ |---|---|
107
+ | 🚀 **Quickstart** | [Getting Started](docs/getting-started.md) • [Integration Cookbook](docs/examples.md) |
108
+ | 🛡️ **Security & AI-WAF** | [Prompt Guardrails](docs/security/prompt-guardrails.md) • [PII Redaction](docs/security/pii-redaction.md) • [Anti-IDOR Defense](docs/security/anti-idor.md) • [End-to-End Security](docs/security/end-to-end-security.md) |
109
+ | 💰 **FinOps & Cost** | [Pre-Flight Budget Guards](docs/finops/budget-guards.md) • [Pricing Adapters & SQLite](docs/finops/pricing-adapters.md) |
110
+ | 🤖 **Agents & Tools** | [Isolated Tools & DTOs](docs/agents/isolated-tools.md) • [Agent Runtime Manual](docs/agents/agent-runtime.md) • [Inter-Tool Chaining](docs/agents/inter-tool-chaining.md) |
111
+ | 🔄 **Deterministic Sagas** | [Durable Workflows Engine](docs/workflows/durable-workflows.md) |
112
+ | 📊 **Observability** | [GateWall Cockpit Console](docs/observability/gatewall-cockpit.md) • [Telemetry & Browser SDK](docs/observability/telemetry-and-browser-sdk.md) |
113
+ | 💶 **Accounting** | [Financial Normalizer](docs/finance/normalizer.md) |
114
+
115
+ ---
116
+
62
117
  ## 📊 Comparison: Direct LLM vs. Cloud AI Proxy vs. AvantGate
63
118
 
64
119
  | Capability & Security Boundary | Direct LLM Calls | Cloud AI Proxy (Helicone / Portkey) | 🛡️ **AvantGate (`avantgate`)** |
@@ -94,6 +149,7 @@ yarn add avantgate zod
94
149
  | `avantgate/finance` | Financial data normalizer (accounting parentheses, EU/US/UK/CH currencies & magnitudes). |
95
150
  | `avantgate/agent` | *(Preview / Experimental)* Durable step runner, Human-in-the-Loop, dual-channel PII tool isolation & storage adapters. |
96
151
  | `avantgate/workflow` | Deterministic sequential state machine, automatic reverse Saga rollback, durable HITL checkpoints & agent tool conversion. |
152
+ | `avantgate/client` | Lightweight front-end SDK (< 1.7 KB) & React hook to stream browser security alerts & metrics directly to GateWall. |
97
153
 
98
154
  ---
99
155
 
@@ -48,6 +48,7 @@ __export(agent_exports, {
48
48
  createCustomStorageAdapter: () => createCustomStorageAdapter,
49
49
  createIsolatedTool: () => createIsolatedTool,
50
50
  createStepRunner: () => createStepRunner,
51
+ createTenantTool: () => createTenantTool,
51
52
  createToolInvoker: () => createToolInvoker,
52
53
  createToolSharedState: () => createToolSharedState,
53
54
  dto: () => dto
@@ -162,7 +163,7 @@ var SPI_LABELLED_REGEX = /(?:(?:num[ée]ro\s+fiscal|spi|n[°o]\s*fiscal|d[ée]cl
162
163
  var SPI_FORMATTED_REGEX = /\b[0-3]\d(?:\s+\d{2}){5}\s+\d\b/g;
163
164
  var IBAN_REGEX = /\b[A-Z]{2}\s*[0-9]{2}(?:[\s\r\n.-]*[A-Z0-9]){11,30}\b/g;
164
165
  var BIC_LABELLED_REGEX = /(?:(?:bic|swift)\s*[:=]?\s*)\b([A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\b/gi;
165
- function sanitizePII(input) {
166
+ var sanitizePII = (input) => {
166
167
  let count = 0;
167
168
  let result = input;
168
169
  result = result.replace(EMAIL_REGEX, () => {
@@ -205,7 +206,7 @@ function sanitizePII(input) {
205
206
  return match;
206
207
  });
207
208
  return { text: result, maskedCount: count };
208
- }
209
+ };
209
210
 
210
211
  // src/agent/guardrails.ts
211
212
  function sanitizeString(value) {
@@ -260,7 +261,23 @@ function auditToolResult(data, options) {
260
261
  }
261
262
 
262
263
  // src/agent/isolated-tool.ts
263
- async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
264
+ var verifyRoles = (configuredRoles, context, toolIdentifier) => {
265
+ if (!configuredRoles || configuredRoles.length === 0) {
266
+ return;
267
+ }
268
+ const userRoles = [
269
+ ...context.roles ?? [],
270
+ ...context.role ? [context.role] : []
271
+ ];
272
+ const hasAllowedRole = configuredRoles.some((role) => userRoles.includes(role));
273
+ if (!hasAllowedRole) {
274
+ throw new ToolAccessDeniedError(
275
+ toolIdentifier,
276
+ "Access denied: insufficient role permissions"
277
+ );
278
+ }
279
+ };
280
+ var verifyDataAccessGuard = async (guard, args, context, toolIdentifier) => {
264
281
  if (!guard) {
265
282
  return;
266
283
  }
@@ -268,8 +285,55 @@ async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
268
285
  if (!isAllowed) {
269
286
  throw new ToolAccessDeniedError(toolIdentifier, "Access denied by data access guard");
270
287
  }
271
- }
272
- async function resolveInvalidationTags(config, args, rawResult, context) {
288
+ };
289
+ var verifyTenantIsolation = (assertTenant, rawResult, context, toolIdentifier) => {
290
+ if (!assertTenant) {
291
+ return;
292
+ }
293
+ if (!context.tenantId) {
294
+ throw new ToolAccessDeniedError(
295
+ toolIdentifier,
296
+ "Access denied: missing session tenantId in execution context for multi-tenant tool"
297
+ );
298
+ }
299
+ const recordTenantId = assertTenant(rawResult);
300
+ if (recordTenantId && recordTenantId !== context.tenantId) {
301
+ throw new ToolAccessDeniedError(
302
+ toolIdentifier,
303
+ `Cross-tenant IDOR access violation: record tenant '${recordTenantId}' does not match session tenant '${context.tenantId}'`
304
+ );
305
+ }
306
+ };
307
+ var verifyResourceOwnership = async (assertOwnership, rawResult, context, toolIdentifier) => {
308
+ if (!assertOwnership) {
309
+ return;
310
+ }
311
+ const isOwner = await assertOwnership(rawResult, context);
312
+ if (!isOwner) {
313
+ throw new ToolAccessDeniedError(
314
+ toolIdentifier,
315
+ "Ownership IDOR access violation: user does not own or have access to this resource"
316
+ );
317
+ }
318
+ };
319
+ var checkSuspiciousParameters = (parameters, toolName) => {
320
+ if (!parameters || typeof parameters !== "object") {
321
+ return;
322
+ }
323
+ const zodShape = parameters.shape;
324
+ if (!zodShape || typeof zodShape !== "object") {
325
+ return;
326
+ }
327
+ const suspiciousKeys = ["tenantId", "tenant_id", "ownerTenantId"];
328
+ for (const key of suspiciousKeys) {
329
+ if (key in zodShape) {
330
+ console.warn(
331
+ `[avantGate Security Warning] Tool '${toolName}' defines '${key}' as a model parameter. Tenancy should be inferred from the trusted server context (context.tenantId) rather than supplied by the untrusted model to prevent IDOR attacks.`
332
+ );
333
+ }
334
+ }
335
+ };
336
+ var resolveInvalidationTags = async (config, args, rawResult, context) => {
273
337
  if (!config.invalidationTags) {
274
338
  return void 0;
275
339
  }
@@ -278,33 +342,29 @@ async function resolveInvalidationTags(config, args, rawResult, context) {
278
342
  await context.onInvalidationTags(tags);
279
343
  }
280
344
  return tags;
281
- }
282
- async function dispatchClientData(rawResult, callback) {
345
+ };
346
+ var dispatchClientData = async (rawResult, callback) => {
283
347
  if (!callback) {
284
348
  return;
285
349
  }
286
350
  await callback(rawResult);
287
- }
288
- async function produceLlmPayload(rawResult, args, context, transformer) {
351
+ };
352
+ var produceLlmPayload = async (rawResult, args, context, transformer) => {
289
353
  if (transformer) {
290
354
  return await transformer(rawResult, args, context);
291
355
  }
292
356
  return rawResult;
293
- }
294
- function validateLlmDto(payload, schema, toolIdentifier) {
357
+ };
358
+ var validateLlmDto = (payload, schema, toolIdentifier) => {
295
359
  const parseResult = schema.safeParse(payload);
296
360
  if (!parseResult.success) {
297
361
  const issues = parseResult.error.issues ?? [];
298
362
  const errorMessages = issues.map((issue) => `${issue.path.join(".") || "root"}: ${issue.message}`).join(", ");
299
- throw new DtoValidationError(
300
- toolIdentifier,
301
- errorMessages,
302
- issues
303
- );
363
+ throw new DtoValidationError(toolIdentifier, errorMessages, issues);
304
364
  }
305
365
  return parseResult.data;
306
- }
307
- function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnPii = false) {
366
+ };
367
+ var protectLlmPayload = (payload, toolIdentifier, sanitizePii = true, throwOnPii = false) => {
308
368
  if (!sanitizePii) {
309
369
  return { sanitized: payload, count: 0 };
310
370
  }
@@ -313,8 +373,8 @@ function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnP
313
373
  throwOnPii
314
374
  });
315
375
  return { sanitized: sanitizedData, count: maskedCount };
316
- }
317
- async function processLlmPayload(rawResult, args, context, config, toolIdentifier) {
376
+ };
377
+ var processLlmPayload = async (rawResult, args, context, config, toolIdentifier) => {
318
378
  let payload = await produceLlmPayload(rawResult, args, context, config.llmDto);
319
379
  if (config.llmDtoSchema) {
320
380
  payload = validateLlmDto(payload, config.llmDtoSchema, toolIdentifier);
@@ -325,14 +385,15 @@ async function processLlmPayload(rawResult, args, context, config, toolIdentifie
325
385
  config.sanitizePii !== false,
326
386
  config.throwOnPii === true
327
387
  );
328
- }
329
- function createIsolatedTool(config) {
388
+ };
389
+ var createIsolatedTool = (config) => {
330
390
  const toolId = config.id || config.name;
331
391
  const toolAlias = config.alias;
332
392
  const clientCallback = config.clientDto;
333
393
  const toolIdentifier = toolAlias || config.name;
334
394
  const toolImpact = config.impact ?? "READ_ONLY";
335
395
  const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
396
+ checkSuspiciousParameters(config.parameters, config.name);
336
397
  const tool = {
337
398
  description: config.description,
338
399
  parameters: config.parameters,
@@ -348,11 +409,12 @@ function createIsolatedTool(config) {
348
409
  _requireApproval: requireApproval,
349
410
  _lastPiiFilteredCount: 0,
350
411
  _lastInvalidationTags: void 0,
351
- async execute(args, context) {
412
+ execute: async (args, context) => {
352
413
  const updatedContext = {
353
414
  ...context,
354
415
  callChain: context?.callChain ?? Object.freeze([toolId])
355
416
  };
417
+ verifyRoles(config.roles, updatedContext, toolIdentifier);
356
418
  await verifyDataAccessGuard(
357
419
  config.dataAccessGuard,
358
420
  args,
@@ -360,6 +422,13 @@ function createIsolatedTool(config) {
360
422
  toolIdentifier
361
423
  );
362
424
  const rawResult = await config.execute(args, updatedContext);
425
+ verifyTenantIsolation(config.assertTenant, rawResult, updatedContext, toolIdentifier);
426
+ await verifyResourceOwnership(
427
+ config.assertOwnership,
428
+ rawResult,
429
+ updatedContext,
430
+ toolIdentifier
431
+ );
363
432
  const tags = await resolveInvalidationTags(
364
433
  config,
365
434
  args,
@@ -382,7 +451,10 @@ function createIsolatedTool(config) {
382
451
  }
383
452
  };
384
453
  return tool;
385
- }
454
+ };
455
+ var createTenantTool = (config) => {
456
+ return createIsolatedTool(config);
457
+ };
386
458
 
387
459
  // src/agent/dto.ts
388
460
  function extractWhitelistedFields(data, keys) {
@@ -2030,6 +2102,7 @@ var HttpTelemetryExporter = class {
2030
2102
  createCustomStorageAdapter,
2031
2103
  createIsolatedTool,
2032
2104
  createStepRunner,
2105
+ createTenantTool,
2033
2106
  createToolInvoker,
2034
2107
  createToolSharedState,
2035
2108
  dto
@@ -9,8 +9,10 @@ import {
9
9
  ToolNotFoundError,
10
10
  ToolSubCallQuotaError,
11
11
  auditToolResult,
12
- createIsolatedTool
13
- } from "../chunk-5VA3EKPJ.mjs";
12
+ createIsolatedTool,
13
+ createTenantTool
14
+ } from "../chunk-W27A25DK.mjs";
15
+ import "../chunk-Y6FXYEAI.mjs";
14
16
 
15
17
  // src/agent/dto.ts
16
18
  function extractWhitelistedFields(data, keys) {
@@ -1657,6 +1659,7 @@ export {
1657
1659
  createCustomStorageAdapter,
1658
1660
  createIsolatedTool,
1659
1661
  createStepRunner,
1662
+ createTenantTool,
1660
1663
  createToolInvoker,
1661
1664
  createToolSharedState,
1662
1665
  dto
@@ -1,9 +1,14 @@
1
- import type { IsolatedToolConfig, VercelAiCoreTool } from "./types";
1
+ import type { IsolatedToolConfig, TenantToolConfig, VercelAiCoreTool } from "./types";
2
2
  /**
3
3
  * Creates an isolated tool compatible with Vercel AI SDK (ai) tool contract.
4
4
  * Features dual-channel separation (client data vs minimal LLM DTO),
5
- * access governance (domain, resource, roles, dataAccessGuard, invalidationTags),
5
+ * access governance (domain, resource, roles, dataAccessGuard, assertTenant, assertOwnership, invalidationTags),
6
6
  * stable ID, aliasing, caching, Zod DTO contract validation, and automatic in-flight PII redaction.
7
7
  */
8
- export declare function createIsolatedTool<TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto>): VercelAiCoreTool<TArgs, TResult>;
8
+ export declare const createIsolatedTool: <TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto>) => VercelAiCoreTool<TArgs, TResult>;
9
+ /**
10
+ * High-assurance factory for multi-tenant and user-owned tools.
11
+ * Compile-time enforcement: strictly requires either assertTenant or assertOwnership.
12
+ */
13
+ export declare const createTenantTool: <TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: TenantToolConfig<TArgs, TResult, TLLMDto, TClientDto>) => VercelAiCoreTool<TArgs, TResult>;
9
14
  //# sourceMappingURL=isolated-tool.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAoHjB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,MAAM,EAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAgElC"}
1
+ {"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAEhB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAqMjB;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,QAAQ,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CA6EjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,QAAQ,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAC5D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAEjC,CAAC"}
@@ -107,6 +107,10 @@ export interface StepRunnerConfig {
107
107
  * Context received by tool execution, supporting inter-tool chaining and shared state.
108
108
  */
109
109
  export interface ToolExecutionContext {
110
+ tenantId?: string;
111
+ userId?: string;
112
+ role?: string;
113
+ roles?: string[];
110
114
  toolCallId?: string;
111
115
  messages?: unknown[];
112
116
  abortSignal?: AbortSignal;
@@ -170,6 +174,8 @@ export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknow
170
174
  impact?: ToolImpact;
171
175
  requireApproval?: boolean;
172
176
  dataAccessGuard?: DataAccessGuard<TArgs>;
177
+ assertTenant?: (result: TResult) => string | undefined | null;
178
+ assertOwnership?: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
173
179
  invalidationTags?: InvalidationTagsResolver<TArgs, TResult>;
174
180
  parameters: z.ZodType<TArgs> | unknown;
175
181
  cacheTTL?: number;
@@ -180,6 +186,16 @@ export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknow
180
186
  sanitizePii?: boolean;
181
187
  throwOnPii?: boolean;
182
188
  }
189
+ /**
190
+ * Configuration for createTenantTool requiring either assertTenant or assertOwnership at compile-time.
191
+ */
192
+ export type TenantToolConfig<TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult> = IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto> & ({
193
+ assertTenant: (result: TResult) => string | undefined | null;
194
+ assertOwnership?: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
195
+ } | {
196
+ assertTenant?: (result: TResult) => string | undefined | null;
197
+ assertOwnership: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
198
+ });
183
199
  /**
184
200
  * Standard tool contract compatible with Vercel AI SDK (ai) tool definition.
185
201
  */
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,GAClB,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,GAClB,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC9D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,CAC1B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,IAClB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAC1D;IACE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,GACD;IACE,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC9D,eAAe,EAAE,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}
@@ -452,7 +452,7 @@ var AccountingFactory = class {
452
452
  };
453
453
 
454
454
  // src/response-validator.ts
455
- function extractAndCleanJSON(rawText) {
455
+ var extractAndCleanJSON = (rawText) => {
456
456
  let cleaned = rawText.trim();
457
457
  cleaned = cleaned.replace(/<think>[\s\S]*?<\/think>/gi, "").trim();
458
458
  const codeBlockMatch = cleaned.match(/```(?:json)?\s*([\s\S]*?)\s*```/i);
@@ -476,8 +476,8 @@ function extractAndCleanJSON(rawText) {
476
476
  cleaned = cleaned.slice(startIndex, endIndex + 1);
477
477
  }
478
478
  return cleaned;
479
- }
480
- function validateWithZod(rawText, schema, options) {
479
+ };
480
+ var validateWithZod = (rawText, schema, options) => {
481
481
  let jsonString = extractAndCleanJSON(rawText);
482
482
  if (options?.normalizer) {
483
483
  jsonString = options.normalizer(jsonString);
@@ -492,20 +492,20 @@ function validateWithZod(rawText, schema, options) {
492
492
  parsed = JSON.parse(sanitized);
493
493
  }
494
494
  return schema.parse(parsed);
495
- }
495
+ };
496
496
 
497
497
  // src/finance/normalizer.ts
498
- function cleanFinancialJSON(rawText, options) {
498
+ var cleanFinancialJSON = (rawText, options) => {
499
499
  if (!rawText) {
500
500
  return "";
501
501
  }
502
502
  const jsonBlock = extractAndCleanJSON(rawText);
503
503
  const strategy = options?.jurisdiction ? AccountingFactory.getStrategy(options.jurisdiction) : options?.autoDetect !== false ? AccountingFactory.detectStrategy(rawText) : AccountingFactory.getStrategy("FR");
504
504
  return strategy.cleanJSON(jsonBlock);
505
- }
506
- function withFinancialNormalizer(options) {
505
+ };
506
+ var withFinancialNormalizer = (options) => {
507
507
  return (rawText) => cleanFinancialJSON(rawText, options);
508
- }
508
+ };
509
509
 
510
510
  export {
511
511
  FrenchPCGStrategy,
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  StepSuspendedError,
3
3
  createIsolatedTool
4
- } from "./chunk-5VA3EKPJ.mjs";
4
+ } from "./chunk-W27A25DK.mjs";
5
5
 
6
6
  // src/workflow/errors.ts
7
7
  var WorkflowSagaRollbackError = class extends Error {