avantgate 1.6.1 → 1.7.0

package/README.md

@@ -90,7 +90,7 @@ Contact our team at [contact@gatewall.fr](mailto:contact@gatewall.fr) for privat
 - 🔒 **Zero-Egress Data Loss Prevention (DLP)**: Automated local redaction of emails, phone numbers, IBAN/BIC, and French/EU identifiers (NIR SSN, SPI tax ID) before network egress.
 - ⚡ **Deterministic Workflow Engine (`avantgate/workflow`)**: In-process sequential state machine for multi-step agent orchestrations. Features automatic reverse compensation (Saga Pattern), non-blocking Human-in-the-Loop checkpoints, and safe-by-default AI tool conversion (`asTool()`).
 - 🎭 **Dual-Channel Tool Isolation (`avantgate/agent`)**: Decouples sensitive database records (streamed out-of-band directly to client UIs) from minimal cognitive LLM context (`llmDto`), keeping confidential fields out of context windows.
-- 🛑 **Anti-IDOR & Access Governance**: Enforces Row-Level Security (`dataAccessGuard`), business domain partitioning, and granular role-based permissions at the agent tool boundary.
+- 🛑 **Anti-IDOR & Multi-Tenant Defense**: Strict Row-Level Security, compile-time tenant tool enforcement (`createTenantTool`), post-fetch runtime assertions (`assertTenant`, `assertOwnership`), and native RBAC authorization at the agent tool boundary. See the [Anti-IDOR Architecture Guide](docs/anti-idor.md).
 - 💰 **Denial-of-Wallet & Pre-Flight Budgeting**: Enforces strict token and cent-level USD budget limits, rejecting abusive requests before paying for upstream inference.
 - 🔀 **Zero-Downtime Multi-Model Failover**: Seamless client-side failover to fallback providers (or local zero-cost Ollama) when upstream APIs return HTTP 429/500 errors.
 - 🔧 **Self-Repairing Structured Outputs**: Strict Zod schema compliance with automated heuristic markdown/JSON repair if the model hallucinates formatting.
@@ -100,6 +100,20 @@ Contact our team at [contact@gatewall.fr](mailto:contact@gatewall.fr) for privat
 
 ---
 
+## 📚 Documentation & Guides
+
+| Category | In-Depth Guides |
+|---|---|
+| 🚀 **Quickstart** | [Getting Started](docs/getting-started.md) • [Integration Cookbook](docs/examples.md) |
+| 🛡️ **Security & AI-WAF** | [Prompt Guardrails](docs/security/prompt-guardrails.md) • [PII Redaction](docs/security/pii-redaction.md) • [Anti-IDOR Defense](docs/security/anti-idor.md) • [End-to-End Security](docs/security/end-to-end-security.md) |
+| 💰 **FinOps & Cost** | [Pre-Flight Budget Guards](docs/finops/budget-guards.md) • [Pricing Adapters & SQLite](docs/finops/pricing-adapters.md) |
+| 🤖 **Agents & Tools** | [Isolated Tools & DTOs](docs/agents/isolated-tools.md) • [Agent Runtime Manual](docs/agents/agent-runtime.md) • [Inter-Tool Chaining](docs/agents/inter-tool-chaining.md) |
+| 🔄 **Deterministic Sagas** | [Durable Workflows Engine](docs/workflows/durable-workflows.md) |
+| 📊 **Observability** | [GateWall Cockpit Console](docs/observability/gatewall-cockpit.md) • [Telemetry & Browser SDK](docs/observability/telemetry-and-browser-sdk.md) |
+| 💶 **Accounting** | [Financial Normalizer](docs/finance/normalizer.md) |
+
+---
+
 ## 📊 Comparison: Direct LLM vs. Cloud AI Proxy vs. AvantGate
 
 | Capability & Security Boundary | Direct LLM Calls | Cloud AI Proxy (Helicone / Portkey) | 🛡️ **AvantGate (`avantgate`)** |

package/dist/agent/index.js

@@ -48,6 +48,7 @@ __export(agent_exports, {
   createCustomStorageAdapter: () => createCustomStorageAdapter,
   createIsolatedTool: () => createIsolatedTool,
   createStepRunner: () => createStepRunner,
+  createTenantTool: () => createTenantTool,
   createToolInvoker: () => createToolInvoker,
   createToolSharedState: () => createToolSharedState,
   dto: () => dto
@@ -162,7 +163,7 @@ var SPI_LABELLED_REGEX = /(?:(?:num[ée]ro\s+fiscal|spi|n[°o]\s*fiscal|d[ée]cl
 var SPI_FORMATTED_REGEX = /\b[0-3]\d(?:\s+\d{2}){5}\s+\d\b/g;
 var IBAN_REGEX = /\b[A-Z]{2}\s*[0-9]{2}(?:[\s\r\n.-]*[A-Z0-9]){11,30}\b/g;
 var BIC_LABELLED_REGEX = /(?:(?:bic|swift)\s*[:=]?\s*)\b([A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\b/gi;
-function sanitizePII(input) {
+var sanitizePII = (input) => {
   let count = 0;
   let result = input;
   result = result.replace(EMAIL_REGEX, () => {
@@ -205,7 +206,7 @@ function sanitizePII(input) {
     return match;
   });
   return { text: result, maskedCount: count };
-}
+};
 
 // src/agent/guardrails.ts
 function sanitizeString(value) {
@@ -260,7 +261,23 @@ function auditToolResult(data, options) {
 }
 
 // src/agent/isolated-tool.ts
-async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
+var verifyRoles = (configuredRoles, context, toolIdentifier) => {
+  if (!configuredRoles || configuredRoles.length === 0) {
+    return;
+  }
+  const userRoles = [
+    ...context.roles ?? [],
+    ...context.role ? [context.role] : []
+  ];
+  const hasAllowedRole = configuredRoles.some((role) => userRoles.includes(role));
+  if (!hasAllowedRole) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: insufficient role permissions"
+    );
+  }
+};
+var verifyDataAccessGuard = async (guard, args, context, toolIdentifier) => {
   if (!guard) {
     return;
   }
@@ -268,8 +285,55 @@ async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
   if (!isAllowed) {
     throw new ToolAccessDeniedError(toolIdentifier, "Access denied by data access guard");
   }
-}
-async function resolveInvalidationTags(config, args, rawResult, context) {
+};
+var verifyTenantIsolation = (assertTenant, rawResult, context, toolIdentifier) => {
+  if (!assertTenant) {
+    return;
+  }
+  if (!context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: missing session tenantId in execution context for multi-tenant tool"
+    );
+  }
+  const recordTenantId = assertTenant(rawResult);
+  if (recordTenantId && recordTenantId !== context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      `Cross-tenant IDOR access violation: record tenant '${recordTenantId}' does not match session tenant '${context.tenantId}'`
+    );
+  }
+};
+var verifyResourceOwnership = async (assertOwnership, rawResult, context, toolIdentifier) => {
+  if (!assertOwnership) {
+    return;
+  }
+  const isOwner = await assertOwnership(rawResult, context);
+  if (!isOwner) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Ownership IDOR access violation: user does not own or have access to this resource"
+    );
+  }
+};
+var checkSuspiciousParameters = (parameters, toolName) => {
+  if (!parameters || typeof parameters !== "object") {
+    return;
+  }
+  const zodShape = parameters.shape;
+  if (!zodShape || typeof zodShape !== "object") {
+    return;
+  }
+  const suspiciousKeys = ["tenantId", "tenant_id", "ownerTenantId"];
+  for (const key of suspiciousKeys) {
+    if (key in zodShape) {
+      console.warn(
+        `[avantGate Security Warning] Tool '${toolName}' defines '${key}' as a model parameter. Tenancy should be inferred from the trusted server context (context.tenantId) rather than supplied by the untrusted model to prevent IDOR attacks.`
+      );
+    }
+  }
+};
+var resolveInvalidationTags = async (config, args, rawResult, context) => {
   if (!config.invalidationTags) {
     return void 0;
   }
@@ -278,33 +342,29 @@ async function resolveInvalidationTags(config, args, rawResult, context) {
     await context.onInvalidationTags(tags);
   }
   return tags;
-}
-async function dispatchClientData(rawResult, callback) {
+};
+var dispatchClientData = async (rawResult, callback) => {
   if (!callback) {
     return;
   }
   await callback(rawResult);
-}
-async function produceLlmPayload(rawResult, args, context, transformer) {
+};
+var produceLlmPayload = async (rawResult, args, context, transformer) => {
   if (transformer) {
     return await transformer(rawResult, args, context);
   }
   return rawResult;
-}
-function validateLlmDto(payload, schema, toolIdentifier) {
+};
+var validateLlmDto = (payload, schema, toolIdentifier) => {
   const parseResult = schema.safeParse(payload);
   if (!parseResult.success) {
     const issues = parseResult.error.issues ?? [];
     const errorMessages = issues.map((issue) => `${issue.path.join(".") || "root"}: ${issue.message}`).join(", ");
-    throw new DtoValidationError(
-      toolIdentifier,
-      errorMessages,
-      issues
-    );
+    throw new DtoValidationError(toolIdentifier, errorMessages, issues);
   }
   return parseResult.data;
-}
-function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnPii = false) {
+};
+var protectLlmPayload = (payload, toolIdentifier, sanitizePii = true, throwOnPii = false) => {
   if (!sanitizePii) {
     return { sanitized: payload, count: 0 };
   }
@@ -313,8 +373,8 @@ function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnP
     throwOnPii
   });
   return { sanitized: sanitizedData, count: maskedCount };
-}
-async function processLlmPayload(rawResult, args, context, config, toolIdentifier) {
+};
+var processLlmPayload = async (rawResult, args, context, config, toolIdentifier) => {
   let payload = await produceLlmPayload(rawResult, args, context, config.llmDto);
   if (config.llmDtoSchema) {
     payload = validateLlmDto(payload, config.llmDtoSchema, toolIdentifier);
@@ -325,14 +385,15 @@ async function processLlmPayload(rawResult, args, context, config, toolIdentifie
     config.sanitizePii !== false,
     config.throwOnPii === true
   );
-}
-function createIsolatedTool(config) {
+};
+var createIsolatedTool = (config) => {
   const toolId = config.id || config.name;
   const toolAlias = config.alias;
   const clientCallback = config.clientDto;
   const toolIdentifier = toolAlias || config.name;
   const toolImpact = config.impact ?? "READ_ONLY";
   const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
+  checkSuspiciousParameters(config.parameters, config.name);
   const tool = {
     description: config.description,
     parameters: config.parameters,
@@ -348,11 +409,12 @@ function createIsolatedTool(config) {
     _requireApproval: requireApproval,
     _lastPiiFilteredCount: 0,
     _lastInvalidationTags: void 0,
-    async execute(args, context) {
+    execute: async (args, context) => {
       const updatedContext = {
         ...context,
         callChain: context?.callChain ?? Object.freeze([toolId])
       };
+      verifyRoles(config.roles, updatedContext, toolIdentifier);
       await verifyDataAccessGuard(
         config.dataAccessGuard,
         args,
@@ -360,6 +422,13 @@ function createIsolatedTool(config) {
         toolIdentifier
       );
       const rawResult = await config.execute(args, updatedContext);
+      verifyTenantIsolation(config.assertTenant, rawResult, updatedContext, toolIdentifier);
+      await verifyResourceOwnership(
+        config.assertOwnership,
+        rawResult,
+        updatedContext,
+        toolIdentifier
+      );
       const tags = await resolveInvalidationTags(
         config,
         args,
@@ -382,7 +451,10 @@ function createIsolatedTool(config) {
     }
   };
   return tool;
-}
+};
+var createTenantTool = (config) => {
+  return createIsolatedTool(config);
+};
 
 // src/agent/dto.ts
 function extractWhitelistedFields(data, keys) {
@@ -2030,6 +2102,7 @@ var HttpTelemetryExporter = class {
   createCustomStorageAdapter,
   createIsolatedTool,
   createStepRunner,
+  createTenantTool,
   createToolInvoker,
   createToolSharedState,
   dto

package/dist/agent/index.mjs

@@ -9,8 +9,10 @@ import {
   ToolNotFoundError,
   ToolSubCallQuotaError,
   auditToolResult,
-  createIsolatedTool
-} from "../chunk-5VA3EKPJ.mjs";
+  createIsolatedTool,
+  createTenantTool
+} from "../chunk-W27A25DK.mjs";
+import "../chunk-Y6FXYEAI.mjs";
 
 // src/agent/dto.ts
 function extractWhitelistedFields(data, keys) {
@@ -1657,6 +1659,7 @@ export {
   createCustomStorageAdapter,
   createIsolatedTool,
   createStepRunner,
+  createTenantTool,
   createToolInvoker,
   createToolSharedState,
   dto

package/dist/agent/isolated-tool.d.ts

@@ -1,9 +1,14 @@
-import type { IsolatedToolConfig, VercelAiCoreTool } from "./types";
+import type { IsolatedToolConfig, TenantToolConfig, VercelAiCoreTool } from "./types";
 /**
  * Creates an isolated tool compatible with Vercel AI SDK (ai) tool contract.
  * Features dual-channel separation (client data vs minimal LLM DTO),
- * access governance (domain, resource, roles, dataAccessGuard, invalidationTags),
+ * access governance (domain, resource, roles, dataAccessGuard, assertTenant, assertOwnership, invalidationTags),
  * stable ID, aliasing, caching, Zod DTO contract validation, and automatic in-flight PII redaction.
  */
-export declare function createIsolatedTool<TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto>): VercelAiCoreTool<TArgs, TResult>;
+export declare const createIsolatedTool: <TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto>) => VercelAiCoreTool<TArgs, TResult>;
+/**
+ * High-assurance factory for multi-tenant and user-owned tools.
+ * Compile-time enforcement: strictly requires either assertTenant or assertOwnership.
+ */
+export declare const createTenantTool: <TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: TenantToolConfig<TArgs, TResult, TLLMDto, TClientDto>) => VercelAiCoreTool<TArgs, TResult>;
 //# sourceMappingURL=isolated-tool.d.ts.map

package/dist/agent/isolated-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAoHjB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,MAAM,EAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAgElC"}
+{"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAEhB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAqMjB;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,QAAQ,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CA6EjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,QAAQ,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAC5D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAEjC,CAAC"}

package/dist/agent/types.d.ts

@@ -107,6 +107,10 @@ export interface StepRunnerConfig {
  * Context received by tool execution, supporting inter-tool chaining and shared state.
  */
 export interface ToolExecutionContext {
+    tenantId?: string;
+    userId?: string;
+    role?: string;
+    roles?: string[];
     toolCallId?: string;
     messages?: unknown[];
     abortSignal?: AbortSignal;
@@ -170,6 +174,8 @@ export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknow
     impact?: ToolImpact;
     requireApproval?: boolean;
     dataAccessGuard?: DataAccessGuard<TArgs>;
+    assertTenant?: (result: TResult) => string | undefined | null;
+    assertOwnership?: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
     invalidationTags?: InvalidationTagsResolver<TArgs, TResult>;
     parameters: z.ZodType<TArgs> | unknown;
     cacheTTL?: number;
@@ -180,6 +186,16 @@ export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknow
     sanitizePii?: boolean;
     throwOnPii?: boolean;
 }
+/**
+ * Configuration for createTenantTool requiring either assertTenant or assertOwnership at compile-time.
+ */
+export type TenantToolConfig<TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult> = IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto> & ({
+    assertTenant: (result: TResult) => string | undefined | null;
+    assertOwnership?: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
+} | {
+    assertTenant?: (result: TResult) => string | undefined | null;
+    assertOwnership: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
+});
 /**
  * Standard tool contract compatible with Vercel AI SDK (ai) tool definition.
  */

package/dist/agent/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,GAClB,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,GAClB,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC9D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,CAC1B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,IAClB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAC1D;IACE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,GACD;IACE,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC9D,eAAe,EAAE,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}

package/dist/{chunk-CO26LNFD.mjs → chunk-36ULFTM2.mjs}

@@ -452,7 +452,7 @@ var AccountingFactory = class {
 };
 
 // src/response-validator.ts
-function extractAndCleanJSON(rawText) {
+var extractAndCleanJSON = (rawText) => {
   let cleaned = rawText.trim();
   cleaned = cleaned.replace(/<think>[\s\S]*?<\/think>/gi, "").trim();
   const codeBlockMatch = cleaned.match(/```(?:json)?\s*([\s\S]*?)\s*```/i);
@@ -476,8 +476,8 @@ function extractAndCleanJSON(rawText) {
     cleaned = cleaned.slice(startIndex, endIndex + 1);
   }
   return cleaned;
-}
-function validateWithZod(rawText, schema, options) {
+};
+var validateWithZod = (rawText, schema, options) => {
   let jsonString = extractAndCleanJSON(rawText);
   if (options?.normalizer) {
     jsonString = options.normalizer(jsonString);
@@ -492,20 +492,20 @@ function validateWithZod(rawText, schema, options) {
     parsed = JSON.parse(sanitized);
   }
   return schema.parse(parsed);
-}
+};
 
 // src/finance/normalizer.ts
-function cleanFinancialJSON(rawText, options) {
+var cleanFinancialJSON = (rawText, options) => {
   if (!rawText) {
     return "";
   }
   const jsonBlock = extractAndCleanJSON(rawText);
   const strategy = options?.jurisdiction ? AccountingFactory.getStrategy(options.jurisdiction) : options?.autoDetect !== false ? AccountingFactory.detectStrategy(rawText) : AccountingFactory.getStrategy("FR");
   return strategy.cleanJSON(jsonBlock);
-}
-function withFinancialNormalizer(options) {
+};
+var withFinancialNormalizer = (options) => {
   return (rawText) => cleanFinancialJSON(rawText, options);
-}
+};
 
 export {
   FrenchPCGStrategy,

package/dist/{chunk-4XWO3NZW.mjs → chunk-AH5XXSS4.mjs}

@@ -1,7 +1,7 @@
 import {
   StepSuspendedError,
   createIsolatedTool
-} from "./chunk-5VA3EKPJ.mjs";
+} from "./chunk-W27A25DK.mjs";
 
 // src/workflow/errors.ts
 var WorkflowSagaRollbackError = class extends Error {

package/dist/{chunk-5VA3EKPJ.mjs → chunk-W27A25DK.mjs}

@@ -6,7 +6,7 @@ var SPI_LABELLED_REGEX = /(?:(?:num[ée]ro\s+fiscal|spi|n[°o]\s*fiscal|d[ée]cl
 var SPI_FORMATTED_REGEX = /\b[0-3]\d(?:\s+\d{2}){5}\s+\d\b/g;
 var IBAN_REGEX = /\b[A-Z]{2}\s*[0-9]{2}(?:[\s\r\n.-]*[A-Z0-9]){11,30}\b/g;
 var BIC_LABELLED_REGEX = /(?:(?:bic|swift)\s*[:=]?\s*)\b([A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\b/gi;
-function sanitizePII(input) {
+var sanitizePII = (input) => {
   let count = 0;
   let result = input;
   result = result.replace(EMAIL_REGEX, () => {
@@ -49,7 +49,7 @@ function sanitizePII(input) {
     return match;
   });
   return { text: result, maskedCount: count };
-}
+};
 
 // src/agent/errors.ts
 var StepSuspendedError = class extends Error {
@@ -204,7 +204,23 @@ function auditToolResult(data, options) {
 }
 
 // src/agent/isolated-tool.ts
-async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
+var verifyRoles = (configuredRoles, context, toolIdentifier) => {
+  if (!configuredRoles || configuredRoles.length === 0) {
+    return;
+  }
+  const userRoles = [
+    ...context.roles ?? [],
+    ...context.role ? [context.role] : []
+  ];
+  const hasAllowedRole = configuredRoles.some((role) => userRoles.includes(role));
+  if (!hasAllowedRole) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: insufficient role permissions"
+    );
+  }
+};
+var verifyDataAccessGuard = async (guard, args, context, toolIdentifier) => {
   if (!guard) {
     return;
   }
@@ -212,8 +228,55 @@ async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
   if (!isAllowed) {
     throw new ToolAccessDeniedError(toolIdentifier, "Access denied by data access guard");
   }
-}
-async function resolveInvalidationTags(config, args, rawResult, context) {
+};
+var verifyTenantIsolation = (assertTenant, rawResult, context, toolIdentifier) => {
+  if (!assertTenant) {
+    return;
+  }
+  if (!context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: missing session tenantId in execution context for multi-tenant tool"
+    );
+  }
+  const recordTenantId = assertTenant(rawResult);
+  if (recordTenantId && recordTenantId !== context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      `Cross-tenant IDOR access violation: record tenant '${recordTenantId}' does not match session tenant '${context.tenantId}'`
+    );
+  }
+};
+var verifyResourceOwnership = async (assertOwnership, rawResult, context, toolIdentifier) => {
+  if (!assertOwnership) {
+    return;
+  }
+  const isOwner = await assertOwnership(rawResult, context);
+  if (!isOwner) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Ownership IDOR access violation: user does not own or have access to this resource"
+    );
+  }
+};
+var checkSuspiciousParameters = (parameters, toolName) => {
+  if (!parameters || typeof parameters !== "object") {
+    return;
+  }
+  const zodShape = parameters.shape;
+  if (!zodShape || typeof zodShape !== "object") {
+    return;
+  }
+  const suspiciousKeys = ["tenantId", "tenant_id", "ownerTenantId"];
+  for (const key of suspiciousKeys) {
+    if (key in zodShape) {
+      console.warn(
+        `[avantGate Security Warning] Tool '${toolName}' defines '${key}' as a model parameter. Tenancy should be inferred from the trusted server context (context.tenantId) rather than supplied by the untrusted model to prevent IDOR attacks.`
+      );
+    }
+  }
+};
+var resolveInvalidationTags = async (config, args, rawResult, context) => {
   if (!config.invalidationTags) {
     return void 0;
   }
@@ -222,33 +285,29 @@ async function resolveInvalidationTags(config, args, rawResult, context) {
     await context.onInvalidationTags(tags);
   }
   return tags;
-}
-async function dispatchClientData(rawResult, callback) {
+};
+var dispatchClientData = async (rawResult, callback) => {
   if (!callback) {
     return;
   }
   await callback(rawResult);
-}
-async function produceLlmPayload(rawResult, args, context, transformer) {
+};
+var produceLlmPayload = async (rawResult, args, context, transformer) => {
   if (transformer) {
     return await transformer(rawResult, args, context);
   }
   return rawResult;
-}
-function validateLlmDto(payload, schema, toolIdentifier) {
+};
+var validateLlmDto = (payload, schema, toolIdentifier) => {
   const parseResult = schema.safeParse(payload);
   if (!parseResult.success) {
     const issues = parseResult.error.issues ?? [];
     const errorMessages = issues.map((issue) => `${issue.path.join(".") || "root"}: ${issue.message}`).join(", ");
-    throw new DtoValidationError(
-      toolIdentifier,
-      errorMessages,
-      issues
-    );
+    throw new DtoValidationError(toolIdentifier, errorMessages, issues);
   }
   return parseResult.data;
-}
-function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnPii = false) {
+};
+var protectLlmPayload = (payload, toolIdentifier, sanitizePii = true, throwOnPii = false) => {
   if (!sanitizePii) {
     return { sanitized: payload, count: 0 };
   }
@@ -257,8 +316,8 @@ function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnP
     throwOnPii
   });
   return { sanitized: sanitizedData, count: maskedCount };
-}
-async function processLlmPayload(rawResult, args, context, config, toolIdentifier) {
+};
+var processLlmPayload = async (rawResult, args, context, config, toolIdentifier) => {
   let payload = await produceLlmPayload(rawResult, args, context, config.llmDto);
   if (config.llmDtoSchema) {
     payload = validateLlmDto(payload, config.llmDtoSchema, toolIdentifier);
@@ -269,14 +328,15 @@ async function processLlmPayload(rawResult, args, context, config, toolIdentifie
     config.sanitizePii !== false,
     config.throwOnPii === true
   );
-}
-function createIsolatedTool(config) {
+};
+var createIsolatedTool = (config) => {
   const toolId = config.id || config.name;
   const toolAlias = config.alias;
   const clientCallback = config.clientDto;
   const toolIdentifier = toolAlias || config.name;
   const toolImpact = config.impact ?? "READ_ONLY";
   const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
+  checkSuspiciousParameters(config.parameters, config.name);
   const tool = {
     description: config.description,
     parameters: config.parameters,
@@ -292,11 +352,12 @@ function createIsolatedTool(config) {
     _requireApproval: requireApproval,
     _lastPiiFilteredCount: 0,
     _lastInvalidationTags: void 0,
-    async execute(args, context) {
+    execute: async (args, context) => {
       const updatedContext = {
         ...context,
         callChain: context?.callChain ?? Object.freeze([toolId])
       };
+      verifyRoles(config.roles, updatedContext, toolIdentifier);
       await verifyDataAccessGuard(
         config.dataAccessGuard,
         args,
@@ -304,6 +365,13 @@ function createIsolatedTool(config) {
         toolIdentifier
       );
       const rawResult = await config.execute(args, updatedContext);
+      verifyTenantIsolation(config.assertTenant, rawResult, updatedContext, toolIdentifier);
+      await verifyResourceOwnership(
+        config.assertOwnership,
+        rawResult,
+        updatedContext,
+        toolIdentifier
+      );
       const tags = await resolveInvalidationTags(
         config,
         args,
@@ -326,7 +394,10 @@ function createIsolatedTool(config) {
     }
   };
   return tool;
-}
+};
+var createTenantTool = (config) => {
+  return createIsolatedTool(config);
+};
 
 export {
   sanitizePII,
@@ -340,5 +411,6 @@ export {
   ToolNotFoundError,
   DtoValidationError,
   auditToolResult,
-  createIsolatedTool
+  createIsolatedTool,
+  createTenantTool
 };

package/dist/chunk-Y6FXYEAI.mjs

@@ -0,0 +1,10 @@
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+export {
+  __require
+};