avantgate 1.6.1 → 1.8.0

package/README.md

@@ -86,17 +86,26 @@ Contact our team at [contact@gatewall.fr](mailto:contact@gatewall.fr) for privat
 
 ## 🚀 Key Security & Defense Features
 
-- 🛡️ **Active Threat Defense & Prompt Guardrails**: Blocks prompt injections, DAN jailbreaks, adversarial noise, and system prompt exfiltration *before* external API invocation.
-- 🔒 **Zero-Egress Data Loss Prevention (DLP)**: Automated local redaction of emails, phone numbers, IBAN/BIC, and French/EU identifiers (NIR SSN, SPI tax ID) before network egress.
-- ⚡ **Deterministic Workflow Engine (`avantgate/workflow`)**: In-process sequential state machine for multi-step agent orchestrations. Features automatic reverse compensation (Saga Pattern), non-blocking Human-in-the-Loop checkpoints, and safe-by-default AI tool conversion (`asTool()`).
-- 🎭 **Dual-Channel Tool Isolation (`avantgate/agent`)**: Decouples sensitive database records (streamed out-of-band directly to client UIs) from minimal cognitive LLM context (`llmDto`), keeping confidential fields out of context windows.
-- 🛑 **Anti-IDOR & Access Governance**: Enforces Row-Level Security (`dataAccessGuard`), business domain partitioning, and granular role-based permissions at the agent tool boundary.
-- 💰 **Denial-of-Wallet & Pre-Flight Budgeting**: Enforces strict token and cent-level USD budget limits, rejecting abusive requests before paying for upstream inference.
-- 🔀 **Zero-Downtime Multi-Model Failover**: Seamless client-side failover to fallback providers (or local zero-cost Ollama) when upstream APIs return HTTP 429/500 errors.
-- 🔧 **Self-Repairing Structured Outputs**: Strict Zod schema compliance with automated heuristic markdown/JSON repair if the model hallucinates formatting.
-- 📡 **Zero-Dependency Telemetry Bridge (`HttpTelemetryExporter`, `PlatformStorageAdapter`)**: Mirror execution audits and hierarchical tool traces asynchronously without adding heavy external dependencies.
-- 🌐 **Lightweight Front-End SDK & React Hook (`avantgate/client`)**: Micro-bundle (< 1.7 KB gzipped) for browser UIs. Captures client-side security alerts (blocked API keys, prompt injection attempts), UI render metrics, and user feedback, streaming them directly to gateWall via `fetch(keepalive)` without loading backend infrastructure.
-- 📦 **100% Framework Agnostic**: Works seamlessly in Next.js, Express, Fastify, NestJS, Cloudflare Workers, AWS Lambda, or CLI scripts.
+| Pillar | Core Capabilities & Architecture |
+|---|---|
+| 🛡️ **AI-WAF & Privacy** | • **Prompt Guardrails**: Blocks prompt injections, jailbreaks & exfiltration *pre-flight*.<br/>• **Zero-Egress DLP**: In-process redaction of emails, phone numbers, IBANs & EU tax IDs.<br/>• **Self-Repairing Outputs**: Native Zod validation with automatic JSON heuristic repair. |
+| 🛑 **Agent Isolation & Anti-IDOR** | • **Dual-Channel DTOs**: Streams full records to UI while injecting sanitized summaries into LLM.<br/>• **Anti-IDOR Boundary**: Compile-time tenant scoping (`createTenantTool`) & runtime ownership checks.<br/>• **Infinite Loop Shield**: Detects and breaks recursive agent tool execution loops. |
+| 💰 **FinOps & Resilience** | • **Denial-of-Wallet**: Enforces hard token & USD budgets *before* external inference spend.<br/>• **Multi-Model Failover**: Instant client-side routing to fallback models or local Ollama on 429/500.<br/>• **Live Cost Ledger**: Token burn calculation & pricing adapters with zero external DB. |
+| ⚡ **Sagas & Telemetry** | • **Deterministic Sagas (`avantgate/workflow`)**: In-process FSM with automatic reverse compensation ($k-1 \to 0$).<br/>• **Human-in-the-Loop (HITL)**: Non-blocking suspension & approval queues for high-risk tools.<br/>• **Lightweight Telemetry (`avantgate/client`)**: < 1.7 KB client SDK & async audit bridge to GateWall. |
+
+---
+
+## 📚 Documentation & Guides
+
+| Category | In-Depth Guides |
+|---|---|
+| 🚀 **Quickstart** | [Getting Started](docs/getting-started.md) • [Integration Cookbook](docs/examples.md) |
+| 🛡️ **Security & AI-WAF** | [Prompt Guardrails](docs/security/prompt-guardrails.md) • [PII Redaction](docs/security/pii-redaction.md) • [Anti-IDOR Defense](docs/security/anti-idor.md) • [End-to-End Security](docs/security/end-to-end-security.md) |
+| 💰 **FinOps & Cost** | [Pre-Flight Budget Guards](docs/finops/budget-guards.md) • [Pricing Adapters & SQLite](docs/finops/pricing-adapters.md) |
+| 🤖 **Agents & Tools** | [Isolated Tools & DTOs](docs/agents/isolated-tools.md) • [Agent Runtime Manual](docs/agents/agent-runtime.md) • [Inter-Tool Chaining](docs/agents/inter-tool-chaining.md) |
+| 🔄 **Deterministic Sagas** | [Durable Workflows Engine](docs/workflows/durable-workflows.md) |
+| 📊 **Observability** | [GateWall Cockpit Console](docs/observability/gatewall-cockpit.md) • [Telemetry & Browser SDK](docs/observability/telemetry-and-browser-sdk.md) |
+| 💶 **Accounting** | [Financial Normalizer](docs/finance/normalizer.md) |
 
 ---
 
@@ -139,19 +148,6 @@ yarn add avantgate zod
 
 ---
 
-## 📖 Documentation & Guides
-
-Comprehensive guides, copy-pasteable integration recipes, and architectural references are available in the dedicated documentation:
-
-| Guide | Description |
-|---|---|
-| **[Deterministic Workflow Engine](docs/workflow.md)** | Zero-infra Saga orchestrator, linear FSM rationale, reverse compensation, HITL checkpoints & agent tool conversion. |
-| **[Code Examples & Recipes](docs/examples.md)** | End-to-end security guardrails, PII redaction, anti-IDOR tool boundaries, cost tracking, Zod self-repair, and multi-model failover. |
-| **[Decoupled Pricing & DB Adapters](docs/pricing.md)** | Dynamic token pricing, database integration (Prisma / PostgreSQL / Drizzle), in-memory TTL caching, and runtime overrides. |
-| **[Durable Agent Harness & Tool Isolation](docs/agent.md)** | Serverless durable step execution, Human-in-the-Loop suspension, dual-channel DTO tool isolation, and telemetry streaming. |
-
----
-
 ## 🏗️ Architecture & Extensibility
 
 AvantGate is built around clean **Ports and Adapters**:
@@ -163,41 +159,7 @@ AvantGate is built around clean **Ports and Adapters**:
 
 ## 🗺️ Roadmap & Milestones
 
-### 🎯 Core Control Plane (`avantgate`)
-
-1. ⏱️ **In-Process Sliding-Window Rate Limiter & User Quotas**
-   - In-memory token bucket per User ID, IP address, or session without Redis.
-   - Per-user daily & hourly token budget limits with automatic graceful throttling.
-
-2. 🔒 **Bidirectional Sanitizer & Secret Leak Prevention**
-   - Extend PII protection from input queries to **model outputs and audit logs**.
-   - Active inspection to prevent LLM hallucinations from leaking server credentials, environment variables (`sk-...`, JWTs), or raw system instructions to client frontends.
-
-3. ⚡ **Spend Velocity Circuit Breaker & Exponential Backoff**
-   - Real-time spend velocity detection (trips if spend exceeds $X within Y minutes).
-   - Configurable exponential backoff retries before triggering provider failover.
-   - Safe degradation returning user-friendly messages instead of raw provider crashes.
-
-4. ⚖️ **Real-Time Evaluation Quality Gates**
-   - Replace gut-feel and vibe-based evaluations with in-process, measurable output quality gates.
-   - Built-in sub-millisecond heuristic gates:
-     - **Refusal & Boilerplate Gate**: Detects unwanted refusal phrasing (*"As an AI..."*) and triggers fallback.
-     - **Context Grounding Gate**: Verifies factual entity containment against supplied reference text.
-   - Automated corrective retry loop (`onFailure: "retry_with_feedback"`) or instant model failover.
-
-5. 🔌 **Lifecycle Middleware Hooks (`beforeRequest`, `afterResponse`)**
-   - Extensible middleware pipeline to inspect, enrich, or modify prompts and completions without modifying core logic.
-   - Universal hook allowing any external RAG system or context engine to compose with AvantGate seamlessly.
-
-6. 🚀 **One-Line Launch-Safe Presets (`PRESETS.LAUNCH_SAFE`)**
-   - Zero-config hardened setup with sensible defaults for security, budgets, and failovers.
-
-### 📦 Modular Ecosystem & Extensions
-
-- **`avantgate/workflow`**: Deterministic sequential state machine, automatic reverse Saga rollback ($k-1 \to 0$), and durable HITL checkpoints.
-- **`avantgate/agent`**: Zero-infra durable step orchestration, human-in-the-loop pauses, and dual-channel PII tool isolation.
-- **`avantgate/finance`**: Zero-overhead financial accounting normalizer across international jurisdictions (FR PCG, US GAAP, UK IFRS, Swiss CO).
-- **Launch Readiness Linter**: Standalone developer tool to audit codebases before launch for exposed keys, unbudgeted endpoints, and missing guards.
+Interested in upcoming features (output DLP & secret leak guard, lifecycle hooks, launch-safe presets) or release history See [**ROADMAP.md**](ROADMAP.md).
 
 ---
 

package/dist/agent/index.js

@@ -48,6 +48,7 @@ __export(agent_exports, {
   createCustomStorageAdapter: () => createCustomStorageAdapter,
   createIsolatedTool: () => createIsolatedTool,
   createStepRunner: () => createStepRunner,
+  createTenantTool: () => createTenantTool,
   createToolInvoker: () => createToolInvoker,
   createToolSharedState: () => createToolSharedState,
   dto: () => dto
@@ -162,7 +163,7 @@ var SPI_LABELLED_REGEX = /(?:(?:num[ée]ro\s+fiscal|spi|n[°o]\s*fiscal|d[ée]cl
 var SPI_FORMATTED_REGEX = /\b[0-3]\d(?:\s+\d{2}){5}\s+\d\b/g;
 var IBAN_REGEX = /\b[A-Z]{2}\s*[0-9]{2}(?:[\s\r\n.-]*[A-Z0-9]){11,30}\b/g;
 var BIC_LABELLED_REGEX = /(?:(?:bic|swift)\s*[:=]?\s*)\b([A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\b/gi;
-function sanitizePII(input) {
+var sanitizePII = (input) => {
   let count = 0;
   let result = input;
   result = result.replace(EMAIL_REGEX, () => {
@@ -205,7 +206,7 @@ function sanitizePII(input) {
     return match;
   });
   return { text: result, maskedCount: count };
-}
+};
 
 // src/agent/guardrails.ts
 function sanitizeString(value) {
@@ -260,7 +261,23 @@ function auditToolResult(data, options) {
 }
 
 // src/agent/isolated-tool.ts
-async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
+var verifyRoles = (configuredRoles, context, toolIdentifier) => {
+  if (!configuredRoles || configuredRoles.length === 0) {
+    return;
+  }
+  const userRoles = [
+    ...context.roles ?? [],
+    ...context.role ? [context.role] : []
+  ];
+  const hasAllowedRole = configuredRoles.some((role) => userRoles.includes(role));
+  if (!hasAllowedRole) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: insufficient role permissions"
+    );
+  }
+};
+var verifyDataAccessGuard = async (guard, args, context, toolIdentifier) => {
   if (!guard) {
     return;
   }
@@ -268,8 +285,55 @@ async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
   if (!isAllowed) {
     throw new ToolAccessDeniedError(toolIdentifier, "Access denied by data access guard");
   }
-}
-async function resolveInvalidationTags(config, args, rawResult, context) {
+};
+var verifyTenantIsolation = (assertTenant, rawResult, context, toolIdentifier) => {
+  if (!assertTenant) {
+    return;
+  }
+  if (!context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: missing session tenantId in execution context for multi-tenant tool"
+    );
+  }
+  const recordTenantId = assertTenant(rawResult);
+  if (recordTenantId && recordTenantId !== context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      `Cross-tenant IDOR access violation: record tenant '${recordTenantId}' does not match session tenant '${context.tenantId}'`
+    );
+  }
+};
+var verifyResourceOwnership = async (assertOwnership, rawResult, context, toolIdentifier) => {
+  if (!assertOwnership) {
+    return;
+  }
+  const isOwner = await assertOwnership(rawResult, context);
+  if (!isOwner) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Ownership IDOR access violation: user does not own or have access to this resource"
+    );
+  }
+};
+var checkSuspiciousParameters = (parameters, toolName) => {
+  if (!parameters || typeof parameters !== "object") {
+    return;
+  }
+  const zodShape = parameters.shape;
+  if (!zodShape || typeof zodShape !== "object") {
+    return;
+  }
+  const suspiciousKeys = ["tenantId", "tenant_id", "ownerTenantId"];
+  for (const key of suspiciousKeys) {
+    if (key in zodShape) {
+      console.warn(
+        `[avantGate Security Warning] Tool '${toolName}' defines '${key}' as a model parameter. Tenancy should be inferred from the trusted server context (context.tenantId) rather than supplied by the untrusted model to prevent IDOR attacks.`
+      );
+    }
+  }
+};
+var resolveInvalidationTags = async (config, args, rawResult, context) => {
   if (!config.invalidationTags) {
     return void 0;
   }
@@ -278,33 +342,29 @@ async function resolveInvalidationTags(config, args, rawResult, context) {
     await context.onInvalidationTags(tags);
   }
   return tags;
-}
-async function dispatchClientData(rawResult, callback) {
+};
+var dispatchClientData = async (rawResult, callback) => {
   if (!callback) {
     return;
   }
   await callback(rawResult);
-}
-async function produceLlmPayload(rawResult, args, context, transformer) {
+};
+var produceLlmPayload = async (rawResult, args, context, transformer) => {
   if (transformer) {
     return await transformer(rawResult, args, context);
   }
   return rawResult;
-}
-function validateLlmDto(payload, schema, toolIdentifier) {
+};
+var validateLlmDto = (payload, schema, toolIdentifier) => {
   const parseResult = schema.safeParse(payload);
   if (!parseResult.success) {
     const issues = parseResult.error.issues ?? [];
     const errorMessages = issues.map((issue) => `${issue.path.join(".") || "root"}: ${issue.message}`).join(", ");
-    throw new DtoValidationError(
-      toolIdentifier,
-      errorMessages,
-      issues
-    );
+    throw new DtoValidationError(toolIdentifier, errorMessages, issues);
   }
   return parseResult.data;
-}
-function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnPii = false) {
+};
+var protectLlmPayload = (payload, toolIdentifier, sanitizePii = true, throwOnPii = false) => {
   if (!sanitizePii) {
     return { sanitized: payload, count: 0 };
   }
@@ -313,8 +373,8 @@ function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnP
     throwOnPii
   });
   return { sanitized: sanitizedData, count: maskedCount };
-}
-async function processLlmPayload(rawResult, args, context, config, toolIdentifier) {
+};
+var processLlmPayload = async (rawResult, args, context, config, toolIdentifier) => {
   let payload = await produceLlmPayload(rawResult, args, context, config.llmDto);
   if (config.llmDtoSchema) {
     payload = validateLlmDto(payload, config.llmDtoSchema, toolIdentifier);
@@ -325,14 +385,15 @@ async function processLlmPayload(rawResult, args, context, config, toolIdentifie
     config.sanitizePii !== false,
     config.throwOnPii === true
   );
-}
-function createIsolatedTool(config) {
+};
+var createIsolatedTool = (config) => {
   const toolId = config.id || config.name;
   const toolAlias = config.alias;
   const clientCallback = config.clientDto;
   const toolIdentifier = toolAlias || config.name;
   const toolImpact = config.impact ?? "READ_ONLY";
   const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
+  checkSuspiciousParameters(config.parameters, config.name);
   const tool = {
     description: config.description,
     parameters: config.parameters,
@@ -348,11 +409,12 @@ function createIsolatedTool(config) {
     _requireApproval: requireApproval,
     _lastPiiFilteredCount: 0,
     _lastInvalidationTags: void 0,
-    async execute(args, context) {
+    execute: async (args, context) => {
       const updatedContext = {
         ...context,
         callChain: context?.callChain ?? Object.freeze([toolId])
       };
+      verifyRoles(config.roles, updatedContext, toolIdentifier);
       await verifyDataAccessGuard(
         config.dataAccessGuard,
         args,
@@ -360,6 +422,13 @@ function createIsolatedTool(config) {
         toolIdentifier
       );
       const rawResult = await config.execute(args, updatedContext);
+      verifyTenantIsolation(config.assertTenant, rawResult, updatedContext, toolIdentifier);
+      await verifyResourceOwnership(
+        config.assertOwnership,
+        rawResult,
+        updatedContext,
+        toolIdentifier
+      );
       const tags = await resolveInvalidationTags(
         config,
         args,
@@ -382,7 +451,10 @@ function createIsolatedTool(config) {
     }
   };
   return tool;
-}
+};
+var createTenantTool = (config) => {
+  return createIsolatedTool(config);
+};
 
 // src/agent/dto.ts
 function extractWhitelistedFields(data, keys) {
@@ -2030,6 +2102,7 @@ var HttpTelemetryExporter = class {
   createCustomStorageAdapter,
   createIsolatedTool,
   createStepRunner,
+  createTenantTool,
   createToolInvoker,
   createToolSharedState,
   dto

package/dist/agent/index.mjs

@@ -9,8 +9,10 @@ import {
   ToolNotFoundError,
   ToolSubCallQuotaError,
   auditToolResult,
-  createIsolatedTool
-} from "../chunk-5VA3EKPJ.mjs";
+  createIsolatedTool,
+  createTenantTool
+} from "../chunk-W27A25DK.mjs";
+import "../chunk-Y6FXYEAI.mjs";
 
 // src/agent/dto.ts
 function extractWhitelistedFields(data, keys) {
@@ -1657,6 +1659,7 @@ export {
   createCustomStorageAdapter,
   createIsolatedTool,
   createStepRunner,
+  createTenantTool,
   createToolInvoker,
   createToolSharedState,
   dto

package/dist/agent/isolated-tool.d.ts

@@ -1,9 +1,14 @@
-import type { IsolatedToolConfig, VercelAiCoreTool } from "./types";
+import type { IsolatedToolConfig, TenantToolConfig, VercelAiCoreTool } from "./types";
 /**
  * Creates an isolated tool compatible with Vercel AI SDK (ai) tool contract.
  * Features dual-channel separation (client data vs minimal LLM DTO),
- * access governance (domain, resource, roles, dataAccessGuard, invalidationTags),
+ * access governance (domain, resource, roles, dataAccessGuard, assertTenant, assertOwnership, invalidationTags),
  * stable ID, aliasing, caching, Zod DTO contract validation, and automatic in-flight PII redaction.
  */
-export declare function createIsolatedTool<TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto>): VercelAiCoreTool<TArgs, TResult>;
+export declare const createIsolatedTool: <TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto>) => VercelAiCoreTool<TArgs, TResult>;
+/**
+ * High-assurance factory for multi-tenant and user-owned tools.
+ * Compile-time enforcement: strictly requires either assertTenant or assertOwnership.
+ */
+export declare const createTenantTool: <TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult>(config: TenantToolConfig<TArgs, TResult, TLLMDto, TClientDto>) => VercelAiCoreTool<TArgs, TResult>;
 //# sourceMappingURL=isolated-tool.d.ts.map

package/dist/agent/isolated-tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAElB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAoHjB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,MAAM,EAAE,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAgElC"}
+{"version":3,"file":"isolated-tool.d.ts","sourceRoot":"","sources":["../../src/agent/isolated-tool.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAEhB,gBAAgB,EACjB,MAAM,SAAS,CAAC;AAqMjB;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,QAAQ,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAC9D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CA6EjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,EAEpB,QAAQ,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,KAC5D,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAEjC,CAAC"}

package/dist/agent/types.d.ts

@@ -107,6 +107,10 @@ export interface StepRunnerConfig {
  * Context received by tool execution, supporting inter-tool chaining and shared state.
  */
 export interface ToolExecutionContext {
+    tenantId?: string;
+    userId?: string;
+    role?: string;
+    roles?: string[];
     toolCallId?: string;
     messages?: unknown[];
     abortSignal?: AbortSignal;
@@ -170,6 +174,8 @@ export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknow
     impact?: ToolImpact;
     requireApproval?: boolean;
     dataAccessGuard?: DataAccessGuard<TArgs>;
+    assertTenant?: (result: TResult) => string | undefined | null;
+    assertOwnership?: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
     invalidationTags?: InvalidationTagsResolver<TArgs, TResult>;
     parameters: z.ZodType<TArgs> | unknown;
     cacheTTL?: number;
@@ -180,6 +186,16 @@ export interface IsolatedToolConfig<TArgs = any, TResult = any, TLLMDto = unknow
     sanitizePii?: boolean;
     throwOnPii?: boolean;
 }
+/**
+ * Configuration for createTenantTool requiring either assertTenant or assertOwnership at compile-time.
+ */
+export type TenantToolConfig<TArgs = any, TResult = any, TLLMDto = unknown, TClientDto = TResult> = IsolatedToolConfig<TArgs, TResult, TLLMDto, TClientDto> & ({
+    assertTenant: (result: TResult) => string | undefined | null;
+    assertOwnership?: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
+} | {
+    assertTenant?: (result: TResult) => string | undefined | null;
+    assertOwnership: (result: TResult, context: ToolExecutionContext) => boolean | Promise<boolean>;
+});
 /**
  * Standard tool contract compatible with Vercel AI SDK (ai) tool definition.
  */

package/dist/agent/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,GAClB,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;GAEG;AACH,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,WAAW,GACX,QAAQ,GACR,kBAAkB,GAClB,SAAS,CAAC;AAEd;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,OAAO,GAAG,OAAO;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACjD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxF,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,OAAO,EAC1B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,KAAK,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAGrD,iBAAiB,CAAC,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,kBAAkB,CAAC,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAC1F,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,mBAAmB,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClG,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5D,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,gBAAgB,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,gBAAgB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB,CAAC,CAAC,GAAG,OAAO;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,EAAE,CAAC,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,eAAe,CAAC,CAAC,GAAG,OAAO,EACzB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC;IACrB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,CAAC,OAAO,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,GAAG,OAAO,IAAI,CACxE,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,OAAO,IAAI,CACjD,IAAI,EAAE,OAAO,KACV,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B;;GAEG;AACH,MAAM,MAAM,wBAAwB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAC3D,MAAM,EAAE,GACR,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,KAAK,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,MAAM,eAAe,CAAC,KAAK,GAAG,GAAG,IAAI,CACzC,IAAI,EAAE,KAAK,EACX,OAAO,CAAC,EAAE,oBAAoB,KAC3B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CACjC,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO;IAEpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC;IACzC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC9D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5D,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,gBAAgB,CAC1B,KAAK,GAAG,GAAG,EACX,OAAO,GAAG,GAAG,EACb,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,OAAO,IAClB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,CAC1D;IACE,YAAY,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC7D,eAAe,CAAC,EAAE,CAChB,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,GACD;IACE,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;IAC9D,eAAe,EAAE,CACf,MAAM,EAAE,OAAO,EACf,OAAO,EAAE,oBAAoB,KAC1B,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC,CACJ,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,gBAAgB,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAExF;;GAEG;AACH,MAAM,WAAW,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,OAAO,GAAG,GAAG;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,CACT,KAAK,EAAE,cAAc,EAAE,EACvB,OAAO,EAAE,WAAW,GACnB,cAAc,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CACjD"}

package/dist/{chunk-CO26LNFD.mjs → chunk-36ULFTM2.mjs}

@@ -452,7 +452,7 @@ var AccountingFactory = class {
 };
 
 // src/response-validator.ts
-function extractAndCleanJSON(rawText) {
+var extractAndCleanJSON = (rawText) => {
   let cleaned = rawText.trim();
   cleaned = cleaned.replace(/<think>[\s\S]*?<\/think>/gi, "").trim();
   const codeBlockMatch = cleaned.match(/```(?:json)?\s*([\s\S]*?)\s*```/i);
@@ -476,8 +476,8 @@ function extractAndCleanJSON(rawText) {
     cleaned = cleaned.slice(startIndex, endIndex + 1);
   }
   return cleaned;
-}
-function validateWithZod(rawText, schema, options) {
+};
+var validateWithZod = (rawText, schema, options) => {
   let jsonString = extractAndCleanJSON(rawText);
   if (options?.normalizer) {
     jsonString = options.normalizer(jsonString);
@@ -492,20 +492,20 @@ function validateWithZod(rawText, schema, options) {
     parsed = JSON.parse(sanitized);
   }
   return schema.parse(parsed);
-}
+};
 
 // src/finance/normalizer.ts
-function cleanFinancialJSON(rawText, options) {
+var cleanFinancialJSON = (rawText, options) => {
   if (!rawText) {
     return "";
   }
   const jsonBlock = extractAndCleanJSON(rawText);
   const strategy = options?.jurisdiction ? AccountingFactory.getStrategy(options.jurisdiction) : options?.autoDetect !== false ? AccountingFactory.detectStrategy(rawText) : AccountingFactory.getStrategy("FR");
   return strategy.cleanJSON(jsonBlock);
-}
-function withFinancialNormalizer(options) {
+};
+var withFinancialNormalizer = (options) => {
   return (rawText) => cleanFinancialJSON(rawText, options);
-}
+};
 
 export {
   FrenchPCGStrategy,

package/dist/{chunk-4XWO3NZW.mjs → chunk-AH5XXSS4.mjs}

@@ -1,7 +1,7 @@
 import {
   StepSuspendedError,
   createIsolatedTool
-} from "./chunk-5VA3EKPJ.mjs";
+} from "./chunk-W27A25DK.mjs";
 
 // src/workflow/errors.ts
 var WorkflowSagaRollbackError = class extends Error {