network-ai 5.12.7 → 5.13.1

package/dist/esm/lib/model-gateway.js

@@ -0,0 +1,243 @@
+"use strict";
+/**
+ * GovernedModelGateway — model-interaction lifecycle governance.
+ *
+ * Absorbs a frontier model's refusal → fallback → billing complexity and
+ * presents one governed, budgeted, audited interface. When the primary model
+ * declines a request with a classifier refusal (`stop_reason: "refusal"`), the
+ * gateway:
+ *
+ *   1. records the refusal (which classifier `category` fired) to the audit sink,
+ *   2. emits a refusal signal to telemetry (a refusal is an HTTP 200, *not* an
+ *      error — it is invisible to error-rate monitoring),
+ *   3. retries on the next model in the fallback chain, redeeming the one-time
+ *      fallback-credit token so the retry is repriced as a cache read,
+ *   4. strips model-specific thinking blocks when it switches models (unless a
+ *      credit is being redeemed, which requires an exact body match),
+ *   5. accounts each attempt's cost against the cross-model budget.
+ *
+ * This layer is **provider-agnostic**. It operates on a normalized
+ * {@link ModelCaller}; the concrete provider binding (e.g. the Anthropic
+ * Messages adapter) maps the native API to these shapes. Unlike
+ * `AdapterRegistry.fallbackChain` — which fails over on adapter *health*
+ * (`CircuitOpenError`) — this gateway falls over on a *classifier refusal*.
+ *
+ * @module GovernedModelGateway
+ * @version 1.0.0
+ * @license MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernedModelGateway = void 0;
+exports.isRefusal = isRefusal;
+// ============================================================================
+// HELPERS
+// ============================================================================
+/** Whether a response is a classifier refusal. Branch on this, not on content. */
+function isRefusal(response) {
+    return response.stopReason === 'refusal';
+}
+// ============================================================================
+// GATEWAY
+// ============================================================================
+/**
+ * Governs the full model-interaction lifecycle: refusal detection, cross-model
+ * fallback, fallback-credit redemption, thinking-block handoff, and per-attempt
+ * cost accounting — behind one {@link GovernedModelGateway.send} call.
+ *
+ * @example
+ * ```typescript
+ * const gateway = new GovernedModelGateway({
+ *   caller,                       // provider binding (e.g. Anthropic adapter)
+ *   primaryModel: 'claude-fable-5',
+ *   fallbackModels: ['claude-opus-4-8'],
+ *   budget, audit, telemetry, thinking, effort,
+ * });
+ *
+ * const r = await gateway.send({ messages: [{ role: 'user', content: 'hi' }] });
+ * console.log(r.servedModel, r.servedByFallback, r.totalCostUsd);
+ * ```
+ */
+class GovernedModelGateway {
+    caller;
+    primaryModel;
+    fallbackModels;
+    defaultEffort;
+    maxFallbacks;
+    allowedFallbacks;
+    budget;
+    audit;
+    telemetry;
+    thinking;
+    effortPolicy;
+    constructor(config) {
+        if (typeof config.caller !== 'function') {
+            throw new TypeError('GovernedModelGateway: caller must be a function');
+        }
+        if (!config.primaryModel || typeof config.primaryModel !== 'string') {
+            throw new TypeError('GovernedModelGateway: primaryModel must be a non-empty string');
+        }
+        this.caller = config.caller;
+        this.primaryModel = config.primaryModel;
+        this.fallbackModels = (config.fallbackModels ?? []).filter((m) => m && m !== config.primaryModel);
+        this.defaultEffort = config.defaultEffort;
+        this.maxFallbacks = config.maxFallbacks ?? this.fallbackModels.length;
+        this.allowedFallbacks = config.allowedFallbacks;
+        this.budget = config.budget;
+        this.audit = config.audit;
+        this.telemetry = config.telemetry;
+        this.thinking = config.thinking;
+        this.effortPolicy = config.effort;
+    }
+    /**
+     * Send a request through the governed lifecycle.
+     *
+     * Tries the primary model, then walks the fallback chain on each refusal,
+     * redeeming fallback credit and stripping cross-model thinking blocks as it
+     * goes. Returns once a model serves the turn or the chain is exhausted.
+     *
+     * @param request  The request. The gateway selects the model(s).
+     * @returns        A {@link GovernedModelResult} describing every attempt.
+     */
+    async send(request) {
+        if (!request || !Array.isArray(request.messages)) {
+            throw new TypeError('GovernedModelGateway.send: request.messages must be an array');
+        }
+        const agentId = request.agentId;
+        const effort = this.resolveEffort(request.effort, agentId);
+        const chain = this.buildChain();
+        const attempts = [];
+        const categories = [];
+        let totalCostUsd;
+        let lastResponse;
+        let creditToken;
+        for (let i = 0; i < chain.length; i++) {
+            const model = chain[i];
+            const isFallback = i > 0;
+            const redeeming = Boolean(creditToken);
+            // When redeeming a credit the body must match the refused request exactly,
+            // so thinking blocks stay. Otherwise, strip them on a model switch.
+            const messages = isFallback && !redeeming && this.thinking
+                ? this.thinking.stripForModelSwitch(request.messages)
+                : request.messages;
+            const req = {
+                model,
+                messages,
+                system: request.system,
+                maxTokens: request.maxTokens,
+                tools: request.tools,
+                effort,
+                fallbackCreditToken: creditToken,
+                metadata: request.metadata,
+            };
+            const response = await this.caller(req);
+            lastResponse = response;
+            const refusal = isRefusal(response);
+            const category = refusal ? response.refusal?.category ?? null : null;
+            // Cost accounting (per attempt — never sum tokens across models).
+            let costUsd;
+            let budgetAllowed = true;
+            if (this.budget) {
+                const rec = this.budget.recordAttempt(response.model, response.usage, {
+                    creditRedeemed: redeeming,
+                    agentId,
+                });
+                costUsd = rec.costUsd;
+                budgetAllowed = rec.allowed;
+                totalCostUsd = (totalCostUsd ?? 0) + rec.costUsd;
+            }
+            attempts.push({
+                model: response.model,
+                stopReason: response.stopReason,
+                refusalCategory: category,
+                usage: response.usage,
+                costUsd,
+                servedByFallback: isFallback,
+                creditRedeemed: redeeming,
+            });
+            await this.auditAttempt(agentId, response, isFallback, redeeming, costUsd);
+            if (!refusal) {
+                // A model served the turn.
+                if (isFallback) {
+                    this.telemetry?.recordFallbackServed({
+                        requestedModel: this.primaryModel,
+                        servedModel: response.model,
+                        agentId,
+                    });
+                }
+                return {
+                    response,
+                    servedModel: response.model,
+                    refused: false,
+                    servedByFallback: isFallback,
+                    attempts,
+                    refusalCategories: categories,
+                    totalCostUsd,
+                };
+            }
+            // Refusal: record the signal (refusal !== error), capture credit, continue.
+            categories.push(category);
+            this.telemetry?.recordRefusal({ model: response.model, category, agentId });
+            creditToken = response.refusal?.fallbackCreditToken ?? undefined;
+            if (!budgetAllowed)
+                break; // budget exhausted — stop trying fallbacks
+        }
+        // Every model in the chain refused (or the budget stopped us).
+        const finalResponse = lastResponse ?? {
+            model: this.primaryModel,
+            content: [],
+            stopReason: 'refusal',
+            usage: { inputTokens: 0, outputTokens: 0 },
+        };
+        return {
+            response: finalResponse,
+            servedModel: finalResponse.model,
+            refused: true,
+            servedByFallback: false,
+            attempts,
+            refusalCategories: categories,
+            totalCostUsd,
+        };
+    }
+    /** The ordered model chain: primary followed by permitted fallbacks. */
+    buildChain() {
+        let fallbacks = this.fallbackModels;
+        if (this.allowedFallbacks) {
+            const permitted = this.allowedFallbacks[this.primaryModel];
+            if (permitted) {
+                fallbacks = fallbacks.filter((m) => permitted.includes(m));
+            }
+        }
+        return [this.primaryModel, ...fallbacks.slice(0, Math.max(0, this.maxFallbacks))];
+    }
+    resolveEffort(requested, agentId) {
+        if (this.effortPolicy) {
+            return this.effortPolicy.resolve(requested ?? this.defaultEffort, { agentId });
+        }
+        return requested ?? this.defaultEffort;
+    }
+    async auditAttempt(agentId, response, isFallback, creditRedeemed, costUsd) {
+        if (!this.audit)
+            return;
+        const refusal = isRefusal(response);
+        try {
+            await this.audit.log({
+                event: refusal ? 'model.refusal' : 'model.attempt',
+                agentId: agentId ?? null,
+                model: response.model,
+                stopReason: response.stopReason,
+                refusalCategory: refusal ? response.refusal?.category ?? null : null,
+                refusalExplanation: refusal ? response.refusal?.explanation ?? null : undefined,
+                servedByFallback: isFallback,
+                creditRedeemed,
+                costUsd: costUsd ?? null,
+                usage: response.usage,
+                ts: new Date().toISOString(),
+            });
+        }
+        catch {
+            // Audit is best-effort — never break the model lifecycle for logging.
+        }
+    }
+}
+exports.GovernedModelGateway = GovernedModelGateway;
+//# sourceMappingURL=model-gateway.js.map

package/dist/esm/lib/model-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-gateway.js","sourceRoot":"","sources":["../../../lib/model-gateway.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAuMH,8BAEC;AAPD,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,kFAAkF;AAClF,SAAgB,SAAS,CAAC,QAAuB;IAC/C,OAAO,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,oBAAoB;IACd,MAAM,CAAc;IACpB,YAAY,CAAS;IACrB,cAAc,CAAW;IACzB,aAAa,CAA0B;IACvC,YAAY,CAAS;IACrB,gBAAgB,CAAuC;IACvD,MAAM,CAAyB;IAC/B,KAAK,CAAwB;IAC7B,SAAS,CAAmC;IAC5C,QAAQ,CAA2B;IACnC,YAAY,CAAyB;IAEtD,YAAY,MAAkC;QAC5C,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpE,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC;QAClG,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QACtE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAC,OAA4B;QACrC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsB,EAAE,CAAC;QACzC,IAAI,YAAgC,CAAC;QACrC,IAAI,YAAuC,CAAC;QAC5C,IAAI,WAA+B,CAAC;QAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YAEvC,2EAA2E;YAC3E,oEAAoE;YACpE,MAAM,QAAQ,GACZ,UAAU,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ;gBACvC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACrD,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAEvB,MAAM,GAAG,GAAiB;gBACxB,KAAK;gBACL,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM;gBACN,mBAAmB,EAAE,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxC,YAAY,GAAG,QAAQ,CAAC;YAExB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAoB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAEtF,kEAAkE;YAClE,IAAI,OAA2B,CAAC;YAChC,IAAI,aAAa,GAAG,IAAI,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;oBACpE,cAAc,EAAE,SAAS;oBACzB,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;gBACtB,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC5B,YAAY,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;YACnD,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,eAAe,EAAE,QAAQ;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO;gBACP,gBAAgB,EAAE,UAAU;gBAC5B,cAAc,EAAE,SAAS;aAC1B,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,2BAA2B;gBAC3B,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC;wBACnC,cAAc,EAAE,IAAI,CAAC,YAAY;wBACjC,WAAW,EAAE,QAAQ,CAAC,KAAK;wBAC3B,OAAO;qBACR,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,WAAW,EAAE,QAAQ,CAAC,KAAK;oBAC3B,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,UAAU;oBAC5B,QAAQ;oBACR,iBAAiB,EAAE,UAAU;oBAC7B,YAAY;iBACb,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,mBAAmB,IAAI,SAAS,CAAC;YAEjE,IAAI,CAAC,aAAa;gBAAE,MAAM,CAAC,2CAA2C;QACxE,CAAC;QAED,+DAA+D;QAC/D,MAAM,aAAa,GAAkB,YAAY,IAAI;YACnD,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;SAC3C,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,WAAW,EAAE,aAAa,CAAC,KAAK;YAChC,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,KAAK;YACvB,QAAQ;YACR,iBAAiB,EAAE,UAAU;YAC7B,YAAY;SACb,CAAC;IACJ,CAAC;IAED,wEAAwE;IAChE,UAAU;QAChB,IAAI,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC;QACpC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAEO,aAAa,CAAC,SAAkC,EAAE,OAAgB;QACxE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAA2B,EAC3B,QAAuB,EACvB,UAAmB,EACnB,cAAuB,EACvB,OAA2B;QAE3B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;gBAClD,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;gBACpE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC/E,gBAAgB,EAAE,UAAU;gBAC5B,cAAc;gBACd,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;CACF;AA7MD,oDA6MC"}

package/dist/esm/lib/owasp-compliance.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * OWASP Agentic AI Top 10 (2026) — coverage matrix and verifier.
+ *
+ * Maps each OWASP Agentic risk category to the deterministic Network-AI control
+ * that addresses it, and provides an `agt verify`-style coverage report. Unlike
+ * the Python-skill MAESTRO/ASI table in `SKILL.md` (which scopes the bundled
+ * scripts), this matrix covers the **TypeScript orchestration engine**.
+ *
+ * The controls referenced here are existing engine features — not aspirational
+ * roadmap items. This module is a single source of truth for the README/SKILL
+ * compliance section and for programmatic verification in CI.
+ *
+ * @module OwaspCompliance
+ * @version 1.0.0
+ * @license MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OWASP_AGENTIC_TOP10_2026 = void 0;
+exports.verifyOwaspCoverage = verifyOwaspCoverage;
+exports.formatOwaspReport = formatOwaspReport;
+/**
+ * The OWASP Agentic AI Top 10 (2026) mapped to Network-AI engine controls.
+ */
+exports.OWASP_AGENTIC_TOP10_2026 = Object.freeze([
+    {
+        id: 'ASI-01',
+        risk: 'Agent Goal Hijack',
+        status: 'covered',
+        controls: [
+            'AuthGuardian weighted permission gating before sensitive resource access (index.ts)',
+            'JourneyFSM behavioral control plane with ToolAuthorizationMatrix (lib/fsm-journey.ts)',
+            'Scope guard responds directly for simple requests instead of decomposing',
+        ],
+    },
+    {
+        id: 'ASI-02',
+        risk: 'Tool Misuse & Exploitation',
+        status: 'covered',
+        controls: [
+            'AgentRuntime SandboxPolicy: command allow-list, shell:false argv execution (lib/agent-runtime.ts)',
+            'ApprovalGate for approval-required operations',
+            'AdapterHookManager beforeExecute matcher-based gating (lib/adapter-hooks.ts)',
+        ],
+    },
+    {
+        id: 'ASI-03',
+        risk: 'Identity & Privilege Abuse',
+        status: 'covered',
+        controls: [
+            'SecureTokenManager HMAC-SHA256 / Ed25519 signed tokens with TTL (security.ts)',
+            'AuthGuardian trust scoring (trust 30%) keyed to data/trust_levels.json',
+            'Grant tokens are advisory-only; platform auth required for destructive actions',
+        ],
+    },
+    {
+        id: 'ASI-04',
+        risk: 'Supply Chain Risks',
+        status: 'covered',
+        controls: [
+            'Single runtime dependency (commander); BYOC adapters add none',
+            'socket.json capability declarations + scripts/socket-check.js pre-publish gate',
+            'scripts/clawhub-check.js bundle hygiene + scripts/codeql-check.js alert gate',
+        ],
+    },
+    {
+        id: 'ASI-05',
+        risk: 'Unsafe Code Execution',
+        status: 'covered',
+        controls: [
+            'AgentRuntime ShellExecutor: tokenized argv, shell-metacharacter rejection, no /bin/sh -c (lib/agent-runtime.ts)',
+            'SourceProtectionError + FileAccessor path-traversal protection',
+            'Per-adapter CircuitBreaker bounds blast radius (lib/circuit-breaker.ts)',
+        ],
+    },
+    {
+        id: 'ASI-06',
+        risk: 'Memory & Context Poisoning',
+        status: 'covered',
+        controls: [
+            'LockedBlackboard atomic propose → validate → commit with file-system mutex (lib/locked-blackboard.ts)',
+            'Blackboard validator injection-pattern detection on untrusted content',
+            'ComplianceMonitor real-time behavior surveillance (lib/compliance-monitor.ts)',
+        ],
+    },
+    {
+        id: 'ASI-07',
+        risk: 'Insecure Inter-Agent Communication',
+        status: 'partial',
+        controls: [
+            'LockedBlackboard file-system mutex for local coordination origin',
+            'Signed grant tokens (security.ts) authenticate cross-agent handoffs',
+            'Documented boundary: run in a trusted workspace; restrict data/ permissions',
+        ],
+    },
+    {
+        id: 'ASI-08',
+        risk: 'Cascading Failures',
+        status: 'covered',
+        controls: [
+            'CircuitBreaker CLOSED/OPEN/HALF_OPEN per adapter with fallbackChain (lib/circuit-breaker.ts)',
+            'FederatedBudget + ModelBudget ceilings bound runaway spend (lib/federated-budget.ts, lib/model-budget.ts)',
+            'GovernedModelGateway + RetryBudget contain refusal-driven retry storms (lib/model-gateway.ts, lib/retry-budget.ts)',
+        ],
+    },
+    {
+        id: 'ASI-09',
+        risk: 'Human-Agent Trust Exploitation',
+        status: 'covered',
+        controls: [
+            'ApprovalGate requires human acknowledgment for high-risk actions (lib/agent-runtime.ts)',
+            'AuthGuardian justification scoring (justification 40%) on every grant',
+            'SecureAuditLogger tamper-evident trail of grants and state transitions (security.ts)',
+        ],
+    },
+    {
+        id: 'ASI-10',
+        risk: 'Rogue Agents',
+        status: 'covered',
+        controls: [
+            'ComplianceMonitor surveillance flags out-of-policy behavior (lib/compliance-monitor.ts)',
+            'CircuitBreaker isolation + budget ceilings act as a kill switch',
+            'Every write and state transition logged to data/audit_log.jsonl (security.ts)',
+        ],
+    },
+]);
+/**
+ * Build a coverage report from a control matrix.
+ *
+ * @param controls  The matrix to verify (defaults to {@link OWASP_AGENTIC_TOP10_2026}).
+ * @returns         Counts plus `allAddressed` (no `not-applicable`-excluded gaps).
+ */
+function verifyOwaspCoverage(controls = exports.OWASP_AGENTIC_TOP10_2026) {
+    let covered = 0;
+    let partial = 0;
+    let notApplicable = 0;
+    for (const c of controls) {
+        if (c.status === 'covered')
+            covered++;
+        else if (c.status === 'partial')
+            partial++;
+        else
+            notApplicable++;
+    }
+    const applicable = controls.filter((c) => c.status !== 'not-applicable');
+    const allAddressed = applicable.every((c) => c.status === 'covered' || c.status === 'partial');
+    return { total: controls.length, covered, partial, notApplicable, controls: [...controls], allAddressed };
+}
+/**
+ * Render a coverage report as an `agt verify`-style text block.
+ *
+ * @param report  A report from {@link verifyOwaspCoverage}.
+ */
+function formatOwaspReport(report) {
+    const lines = [];
+    lines.push('Network-AI — OWASP Agentic AI Top 10 (2026) Coverage');
+    lines.push('─'.repeat(56));
+    for (const c of report.controls) {
+        const mark = c.status === 'covered' ? '✅' : c.status === 'partial' ? '🟡' : '⚪';
+        lines.push(`  ${c.id}  ${mark} ${c.risk}`);
+    }
+    lines.push('─'.repeat(56));
+    lines.push(`  ${report.covered}/${report.total} covered, ${report.partial} partial`);
+    lines.push(`  ${report.allAddressed ? 'PASS — all risks addressed' : 'FAIL — gaps present'}`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=owasp-compliance.js.map

package/dist/esm/lib/owasp-compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp-compliance.js","sourceRoot":"","sources":["../../../lib/owasp-compliance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA4IH,kDAcC;AAOD,8CAYC;AAjJD;;GAEG;AACU,QAAA,wBAAwB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC7E;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,qFAAqF;YACrF,uFAAuF;YACvF,0EAA0E;SAC3E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,mGAAmG;YACnG,+CAA+C;YAC/C,8EAA8E;SAC/E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,+EAA+E;YAC/E,wEAAwE;YACxE,gFAAgF;SACjF;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gFAAgF;YAChF,8EAA8E;SAC/E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,iHAAiH;YACjH,gEAAgE;YAChE,yEAAyE;SAC1E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,uGAAuG;YACvG,uEAAuE;YACvE,+EAA+E;SAChF;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,kEAAkE;YAClE,qEAAqE;YACrE,6EAA6E;SAC9E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,8FAA8F;YAC9F,2GAA2G;YAC3G,oHAAoH;SACrH;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,yFAAyF;YACzF,uEAAuE;YACvE,sFAAsF;SACvF;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,yFAAyF;YACzF,iEAAiE;YACjE,+EAA+E;SAChF;KACF;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,WAAoC,gCAAwB;IAE5D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;aACjC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;;YACtC,aAAa,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/esm/lib/retry-budget.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * RetryBudget — per-request retry accounting.
+ *
+ * Frontier models can refuse independently on the same turn (an orchestrator
+ * agent and each of its sub-agents), so retries must be budgeted **per request,
+ * not per session**. `RetryBudget` enforces a maximum number of retries for
+ * each distinct key (a request id, task id, or sub-agent id) and never shares
+ * the allowance across keys — one runaway request cannot starve the others.
+ *
+ * @module RetryBudget
+ * @version 1.0.0
+ * @license MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RetryBudget = void 0;
+/**
+ * Per-key retry allowance.
+ *
+ * @example
+ * ```typescript
+ * const budget = new RetryBudget({ maxPerKey: 2 });
+ * while (budget.tryConsume(requestId)) {
+ *   const r = await attempt();
+ *   if (r.ok) break;
+ * }
+ * ```
+ */
+class RetryBudget {
+    max;
+    consumed = new Map();
+    constructor(options) {
+        if (typeof options.maxPerKey !== 'number' || options.maxPerKey < 0 || !Number.isInteger(options.maxPerKey)) {
+            throw new RangeError('RetryBudget: maxPerKey must be a non-negative integer');
+        }
+        this.max = options.maxPerKey;
+    }
+    /**
+     * Consume one retry for `key`. Returns `false` (without consuming) once the
+     * per-key budget is exhausted.
+     *
+     * @param key  Request/task/sub-agent identifier. Must be a non-empty string.
+     */
+    tryConsume(key) {
+        if (!key || typeof key !== 'string') {
+            throw new TypeError('RetryBudget.tryConsume: key must be a non-empty string');
+        }
+        const used = this.consumed.get(key) ?? 0;
+        if (used >= this.max)
+            return false;
+        this.consumed.set(key, used + 1);
+        return true;
+    }
+    /** Retries already consumed for `key`. */
+    used(key) {
+        return this.consumed.get(key) ?? 0;
+    }
+    /** Retries still available for `key`. */
+    remaining(key) {
+        return Math.max(0, this.max - (this.consumed.get(key) ?? 0));
+    }
+    /** The configured per-key maximum. */
+    getMax() {
+        return this.max;
+    }
+    /** Reset one key, or all keys when `key` is omitted. */
+    reset(key) {
+        if (key === undefined)
+            this.consumed.clear();
+        else
+            this.consumed.delete(key);
+    }
+}
+exports.RetryBudget = RetryBudget;
+//# sourceMappingURL=retry-budget.js.map

package/dist/esm/lib/retry-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-budget.js","sourceRoot":"","sources":["../../../lib/retry-budget.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAQH;;;;;;;;;;;GAWG;AACH,MAAa,WAAW;IACL,GAAG,CAAS;IACZ,QAAQ,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE3D,YAAY,OAA2B;QACrC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,yCAAyC;IACzC,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,sCAAsC;IACtC,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,GAAY;QAChB,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;;YACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;CACF;AA/CD,kCA+CC"}

package/dist/esm/lib/telemetry-provider.js

@@ -48,7 +48,7 @@
  * ```
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CapturingTelemetryProvider = exports.NullTelemetryProvider = void 0;
+exports.RefusalTelemetry = exports.FALLBACK_SERVED_EVENT = exports.REFUSAL_EVENT = exports.CapturingTelemetryProvider = exports.NullTelemetryProvider = void 0;
 exports.createOtelHooks = createOtelHooks;
 // ============================================================================
 // NULL PROVIDER (default — zero overhead when no telemetry is configured)
@@ -204,4 +204,112 @@ function createOtelHooks(provider) {
         },
     ];
 }
+// ============================================================================
+// REFUSAL OBSERVABILITY
+// ============================================================================
+/** Span/event name emitted for a classifier refusal. */
+exports.REFUSAL_EVENT = 'model.refusal';
+/** Span/event name emitted when a fallback model serves a turn. */
+exports.FALLBACK_SERVED_EVENT = 'model.fallback_served';
+/**
+ * Refusal/fallback observability.
+ *
+ * A classifier refusal is a successful **HTTP 200**, so monitoring built on
+ * error rates or 5xx responses never sees it. `RefusalTelemetry` records each
+ * refusal and each fallback-served response as discrete **non-error** signals,
+ * keeps counters, and exposes the gap between them (`unservedRefusalCount`) so
+ * you can alert when refusals are not being served by a fallback.
+ *
+ * It satisfies the `RefusalTelemetrySink` contract consumed by
+ * {@link ../lib/model-gateway!GovernedModelGateway}. Pass an
+ * {@link ITelemetryProvider} to also emit spans to your tracing backend.
+ *
+ * @example
+ * ```typescript
+ * const refusals = new RefusalTelemetry(new CapturingTelemetryProvider());
+ * const gateway = new GovernedModelGateway({ caller, primaryModel, fallbackModels, telemetry: refusals });
+ * // ...later
+ * if (refusals.unservedRefusalCount > 0) alert('refusals are reaching users');
+ * ```
+ */
+class RefusalTelemetry {
+    provider;
+    _refusals = 0;
+    _fallbackServed = 0;
+    _byCategory = new Map();
+    _byModel = new Map();
+    constructor(provider) {
+        this.provider = provider;
+    }
+    /** Record a classifier refusal (counted as a signal, never as an error). */
+    recordRefusal(info) {
+        this._refusals++;
+        const cat = info.category ?? 'unspecified';
+        this._byCategory.set(cat, (this._byCategory.get(cat) ?? 0) + 1);
+        this._byModel.set(info.model, (this._byModel.get(info.model) ?? 0) + 1);
+        this.emit(exports.REFUSAL_EVENT, { model: info.model, category: cat, agentId: info.agentId ?? '' });
+    }
+    /** Record that a fallback model served a turn the primary declined. */
+    recordFallbackServed(info) {
+        this._fallbackServed++;
+        this.emit(exports.FALLBACK_SERVED_EVENT, {
+            requestedModel: info.requestedModel,
+            servedModel: info.servedModel,
+            agentId: info.agentId ?? '',
+        });
+    }
+    /** Total refusals observed. */
+    get refusalCount() {
+        return this._refusals;
+    }
+    /** Total fallback-served responses observed. */
+    get fallbackServedCount() {
+        return this._fallbackServed;
+    }
+    /** Refusals that were never served by a fallback (the gap to alert on). */
+    get unservedRefusalCount() {
+        return Math.max(0, this._refusals - this._fallbackServed);
+    }
+    /** Refusal counts keyed by classifier category. */
+    byCategory() {
+        const out = {};
+        for (const [k, v] of this._byCategory)
+            out[k] = v;
+        return out;
+    }
+    /** A full counter snapshot. */
+    snapshot() {
+        const byModel = {};
+        for (const [k, v] of this._byModel)
+            byModel[k] = v;
+        return {
+            refusals: this._refusals,
+            fallbackServed: this._fallbackServed,
+            unservedRefusals: this.unservedRefusalCount,
+            byCategory: this.byCategory(),
+            byModel,
+        };
+    }
+    /** Reset all counters. */
+    reset() {
+        this._refusals = 0;
+        this._fallbackServed = 0;
+        this._byCategory.clear();
+        this._byModel.clear();
+    }
+    /** Emit a discrete non-error span for a refusal/fallback signal. @internal */
+    emit(name, attributes) {
+        if (!this.provider)
+            return;
+        try {
+            const id = this.provider.startSpan(name, attributes);
+            // A refusal is a successful HTTP 200 — close the span 'ok', never 'error'.
+            this.provider.endSpan(id, 'ok', attributes);
+        }
+        catch {
+            // Telemetry must never throw.
+        }
+    }
+}
+exports.RefusalTelemetry = RefusalTelemetry;
 //# sourceMappingURL=telemetry-provider.js.map

package/dist/esm/lib/telemetry-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry-provider.js","sourceRoot":"","sources":["../../../lib/telemetry-provider.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;;;AAsKH,0CAyDC;AA5JD,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAE/E;;;;GAIG;AACH,MAAa,qBAAqB;IAChC,kBAAkB;IAClB,SAAS,CAAC,KAAa,EAAE,WAA4B,IAAY,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7E,kBAAkB;IAClB,OAAO,CAAC,OAAe,EAAE,OAAuB,EAAE,WAA4B,IAAS,CAAC;IACxF,kBAAkB;IAClB,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,WAA4B,IAAS,CAAC;CACnF;AAPD,sDAOC;AAED,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAa,0BAA0B;IACrC,8DAA8D;IACrD,KAAK,GAAmB,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC;IAEpB,kBAAkB;IAClB,SAAS,CAAC,IAAY,EAAE,aAA6B,EAAE;QACrD,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB;IAClB,OAAO,CAAC,MAAc,EAAE,MAAsB,EAAE,aAA6B,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,kBAAkB;IAClB,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,aAA6B,EAAE;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,sDAAsD;IACtD,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACnB,CAAC;CACF;AAjCD,gEAiCC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,eAAe,CAAC,QAA4B;IAC1D,OAAO;QACL;YACE,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,GAAG;YACb,OAAO,CAAC,GAAgB;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE;wBACnD,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,MAAM,EAAG,GAAG,CAAC,OAA+B,CAAC,MAAM,IAAI,EAAE;wBACzD,KAAK,EAAE,GAAG,CAAC,KAAK;qBACjB,CAAC,CAAC;oBACH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,GAAG;YACb,OAAO,CAAC,GAAgB;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAuB,CAAC;oBACpE,IAAI,MAAM,EAAE,CAAC;wBACX,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;4BAC7B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;yBACtC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;SACF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,GAAG;YACb,OAAO,CAAC,GAAgB;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAuB,CAAC;oBACpE,IAAI,MAAM,EAAE,CAAC;wBACX,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;4BAChC,YAAY,EAAG,GAAG,CAAC,KAA2B,EAAE,OAAO,IAAI,SAAS;yBACrE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"telemetry-provider.js","sourceRoot":"","sources":["../../../lib/telemetry-provider.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;;;AAsKH,0CAyDC;AA5JD,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAE/E;;;;GAIG;AACH,MAAa,qBAAqB;IAChC,kBAAkB;IAClB,SAAS,CAAC,KAAa,EAAE,WAA4B,IAAY,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7E,kBAAkB;IAClB,OAAO,CAAC,OAAe,EAAE,OAAuB,EAAE,WAA4B,IAAS,CAAC;IACxF,kBAAkB;IAClB,WAAW,CAAC,OAAe,EAAE,KAAa,EAAE,WAA4B,IAAS,CAAC;CACnF;AAPD,sDAOC;AAED,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E;;;;;;;;;;;;;GAaG;AACH,MAAa,0BAA0B;IACrC,8DAA8D;IACrD,KAAK,GAAmB,EAAE,CAAC;IAC5B,OAAO,GAAG,CAAC,CAAC;IAEpB,kBAAkB;IAClB,SAAS,CAAC,IAAY,EAAE,aAA6B,EAAE;QACrD,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB;IAClB,OAAO,CAAC,MAAc,EAAE,MAAsB,EAAE,aAA6B,EAAE;QAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,kBAAkB;IAClB,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,aAA6B,EAAE;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,sDAAsD;IACtD,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACnB,CAAC;CACF;AAjCD,gEAiCC;AAED,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,eAAe,CAAC,QAA4B;IAC1D,OAAO;QACL;YACE,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,eAAe;YACtB,QAAQ,EAAE,GAAG;YACb,OAAO,CAAC,GAAgB;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,iBAAiB,EAAE;wBACnD,OAAO,EAAE,GAAG,CAAC,OAAO;wBACpB,MAAM,EAAG,GAAG,CAAC,OAA+B,CAAC,MAAM,IAAI,EAAE;wBACzD,KAAK,EAAE,GAAG,CAAC,KAAK;qBACjB,CAAC,CAAC;oBACH,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;SACF;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,GAAG;YACb,OAAO,CAAC,GAAgB;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAuB,CAAC;oBACpE,IAAI,MAAM,EAAE,CAAC;wBACX,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE;4BAC7B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI;yBACtC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;SACF;QACD;YACE,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,GAAG;YACb,OAAO,CAAC,GAAgB;gBACtB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAuB,CAAC;oBACpE,IAAI,MAAM,EAAE,CAAC;wBACX,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;4BAChC,YAAY,EAAG,GAAG,CAAC,KAA2B,EAAE,OAAO,IAAI,SAAS;yBACrE,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ;gBACV,CAAC;gBACD,OAAO,GAAG,CAAC;YACb,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,wDAAwD;AAC3C,QAAA,aAAa,GAAG,eAAe,CAAC;AAC7C,mEAAmE;AACtD,QAAA,qBAAqB,GAAG,uBAAuB,CAAC;AA0B7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,gBAAgB;IACV,QAAQ,CAAiC;IAClD,SAAS,GAAG,CAAC,CAAC;IACd,eAAe,GAAG,CAAC,CAAC;IACX,WAAW,GAAwB,IAAI,GAAG,EAAE,CAAC;IAC7C,QAAQ,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE3D,YAAY,QAA6B;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,4EAA4E;IAC5E,aAAa,CAAC,IAAsB;QAClC,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,qBAAa,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,uEAAuE;IACvE,oBAAoB,CAAC,IAAwB;QAC3C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,6BAAqB,EAAE;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,gDAAgD;IAChD,IAAI,mBAAmB;QACrB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAC3E,IAAI,oBAAoB;QACtB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,mDAAmD;IACnD,UAAU;QACR,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+BAA+B;IAC/B,QAAQ;QACN,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB;YAC3C,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;YAC7B,OAAO;SACR,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,KAAK;QACH,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,8EAA8E;IACtE,IAAI,CAAC,IAAY,EAAE,UAA0B;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACrD,2EAA2E;YAC3E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;CACF;AApFD,4CAoFC"}