network-ai 5.12.7 → 5.13.1

package/dist/lib/model-gateway.js

@@ -0,0 +1,243 @@
+"use strict";
+/**
+ * GovernedModelGateway — model-interaction lifecycle governance.
+ *
+ * Absorbs a frontier model's refusal → fallback → billing complexity and
+ * presents one governed, budgeted, audited interface. When the primary model
+ * declines a request with a classifier refusal (`stop_reason: "refusal"`), the
+ * gateway:
+ *
+ *   1. records the refusal (which classifier `category` fired) to the audit sink,
+ *   2. emits a refusal signal to telemetry (a refusal is an HTTP 200, *not* an
+ *      error — it is invisible to error-rate monitoring),
+ *   3. retries on the next model in the fallback chain, redeeming the one-time
+ *      fallback-credit token so the retry is repriced as a cache read,
+ *   4. strips model-specific thinking blocks when it switches models (unless a
+ *      credit is being redeemed, which requires an exact body match),
+ *   5. accounts each attempt's cost against the cross-model budget.
+ *
+ * This layer is **provider-agnostic**. It operates on a normalized
+ * {@link ModelCaller}; the concrete provider binding (e.g. the Anthropic
+ * Messages adapter) maps the native API to these shapes. Unlike
+ * `AdapterRegistry.fallbackChain` — which fails over on adapter *health*
+ * (`CircuitOpenError`) — this gateway falls over on a *classifier refusal*.
+ *
+ * @module GovernedModelGateway
+ * @version 1.0.0
+ * @license MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GovernedModelGateway = void 0;
+exports.isRefusal = isRefusal;
+// ============================================================================
+// HELPERS
+// ============================================================================
+/** Whether a response is a classifier refusal. Branch on this, not on content. */
+function isRefusal(response) {
+    return response.stopReason === 'refusal';
+}
+// ============================================================================
+// GATEWAY
+// ============================================================================
+/**
+ * Governs the full model-interaction lifecycle: refusal detection, cross-model
+ * fallback, fallback-credit redemption, thinking-block handoff, and per-attempt
+ * cost accounting — behind one {@link GovernedModelGateway.send} call.
+ *
+ * @example
+ * ```typescript
+ * const gateway = new GovernedModelGateway({
+ *   caller,                       // provider binding (e.g. Anthropic adapter)
+ *   primaryModel: 'claude-fable-5',
+ *   fallbackModels: ['claude-opus-4-8'],
+ *   budget, audit, telemetry, thinking, effort,
+ * });
+ *
+ * const r = await gateway.send({ messages: [{ role: 'user', content: 'hi' }] });
+ * console.log(r.servedModel, r.servedByFallback, r.totalCostUsd);
+ * ```
+ */
+class GovernedModelGateway {
+    caller;
+    primaryModel;
+    fallbackModels;
+    defaultEffort;
+    maxFallbacks;
+    allowedFallbacks;
+    budget;
+    audit;
+    telemetry;
+    thinking;
+    effortPolicy;
+    constructor(config) {
+        if (typeof config.caller !== 'function') {
+            throw new TypeError('GovernedModelGateway: caller must be a function');
+        }
+        if (!config.primaryModel || typeof config.primaryModel !== 'string') {
+            throw new TypeError('GovernedModelGateway: primaryModel must be a non-empty string');
+        }
+        this.caller = config.caller;
+        this.primaryModel = config.primaryModel;
+        this.fallbackModels = (config.fallbackModels ?? []).filter((m) => m && m !== config.primaryModel);
+        this.defaultEffort = config.defaultEffort;
+        this.maxFallbacks = config.maxFallbacks ?? this.fallbackModels.length;
+        this.allowedFallbacks = config.allowedFallbacks;
+        this.budget = config.budget;
+        this.audit = config.audit;
+        this.telemetry = config.telemetry;
+        this.thinking = config.thinking;
+        this.effortPolicy = config.effort;
+    }
+    /**
+     * Send a request through the governed lifecycle.
+     *
+     * Tries the primary model, then walks the fallback chain on each refusal,
+     * redeeming fallback credit and stripping cross-model thinking blocks as it
+     * goes. Returns once a model serves the turn or the chain is exhausted.
+     *
+     * @param request  The request. The gateway selects the model(s).
+     * @returns        A {@link GovernedModelResult} describing every attempt.
+     */
+    async send(request) {
+        if (!request || !Array.isArray(request.messages)) {
+            throw new TypeError('GovernedModelGateway.send: request.messages must be an array');
+        }
+        const agentId = request.agentId;
+        const effort = this.resolveEffort(request.effort, agentId);
+        const chain = this.buildChain();
+        const attempts = [];
+        const categories = [];
+        let totalCostUsd;
+        let lastResponse;
+        let creditToken;
+        for (let i = 0; i < chain.length; i++) {
+            const model = chain[i];
+            const isFallback = i > 0;
+            const redeeming = Boolean(creditToken);
+            // When redeeming a credit the body must match the refused request exactly,
+            // so thinking blocks stay. Otherwise, strip them on a model switch.
+            const messages = isFallback && !redeeming && this.thinking
+                ? this.thinking.stripForModelSwitch(request.messages)
+                : request.messages;
+            const req = {
+                model,
+                messages,
+                system: request.system,
+                maxTokens: request.maxTokens,
+                tools: request.tools,
+                effort,
+                fallbackCreditToken: creditToken,
+                metadata: request.metadata,
+            };
+            const response = await this.caller(req);
+            lastResponse = response;
+            const refusal = isRefusal(response);
+            const category = refusal ? response.refusal?.category ?? null : null;
+            // Cost accounting (per attempt — never sum tokens across models).
+            let costUsd;
+            let budgetAllowed = true;
+            if (this.budget) {
+                const rec = this.budget.recordAttempt(response.model, response.usage, {
+                    creditRedeemed: redeeming,
+                    agentId,
+                });
+                costUsd = rec.costUsd;
+                budgetAllowed = rec.allowed;
+                totalCostUsd = (totalCostUsd ?? 0) + rec.costUsd;
+            }
+            attempts.push({
+                model: response.model,
+                stopReason: response.stopReason,
+                refusalCategory: category,
+                usage: response.usage,
+                costUsd,
+                servedByFallback: isFallback,
+                creditRedeemed: redeeming,
+            });
+            await this.auditAttempt(agentId, response, isFallback, redeeming, costUsd);
+            if (!refusal) {
+                // A model served the turn.
+                if (isFallback) {
+                    this.telemetry?.recordFallbackServed({
+                        requestedModel: this.primaryModel,
+                        servedModel: response.model,
+                        agentId,
+                    });
+                }
+                return {
+                    response,
+                    servedModel: response.model,
+                    refused: false,
+                    servedByFallback: isFallback,
+                    attempts,
+                    refusalCategories: categories,
+                    totalCostUsd,
+                };
+            }
+            // Refusal: record the signal (refusal !== error), capture credit, continue.
+            categories.push(category);
+            this.telemetry?.recordRefusal({ model: response.model, category, agentId });
+            creditToken = response.refusal?.fallbackCreditToken ?? undefined;
+            if (!budgetAllowed)
+                break; // budget exhausted — stop trying fallbacks
+        }
+        // Every model in the chain refused (or the budget stopped us).
+        const finalResponse = lastResponse ?? {
+            model: this.primaryModel,
+            content: [],
+            stopReason: 'refusal',
+            usage: { inputTokens: 0, outputTokens: 0 },
+        };
+        return {
+            response: finalResponse,
+            servedModel: finalResponse.model,
+            refused: true,
+            servedByFallback: false,
+            attempts,
+            refusalCategories: categories,
+            totalCostUsd,
+        };
+    }
+    /** The ordered model chain: primary followed by permitted fallbacks. */
+    buildChain() {
+        let fallbacks = this.fallbackModels;
+        if (this.allowedFallbacks) {
+            const permitted = this.allowedFallbacks[this.primaryModel];
+            if (permitted) {
+                fallbacks = fallbacks.filter((m) => permitted.includes(m));
+            }
+        }
+        return [this.primaryModel, ...fallbacks.slice(0, Math.max(0, this.maxFallbacks))];
+    }
+    resolveEffort(requested, agentId) {
+        if (this.effortPolicy) {
+            return this.effortPolicy.resolve(requested ?? this.defaultEffort, { agentId });
+        }
+        return requested ?? this.defaultEffort;
+    }
+    async auditAttempt(agentId, response, isFallback, creditRedeemed, costUsd) {
+        if (!this.audit)
+            return;
+        const refusal = isRefusal(response);
+        try {
+            await this.audit.log({
+                event: refusal ? 'model.refusal' : 'model.attempt',
+                agentId: agentId ?? null,
+                model: response.model,
+                stopReason: response.stopReason,
+                refusalCategory: refusal ? response.refusal?.category ?? null : null,
+                refusalExplanation: refusal ? response.refusal?.explanation ?? null : undefined,
+                servedByFallback: isFallback,
+                creditRedeemed,
+                costUsd: costUsd ?? null,
+                usage: response.usage,
+                ts: new Date().toISOString(),
+            });
+        }
+        catch {
+            // Audit is best-effort — never break the model lifecycle for logging.
+        }
+    }
+}
+exports.GovernedModelGateway = GovernedModelGateway;
+//# sourceMappingURL=model-gateway.js.map

package/dist/lib/model-gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-gateway.js","sourceRoot":"","sources":["../../lib/model-gateway.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAuMH,8BAEC;AAPD,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,kFAAkF;AAClF,SAAgB,SAAS,CAAC,QAAuB;IAC/C,OAAO,QAAQ,CAAC,UAAU,KAAK,SAAS,CAAC;AAC3C,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,oBAAoB;IACd,MAAM,CAAc;IACpB,YAAY,CAAS;IACrB,cAAc,CAAW;IACzB,aAAa,CAA0B;IACvC,YAAY,CAAS;IACrB,gBAAgB,CAAuC;IACvD,MAAM,CAAyB;IAC/B,KAAK,CAAwB;IAC7B,SAAS,CAAmC;IAC5C,QAAQ,CAA2B;IACnC,YAAY,CAAyB;IAEtD,YAAY,MAAkC;QAC5C,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACpE,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;QACxC,IAAI,CAAC,cAAc,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC;QAClG,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QACtE,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI,CAAC,OAA4B;QACrC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,MAAM,UAAU,GAAsB,EAAE,CAAC;QACzC,IAAI,YAAgC,CAAC;QACrC,IAAI,YAAuC,CAAC;QAC5C,IAAI,WAA+B,CAAC;QAEpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;YAEvC,2EAA2E;YAC3E,oEAAoE;YACpE,MAAM,QAAQ,GACZ,UAAU,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ;gBACvC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACrD,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAEvB,MAAM,GAAG,GAAiB;gBACxB,KAAK;gBACL,QAAQ;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM;gBACN,mBAAmB,EAAE,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxC,YAAY,GAAG,QAAQ,CAAC;YAExB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAoB,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAEtF,kEAAkE;YAClE,IAAI,OAA2B,CAAC;YAChC,IAAI,aAAa,GAAG,IAAI,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;oBACpE,cAAc,EAAE,SAAS;oBACzB,OAAO;iBACR,CAAC,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;gBACtB,aAAa,GAAG,GAAG,CAAC,OAAO,CAAC;gBAC5B,YAAY,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;YACnD,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,eAAe,EAAE,QAAQ;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO;gBACP,gBAAgB,EAAE,UAAU;gBAC5B,cAAc,EAAE,SAAS;aAC1B,CAAC,CAAC;YAEH,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;YAE3E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,2BAA2B;gBAC3B,IAAI,UAAU,EAAE,CAAC;oBACf,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC;wBACnC,cAAc,EAAE,IAAI,CAAC,YAAY;wBACjC,WAAW,EAAE,QAAQ,CAAC,KAAK;wBAC3B,OAAO;qBACR,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO;oBACL,QAAQ;oBACR,WAAW,EAAE,QAAQ,CAAC,KAAK;oBAC3B,OAAO,EAAE,KAAK;oBACd,gBAAgB,EAAE,UAAU;oBAC5B,QAAQ;oBACR,iBAAiB,EAAE,UAAU;oBAC7B,YAAY;iBACb,CAAC;YACJ,CAAC;YAED,4EAA4E;YAC5E,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1B,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,mBAAmB,IAAI,SAAS,CAAC;YAEjE,IAAI,CAAC,aAAa;gBAAE,MAAM,CAAC,2CAA2C;QACxE,CAAC;QAED,+DAA+D;QAC/D,MAAM,aAAa,GAAkB,YAAY,IAAI;YACnD,KAAK,EAAE,IAAI,CAAC,YAAY;YACxB,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE;SAC3C,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,aAAa;YACvB,WAAW,EAAE,aAAa,CAAC,KAAK;YAChC,OAAO,EAAE,IAAI;YACb,gBAAgB,EAAE,KAAK;YACvB,QAAQ;YACR,iBAAiB,EAAE,UAAU;YAC7B,YAAY;SACb,CAAC;IACJ,CAAC;IAED,wEAAwE;IAChE,UAAU;QAChB,IAAI,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC;QACpC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,SAAS,EAAE,CAAC;gBACd,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAEO,aAAa,CAAC,SAAkC,EAAE,OAAgB;QACxE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,SAAS,IAAI,IAAI,CAAC,aAAa,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,OAA2B,EAC3B,QAAuB,EACvB,UAAmB,EACnB,cAAuB,EACvB,OAA2B;QAE3B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;gBAClD,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;gBACpE,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS;gBAC/E,gBAAgB,EAAE,UAAU;gBAC5B,cAAc;gBACd,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAC7B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;CACF;AA7MD,oDA6MC"}

package/dist/lib/owasp-compliance.d.ts

@@ -0,0 +1,57 @@
+/**
+ * OWASP Agentic AI Top 10 (2026) — coverage matrix and verifier.
+ *
+ * Maps each OWASP Agentic risk category to the deterministic Network-AI control
+ * that addresses it, and provides an `agt verify`-style coverage report. Unlike
+ * the Python-skill MAESTRO/ASI table in `SKILL.md` (which scopes the bundled
+ * scripts), this matrix covers the **TypeScript orchestration engine**.
+ *
+ * The controls referenced here are existing engine features — not aspirational
+ * roadmap items. This module is a single source of truth for the README/SKILL
+ * compliance section and for programmatic verification in CI.
+ *
+ * @module OwaspCompliance
+ * @version 1.0.0
+ * @license MIT
+ */
+/** Coverage state for a single risk. */
+export type CoverageStatus = 'covered' | 'partial' | 'not-applicable';
+/** One OWASP Agentic risk and the controls that address it. */
+export interface OwaspControl {
+    /** Risk identifier, e.g. `ASI-01`. */
+    id: string;
+    /** Risk name. */
+    risk: string;
+    /** Coverage state. */
+    status: CoverageStatus;
+    /** Deterministic controls (with the modules that implement them). */
+    controls: string[];
+}
+/** Aggregate coverage report from {@link verifyOwaspCoverage}. */
+export interface OwaspCoverageReport {
+    total: number;
+    covered: number;
+    partial: number;
+    notApplicable: number;
+    controls: OwaspControl[];
+    /** `true` when every applicable risk is at least `partial` (no gaps). */
+    allAddressed: boolean;
+}
+/**
+ * The OWASP Agentic AI Top 10 (2026) mapped to Network-AI engine controls.
+ */
+export declare const OWASP_AGENTIC_TOP10_2026: readonly OwaspControl[];
+/**
+ * Build a coverage report from a control matrix.
+ *
+ * @param controls  The matrix to verify (defaults to {@link OWASP_AGENTIC_TOP10_2026}).
+ * @returns         Counts plus `allAddressed` (no `not-applicable`-excluded gaps).
+ */
+export declare function verifyOwaspCoverage(controls?: readonly OwaspControl[]): OwaspCoverageReport;
+/**
+ * Render a coverage report as an `agt verify`-style text block.
+ *
+ * @param report  A report from {@link verifyOwaspCoverage}.
+ */
+export declare function formatOwaspReport(report: OwaspCoverageReport): string;
+//# sourceMappingURL=owasp-compliance.d.ts.map

package/dist/lib/owasp-compliance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp-compliance.d.ts","sourceRoot":"","sources":["../../lib/owasp-compliance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wCAAwC;AACxC,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,gBAAgB,CAAC;AAEtE,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,MAAM,EAAE,cAAc,CAAC;IACvB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,kEAAkE;AAClE,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,yEAAyE;IACzE,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,YAAY,EAqG1D,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,GAAE,SAAS,YAAY,EAA6B,GAC3D,mBAAmB,CAYrB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAYrE"}

package/dist/lib/owasp-compliance.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * OWASP Agentic AI Top 10 (2026) — coverage matrix and verifier.
+ *
+ * Maps each OWASP Agentic risk category to the deterministic Network-AI control
+ * that addresses it, and provides an `agt verify`-style coverage report. Unlike
+ * the Python-skill MAESTRO/ASI table in `SKILL.md` (which scopes the bundled
+ * scripts), this matrix covers the **TypeScript orchestration engine**.
+ *
+ * The controls referenced here are existing engine features — not aspirational
+ * roadmap items. This module is a single source of truth for the README/SKILL
+ * compliance section and for programmatic verification in CI.
+ *
+ * @module OwaspCompliance
+ * @version 1.0.0
+ * @license MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OWASP_AGENTIC_TOP10_2026 = void 0;
+exports.verifyOwaspCoverage = verifyOwaspCoverage;
+exports.formatOwaspReport = formatOwaspReport;
+/**
+ * The OWASP Agentic AI Top 10 (2026) mapped to Network-AI engine controls.
+ */
+exports.OWASP_AGENTIC_TOP10_2026 = Object.freeze([
+    {
+        id: 'ASI-01',
+        risk: 'Agent Goal Hijack',
+        status: 'covered',
+        controls: [
+            'AuthGuardian weighted permission gating before sensitive resource access (index.ts)',
+            'JourneyFSM behavioral control plane with ToolAuthorizationMatrix (lib/fsm-journey.ts)',
+            'Scope guard responds directly for simple requests instead of decomposing',
+        ],
+    },
+    {
+        id: 'ASI-02',
+        risk: 'Tool Misuse & Exploitation',
+        status: 'covered',
+        controls: [
+            'AgentRuntime SandboxPolicy: command allow-list, shell:false argv execution (lib/agent-runtime.ts)',
+            'ApprovalGate for approval-required operations',
+            'AdapterHookManager beforeExecute matcher-based gating (lib/adapter-hooks.ts)',
+        ],
+    },
+    {
+        id: 'ASI-03',
+        risk: 'Identity & Privilege Abuse',
+        status: 'covered',
+        controls: [
+            'SecureTokenManager HMAC-SHA256 / Ed25519 signed tokens with TTL (security.ts)',
+            'AuthGuardian trust scoring (trust 30%) keyed to data/trust_levels.json',
+            'Grant tokens are advisory-only; platform auth required for destructive actions',
+        ],
+    },
+    {
+        id: 'ASI-04',
+        risk: 'Supply Chain Risks',
+        status: 'covered',
+        controls: [
+            'Single runtime dependency (commander); BYOC adapters add none',
+            'socket.json capability declarations + scripts/socket-check.js pre-publish gate',
+            'scripts/clawhub-check.js bundle hygiene + scripts/codeql-check.js alert gate',
+        ],
+    },
+    {
+        id: 'ASI-05',
+        risk: 'Unsafe Code Execution',
+        status: 'covered',
+        controls: [
+            'AgentRuntime ShellExecutor: tokenized argv, shell-metacharacter rejection, no /bin/sh -c (lib/agent-runtime.ts)',
+            'SourceProtectionError + FileAccessor path-traversal protection',
+            'Per-adapter CircuitBreaker bounds blast radius (lib/circuit-breaker.ts)',
+        ],
+    },
+    {
+        id: 'ASI-06',
+        risk: 'Memory & Context Poisoning',
+        status: 'covered',
+        controls: [
+            'LockedBlackboard atomic propose → validate → commit with file-system mutex (lib/locked-blackboard.ts)',
+            'Blackboard validator injection-pattern detection on untrusted content',
+            'ComplianceMonitor real-time behavior surveillance (lib/compliance-monitor.ts)',
+        ],
+    },
+    {
+        id: 'ASI-07',
+        risk: 'Insecure Inter-Agent Communication',
+        status: 'partial',
+        controls: [
+            'LockedBlackboard file-system mutex for local coordination origin',
+            'Signed grant tokens (security.ts) authenticate cross-agent handoffs',
+            'Documented boundary: run in a trusted workspace; restrict data/ permissions',
+        ],
+    },
+    {
+        id: 'ASI-08',
+        risk: 'Cascading Failures',
+        status: 'covered',
+        controls: [
+            'CircuitBreaker CLOSED/OPEN/HALF_OPEN per adapter with fallbackChain (lib/circuit-breaker.ts)',
+            'FederatedBudget + ModelBudget ceilings bound runaway spend (lib/federated-budget.ts, lib/model-budget.ts)',
+            'GovernedModelGateway + RetryBudget contain refusal-driven retry storms (lib/model-gateway.ts, lib/retry-budget.ts)',
+        ],
+    },
+    {
+        id: 'ASI-09',
+        risk: 'Human-Agent Trust Exploitation',
+        status: 'covered',
+        controls: [
+            'ApprovalGate requires human acknowledgment for high-risk actions (lib/agent-runtime.ts)',
+            'AuthGuardian justification scoring (justification 40%) on every grant',
+            'SecureAuditLogger tamper-evident trail of grants and state transitions (security.ts)',
+        ],
+    },
+    {
+        id: 'ASI-10',
+        risk: 'Rogue Agents',
+        status: 'covered',
+        controls: [
+            'ComplianceMonitor surveillance flags out-of-policy behavior (lib/compliance-monitor.ts)',
+            'CircuitBreaker isolation + budget ceilings act as a kill switch',
+            'Every write and state transition logged to data/audit_log.jsonl (security.ts)',
+        ],
+    },
+]);
+/**
+ * Build a coverage report from a control matrix.
+ *
+ * @param controls  The matrix to verify (defaults to {@link OWASP_AGENTIC_TOP10_2026}).
+ * @returns         Counts plus `allAddressed` (no `not-applicable`-excluded gaps).
+ */
+function verifyOwaspCoverage(controls = exports.OWASP_AGENTIC_TOP10_2026) {
+    let covered = 0;
+    let partial = 0;
+    let notApplicable = 0;
+    for (const c of controls) {
+        if (c.status === 'covered')
+            covered++;
+        else if (c.status === 'partial')
+            partial++;
+        else
+            notApplicable++;
+    }
+    const applicable = controls.filter((c) => c.status !== 'not-applicable');
+    const allAddressed = applicable.every((c) => c.status === 'covered' || c.status === 'partial');
+    return { total: controls.length, covered, partial, notApplicable, controls: [...controls], allAddressed };
+}
+/**
+ * Render a coverage report as an `agt verify`-style text block.
+ *
+ * @param report  A report from {@link verifyOwaspCoverage}.
+ */
+function formatOwaspReport(report) {
+    const lines = [];
+    lines.push('Network-AI — OWASP Agentic AI Top 10 (2026) Coverage');
+    lines.push('─'.repeat(56));
+    for (const c of report.controls) {
+        const mark = c.status === 'covered' ? '✅' : c.status === 'partial' ? '🟡' : '⚪';
+        lines.push(`  ${c.id}  ${mark} ${c.risk}`);
+    }
+    lines.push('─'.repeat(56));
+    lines.push(`  ${report.covered}/${report.total} covered, ${report.partial} partial`);
+    lines.push(`  ${report.allAddressed ? 'PASS — all risks addressed' : 'FAIL — gaps present'}`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=owasp-compliance.js.map

package/dist/lib/owasp-compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp-compliance.js","sourceRoot":"","sources":["../../lib/owasp-compliance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA4IH,kDAcC;AAOD,8CAYC;AAjJD;;GAEG;AACU,QAAA,wBAAwB,GAA4B,MAAM,CAAC,MAAM,CAAC;IAC7E;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,qFAAqF;YACrF,uFAAuF;YACvF,0EAA0E;SAC3E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,mGAAmG;YACnG,+CAA+C;YAC/C,8EAA8E;SAC/E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,+EAA+E;YAC/E,wEAAwE;YACxE,gFAAgF;SACjF;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,+DAA+D;YAC/D,gFAAgF;YAChF,8EAA8E;SAC/E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,iHAAiH;YACjH,gEAAgE;YAChE,yEAAyE;SAC1E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,uGAAuG;YACvG,uEAAuE;YACvE,+EAA+E;SAChF;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,kEAAkE;YAClE,qEAAqE;YACrE,6EAA6E;SAC9E;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,8FAA8F;YAC9F,2GAA2G;YAC3G,oHAAoH;SACrH;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,gCAAgC;QACtC,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,yFAAyF;YACzF,uEAAuE;YACvE,sFAAsF;SACvF;KACF;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,yFAAyF;YACzF,iEAAiE;YACjE,+EAA+E;SAChF;KACF;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAgB,mBAAmB,CACjC,WAAoC,gCAAwB;IAE5D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;aACjC,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;;YACtC,aAAa,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;IAC/F,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC;AAC5G,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,MAA2B;IAC3D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAChF,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,aAAa,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/retry-budget.d.ts

@@ -0,0 +1,51 @@
+/**
+ * RetryBudget — per-request retry accounting.
+ *
+ * Frontier models can refuse independently on the same turn (an orchestrator
+ * agent and each of its sub-agents), so retries must be budgeted **per request,
+ * not per session**. `RetryBudget` enforces a maximum number of retries for
+ * each distinct key (a request id, task id, or sub-agent id) and never shares
+ * the allowance across keys — one runaway request cannot starve the others.
+ *
+ * @module RetryBudget
+ * @version 1.0.0
+ * @license MIT
+ */
+/** Construction options for {@link RetryBudget}. */
+export interface RetryBudgetOptions {
+    /** Maximum retries allowed per key. Must be a non-negative integer. */
+    maxPerKey: number;
+}
+/**
+ * Per-key retry allowance.
+ *
+ * @example
+ * ```typescript
+ * const budget = new RetryBudget({ maxPerKey: 2 });
+ * while (budget.tryConsume(requestId)) {
+ *   const r = await attempt();
+ *   if (r.ok) break;
+ * }
+ * ```
+ */
+export declare class RetryBudget {
+    private readonly max;
+    private readonly consumed;
+    constructor(options: RetryBudgetOptions);
+    /**
+     * Consume one retry for `key`. Returns `false` (without consuming) once the
+     * per-key budget is exhausted.
+     *
+     * @param key  Request/task/sub-agent identifier. Must be a non-empty string.
+     */
+    tryConsume(key: string): boolean;
+    /** Retries already consumed for `key`. */
+    used(key: string): number;
+    /** Retries still available for `key`. */
+    remaining(key: string): number;
+    /** The configured per-key maximum. */
+    getMax(): number;
+    /** Reset one key, or all keys when `key` is omitted. */
+    reset(key?: string): void;
+}
+//# sourceMappingURL=retry-budget.d.ts.map

package/dist/lib/retry-budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-budget.d.ts","sourceRoot":"","sources":["../../lib/retry-budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,oDAAoD;AACpD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkC;gBAE/C,OAAO,EAAE,kBAAkB;IAOvC;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAUhC,0CAA0C;IAC1C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAIzB,yCAAyC;IACzC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAI9B,sCAAsC;IACtC,MAAM,IAAI,MAAM;IAIhB,wDAAwD;IACxD,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;CAI1B"}

package/dist/lib/retry-budget.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * RetryBudget — per-request retry accounting.
+ *
+ * Frontier models can refuse independently on the same turn (an orchestrator
+ * agent and each of its sub-agents), so retries must be budgeted **per request,
+ * not per session**. `RetryBudget` enforces a maximum number of retries for
+ * each distinct key (a request id, task id, or sub-agent id) and never shares
+ * the allowance across keys — one runaway request cannot starve the others.
+ *
+ * @module RetryBudget
+ * @version 1.0.0
+ * @license MIT
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RetryBudget = void 0;
+/**
+ * Per-key retry allowance.
+ *
+ * @example
+ * ```typescript
+ * const budget = new RetryBudget({ maxPerKey: 2 });
+ * while (budget.tryConsume(requestId)) {
+ *   const r = await attempt();
+ *   if (r.ok) break;
+ * }
+ * ```
+ */
+class RetryBudget {
+    max;
+    consumed = new Map();
+    constructor(options) {
+        if (typeof options.maxPerKey !== 'number' || options.maxPerKey < 0 || !Number.isInteger(options.maxPerKey)) {
+            throw new RangeError('RetryBudget: maxPerKey must be a non-negative integer');
+        }
+        this.max = options.maxPerKey;
+    }
+    /**
+     * Consume one retry for `key`. Returns `false` (without consuming) once the
+     * per-key budget is exhausted.
+     *
+     * @param key  Request/task/sub-agent identifier. Must be a non-empty string.
+     */
+    tryConsume(key) {
+        if (!key || typeof key !== 'string') {
+            throw new TypeError('RetryBudget.tryConsume: key must be a non-empty string');
+        }
+        const used = this.consumed.get(key) ?? 0;
+        if (used >= this.max)
+            return false;
+        this.consumed.set(key, used + 1);
+        return true;
+    }
+    /** Retries already consumed for `key`. */
+    used(key) {
+        return this.consumed.get(key) ?? 0;
+    }
+    /** Retries still available for `key`. */
+    remaining(key) {
+        return Math.max(0, this.max - (this.consumed.get(key) ?? 0));
+    }
+    /** The configured per-key maximum. */
+    getMax() {
+        return this.max;
+    }
+    /** Reset one key, or all keys when `key` is omitted. */
+    reset(key) {
+        if (key === undefined)
+            this.consumed.clear();
+        else
+            this.consumed.delete(key);
+    }
+}
+exports.RetryBudget = RetryBudget;
+//# sourceMappingURL=retry-budget.js.map

package/dist/lib/retry-budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-budget.js","sourceRoot":"","sources":["../../lib/retry-budget.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAQH;;;;;;;;;;;GAWG;AACH,MAAa,WAAW;IACL,GAAG,CAAS;IACZ,QAAQ,GAAwB,IAAI,GAAG,EAAE,CAAC;IAE3D,YAAY,OAA2B;QACrC,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3G,MAAM,IAAI,UAAU,CAAC,uDAAuD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IACH,UAAU,CAAC,GAAW;QACpB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC,GAAW;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,yCAAyC;IACzC,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,sCAAsC;IACtC,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,GAAY;QAChB,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;;YACxC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;CACF;AA/CD,kCA+CC"}