prefix-safe-json 0.0.1-alpha.2 → 0.0.1-alpha.4

package/README.md

@@ -2,13 +2,108 @@
 
 > ⚠️ **Alpha** — This project is under active development. APIs may change without notice. Do not use in production.
 
-Incremental LLM tool-call JSON parser and deterministic repair engine.
+**Don't execute incomplete AI tool calls.**
+
+`prefix-safe-json` is a fail-closed integrity layer for streamed LLM tool
+calls. It distinguishes complete, unfabricated arguments from truncated
+ones — including ones a syntax-level JSON repairer can make *look* complete
+— before they reach a tool with real side effects (writing a file, running a
+command, sending a request).
+
+```
+model output truncated
+        ↓
+    json repair
+        ↓
+    looks valid
+        ↓
+❌ dangerous execution
+```
+
+```
+   prefix-safe-json
+        ↓
+      truncated
+        ↓
+  executable: false
+        ↓
+        retry
+```
 
 ![Demo: a tool call truncated mid-argument is correctly reported non-executable, while the same call delivered in full is reported executable](examples/demo.gif)
 
 *(Real terminal output from [`examples/anthropic-truncation-safety.mjs`](examples/anthropic-truncation-safety.mjs) — not staged. Same script CI runs on every push.)*
 
-## Problem
+## From stream to safe execution, in about 10 lines
+
+```typescript
+import { createAiSdkExecutionGuard } from "prefix-safe-json";
+
+const guard = createAiSdkExecutionGuard({
+  schemas: {
+    write_file: {
+      type: "object",
+      properties: { path: { type: "string" }, content: { type: "string" } },
+      required: ["path", "content"],
+    },
+  },
+});
+
+for await (const part of result.fullStream) guard.push(part);
+
+for (const decision of guard.finish().decisions) {
+  if (decision.action === "execute") await tools[decision.name](decision.value);
+}
+```
+
+`createAiSdkExecutionGuard()` is a drop-in guard for the [Vercel AI
+SDK](https://ai-sdk.dev)'s `fullStream` — not a dependency of this library
+(no `ai` import, no runtime version lock; see
+[`examples/ai-sdk-guard.mjs`](examples/ai-sdk-guard.mjs)). It's a thin
+composition over the same lower-level adapter + gate API this library has
+always exposed — nothing about the decision logic changes based on which one
+you call.
+
+**What the decisions mean**
+
+Every tool call gets exactly one verdict:
+
+- **`execute`** — complete, unfabricated, and (if a schema is registered)
+  schema-valid. `decision.value` is safe to pass to your tool.
+- **`retry`** — nothing is wrong with what arrived; there just isn't a
+  trustworthy complete value yet. Continue generation.
+- **`reject`** — the data itself is the problem (malformed JSON, a schema
+  mismatch, a resource limit, a provider error, a content-policy
+  termination). Retrying the same input won't help.
+
+**Why the model's finish reason matters as much as the JSON's shape**
+
+A tool call cut short by a token limit, a provider error, or a content
+filter can still contain syntactically complete, schema-valid JSON — the
+model was simply stopped before finishing the *rest* of its response, not
+necessarily mid-argument. Executing on JSON shape alone means trusting data
+nobody, including the model, confirmed as final. This is exactly the failure
+mode independently reported and reproduced in
+[vercel/ai#19063](https://github.com/vercel/ai/issues/19063): tool calls
+executing regardless of an unsafe finish reason, across AI SDK v5, v6, and
+v7, with fixes landing across all three release lines (v7's in `ai@7.0.70`).
+`prefix-safe-json` does not patch or depend on that fix — it's a
+provider-independent guard that requires positive proof a stream ended
+safely before treating any tool call as final, regardless of which SDK,
+provider, or framework hands it the data. See
+`test/guard/ai-sdk-compatibility.test.ts` for the cross-version test
+evidence.
+
+**Supported providers**: OpenAI (legacy `function_call` and Responses API),
+Anthropic, Gemini, OpenRouter, generic OpenAI-compatible endpoints, and the
+Vercel AI SDK. High-level guards currently ship for the AI SDK; every
+provider has a public low-level adapter (see below) that composes with
+`createToolCallExecutionGate()` the same way.
+
+Full semantics, the decision table, provider finish-reason mapping, and the
+high-level guard API: [`docs/EXECUTION_GATE.md`](docs/EXECUTION_GATE.md).
+
+## The lower-level problem this is built on
 
 LLM providers (OpenAI, Anthropic, Gemini, OpenRouter) stream tool-call arguments as small JSON chunks. During streaming, the JSON is frequently incomplete: strings split mid-word, UTF-8 characters split mid-byte, containers left unclosed, numbers terminated at chunk boundaries.
 
@@ -98,6 +193,25 @@ draws exactly that distinction (`outcome: "truncated"`) and could gate
 execution on it without touching the syntax-repair behavior for the other
 case.
 
+## Scope: what this does and doesn't protect against
+
+This library is honestly scoped as **execution integrity** — complete,
+unfabricated, schema-valid arguments — not a general "AI security platform."
+It does **not**:
+
+- defend against prompt injection (it says nothing about whether the
+  arguments a model *chose* to send are the arguments it *should* have
+  sent — only whether they're complete and unfabricated)
+- resolve authorization (it doesn't know which caller may invoke which tool)
+- sandbox execution (`action: "execute"` means "this is genuinely the
+  complete value the model produced," not "safe to run without your own
+  validation and permissions")
+- detect a malicious or wrong tool choice (a model calling the wrong tool
+  with complete, schema-valid arguments is still reported `execute`)
+
+See [`docs/EXECUTION_GATE.md`](docs/EXECUTION_GATE.md#limitations---what-this-does-not-protect-against)
+for the full list, including known internal limitations.
+
 ## Current Status (Alpha)
 
 ### Implemented
@@ -111,8 +225,10 @@ case.
 - Configurable resource limits (depth, input size, string length, queued events)
 - Machine-readable test corpus with 25+ canonical fixtures
 - Chunk invariance verification
-- Provider stream adapters for OpenAI (legacy `function_call` and Responses API), Anthropic, Gemini, OpenRouter, and generic OpenAI-compatible endpoints, plus a coordinator for tracking multiple concurrent tool-call streams
+- Provider stream adapters for OpenAI (legacy `function_call` and Responses API), Anthropic, Gemini, OpenRouter, generic OpenAI-compatible endpoints, and the Vercel AI SDK, plus a coordinator for tracking multiple concurrent tool-call streams
 - Optional per-tool JSON Schema validation on the coordinator (see below) — a value can be structurally complete and still not match what a tool declared it needs
+- `createToolCallExecutionGate()` — a fail-closed `execute` / `retry` / `reject` decision per tool call, built on top of the coordinator (see [`docs/EXECUTION_GATE.md`](docs/EXECUTION_GATE.md))
+- `createAiSdkExecutionGuard()` — a drop-in high-level guard for the Vercel AI SDK's `fullStream`, composing a provider adapter with the execution gate; every `ExecutionDecision` also carries an `evidence` object explaining why (see [`docs/EXECUTION_GATE.md`](docs/EXECUTION_GATE.md#high-level-guards))
 
 ### Not Yet Implemented
 
@@ -155,7 +271,14 @@ A schema mismatch also surfaces as a coordinator diagnostic (`E_SCHEMA_VALIDATIO
 npm install prefix-safe-json
 ```
 
-## Quick Start
+## Low-level API: Quick Start
+
+The AI SDK guard (above) covers the common case. For other providers, or
+when you need the adapter/gate instance directly, `createToolCallExecutionGate()`
+and the provider adapters (`AnthropicStreamAdapter`, `OpenAIStreamAdapter`,
+etc.) are equally public — see [`docs/EXECUTION_GATE.md`](docs/EXECUTION_GATE.md#example).
+The `createParser()` API both are built on is also fully public, for anyone who
+needs direct access to parser state:
 
 ```typescript
 import { createParser } from "prefix-safe-json";
@@ -192,6 +315,16 @@ and asserts the truncated call is never reported executable while a
 genuinely complete one is. This example runs in CI on every push, so it
 can't silently rot into a stale claim.
 
+For the same demonstration through the low-level execution gate and the
+[Vercel AI SDK](https://ai-sdk.dev)'s `fullStream` shape instead, see
+[`examples/ai-sdk-execution-gate.mjs`](examples/ai-sdk-execution-gate.mjs)
+(`node examples/ai-sdk-execution-gate.mjs` after `pnpm run build`) — also
+run in CI on every push. For the drop-in `createAiSdkExecutionGuard()` shown
+at the top of this README, see
+[`examples/ai-sdk-guard.mjs`](examples/ai-sdk-guard.mjs)
+(`node examples/ai-sdk-guard.mjs`) — same scenarios, same guarantees, also
+run in CI on every push.
+
 ## License
 
 Licensed under either of:

package/dist/coordinator/diagnostic-codes.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Emitted (as a stream-wide `provider_diagnostic`, no `callRef`) by a
+ * provider adapter when the underlying provider reports that generation was
+ * stopped by a content-safety/policy filter, as opposed to a generic
+ * cancellation. The execution gate matches on this to return a distinct
+ * `reason: "content_filtered"` rather than lumping it in with ordinary
+ * incomplete-stream retries - a policy termination should not be retried
+ * blindly.
+ */
+export declare const CONTENT_FILTERED_DIAGNOSTIC_CODE = "E_CONTENT_FILTERED";
+//# sourceMappingURL=diagnostic-codes.d.ts.map

package/dist/coordinator/diagnostic-codes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-codes.d.ts","sourceRoot":"","sources":["../../src/coordinator/diagnostic-codes.ts"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,eAAO,MAAM,gCAAgC,uBAAuB,CAAC"}

package/dist/coordinator/diagnostic-codes.js

@@ -0,0 +1,22 @@
+// ---------------------------------------------------------------------------
+// Cross-module coordinator-level diagnostic codes.
+//
+// Most coordinator diagnostics (see coordinator.ts) are inline string
+// literals local to wherever they're raised - there's no central registry,
+// unlike the parser-level `DiagnosticCode` in diagnostics/codes.ts. This
+// file exists only for the handful of codes that a provider adapter raises
+// and something *outside* that adapter (e.g. the execution gate) needs to
+// recognize by exact code, where a shared constant is safer than either
+// module guessing the other's string literal.
+// ---------------------------------------------------------------------------
+/**
+ * Emitted (as a stream-wide `provider_diagnostic`, no `callRef`) by a
+ * provider adapter when the underlying provider reports that generation was
+ * stopped by a content-safety/policy filter, as opposed to a generic
+ * cancellation. The execution gate matches on this to return a distinct
+ * `reason: "content_filtered"` rather than lumping it in with ordinary
+ * incomplete-stream retries - a policy termination should not be retried
+ * blindly.
+ */
+export const CONTENT_FILTERED_DIAGNOSTIC_CODE = "E_CONTENT_FILTERED";
+//# sourceMappingURL=diagnostic-codes.js.map

package/dist/coordinator/diagnostic-codes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostic-codes.js","sourceRoot":"","sources":["../../src/coordinator/diagnostic-codes.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mDAAmD;AACnD,EAAE;AACF,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,wEAAwE;AACxE,8CAA8C;AAC9C,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,oBAAoB,CAAC"}

package/dist/coordinator/protocol.d.ts

@@ -1,4 +1,4 @@
-export type ProviderName = "openai" | "anthropic" | "gemini" | "openrouter" | "openai-compatible" | "unknown";
+export type ProviderName = "openai" | "anthropic" | "gemini" | "openrouter" | "openai-compatible" | "ai-sdk" | "unknown";
 export interface NormalizedEventBase {
     /**
      * Deterministic sequence number assigned by the stream coordinator.

package/dist/coordinator/protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/coordinator/protocol.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,mBAAmB,GACnB,SAAS,CAAC;AAEd,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,MAAM,yBAAyB,GACjC,kBAAkB,GAClB,qBAAqB,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,QAAQ,GACR,WAAW,GACX,gBAAgB,GAChB,eAAe,GACf,SAAS,CAAC;AAEd,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAClE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/coordinator/protocol.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GACpB,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,YAAY,GACZ,mBAAmB,GACnB,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,mBAAmB;IAClC;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,MAAM,yBAAyB,GACjC,kBAAkB,GAClB,qBAAqB,GACrB,sBAAsB,GACtB,2BAA2B,GAC3B,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,CAAC;AAE3B,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC;CACrC;AAED,MAAM,MAAM,eAAe,GACvB,UAAU,GACV,QAAQ,GACR,WAAW,GACX,gBAAgB,GAChB,eAAe,GACf,SAAS,CAAC;AAEd,MAAM,WAAW,gBAAiB,SAAQ,mBAAmB;IAC3D,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAClE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;CACpC;AAED,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/gate/decide.d.ts

@@ -0,0 +1,27 @@
+import { CoordinatorDiagnostic, ToolCallState } from "../coordinator/types.js";
+import { StreamEndReason } from "../coordinator/protocol.js";
+import { ExecuteDecision, NonExecutableDecision } from "./types.js";
+export interface DecisionContext {
+    /**
+     * The stream-level end reason - what actually happened to the underlying
+     * provider stream, not any single call's own (possibly still-"collecting")
+     * status. Stream-wide fail-closed conditions (provider_error) key off this
+     * rather than per-call state.
+     */
+    readonly streamEndReason: StreamEndReason;
+    /**
+     * The provider's own pre-normalization reason string for the stream-end
+     * event, when one was given (`ProviderStreamEndEvent.providerReason`).
+     * Observability only, mirrored onto `DecisionEvidence.providerReason` -
+     * never consulted by the decision logic itself.
+     */
+    readonly streamEndProviderReason?: string;
+    /**
+     * The coordinator's full, unfiltered diagnostics list (`snapshot().diagnostics`).
+     * `decideExecution` splits this into per-call (`internalId` matches) and
+     * global (`internalId` undefined) subsets itself.
+     */
+    readonly diagnostics: readonly CoordinatorDiagnostic[];
+}
+export declare function decideExecution(call: ToolCallState, ctx: DecisionContext): ExecuteDecision | NonExecutableDecision;
+//# sourceMappingURL=decide.d.ts.map

package/dist/gate/decide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.d.ts","sourceRoot":"","sources":["../../src/gate/decide.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAoB,eAAe,EAAmB,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEvG,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAE1C;;;;;OAKG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAE1C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACxD;AAeD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,eAAe,GACnB,eAAe,GAAG,qBAAqB,CA+HzC"}

package/dist/gate/decide.js

@@ -0,0 +1,138 @@
+// ---------------------------------------------------------------------------
+// Pure execution-decision mapping.
+//
+// Deliberately a standalone function (no coordinator/adapter dependency) so
+// the entire decision table can be unit-tested directly against hand-built
+// ToolCallState fixtures, without spinning up a full push()/finish()
+// pipeline for every row of the table.
+//
+// Priority order matters and is intentional: every fail-closed disqualifier
+// (resource limits, provider errors, content-policy terminations, schema
+// mismatches, malformed content, positively-observed truncation) is checked
+// before the single positive "execute" branch. "execute" is reached only
+// once nothing above has disqualified the call - it is the last positive
+// case, never the first check made, so a future status value that happens
+// to superficially resemble "complete" still can't skip the checks ahead of
+// it.
+// ---------------------------------------------------------------------------
+import { DiagnosticCode } from "../diagnostics/codes.js";
+import { CONTENT_FILTERED_DIAGNOSTIC_CODE } from "../coordinator/diagnostic-codes.js";
+const PARSER_RESOURCE_LIMIT_CODES = new Set([
+    DiagnosticCode.E_LIMIT_DEPTH,
+    DiagnosticCode.E_LIMIT_INPUT_BYTES,
+    DiagnosticCode.E_LIMIT_STRING_BYTES,
+    DiagnosticCode.E_LIMIT_EVENT_QUEUE,
+]);
+const COORDINATOR_RESOURCE_LIMIT_CODES = new Set([
+    "E_COORDINATOR_LIMIT_CALLS",
+    "E_COORDINATOR_LIMIT_EVENTS",
+    "E_TOOL_NAME_LIMIT",
+]);
+export function decideExecution(call, ctx) {
+    const parserDiagnostics = call.parser.diagnostics;
+    const callCoordinatorDiagnostics = ctx.diagnostics.filter((d) => d.internalId === call.internalId);
+    const globalCoordinatorDiagnostics = ctx.diagnostics.filter((d) => d.internalId === undefined);
+    const coordinatorDiagnostics = [
+        ...globalCoordinatorDiagnostics,
+        ...callCoordinatorDiagnostics,
+    ];
+    const evidence = {
+        provider: call.provider,
+        providerReason: ctx.streamEndProviderReason,
+        streamEndReason: ctx.streamEndReason,
+        terminalConfirmed: ctx.streamEndReason !== "unknown",
+        structurallyComplete: call.parser.rootComplete,
+        parserExecutable: call.parser.executable,
+        schemaValid: call.schemaValid,
+        receivedBytes: call.parser.receivedBytes,
+    };
+    const common = {
+        internalId: call.internalId,
+        toolCallId: call.toolCallId,
+        toolIndex: call.toolIndex,
+        name: call.name,
+        stableValue: call.parser.stableValue,
+        parserDiagnostics,
+        coordinatorDiagnostics,
+        evidence,
+    };
+    function reject(reason) {
+        return { ...common, action: "reject", executable: false, reason };
+    }
+    function retry(reason) {
+        return { ...common, action: "retry", executable: false, reason };
+    }
+    // --- Universal fail-closed checks ---------------------------------------
+    // Evaluated first and unconditionally, regardless of call.status, so a
+    // resource limit, a provider-side failure, or a content-policy
+    // termination always wins over whatever the structural status looks like.
+    const hasResourceLimit = parserDiagnostics.some((d) => PARSER_RESOURCE_LIMIT_CODES.has(d.code)) ||
+        callCoordinatorDiagnostics.some((d) => COORDINATOR_RESOURCE_LIMIT_CODES.has(d.code)) ||
+        globalCoordinatorDiagnostics.some((d) => d.code === "E_COORDINATOR_LIMIT_EVENTS");
+    if (hasResourceLimit) {
+        return reject("resource_limit");
+    }
+    if (ctx.streamEndReason === "provider_error") {
+        return reject("provider_error");
+    }
+    const isContentFiltered = globalCoordinatorDiagnostics.some((d) => d.code === CONTENT_FILTERED_DIAGNOSTIC_CODE);
+    if (isContentFiltered) {
+        return reject("content_filtered");
+    }
+    // --- Status-specific handling --------------------------------------------
+    // Exhaustive over ToolCallState["status"] with no `default`: if a future
+    // coordinator version adds a new status literal without a matching case
+    // here, `noImplicitReturns` fails the build - not a silent runtime gap.
+    switch (call.status) {
+        case "complete": {
+            if (call.schemaValid === false) {
+                return reject("schema_invalid");
+            }
+            // The ONLY positive branch in this entire function, reached only
+            // after every disqualifying check above has already passed. The
+            // `call.name !== undefined` check is defensive/redundant with the
+            // coordinator's own invariant (a call only reaches status "complete"
+            // when its name is known) - narrowing on it here is what lets
+            // `ExecuteDecision.name` be typed as a required `string` instead of
+            // `string | undefined`, so it never needs re-checking at every call
+            // site. If the invariant were ever violated, this still fails closed
+            // to "stream_incomplete" rather than fabricating a name.
+            if (call.parser.executable === true &&
+                call.parser.stableValue !== undefined &&
+                call.name !== undefined) {
+                const decision = {
+                    ...common,
+                    name: call.name,
+                    action: "execute",
+                    executable: true,
+                    reason: "complete",
+                    value: call.parser.stableValue,
+                };
+                return decision;
+            }
+            // Root closed, syntactically valid, but not trusted: the parser's
+            // own executable contract failed it (stream-end-reason mismatch or
+            // trailing data), even though nothing here required a repair.
+            return retry("stream_incomplete");
+        }
+        case "truncated":
+            // The parser positively observed an open string/number/literal or an
+            // unclosed container - a real, raw mid-value cut, not a matter of
+            // interpretation.
+            return retry("truncated");
+        case "invalid":
+            // Duplicate key, unexpected token, or a missing/conflicting tool
+            // identity - a genuine content defect, independent of how the stream
+            // ended.
+            return reject("malformed");
+        case "salvaged":
+            // Root only closed via a safe-container-closing repair; the JSON
+            // *looks* complete, but provider metadata never confirmed genuine
+            // completion. This is the container-level truncation case.
+            return retry("stream_incomplete");
+        case "cancelled":
+        case "collecting":
+            return retry("stream_incomplete");
+    }
+}
+//# sourceMappingURL=decide.js.map

package/dist/gate/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../../src/gate/decide.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,mCAAmC;AACnC,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AACrE,uCAAuC;AACvC,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,MAAM;AACN,8EAA8E;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,OAAO,EAAE,gCAAgC,EAAE,MAAM,oCAAoC,CAAC;AA4BtF,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAC;IAC/D,cAAc,CAAC,aAAa;IAC5B,cAAc,CAAC,mBAAmB;IAClC,cAAc,CAAC,oBAAoB;IACnC,cAAc,CAAC,mBAAmB;CACnC,CAAC,CAAC;AAEH,MAAM,gCAAgC,GAAwB,IAAI,GAAG,CAAC;IACpE,2BAA2B;IAC3B,4BAA4B;IAC5B,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,UAAU,eAAe,CAC7B,IAAmB,EACnB,GAAoB;IAEpB,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;IAClD,MAAM,0BAA0B,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,CACxC,CAAC;IACF,MAAM,4BAA4B,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAClC,CAAC;IACF,MAAM,sBAAsB,GAAG;QAC7B,GAAG,4BAA4B;QAC/B,GAAG,0BAA0B;KAC9B,CAAC;IAEF,MAAM,QAAQ,GAAqB;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,GAAG,CAAC,uBAAuB;QAC3C,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,iBAAiB,EAAE,GAAG,CAAC,eAAe,KAAK,SAAS;QACpD,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY;QAC9C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;QACxC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;KACzC,CAAC;IAEF,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;QACpC,iBAAiB;QACjB,sBAAsB;QACtB,QAAQ;KACT,CAAC;IAEF,SAAS,MAAM,CAAC,MAA4C;QAC1D,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,SAAS,KAAK,CAAC,MAAyC;QACtD,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACnE,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,+DAA+D;IAC/D,0EAA0E;IAE1E,MAAM,gBAAgB,GACpB,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtE,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,4BAA4B,CAAC,CAAC;IACpF,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,GAAG,CAAC,eAAe,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,IAAI,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gCAAgC,CACnD,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACpC,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAClC,CAAC;YACD,iEAAiE;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,qEAAqE;YACrE,8DAA8D;YAC9D,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,yDAAyD;YACzD,IACE,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI;gBAC/B,IAAI,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS;gBACrC,IAAI,CAAC,IAAI,KAAK,SAAS,EACvB,CAAC;gBACD,MAAM,QAAQ,GAAoB;oBAChC,GAAG,MAAM;oBACT,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,SAAS;oBACjB,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,UAAU;oBAClB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;iBAC/B,CAAC;gBACF,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,kEAAkE;YAClE,mEAAmE;YACnE,8DAA8D;YAC9D,OAAO,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,WAAW;YACd,qEAAqE;YACrE,kEAAkE;YAClE,kBAAkB;YAClB,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC;QAE5B,KAAK,SAAS;YACZ,iEAAiE;YACjE,qEAAqE;YACrE,SAAS;YACT,OAAO,MAAM,CAAC,WAAW,CAAC,CAAC;QAE7B,KAAK,UAAU;YACb,iEAAiE;YACjE,kEAAkE;YAClE,2DAA2D;YAC3D,OAAO,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAEpC,KAAK,WAAW,CAAC;QACjB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/gate/gate.d.ts

@@ -0,0 +1,25 @@
+import { CoordinatorLimits, JsonSchemaLike } from "../coordinator/types.js";
+import { ParserOptions } from "../types.js";
+import { ToolCallExecutionGate } from "./types.js";
+/**
+ * Creates a fail-closed execution-decision gate for streamed LLM tool calls.
+ * Wraps a `ToolCallStreamCoordinator` (same constructor arguments) and adds
+ * exactly one operation: turn each call's settled state into an
+ * `ExecutionDecision` (`execute` / `retry` / `reject`) via a deterministic,
+ * fully-typed decision table. See `docs/EXECUTION_GATE.md`.
+ *
+ * ```ts
+ * const gate = createToolCallExecutionGate(undefined, undefined, {
+ *   write_file: { type: "object", required: ["path", "content"], properties: {
+ *     path: { type: "string" }, content: { type: "string" } } },
+ * });
+ * for (const raw of providerEvents) {
+ *   for (const normalized of adapter.push(raw)) gate.push(normalized);
+ * }
+ * for (const decision of gate.finish().decisions) {
+ *   if (decision.action === "execute") await tools[decision.name](decision.value);
+ * }
+ * ```
+ */
+export declare function createToolCallExecutionGate(limits?: Partial<CoordinatorLimits>, parserOptions?: ParserOptions, toolSchemas?: Record<string, JsonSchemaLike>): ToolCallExecutionGate;
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,iBAAiB,EAEjB,cAAc,EAGf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAEL,qBAAqB,EAEtB,MAAM,YAAY,CAAC;AA+EpB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,EACnC,aAAa,CAAC,EAAE,aAAa,EAC7B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAC3C,qBAAqB,CAEvB"}

package/dist/gate/gate.js

@@ -0,0 +1,96 @@
+// ---------------------------------------------------------------------------
+// ToolCallExecutionGate — high-level execution safety layer.
+//
+// Built by composition over ToolCallStreamCoordinator, not by extending or
+// reimplementing it: the gate holds a coordinator instance and adds exactly
+// one thing coordinator state doesn't already capture - which stream-end
+// reason actually got applied - then maps every ToolCallState through the
+// pure decideExecution() table. No re-parsing, no duplicate event pipeline.
+// ---------------------------------------------------------------------------
+import { createToolCallStreamCoordinator } from "../coordinator/coordinator.js";
+import { decideExecution } from "./decide.js";
+class DefaultToolCallExecutionGate {
+    coordinator;
+    // Mirrors the coordinator's own "first provider_stream_end (from push(),
+    // or from finish()'s meta if none arrived) wins" rule - see push()/finish()
+    // below and DefaultToolCallStreamCoordinator.finish()'s matching
+    // `if (!this.isFinished)` guard. streamEndProviderReason is captured
+    // alongside streamEndReason purely for DecisionEvidence.providerReason -
+    // it is never read by decideExecution()'s own logic.
+    streamEndReason;
+    streamEndProviderReason;
+    streamEndCaptured = false;
+    constructor(limits, parserOptions, toolSchemas) {
+        this.coordinator = createToolCallStreamCoordinator(limits, parserOptions, toolSchemas);
+    }
+    push(event) {
+        if (event.type === "provider_stream_end" && !this.streamEndCaptured) {
+            this.streamEndCaptured = true;
+            this.streamEndReason = event.reason;
+            this.streamEndProviderReason = event.providerReason;
+        }
+        return this.coordinator.push(event);
+    }
+    snapshot() {
+        const snap = this.coordinator.snapshot();
+        const ctx = {
+            // Pre-finish, no stream-end reason has been observed yet ("unknown"
+            // is a neutral placeholder here, not a claim anything went wrong) -
+            // every in-flight call is still "collecting" regardless, so this
+            // never influences whether something looks executable.
+            streamEndReason: this.streamEndReason ?? "unknown",
+            streamEndProviderReason: this.streamEndProviderReason,
+            diagnostics: snap.diagnostics,
+        };
+        return snap.calls.map((call) => decideExecution(call, ctx));
+    }
+    drainEvents() {
+        return this.coordinator.drainEvents();
+    }
+    finish(meta) {
+        if (!this.streamEndCaptured) {
+            this.streamEndCaptured = true;
+            this.streamEndReason = meta?.reason ?? "unknown";
+            this.streamEndProviderReason = meta?.providerReason;
+        }
+        const result = this.coordinator.finish(meta);
+        const diagnostics = this.coordinator.snapshot().diagnostics;
+        // Unlike snapshot() above, this point is only ever reached after
+        // streamEndCaptured is guaranteed true (set on entry to this method, or
+        // already true from an earlier push()/finish() call) - and every path
+        // that sets streamEndCaptured sets streamEndReason to a defined value in
+        // the same branch, so the pre-finish "unknown" placeholder never applies
+        // here.
+        const ctx = {
+            streamEndReason: this.streamEndReason,
+            streamEndProviderReason: this.streamEndProviderReason,
+            diagnostics,
+        };
+        const decisions = result.calls.map((call) => decideExecution(call, ctx));
+        return { decisions, diagnostics };
+    }
+}
+/**
+ * Creates a fail-closed execution-decision gate for streamed LLM tool calls.
+ * Wraps a `ToolCallStreamCoordinator` (same constructor arguments) and adds
+ * exactly one operation: turn each call's settled state into an
+ * `ExecutionDecision` (`execute` / `retry` / `reject`) via a deterministic,
+ * fully-typed decision table. See `docs/EXECUTION_GATE.md`.
+ *
+ * ```ts
+ * const gate = createToolCallExecutionGate(undefined, undefined, {
+ *   write_file: { type: "object", required: ["path", "content"], properties: {
+ *     path: { type: "string" }, content: { type: "string" } } },
+ * });
+ * for (const raw of providerEvents) {
+ *   for (const normalized of adapter.push(raw)) gate.push(normalized);
+ * }
+ * for (const decision of gate.finish().decisions) {
+ *   if (decision.action === "execute") await tools[decision.name](decision.value);
+ * }
+ * ```
+ */
+export function createToolCallExecutionGate(limits, parserOptions, toolSchemas) {
+    return new DefaultToolCallExecutionGate(limits, parserOptions, toolSchemas);
+}
+//# sourceMappingURL=gate.js.map

package/dist/gate/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../../src/gate/gate.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAE9E,OAAO,EAAE,+BAA+B,EAAE,MAAM,+BAA+B,CAAC;AAUhF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAO9C,MAAM,4BAA4B;IACf,WAAW,CAA4B;IAExD,yEAAyE;IACzE,4EAA4E;IAC5E,iEAAiE;IACjE,qEAAqE;IACrE,yEAAyE;IACzE,qDAAqD;IAC7C,eAAe,CAA8B;IAC7C,uBAAuB,CAAqB;IAC5C,iBAAiB,GAAG,KAAK,CAAC;IAElC,YACE,MAAmC,EACnC,aAA6B,EAC7B,WAA4C;QAE5C,IAAI,CAAC,WAAW,GAAG,+BAA+B,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,CAAC,KAAgC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACpE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;YACpC,IAAI,CAAC,uBAAuB,GAAG,KAAK,CAAC,cAAc,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,QAAQ;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG;YACV,oEAAoE;YACpE,oEAAoE;YACpE,iEAAiE;YACjE,uDAAuD;YACvD,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,SAAS;YAClD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,CAAC;IAED,WAAW;QACT,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,IAGN;QACC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC5B,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,MAAM,IAAI,SAAS,CAAC;YACjD,IAAI,CAAC,uBAAuB,GAAG,IAAI,EAAE,cAAc,CAAC;QACtD,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC;QAC5D,iEAAiE;QACjE,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,QAAQ;QACR,MAAM,GAAG,GAAG;YACV,eAAe,EAAE,IAAI,CAAC,eAAkC;YACxD,uBAAuB,EAAE,IAAI,CAAC,uBAAuB;YACrD,WAAW;SACZ,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAEzE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAmC,EACnC,aAA6B,EAC7B,WAA4C;IAE5C,OAAO,IAAI,4BAA4B,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AAC9E,CAAC"}