@aexol/spectral 0.8.0 → 0.8.5

package/dist/relay/dispatcher.d.ts

@@ -0,0 +1,207 @@
+/**
+ * Relay envelope dispatcher (CLI side).
+ *
+ * Translates inbound `RelayFrame`s from the backend into calls against the
+ * pure REST handlers (`handlers/projects.ts`, `handlers/sessions.ts`) and
+ * the live `SessionStreamManager`. Pure module — no socket, no timers,
+ * no logging side-channels except what the caller passes in. The caller
+ * (`commands/serve.ts`) owns lifecycle and the `RelayClient`.
+ *
+ * Two entry points, one per inbound frame kind we route:
+ *
+ *  - `handleRestRequest(frame, deps)` — synchronous-style request/response.
+ *    Resolves to a `RestResponseFrame` the caller sends back via
+ *    `relay.send(...)`. Errors thrown by handlers are mapped to status
+ *    codes (400/404/500) and returned in the body, never re-thrown — the
+ *    backend has a 30 s pending-request timeout and we want every request
+ *    to terminate with a wire response so the browser doesn't sit on a
+ *    stale spinner.
+ *
+ *  - `handleClientMessage(frame, deps)` — fire-and-forget. Attaches a
+ *    `Subscriber` (the relay socket, wrapped) to the session if not
+ *    already attached, then calls `manager.prompt()`. Outbound
+ *    `ServerEvent`s flow back through the subscriber as `WsEventFrame`s
+ *    via `deps.relay.send()`.
+ *
+ * Subscriber bookkeeping lives in `serve.ts`, NOT here. The dispatcher
+ * is given the subscriber by the caller so it stays pure-ish (depends
+ * only on `manager` + `relay.send`). This also keeps the lifecycle for
+ * "detach all on relay disconnect" in one place.
+ *
+ * Path matching is a 30-line inline switch; we deliberately do not pull
+ * in `path-to-regexp` for five literal patterns. The matcher returns
+ * the parsed `id` param when applicable.
+ *
+ * Close-code policy (mirroring backend `router.ts`):
+ *  - The dispatcher itself never closes the relay; that's serve.ts.
+ *  - Backend cancels pending REST requests with `code:"timeout"` (30 s)
+ *    or `code:"machine_offline"` (CLI socket dropped). Both are
+ *    transparent to this layer — we just respond when we can.
+ */
+import type { AutoResearchFrame, CancelTurnFrame, ClientMessageFrame, MetaEvent, RestRequestFrame, RestResponseFrame, SubscribeFrame } from "@aexol/relay-protocol";
+import type { SessionStreamManager, Subscriber } from "../server/session-stream.js";
+import type { SessionStore } from "../server/storage.js";
+import type { RelayClient } from "./client.js";
+/**
+ * Result of matching a request path against a route table entry.
+ * `id` is populated when the route had an `:id` placeholder.
+ */
+interface RouteMatch {
+    route: "list_projects" | "create_project" | "update_project" | "delete_project" | "bind_studio" | "list_project_sessions" | "create_session" | "get_session" | "update_session" | "delete_session" | "get_session_memory" | "get_session_memory_details" | "compact_session" | "remember_and_delete_session" | "fork_session" | "list_path_autocomplete" | "enqueue_prompt" | "get_prompt_queue" | "remove_prompt" | "clear_prompt_queue";
+    id?: string;
+    /** Parsed query params, if the path carried a `?...` suffix. */
+    query?: URLSearchParams;
+    /** For `remove_prompt`: the queue item id extracted from the path. */
+    itemId?: string;
+}
+/**
+ * Inline path matcher. Returns `null` for any path/method combination we
+ * don't recognise; the caller turns that into a `404 Unknown route`.
+ *
+ * Intentionally literal — a regex table would be marginally fancier but
+ * also marginally slower and harder to read for ~9 routes.
+ */
+export declare function matchRoute(method: string, path: string): RouteMatch | null;
+/**
+ * Best-effort publisher for project/session lifecycle meta events. Bound
+ * by `serve.ts` to `relay.send({kind:"meta_event", machineId, event})`;
+ * tests pass a recording stub. Always called inside a try/catch by the
+ * dispatcher so a publish failure never breaks the REST response — the
+ * mutation already succeeded.
+ *
+ * Omit (`undefined`) to disable publishing entirely (used in the handler
+ * unit tests where there's no relay).
+ */
+export type PublishMetaEvent = (event: MetaEvent) => void;
+export interface RestRequestDeps {
+    store: SessionStore;
+    manager: SessionStreamManager;
+    /** Optional logger for unexpected errors. Defaults to console.error. */
+    logger?: {
+        error: (...args: unknown[]) => void;
+    };
+    /**
+     * Optional meta-event publisher. Invoked AFTER each successful mutation
+     * (create/update/delete project, create/update/delete session) so all
+     * tabs of all browsers subscribed to this machine refetch. Read paths
+     * (`list_*`, `get_*`) never publish.
+     *
+     * Failure handling: any throw is caught + logged; we never propagate
+     * publish failures into the REST response (the SQLite mutation has
+     * already committed and the caller deserves the success it asked for).
+     */
+    publishMetaEvent?: PublishMetaEvent;
+}
+/**
+ * Dispatch a `rest_request` frame. Always resolves with a
+ * `RestResponseFrame` — handler exceptions are caught and translated.
+ *
+ * Status mapping:
+ *  - 200: handler returned successfully (body is the handler's return value
+ *         or `{ ok: true }` for void returns)
+ *  - 400: `BadRequestError` thrown by handler, OR malformed body for a
+ *         route that requires one, OR unknown route
+ *  - 404: `NotFoundError` thrown by handler
+ *  - 405: route matches but method doesn't (returned as 404 since we don't
+ *         distinguish — the matcher treats it as "no route", consistent
+ *         with the original Hono router which also 404'd)
+ *  - 500: anything else; `error` field carries a sanitized message
+ */
+export declare function handleRestRequest(frame: RestRequestFrame, deps: RestRequestDeps): Promise<RestResponseFrame>;
+export interface ClientMessageDeps {
+    manager: SessionStreamManager;
+    /** Live relay client used to send `WsEventFrame`s back. */
+    relay: Pick<RelayClient, "send">;
+    /**
+     * Subscriber registry. The dispatcher attaches per `(sessionId)` exactly
+     * once and reuses the same `Subscriber` instance for subsequent
+     * `client_message` frames addressed to the same session. The caller is
+     * responsible for clearing this on relay disconnect via
+     * `detachAll(deps)`.
+     *
+     * Keyed by `sessionId` (machine routing already happened at the backend;
+     * the CLI only ever sees frames addressed to itself).
+     */
+    subscribers: Map<string, Subscriber>;
+    /** Optional logger for prompt-side errors. Defaults to console.error. */
+    logger?: {
+        error: (...args: unknown[]) => void;
+    };
+}
+/**
+ * Dispatch a `client_message` frame. Idempotent w.r.t. attach: the same
+ * `Subscriber` is reused across messages for a given session.
+ *
+ * Errors:
+ *  - Unknown sessionId → emits a `ws_event` carrying an `error`-typed
+ *    `ServerEvent` so the browser sees it on the established stream
+ *    (mirrors how the old WS route surfaced `manager.attach` failures).
+ *  - Unknown message shape → silently ignored with a logger warning;
+ *    the wire contract is `{type:"user_message", content:string}` and
+ *    anything else is a protocol violation we don't escalate.
+ *  - `manager.prompt()` rejection → logged; the manager itself broadcasts
+ *    an `error` event to subscribers, so we don't double-report.
+ */
+export declare function handleClientMessage(frame: ClientMessageFrame, deps: ClientMessageDeps): void;
+/**
+ * Dispatch a `subscribe` frame from the backend. Handles the case where a
+ * browser enters an old session — we load history from SQLite immediately
+ * via `manager.attach()` and synthesize `session_ready` so the browser sees
+ * the full chat history without needing to send a first `client_message`.
+ *
+ * Idempotent: if a subscriber already exists for this session, we re-send
+ * `session_ready` (history may have changed, and the newly-joined browser
+ * tab needs it). The `ready.catch` handler is only registered once — on the
+ * first subscriber creation — to avoid duplicate error events.
+ */
+export declare function handleSubscribe(frame: SubscribeFrame, deps: ClientMessageDeps): void;
+/**
+ * Dispatch a `cancel_turn` frame. Disposes the session's pi bridge and
+ * removes the stream so the next user message creates a fresh one. The
+ * bridge dispose triggers `agent_end` broadcast to all subscribers.
+ *
+ * Idempotent: no-ops when no stream exists for the session.
+ */
+export declare function handleCancelTurn(frame: CancelTurnFrame, deps: {
+    manager: SessionStreamManager;
+    logger?: {
+        error: (...args: unknown[]) => void;
+    };
+}): void;
+/**
+ * Detach every subscriber the dispatcher has attached. Called by
+ * `serve.ts` on relay disconnect / shutdown so the underlying pi
+ * processes don't keep an unreachable subscriber pinned.
+ *
+ * NOTE: this does NOT dispose the streams themselves — pi keeps running
+ * so a future browser reconnect can resume mid-turn. Use
+ * `manager.dispose()` at full shutdown.
+ */
+export declare function detachAllSubscribers(manager: SessionStreamManager, subscribers: Map<string, Subscriber>): void;
+export interface AutoResearchDeps {
+    store: SessionStore;
+    manager: SessionStreamManager;
+    relay: Pick<RelayClient, "send">;
+    /** Subscriber map shared with handleClientMessage. */
+    subscribers: Map<string, Subscriber>;
+    /** Project working directory. */
+    cwd: string;
+    /** Optional logger. Defaults to console.error. */
+    logger?: {
+        error: (...args: unknown[]) => void;
+    };
+}
+/**
+ * Dispatch an `auto_research` frame. Sends the auto-research task through
+ * the existing AgentBridge (backend proxy) instead of spawning a separate pi
+ * subprocess. This ensures auto-research uses the same model and API keys
+ * as the active session.
+ *
+ * Progress is streamed back as `ws_event` frames carrying
+ * `auto_research_*` ServerEvent types on the `sessionId` channel.
+ *
+ * Errors are surfaced as `auto_research_error` events.
+ */
+export declare function handleAutoResearchFrame(frame: AutoResearchFrame, deps: AutoResearchDeps): void;
+export {};
+//# sourceMappingURL=dispatcher.d.ts.map

package/dist/relay/dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../src/relay/dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACf,MAAM,uBAAuB,CAAC;AA6B/B,OAAO,KAAK,EACV,oBAAoB,EACpB,UAAU,EACX,MAAM,6BAA6B,CAAC;AAErC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO/C;;;GAGG;AACH,UAAU,UAAU;IAClB,KAAK,EACD,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,uBAAuB,GACvB,gBAAgB,GAChB,aAAa,GACb,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,4BAA4B,GAC5B,iBAAiB,GACjB,6BAA6B,GAC7B,cAAc,GACd,wBAAwB,GACxB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,oBAAoB,CAAC;IACzB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,IAAI,CAoGnB;AAMD;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,wEAAwE;IACxE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;KAAE,CAAC;IACjD;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,EACvB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAiD5B;AAwRD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,oBAAoB,CAAC;IAC9B,2DAA2D;IAC3D,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;;;;OASG;IACH,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;KAAE,CAAC;CAClD;AA8BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,kBAAkB,EACzB,IAAI,EAAE,iBAAiB,GACtB,IAAI,CAqIN;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,iBAAiB,GACtB,IAAI,CAsDN;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE;IAAE,OAAO,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;KAAE,CAAA;CAAE,GACxF,IAAI,CAEN;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,EAC7B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GACnC,IAAI,CASN;AAMD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACjC,sDAAsD;IACtD,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;KAAE,CAAC;CAClD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,iBAAiB,EACxB,IAAI,EAAE,gBAAgB,GACrB,IAAI,CAQN"}

package/dist/relay/machine-store.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Persistent record of a registered machine.
+ *
+ * Lives at `<configDir>/machine.json` (mode 0600). Created the first time
+ * `spectral serve` runs after login; reused across restarts so a single
+ * developer machine appears as one logical agent in the backend's machine
+ * list, regardless of how many times the CLI process restarts.
+ *
+ * Why a separate file from `config.json`?
+ *  - `config.json` carries the team API key (rotated on logout). The
+ *    machine identity outlives logout/login: if you `logout` then
+ *    `login` with the same team, your machine should keep its `machineId`
+ *    so the backend's audit log stays continuous.
+ *  - The machine JWT is short-lived (decoded `exp` checked by
+ *    `registration.ts`). Splitting it out keeps the auth file minimal and
+ *    avoids any risk of accidentally serializing the JWT into a
+ *    `spectral login` log line.
+ *
+ * Schema is intentionally minimal — Batch 3 will add capability flags;
+ * unknown fields are preserved on round-trip via `extra` so older CLIs
+ * don't strip data the backend later cares about.
+ */
+export interface MachineRecord {
+    /** Stable machine id assigned by the backend on first register. */
+    machineId: string;
+    /** Display name (defaults to hostname; user can override with --machine-name). */
+    machineName: string;
+    /** Short-lived bearer JWT used for the WS Authorization header. */
+    machineJwt: string;
+    /** Team id (optional — backend may or may not return one in this batch). */
+    teamId?: string;
+    /** User who registered the machine via OAuth. Absent for team-API-key registrations. */
+    ownerId?: string;
+    /** Machine visibility: "PRIVATE" or "SHARED". */
+    visibility?: string;
+    /** Wall-clock ms when the JWT was issued (used for cheap freshness display). */
+    registeredAt: number;
+    /** Hostname captured at registration time. Informational only. */
+    hostname: string;
+    /** CLI version captured at registration time. Informational only. */
+    version: string;
+    /**
+     * Forward-compatibility bag: any unknown JSON keys read from disk are
+     * preserved here and re-emitted on save so a newer backend that adds
+     * fields doesn't get them stripped by an older CLI.
+     */
+    extra?: Record<string, unknown>;
+}
+export declare function getMachineFile(): string;
+/**
+ * Read the persisted machine record. Returns `null` when the file is
+ * missing or malformed — callers treat both as "needs registration".
+ *
+ * We intentionally do NOT throw on parse errors: a corrupted machine.json
+ * should self-heal on the next `spectral serve` (re-register, overwrite),
+ * not block startup forever.
+ */
+export declare function loadMachine(): Promise<MachineRecord | null>;
+/**
+ * Write the machine record with restrictive permissions. Creates the
+ * config directory if missing (matches `writeConfig` in `config.ts`).
+ *
+ * Atomicity: we do NOT write-then-rename. The record is small, the file
+ * is single-writer (one `spectral serve` at a time per `$SPECTRAL_CONFIG_DIR`),
+ * and a torn write self-heals via `loadMachine` returning null + re-register.
+ */
+export declare function saveMachine(rec: MachineRecord): Promise<void>;
+//# sourceMappingURL=machine-store.d.ts.map

package/dist/relay/machine-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-store.d.ts","sourceRoot":"","sources":["../../src/relay/machine-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAQH,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAcD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAuCjE;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBnE"}

package/dist/relay/models-fetch.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Fetch the admin-managed list of allowed base models from the backend.
+ *
+ * Used by `AgentBridge` at startup to register synthetic providers
+ * (`spectral-proxy-anthropic` / `spectral-proxy-openai`) that route every
+ * inference call through the backend's `/v1/messages` and
+ * `/v1/chat/completions` endpoints. The backend authenticates the call
+ * with the machine JWT (Bearer) and forwards to the upstream provider
+ * using its own (centralized) API keys.
+ *
+ * Why GraphQL (not REST):
+ *  - The backend already exposes the whitelist via `availableBaseModels`
+ *    in its public GraphQL schema (`schema.graphql`); there is no
+ *    equivalent REST endpoint and we don't want to add one just for the
+ *    CLI.
+ *  - The query is parameterless and authenticated via the same Bearer
+ *    machine JWT used by `/v1/*`, so a single `fetch` call is enough —
+ *    no Zeus client setup required.
+ *
+ * Caching:
+ *  - In-memory TTL cache (default 5 min), keyed by `${backendUrl}|${jwt}`.
+ *    Pi sessions are short-lived but a single `spectral serve` process
+ *    creates many of them, so we don't want to hammer the GraphQL
+ *    endpoint on every reconnect.
+ */
+export interface AllowedModel {
+    /** Raw provider modelId, e.g. "claude-3-5-haiku-latest". Sent as `body.model`. */
+    modelId: string;
+    /** Provider key as the backend records it, e.g. "anthropic", "openai", "google", "built-in". */
+    provider: string;
+    /** Human-readable name. Backend currently returns the modelId here, but the
+     *  shape is forward-compatible with a separate displayName field. */
+    displayName: string;
+    /** Whether the upstream model supports reasoning/thinking. */
+    supportsReasoning?: boolean | null;
+    /** Backend-assigned UserModel id. Present for built-in (custom) models. */
+    userModelId?: string;
+    /** Optional model credit rates (credits per 1M tokens) used for Agent UI usage display. */
+    creditInputPer1M?: number | null;
+    creditOutputPer1M?: number | null;
+    creditCachedInputPer1M?: number | null;
+    creditCacheReadPer1M?: number | null;
+    creditCacheWritePer1M?: number | null;
+    /** Context window size in tokens (from backend's BaseModelInfo). */
+    contextWindow?: number | null;
+    /** Whether the model supports image input (derived from capabilities.modalities.input). */
+    supportsImages?: boolean | null;
+    /** Admin-configured default model flag (from backend BaseModel.isDefault). */
+    isDefault?: boolean | null;
+    /** Admin-configured default vision model flag (from backend BaseModel.isVisionDefault). */
+    isVisionDefault?: boolean | null;
+}
+export interface FetchAllowedModelsOptions {
+    backendUrl: string;
+    machineJwt: string;
+    /** Override for tests. */
+    fetchImpl?: typeof fetch;
+    /**
+     * Bypass the in-memory cache for this call. Tests use this to assert
+     * that the network is actually hit; production code never sets it.
+     */
+    bypassCache?: boolean;
+    /** TTL in milliseconds. Default 5 min. Tests use 0 to effectively disable. */
+    cacheTtlMs?: number;
+}
+/** Test-only helper: drops every cached entry. */
+export declare function clearAllowedModelsCache(): void;
+/**
+ * Fetch the whitelist of allowed base models. Throws on any failure with a
+ * message tailored for an operator running `spectral serve` — the caller
+ * (AgentBridge.start) lets the throw propagate so the WS subscriber sees a
+ * clear error event instead of a silent fall-through to "no models".
+ */
+export declare function fetchAllowedModels(opts: FetchAllowedModelsOptions): Promise<AllowedModel[]>;
+//# sourceMappingURL=models-fetch.d.ts.map

package/dist/relay/models-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models-fetch.d.ts","sourceRoot":"","sources":["../../src/relay/models-fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB;yEACqE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACnC,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,qBAAqB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oEAAoE;IACpE,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,2FAA2F;IAC3F,cAAc,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC3B,2FAA2F;IAC3F,eAAe,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAUD,kDAAkD;AAClD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AA0BD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,YAAY,EAAE,CAAC,CAyHzB"}

package/dist/relay/registration.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Machine registration with the Aexol backend.
+ *
+ * Contract (Batch 1 backend):
+ *   POST <backend>/api/machines/register
+ *     Headers: Authorization: Bearer <teamApiKey|userJwt>
+ *     Body:    { name?: string, hostname: string, version: string, pid: number }
+ *     200:     { machineId: string, jwt: string, name: string, ownerId?: string }
+ *
+ * Auth priority:
+ *   - If `userJwt` is set → used as Bearer token (machine gets ownerId)
+ *   - Else → `apiKey` (team API key, machine gets no owner)
+ *
+ * Why this lives in its own module:
+ *  - It's the ONLY consumer of the team API key / user JWT for registration.
+ *    Once registration succeeds, the auth token is dropped on the floor —
+ *    only the `machineJwt` is persisted (in `machine.json`) and threaded
+ *    into `RelayClient`. Keeps the blast radius of an in-memory leak minimal.
+ *  - It owns JWT expiry decoding so `serve.ts` doesn't have to know about
+ *    JWT internals; a single boundary for "is the saved record still good".
+ *
+ * Failure mode: registration is fail-fast (no retry). The user is sitting
+ * at a CLI prompt; if their team key is wrong or the backend is down, the
+ * right answer is a clear error message, not a hang. WS reconnect (which
+ * IS retried) is the long-running path; that's `RelayClient`'s job.
+ */
+import { type MachineRecord } from "./machine-store.js";
+export interface RegistrationDeps {
+    /** Backend base URL, e.g. "https://api.aexol.ai". No trailing slash. */
+    backendUrl: string;
+    /** Team API key — used when `userJwt` is not set. */
+    apiKey: string;
+    /** Optional user JWT from OAuth login. When set, used instead of `apiKey` for registration. */
+    userJwt?: string;
+    /** Display name override (from `--machine-name`). Falls back to hostname. */
+    machineNameOverride?: string;
+    /** CLI version string for the registration payload. */
+    version: string;
+    /** Process id (informational; backend uses for last-seen audit). */
+    pid?: number;
+    /**
+     * Skew tolerance: treat the JWT as expired if it expires in less than this
+     * many seconds. Default 60s — well below any realistic JWT lifetime, but
+     * large enough that we don't connect with a token that dies mid-handshake.
+     */
+    expirySkewSec?: number;
+    /** Override fetch (tests). */
+    fetchImpl?: typeof fetch;
+}
+export interface RegisterResponse {
+    /** True when the existing on-disk record was reused (no network call). */
+    reused: boolean;
+    record: MachineRecord;
+}
+/**
+ * Decode the `exp` claim of a JWT without verifying the signature.
+ * We're not using this for AuthN — only for "should we re-register
+ * proactively". The backend is the source of truth on validity; if our
+ * cheap pre-check is wrong, the WS handshake will reject and we'll fall
+ * through to a full re-register on the next `spectral serve`.
+ *
+ * Returns `null` if the token isn't a parseable JWT or has no `exp`.
+ */
+export declare function decodeJwtExp(jwt: string): number | null;
+/** True when the JWT is past expiry (with skew). Treats undecodable as expired. */
+export declare function isJwtExpired(jwt: string, skewSec?: number): boolean;
+/**
+ * Ensure a machine is registered. Returns the record either from the cached
+ * `machine.json` (when the JWT is still fresh) or from a freshly issued one.
+ *
+ * Re-registration triggers:
+ *   - No `machine.json` on disk (first run).
+ *   - The cached JWT is expired or near-expired.
+ *
+ * Why we don't re-register on `--machine-name` change: the CLI flag controls
+ * the *next* registration's display name, but switching it shouldn't burn a
+ * fresh `machineId` on every restart. If users want a clean break they can
+ * delete `machine.json`.
+ */
+export declare function ensureMachineRegistered(deps: RegistrationDeps): Promise<RegisterResponse>;
+//# sourceMappingURL=registration.d.ts.map

package/dist/relay/registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registration.d.ts","sourceRoot":"","sources":["../../src/relay/registration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAElF,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvD;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,SAAK,GAAG,OAAO,CAI/D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,gBAAgB,CAAC,CAyF3B"}

package/dist/sdk/agent-core/agent-loop.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Agent loop that works with AgentMessage throughout.
+ * Transforms to Message[] only at the LLM call boundary.
+ */
+import { EventStream } from "../ai/index.js";
+import type { AgentContext, AgentEvent, AgentLoopConfig, AgentMessage, StreamFn } from "./types.js";
+export type AgentEventSink = (event: AgentEvent) => Promise<void> | void;
+/**
+ * Start an agent loop with a new prompt message.
+ * The prompt is added to the context and events are emitted for it.
+ */
+export declare function agentLoop(prompts: AgentMessage[], context: AgentContext, config: AgentLoopConfig, signal?: AbortSignal, streamFn?: StreamFn): EventStream<AgentEvent, AgentMessage[]>;
+/**
+ * Continue an agent loop from the current context without adding a new message.
+ * Used for retries - context already has user message or tool results.
+ *
+ * **Important:** The last message in context must convert to a `user` or `toolResult` message
+ * via `convertToLlm`. If it doesn't, the LLM provider will reject the request.
+ * This cannot be validated here since `convertToLlm` is only called once per turn.
+ */
+export declare function agentLoopContinue(context: AgentContext, config: AgentLoopConfig, signal?: AbortSignal, streamFn?: StreamFn): EventStream<AgentEvent, AgentMessage[]>;
+export declare function runAgentLoop(prompts: AgentMessage[], context: AgentContext, config: AgentLoopConfig, emit: AgentEventSink, signal?: AbortSignal, streamFn?: StreamFn): Promise<AgentMessage[]>;
+export declare function runAgentLoopContinue(context: AgentContext, config: AgentLoopConfig, emit: AgentEventSink, signal?: AbortSignal, streamFn?: StreamFn): Promise<AgentMessage[]>;
+//# sourceMappingURL=agent-loop.d.ts.map

package/dist/sdk/agent-core/agent-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-loop.d.ts","sourceRoot":"","sources":["../../../src/sdk/agent-core/agent-loop.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAGN,WAAW,EAIX,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,UAAU,EACV,eAAe,EACf,YAAY,EAIZ,QAAQ,EACR,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAEzE;;;GAGG;AACH,wBAAgB,SAAS,CACxB,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,QAAQ,GACjB,WAAW,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAiBzC;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,QAAQ,GACjB,WAAW,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAwBzC;AAED,wBAAsB,YAAY,CACjC,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,cAAc,EACpB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAgBzB;AAED,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,cAAc,EACpB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,YAAY,EAAE,CAAC,CAiBzB"}

package/dist/sdk/agent-core/agent.d.ts

@@ -0,0 +1,125 @@
+import { type ImageContent, type Message, type SimpleStreamOptions, type ThinkingBudgets, type Transport } from "../ai/index.js";
+import type { AfterToolCallContext, AfterToolCallResult, AgentEvent, AgentLoopTurnUpdate, AgentMessage, AgentState, BeforeToolCallContext, BeforeToolCallResult, QueueMode, StreamFn, ToolExecutionMode } from "./types.js";
+export type { QueueMode } from "./types.js";
+/** Options for constructing an {@link Agent}. */
+export interface AgentOptions {
+    initialState?: Partial<Omit<AgentState, "pendingToolCalls" | "isStreaming" | "streamingMessage" | "errorMessage">>;
+    convertToLlm?: (messages: AgentMessage[]) => Message[] | Promise<Message[]>;
+    transformContext?: (messages: AgentMessage[], signal?: AbortSignal) => Promise<AgentMessage[]>;
+    streamFn?: StreamFn;
+    getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+    onPayload?: SimpleStreamOptions["onPayload"];
+    onResponse?: SimpleStreamOptions["onResponse"];
+    beforeToolCall?: (context: BeforeToolCallContext, signal?: AbortSignal) => Promise<BeforeToolCallResult | undefined>;
+    afterToolCall?: (context: AfterToolCallContext, signal?: AbortSignal) => Promise<AfterToolCallResult | undefined>;
+    prepareNextTurn?: (signal?: AbortSignal) => Promise<AgentLoopTurnUpdate | undefined> | AgentLoopTurnUpdate | undefined;
+    steeringMode?: QueueMode;
+    followUpMode?: QueueMode;
+    sessionId?: string;
+    thinkingBudgets?: ThinkingBudgets;
+    transport?: Transport;
+    maxRetryDelayMs?: number;
+    toolExecution?: ToolExecutionMode;
+}
+/**
+ * Stateful wrapper around the low-level agent loop.
+ *
+ * `Agent` owns the current transcript, emits lifecycle events, executes tools,
+ * and exposes queueing APIs for steering and follow-up messages.
+ */
+export declare class Agent {
+    private _state;
+    private readonly listeners;
+    private readonly steeringQueue;
+    private readonly followUpQueue;
+    convertToLlm: (messages: AgentMessage[]) => Message[] | Promise<Message[]>;
+    transformContext?: (messages: AgentMessage[], signal?: AbortSignal) => Promise<AgentMessage[]>;
+    streamFn: StreamFn;
+    getApiKey?: (provider: string) => Promise<string | undefined> | string | undefined;
+    onPayload?: SimpleStreamOptions["onPayload"];
+    onResponse?: SimpleStreamOptions["onResponse"];
+    beforeToolCall?: (context: BeforeToolCallContext, signal?: AbortSignal) => Promise<BeforeToolCallResult | undefined>;
+    afterToolCall?: (context: AfterToolCallContext, signal?: AbortSignal) => Promise<AfterToolCallResult | undefined>;
+    prepareNextTurn?: (signal?: AbortSignal) => Promise<AgentLoopTurnUpdate | undefined> | AgentLoopTurnUpdate | undefined;
+    private activeRun?;
+    /** Session identifier forwarded to providers for cache-aware backends. */
+    sessionId?: string;
+    /** Optional per-level thinking token budgets forwarded to the stream function. */
+    thinkingBudgets?: ThinkingBudgets;
+    /** Preferred transport forwarded to the stream function. */
+    transport: Transport;
+    /** Optional cap for provider-requested retry delays. */
+    maxRetryDelayMs?: number;
+    /** Tool execution strategy for assistant messages that contain multiple tool calls. */
+    toolExecution: ToolExecutionMode;
+    constructor(options?: AgentOptions);
+    /**
+     * Subscribe to agent lifecycle events.
+     *
+     * Listener promises are awaited in subscription order and are included in
+     * the current run's settlement. Listeners also receive the active abort
+     * signal for the current run.
+     *
+     * `agent_end` is the final emitted event for a run, but the agent does not
+     * become idle until all awaited listeners for that event have settled.
+     */
+    subscribe(listener: (event: AgentEvent, signal: AbortSignal) => Promise<void> | void): () => void;
+    /**
+     * Current agent state.
+     *
+     * Assigning `state.tools` or `state.messages` copies the provided top-level array.
+     */
+    get state(): AgentState;
+    /** Controls how queued steering messages are drained. */
+    set steeringMode(mode: QueueMode);
+    get steeringMode(): QueueMode;
+    /** Controls how queued follow-up messages are drained. */
+    set followUpMode(mode: QueueMode);
+    get followUpMode(): QueueMode;
+    /** Queue a message to be injected after the current assistant turn finishes. */
+    steer(message: AgentMessage): void;
+    /** Queue a message to run only after the agent would otherwise stop. */
+    followUp(message: AgentMessage): void;
+    /** Remove all queued steering messages. */
+    clearSteeringQueue(): void;
+    /** Remove all queued follow-up messages. */
+    clearFollowUpQueue(): void;
+    /** Remove all queued steering and follow-up messages. */
+    clearAllQueues(): void;
+    /** Returns true when either queue still contains pending messages. */
+    hasQueuedMessages(): boolean;
+    /** Active abort signal for the current run, if any. */
+    get signal(): AbortSignal | undefined;
+    /** Abort the current run, if one is active. */
+    abort(): void;
+    /**
+     * Resolve when the current run and all awaited event listeners have finished.
+     *
+     * This resolves after `agent_end` listeners settle.
+     */
+    waitForIdle(): Promise<void>;
+    /** Clear transcript state, runtime state, and queued messages. */
+    reset(): void;
+    /** Start a new prompt from text, a single message, or a batch of messages. */
+    prompt(message: AgentMessage | AgentMessage[]): Promise<void>;
+    prompt(input: string, images?: ImageContent[]): Promise<void>;
+    /** Continue from the current transcript. The last message must be a user or tool-result message. */
+    continue(): Promise<void>;
+    private normalizePromptInput;
+    private runPromptMessages;
+    private runContinuation;
+    private createContextSnapshot;
+    private createLoopConfig;
+    private runWithLifecycle;
+    private handleRunFailure;
+    private finishRun;
+    /**
+     * Reduce internal state for a loop event, then await listeners.
+     *
+     * `agent_end` only means no further loop events will be emitted. The run is
+     * considered idle later, after all awaited listeners for `agent_end` finish
+     * and `finishRun()` clears runtime-owned state.
+     */
+    private processEvents;
+}
+//# sourceMappingURL=agent.d.ts.map

package/dist/sdk/agent-core/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../../src/sdk/agent-core/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,YAAY,EACjB,KAAK,OAAO,EAEZ,KAAK,mBAAmB,EAGxB,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EACX,oBAAoB,EACpB,mBAAmB,EAEnB,UAAU,EAEV,mBAAmB,EACnB,YAAY,EACZ,UAAU,EAEV,qBAAqB,EACrB,oBAAoB,EACpB,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAkE5C,iDAAiD;AACjD,MAAM,WAAW,YAAY;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,aAAa,GAAG,kBAAkB,GAAG,cAAc,CAAC,CAAC,CAAC;IACnH,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/F,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;IACnF,SAAS,CAAC,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,UAAU,CAAC,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC/C,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IACrH,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAClH,eAAe,CAAC,EAAE,CACjB,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,GAAG,mBAAmB,GAAG,SAAS,CAAC;IAChF,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,iBAAiB,CAAC;CAClC;AA4CD;;;;;GAKG;AACH,qBAAa,KAAK;IACjB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA+E;IACzG,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IAE7C,YAAY,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC/F,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;IACnF,SAAS,CAAC,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC7C,UAAU,CAAC,EAAE,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAC/C,cAAc,CAAC,EAAE,CACvB,OAAO,EAAE,qBAAqB,EAC9B,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IACxC,aAAa,CAAC,EAAE,CACtB,OAAO,EAAE,oBAAoB,EAC7B,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IACvC,eAAe,CAAC,EAAE,CACxB,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,GAAG,mBAAmB,GAAG,SAAS,CAAC;IAChF,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,0EAA0E;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAC3E,eAAe,CAAC,EAAE,eAAe,CAAC;IACzC,4DAA4D;IACrD,SAAS,EAAE,SAAS,CAAC;IAC5B,wDAAwD;IACjD,eAAe,CAAC,EAAE,MAAM,CAAC;IAChC,uFAAuF;IAChF,aAAa,EAAE,iBAAiB,CAAC;gBAE5B,OAAO,GAAE,YAAiB;IAoBtC;;;;;;;;;OASG;IACH,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,MAAM,IAAI;IAKjG;;;;OAIG;IACH,IAAI,KAAK,IAAI,UAAU,CAEtB;IAED,yDAAyD;IACzD,IAAI,YAAY,CAAC,IAAI,EAAE,SAAS,EAE/B;IAED,IAAI,YAAY,IAAI,SAAS,CAE5B;IAED,0DAA0D;IAC1D,IAAI,YAAY,CAAC,IAAI,EAAE,SAAS,EAE/B;IAED,IAAI,YAAY,IAAI,SAAS,CAE5B;IAED,gFAAgF;IAChF,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIlC,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAIrC,2CAA2C;IAC3C,kBAAkB,IAAI,IAAI;IAI1B,4CAA4C;IAC5C,kBAAkB,IAAI,IAAI;IAI1B,yDAAyD;IACzD,cAAc,IAAI,IAAI;IAKtB,sEAAsE;IACtE,iBAAiB,IAAI,OAAO;IAI5B,uDAAuD;IACvD,IAAI,MAAM,IAAI,WAAW,GAAG,SAAS,CAEpC;IAED,+CAA+C;IAC/C,KAAK,IAAI,IAAI;IAIb;;;;OAIG;IACH,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,kEAAkE;IAClE,KAAK,IAAI,IAAI;IAUb,8EAA8E;IACxE,MAAM,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAC7D,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWnE,oGAAoG;IAC9F,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IA6B/B,OAAO,CAAC,oBAAoB;YAmBd,iBAAiB;YAgBjB,eAAe;IAY7B,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,gBAAgB;YA6BV,gBAAgB;YAyBhB,gBAAgB;IAkB9B,OAAO,CAAC,SAAS;IAQjB;;;;;;OAMG;YACW,aAAa;CAgD3B"}