@agentconnect.md/daemon 1.0.1 → 1.1.0-rc.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentconnect.md/daemon",
-  "version": "1.0.1",
+  "version": "1.1.0-rc.1",
   "description": "AgentConnect daemon — edge message + agent execution unit",
   "license": "Apache-2.0",
   "type": "module",

package/dist/dist-Bv1W3Nap.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dist-Bv1W3Nap.js","names":["z.object","z.literal","z.string","z.unknown","z.number","z.object","z.string","z\n        .object","z.number","z.boolean","z.enum","z.object","z.string","z.discriminatedUnion","z.literal","z.array","z.boolean","z.number","z.unknown","z.union","z.object","z.enum","z.string","z.boolean","z.number","z.object","z.string","z.number","z.enum","z.discriminatedUnion","z.object","z.literal","z.string","z\n    .object","z.enum","z.array","z.boolean","z.discriminatedUnion","z.object","z.literal","z.string","z.enum","z.boolean","z.record","z.array","z.object","z.string","z.enum","z.array","z.number","z.object","z.string","z.array","z.boolean","z.number","z.string","z.enum","z.object","z\n    .object","z.number","z.boolean","z\n    .string","z.discriminatedUnion","z.literal","z.array","z.enum","z.object","z.string","z.array","z.literal","z.boolean","z.number","z.object","z.number","z.string","z.array","z.unknown","z.boolean","z.object","z.string","z.enum","z.array","z.object","z.string","z.enum","z.number","z.boolean","z.array","z.object","z.string","z.number","z.boolean","z.array","z.object","z.number","z.enum","z.array","z.string","z.boolean","z.record","z.unknown","z.enum","z.object","z.string","z.boolean","z.record","z.unknown","z.object","z.boolean","z.string","z.enum","z.discriminatedUnion","z.literal","z.number","z.array","z\n    .object","z.object","z.literal","z.string","z.discriminatedUnion","z.object","z.enum","z.string","z.number","z.boolean","z\n    .object","z.discriminatedUnion","z.literal","z\n        .object","z.array","z.object","z.string","z.discriminatedUnion","z.literal","z.boolean","z.number","z.enum","z.array"],"sources":["../../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/compat.js","../../protocol/dist/envelope.js","../../protocol/dist/frames/auth.js","../../protocol/dist/frames/route.js","../../protocol/dist/frames/cron.js","../../protocol/dist/frames/secrets.js","../../protocol/dist/frames/integration.js","../../protocol/dist/frames/agent.js","../../protocol/dist/frames/collab.js","../../protocol/dist/frames/register.js","../../protocol/dist/frames/hook.js","../../protocol/dist/frames/gitcred.js","../../protocol/dist/frames/session.js","../../protocol/dist/frames/channel.js","../../protocol/dist/frames/workspace.js","../../protocol/dist/frames/memory.js","../../protocol/dist/frames/telemetry.js","../../protocol/dist/frames/error.js","../../protocol/dist/frames/webchat.js","../../protocol/dist/frame.js","../../protocol/dist/wire.js","../../protocol/dist/codec.js","../../protocol/dist/frames/relay-cp.js","../../protocol/dist/frames/relay-daemon.js","../../protocol/dist/git-url.js","../../protocol/dist/index.js"],"sourcesContent":["// Zod 3 compat layer\nimport * as core from \"../core/index.js\";\n/** @deprecated Use the raw string literal codes instead, e.g. \"invalid_type\". */\nexport const ZodIssueCode = {\n    invalid_type: \"invalid_type\",\n    too_big: \"too_big\",\n    too_small: \"too_small\",\n    invalid_format: \"invalid_format\",\n    not_multiple_of: \"not_multiple_of\",\n    unrecognized_keys: \"unrecognized_keys\",\n    invalid_union: \"invalid_union\",\n    invalid_key: \"invalid_key\",\n    invalid_element: \"invalid_element\",\n    invalid_value: \"invalid_value\",\n    custom: \"custom\",\n};\nexport { $brand, config } from \"../core/index.js\";\n/** @deprecated Use `z.config(params)` instead. */\nexport function setErrorMap(map) {\n    core.config({\n        customError: map,\n    });\n}\n/** @deprecated Use `z.config()` instead. */\nexport function getErrorMap() {\n    return core.config().customError;\n}\n/** @deprecated Do not use. Stub definition, only included for zod-to-json-schema compatibility. */\nexport var ZodFirstPartyTypeKind;\n(function (ZodFirstPartyTypeKind) {\n})(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));\n","import { z } from 'zod';\n/**\n * The protocol envelope — every frame, both directions, is wrapped in this.\n * Mirrors daemon-cp-ws-protocol.md §1.1.\n *\n * `payload` is left as `unknown` here and validated by the per-type schema in\n * `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is\n * what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)\n * instead of a hard close — forward-compat, protocol §1.\n */\nexport const Envelope = z.object({\n    v: z.literal(1), // protocol major; bump = breaking\n    id: z.string().uuid(), // unique per frame (sender-generated)\n    ts: z.string().datetime(), // RFC3339, sender clock (advisory only)\n    type: z.string(), // frame discriminator, e.g. \"register\"\n    corr: z.string().uuid().optional(), // correlation: set on a reply to the request's `id`\n    payload: z.unknown() // validated by the per-type schema\n});\n/**\n * Control-frame envelope extension — protocol §4.2.\n *\n * Fenced C→D frames carry this block alongside `payload`. It is the fencing\n * surface: `epoch` (sessionEpoch this frame was issued under), the `agentId` an\n * agent-scoped frame belongs to, and the `launchId` fence. Daemon validation\n * order: epoch → launchId.\n */\nexport const ControlExt = z.object({\n    epoch: z.number().int(), // sessionEpoch this frame was issued under (§3.1 fencing)\n    agentId: z.string().uuid().optional(), // present on agent-scoped frames\n    launchId: z.string().uuid().optional() // per-launch fence, §4.4\n});\n/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */\nexport const NIL_UUID = '00000000-0000-0000-0000-000000000000';\n/**\n * Builds the envelope schema for one frame `type` — the `type` literal plus the\n * typed payload — so a wire's discriminated union infers `payload` precisely.\n * Shared by the daemon↔CP union (`frame.ts`) and the relay wire unions\n * (`frames/relay-cp.ts` / `frames/relay-daemon.ts`), which are deliberately\n * SEPARATE unions over the same envelope shape (shared-bot-relay.md §8).\n */\nexport function frameSchema(type, payload) {\n    return z.object({\n        v: z.literal(1),\n        id: z.string().uuid(),\n        ts: z.string().datetime(),\n        type: z.literal(type),\n        corr: z.string().uuid().optional(),\n        payload\n    });\n}\n//# sourceMappingURL=envelope.js.map","import { z } from 'zod';\n/**\n * Auth & identity — protocol §3.1 / §3.2.\n *\n * `auth` is the first frame after the socket opens. `auth/ok` carries the\n * minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the\n * resume verdict.\n */\nexport const AuthReq = z.object({\n    // Long-lived, revocable API key — a bare opaque `<secret><crc>`, hashed at rest and looked up\n    // by that unique hash (see docs/designs/daemon-api-key-auth.md). The only daemon credential.\n    apiKey: z.string(),\n    // Optional echo of the daemonId. If present it must equal the daemonId the ApiKey row\n    // resolves to; otherwise the daemon adopts the authoritative id from `auth/ok`.\n    daemonId: z.string().uuid().optional(),\n    machineId: z.string().uuid().optional(), // 🅼 machine identity (scope-attestation, §3.2) — NOT the auth credential\n    attestation: z.string().optional(), // 🅼 signed proof (JWS), §3.2\n    agentVersion: z.string(), // daemon build/version\n    resume: z\n        .object({\n        lastEpoch: z.number().int() // sessionEpoch the daemon last held\n    })\n        .optional()\n});\nexport const AuthOk = z.object({\n    daemonId: z.string().uuid(),\n    sessionEpoch: z.number().int(), // monotonic; bumped each successful (re)auth — fencing token\n    heartbeatSec: z.number().int(), // cadence the daemon must emit heartbeat at\n    serverTime: z.string().datetime(),\n    // Base URL of the Web App console (the CP's own public origin), so the daemon can build\n    // session deep links without local config. Omitted when the CP has no console URL\n    // configured; a daemon-local `webAppUrl` overrides it.\n    webAppUrl: z.string().optional(),\n    // Slug of the org this daemon's api key belongs to. The console is org-scoped\n    // (`<webAppUrl>/<orgSlug>/sessions/<id>`), so the daemon needs it to build a link that\n    // resolves. Omitted when the CP can't resolve it; then the daemon drops the segment.\n    orgSlug: z.string().optional(),\n    resume: z\n        .object({\n        accepted: z.boolean() // false ⇒ daemon must do a full register reconcile\n    })\n        .optional()\n});\n//# sourceMappingURL=auth.js.map","import { z } from 'zod';\n/**\n * Routing & orchestration (C→D control) — protocol §5.\n *\n * `SessionKey` is the canonical session primitive shared across route/*,\n * agent/*, and event/session. Its canonical string form is\n * `${platform}:${channel}:${thread ?? \"-\"}`.\n */\n// `webchat` and `hook` are session-identity platforms only (the Playground\n// conversation / a webhook trigger's session) — no integration, no bind rules,\n// no routing-table participation, never a persisted DB Platform.\nexport const Platform = z.enum(['slack', 'telegram', 'webchat', 'discord', 'hook']);\nexport const SessionKey = z.object({\n    platform: Platform,\n    channel: z.string(),\n    thread: z.string().optional() // absent = channel-root\n});\n/** Trigger-matching rule for a binding (protocol §5.1). */\nexport const BindRule = z.object({\n    match: z.discriminatedUnion('kind', [\n        z.object({ kind: z.literal('mention') }),\n        z.object({ kind: z.literal('dm') }),\n        z.object({ kind: z.literal('keyword'), value: z.string() }),\n        z.object({ kind: z.literal('auto') }) // alert-channel auto-handle\n    ])\n});\nexport const RouteAssign = z.object({\n    // also appears in RegisterOk.assignments[]\n    sessionKey: SessionKey,\n    agentId: z.string().uuid(),\n    workspaceId: z.string().uuid(), // which D9 workspace to prepare\n    bindRules: z.array(BindRule).default([])\n});\nexport const RouteAssignAck = z.object({\n    ok: z.boolean(),\n    sessionKey: SessionKey,\n    reason: z.string().optional()\n});\nexport const RouteUpdate = z.object({\n    routingEpoch: z.number().int(),\n    rules: z.array(z.object({ match: z.unknown(), agentId: z.string().uuid() }))\n});\n/** Graceful scale-down / rebalance — protocol §5.3. */\nexport const Drain = z.object({\n    scope: z.union([\n        z.object({ kind: z.literal('agent'), agentId: z.string().uuid() }),\n        z.object({ kind: z.literal('daemon') }), // whole-daemon drain (shutdown/upgrade)\n        z.object({ kind: z.literal('session'), sessionKey: SessionKey })\n    ]),\n    deadline: z.string().datetime() // hard cutoff; in-flight turns past this are cancelled\n});\nexport const DrainProgress = z.object({\n    remaining: z.number().int(),\n    drained: z.array(SessionKey)\n});\nexport const DrainDone = z.object({\n    released: z.array(SessionKey) // CP may now reassign — fenced by new epoch\n});\n//# sourceMappingURL=route.js.map","import { z } from 'zod';\n/**\n * Cron sinks to the daemon (D5) — protocol §5.4.\n *\n * A cron periodically triggers ONE AGENT with a synthetic prompt (`trigger`) to\n * carry out some work. The CP owns the definition; the daemon owns firing +\n * last-run persistence, so crons fire even when the CP is down. On receipt the\n * daemon persists the def into the owning agent's `agent.json` `crons[]` (the\n * single source of truth, same model as integrations) — surviving a restart\n * with the CP down.\n *\n * `target` is OPTIONAL output routing: when present, the daemon posts the\n * trigger as a real message in that channel and the agent's session replies in\n * its thread; when absent the fire is headless (the agent works with no\n * platform output).\n */\nexport const CronTarget = z.object({\n    platform: z.enum(['slack', 'telegram', 'discord']).default('slack'),\n    channel: z.string(),\n    // The agent integration whose connection posts the anchor — targets come from\n    // the owning agent's integrations, so the daemon posts through the right bot\n    // when the agent has several. Absent (legacy defs) ⇒ first integration.\n    integrationId: z.string().uuid().optional()\n});\nexport const CronUpsert = z.object({\n    cronId: z.string().uuid(),\n    agentId: z.string().uuid(), // the agent this cron drives — routes the def to its daemon\n    schedule: z.string(), // croner expression (tz-aware)\n    target: CronTarget.optional(), // absent ⇒ headless fire\n    trigger: z.string(), // synthetic prompt text injected on fire\n    enabled: z.boolean().default(true)\n});\nexport const CronRemove = z.object({\n    cronId: z.string().uuid()\n});\n/**\n * `cron/report` (D→C EVT, fire-and-forget) — one CP-owned cron fired. The\n * daemon stamps the fire into its local store first (it stays authoritative,\n * §5.4) and reports it here so the console's `lastRunAt` converges; the CP\n * upsert is latest-wins, so the daemon re-asserting its stored stamps on\n * reconnect (fires while the CP was unreachable) is idempotent and can never\n * regress the value. Hand-authored (no-origin) crons are never reported.\n *\n * Two reports per fire, keyed by `(cronId, firedAt)`: the FIRE report (no\n * `status`) opens the run, and the COMPLETION report (with `status` + outcome\n * fields) closes it once the dispatched turn ends — feeding the console's\n * per-schedule run history. A completion without a prior fire report (CP was\n * down at fire time) still creates the run row.\n */\nexport const CronRunStatus = z.enum(['success', 'failed']);\nexport const CronReport = z.object({\n    cronId: z.string().uuid(),\n    agentId: z.string().uuid(), // the owning agent — scopes the report to its daemon\n    firedAt: z.string().datetime(),\n    // Completion-only outcome fields (absent on the fire report / legacy daemons).\n    status: CronRunStatus.optional(),\n    durationMs: z.number().int().nonnegative().optional(), // fire → turn end\n    sessionId: z.string().optional(), // ACP session the run prompted (console deep-link)\n    reason: z.string().optional() // short failure text (status \"failed\")\n});\n/**\n * `cron/run` (C→D REQ → ack) — fire one CP-owned cron NOW (console \"Run now\").\n * The daemon accepts (`ok:true`) and runs the fire asynchronously — outcome\n * arrives as normal `cron/report`s; `ok:false` when it holds no such cron.\n */\nexport const CronRunNow = z.object({\n    cronId: z.string().uuid()\n});\n//# sourceMappingURL=cron.js.map","import { z } from 'zod';\nimport { Platform } from './route.js';\n/**\n * Secrets (C5 ↔ D10) — protocol §6.\n *\n * Lease-based, no plaintext on the wire or in PG. Every frame carries a\n * REFERENCE to a Vault/KMS path, never the secret material itself.\n */\nexport const SecretsRequest = z.object({\n    // D→C, REQ — daemon asks for a lease at session start\n    scope: z.object({\n        platform: Platform,\n        workspaceId: z.string().uuid()\n    })\n});\nexport const SecretsGrant = z.object({\n    // C→D, REP (also in RegisterOk.leases[])\n    leaseId: z.string().uuid(),\n    scope: z.object({\n        platform: z.string(),\n        workspaceId: z.string().uuid()\n    }),\n    ref: z.string(), // Vault/KMS path or handle — NOT the secret\n    ttl: z.number().int(), // seconds\n    renewBeforeSec: z.number().int() // daemon should renew this many sec before expiry\n});\nexport const SecretsRenew = z.object({\n    leaseId: z.string().uuid() // D→C REQ → new SecretsGrant\n});\nexport const SecretsRevoke = z.object({\n    leaseId: z.string().uuid(),\n    reason: z.string() // C→D EVT (hot revoke)\n});\n/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */\nexport const ScopeAttestation = z.object({\n    machineId: z.string().uuid(),\n    scope: z.enum(['attachment.put', 'attachment.get', 'facts.put']),\n    resourceRef: z.string(), // opaque object key/prefix\n    jws: z.string(), // signed capability the store verifies offline\n    exp: z.string().datetime()\n});\n//# sourceMappingURL=secrets.js.map","import { z } from 'zod';\n/**\n * Platform integration distribution (C→D) — the Slack \"install\" flow.\n *\n * The Control Plane is the source of truth for platform integrations and pushes\n * them to the daemon that owns the integration's agent (`integration/upsert`, and\n * the reconcile snapshot `RegisterOk.integrations[]`). The daemon opens the Socket\n * Mode connection from the delivered config (see slack/connection.ts).\n *\n * SECURITY: `integration/upsert` and `RegisterOk.integrations[]` carry PLAINTEXT\n * platform tokens (botToken/appToken). These payloads MUST NEVER be logged — no\n * body dump on decode error, no register/ok snapshot debug dump. The daemon\n * persists them into the owning agent's local `agent.json` (same trust boundary\n * as hand-authored agents, which already keep tokens there) so integrations\n * survive a restart with the CP down.\n *\n * `signingSecret` is intentionally absent: Socket Mode authenticates with the\n * app-level token, so the daemon never needs a signing secret.\n */\n/** Trigger match — mirrors the daemon BindRuleConfig.match (agents/agent-schema.ts). */\nexport const BindMatch = z.discriminatedUnion('kind', [\n    z.object({ kind: z.literal('mention') }),\n    z.object({ kind: z.literal('dm') }),\n    z.object({ kind: z.literal('keyword'), value: z.string() }),\n    z.object({ kind: z.literal('auto') })\n]);\n/** One channel/thread trigger binding — mirrors the daemon BindRuleConfig. */\nexport const IntegrationBindRule = z.object({\n    channel: z.string().optional(), // absent = any channel\n    thread: z.string().optional(),\n    match: BindMatch\n});\n/**\n * The Slack config a daemon receives (no signingSecret). `mode` splits the two\n * distribution paths of shared-bot-relay.md §7.3:\n *\n *  - `direct` (today's behaviour, the default): the daemon owns the whole bot —\n *    it opens the Socket Mode connection itself (needs `appToken`) and arbitrates\n *    inbound locally (`bindRules`). Unchanged from before shared bots existed.\n *  - `shared`: the bot's INBOUND lives on a relay (§4.1), so the daemon gets\n *    xoxb ONLY — enough to SEND (`chat.postMessage`, attachment fetch). No\n *    `appToken` (credential domaining: the daemon must not be able to subscribe\n *    the event stream) and no `bindRules` (routing is arbitrated in the relay,\n *    delivered pre-addressed). `botUserId` is optional and lazily resolved by the\n *    daemon via `auth.test` (same as direct) if the sender ever needs it.\n *\n * Modeled as a flat object with a defaulted discriminator (not a\n * `discriminatedUnion`) so specs persisted before this field existed still decode\n * as `direct`. `.superRefine` enforces the one hard per-mode requirement the union\n * would otherwise give: direct needs the app-level token.\n */\nexport const IntegrationSlackConfig = z\n    .object({\n    mode: z.enum(['direct', 'shared']).default('direct'),\n    botToken: z.string(), // xoxb-…  (plaintext — never log) — always present (send path)\n    appToken: z.string().optional(), // xapp-… (plaintext — never log) — direct only (Socket Mode)\n    botUserId: z.string().optional(), // lazily resolved via auth.test; may be seeded by CP\n    allowedUserIds: z.array(z.string()).default([]),\n    bindRules: z.array(IntegrationBindRule).default([]) // empty for shared (relay arbitrates)\n})\n    .superRefine((c, ctx) => {\n    if (c.mode === 'direct' && !c.appToken)\n        ctx.addIssue({ code: z.ZodIssueCode.custom, message: 'direct slack requires appToken', path: ['appToken'] });\n});\n/**\n * The Telegram config the daemon needs to open long-polling + route (grammY).\n * Telegram has a SINGLE BotFather HTTP token — no app-level token and no signing\n * secret (long-polling authenticates every getUpdates call with the bot token).\n */\nexport const IntegrationTelegramConfig = z.object({\n    botToken: z.string(), // BotFather \"123456:ABC…\"  (plaintext — never log)\n    allowedUserIds: z.array(z.string()).default([]),\n    bindRules: z.array(IntegrationBindRule).default([])\n});\n/**\n * The Discord config the daemon needs to open the Gateway + route (discord.js).\n * Discord authenticates the Gateway with a SINGLE bot token — no Slack-style\n * app-level token and no signing secret. `applicationId` is public metadata (the\n * client id for the OAuth2 bot-invite URL); it is not secret material.\n */\nexport const IntegrationDiscordConfig = z.object({\n    botToken: z.string(), // Bot <token>  (plaintext — never log)\n    applicationId: z.string().optional(), // client/application id — public, for the invite URL\n    allowedUserIds: z.array(z.string()).default([]),\n    bindRules: z.array(IntegrationBindRule).default([])\n});\n/**\n * One platform integration, owned by exactly one agent. Also the element type of\n * `RegisterOk.integrations[]` (the per-daemon reconcile set). Discriminated on\n * `platform`: the daemon opens a Slack Socket Mode connection, a Telegram\n * long-poll, or a Discord Gateway from whichever variant is delivered.\n */\nexport const IntegrationSpec = z.discriminatedUnion('platform', [\n    z.object({\n        integrationId: z.string().uuid(),\n        agentId: z.string().uuid(),\n        platform: z.literal('slack'),\n        slack: IntegrationSlackConfig\n    }),\n    z.object({\n        integrationId: z.string().uuid(),\n        agentId: z.string().uuid(),\n        platform: z.literal('telegram'),\n        telegram: IntegrationTelegramConfig\n    }),\n    z.object({\n        integrationId: z.string().uuid(),\n        agentId: z.string().uuid(),\n        platform: z.literal('discord'),\n        discord: IntegrationDiscordConfig\n    })\n]);\n/** C→D EVT — install/update an integration on the owning agent's daemon. */\nexport const IntegrationUpsert = IntegrationSpec;\n/** C→D EVT — remove an integration from the daemon. */\nexport const IntegrationRemove = z.object({\n    integrationId: z.string().uuid()\n});\n/** One channel the bot is currently a member of (metadata only — no messages). */\nexport const IntegrationChannel = z.object({\n    id: z.string(), // platform channel id (Slack \"C…\")\n    name: z.string().optional(), // \"#deploys\" without the hash; absent if lookup failed\n    isPrivate: z.boolean().optional()\n});\n/**\n * D→C EVT — the FULL set of channels the integration's bot is a member of\n * (fire-and-forget, latest-wins). Emitted on socket start and whenever the bot\n * is invited to / removed from a channel, so the console can offer per-channel\n * trigger config. Channel names are control metadata, never message content.\n */\nexport const IntegrationChannels = z.object({\n    integrationId: z.string().uuid(),\n    channels: z.array(IntegrationChannel)\n});\n//# sourceMappingURL=integration.js.map","import { z } from 'zod';\nimport { IntegrationSpec } from './integration.js';\nimport { CronUpsert } from './cron.js';\n/**\n * Agent lifecycle (protocol §4.4, §7.4, §8).\n *\n * There is no CP→daemon prompt-delivery frame: the daemon prompts an agent from\n * its own ingress (platform adapters, and webchat over its own `webchat/*`\n * frames), never the CP. The old `agent/prompt` + per-agent `seq` machinery was\n * reserved infrastructure with no live caller and has been removed.\n */\n/**\n * Where the agent runs. Two modes; the **path is always daemon-generated** —\n * never specified by the caller (UX picks the mode, the machine owns the dir).\n *\n * - `scratch`: a fresh empty working dir on the machine, no repo.\n * - `github`: the daemon clones `gitRepo` @ `branch` and runs the agent in\n *   `agentDir` (a subdir of the repo, repo-root if omitted). **Multiple agents\n *   may share one repo** — they differ by `agentDir`, so the repo is not an\n *   owned entity, just shared config on each agent.\n */\nexport const AgentWorkspace = z.discriminatedUnion('mode', [\n    z.object({ mode: z.literal('scratch') }),\n    z.object({\n        mode: z.literal('github'),\n        gitRepo: z.string(), // FULL cloneable address, e.g. https://github.com/acme/infra (normalizeGitUrl)\n        branch: z.string().default('main'),\n        agentDir: z.string().optional(), // subdir within the repo; omitted ⇒ repo root\n        // Credential mode for remote git ops. Absent ⇒ anonymous (public repos,\n        // the pre-github-app behavior). 'github-app' ⇒ the daemon pulls short-lived\n        // CP-minted installation tokens over gitcred/request and injects them via\n        // the local credential helper — no durable git credential on the host.\n        gitCredential: z.enum(['github-app']).optional()\n    })\n]);\n/**\n * MCP-server name reserved for the daemon's own injected stdio bridge (its\n * platform tools). A config-defined or agent-enabled server under this name\n * would collide with the bridge entry at ACP `session/new`, so the daemon\n * strips it and the CP rejects it in `AgentSpec.mcpServers` at the API edge.\n */\nexport const RESERVED_MCP_SERVER_NAME = 'agentconnect';\n/**\n * The curated Lucide glyph set a `glyph` icon may use — the single source of\n * truth for the picker, the DTO validation, and the CP icon-endpoint renderer.\n * `glyph` is constrained to this set so an API/CLI-created icon can't persist a\n * name the console `<Icon>` and the PNG endpoint don't both render. The web\n * picker mirrors this list (it does not import this package) — keep in sync.\n */\nexport const AGENT_ICON_GLYPHS = [\n    'bot',\n    'cpu',\n    'terminal',\n    'code',\n    'rocket',\n    'zap',\n    'bug',\n    'git-branch',\n    'message-square',\n    'sparkles',\n    'brain',\n    'wrench',\n    'ship',\n    'box',\n    'hexagon',\n    'compass'\n];\n/**\n * An agent's display icon (docs: the Console \"Agent Avatar\" picker). A\n * discriminated union on `kind`:\n *  - `runtime` — derive the mark from the agent's runtime (Claude/Codex/…), the\n *    legacy behavior; also the meaning of a null/absent icon.\n *  - `glyph`   — a curated Lucide glyph (see {@link AGENT_ICON_GLYPHS}) on a solid\n *    color plate (the create-time random default is a `glyph`). An unknown glyph\n *    fails to parse and degrades to the runtime mark on every surface.\n *  - `image`   — an external image referenced by its public https URL.\n * This descriptor is CP-owned + stored on the agent and surfaced to the web\n * console. The daemon never receives it — it gets only the resolved public\n * `AgentSpec.iconUrl` (for the Slack per-message avatar), so it needs no renderer.\n */\nexport const AgentIcon = z.discriminatedUnion('kind', [\n    z.object({ kind: z.literal('runtime') }),\n    z.object({ kind: z.literal('glyph'), glyph: z.enum(AGENT_ICON_GLYPHS), color: z.string() }),\n    z.object({ kind: z.literal('image'), url: z.string().url() })\n]);\n/**\n * The editable agent definition the CP owns and the daemon needs to run it:\n * prompt + runtime selection. Raft ships this in the launch config and the\n * daemon synthesizes the system prompt locally; `description` IS the prompt.\n */\nexport const AgentSpec = z.object({\n    name: z.string(),\n    // Human-readable bot name. CP snapshots/upserts always ship value or null so\n    // clearing it removes a stale daemon-local display name; absent remains\n    // available to hand-authored/partial specs as \"leave unchanged\".\n    displayName: z.string().nullable().optional(),\n    // Absolute, publicly-fetchable avatar URL the CP resolves from the agent's icon\n    // (agent.icon → the CP icon endpoint for runtime/glyph, or the image URL directly).\n    // The daemon uses it as the Slack per-message `icon_url` (chat:write.customize) —\n    // the sibling of displayName→username (PR #539). CP ships value or null so clearing\n    // the icon drops the override; null/absent ⇒ Slack keeps the app's default avatar.\n    iconUrl: z.string().url().nullable().optional(),\n    description: z.string().optional(), // the system prompt seed; appended to the daemon's standing prompt\n    runtime: z.string().optional(), // which ACP runtime to run, e.g. \"claude\" / \"codex\"\n    // Per-runtime override vocabularies (model / effort / permission mode). Switching\n    // runtime invalidates them, so the CP must be able to CLEAR them, not just set them:\n    //   absent ⇒ leave the on-disk value alone (hand-authored agent.json / partial spec)\n    //   null   ⇒ clear the override (revert to the runtime's own default)\n    //   string ⇒ set it\n    // The CP's agentRecordToSpec always ships these (value or null) so a clear replicates.\n    model: z.string().nullable().optional(), // runtime model, e.g. \"opus\"\n    reasoningEffort: z.string().nullable().optional(),\n    executionMode: z.string().optional(), // e.g. \"byoc\"\n    outputMode: z.enum(['low', 'medium', 'high']).optional(), // platform output verbosity → agent.json output.mode\n    fastMode: z.boolean().optional(), // runtime fast mode (ACP `model_config` toggle); absent ⇒ leave runtime default\n    permissionMode: z.string().nullable().optional(), // runtime permission/approval mode (ACP `mode` selector); absent ⇒ leave alone, null ⇒ clear\n    // Operational message-processing toggle (orthogonal to placement). When true the\n    // agent stays placed/connected but the daemon skips ALL turn dispatch (platform,\n    // webchat, cron). Optional (not defaulted) so an absent value leaves the on-disk\n    // agent.json pause untouched — same contract as fastMode/permissionMode.\n    pause: z.boolean().optional(),\n    workspace: AgentWorkspace.optional(), // where it runs; absent ⇒ daemon defaults to scratch\n    env: z.record(z.string(), z.string()).optional(), // extra env injected into the runtime\n    // Which memory backend the agent uses (design: docs/designs/memory-evolution.md):\n    //   managed  — our <agent-root>/memory/ directory (default)\n    //   native   — the runtime's own memory (Claude auto-memory / Codex memories),\n    //              redirected under the agent root for per-agent isolation\n    //   external — an outside service (mem0); not yet implemented\n    // Optional (absent ⇒ leave the on-disk agent.json value alone — same contract as\n    // fastMode/pause). A brand-new agent with no value defaults to managed daemon-side.\n    memory: z.object({ provider: z.enum(['native', 'managed', 'external']) }).optional(),\n    // Names of daemon-configured MCP servers (daemon config `mcpServers`, probed\n    // via `facts/daemon-runtimes`) to attach at `session/new`. Empty/absent ⇒ none.\n    mcpServers: z.array(z.string()).default([]),\n    // Agent→agent call authorization (design §2.5). `callPolicy` gates who may wake\n    // this agent via the `messageAgent` tool: 'all' ⇒ any peer in the org, 'selected'\n    // ⇒ only agents in `allowedCallerAgentIds`. Replicated CP→daemon so the daemon can\n    // enforce the policy LOCALLY on same-daemon delivery (no CP hop on the hot path).\n    // Optional (absent ⇒ leave the on-disk agent.json value alone — same contract as\n    // pause/memory); `allowedCallerAgentIds` always ships (even []) so removing the last\n    // allowed caller replicates.\n    callPolicy: z.enum(['all', 'selected']).optional(),\n    allowedCallerAgentIds: z.array(z.string()).default([])\n});\nexport const AgentLaunch = z.object({\n    // C→D, carries ControlExt(epoch)\n    agentId: z.string().uuid(),\n    runtime: z.string(), // must be in RegisterReq.capabilities.runtimes\n    workspaceId: z.string().uuid(),\n    capabilities: z.array(z.string()), // the active-capability pin (§8.1)\n    spec: AgentSpec, // prompt/model/env — arrives at start, no separate CRUD needed\n    mode: z.enum(['long_lived', 'per_turn']).default('long_lived') // 🅰️ decision #2 knob\n});\n/**\n * Live agent CRUD (C→D): the console edited an agent's spec; push it so a\n * running daemon reloads without waiting for the next launch. `agent/remove`\n * tears the agent down. Deleting an agent never relaunches it.\n */\nexport const AgentUpsert = z.object({\n    agentId: z.string().uuid(),\n    spec: AgentSpec\n});\nexport const AgentRemove = z.object({\n    agentId: z.string().uuid()\n});\n/**\n * Safe cold-move lifecycle (C→D REQ → generic `ack`). `agent/detach`\n * quiesces the agent and archives its daemon-local root; `agent/activate`\n * atomically applies the authoritative spec/integration/cron bundle, restores\n * and exact-prunes an archive when present, then makes the agent servable.\n */\nexport const AgentDetach = z.object({\n    agentId: z.string().uuid(),\n    /** Fences late lifecycle retries from a superseded move operation. */\n    moveId: z.string().uuid()\n});\nexport const AgentActivate = z.object({\n    agentId: z.string().uuid(),\n    moveId: z.string().uuid(),\n    /**\n     * One authoritative, acknowledged bootstrap bundle. Unlike the live CRUD\n     * EVTs, these definitions are synchronously persisted under the staging gate\n     * before activation can ACK, so a same-id stale secret/spec cannot survive.\n     */\n    spec: AgentSpec,\n    integrations: z.array(IntegrationSpec),\n    crons: z.array(CronUpsert)\n});\nexport const AgentLaunched = z.object({\n    // D→C, REP/EVT\n    agentId: z.string().uuid(),\n    launchId: z.string().uuid(), // new fence value\n    acpSessionId: z.string().optional(), // 🅰️ present iff long-lived ACP session (default)\n    startedAt: z.string().datetime(),\n    runtime: z.string() // e.g. \"claude\" / \"codex\"\n});\nexport const AgentStop = z.object({\n    agentId: z.string().uuid(),\n    launchId: z.string().uuid(),\n    reason: z.string()\n});\nexport const AgentActivity = z.object({\n    // D→C, EVT — activity-probe (§7.4)\n    agentId: z.string().uuid(),\n    launchId: z.string().uuid(),\n    state: z.enum(['thinking', 'tool_call', 'awaiting_permission', 'idle']),\n    ts: z.string().datetime()\n});\nexport const AgentScopeDenied = z.object({\n    // D→C, EVT — capability-scope audit (§8.1)\n    agentId: z.string().uuid(),\n    launchId: z.string().uuid(),\n    capability: z.string()\n});\n//# sourceMappingURL=agent.js.map","import { z } from 'zod';\nimport { Platform } from './route.js';\n/**\n * Bot-AGNOSTIC agent-collaboration routing snapshot (agent-collaboration §2.3 / §6.2 / §6.5).\n *\n * The existing shared-bot `members` table is keyed by botId (`BotAssignment`) and\n * CANNOT address an agent on a DIFFERENT bot / arbitrary channel. This snapshot is\n * the fix: it maps a channel — `(orgId, platform, channelId)` — to the per-agent\n * placement + call policy the relay needs to route a cross-daemon `rd/agentmsg` and\n * the target daemon needs to terminal-verify a remote caller.\n *\n * It carries NO message body — pure routing/policy metadata, like the rest of the\n * control plane. The SAME shape is distributed two ways (§6.5):\n *  - CP→relay over the `rc/*` wire (`rc/collab-routes`) — the relay routes\n *    `toAgentId` → owning `daemonId` and authorizes the caller/target policy.\n *  - CP→daemon over the daemon↔CP wire — as a `register/ok` field (reconnect\n *    baseline) + a `collaboration/routes` EVT (hot push) — so the OWNING daemon of\n *    the target can terminal-verify (defense in depth, §2.5 #4) the remote caller's\n *    org/channel/placement against its OWN copy, never trusting the relay's claim\n *    blindly.\n *\n * FOLLOW-UP (scoped down in P2, see PR description): the full versioned lifecycle\n * of §6.5 — per-entry tombstones, TTL/expiry after a CP disconnect, and\n * fail-closed-on-stale — is NOT fully implemented here. `generation` is present as\n * the version hook and the snapshot is FULL-REPLACE (converge-don't-diff, same as\n * `register/ok`), which is enough to route + authorize on a live CP. TTL-expiry and\n * tombstone semantics are a follow-up within this phase.\n */\n/** One agent's placement + call policy within a channel. `daemonId` is the owning\n *  daemon the relay forwards to; `integrationId` is the DEFINITE reply integration\n *  (§6.2 — no fallback to \"first connection\"). */\nexport const CollabAgentPlacement = z.object({\n    agentId: z.string().uuid(),\n    daemonId: z.string().uuid(),\n    integrationId: z.string().uuid().optional(),\n    callPolicy: z.enum(['all', 'selected']).default('all'),\n    allowedCallerAgentIds: z.array(z.string()).default([])\n});\n/** All agents present in one channel, across daemons. `orgId` scopes routing +\n *  authorization: a cross-org caller/target pair never resolves (§2.5 — cross-org\n *  rejected). */\nexport const CollabChannelRoute = z.object({\n    // Org ids are opaque strings (Prisma uses cuid(); the seeded dev org uses\n    // `org_default...`), unlike daemon/agent/integration ids which are UUIDs.\n    orgId: z.string().min(1),\n    platform: Platform,\n    channelId: z.string().min(1),\n    agents: z.array(CollabAgentPlacement)\n});\n/**\n * The full collaboration snapshot — FULL-REPLACE (converge-don't-diff): the\n * recipient replaces its whole table with `channels`. `generation` monotonically\n * increases per source so a recipient can ignore a stale re-order (version hook for\n * the §6.5 lifecycle follow-up).\n */\nexport const CollabRoutesSnapshot = z.object({\n    generation: z.number().int().nonnegative().default(0),\n    channels: z.array(CollabChannelRoute).default([])\n});\n//# sourceMappingURL=collab.js.map","import { z } from 'zod';\nimport { Platform, RouteAssign } from './route.js';\nimport { CronUpsert } from './cron.js';\nimport { SecretsGrant } from './secrets.js';\nimport { AgentSpec } from './agent.js';\nimport { IntegrationSpec } from './integration.js';\nimport { CollabRoutesSnapshot } from './collab.js';\n/**\n * Capability upload + the reconcile snapshot — protocol §3.3.\n *\n * `register/ok` is the authoritative source of truth: the daemon converges its\n * local cache to it. CP wins all conflicts, so re-issuing the same snapshot is\n * idempotent.\n */\nexport const RegisterReq = z.object({\n    host: z.string(), // hostname (display only)\n    capabilities: z.object({\n        platforms: z.array(Platform), // D3 adapters present\n        runtimes: z.array(z.string()), // e.g. [\"claude\",\"codex\"]\n        acp: z.boolean(), // can this daemon host ACP sessions (D6)?\n        features: z.array(z.string()).default([]) // e.g. [\"cli-wrapper-fallback\",\"worktree-iso\"]\n    }),\n    maxAgents: z.number().int(), // concurrency ceiling for placement (C3)\n    localState: z.object({\n        // what the daemon currently believes it owns (for reconcile)\n        assignments: z.array(z.string()), // sessionKeys it is actively serving\n        crons: z.array(z.string()), // cronIds it has scheduled\n        leases: z.array(z.string()) // leaseIds it holds\n    })\n});\n/**\n * One relay the daemon SHOULD hold an outbound WS to (shared-bot-relay.md §5).\n * The roster is all-to-all by design: a webchat/webhook landing on ANY relay\n * instance must find this daemon's connection without cross-instance forwarding.\n * That only holds if `url` (the relay's registered `daemonUrl`) routes to that\n * SPECIFIC instance — the daemon confirms the landing spot against\n * `rd/hello/ok.relayId` and treats a mismatch as a deployment misroute.\n */\nexport const RelayRosterEntry = z.object({\n    relayId: z.string().uuid(),\n    url: z.string() // the relay's daemonUrl — per-instance routable, never a pool LB\n});\n/**\n * C→D EVT (`relay/roster`) — hot roster update (relay registered / swept).\n * Carries the WHOLE desired set, same converge-don't-diff semantics as the\n * `register/ok.relays` snapshot it refreshes.\n */\nexport const RelayRosterUpdate = z.object({\n    relays: z.array(RelayRosterEntry)\n});\nexport const RegisterOk = z.object({\n    routingEpoch: z.number().int(), // version of the routing table this snapshot reflects\n    // CP protocol capabilities. Default keeps a new daemon compatible with an\n    // older CP during rolling deploys; old daemons ignore this additive field.\n    serverFeatures: z.array(z.string()).default([]),\n    // Authoritative reconcile snapshot — daemon converges its local cache to this:\n    assignments: z.array(RouteAssign), // the route/assign set the daemon SHOULD own\n    agents: z.array(AgentSpec.extend({ agentId: z.string().uuid() })).default([]), // spec set CP wants present; daemon converges\n    crons: z.array(CronUpsert), // the cron set it SHOULD run\n    // Platform integrations this daemon SHOULD hold — FILTERED to this daemon (never\n    // org-wide), since each element carries plaintext tokens. Never log this array.\n    integrations: z.array(IntegrationSpec).default([]),\n    leases: z.array(SecretsGrant), // secret leases it SHOULD hold\n    // Relay roster — the relays this daemon SHOULD dial (webchat ingress now;\n    // shared-bot/webhook with milestone B). Hot updates ride `relay/roster`;\n    // defaulted so a pre-relay CP's snapshot still parses.\n    relays: z.array(RelayRosterEntry).default([]),\n    // Bot-agnostic collaboration routing snapshot (agent-collaboration §2.3 / §6.5) —\n    // the reconnect BASELINE for this daemon's terminal-verify of REMOTE agent callers.\n    // Scoped to channels this daemon's agents participate in. Hot changes ride the\n    // `collaboration/routes` EVT. Defaulted so a pre-collab CP's snapshot still parses.\n    collabRoutes: CollabRoutesSnapshot.default({ generation: 0, channels: [] }),\n    drop: z.object({\n        // things in localState the CP says to release\n        assignments: z.array(z.string()),\n        crons: z.array(z.string())\n    })\n});\n//# sourceMappingURL=register.js.map","import { z } from 'zod';\n/** Decimal wire form for Prisma/GitHub bigint values. */\nexport const HookBigIntString = z.string().regex(/^(?:0|[1-9]\\d*)$/);\n/** The highest formal-review event one hook permits. */\nexport const HookReviewPolicy = z.enum(['off', 'comment', 'request_changes', 'full']);\n/** External run-reporting transport. `status` is reserved for the later R3. */\nexport const HookReportingMode = z.enum(['off', 'check', 'status']);\n/** R2a only admits informational; `required` remains a fail-closed future mode. */\nexport const HookGateMode = z.enum(['informational', 'required']);\n/**\n * Exact config + dispatch identity captured when the CP compiles a hook fire.\n *\n * The relay-facing frames expose these fields individually at top level so an\n * older CP/relay can omit them without making the whole fire undecodable. A\n * consumer MUST have every field before enabling review/reporting; absence is\n * not filled with a revision and therefore fails closed. Action-time RPCs use\n * this complete object so a partially rolled-out tuple cannot authorize an\n * effect.\n */\nexport const HookConfigSnapshot = z.object({\n    configRevision: HookBigIntString,\n    dispatchRevision: HookBigIntString,\n    dispatchDaemonId: z.string().uuid(),\n    reviewPolicy: HookReviewPolicy,\n    reportingMode: HookReportingMode,\n    gateMode: HookGateMode\n});\n/** Optional top-level form used only on rolling-compatible delivery frames. */\nexport const OptionalHookConfigSnapshot = HookConfigSnapshot.partial();\n/**\n * Trusted, body-free GitHub subject/revision metadata. It is deliberately\n * separate from HookContext: HookContext contains attacker-authored prompt\n * excerpts, whereas this object is cut from a signature-verified payload and\n * fenced to the CP-compiled numeric repo/installation rule.\n *\n * `headSha` is absent for PR issue_comment deliveries because GitHub omits the\n * revision there; the daemon resolves it before `hook/start`. R2a informational\n * checks use `reportSha=headSha` once known. Review-comment deliveries may also\n * identify the triggering comment and its normalized thread root; both remain\n * optional so mixed-version relay/daemon rollouts continue to decode.\n */\nexport const GithubHookMetadata = z\n    .object({\n    repoId: HookBigIntString,\n    repoFullName: z.string().min(1),\n    sourceInstallationId: HookBigIntString,\n    subjectKind: z.enum(['issue', 'pull_request']),\n    pullNumber: z.number().int().positive().optional(),\n    headSha: z.string().min(1).optional(),\n    baseSha: z.string().min(1).optional(),\n    reportSha: z.string().min(1).optional(),\n    headRepoFullName: z.string().min(1).optional(),\n    mergeCommitSha: z.string().min(1).optional(),\n    isDraft: z.boolean().optional(),\n    baseChanged: z.boolean().optional(),\n    reviewCommentId: HookBigIntString.optional(),\n    reviewThreadRootCommentId: HookBigIntString.optional()\n})\n    .superRefine((value, ctx) => {\n    if (value.subjectKind === 'pull_request' && value.pullNumber === undefined) {\n        ctx.addIssue({\n            code: 'custom',\n            path: ['pullNumber'],\n            message: 'pullNumber is required for a pull_request subject'\n        });\n    }\n    if (value.reportSha !== undefined && value.headSha === undefined) {\n        ctx.addIssue({\n            code: 'custom',\n            path: ['reportSha'],\n            message: 'reportSha requires an authoritative headSha'\n        });\n    }\n    if (value.reportSha !== undefined && value.headSha !== undefined && value.reportSha !== value.headSha) {\n        ctx.addIssue({\n            code: 'custom',\n            path: ['reportSha'],\n            message: 'R2a reports only the authoritative pull head SHA'\n        });\n    }\n});\nexport const HookReviewEvent = z.enum(['COMMENT', 'REQUEST_CHANGES', 'APPROVE']);\nexport const HookReviewVerdict = z.enum(['pass', 'fail', 'neutral']);\n/** Short machine code only; raw GitHub/runtime exception text never crosses to reporting. */\nconst HookReviewResultCode = z\n    .string()\n    .min(1)\n    .max(100)\n    .regex(/^[a-z0-9_:-]+$/);\n/**\n * Body-free outcome of one reserved formal-review attempt.\n *\n * `not_submitted` is only legal after a deterministic no-effect failure and\n * lets the CP release the reservation. An uncertain POST remains `ambiguous`\n * until marker reconciliation proves whether GitHub created it.\n */\nexport const HookReviewResult = z.discriminatedUnion('state', [\n    z.object({\n        state: z.literal('submitted'),\n        reviewId: z.string().min(1),\n        event: HookReviewEvent,\n        verdict: HookReviewVerdict,\n        commitId: z.string().min(1)\n    }),\n    z.object({ state: z.literal('not_submitted'), code: HookReviewResultCode }),\n    z.object({ state: z.literal('ambiguous'), code: HookReviewResultCode })\n]);\n/**\n * Hook (inbound-webhook trigger) frames — webhook-triggers-and-github-events.md.\n *\n * A hook maps an inbound webhook delivery to ONE AGENT turn. The CP owns the\n * definition (`HookDef`) and compiles it into relay-side rules\n * (`rc/hook-assign`, frames/relay-cp.ts); the relay pool is the public ingress\n * that verifies + matches + dispatches the trigger to the target daemon as an\n * `rd/msg` `hook` member (frames/relay-daemon.ts). Event payloads never touch\n * the CP. R1/R2a add only metadata barriers and action-result control frames;\n * the model-visible body remains relay↔daemon.\n */\n/**\n * The trimmed event envelope a fire carries — bounded excerpts only; the full\n * payload lives in relay/daemon memory for the duration of the dispatch and the\n * agent pulls source-of-truth content itself (gh / API) when it needs more.\n * The whole frame rides under the 256 KiB frame cap; these excerpt caps are far\n * below it. Trust differs by kind (design 安全边界 1): a webhook `body` IS the\n * caller's message (the URL is a capability credential), while github excerpts\n * (P2) are untrusted third-party content the daemon fences in the prompt.\n */\nexport const HookContext = z.object({\n    source: z.enum(['webhook', 'github']),\n    // ── github (P2) ──\n    event: z.string().optional(), // 'issues' | 'pull_request' | 'issue_comment'\n    action: z.string().optional(), // 'opened' | 'synchronize' | 'created' | …\n    repo: z.string().optional(), // 'owner/repo'\n    number: z.number().int().optional(), // issue/PR number\n    title: z.string().optional(),\n    senderLogin: z.string().optional(),\n    authorAssociation: z.string().optional(),\n    labels: z.array(z.string()).optional(),\n    htmlUrl: z.string().optional(),\n    bodyExcerpt: z.string().optional(), // ≤4 KiB\n    // ── webhook ──\n    body: z.string().optional(), // raw body, truncated to ≤64 KiB\n    truncated: z.boolean().optional()\n});\n/**\n * Normalized quota failure: the operational HookRun remains failed while an\n * informational GitHub Check may intentionally project the outcome as skipped.\n */\nexport const HOOK_REPORT_REASON_PROVIDER_QUOTA_EXHAUSTED = 'provider_quota_exhausted';\n/**\n * Normalized provider sign-in failure: the runtime cannot run until a human\n * refreshes its credentials, so an informational GitHub Check is skipped\n * instead of reported as a code-review failure.\n */\nexport const HOOK_REPORT_REASON_PROVIDER_AUTH_REQUIRED = 'provider_auth_required';\n/**\n * `hook/report` (D→C REQ → generic `ack`) — the dispatched turn ended; closes\n * the `HookRun` row the relay's `rc/run-report` opened. Same discipline as\n * `cron/report`: scoped (the agent must be placed on the reporting daemon),\n * latest-wins, lost reports harvested by the HookRunReaper (late arrivals may\n * still overwrite `orphaned`). The daemon retains a metadata-only outbox entry\n * until ACK. Keyed by `(hookId, deliveryKey)`.\n */\nexport const HookReport = z\n    .object({\n    hookId: z.string().uuid(),\n    agentId: z.string().uuid(), // the owning agent — scopes the report to its daemon\n    deliveryKey: z.string().min(1),\n    // Rolling-compatible copy of the exact accepted dispatch tuple. Every field\n    // is optional on the delivery frame, but review/report consumers require the\n    // complete HookConfigSnapshot before taking an effect.\n    ...OptionalHookConfigSnapshot.shape,\n    event: z.string().min(1).optional(), // 'pull_request:synchronize', etc.\n    github: GithubHookMetadata.optional(),\n    status: z.enum(['success', 'failed']),\n    durationMs: z.number().int().nonnegative().optional(), // dispatch → turn end\n    sessionId: z.string().optional(), // ACP session the run prompted (console deep-link)\n    reason: z.string().optional(), // short failure text (status \"failed\")\n    // A submitted result is repeated here as recovery if the immediate\n    // github/review-result request was lost. No review/comment body crosses CP.\n    reviewAttemptId: z.string().uuid().optional(),\n    reviewResult: HookReviewResult.optional()\n})\n    .superRefine((report, ctx) => {\n    if ((report.reviewAttemptId === undefined) !== (report.reviewResult === undefined)) {\n        ctx.addIssue({\n            code: 'custom',\n            path: report.reviewAttemptId === undefined ? ['reviewAttemptId'] : ['reviewResult'],\n            message: 'reviewAttemptId and reviewResult must be reported together'\n        });\n    }\n});\n/**\n * `hook/start` (D→C REQ) — metadata barrier immediately before an accepted\n * GitHub hook enters the model prompt. A successful reply means the CP durably\n * attached the authoritative revision to the accepted HookRun and, for R2a,\n * advanced its informational projection to in_progress.\n */\nexport const HookStart = z.object({\n    hookId: z.string().uuid(),\n    agentId: z.string().uuid(),\n    deliveryKey: z.string().min(1),\n    sessionId: z.string().min(1).optional(), // ACP session already created for this turn (rolling-compatible)\n    event: z.string().min(1).optional(),\n    github: GithubHookMetadata,\n    ...HookConfigSnapshot.shape\n});\nexport const HookStartOk = z.object({ accepted: z.literal(true) });\n/** D→C action-time authorization for one formal GitHub review attempt. */\nexport const GithubReviewAuthorize = z.object({\n    hookId: z.string().uuid(),\n    deliveryKey: z.string().min(1),\n    attemptId: z.string().uuid(),\n    requestedEvent: HookReviewEvent,\n    requestedVerdict: HookReviewVerdict,\n    snapshot: HookConfigSnapshot\n});\n/** Trusted target echoed with a broker-only purpose token. Secret: never log. */\nexport const GithubReviewAuthorized = z.object({\n    attemptId: z.string().uuid(),\n    token: z.string().min(1),\n    ttlSec: z.number().int().positive(),\n    expiresAt: z.string().datetime(),\n    repoId: HookBigIntString,\n    repoFullName: z.string().min(1),\n    pullNumber: z.number().int().positive(),\n    expectedHeadSha: z.string().min(1),\n    expectedBaseSha: z.string().min(1)\n});\n/**\n * Immediate metadata-only convergence after the daemon's GitHub review POST.\n * Submitted metadata is also repeated on HookReport for lost-REP recovery.\n */\nexport const GithubReviewResultReport = z.object({\n    hookId: z.string().uuid(),\n    deliveryKey: z.string().min(1),\n    attemptId: z.string().uuid(),\n    snapshot: HookConfigSnapshot,\n    result: HookReviewResult\n});\nexport const GithubReviewResultOk = z.object({ accepted: z.literal(true) });\n//# sourceMappingURL=hook.js.map","import { z } from 'zod';\n/**\n * Git credentials (github-app workspaces) — daemon-pulled, CP-minted.\n *\n * The CP holds the GitHub App private key and mints short-lived (1h,\n * non-renewable) installation access tokens scoped to a single repository;\n * the daemon pulls one on demand right before a remote git operation and\n * holds it in memory only. Unlike `secrets/*` (lease + reference semantics,\n * still unwired), the grant here carries the TOKEN MATERIAL itself — same\n * plaintext-over-TLS-WS posture as `integration/upsert`, and the same\n * discipline: **never log the payload**.\n *\n * The daemon may only name an agentId — the CP resolves agent → workspace →\n * repo → installation itself, so a daemon can never pick a repo it wasn't\n * assigned. Failures come back as correlated `error` REPs: `SCOPE_DENIED`\n * (not a github-app workspace, or agent not placed on this daemon — stop\n * asking), `LEASE_DENIED` (installation uninstalled/suspended or the repo\n * left its grant set — recoverable only by an operator), `RATE_LIMITED`,\n * `INTERNAL`.\n */\n/**\n * Token capability classes (webhook-triggers-and-github-events.md P2.5 回写).\n * `contents` is the git data plane (the pre-capabilities behavior); `issues` /\n * `pull_requests` buy the agent `gh` write-back (issue/PR comments). Every\n * General agent credentials mint every capability at the repo's `gitAccess` /\n * authorization tier — a read-only agent gets read-only issues/PR scopes.\n * The one exception is purpose=github_hook_reply: a daemon-owned writer whose\n * token never enters the agent environment and is gated by an enabled hook.\n */\nexport const GitCredCapability = z.enum(['contents', 'issues', 'pull_requests']);\nexport const GitCredRequest = z.object({\n    // D→C, REQ\n    agentId: z.string().uuid(),\n    reason: z.enum(['clone', 'fetch', 'pull', 'push', 'helper']).optional(), // observability only\n    // Absent ⇒ ['contents'] — pre-P2.5 daemons keep byte-identical behavior.\n    capabilities: z.array(GitCredCapability).nonempty().optional(),\n    // The daemon-owned GithubPoster is a narrower consumer than an agent's git/\n    // gh tools: its token never enters the agent environment and may only back\n    // the one final comment for an enabled GitHub hook turn. Marking that purpose\n    // explicitly lets the CP apply the hook authorization instead of incorrectly\n    // clamping the comment token to the workspace contents gitAccess.\n    purpose: z.literal('github_hook_reply').optional(),\n    // Trusted hook identity copied from the relay-delivered rd/msg. Required by\n    // the CP for purpose=github_hook_reply so authorization stays rename-safe on\n    // HookDef.repoId instead of comparing mutable owner/repo display names.\n    hookId: z.string().uuid().optional(),\n    // A poster sets this only after GitHub rejects a cached token with 401/403.\n    // The CP then bypasses its installation-token cache exactly once; ordinary\n    // git/gh requests ignore it.\n    forceRefresh: z.boolean().optional(),\n    // Absent ⇒ the agent's workspace repo (pre-multi-repo behavior). \"owner/repo\".\n    // The CP admits only workspace ∪ the agent's AgentRepoAuthorization rows and\n    // mints the requested capability subset at the row's access tier — the daemon\n    // still cannot pick an arbitrary repo (agent-multi-repo-authorization.md\n    // decision 2). A purpose=github_hook_reply request is separately gated by an\n    // enabled GitHub hook and receives only issues/PR write, never contents. Old\n    // CPs strip this field and answer with a WORKSPACE grant: consumers MUST\n    // verify grant.repoFullName against what they asked for before trusting it.\n    repoFullName: z.string().optional()\n});\nexport const GitCredGrant = z.object({\n    // C→D, REP (plaintext token — never log)\n    username: z.literal('x-access-token'), // fixed HTTPS basic-auth username for installation tokens\n    token: z.string(), // ghs_… — new stateless format runs ~520 chars; never assume a length\n    ttlSec: z.number().int(), // CP-computed remaining life, 60s clock-skew allowance already shaved.\n    // Daemons MUST track expiry as monotonic receivedAt+ttlSec (a skewed local\n    // clock must never resurrect a dead token); `expiresAt` is observability only.\n    expiresAt: z.string().datetime(),\n    repoFullName: z.string(), // owner/repo — helper path-match + diagnostics\n    access: z.enum(['read', 'write'])\n});\n//# sourceMappingURL=gitcred.js.map","import { z } from 'zod';\nimport { SessionKey } from './route.js';\n/**\n * Session read-back (C→D REQ → REP) — the console's on-demand pulls.\n *\n * Session bodies are daemon-local (body-locality, §1/§12). The CP may persist a\n * metadata-only session-list snapshot from daemon `event/session` events, while\n * transcript/tool bodies are pulled live from the owning daemon and proxied to\n * the console only for display.\n *\n * - `session/list`: the daemon's local metadata projection, used for snapshots\n *   and direct read-back/debugging.\n * - `session/history`: one cursor-paginated page of a session's transcript.\n */\n/**\n * Per-session token accounting, metered by the daemon from the agent's ACP usage\n * stream. Token counts are CUMULATIVE across the session's turns (summed from each\n * turn's `PromptResponse.usage`); context/cost are the LATEST snapshot from the\n * agent's `usage_update` stream. Every field is optional — a runtime that reports\n * no usage yields an absent field, not a zero.\n */\nexport const SessionUsage = z.object({\n    totalTokens: z.number().int().optional(),\n    inputTokens: z.number().int().optional(),\n    outputTokens: z.number().int().optional(),\n    thoughtTokens: z.number().int().optional(),\n    cachedReadTokens: z.number().int().optional(),\n    cachedWriteTokens: z.number().int().optional(),\n    contextUsed: z.number().int().optional(), // current context-window occupancy\n    contextSize: z.number().int().optional(), // context-window size\n    costAmount: z.number().optional(), // running session cost\n    costCurrency: z.string().optional()\n});\n/** One row in the session list (metadata + console metrics; NOT the transcript). */\nexport const SessionListItem = z.object({\n    sessionId: z.string(), // opaque ACP session id (agent-assigned; NOT a wire UUID)\n    sessionKey: SessionKey, // platform/channel/thread — drives the \"integration · channel\" column\n    agentId: z.string().uuid(),\n    title: z.string().optional(), // human-facing session title (daemon-derived)\n    status: z.string().optional(), // e.g. \"plan\" / \"completed\" / \"awaiting approval\"\n    lastActivityAt: z.string().optional(), // ISO/string ts of the last activity\n    usage: SessionUsage.optional(), // per-session token/cost accounting (daemon-metered)\n    triggeredBy: z.string().optional(), // sender handle/id that triggered/drove the run\n    // Human-readable display names, resolved + cached by the daemon (the only side\n    // holding platform credentials). Always optional — the raw ids above stay the\n    // canonical identity; absent when the daemon hasn't resolved them (yet).\n    channelName: z.string().optional(), // \"general\" for a Slack \"C…\" channel; \"@Dana Reyes\" for a \"D…\" DM\n    triggeredByName: z.string().optional(), // display name for `triggeredBy`\n    // Platform-native deep link back to the source thread (e.g. a Slack\n    // `…/archives/<C…>/p<ts>` permalink), built by the daemon from the platform\n    // credentials it holds. Optional — absent when the daemon can't resolve the\n    // workspace URL (yet) or the platform has no addressable thread link.\n    threadUrl: z.string().optional()\n});\n/** C→D REQ: list the daemon's sessions (optionally just one agent's). */\nexport const SessionListReq = z.object({\n    agentId: z.string().uuid().optional() // omit ⇒ all this daemon's sessions\n});\n/** D→C REP (corr = req id): the daemon's current sessions. */\nexport const SessionListPage = z.object({\n    sessions: z.array(SessionListItem)\n});\n/**\n * The full ACP tool body, transported as a JSON STRING in `SessionMessage.body`.\n * Kept structurally faithful to the ACP `ToolCall`; free-form fields stay opaque\n * (`z.unknown()`) so no daemon-side redaction/reshaping is implied.\n */\nexport const ToolBody = z.object({\n    toolCallId: z.string(),\n    kind: z.string().optional(), // ACP ToolKind: read|edit|delete|move|search|execute|think|fetch|switch_mode|other\n    status: z.string().optional(), // ACP ToolCallStatus: pending|in_progress|completed|failed\n    rawInput: z.unknown().optional(),\n    rawOutput: z.unknown().optional(),\n    content: z.array(z.unknown()).optional(), // ACP ToolCallContent[] kept opaque (content|diff|terminal blocks)\n    locations: z.array(z.object({ path: z.string(), line: z.number().int().optional() })).optional(),\n    truncated: z.boolean().optional() // set when the daemon capped the stored body at write time\n});\n/** One message in a session transcript page (a body — returned only for display). */\nexport const SessionMessage = z.object({\n    seq: z.number().int(), // daemon-local insertion order within the session\n    sender: z.string(), // platform handle/id of the author\n    senderName: z.string().optional(), // display name (daemon-resolved; absent if unknown)\n    ts: z.string(), // platform timestamp (daemon-local string form)\n    kind: z.string(), // \"text\" / tool / … (daemon transcript kind)\n    text: z.string(),\n    // ── tool-body enrichment (optional ⇒ text/reasoning rows and old daemons omit these) ──\n    toolCallId: z.string().optional(), // parsed from the ToolBody (tool rows only)\n    toolStatus: z.string().optional(), // ACP ToolCallStatus, surfaced for the console badge\n    toolKind: z.string().optional(), // ACP ToolKind, surfaced for the console icon\n    body: z.string().optional(), // JSON.stringify(ToolBody); may be a truncated-but-VALID-JSON preview\n    bodyTruncated: z.boolean().optional(), // preview was shrunk for the frame; full body via session/tool-body\n    bodyBytes: z.number().int().optional() // full (untruncated) body byte length\n});\n/** C→D REQ: fetch one page of a session's history from the owning daemon. */\nexport const SessionHistoryReq = z.object({\n    sessionId: z.string(), // opaque ACP session id (agent-assigned; NOT a wire UUID)\n    cursor: z.string().optional(), // opaque; omit ⇒ newest page\n    limit: z.number().int().positive().max(200).default(50)\n});\n/** D→C REP (corr = the req id): a page of messages + the cursor for the next page. */\nexport const SessionHistoryPage = z.object({\n    sessionId: z.string(), // opaque ACP session id (agent-assigned; NOT a wire UUID)\n    messages: z.array(SessionMessage), // ordered oldest→newest within the page\n    nextCursor: z.string().optional() // absent ⇒ no older messages\n});\n/**\n * C→D REQ: fetch the FULL (untruncated) ToolBody JSON for one tool call, chunked.\n * The inline `SessionMessage.body` preview is capped at 32 KiB; when a body is\n * bigger the console pages the whole thing back through this frame by offset.\n */\nexport const SessionToolBodyReq = z.object({\n    sessionId: z.string(),\n    toolCallId: z.string(),\n    offset: z.number().int().nonnegative().default(0)\n});\n/** D→C REP (corr = the req id): one frame-budgeted byte slice of the full ToolBody JSON. */\nexport const SessionToolBodyChunk = z.object({\n    sessionId: z.string(),\n    toolCallId: z.string(),\n    data: z.string(), // UTF-8-boundary-safe byte slice of the FULL ToolBody JSON\n    totalBytes: z.number().int(),\n    nextOffset: z.number().int().optional() // absent ⇒ this is the last chunk\n});\n//# sourceMappingURL=session.js.map","import { z } from 'zod';\nimport { Platform } from './route.js';\n/**\n * Channel agent directory (D→C REQ → REP) — agent collaboration lookup.\n *\n * An agent asks (via a daemon-side tool) \"who else is in this channel?\". The\n * daemon forwards it to the CP — the ONLY authority for the FULL channel roster,\n * because agents in one channel may run on different daemons (each daemon knows\n * only its own agents). The CP joins the channel's integrations to their agents\n * and returns their public metadata (name / displayName / description / status).\n * Metadata only — never message content (§1/§12).\n *\n * Direction is daemon→CP (like `auth` / `register`): the daemon sends the REQ and\n * the CP replies with `channel/agents/ok` (corr = the req id).\n *\n * The REQ is bound to the requesting daemon's authenticated org AND to the\n * session-derived `requesterAgentId` (never a tool input — §2.2/§6.1): the CP\n * verifies the requester actually belongs to the target (platform, channel)\n * before returning the roster, and filters it by call policy so non-callable /\n * private peers are not leaked. This stops one agent from probing arbitrary\n * (including private) channels of its own org.\n */\n/** One agent visible in a channel — the collaboration directory entry. */\nexport const ChannelAgent = z.object({\n    agentId: z.string().uuid(),\n    name: z.string(), // slug\n    displayName: z.string().optional(), // human-readable name, if set\n    description: z.string().optional(), // what the agent does (its system-prompt seed)\n    status: z.enum(['active', 'inactive', 'paused'])\n});\n/** D→C REQ: list the agents in a channel (for the asking agent's collaboration tool). */\nexport const ChannelAgentsReq = z.object({\n    platform: Platform,\n    channel: z.string(), // platform channel id\n    /** The agent asking, derived by the daemon from the MCP session context — NEVER\n     *  a tool input (§6.1). The CP uses it to verify the requester belongs to the\n     *  target channel and to apply per-peer call-policy visibility filtering. */\n    requesterAgentId: z.string().uuid()\n});\n/** C→D REP (corr = req id): every agent in the channel across all daemons. */\nexport const ChannelAgentsOk = z.object({\n    platform: Platform,\n    channel: z.string(),\n    agents: z.array(ChannelAgent)\n});\n//# sourceMappingURL=channel.js.map","import { z } from 'zod';\n/**\n * Agent workspace file browsing (C→D REQ → REP) — the console's on-demand pulls.\n *\n * The CP stores NO workspace data — directory listings and file bytes are pulled\n * live from the owning daemon and proxied to the console, never persisted\n * (body-locality). Missing paths are DATA (`exists:false`), not errors; only\n * path-containment violations (`BAD_PAYLOAD`) and unexpected fs failures\n * (`INTERNAL`) come back as `error` frames.\n *\n * - `workspace/list`: one cursor-paginated page of a directory's entries.\n * - `workspace/read`: one byte slice of a file. `limit` is only a ceiling — the\n *   daemon returns FEWER bytes when needed to keep the JSON-escaped REP under the\n *   256 KiB frame cap (control bytes escape to `\\uXXXX`, a 6× blowup), and always\n *   ends the slice on a UTF-8 character boundary. `nextOffset` is the authoritative\n *   byte offset to request next — callers must NOT recompute it from the decoded\n *   `content` (a split multi-byte char would make the byte count drift).\n */\n/** One directory entry in a workspace listing (name-only; not a full path). */\nexport const WorkspaceEntry = z.object({\n    name: z.string(),\n    type: z.enum(['dir', 'file', 'symlink', 'other']),\n    size: z.number().int().nonnegative().optional(), // regular files only\n    mtime: z.string().optional() // RFC3339\n});\n/** C→D REQ: list one page of a directory in the agent's workspace. */\nexport const WorkspaceListReq = z.object({\n    agentId: z.string().min(1), // local agent id (NOT a wire UUID)\n    path: z.string().default(''), // workspace-relative POSIX path; '' ⇒ workspace root\n    cursor: z.string().optional(), // opaque; omit ⇒ first page\n    limit: z.number().int().positive().max(500).default(200)\n});\n/** D→C REP (corr = the req id): a page of entries + the cursor for the next page. */\nexport const WorkspaceListPage = z.object({\n    agentId: z.string(),\n    path: z.string(),\n    exists: z.boolean(), // false ⇒ workspace root or the dir does not exist (NOT an error)\n    entries: z.array(WorkspaceEntry),\n    nextCursor: z.string().optional() // absent ⇒ no more entries\n});\n/** C→D REQ: read one byte slice of a file in the agent's workspace. */\nexport const WorkspaceReadReq = z.object({\n    agentId: z.string().min(1), // local agent id (NOT a wire UUID)\n    path: z.string().min(1), // workspace-relative POSIX path to a file\n    offset: z.number().int().nonnegative().default(0), // byte offset\n    limit: z.number().int().positive().max(65536).default(65536) // byte count per slice (64 KiB, see docblock)\n});\n/** D→C REP (corr = the req id): the file slice (or `exists:false` / binary-detected). */\nexport const WorkspaceReadContent = z.object({\n    agentId: z.string(),\n    path: z.string(),\n    exists: z.boolean(), // false ⇒ the file does not exist (NOT an error)\n    size: z.number().int().nonnegative().optional(),\n    mtime: z.string().optional(), // RFC3339\n    encoding: z.enum(['utf8', 'none']).optional(), // 'none' ⇒ binary detected, content omitted\n    content: z.string().optional(), // utf8 text slice\n    offset: z.number().int().nonnegative().optional(), // byte offset this slice starts at\n    nextOffset: z.number().int().nonnegative().optional(), // byte offset to request next (offset + bytes in this slice)\n    truncated: z.boolean().optional() // true ⇒ nextOffset < size (more bytes remain)\n});\n/**\n * Agent workspace git ops (C→D REQ → REP) — the console's on-demand controls for\n * a git-repo workspace. Like list/read these run daemon-local; the CP proxies the\n * outcome and stores nothing.\n *\n * These are DATA-oriented: a non-repo workspace (`isRepo:false`), a dirty tree,\n * or a pull that can't fast-forward (offline, diverged, local edits) all come\n * back as a normal REP — NOT an `error` frame. Only an unknown agent\n * (`BAD_PAYLOAD`) or an unexpected git/fs failure (`INTERNAL`) is an error.\n */\n/** C→D REQ: report `git status` of the agent's workspace (is it clean?). */\nexport const WorkspaceGitStatusReq = z.object({\n    agentId: z.string().min(1) // local agent id (NOT a wire UUID)\n});\n/** One changed path in a `git status`. `index`/`workingDir` are git's per-file XY\n *  status chars (' ', 'M', 'A', 'D', 'R', 'C', 'U', '?', …). */\nexport const WorkspaceGitFile = z.object({\n    path: z.string(),\n    index: z.string(), // staged (X) status char\n    workingDir: z.string() // unstaged (Y) status char\n});\n/** The HEAD commit of the checkout. */\nexport const WorkspaceGitCommit = z.object({\n    sha: z.string(), // full 40-hex commit hash\n    shortSha: z.string(), // abbreviated hash (7 hex) for display\n    subject: z.string(), // first line of the commit message\n    committedAt: z.string() // RFC3339 committer date\n});\n/** D→C REP (corr = the req id): the working-tree status. */\nexport const WorkspaceGitStatus = z.object({\n    agentId: z.string(),\n    isRepo: z.boolean(), // false ⇒ from-scratch workspace (no .git) — git ops are N/A\n    clean: z.boolean(), // true ⇒ no staged / unstaged / untracked changes\n    branch: z.string().optional(), // current branch (absent ⇒ detached / unknown)\n    tracking: z.string().optional(), // upstream ref, if the branch tracks one\n    ahead: z.number().int().nonnegative().optional(), // commits ahead of upstream\n    behind: z.number().int().nonnegative().optional(), // commits behind upstream\n    files: z.array(WorkspaceGitFile).optional(), // changed paths (bounded; see `truncated`)\n    truncated: z.boolean().optional(), // true ⇒ the `files` list was capped\n    lastCommit: WorkspaceGitCommit.optional(), // HEAD commit (absent ⇒ empty repo / no commits yet)\n    lastFetchAt: z.string().optional() // RFC3339 mtime of .git/FETCH_HEAD — when the repo last fetched/pulled\n});\n/** C→D REQ: force a fast-forward-only `git pull` in the agent's workspace now. */\nexport const WorkspaceGitPullReq = z.object({\n    agentId: z.string().min(1) // local agent id (NOT a wire UUID)\n});\n/** D→C REP (corr = the req id): the pull outcome. A failed pull is DATA\n *  (`ok:false` + `detail`), not an error frame (see the section docblock). */\nexport const WorkspaceGitPullResult = z.object({\n    agentId: z.string(),\n    isRepo: z.boolean(), // false ⇒ from-scratch workspace (no .git) — nothing to pull\n    ok: z.boolean(), // true ⇒ pull succeeded (fast-forwarded or already up to date)\n    detail: z.string().optional(), // human summary or failure reason (host paths stripped)\n    changed: z.number().int().nonnegative().optional(), // files changed by the pull\n    insertions: z.number().int().nonnegative().optional(),\n    deletions: z.number().int().nonnegative().optional()\n});\n//# sourceMappingURL=workspace.js.map","import { z } from 'zod';\n/**\n * Agent memory directory (C→D REQ → REP) — the console's read/write of an agent's\n * long-term memory, and the surface the daemon serves it from.\n *\n * Memory is a DIRECTORY at the agent's ROOT (`<agent-root>/memory/`), OUTSIDE the\n * workspace — so it survives a workspace reset / re-clone and is never committed\n * into a github-workspace repo. It follows the index-plus-topics shape: a lean\n * `MEMORY.md` index (injected into the prompt every session, bounded) plus any\n * number of `<topic>.md` files the agent reads on demand. The agent maintains it\n * via MCP tools; these frames are the third channel — the CP reading/writing it\n * for the console — all pointing at the same directory.\n *\n * The CP stores NO memory content — bytes are pulled live from the owning daemon\n * and proxied to the console, never persisted (body-locality). A not-yet-created\n * file/dir is DATA (`exists:false`), not an error; only an unknown agent or a\n * path-containment violation (`BAD_PAYLOAD`) or an unexpected fs failure\n * (`INTERNAL`) comes back as an `error` frame.\n *\n * - `memory/list`: the topic files in the memory dir (flat; the index + topics).\n * - `memory/read`: one byte slice of a memory file (`path` relative to the memory\n *   dir; default `MEMORY.md`). `limit` is a ceiling — the daemon returns fewer\n *   bytes to keep the JSON-escaped REP under the 256 KiB frame cap and always ends\n *   on a UTF-8 boundary. `nextOffset` is authoritative — do NOT recompute it.\n * - `memory/write`: replace the whole named memory file with `content`.\n */\n/** The default file name of the memory index (loaded into the prompt each session). */\nexport const MEMORY_INDEX = 'MEMORY.md';\n/** One entry in a memory-dir listing (name-only; not a path). */\nexport const MemoryEntry = z.object({\n    name: z.string(), // file name relative to the memory dir\n    size: z.number().int().nonnegative(),\n    mtime: z.string() // RFC3339\n});\n/** C→D REQ: list the files in the agent's memory dir. */\nexport const MemoryListReq = z.object({\n    agentId: z.string().min(1) // local agent id (NOT a wire UUID)\n});\n/** D→C REP (corr = the req id): the memory dir's files (or `exists:false`). */\nexport const MemoryListPage = z.object({\n    agentId: z.string(),\n    exists: z.boolean(), // false ⇒ the memory dir does not exist yet (NOT an error)\n    entries: z.array(MemoryEntry)\n});\n/** C→D REQ: read one byte slice of a memory file (path relative to the memory dir). */\nexport const MemoryReadReq = z.object({\n    agentId: z.string().min(1), // local agent id (NOT a wire UUID)\n    path: z.string().default(MEMORY_INDEX), // memory-dir-relative POSIX path; default the index\n    offset: z.number().int().nonnegative().default(0), // byte offset\n    limit: z.number().int().positive().max(65536).default(65536) // byte count per slice (64 KiB, see docblock)\n});\n/** D→C REP (corr = the req id): the memory file slice (or `exists:false`). Always utf8 text. */\nexport const MemoryReadContent = z.object({\n    agentId: z.string(),\n    path: z.string(),\n    exists: z.boolean(), // false ⇒ the file does not exist yet (NOT an error)\n    size: z.number().int().nonnegative().optional(), // total file size in bytes\n    mtime: z.string().optional(), // RFC3339\n    content: z.string().optional(), // utf8 text slice\n    offset: z.number().int().nonnegative().optional(), // byte offset this slice starts at\n    nextOffset: z.number().int().nonnegative().optional(), // byte offset to request next (offset + bytes in this slice)\n    truncated: z.boolean().optional() // true ⇒ nextOffset < size (more bytes remain)\n});\n/** C→D REQ: replace the whole named memory file with `content` (console edit). */\nexport const MemoryWriteReq = z.object({\n    agentId: z.string().min(1), // local agent id (NOT a wire UUID)\n    path: z.string().default(MEMORY_INDEX), // memory-dir-relative POSIX path; default the index\n    content: z.string(), // full new file content (utf8); '' clears the file\n    // Optimistic concurrency: the mtime the writer last read. When present the write\n    // fails (CONFLICT) unless the file still has this mtime — so a console edit can't\n    // clobber a newer agent write. Omit to force (last-write-wins).\n    ifMatchMtime: z.string().optional()\n});\n/** D→C REP (corr = the req id): the written state, so the console can refresh. */\nexport const MemoryWriteOk = z.object({\n    agentId: z.string(),\n    path: z.string(),\n    size: z.number().int().nonnegative(), // bytes written\n    mtime: z.string() // RFC3339 of the write\n});\n//# sourceMappingURL=memory.js.map","import { z } from 'zod';\nimport { SessionUsage } from './session.js';\nimport { Platform } from './route.js';\n/**\n * Telemetry & facts (D→C) — protocol §7.\n *\n * The dashboard's real-time source. `event/session` is the converged milestone\n * feed (NOT the message stream); `facts/daemon-runtimes` is the observed runtime\n * capability feed; `heartbeat` drives the watchdog.\n */\nexport const Heartbeat = z.object({\n    load: z.object({\n        cpu: z.number(), // 0..1 CPU utilization fraction (busy-time across cores) — NOT a raw load average\n        mem: z.number(), // 0..1 utilization fraction\n        agents: z.number().int()\n    }),\n    health: z.enum(['ok', 'degraded']),\n    activeSessions: z.number().int(),\n    degradedScopes: z.array(z.string()).default([]) // e.g. expired-lease bindings (§6)\n});\n/** Converged session lifecycle milestone — protocol §7.2. NOT the message stream. */\nexport const EventSession = z.object({\n    sessionId: z.string(), // ACP session id (agent-assigned; a free string, NOT a wire UUID — matches usage/report)\n    agentId: z.string().uuid(),\n    launchId: z.string().uuid().optional(), // 🅰️ CP launch fence — absent for sessions created on the Slack/Discord→daemon path (no CP-initiated launch)\n    phase: z.enum(['start', 'plan', 'problem', 'end']),\n    // sessionKey echo — where the session lives; the CP stores it so a deep-link\n    // detail page (…/sessions/:id) can show the channel without the daemon online.\n    platform: Platform.optional(),\n    channel: z.string().optional(),\n    thread: z.string().optional(),\n    link: z.string().optional(), // deep-link to detail view\n    summary: z.string().optional(), // short, human-facing milestone text\n    // Dashboard-list metadata snapshot. Still metadata-only: no message bodies,\n    // transcript stream, attachment bytes, or tool payloads cross into the CP store.\n    title: z.string().optional(),\n    status: z.string().optional(),\n    lastActivityAt: z.string().datetime().optional(),\n    triggeredBy: z.string().optional(),\n    channelName: z.string().optional(),\n    triggeredByName: z.string().optional(),\n    threadUrl: z.string().optional(),\n    // Effective execution-config snapshot: what the session actually ran with\n    // (per-session sticky override, else the agent's config at run time; absent ⇒\n    // the runtime's own default). Recorded so the console shows what a session\n    // USED, not the owning agent's config at view time. The reporting daemon is\n    // NOT echoed here — the CP stamps it from the authenticated WS connection.\n    runtime: z.string().optional(),\n    model: z.string().optional(),\n    effort: z.string().optional(), // reasoning effort level (runtime-owned vocabulary)\n    fastMode: z.boolean().optional(),\n    permissionMode: z.string().optional(), // runtime permission/approval mode\n    outputMode: z.string().optional(), // daemon-side output verbosity (low/medium/high)\n    ts: z.string().datetime()\n});\n/**\n * Per-session token-usage report — D→C EVT. The daemon meters usage from the\n * agent's ACP stream and reports the session's CUMULATIVE snapshot (latest-wins)\n * so the CP can persist it for the console's historical usage aggregates. This is\n * dashboard metadata (token counts + cost), never the message stream. Idempotent\n * by `sessionId`: re-sending the same snapshot is a no-op upsert on the CP.\n */\nexport const UsageReport = z.object({\n    sessionId: z.string(), // ACP session id (agent-assigned; NOT a wire UUID)\n    agentId: z.string().uuid(),\n    platform: z.string().optional(), // denormalized sessionKey echo for dashboard filters\n    channel: z.string().optional(),\n    lastActivityAt: z.string(), // ISO ts of the session's last activity\n    usage: SessionUsage\n});\n/**\n * Observed capabilities of an installed runtime — protocol §7.3. The element\n * type of the `facts/daemon-runtimes` snapshot. As a standalone per-runtime\n * frame (`facts/runtime-profile`, upsert-only) it is DEPRECATED: current\n * daemons report the full snapshot instead; the CP keeps accepting the old\n * frame from older daemons.\n */\n/**\n * MCP transports a runtime accepts on `session/new` `mcpServers` (from the ACP\n * `initialize` response's `agentCapabilities.mcpCapabilities`). Stdio is the ACP\n * baseline every agent must accept, so only the optional transports are listed.\n */\nexport const McpTransportCapabilities = z.object({\n    http: z.boolean(),\n    sse: z.boolean()\n});\nexport const FactsRuntimeProfile = z.object({\n    runtime: z.string(), // \"claude\" / \"codex\" / ...\n    version: z.string(),\n    models: z.array(z.string()),\n    contextWindow: z.number().int().optional(),\n    acpSupport: z.enum(['full', 'partial', 'none']), // gates the dual-mode decision (#1)\n    // ACP protocol version the runtime negotiated at `initialize` (the number the\n    // agent echoed/downgraded to). Absent for older daemons / runtimes not probed yet.\n    acpProtocolVersion: z.number().int().optional(),\n    toolCalling: z.boolean(),\n    // MCP transports the runtime advertised at `initialize`. Absent for older\n    // daemons / runtimes not probed yet (⇒ assume stdio-only).\n    mcpCapabilities: McpTransportCapabilities.optional()\n});\n/**\n * Probe result for one daemon-configured MCP server (daemon config `mcpServers`).\n * The daemon connects to the server (MCP initialize + `tools/list`) so the\n * console can show what each server offers before the user enables it on an\n * agent. Metadata only — definitions (commands, URLs, headers) stay daemon-local.\n */\nexport const FactsMcpServer = z.object({\n    name: z.string(), // config key; what AgentSpec.mcpServers references\n    transport: z.enum(['stdio', 'http', 'sse']),\n    /** True iff the MCP handshake succeeded. */\n    ok: z.boolean(),\n    tools: z.array(z.string()).default([]), // tool names from `tools/list` (empty when !ok)\n    version: z.string().optional(), // serverInfo.version from the MCP handshake\n    error: z.string().optional() // failure reason when `ok` is false\n});\n/**\n * Full snapshot of the daemon's installed runtimes — D→C EVT (protocol §7.3a),\n * emitted on each register and again once the background probe sweep completes\n * (with the learned `models[]`). REPLACE semantics: the CP reconciles its\n * stored runtime list for the daemon to exactly `runtimes[]`, pruning runtimes\n * that are no longer installed. Idempotent (latest-wins). Supersedes the\n * per-runtime `facts/runtime-profile` upsert.\n */\nexport const DaemonRuntimes = z.object({\n    runtimes: z.array(FactsRuntimeProfile),\n    // Daemon-level (not per-runtime) MCP-server probe snapshot — same REPLACE\n    // semantics as `runtimes`. Default [] so older daemons parse clean.\n    mcpServers: z.array(FactsMcpServer).default([])\n});\n/** Non-secret config update — C→D EVT, protocol §8.3 / frame #26. */\nexport const ConfigPush = z.object({\n    keys: z.record(z.string(), z.unknown())\n});\n/** Fleet: drain+exit, supervisor restarts — C→D REQ, protocol §8.3 / frame #27. */\nexport const DaemonRestart = z.object({\n    reason: z.string(),\n    drainFirst: z.boolean().default(true)\n});\n/** Fleet: drain+exit for version bump — C→D REQ, protocol §8.3 / frame #28. */\nexport const DaemonUpgrade = z.object({\n    targetVersion: z.string(),\n    drainFirst: z.boolean().default(true)\n});\n/** Reply to a fleet restart/upgrade REQ (protocol §8.3). */\nexport const DaemonControlAck = z.object({\n    accepted: z.boolean(),\n    willDrainUntil: z.string().datetime().optional()\n});\n/**\n * Generic acknowledgement for REQs whose reply is just `ack` in the frame index\n * (cron/upsert, cron/remove, agent/stop). Kept permissive but typed.\n */\nexport const Ack = z.object({\n    ok: z.boolean(),\n    reason: z.string().optional()\n});\n//# sourceMappingURL=telemetry.js.map","import { z } from 'zod';\n/**\n * Error model — protocol §9.\n *\n * Every REQ can be answered by an `error` REP (`corr` = request `id`). Errors\n * are typed and actionable, not free text.\n */\nexport const ErrorCode = z.enum([\n    // protocol / framing\n    'UNKNOWN_FRAME',\n    'FRAME_TOO_LARGE',\n    'PROTOCOL_STATE',\n    'BAD_PAYLOAD',\n    // auth / identity\n    'AUTH_FAILED',\n    'ATTESTATION_INVALID',\n    // fencing / ordering\n    'STALE_EPOCH',\n    'STALE_LAUNCH',\n    // delivery\n    'NO_SESSION',\n    'SCOPE_DENIED',\n    // secrets\n    'LEASE_EXPIRED',\n    'LEASE_DENIED',\n    // generic\n    'RATE_LIMITED',\n    'CONFLICT',\n    'INTERNAL'\n]);\nexport const ErrorFrame = z.object({\n    code: ErrorCode,\n    message: z.string(), // human-readable, redacted of secrets\n    retryable: z.boolean(),\n    details: z.record(z.string(), z.unknown()).optional()\n});\n/**\n * WebSocket close codes — protocol §9.\n *\n * `4401` requires a fresh credential before reconnecting; everything else uses\n * exponential backoff with jitter.\n */\nexport const CloseCode = {\n    BAD_SUBPROTOCOL: 4400, // bad subprotocol/handshake\n    AUTH_FAILED: 4401, // auth failed (don't auto-retry)\n    EPOCH_CONFLICT: 4409, // epoch conflict on handshake (do full reconcile)\n    UNSUPPORTED_ENCODING: 4415, // binary/unsupported encoding\n    RATE_LIMITED: 4429, // rate-limited (backoff)\n    SERVER_INTERNAL: 1011, // server internal\n    SERVER_RESTARTING: 1012, // server restarting (reconnect with backoff)\n    /** soft 256 KiB cap exceeded → ws library close (protocol §1). */\n    MESSAGE_TOO_BIG: 1009\n};\n//# sourceMappingURL=error.js.map","import { z } from 'zod';\n// webchat's content plane is the RELAY, not the daemon↔CP control WS (milestone A4):\n// a browser dials the relay pool with a CP-minted token and the relay bridges the\n// conversation onto the target daemon's rd/* socket. These payloads describe the reply\n// stream + the turn verdict; the relay's `rd/chat` / `rd/ack` frames REUSE them verbatim\n// (packages/protocol/src/frames/relay-daemon.ts). Content never touches the CP.\n// The webchat turn verdict — `dispatchWebchatTurn` returns this and the relay path folds\n// it into `rd/ack` (accepted + a fresh turnId that correlates the reply stream; `reason`\n// explains a rejection). Not a wire frame of its own anymore.\nexport const WebchatAck = z.object({\n    accepted: z.boolean(),\n    turnId: z.string().uuid(), // correlates the streamed output to this turn\n    reason: z.enum(['queued', 'no_agent', 'busy', 'paused', 'draining']).optional()\n});\n// One structured chunk of the agent's reply stream. Ordered per-connection (TCP);\n// 'index' is a per-turn monotonic counter for client-side assembly (NOT a global fence).\nexport const WebchatEvent = z.discriminatedUnion('kind', [\n    z.object({ kind: z.literal('message'), text: z.string() }), // from agent_message_chunk\n    z.object({ kind: z.literal('thinking'), text: z.string() }), // from agent_thought_chunk\n    z.object({ kind: z.literal('tool_call'), toolCallId: z.string(), title: z.string(), status: z.string() }),\n    z.object({ kind: z.literal('tool_update'), toolCallId: z.string(), status: z.string() }),\n    // The runtime's auto-generated session title (from ACP session_info_update). The\n    // daemon persists it (session/list surfaces it on the persisted row); this streams\n    // the same value so the LIVE playground session renames itself in place, matching\n    // what a Slack session shows once its title lands.\n    z.object({ kind: z.literal('session_info'), title: z.string() })\n]);\n// The session status-bar snapshot (model / context / tokens / cost), rebuilt from\n// the daemon's model selector + folded ACP usage. All fields optional so a partial\n// snapshot is valid: context/cost stream live via ACP `usage_update`, while token\n// totals only refresh at each turn's end. Carried as an extra field on the output\n// frame (see below) rather than a reply-stream event — a status update is not part\n// of the transcript and can arrive with no text chunk of its own.\nexport const WebchatStatus = z.object({\n    model: z.string().optional(),\n    effort: z.string().optional(),\n    permissionMode: z.string().optional(),\n    fastMode: z.boolean().optional(),\n    contextUsed: z.number().int().optional(),\n    contextSize: z.number().int().optional(),\n    totalTokens: z.number().int().optional(),\n    costAmount: z.number().optional(),\n    costCurrency: z.string().optional(),\n    // The models this session's runtime advertises as selectable (from the ACP model\n    // config option) — populates the console's model dropdown. Absent ⇒ no selector.\n    models: z.array(z.string()).optional(),\n    // The reasoning-effort levels this session's runtime offers (from the ACP\n    // `thought_level` config option, plus the synthetic `ultracode`/`max` entries on\n    // Claude runtimes) — populates the console's effort dropdown. Absent ⇒ no selector.\n    efforts: z.array(z.string()).optional(),\n    // The runtime's selectable permission/approval modes (ACP `mode` config option).\n    // Values are runtime-owned; absent ⇒ no selector.\n    permissionModes: z.array(z.string()).optional(),\n    // Whether the selected model advertises a fast-mode toggle (the ACP `model_config`\n    // config option only appears once a fast-capable model is selected). Absent/false ⇒\n    // no fast toggle shown.\n    fastModeAvailable: z.boolean().optional(),\n    // The daemon's session id (== acpSessionId) for this conversation, so the console can\n    // deep-link to the session detail page. Absent until the session is created.\n    sessionId: z.string().optional()\n});\n// D→C EVT — the integration's \"send\": one chunk of a turn's reply and/or a status\n// snapshot. `event` is optional so a status-only frame (no reply chunk) is valid;\n// every frame still carries a monotonic `index` for client-side ordering.\nexport const WebchatOutput = z\n    .object({\n    conversationId: z.string().uuid(),\n    turnId: z.string().uuid(),\n    index: z.number().int(),\n    event: WebchatEvent.optional(),\n    status: WebchatStatus.optional()\n})\n    // A frame must carry at least one of event/status — an empty frame is meaningless.\n    .refine((o) => o.event !== undefined || o.status !== undefined, {\n    message: 'WebchatOutput must carry event and/or status'\n});\n// D→C EVT — the turn finished. `error` is set when the turn ended in FAILURE\n// (agent failed to start, ACP handshake/prompt rejected) rather than completing —\n// a human-readable reason the client renders instead of a normal reply. When\n// present, `stopReason`/`usage` are absent (the turn produced no clean result).\nexport const WebchatDone = z.object({\n    conversationId: z.string().uuid(),\n    turnId: z.string().uuid(),\n    stopReason: z.string().optional(),\n    usage: z.object({ used: z.number().int().optional(), cost: z.number().optional() }).optional(),\n    error: z.string().optional()\n});\n// NOTE (milestone A4): the C→D webchat CONTENT frames — WebchatMessage/Ack-as-a-frame,\n// WebchatClose, WebchatSetModel/Effort/PermissionMode/Fast, WebchatCancel — were retired.\n// Their ops now ride the relay's `rd/msg` (RelayWebchatOp) instead of the daemon↔CP\n// control WS, so the CP is off the webchat hot path entirely.\n//# sourceMappingURL=webchat.js.map","import { z } from 'zod';\nimport { AuthReq, AuthOk } from './frames/auth.js';\nimport { RegisterReq, RegisterOk, RelayRosterUpdate } from './frames/register.js';\nimport { CollabRoutesSnapshot } from './frames/collab.js';\nimport { RouteAssign, RouteAssignAck, RouteUpdate, Drain, DrainProgress, DrainDone } from './frames/route.js';\nimport { AgentLaunch, AgentLaunched, AgentStop, AgentUpsert, AgentRemove, AgentDetach, AgentActivate, AgentActivity, AgentScopeDenied } from './frames/agent.js';\nimport { CronUpsert, CronRemove, CronReport, CronRunNow } from './frames/cron.js';\nimport { GithubReviewAuthorize, GithubReviewAuthorized, GithubReviewResultOk, GithubReviewResultReport, HookReport, HookStart, HookStartOk } from './frames/hook.js';\nimport { IntegrationUpsert, IntegrationRemove, IntegrationChannels } from './frames/integration.js';\nimport { GitCredRequest, GitCredGrant } from './frames/gitcred.js';\nimport { SecretsRequest, SecretsGrant, SecretsRenew, SecretsRevoke, ScopeAttestation } from './frames/secrets.js';\nimport { SessionHistoryReq, SessionHistoryPage, SessionListReq, SessionListPage, SessionToolBodyReq, SessionToolBodyChunk } from './frames/session.js';\nimport { ChannelAgentsReq, ChannelAgentsOk } from './frames/channel.js';\nimport { WorkspaceListReq, WorkspaceListPage, WorkspaceReadReq, WorkspaceReadContent, WorkspaceGitStatusReq, WorkspaceGitStatus, WorkspaceGitPullReq, WorkspaceGitPullResult } from './frames/workspace.js';\nimport { MemoryListReq, MemoryListPage, MemoryReadReq, MemoryReadContent, MemoryWriteReq, MemoryWriteOk } from './frames/memory.js';\nimport { Heartbeat, EventSession, UsageReport, FactsRuntimeProfile, DaemonRuntimes, ConfigPush, DaemonRestart, DaemonUpgrade, DaemonControlAck, Ack } from './frames/telemetry.js';\nimport { ErrorFrame } from './frames/error.js';\n// webchat CONTENT frames were retired in milestone A4 — content rides the relay's rd/*\n// wire now, not the daemon↔CP control WS. The reply-payload schemas live on in\n// frames/webchat.ts (reused by rd/chat), but none are registered as control-WS frames.\n/**\n * The single source of truth for the wire: `type` string → payload zod schema.\n *\n * Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered\n * frames) plus the correlated REP types named in the \"Reply\" column\n * (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also\n * travel on the wire and must be decodable.\n *\n * `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;\n * an unknown `type` → `ErrorFrame{code:\"UNKNOWN_FRAME\"}` (a REP, not a close).\n */\nexport const FRAME_SCHEMAS = {\n    // ── auth / identity ──\n    auth: AuthReq,\n    'auth/ok': AuthOk,\n    // ── register / reconcile ──\n    register: RegisterReq,\n    'register/ok': RegisterOk,\n    // ── relay roster (C→D hot update of register/ok.relays) ──\n    'relay/roster': RelayRosterUpdate,\n    // ── collaboration routing snapshot (C→D hot push; baseline in register/ok) ──\n    'collaboration/routes': CollabRoutesSnapshot,\n    // ── telemetry ──\n    heartbeat: Heartbeat,\n    // ── agent lifecycle / delivery ──\n    'agent/launch': AgentLaunch,\n    'agent/launched': AgentLaunched,\n    'agent/stop': AgentStop,\n    'agent/upsert': AgentUpsert,\n    'agent/remove': AgentRemove,\n    'agent/detach': AgentDetach,\n    'agent/activate': AgentActivate,\n    'agent/activity': AgentActivity,\n    'agent/scope-denied': AgentScopeDenied,\n    // ── routing / orchestration ──\n    'route/assign': RouteAssign,\n    'route/assign/ack': RouteAssignAck,\n    'route/update': RouteUpdate,\n    'daemon/drain': Drain,\n    'drain/progress': DrainProgress,\n    'drain/done': DrainDone,\n    // ── cron ──\n    'cron/upsert': CronUpsert,\n    'cron/remove': CronRemove,\n    'cron/report': CronReport,\n    'cron/run': CronRunNow,\n    // ── hooks (content fires ride rd/*; only metadata/effect control is here) ──\n    'hook/report': HookReport,\n    'hook/start': HookStart,\n    'hook/start/ok': HookStartOk,\n    'github/review-authorize': GithubReviewAuthorize,\n    'github/review-authorized': GithubReviewAuthorized,\n    'github/review-result': GithubReviewResultReport,\n    'github/review-result/ok': GithubReviewResultOk,\n    // ── integrations (platform config distribution; token-bearing — never log) ──\n    'integration/upsert': IntegrationUpsert,\n    'integration/remove': IntegrationRemove,\n    'integration/channels': IntegrationChannels,\n    // ── git credentials (github-app workspaces; token-bearing — never log) ──\n    'gitcred/request': GitCredRequest,\n    'gitcred/grant': GitCredGrant,\n    // ── secrets ──\n    'secrets/request': SecretsRequest,\n    'secrets/grant': SecretsGrant,\n    'secrets/renew': SecretsRenew,\n    'secrets/revoke': SecretsRevoke,\n    'scope-attestation': ScopeAttestation,\n    // ── dashboard / facts ──\n    'event/session': EventSession,\n    'usage/report': UsageReport,\n    'facts/runtime-profile': FactsRuntimeProfile,\n    'facts/daemon-runtimes': DaemonRuntimes,\n    // ── session read-back (console history pull) ──\n    'session/list': SessionListReq,\n    'session/list/page': SessionListPage,\n    'session/history': SessionHistoryReq,\n    'session/history/page': SessionHistoryPage,\n    'session/tool-body': SessionToolBodyReq,\n    'session/tool-body/chunk': SessionToolBodyChunk,\n    // ── channel agent directory (agent collaboration; D→C REQ → REP) ──\n    'channel/agents': ChannelAgentsReq,\n    'channel/agents/ok': ChannelAgentsOk,\n    // ── workspace file browsing (console live pull; bytes transit, never stored) ──\n    'workspace/list': WorkspaceListReq,\n    'workspace/list/page': WorkspaceListPage,\n    'workspace/read': WorkspaceReadReq,\n    'workspace/read/content': WorkspaceReadContent,\n    'workspace/gitstatus': WorkspaceGitStatusReq,\n    'workspace/gitstatus/result': WorkspaceGitStatus,\n    'workspace/gitpull': WorkspaceGitPullReq,\n    'workspace/gitpull/result': WorkspaceGitPullResult,\n    'memory/list': MemoryListReq,\n    'memory/list/page': MemoryListPage,\n    'memory/read': MemoryReadReq,\n    'memory/read/content': MemoryReadContent,\n    'memory/write': MemoryWriteReq,\n    'memory/write/ok': MemoryWriteOk,\n    // ── fleet / config ──\n    'config/push': ConfigPush,\n    'daemon/restart': DaemonRestart,\n    'daemon/upgrade': DaemonUpgrade,\n    // ── generic replies ──\n    'daemon/control/ack': DaemonControlAck,\n    ack: Ack,\n    // ── error ──\n    error: ErrorFrame\n};\n/** All frame `type` strings, as a runtime array (used by guards / tests). */\nexport const FRAME_TYPES = Object.keys(FRAME_SCHEMAS);\n/**\n * Builds the envelope schema for one frame `type` with a `type` literal and the\n * typed payload, so the discriminated union infers `payload` precisely.\n *\n * Kept as a local generic (payload pinned to `FRAME_SCHEMAS[T]`) so a\n * mispaired member — `frame('auth', FRAME_SCHEMAS['register'])` — is a compile\n * error; a bare `frameSchema` alias would accept it. The body is deliberately\n * inlined rather than delegated: `return frameSchema(type, payload)` under\n * THIS generic signature collapses every union member's `payload` to `unknown`\n * (113 × TS18046 under TS 6.0.3 / zod 4.4.3 — reproducible by making exactly\n * that substitution), while the small relay unions call `frameSchema` with\n * concrete schemas and infer fine.\n */\nfunction frame(type, payload) {\n    return z.object({\n        v: z.literal(1),\n        id: z.string().uuid(),\n        ts: z.string().datetime(),\n        type: z.literal(type),\n        corr: z.string().uuid().optional(),\n        payload\n    });\n}\n/**\n * `AnyFrame` — the discriminated union over `type` of every fully-validated\n * frame (envelope + typed payload). This is the runtime guard at the socket\n * edge and the precise inferred type the handlers switch on.\n */\nexport const AnyFrame = z.discriminatedUnion('type', [\n    frame('auth', FRAME_SCHEMAS['auth']),\n    frame('auth/ok', FRAME_SCHEMAS['auth/ok']),\n    frame('register', FRAME_SCHEMAS['register']),\n    frame('register/ok', FRAME_SCHEMAS['register/ok']),\n    frame('relay/roster', FRAME_SCHEMAS['relay/roster']),\n    frame('collaboration/routes', FRAME_SCHEMAS['collaboration/routes']),\n    frame('heartbeat', FRAME_SCHEMAS['heartbeat']),\n    frame('agent/launch', FRAME_SCHEMAS['agent/launch']),\n    frame('agent/launched', FRAME_SCHEMAS['agent/launched']),\n    frame('agent/stop', FRAME_SCHEMAS['agent/stop']),\n    frame('agent/upsert', FRAME_SCHEMAS['agent/upsert']),\n    frame('agent/remove', FRAME_SCHEMAS['agent/remove']),\n    frame('agent/detach', FRAME_SCHEMAS['agent/detach']),\n    frame('agent/activate', FRAME_SCHEMAS['agent/activate']),\n    frame('agent/activity', FRAME_SCHEMAS['agent/activity']),\n    frame('agent/scope-denied', FRAME_SCHEMAS['agent/scope-denied']),\n    // ── webchat (integration over the control WS) ──\n    frame('route/assign', FRAME_SCHEMAS['route/assign']),\n    frame('route/assign/ack', FRAME_SCHEMAS['route/assign/ack']),\n    frame('route/update', FRAME_SCHEMAS['route/update']),\n    frame('daemon/drain', FRAME_SCHEMAS['daemon/drain']),\n    frame('drain/progress', FRAME_SCHEMAS['drain/progress']),\n    frame('drain/done', FRAME_SCHEMAS['drain/done']),\n    frame('cron/upsert', FRAME_SCHEMAS['cron/upsert']),\n    frame('cron/remove', FRAME_SCHEMAS['cron/remove']),\n    frame('cron/report', FRAME_SCHEMAS['cron/report']),\n    frame('cron/run', FRAME_SCHEMAS['cron/run']),\n    frame('hook/report', FRAME_SCHEMAS['hook/report']),\n    frame('hook/start', FRAME_SCHEMAS['hook/start']),\n    frame('hook/start/ok', FRAME_SCHEMAS['hook/start/ok']),\n    frame('github/review-authorize', FRAME_SCHEMAS['github/review-authorize']),\n    frame('github/review-authorized', FRAME_SCHEMAS['github/review-authorized']),\n    frame('github/review-result', FRAME_SCHEMAS['github/review-result']),\n    frame('github/review-result/ok', FRAME_SCHEMAS['github/review-result/ok']),\n    frame('integration/upsert', FRAME_SCHEMAS['integration/upsert']),\n    frame('integration/remove', FRAME_SCHEMAS['integration/remove']),\n    frame('integration/channels', FRAME_SCHEMAS['integration/channels']),\n    frame('gitcred/request', FRAME_SCHEMAS['gitcred/request']),\n    frame('gitcred/grant', FRAME_SCHEMAS['gitcred/grant']),\n    frame('secrets/request', FRAME_SCHEMAS['secrets/request']),\n    frame('secrets/grant', FRAME_SCHEMAS['secrets/grant']),\n    frame('secrets/renew', FRAME_SCHEMAS['secrets/renew']),\n    frame('secrets/revoke', FRAME_SCHEMAS['secrets/revoke']),\n    frame('scope-attestation', FRAME_SCHEMAS['scope-attestation']),\n    frame('event/session', FRAME_SCHEMAS['event/session']),\n    frame('usage/report', FRAME_SCHEMAS['usage/report']),\n    frame('facts/runtime-profile', FRAME_SCHEMAS['facts/runtime-profile']),\n    frame('facts/daemon-runtimes', FRAME_SCHEMAS['facts/daemon-runtimes']),\n    frame('session/list', FRAME_SCHEMAS['session/list']),\n    frame('session/list/page', FRAME_SCHEMAS['session/list/page']),\n    frame('session/history', FRAME_SCHEMAS['session/history']),\n    frame('session/history/page', FRAME_SCHEMAS['session/history/page']),\n    frame('session/tool-body', FRAME_SCHEMAS['session/tool-body']),\n    frame('session/tool-body/chunk', FRAME_SCHEMAS['session/tool-body/chunk']),\n    frame('channel/agents', FRAME_SCHEMAS['channel/agents']),\n    frame('channel/agents/ok', FRAME_SCHEMAS['channel/agents/ok']),\n    frame('workspace/list', FRAME_SCHEMAS['workspace/list']),\n    frame('workspace/list/page', FRAME_SCHEMAS['workspace/list/page']),\n    frame('workspace/read', FRAME_SCHEMAS['workspace/read']),\n    frame('workspace/read/content', FRAME_SCHEMAS['workspace/read/content']),\n    frame('workspace/gitstatus', FRAME_SCHEMAS['workspace/gitstatus']),\n    frame('workspace/gitstatus/result', FRAME_SCHEMAS['workspace/gitstatus/result']),\n    frame('workspace/gitpull', FRAME_SCHEMAS['workspace/gitpull']),\n    frame('workspace/gitpull/result', FRAME_SCHEMAS['workspace/gitpull/result']),\n    frame('memory/list', FRAME_SCHEMAS['memory/list']),\n    frame('memory/list/page', FRAME_SCHEMAS['memory/list/page']),\n    frame('memory/read', FRAME_SCHEMAS['memory/read']),\n    frame('memory/read/content', FRAME_SCHEMAS['memory/read/content']),\n    frame('memory/write', FRAME_SCHEMAS['memory/write']),\n    frame('memory/write/ok', FRAME_SCHEMAS['memory/write/ok']),\n    frame('config/push', FRAME_SCHEMAS['config/push']),\n    frame('daemon/restart', FRAME_SCHEMAS['daemon/restart']),\n    frame('daemon/upgrade', FRAME_SCHEMAS['daemon/upgrade']),\n    frame('daemon/control/ack', FRAME_SCHEMAS['daemon/control/ack']),\n    frame('ack', FRAME_SCHEMAS['ack']),\n    frame('error', FRAME_SCHEMAS['error'])\n]);\n/** Runtime guard: is `t` a known frame `type`? */\nexport function isFrameType(t) {\n    return Object.prototype.hasOwnProperty.call(FRAME_SCHEMAS, t);\n}\n//# sourceMappingURL=frame.js.map","import { randomUUID } from 'node:crypto';\nimport { Envelope, NIL_UUID } from './envelope.js';\n/**\n * Generic envelope codec — the schema-map-agnostic core shared by every wire.\n *\n * The daemon↔CP wire (`codec.ts` over `FRAME_SCHEMAS`) and the two relay wires\n * (`frames/relay-cp.ts` / `frames/relay-daemon.ts` over their OWN maps) all\n * decode the same envelope shape but accept disjoint frame families — a relay\n * socket must answer a daemon↔CP frame with `UNKNOWN_FRAME`, and vice versa\n * (shared-bot-relay.md §8 \"独立帧 union，不混入 daemon 协议\").\n */\n/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */\nexport const MAX_FRAME_BYTES = 256 * 1024;\nconst textEncoder = new TextEncoder();\nfunction byteLength(text) {\n    return textEncoder.encode(text).length;\n}\nfunction extractControlExt(json) {\n    if (typeof json !== 'object' || json === null)\n        return undefined;\n    const o = json;\n    const ext = {};\n    if (typeof o.epoch === 'number')\n        ext.epoch = o.epoch;\n    if (typeof o.agentId === 'string')\n        ext.agentId = o.agentId;\n    if (typeof o.launchId === 'string')\n        ext.launchId = o.launchId;\n    return Object.keys(ext).length > 0 ? ext : undefined;\n}\n/**\n * Decode one wire frame against `schemas` (the wire's `type` → payload map).\n * Two-step parse: envelope first, then the per-type payload schema — an unknown\n * `type` is a typed `UNKNOWN_FRAME` failure (a REP, never a hard close).\n */\nexport function decodeEnvelopeWith(schemas, text) {\n    if (byteLength(text) > MAX_FRAME_BYTES) {\n        return { ok: false, id: NIL_UUID, msg: 'FRAME_TOO_LARGE' };\n    }\n    let json;\n    try {\n        json = JSON.parse(text);\n    }\n    catch {\n        return { ok: false, id: NIL_UUID, msg: 'invalid json' };\n    }\n    const env = Envelope.safeParse(json);\n    if (!env.success) {\n        const id = typeof json === 'object' && json !== null && typeof json.id === 'string'\n            ? json.id\n            : NIL_UUID;\n        return { ok: false, id, msg: env.error.message };\n    }\n    const schema = schemas[env.data.type];\n    if (!schema) {\n        return {\n            ok: false,\n            id: env.data.id,\n            msg: 'UNKNOWN_FRAME',\n            ...(env.data.corr ? { corr: env.data.corr } : {})\n        };\n    }\n    const payload = schema.safeParse(env.data.payload);\n    if (!payload.success) {\n        return {\n            ok: false,\n            id: env.data.id,\n            msg: payload.error.message,\n            ...(env.data.corr ? { corr: env.data.corr } : {})\n        };\n    }\n    const ext = extractControlExt(json);\n    return {\n        ok: true,\n        frame: { ...env.data, payload: payload.data },\n        ...(ext ? { ext } : {})\n    };\n}\n/**\n * Wrap a payload in the wire envelope. Untyped core — each wire exports a typed\n * wrapper (`buildEnvelope` / `buildRelayCpFrame` / `buildRelayDaemonFrame`) that\n * pins `type` to its own union and casts the result.\n */\nexport function buildEnvelopeRaw(type, payload, opts = {}) {\n    return {\n        v: 1,\n        id: opts.id ?? randomUUID(),\n        ts: opts.ts ?? new Date().toISOString(),\n        type,\n        payload,\n        ...(opts.corr ? { corr: opts.corr } : {}),\n        ...(opts.ext ?? {})\n    };\n}\n//# sourceMappingURL=wire.js.map","import { FRAME_SCHEMAS } from './index.js';\nimport { MAX_FRAME_BYTES, buildEnvelopeRaw, decodeEnvelopeWith } from './wire.js';\n/**\n * The daemon↔CP wire codec — the `FRAME_SCHEMAS` instantiation of the generic\n * envelope codec in `wire.ts`. The relay wires (`frames/relay-*.ts`) build their\n * own instantiations over their own schema maps; the unions never mix.\n */\nexport { MAX_FRAME_BYTES };\nexport function decodeEnvelope(text) {\n    return decodeEnvelopeWith(FRAME_SCHEMAS, text);\n}\nexport function buildEnvelope(type, payload, opts = {}) {\n    return buildEnvelopeRaw(type, payload, opts);\n}\nexport function encode(frame) {\n    return JSON.stringify(frame);\n}\n//# sourceMappingURL=codec.js.map","import { z } from 'zod';\nimport { frameSchema } from '../envelope.js';\nimport { ErrorFrame } from './error.js';\nimport { BindMatch } from './integration.js';\nimport { CronTarget } from './cron.js';\nimport { CollabRoutesSnapshot } from './collab.js';\nimport { GithubHookMetadata, HookBigIntString, OptionalHookConfigSnapshot } from './hook.js';\nimport { buildEnvelopeRaw, decodeEnvelopeWith } from '../wire.js';\n/**\n * relay↔CP control frames (`rc/*`) — shared-bot-relay.md §7.1 / §8.\n *\n * The relay dials OUT to the CP (`/api/v1/relays/ws`) and this wire carries\n * ONLY control signaling: registration, heartbeat, delegated credential\n * verification, and revocation. Message content NEVER crosses it — content\n * flows browser/platform → relay → daemon on the `rd/*` wire.\n *\n * This is a SEPARATE frame union from the daemon↔CP protocol (`frame.ts`) and\n * from the relay↔daemon wire (`relay-daemon.ts`): each socket decodes against\n * its own schema map, so a frame from the wrong family is `UNKNOWN_FRAME`.\n *\n * Milestone A carried the skeleton subset (register / heartbeat / verify /\n * daemon-revoke); milestone B-github adds the hook frames (`rc/hook-assign`,\n * `rc/hook-remove`, `rc/run-report` — webhook-triggers-and-github-events.md).\n * Shared-bot (`rc/bot-assign`…) frames land with milestone B-slack.\n */\n/** Subprotocol negotiated on the relay↔CP socket. */\nexport const RELAY_CP_SUBPROTOCOL = 'agentconnect.rc.v1';\n// ── auth (first frame; §8 dual-mode) ─────────────────────────────────────────\n// R→C REQ → rc/auth/ok. `token` = deployment-shared secret (`RELAY_TOKEN`, or a\n// JWT signed with it — the credential FORM is discriminated by the presence of\n// dots, not here); `apikey` = a per-relay ApiKey (kind 'relay', org-less).\n// The credential is secret material — NEVER log this frame.\nexport const RcAuth = z.object({\n    method: z.enum(['token', 'apikey']),\n    credential: z.string().min(1)\n});\n// C→R REP (corr = rc/auth id). Rejection is a `error` REP + close, not a reply.\nexport const RcAuthOk = z.object({\n    heartbeatSec: z.number().int(), // cadence the relay must emit rc/heartbeat at\n    serverTime: z.string().datetime()\n});\n// ── registration ─────────────────────────────────────────────────────────────\n// R→C REQ → rc/registered. Announces this relay instance and where daemons can\n// dial it. Re-sent on every (re)connect; the CP upserts and re-issues the id.\n// `daemonUrl` MUST route to THIS instance (per-pod DNS or a relay-id-sticky\n// path) — a pool-level random LB breaks the no-cross-pod-forwarding topology\n// (design §5). The pool-level public ingress is env-level PUBLIC_RELAY_URL and\n// is never registered here.\nexport const RcRegister = z.object({\n    name: z.string().min(1), // deployment-side identity (pod name etc.)\n    daemonUrl: z.string().min(1) // per-instance-routable WSS origin daemons dial\n});\n// C→R REP (corr = rc/register id).\nexport const RcRegistered = z.object({\n    relayId: z.string().uuid()\n});\n// R→C EVT — liveness; drives `relay.lastSeenAt` and the failover sweeper.\nexport const RcHeartbeat = z.object({});\n// ── delegated verification (§9 / §10) ────────────────────────────────────────\n// R→C REQ → rc/verify/ok. The relay holds no database, so it delegates credential\n// checks to the CP: a daemon's API key on `rd/hello`, or a browser's CP-minted\n// short-lived webchat token. The credential is secret material — NEVER log.\nexport const RcVerify = z.object({\n    kind: z.enum(['daemon-key', 'webchat-token']),\n    credential: z.string().min(1)\n});\n// C→R REP (corr = rc/verify id). `ok:false` carries no detail beyond `reason`\n// (no existence oracle). On success the identity fields depend on `kind`:\n//  - daemon-key     → daemonId + orgId\n//  - webchat-token  → userId (+ display `user`) + agentId + daemonId + orgId,\n//    where daemonId is the agent's CURRENT placement (resolved at verify time).\nexport const RcVerifyResult = z.object({\n    ok: z.boolean(),\n    reason: z.string().optional(),\n    orgId: z.string().optional(),\n    daemonId: z.string().uuid().optional(),\n    userId: z.string().optional(),\n    user: z.string().optional(), // display handle for the transcript author line\n    agentId: z.string().uuid().optional()\n});\n// R→C REQ → rc/github-comment-authz/ok. A GitHub comment webhook may carry\n// a stale `author_association`, so the relay asks the CP (which owns the App\n// installation) for a current repository-permission verdict. This frame is\n// deliberately metadata-only: comment text and other message content must\n// never cross the relay↔CP control plane.\nexport const RcGithubCommentAuthz = z\n    .object({\n    hookId: z.string().uuid(),\n    installationId: z.string().regex(/^[1-9]\\d*$/),\n    repoId: z.string().regex(/^[1-9]\\d*$/),\n    repoFullName: z.string().regex(/^[^/\\s]+\\/[^/\\s]+$/),\n    senderLogin: z.string().min(1),\n    // Fence the fallback to the exact compiled rule that accepted the\n    // delivery. A stale relay copy cannot authorize after retarget/reassign.\n    configRevision: HookBigIntString,\n    dispatchRevision: HookBigIntString\n})\n    .strict();\n// C→R REP (corr = rc/github-comment-authz id). Do not disclose the user's\n// effective permission or which validation failed; the relay needs one bit.\nexport const RcGithubCommentAuthzResult = z.object({ allowed: z.boolean() }).strict();\n// R→C REQ — a signature-verified `check_run:rerequested` control action. The\n// relay forwards only the opaque Check identity and revision fence; the CP\n// resolves the owning durable projection before authorizing a fresh delivery.\nexport const RcGithubRerequest = z\n    .object({\n    checkRunId: z.string().regex(/^[1-9]\\d*$/),\n    repoId: z.string().regex(/^[1-9]\\d*$/),\n    headSha: z.string().min(1),\n    deliveryKey: z.string().min(1).max(200)\n})\n    .strict();\n// C→R REP (corr = rc/github-rerequest id). A denial is intentionally bare. On\n// success the CP returns only metadata already bound to the projection's\n// current HookRun; the relay re-fences it against its current compiled rule.\nexport const RcGithubRerequestResult = z.discriminatedUnion('allowed', [\n    z.object({ allowed: z.literal(false) }).strict(),\n    z\n        .object({\n        allowed: z.literal(true),\n        hookId: z.string().uuid(),\n        pullNumber: z.number().int().positive(),\n        configRevision: HookBigIntString,\n        dispatchRevision: HookBigIntString\n    })\n        .strict()\n]);\n// ── hooks (webhook-triggers-and-github-events.md; pool-wide broadcast) ──────\n// C→R EVT — one enabled hook's compiled rule, broadcast to the WHOLE pool\n// (webhook-type ingress is pool-served, shared-bot-relay.md §5). Upsert\n// semantics: the CP re-sends the full frame on hook create/update/enable, on\n// agent placement moves, and (github kind) when the org's installation set\n// changes; disable/delete send `rc/hook-remove`. After a relay (re)registers\n// the CP replays every enabled hook — the relay's table is a memory copy.\n// `hmacSecret` is secret material — NEVER log this frame.\nexport const RcHookAssign = z\n    .object({\n    hookId: z.string().uuid(),\n    kind: z.enum(['webhook', 'github']),\n    agentId: z.string().uuid(),\n    daemonId: z.string().uuid(), // the agent's CURRENT placement; re-sent on moves\n    // R1/R2a rolling fields. Partial/absent remains decodable, but the relay\n    // propagates an incomplete tuple with review/reporting forced off.\n    ...OptionalHookConfigSnapshot.shape,\n    // No prompt: the agent's description is its standing context; the delivery\n    // payload carries the caller's message (design 安全边界 1).\n    sessionMode: z.enum(['perDelivery', 'perThread', 'shared']),\n    target: CronTarget.optional(), // output anchoring; absent ⇒ headless\n    // kind=webhook — required for that kind (enforced at the CP compile site)\n    webhook: z\n        .object({\n        urlToken: z.string().min(1), // ingress routing key (capability URL)\n        hmacSecret: z.string().optional() // optional X-AC-Signature key\n    })\n        .optional(),\n    // kind=github (P2) — required for that kind\n    github: z\n        .object({\n        repoId: z.string(), // GitHub numeric repo id (BigInt as string) — the match key\n        repoFullName: z.string(), // display/logs only; never matched on\n        events: z.array(z.string()), // 'issues:opened' / 'pull_request:*' / …\n        labelFilter: z.array(z.string()),\n        // Optional disambiguator for GitHub's shared issue_comment event. Absent\n        // or empty preserves the legacy/API repo-wide meaning; a new CP stamps\n        // the console-selected thread families so the relay can isolate replies.\n        commentFamilies: z.array(z.enum(['issues', 'pull_request'])).optional(),\n        // P3 summon mode: every event's authored text must @-mention the App.\n        // Comments ALWAYS pass the collaborator gate in addition to this flag.\n        mentionOnly: z.boolean(),\n        // The App's slug — what a mention looks like (`@<appSlug>`). Compiled from\n        // the CP's GITHUB_APP_SLUG (per-org Apps would move it per rule, 待定 3).\n        // Absent on rules from a pre-P3 CP ⇒ mentionOnly fires fail closed.\n        appSlug: z.string().optional(),\n        // The org's valid installation ids (BigInt as string) — the runtime\n        // attribution gate: an event fires only if payload.installation.id ∈ set.\n        installationIds: z.array(z.string())\n    })\n        .optional()\n})\n    .superRefine((rule, ctx) => {\n    if (rule.dispatchDaemonId !== undefined && rule.dispatchDaemonId !== rule.daemonId) {\n        ctx.addIssue({\n            code: 'custom',\n            path: ['dispatchDaemonId'],\n            message: 'dispatchDaemonId must equal daemonId on a compiled rule'\n        });\n    }\n});\n// C→R EVT — drop one rule (hook disabled / deleted / agent unplaced).\nexport const RcHookRemove = z.object({\n    hookId: z.string().uuid()\n});\n/** Definite pre-dispatch unavailability: the relay found no live connection for\n * the assigned daemon, so no agent turn or external review effect could start. */\nexport const HOOK_DELIVERY_REASON_DAEMON_OFFLINE = 'daemon_offline';\n/** Ambiguous delivery: the daemon may have admitted the message before the ACK\n * was lost. Record it consistently, but do not automatically redeliver it\n * without cross-daemon idempotency or an end-to-end admission fence. */\nexport const HOOK_DELIVERY_REASON_DISPATCH_TIMEOUT = 'dispatch_timeout';\n/** Delivery-stage failures that are safe to redeliver automatically. Keep this\n * list closed: unknown failures and agent/business rejections require an\n * explicit decision before they can cause another turn or external effect. */\nexport const RETRYABLE_HOOK_DELIVERY_REASONS = [HOOK_DELIVERY_REASON_DAEMON_OFFLINE];\nconst retryableHookDeliveryReasons = new Set(RETRYABLE_HOOK_DELIVERY_REASONS);\nexport function isRetryableHookDeliveryReason(reason) {\n    return typeof reason === 'string' && retryableHookDeliveryReasons.has(reason);\n}\n// R→C EVT (fire-and-forget) — delivery-stage bookkeeping, pure metadata (no\n// payload ever). `accepted` opens the HookRun row (running); `failed` records a\n// failed row outright. The daemon's `hook/report` completion EVT (frames/hook.ts,\n// the control WS) later closes accepted rows; the HookRunReaper harvests the\n// rest. Duplicate reports collapse on the CP's (hookId, deliveryKey) unique key.\nexport const RcRunReport = z\n    .object({\n    hookId: z.string().uuid(),\n    deliveryKey: z.string().min(1),\n    firedAt: z.string().datetime(), // relay ingest time == HookRun.startedAt\n    agentId: z.string().uuid(),\n    daemonId: z.string().uuid().optional(),\n    ...OptionalHookConfigSnapshot.shape,\n    event: z.string().min(1).optional(), // 'issues:opened' etc (github); absent for webhook kind\n    github: GithubHookMetadata.optional(),\n    status: z.enum(['accepted', 'failed']),\n    reason: z.string().optional() // delivery-stage reason; use isRetryableHookDeliveryReason before redelivery\n})\n    .superRefine((report, ctx) => {\n    if (report.daemonId !== undefined &&\n        report.dispatchDaemonId !== undefined &&\n        report.daemonId !== report.dispatchDaemonId) {\n        ctx.addIssue({\n            code: 'custom',\n            path: ['dispatchDaemonId'],\n            message: 'dispatchDaemonId must equal daemonId on a delivery report'\n        });\n    }\n});\n// R→C EVT (fire-and-forget) — installation doorbell (webhook-triggers 决策 11):\n// the relay forwards a verified `installation`/`installation_repositories`\n// event as a minimal poke; the CP re-pulls `GET /app/installations/{id}` as the\n// source of truth (`action` is observational — the CP never writes from it).\n// Emitted ONLY after X-Hub-Signature-256 verification. A dropped doorbell is\n// safe: the pull-based sync paths (setup callback / manual Sync / mint-failure\n// markRevoked) converge eventually.\nexport const RcGithubInstallation = z.object({\n    installationId: z.string().min(1), // GitHub numeric id (BigInt as string)\n    action: z.string().min(1) // created|deleted|suspend|…|added|removed\n});\n// ── revocation (§9 吊销闭环) ─────────────────────────────────────────────────\n// C→R EVT — the daemon's credential was revoked / membership removed: the relay\n// must immediately drop that daemon's connection and stop routing to it.\nexport const RcDaemonRevoke = z.object({\n    daemonId: z.string().uuid()\n});\n// The Block Kit `action_id` on a shared bot's 👤 switch-agent button (§10.1; older\n// posted messages may still carry the same action on their footer). The DAEMON renders\n// the button (send-only) and the RELAY receives the click over Socket Mode — they're\n// different processes, so the id is pinned here as the single source. The `callback_id`\n// on the relay-owned default-agent modal shares the same string. Session configuration\n// uses `SLACK_STATUS_ACTION.manage` (⚙️) instead.\nexport const SHARED_CONFIG_ACTION_ID = 'ac_shared_channel_config';\n/** The Block Kit `action_id` on a shared status bar's inline agent selector.\n *  The relay owns the shared app's Socket Mode connection and answers both the\n *  external-select suggestions and the resulting channel-default selection. Keep\n *  this separate from {@link SHARED_CONFIG_ACTION_ID}: older posted messages still\n *  use that id for the legacy 👤 button + modal flow. */\nexport const SHARED_AGENT_SELECT_ACTION_ID = 'ac_shared_agent_select';\n/** Slack action ids shared by the daemon-owned status modal and the relay-owned\n *  Socket Mode edge. Dedicated bots handle them in the daemon directly; shared bots\n *  forward them from the relay to the target daemon. */\nexport const SLACK_STATUS_ACTION = {\n    more: 'ac_more',\n    manage: 'ac_manage',\n    setModel: 'ac_set_model',\n    setEffort: 'ac_set_effort',\n    setPermissionMode: 'ac_set_permission_mode',\n    setFast: 'ac_set_fast',\n    setOutput: 'ac_set_output',\n    cancel: 'ac_cancel',\n    view: 'ac_view'\n};\n/** One short choice from the compact Slack status overflow. Slack caps option\n *  values at 150 characters; the longer session target rides in `block_id`. */\nexport const SlackStatusOverflowAction = z.enum(['switch-agent', 'manage', 'cancel']);\nconst LegacySlackStatusOverflowValue = z\n    .object({\n    v: z.literal(1),\n    action: SlackStatusOverflowAction,\n    target: z.string().min(1)\n})\n    .strict();\nexport function encodeSlackStatusOverflowValue(action) {\n    return action;\n}\nexport function decodeSlackStatusOverflowValue(value) {\n    const compact = SlackStatusOverflowAction.safeParse(value);\n    if (compact.success)\n        return { action: compact.data };\n    try {\n        const legacy = LegacySlackStatusOverflowValue.safeParse(JSON.parse(value));\n        return legacy.success ? { action: legacy.data.action, target: legacy.data.target } : null;\n    }\n    catch {\n        return null;\n    }\n}\n/** Opaque routing target carried by a shared bot's session-config button and modal.\n *  Slack returns it unchanged in `action.value` / `view.private_metadata`; the relay\n *  validates the agent against its current bot assignment before forwarding. */\nexport const SharedSlackStatusTarget = z\n    .object({\n    v: z.literal(1),\n    agentId: z.string().min(1),\n    integrationId: z.string().min(1),\n    sessionKey: z.string().min(1)\n})\n    .strict();\nexport function encodeSharedSlackStatusTarget(target) {\n    return JSON.stringify({ v: 1, ...target });\n}\nexport function decodeSharedSlackStatusTarget(value) {\n    try {\n        const parsed = SharedSlackStatusTarget.safeParse(JSON.parse(value));\n        return parsed.success ? parsed.data : null;\n    }\n    catch {\n        return null;\n    }\n}\n// ── shared-bot assignment + routing (§7.1 / §10) ─────────────────────────────\n// One attributed routing rule the relay arbitrates inbound against. Unlike the\n// daemon's local BindRule this ALREADY carries its target (agentId + the daemon\n// to forward to + the integration id to send the reply back through) — the\n// CP→relay protocol is new, so the v1 \"owner side can't express attribution\"\n// blocker is fixed by attaching attribution here (§3). `scope` narrows the rule\n// to a channel/thread (channel ownership → per-channel default agent, §10).\nexport const AttributedRoute = z.object({\n    agentId: z.string().uuid(),\n    daemonId: z.string().uuid(),\n    integrationId: z.string().uuid(),\n    scope: z.object({ channel: z.string().optional(), thread: z.string().optional() }).optional(),\n    match: BindMatch\n});\n// Bot credentials handed to the relay. `appToken` (Slack xapp) is the event-stream\n// subscription capability and lives ONLY here + the CP db (§14 credential\n// domaining) — daemons never get it. Secret material — NEVER log this frame.\nexport const RcBotSecrets = z.object({\n    botToken: z.string(), // xoxb / BotFather token — the relay opens the ingest with it\n    appToken: z.string().optional() // xapp — Slack Socket Mode only\n});\n// One member agent's display info — the relay holds no DB, so it can't resolve a\n// name from an id. Carried so the relay can label the per-channel \"default agent\"\n// picker modal (§10.1 config button). Ids alone aren't enough for a human list.\nexport const RcAgentDirEntry = z.object({\n    agentId: z.string().uuid(),\n    name: z.string(), // the slug; the modal shows it (displayName folded in by the CP if set)\n    daemonId: z.string().uuid()\n});\n// C→R EVT — assign a shared bot's INBOUND to this relay: open the platform ingest\n// (Slack Socket Mode / TG long-poll) and arbitrate against `routes`. The CP picks\n// exactly ONE relay per shared bot (single-consumer, §4.2); a re-assign to another\n// relay is unassign-here + assign-there. `members` lists which daemons/agents this\n// bot serves (drives which daemon connections the relay expects). NEVER log.\nexport const RcBotAssign = z.object({\n    botId: z.string().uuid(),\n    platform: z.enum(['slack', 'telegram', 'discord']),\n    botUserId: z.string().optional(), // resolved by CP; for echo suppression + mention match\n    secrets: RcBotSecrets,\n    members: z.array(z.object({ daemonId: z.string().uuid(), agentIds: z.array(z.string().uuid()) })),\n    agents: z.array(RcAgentDirEntry).default([]), // member directory (id→name) for the config modal\n    routes: z.array(AttributedRoute),\n    defaultAgentId: z.string().uuid().optional(), // bare @bot / DM fallback within the group (§10.3)\n    defaultDaemonId: z.string().uuid().optional()\n});\n// C→R EVT — release a shared bot from this relay (bot un-shared, uninstalled, or\n// re-placed onto another relay): close the ingest, drop the routing table.\nexport const RcBotUnassign = z.object({\n    botId: z.string().uuid()\n});\n// C→R EVT — hot-update the routing table for an already-assigned bot (channel\n// ownership / membership / default-agent change) WITHOUT re-opening the ingest.\nexport const RcRoutes = z.object({\n    botId: z.string().uuid(),\n    members: z.array(z.object({ daemonId: z.string().uuid(), agentIds: z.array(z.string().uuid()) })),\n    agents: z.array(RcAgentDirEntry).default([]),\n    routes: z.array(AttributedRoute),\n    defaultAgentId: z.string().uuid().optional(),\n    defaultDaemonId: z.string().uuid().optional()\n});\n// C→R EVT — durable per-sessionKey thread affinity (§10 step 3): the CP learns\n// from session telemetry which agent owns a (channel, thread) and pushes it so the\n// relay's in-memory affinity survives a restart / re-assign (full re-push on\n// re-assign restores it). A relay MAY also learn affinity live; this is the\n// authoritative fallback.\nexport const RcAssign = z.object({\n    botId: z.string().uuid(),\n    sessionKey: z.string().min(1),\n    agentId: z.string().uuid(),\n    daemonId: z.string().uuid()\n});\n// R→C EVT (fire-and-forget) — the operator picked a channel's default agent in the\n// in-Slack config modal (§10.1). The CP persists it as the channel's owner\n// (IntegrationChannel.agentId on the chosen agent's install for this bot, clearing\n// any other install's row for the same channel) and re-compiles the bot's routes\n// (rc/routes). `agentId: null` clears the channel's default. The relay acks the\n// modal immediately; this rides best-effort like other rc EVTs.\nexport const RcSetChannelAgent = z.object({\n    botId: z.string().uuid(),\n    channelId: z.string().min(1),\n    agentId: z.string().uuid().nullable()\n});\n// C→R EVT — the bot-AGNOSTIC agent-collaboration routing snapshot (agent-collaboration\n// §2.3 / §6.2 / §6.5). FULL-REPLACE: the relay swaps its whole `(orgId,platform,channel)\n// → agents` table. Unlike `rc/bot-assign` (keyed by botId, can't address cross-bot), this\n// lets the relay resolve a cross-daemon `rd/agentmsg` `toAgentId` → owning daemonId and\n// authorize caller/target call policy. Bodiless routing/policy metadata only.\nexport const RcCollabRoutes = CollabRoutesSnapshot;\n// ── the wire union ───────────────────────────────────────────────────────────\n/** `type` string → payload schema for the relay↔CP wire. */\nexport const RELAY_CP_SCHEMAS = {\n    'rc/auth': RcAuth,\n    'rc/auth/ok': RcAuthOk,\n    'rc/register': RcRegister,\n    'rc/registered': RcRegistered,\n    'rc/heartbeat': RcHeartbeat,\n    'rc/verify': RcVerify,\n    'rc/verify/ok': RcVerifyResult,\n    'rc/github-comment-authz': RcGithubCommentAuthz,\n    'rc/github-comment-authz/ok': RcGithubCommentAuthzResult,\n    'rc/github-rerequest': RcGithubRerequest,\n    'rc/github-rerequest/ok': RcGithubRerequestResult,\n    'rc/hook-assign': RcHookAssign,\n    'rc/hook-remove': RcHookRemove,\n    'rc/run-report': RcRunReport,\n    'rc/github-installation': RcGithubInstallation,\n    'rc/daemon-revoke': RcDaemonRevoke,\n    'rc/bot-assign': RcBotAssign,\n    'rc/bot-unassign': RcBotUnassign,\n    'rc/routes': RcRoutes,\n    'rc/assign': RcAssign,\n    'rc/set-channel-agent': RcSetChannelAgent,\n    'rc/collab-routes': RcCollabRoutes,\n    error: ErrorFrame\n};\n/** All relay↔CP frame `type` strings, as a runtime array (guards / tests). */\nexport const RELAY_CP_FRAME_TYPES = Object.keys(RELAY_CP_SCHEMAS);\n/** The discriminated union of every fully-validated relay↔CP frame. */\nexport const RelayCpFrame = z.discriminatedUnion('type', [\n    frameSchema('rc/auth', RELAY_CP_SCHEMAS['rc/auth']),\n    frameSchema('rc/auth/ok', RELAY_CP_SCHEMAS['rc/auth/ok']),\n    frameSchema('rc/register', RELAY_CP_SCHEMAS['rc/register']),\n    frameSchema('rc/registered', RELAY_CP_SCHEMAS['rc/registered']),\n    frameSchema('rc/heartbeat', RELAY_CP_SCHEMAS['rc/heartbeat']),\n    frameSchema('rc/verify', RELAY_CP_SCHEMAS['rc/verify']),\n    frameSchema('rc/verify/ok', RELAY_CP_SCHEMAS['rc/verify/ok']),\n    frameSchema('rc/github-comment-authz', RELAY_CP_SCHEMAS['rc/github-comment-authz']),\n    frameSchema('rc/github-comment-authz/ok', RELAY_CP_SCHEMAS['rc/github-comment-authz/ok']),\n    frameSchema('rc/github-rerequest', RELAY_CP_SCHEMAS['rc/github-rerequest']),\n    frameSchema('rc/github-rerequest/ok', RELAY_CP_SCHEMAS['rc/github-rerequest/ok']),\n    frameSchema('rc/hook-assign', RELAY_CP_SCHEMAS['rc/hook-assign']),\n    frameSchema('rc/hook-remove', RELAY_CP_SCHEMAS['rc/hook-remove']),\n    frameSchema('rc/run-report', RELAY_CP_SCHEMAS['rc/run-report']),\n    frameSchema('rc/github-installation', RELAY_CP_SCHEMAS['rc/github-installation']),\n    frameSchema('rc/daemon-revoke', RELAY_CP_SCHEMAS['rc/daemon-revoke']),\n    frameSchema('rc/bot-assign', RELAY_CP_SCHEMAS['rc/bot-assign']),\n    frameSchema('rc/bot-unassign', RELAY_CP_SCHEMAS['rc/bot-unassign']),\n    frameSchema('rc/routes', RELAY_CP_SCHEMAS['rc/routes']),\n    frameSchema('rc/assign', RELAY_CP_SCHEMAS['rc/assign']),\n    frameSchema('rc/set-channel-agent', RELAY_CP_SCHEMAS['rc/set-channel-agent']),\n    frameSchema('rc/collab-routes', RELAY_CP_SCHEMAS['rc/collab-routes']),\n    frameSchema('error', RELAY_CP_SCHEMAS['error'])\n]);\n/** Runtime guard: is `t` a known relay↔CP frame `type`? */\nexport function isRelayCpFrameType(t) {\n    return Object.prototype.hasOwnProperty.call(RELAY_CP_SCHEMAS, t);\n}\n/** Decode one relay↔CP wire frame (envelope + typed payload). */\nexport function decodeRelayCpFrame(text) {\n    return decodeEnvelopeWith(RELAY_CP_SCHEMAS, text);\n}\n/** Build a relay↔CP frame with a compile-time-typed payload. */\nexport function buildRelayCpFrame(type, payload, opts = {}) {\n    return buildEnvelopeRaw(type, payload, opts);\n}\n//# sourceMappingURL=relay-cp.js.map","import { z } from 'zod';\nimport { frameSchema } from '../envelope.js';\nimport { ErrorFrame } from './error.js';\nimport { WebchatDone, WebchatOutput } from './webchat.js';\nimport { GithubHookMetadata, HookContext, OptionalHookConfigSnapshot } from './hook.js';\nimport { CronTarget } from './cron.js';\nimport { buildEnvelopeRaw, decodeEnvelopeWith } from '../wire.js';\n/**\n * relay↔daemon frames (`rd/*`) — shared-bot-relay.md §7.2.\n *\n * The daemon dials OUT to every relay in its roster (one WS per (daemon, relay)\n * pair, multiplexing every source). This wire CARRIES MESSAGE CONTENT — it is\n * the ingress data plane — so nothing on it is ever logged with its payload.\n *\n * Direction per frame:\n *  - `rd/hello` (+ `rd/hello/ok`)  D→R REQ / R→D REP — authenticate the dial-in\n *  - `rd/msg`                      R→D REQ — one inbound item, already routed\n *  - `rd/ack`                      D→R REP — receipt (+ webchat turn verdict)\n *  - `rd/chat`                     D→R EVT — webchat output stream back to the\n *                                  browser (webchat is the one BIDIRECTIONAL\n *                                  source: its far end hangs off the relay)\n *\n * Milestone A carried the webchat slice; milestone B-github adds the `hook`\n * member (webhook-triggers-and-github-events.md). The `im` (shared bot) member\n * joins the `rd/msg` union with milestone B-slack.\n */\n/** Subprotocol negotiated on the relay↔daemon socket. */\nexport const RELAY_DAEMON_SUBPROTOCOL = 'agentconnect.rd.v1';\n/** The canonical path the relay mounts its daemon-facing `rd/*` server at, and\n *  the daemon appends to a roster `daemonUrl` origin when dialing (mirrors the\n *  daemon↔CP `/daemon/ws` convention). A roster url already ending in it is used\n *  verbatim. */\nexport const RELAY_DAEMON_WS_PATH = '/rd/ws';\n// ── hello (first frame; §9) ──────────────────────────────────────────────────\n// D→R REQ → rd/hello/ok. The daemon presents its EXISTING daemon API key; the\n// relay holds no database, so it delegates to the CP via `rc/verify` and caches\n// the verdict until this connection closes. Secret material — NEVER log.\nexport const RdHello = z.object({\n    apiKey: z.string().min(1),\n    daemonId: z.string().uuid()\n});\n// R→D REP (corr = rd/hello id). Echoes the relay's identity so the daemon can\n// confirm it reached the roster entry it dialed: roster `url`s must be\n// per-instance routable (design §5), so a relayId mismatch means the deployment\n// put a random LB in front of the daemon dial path — the daemon MUST treat it\n// as a misroute (close + backoff), never silently continue on the wrong\n// instance. Rejection is an `error` REP + close, not a reply.\nexport const RdHelloOk = z.object({\n    relayId: z.string().uuid()\n});\n// ── inbound delivery (R→D) ───────────────────────────────────────────────────\n// The webchat operations a browser can issue, folded into one payload union so\n// the wire stays at the four designed frames. `turn` is the user message; the\n// rest are the session controls the old daemon↔CP webchat EVTs carried.\nexport const RelayWebchatOp = z.discriminatedUnion('op', [\n    z.object({ op: z.literal('turn'), text: z.string(), user: z.string().optional() }),\n    z.object({ op: z.literal('set_model'), model: z.string() }),\n    z.object({ op: z.literal('set_effort'), effort: z.string() }),\n    z.object({ op: z.literal('set_permission_mode'), permissionMode: z.string() }),\n    z.object({ op: z.literal('set_fast'), fastMode: z.boolean() }),\n    z.object({ op: z.literal('cancel') }),\n    z.object({ op: z.literal('close') })\n]);\n// R→D REQ → rd/ack. One inbound item, already routed: the relay names the target\n// agent, so the daemon takes the explicit-agent short-circuit into dispatch —\n// no local trigger arbitration (same precedent as webchat today).\nexport const RdMsgWebchat = z.object({\n    source: z.literal('webchat'),\n    agentId: z.string().uuid(), // explicit target (webchat names its agent)\n    // Dedup scope: the daemon drops an already-seen (sessionKey, msgId). For\n    // webchat, sessionKey == chatId (the conversation IS the session).\n    sessionKey: z.string().min(1),\n    msgId: z.string().min(1), // relay-minted idempotency key (unique per op)\n    chatId: z.string().uuid(), // == conversationId (SessionKey.channel for 'webchat')\n    payload: RelayWebchatOp\n});\n// ── shared-bot inbound (`im`) ────────────────────────────────────────────────\n// One shared attachment — metadata + an auth-gated fetch URL. The bytes NEVER\n// cross this wire (or the relay): the daemon fetches them locally with its xoxb\n// (§7.2). Mirrors the daemon's `messages/normalized.ts#Attachment`.\nexport const WireAttachment = z.object({\n    id: z.string(),\n    name: z.string(),\n    mimeType: z.string(),\n    size: z.number().optional(),\n    sourceUrl: z.string()\n});\n// A normalized platform message, produced by the relay's ingest and dispatched\n// pre-addressed to the daemon. This MUST stay structurally identical to the\n// daemon's `messages/normalized.ts#NormalizedMessage` (the daemon spreads it\n// straight into dispatch); keep the two in sync.\nexport const WireNormalizedMessage = z.object({\n    msgId: z.string(),\n    traceId: z.string(),\n    source: z.enum(['user', 'cron', 'agent']),\n    platform: z.enum(['slack', 'telegram', 'webchat', 'discord']),\n    channel: z.string(),\n    thread: z.string().optional(),\n    sender: z.object({ id: z.string(), isBot: z.boolean() }),\n    text: z.string(),\n    mentionedBots: z.array(z.string()),\n    attachments: z.array(WireAttachment).optional(),\n    isDm: z.boolean(),\n    replyTo: z.string().optional(),\n    telegramTopicId: z.string().optional(),\n    telegramThreadRoot: z.string().optional(),\n    discordTopLevel: z.boolean().optional(),\n    trigger: z.enum(['mention', 'dm', 'keyword', 'auto', 'cron']).optional(),\n    headless: z.boolean().optional()\n});\n// R→D REQ → rd/ack. One shared-bot inbound the relay already arbitrated: it names\n// the target `agentId` + the `integrationId` the daemon replies through, so the\n// daemon takes the explicit-agent short-circuit into dispatch (no local\n// arbitration — the routing happened in the relay, §10). `msgId` is the platform\n// event id (Slack event_id / TG update_id) — the idempotency key that survives a\n// relay re-assign (§12). Dedup scope is (sessionKey, msgId).\nexport const RdMsgIm = z.object({\n    source: z.literal('im'),\n    agentId: z.string().uuid(),\n    sessionKey: z.string().min(1),\n    msgId: z.string().min(1),\n    botId: z.string().uuid(),\n    integrationId: z.string().uuid(),\n    chatId: z.string().optional(), // platform channel id (observability)\n    payload: WireNormalizedMessage\n});\n// One daemon-owned session-control interaction received by the shared app's relay\n// Socket Mode edge. It remains typed inside rd/msg so it reuses the existing receipt,\n// dedup, and relay→daemon delivery path.\nexport const RdSlackAction = z.discriminatedUnion('kind', [\n    z.object({ kind: z.literal('open-config'), triggerId: z.string().min(1) }),\n    z.object({ kind: z.literal('set-model'), model: z.string().min(1) }),\n    z.object({ kind: z.literal('set-effort'), effort: z.string().min(1) }),\n    z.object({ kind: z.literal('set-permission-mode'), permissionMode: z.string().min(1) }),\n    z.object({ kind: z.literal('set-fast'), fastMode: z.boolean() }),\n    z.object({ kind: z.literal('set-output'), outputMode: z.enum(['low', 'medium', 'high']) }),\n    z.object({ kind: z.literal('cancel') })\n]);\n/** R→D REQ → rd/ack. The relay has validated the opaque Slack target against its\n *  current shared-bot assignment and names the canonical agent + integration. */\nexport const RdMsgSlackAction = z.object({\n    source: z.literal('slack_action'),\n    agentId: z.string().uuid(),\n    sessionKey: z.string().min(1),\n    msgId: z.string().min(1),\n    botId: z.string().uuid(),\n    integrationId: z.string().uuid(),\n    payload: RdSlackAction\n});\n// R→D REQ → rd/ack. One already-adjudicated trigger delivery: the relay matched\n// the hook rule and names the target agent (explicit-agent short-circuit, same\n// as webchat — no local trigger arbitration). The daemon synthesizes a\n// NormalizedMessage from `prompt` + `context` (fencing the context as untrusted\n// external content) and dispatches; the turn's outcome goes to the CP as a\n// `hook/report` EVT on the control WS, NOT back over this wire.\nexport const RdMsgHook = z.object({\n    source: z.literal('hook'),\n    agentId: z.string().uuid(),\n    // (sessionKey, msgId) is the daemon's dedup key. msgId folds in the hookId:\n    // one GitHub delivery fanning out to two hooks on the same agent+repo must\n    // not swallow each other.\n    sessionKey: z.string().min(1), // relay-computed: github perThread 'owner/repo#42';\n    // webhook perDelivery '<hookId>:<deliveryKey>' / shared '<hookId>'\n    msgId: z.string().min(1), // `${hookId}:${deliveryKey}`\n    hookId: z.string().uuid(),\n    deliveryKey: z.string().min(1),\n    firedAt: z.string().datetime(), // relay ingest time\n    // Rolling-compatible policy + durable dispatch fence. Older rules omit\n    // these; the daemon must then keep review/reporting off while still running\n    // the ordinary hook turn.\n    ...OptionalHookConfigSnapshot.shape,\n    event: z.string().min(1).optional(), // normalized 'family:action' (or bare push)\n    // Signature-verified, rule-fenced metadata. Kept outside HookContext because\n    // the latter contains model-visible, attacker-authored excerpts.\n    github: GithubHookMetadata.optional(),\n    context: HookContext.optional(), // trimmed envelope; message extraction/fencing happens on the daemon\n    target: CronTarget.optional() // output anchoring; absent ⇒ headless\n});\n// Shared-bot IM + status actions and webhook fires join the webchat union.\nexport const RdMsg = z.discriminatedUnion('source', [RdMsgWebchat, RdMsgIm, RdMsgSlackAction, RdMsgHook]);\n// D→R REP (corr = rd/msg id). Receipt for dedup/ack bookkeeping; for a webchat\n// `turn` it also carries the dispatch verdict the relay forwards to the browser\n// (`turnId` correlates the `rd/chat` stream; `reason` e.g. 'no_agent'|'paused').\nexport const RdAck = z.object({\n    msgId: z.string(),\n    accepted: z.boolean(),\n    turnId: z.string().uuid().optional(),\n    reason: z.string().optional()\n});\n// ── cross-daemon agent→agent (`rd/agentmsg`) ─────────────────────────────────\n/**\n * D→R REQ → `rd/agentmsg/ack`. A cross-daemon `messageAgent` (agent-collaboration\n * §2.3 / §6.2): the SOURCE daemon found the target is not local and routes over the\n * relay data plane (the body NEVER touches the CP).\n *\n * `claimedFromAgentId` is UNTRUSTED (§2.5/§6.2): a daemon hosts many agents, and the\n * `rd/hello` handshake only authenticates the socket's `daemonId` — it cannot prove\n * WHICH agent originated the call. The relay binds the request to the socket's\n * AUTHENTICATED daemonId, validates `claimedFromAgentId` actually belongs to that\n * daemon AND is in `coords` via the collaboration snapshot, checks the target's\n * callPolicy, resolves `toAgentId → daemonId`, and only then forwards a TRUSTED\n * claim (`RdAgentMsgFwd.trustedFromAgentId`) to the owning daemon.\n *\n * `deliveryId` is stable end-to-end (dedup at each hop, §6.3/§6.7). `hopCount` is\n * the depth of the SOURCE turn; the relay/target reject `hopCount+1 > cap` (§2.4).\n */\nexport const RdAgentMsg = z.object({\n    claimedFromAgentId: z.string().uuid(), // UNTRUSTED self-claim — relay validates against the socket daemonId\n    toAgentId: z.string().uuid(),\n    text: z.string(),\n    coords: z.object({\n        platform: z.enum(['slack', 'telegram', 'webchat', 'discord']),\n        channel: z.string().min(1),\n        thread: z.string().optional()\n    }),\n    correlationId: z.string().optional(),\n    hopCount: z.number().int().nonnegative(),\n    deliveryId: z.string().min(1)\n});\n/**\n * R→D REQ → `rd/agentmsg/ack`. The relay forwards the validated call to the TARGET's\n * owning daemon, replacing the untrusted `claimedFromAgentId` with a TRUSTED caller\n * claim the relay minted after snapshot validation: `trustedFromAgentId` + the\n * asserted `orgId`/`platform`/`channel` the caller was verified in. The target daemon\n * TERMINAL-verifies this claim + its own callPolicy against its LOCAL snapshot\n * (defense in depth, §2.5 #4) before dispatching `source:'agent'`.\n */\nexport const RdAgentMsgFwd = z.object({\n    trustedFromAgentId: z.string().uuid(), // minted by the relay — the target may trust this\n    // Org ids are opaque strings (normally cuid()), not UUIDs.\n    orgId: z.string().min(1), // org the relay asserted the caller belongs to (cross-org guard)\n    toAgentId: z.string().uuid(),\n    integrationId: z.string().uuid().optional(), // DEFINITE target reply integration (§6.2)\n    text: z.string(),\n    coords: z.object({\n        platform: z.enum(['slack', 'telegram', 'webchat', 'discord']),\n        channel: z.string().min(1),\n        thread: z.string().optional()\n    }),\n    correlationId: z.string().optional(),\n    hopCount: z.number().int().nonnegative(), // already incremented by the relay\n    deliveryId: z.string().min(1)\n});\n/** The typed admission verdict for an agent-call (§6.4). The ACK is returned after the\n *  TARGET daemon durably admits/enqueues the turn (P4-gate) — NOT after the model turn.\n *  `reason` is only set when `delivered:false`. */\nexport const RdAgentMsgReason = z.enum(['busy', 'offline', 'queue_full', 'not_allowed', 'not_found', 'hop_limit']);\nexport const RdAgentMsgAck = z.object({\n    deliveryId: z.string().min(1),\n    delivered: z.boolean(),\n    reason: RdAgentMsgReason.optional()\n});\n// ── webchat output stream (D→R) ──────────────────────────────────────────────\n// One item of a webchat reply stream. Reuses the webchat frame payloads verbatim\n// (they already carry conversationId/turnId/index) so the daemon-side emitters\n// and the browser-facing shapes migrate unchanged.\nexport const RdChatEvent = z.discriminatedUnion('kind', [\n    z.object({ kind: z.literal('output'), output: WebchatOutput }),\n    z.object({ kind: z.literal('done'), done: WebchatDone })\n]);\n// D→R EVT — streamed back to the browser hanging off the relay. `seq` is a\n// per-chat monotonic counter (the relay forwards in arrival order; the browser\n// renders by arrival, `seq` is for observability/assembly only).\nexport const RdChat = z.object({\n    chatId: z.string().uuid(),\n    seq: z.number().int(),\n    event: RdChatEvent\n});\n// ── the wire union ───────────────────────────────────────────────────────────\n/** `type` string → payload schema for the relay↔daemon wire. */\nexport const RELAY_DAEMON_SCHEMAS = {\n    'rd/hello': RdHello,\n    'rd/hello/ok': RdHelloOk,\n    'rd/msg': RdMsg,\n    'rd/ack': RdAck,\n    'rd/agentmsg': RdAgentMsg,\n    'rd/agentmsg/fwd': RdAgentMsgFwd,\n    'rd/agentmsg/ack': RdAgentMsgAck,\n    'rd/chat': RdChat,\n    error: ErrorFrame\n};\n/** All relay↔daemon frame `type` strings, as a runtime array (guards / tests). */\nexport const RELAY_DAEMON_FRAME_TYPES = Object.keys(RELAY_DAEMON_SCHEMAS);\n/** The discriminated union of every fully-validated relay↔daemon frame. */\nexport const RelayDaemonFrame = z.discriminatedUnion('type', [\n    frameSchema('rd/hello', RELAY_DAEMON_SCHEMAS['rd/hello']),\n    frameSchema('rd/hello/ok', RELAY_DAEMON_SCHEMAS['rd/hello/ok']),\n    frameSchema('rd/msg', RELAY_DAEMON_SCHEMAS['rd/msg']),\n    frameSchema('rd/ack', RELAY_DAEMON_SCHEMAS['rd/ack']),\n    frameSchema('rd/agentmsg', RELAY_DAEMON_SCHEMAS['rd/agentmsg']),\n    frameSchema('rd/agentmsg/fwd', RELAY_DAEMON_SCHEMAS['rd/agentmsg/fwd']),\n    frameSchema('rd/agentmsg/ack', RELAY_DAEMON_SCHEMAS['rd/agentmsg/ack']),\n    frameSchema('rd/chat', RELAY_DAEMON_SCHEMAS['rd/chat']),\n    frameSchema('error', RELAY_DAEMON_SCHEMAS['error'])\n]);\n/** Runtime guard: is `t` a known relay↔daemon frame `type`? */\nexport function isRelayDaemonFrameType(t) {\n    return Object.prototype.hasOwnProperty.call(RELAY_DAEMON_SCHEMAS, t);\n}\n/** Decode one relay↔daemon wire frame (envelope + typed payload). */\nexport function decodeRelayDaemonFrame(text) {\n    return decodeEnvelopeWith(RELAY_DAEMON_SCHEMAS, text);\n}\n/** Build a relay↔daemon frame with a compile-time-typed payload. */\nexport function buildRelayDaemonFrame(type, payload, opts = {}) {\n    return buildEnvelopeRaw(type, payload, opts);\n}\n//# sourceMappingURL=relay-daemon.js.map","/**\n * Git repo address helpers, shared by the CP (normalize on write) and the\n * daemon (defensive normalize before clone).\n *\n * STORAGE INVARIANT: `workspace.gitRepo` is persisted as a FULL cloneable git\n * address (e.g. `https://github.com/acme/infra`), never the `acme/infra`\n * shorthand a user may type. UIs shorten it back to `org/repo` for display\n * with `gitRepoLabel`.\n */\n/** Scheme-full address: https://, ssh://, git://, file://, … */\nconst SCHEME_RE = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n/** scp-like ssh address: git@github.com:acme/infra(.git) */\nconst SCP_RE = /^[\\w.-]+@[\\w.-]+:(.+)$/;\n/**\n * Normalize a user-supplied repo reference into a full cloneable git address.\n * Idempotent — full addresses pass through unchanged.\n *\n * - `https://…` / `ssh://…` / `git://…` / `git@host:…` → as-is\n * - `github.com/acme/infra` (host-prefixed shorthand)  → `https://github.com/acme/infra`\n * - `acme/infra` (bare org/repo)                       → `https://github.com/acme/infra`\n * - anything else (e.g. a local path) → as-is\n */\nexport function normalizeGitUrl(input) {\n    const s = input.trim().replace(/\\/+$/, '');\n    if (!s || SCHEME_RE.test(s) || SCP_RE.test(s))\n        return s;\n    const segments = s.split('/');\n    // host-prefixed shorthand: first segment looks like a hostname (has a dot)\n    if (segments.length >= 3 && segments[0].includes('.'))\n        return `https://${s}`;\n    // bare org/repo → GitHub by default\n    if (segments.length === 2 && segments.every((p) => p.length > 0))\n        return `https://github.com/${s}`;\n    return s;\n}\n/**\n * Shorten a stored git address to the `org/repo` display form.\n * `https://github.com/acme/infra.git` / `git@github.com:acme/infra` → `acme/infra`.\n * Unrecognized inputs come back unchanged (minus a trailing `.git`).\n */\nexport function gitRepoLabel(gitRepo) {\n    const s = gitRepo\n        .trim()\n        .replace(/\\/+$/, '')\n        .replace(/\\.git$/, '');\n    const scp = SCP_RE.exec(s);\n    if (scp)\n        return scp[1].replace(/^\\/+/, '');\n    const url = /^[a-z][a-z0-9+.-]*:\\/\\/[^/]+\\/(.+)$/i.exec(s);\n    if (url)\n        return url[1];\n    const segments = s.split('/');\n    if (segments.length >= 3 && segments[0].includes('.'))\n        return segments.slice(1).join('/');\n    return s;\n}\n//# sourceMappingURL=git-url.js.map","/**\n * `@agentconnect.md/protocol` — the shared wire contract for the daemon ↔ CP\n * WebSocket protocol (daemon-cp-ws-protocol.md). Single source of truth for all\n * frames and the `sessionEpoch`/`seq`/`launchId` fencing fields, imported by\n * both the control-plane and the daemon.\n *\n * This barrel re-exports the zod schemas, their inferred types, and the\n * `isFrameType` guard.\n */\n// ── envelope + control extension ──\nexport { Envelope, ControlExt, NIL_UUID } from './envelope.js';\n// ── frame groups (schemas + inferred types) ──\nexport * from './frames/auth.js';\nexport * from './frames/register.js';\nexport * from './frames/collab.js';\nexport * from './frames/route.js';\nexport * from './frames/agent.js';\nexport * from './frames/cron.js';\nexport * from './frames/hook.js';\nexport * from './frames/integration.js';\nexport * from './frames/gitcred.js';\nexport * from './frames/secrets.js';\nexport * from './frames/session.js';\nexport * from './frames/channel.js';\nexport * from './frames/workspace.js';\nexport * from './frames/memory.js';\nexport * from './frames/telemetry.js';\nexport * from './frames/error.js';\nexport * from './frames/webchat.js';\n// ── the union, the type map, and guards ──\nexport { AnyFrame, FRAME_SCHEMAS, FRAME_TYPES, isFrameType } from './frame.js';\nimport { isFrameType } from './frame.js';\n/**\n * Narrowing guard factory: `isFrame(\"auth\")(frame)` narrows a decoded\n * `AnyFrame` to the member whose `type` matches.\n */\nexport function isFrame(type) {\n    return (frame) => frame.type === type;\n}\n/** Re-export under a convenience alias for call sites that prefer it. */\nexport { isFrameType as isKnownFrameType };\n// ── wire codec (shared by daemon + control-plane) ──\nexport { decodeEnvelope, buildEnvelope, encode, MAX_FRAME_BYTES } from './codec.js';\n// ── relay wires (separate frame unions; shared-bot-relay.md §7/§8) ──\nexport * from './frames/relay-cp.js';\nexport * from './frames/relay-daemon.js';\nexport { decodeEnvelopeWith, buildEnvelopeRaw } from './wire.js';\n// ── git repo address helpers (normalize on write, shorten for display) ──\nexport { normalizeGitUrl, gitRepoLabel } from './git-url.js';\n//# sourceMappingURL=index.js.map"],"x_google_ignoreList":[0],"mappings":";;;;AAGA,MAAa,eAAe;CACxB,cAAc;CACd,SAAS;CACT,WAAW;CACX,gBAAgB;CAChB,iBAAiB;CACjB,mBAAmB;CACnB,eAAe;CACf,aAAa;CACb,iBAAiB;CACjB,eAAe;CACf,QAAQ;AACZ;;AAaA,IAAW;AAER,0BAA0B,wBAAwB,CAAC;;;;;;;;;;;;ACpBtD,MAAa,WAAWA,OAAS;CAC7B,GAAGC,QAAU,CAAC;CACd,IAAIC,OAAS,CAAC,CAAC,KAAK;CACpB,IAAIA,OAAS,CAAC,CAAC,SAAS;CACxB,MAAMA,OAAS;CACf,MAAMA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACjC,SAASC,QAAU;AACvB,CAAC;AASyBH,OAAS;CAC/B,OAAOI,OAAS,CAAC,CAAC,IAAI;CACtB,SAASF,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACpC,UAAUA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;AACzC,CAAC;;AAED,MAAa,WAAW;;;;;;;;AAQxB,SAAgB,YAAY,MAAM,SAAS;CACvC,OAAOF,OAAS;EACZ,GAAGC,QAAU,CAAC;EACd,IAAIC,OAAS,CAAC,CAAC,KAAK;EACpB,IAAIA,OAAS,CAAC,CAAC,SAAS;EACxB,MAAMD,QAAU,IAAI;EACpB,MAAMC,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;EACjC;CACJ,CAAC;AACL;;;;;;;;;;ACzCA,MAAa,UAAUG,OAAS;CAG5B,QAAQC,OAAS;CAGjB,UAAUA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACrC,WAAWA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACtC,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,cAAcA,OAAS;CACvB,QAAQC,OACI,EACR,WAAWC,OAAS,CAAC,CAAC,IAAI,EAC9B,CAAC,CAAC,CACG,SAAS;AAClB,CAAC;AACD,MAAa,SAASH,OAAS;CAC3B,UAAUC,OAAS,CAAC,CAAC,KAAK;CAC1B,cAAcE,OAAS,CAAC,CAAC,IAAI;CAC7B,cAAcA,OAAS,CAAC,CAAC,IAAI;CAC7B,YAAYF,OAAS,CAAC,CAAC,SAAS;CAIhC,WAAWA,OAAS,CAAC,CAAC,SAAS;CAI/B,SAASA,OAAS,CAAC,CAAC,SAAS;CAC7B,QAAQC,OACI,EACR,UAAUE,QAAU,EACxB,CAAC,CAAC,CACG,SAAS;AAClB,CAAC;;;;;;;;;;AC/BD,MAAa,WAAWC,MAAO;CAAC;CAAS;CAAY;CAAW;CAAW;AAAM,CAAC;AAClF,MAAa,aAAaC,OAAS;CAC/B,UAAU;CACV,SAASC,OAAS;CAClB,QAAQA,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC;;AAED,MAAa,WAAWD,OAAS,EAC7B,OAAOE,mBAAqB,QAAQ;CAChCF,OAAS,EAAE,MAAMG,QAAU,SAAS,EAAE,CAAC;CACvCH,OAAS,EAAE,MAAMG,QAAU,IAAI,EAAE,CAAC;CAClCH,OAAS;EAAE,MAAMG,QAAU,SAAS;EAAG,OAAOF,OAAS;CAAE,CAAC;CAC1DD,OAAS,EAAE,MAAMG,QAAU,MAAM,EAAE,CAAC;AACxC,CAAC,EACL,CAAC;AACD,MAAa,cAAcH,OAAS;CAEhC,YAAY;CACZ,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,aAAaA,OAAS,CAAC,CAAC,KAAK;CAC7B,WAAWG,MAAQ,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AACD,MAAa,iBAAiBJ,OAAS;CACnC,IAAIK,QAAU;CACd,YAAY;CACZ,QAAQJ,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC;AACD,MAAa,cAAcD,OAAS;CAChC,cAAcM,OAAS,CAAC,CAAC,IAAI;CAC7B,OAAOF,MAAQJ,OAAS;EAAE,OAAOO,QAAU;EAAG,SAASN,OAAS,CAAC,CAAC,KAAK;CAAE,CAAC,CAAC;AAC/E,CAAC;;AAED,MAAa,QAAQD,OAAS;CAC1B,OAAOQ,MAAQ;EACXR,OAAS;GAAE,MAAMG,QAAU,OAAO;GAAG,SAASF,OAAS,CAAC,CAAC,KAAK;EAAE,CAAC;EACjED,OAAS,EAAE,MAAMG,QAAU,QAAQ,EAAE,CAAC;EACtCH,OAAS;GAAE,MAAMG,QAAU,SAAS;GAAG,YAAY;EAAW,CAAC;CACnE,CAAC;CACD,UAAUF,OAAS,CAAC,CAAC,SAAS;AAClC,CAAC;AACD,MAAa,gBAAgBD,OAAS;CAClC,WAAWM,OAAS,CAAC,CAAC,IAAI;CAC1B,SAASF,MAAQ,UAAU;AAC/B,CAAC;AACD,MAAa,YAAYJ,OAAS,EAC9B,UAAUI,MAAQ,UAAU,EAChC,CAAC;;;;;;;;;;;;;;;;;;ACzCD,MAAa,aAAaK,OAAS;CAC/B,UAAUC,MAAO;EAAC;EAAS;EAAY;CAAS,CAAC,CAAC,CAAC,QAAQ,OAAO;CAClE,SAASC,OAAS;CAIlB,eAAeA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;AAC9C,CAAC;AACD,MAAa,aAAaF,OAAS;CAC/B,QAAQE,OAAS,CAAC,CAAC,KAAK;CACxB,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS;CACnB,QAAQ,WAAW,SAAS;CAC5B,SAASA,OAAS;CAClB,SAASC,QAAU,CAAC,CAAC,QAAQ,IAAI;AACrC,CAAC;AACD,MAAa,aAAaH,OAAS,EAC/B,QAAQE,OAAS,CAAC,CAAC,KAAK,EAC5B,CAAC;;;;;;;;;;;;;;;AAeD,MAAa,gBAAgBD,MAAO,CAAC,WAAW,QAAQ,CAAC;AACzD,MAAa,aAAaD,OAAS;CAC/B,QAAQE,OAAS,CAAC,CAAC,KAAK;CACxB,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,SAASA,OAAS,CAAC,CAAC,SAAS;CAE7B,QAAQ,cAAc,SAAS;CAC/B,YAAYE,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CACpD,WAAWF,OAAS,CAAC,CAAC,SAAS;CAC/B,QAAQA,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;AAMD,MAAa,aAAaF,OAAS,EAC/B,QAAQE,OAAS,CAAC,CAAC,KAAK,EAC5B,CAAC;;;;;;;;;AC3DD,MAAa,iBAAiBG,OAAS,EAEnC,OAAOA,OAAS;CACZ,UAAU;CACV,aAAaC,OAAS,CAAC,CAAC,KAAK;AACjC,CAAC,EACL,CAAC;AACD,MAAa,eAAeD,OAAS;CAEjC,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,OAAOD,OAAS;EACZ,UAAUC,OAAS;EACnB,aAAaA,OAAS,CAAC,CAAC,KAAK;CACjC,CAAC;CACD,KAAKA,OAAS;CACd,KAAKC,OAAS,CAAC,CAAC,IAAI;CACpB,gBAAgBA,OAAS,CAAC,CAAC,IAAI;AACnC,CAAC;AACD,MAAa,eAAeF,OAAS,EACjC,SAASC,OAAS,CAAC,CAAC,KAAK,EAC7B,CAAC;AACD,MAAa,gBAAgBD,OAAS;CAClC,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,QAAQA,OAAS;AACrB,CAAC;;AAED,MAAa,mBAAmBD,OAAS;CACrC,WAAWC,OAAS,CAAC,CAAC,KAAK;CAC3B,OAAOE,MAAO;EAAC;EAAkB;EAAkB;CAAW,CAAC;CAC/D,aAAaF,OAAS;CACtB,KAAKA,OAAS;CACd,KAAKA,OAAS,CAAC,CAAC,SAAS;AAC7B,CAAC;;;;;;;;;;;;;;;;;;;;;;ACpBD,MAAa,YAAYG,mBAAqB,QAAQ;CAClDC,OAAS,EAAE,MAAMC,QAAU,SAAS,EAAE,CAAC;CACvCD,OAAS,EAAE,MAAMC,QAAU,IAAI,EAAE,CAAC;CAClCD,OAAS;EAAE,MAAMC,QAAU,SAAS;EAAG,OAAOC,OAAS;CAAE,CAAC;CAC1DF,OAAS,EAAE,MAAMC,QAAU,MAAM,EAAE,CAAC;AACxC,CAAC;;AAED,MAAa,sBAAsBD,OAAS;CACxC,SAASE,OAAS,CAAC,CAAC,SAAS;CAC7B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,OAAO;AACX,CAAC;;;;;;;;;;;;;;;;;;;;AAoBD,MAAa,yBAAyBC,OAC1B;CACR,MAAMC,MAAO,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,QAAQ,QAAQ;CACnD,UAAUF,OAAS;CACnB,UAAUA,OAAS,CAAC,CAAC,SAAS;CAC9B,WAAWA,OAAS,CAAC,CAAC,SAAS;CAC/B,gBAAgBG,MAAQH,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAC9C,WAAWG,MAAQ,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC,CAAC,CACG,aAAa,GAAG,QAAQ;CACzB,IAAI,EAAE,SAAS,YAAY,CAAC,EAAE,UAC1B,IAAI,SAAS;EAAE,MAAA,aAAqB;EAAQ,SAAS;EAAkC,MAAM,CAAC,UAAU;CAAE,CAAC;AACnH,CAAC;;;;;;AAMD,MAAa,4BAA4BL,OAAS;CAC9C,UAAUE,OAAS;CACnB,gBAAgBG,MAAQH,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAC9C,WAAWG,MAAQ,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;;;;;;;AAOD,MAAa,2BAA2BL,OAAS;CAC7C,UAAUE,OAAS;CACnB,eAAeA,OAAS,CAAC,CAAC,SAAS;CACnC,gBAAgBG,MAAQH,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAC9C,WAAWG,MAAQ,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtD,CAAC;;;;;;;AAOD,MAAa,kBAAkBN,mBAAqB,YAAY;CAC5DC,OAAS;EACL,eAAeE,OAAS,CAAC,CAAC,KAAK;EAC/B,SAASA,OAAS,CAAC,CAAC,KAAK;EACzB,UAAUD,QAAU,OAAO;EAC3B,OAAO;CACX,CAAC;CACDD,OAAS;EACL,eAAeE,OAAS,CAAC,CAAC,KAAK;EAC/B,SAASA,OAAS,CAAC,CAAC,KAAK;EACzB,UAAUD,QAAU,UAAU;EAC9B,UAAU;CACd,CAAC;CACDD,OAAS;EACL,eAAeE,OAAS,CAAC,CAAC,KAAK;EAC/B,SAASA,OAAS,CAAC,CAAC,KAAK;EACzB,UAAUD,QAAU,SAAS;EAC7B,SAAS;CACb,CAAC;AACL,CAAC;;AAED,MAAa,oBAAoB;;AAEjC,MAAa,oBAAoBD,OAAS,EACtC,eAAeE,OAAS,CAAC,CAAC,KAAK,EACnC,CAAC;;AAED,MAAa,qBAAqBF,OAAS;CACvC,IAAIE,OAAS;CACb,MAAMA,OAAS,CAAC,CAAC,SAAS;CAC1B,WAAWI,QAAU,CAAC,CAAC,SAAS;AACpC,CAAC;;;;;;;AAOD,MAAa,sBAAsBN,OAAS;CACxC,eAAeE,OAAS,CAAC,CAAC,KAAK;CAC/B,UAAUG,MAAQ,kBAAkB;AACxC,CAAC;;;;;;;;;;;;;;;;;;;;;AChHD,MAAa,iBAAiBE,mBAAqB,QAAQ,CACvDC,OAAS,EAAE,MAAMC,QAAU,SAAS,EAAE,CAAC,GACvCD,OAAS;CACL,MAAMC,QAAU,QAAQ;CACxB,SAASC,OAAS;CAClB,QAAQA,OAAS,CAAC,CAAC,QAAQ,MAAM;CACjC,UAAUA,OAAS,CAAC,CAAC,SAAS;CAK9B,eAAeC,MAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;AACnD,CAAC,CACL,CAAC;;;;;;;AAOD,MAAa,2BAA2B;AAuCfJ,mBAAqB,QAAQ;CAClDC,OAAS,EAAE,MAAMC,QAAU,SAAS,EAAE,CAAC;CACvCD,OAAS;EAAE,MAAMC,QAAU,OAAO;EAAG,OAAOE,MAAO;GAhCnD;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EAiBmD,CAAiB;EAAG,OAAOD,OAAS;CAAE,CAAC;CAC1FF,OAAS;EAAE,MAAMC,QAAU,OAAO;EAAG,KAAKC,OAAS,CAAC,CAAC,IAAI;CAAE,CAAC;AAChE,CAAC;;;;;;AAMD,MAAa,YAAYF,OAAS;CAC9B,MAAME,OAAS;CAIf,aAAaA,OAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAM5C,SAASA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC9C,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,SAASA,OAAS,CAAC,CAAC,SAAS;CAO7B,OAAOA,OAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACtC,iBAAiBA,OAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAChD,eAAeA,OAAS,CAAC,CAAC,SAAS;CACnC,YAAYC,MAAO;EAAC;EAAO;EAAU;CAAM,CAAC,CAAC,CAAC,SAAS;CACvD,UAAUC,QAAU,CAAC,CAAC,SAAS;CAC/B,gBAAgBF,OAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAK/C,OAAOE,QAAU,CAAC,CAAC,SAAS;CAC5B,WAAW,eAAe,SAAS;CACnC,KAAKC,OAASH,OAAS,GAAGA,OAAS,CAAC,CAAC,CAAC,SAAS;CAQ/C,QAAQF,OAAS,EAAE,UAAUG,MAAO;EAAC;EAAU;EAAW;CAAU,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;CAGnF,YAAYG,MAAQJ,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAQ1C,YAAYC,MAAO,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS;CACjD,uBAAuBG,MAAQJ,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;AACD,MAAa,cAAcF,OAAS;CAEhC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,SAASA,OAAS;CAClB,aAAaA,OAAS,CAAC,CAAC,KAAK;CAC7B,cAAcI,MAAQJ,OAAS,CAAC;CAChC,MAAM;CACN,MAAMC,MAAO,CAAC,cAAc,UAAU,CAAC,CAAC,CAAC,QAAQ,YAAY;AACjE,CAAC;;;;;;AAMD,MAAa,cAAcH,OAAS;CAChC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,MAAM;AACV,CAAC;AACD,MAAa,cAAcF,OAAS,EAChC,SAASE,OAAS,CAAC,CAAC,KAAK,EAC7B,CAAC;;;;;;;AAOD,MAAa,cAAcF,OAAS;CAChC,SAASE,OAAS,CAAC,CAAC,KAAK;;CAEzB,QAAQA,OAAS,CAAC,CAAC,KAAK;AAC5B,CAAC;AACD,MAAa,gBAAgBF,OAAS;CAClC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,QAAQA,OAAS,CAAC,CAAC,KAAK;;;;;;CAMxB,MAAM;CACN,cAAcI,MAAQ,eAAe;CACrC,OAAOA,MAAQ,UAAU;AAC7B,CAAC;AACD,MAAa,gBAAgBN,OAAS;CAElC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAC1B,cAAcA,OAAS,CAAC,CAAC,SAAS;CAClC,WAAWA,OAAS,CAAC,CAAC,SAAS;CAC/B,SAASA,OAAS;AACtB,CAAC;AACD,MAAa,YAAYF,OAAS;CAC9B,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAC1B,QAAQA,OAAS;AACrB,CAAC;AACD,MAAa,gBAAgBF,OAAS;CAElC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAC1B,OAAOC,MAAO;EAAC;EAAY;EAAa;EAAuB;CAAM,CAAC;CACtE,IAAID,OAAS,CAAC,CAAC,SAAS;AAC5B,CAAC;AACD,MAAa,mBAAmBF,OAAS;CAErC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAC1B,YAAYA,OAAS;AACzB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACtLD,MAAa,uBAAuBK,OAAS;CACzC,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAC1B,eAAeA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CAC1C,YAAYC,MAAO,CAAC,OAAO,UAAU,CAAC,CAAC,CAAC,QAAQ,KAAK;CACrD,uBAAuBC,MAAQF,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AACzD,CAAC;;;;AAID,MAAa,qBAAqBD,OAAS;CAGvC,OAAOC,OAAS,CAAC,CAAC,IAAI,CAAC;CACvB,UAAU;CACV,WAAWA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC3B,QAAQE,MAAQ,oBAAoB;AACxC,CAAC;;;;;;;AAOD,MAAa,uBAAuBH,OAAS;CACzC,YAAYI,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;CACpD,UAAUD,MAAQ,kBAAkB,CAAC,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC;;;;;;;;;;AC5CD,MAAa,cAAcE,OAAS;CAChC,MAAMC,OAAS;CACf,cAAcD,OAAS;EACnB,WAAWE,MAAQ,QAAQ;EAC3B,UAAUA,MAAQD,OAAS,CAAC;EAC5B,KAAKE,QAAU;EACf,UAAUD,MAAQD,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAC5C,CAAC;CACD,WAAWG,OAAS,CAAC,CAAC,IAAI;CAC1B,YAAYJ,OAAS;EAEjB,aAAaE,MAAQD,OAAS,CAAC;EAC/B,OAAOC,MAAQD,OAAS,CAAC;EACzB,QAAQC,MAAQD,OAAS,CAAC;CAC9B,CAAC;AACL,CAAC;;;;;;;;;AASD,MAAa,mBAAmBD,OAAS;CACrC,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,KAAKA,OAAS;AAClB,CAAC;;;;;;AAMD,MAAa,oBAAoBD,OAAS,EACtC,QAAQE,MAAQ,gBAAgB,EACpC,CAAC;AACD,MAAa,aAAaF,OAAS;CAC/B,cAAcI,OAAS,CAAC,CAAC,IAAI;CAG7B,gBAAgBF,MAAQD,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAE9C,aAAaC,MAAQ,WAAW;CAChC,QAAQA,MAAQ,UAAU,OAAO,EAAE,SAASD,OAAS,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CAC5E,OAAOC,MAAQ,UAAU;CAGzB,cAAcA,MAAQ,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC;CACjD,QAAQA,MAAQ,YAAY;CAI5B,QAAQA,MAAQ,gBAAgB,CAAC,CAAC,QAAQ,CAAC,CAAC;CAK5C,cAAc,qBAAqB,QAAQ;EAAE,YAAY;EAAG,UAAU,CAAC;CAAE,CAAC;CAC1E,MAAMF,OAAS;EAEX,aAAaE,MAAQD,OAAS,CAAC;EAC/B,OAAOC,MAAQD,OAAS,CAAC;CAC7B,CAAC;AACL,CAAC;;;;AC3ED,MAAa,mBAAmBI,OAAS,CAAC,CAAC,MAAM,kBAAkB;;AAEnE,MAAa,mBAAmBC,MAAO;CAAC;CAAO;CAAW;CAAmB;AAAM,CAAC;;AAEpF,MAAa,oBAAoBA,MAAO;CAAC;CAAO;CAAS;AAAQ,CAAC;;AAElE,MAAa,eAAeA,MAAO,CAAC,iBAAiB,UAAU,CAAC;;;;;;;;;;;AAWhE,MAAa,qBAAqBC,OAAS;CACvC,gBAAgB;CAChB,kBAAkB;CAClB,kBAAkBF,OAAS,CAAC,CAAC,KAAK;CAClC,cAAc;CACd,eAAe;CACf,UAAU;AACd,CAAC;;AAED,MAAa,6BAA6B,mBAAmB,QAAQ;;;;;;;;;;;;;AAarE,MAAa,qBAAqBG,OACtB;CACR,QAAQ;CACR,cAAcH,OAAS,CAAC,CAAC,IAAI,CAAC;CAC9B,sBAAsB;CACtB,aAAaC,MAAO,CAAC,SAAS,cAAc,CAAC;CAC7C,YAAYG,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CACjD,SAASJ,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACpC,SAASA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACpC,WAAWA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACtC,kBAAkBA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAC7C,gBAAgBA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAC3C,SAASK,QAAU,CAAC,CAAC,SAAS;CAC9B,aAAaA,QAAU,CAAC,CAAC,SAAS;CAClC,iBAAiB,iBAAiB,SAAS;CAC3C,2BAA2B,iBAAiB,SAAS;AACzD,CAAC,CAAC,CACG,aAAa,OAAO,QAAQ;CAC7B,IAAI,MAAM,gBAAgB,kBAAkB,MAAM,eAAe,KAAA,GAC7D,IAAI,SAAS;EACT,MAAM;EACN,MAAM,CAAC,YAAY;EACnB,SAAS;CACb,CAAC;CAEL,IAAI,MAAM,cAAc,KAAA,KAAa,MAAM,YAAY,KAAA,GACnD,IAAI,SAAS;EACT,MAAM;EACN,MAAM,CAAC,WAAW;EAClB,SAAS;CACb,CAAC;CAEL,IAAI,MAAM,cAAc,KAAA,KAAa,MAAM,YAAY,KAAA,KAAa,MAAM,cAAc,MAAM,SAC1F,IAAI,SAAS;EACT,MAAM;EACN,MAAM,CAAC,WAAW;EAClB,SAAS;CACb,CAAC;AAET,CAAC;AACD,MAAa,kBAAkBJ,MAAO;CAAC;CAAW;CAAmB;AAAS,CAAC;AAC/E,MAAa,oBAAoBA,MAAO;CAAC;CAAQ;CAAQ;AAAS,CAAC;;AAEnE,MAAM,uBAAuBK,OACjB,CAAC,CACR,IAAI,CAAC,CAAC,CACN,IAAI,GAAG,CAAC,CACR,MAAM,gBAAgB;;;;;;;;AAQ3B,MAAa,mBAAmBC,mBAAqB,SAAS;CAC1DL,OAAS;EACL,OAAOM,QAAU,WAAW;EAC5B,UAAUR,OAAS,CAAC,CAAC,IAAI,CAAC;EAC1B,OAAO;EACP,SAAS;EACT,UAAUA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC9B,CAAC;CACDE,OAAS;EAAE,OAAOM,QAAU,eAAe;EAAG,MAAM;CAAqB,CAAC;CAC1EN,OAAS;EAAE,OAAOM,QAAU,WAAW;EAAG,MAAM;CAAqB,CAAC;AAC1E,CAAC;;;;;;;;;;;;;;;;;;;;;AAqBD,MAAa,cAAcN,OAAS;CAChC,QAAQD,MAAO,CAAC,WAAW,QAAQ,CAAC;CAEpC,OAAOD,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,MAAMA,OAAS,CAAC,CAAC,SAAS;CAC1B,QAAQI,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,OAAOJ,OAAS,CAAC,CAAC,SAAS;CAC3B,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,mBAAmBA,OAAS,CAAC,CAAC,SAAS;CACvC,QAAQS,MAAQT,OAAS,CAAC,CAAC,CAAC,SAAS;CACrC,SAASA,OAAS,CAAC,CAAC,SAAS;CAC7B,aAAaA,OAAS,CAAC,CAAC,SAAS;CAEjC,MAAMA,OAAS,CAAC,CAAC,SAAS;CAC1B,WAAWK,QAAU,CAAC,CAAC,SAAS;AACpC,CAAC;;;;;AAKD,MAAa,8CAA8C;;;;;;AAM3D,MAAa,4CAA4C;;;;;;;;;AASzD,MAAa,aAAaF,OACd;CACR,QAAQH,OAAS,CAAC,CAAC,KAAK;CACxB,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC;CAI7B,GAAG,2BAA2B;CAC9B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAClC,QAAQ,mBAAmB,SAAS;CACpC,QAAQC,MAAO,CAAC,WAAW,QAAQ,CAAC;CACpC,YAAYG,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CACpD,WAAWJ,OAAS,CAAC,CAAC,SAAS;CAC/B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAG5B,iBAAiBA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CAC5C,cAAc,iBAAiB,SAAS;AAC5C,CAAC,CAAC,CACG,aAAa,QAAQ,QAAQ;CAC9B,IAAK,OAAO,oBAAoB,KAAA,OAAgB,OAAO,iBAAiB,KAAA,IACpE,IAAI,SAAS;EACT,MAAM;EACN,MAAM,OAAO,oBAAoB,KAAA,IAAY,CAAC,iBAAiB,IAAI,CAAC,cAAc;EAClF,SAAS;CACb,CAAC;AAET,CAAC;;;;;;;AAOD,MAAa,YAAYE,OAAS;CAC9B,QAAQF,OAAS,CAAC,CAAC,KAAK;CACxB,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC7B,WAAWA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACtC,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAClC,QAAQ;CACR,GAAG,mBAAmB;AAC1B,CAAC;AACD,MAAa,cAAcE,OAAS,EAAE,UAAUM,QAAU,IAAI,EAAE,CAAC;;AAEjE,MAAa,wBAAwBN,OAAS;CAC1C,QAAQF,OAAS,CAAC,CAAC,KAAK;CACxB,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC7B,WAAWA,OAAS,CAAC,CAAC,KAAK;CAC3B,gBAAgB;CAChB,kBAAkB;CAClB,UAAU;AACd,CAAC;;AAED,MAAa,yBAAyBE,OAAS;CAC3C,WAAWF,OAAS,CAAC,CAAC,KAAK;CAC3B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC;CACvB,QAAQI,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAClC,WAAWJ,OAAS,CAAC,CAAC,SAAS;CAC/B,QAAQ;CACR,cAAcA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC9B,YAAYI,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACtC,iBAAiBJ,OAAS,CAAC,CAAC,IAAI,CAAC;CACjC,iBAAiBA,OAAS,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;;;;;AAKD,MAAa,2BAA2BE,OAAS;CAC7C,QAAQF,OAAS,CAAC,CAAC,KAAK;CACxB,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC7B,WAAWA,OAAS,CAAC,CAAC,KAAK;CAC3B,UAAU;CACV,QAAQ;AACZ,CAAC;AACD,MAAa,uBAAuBE,OAAS,EAAE,UAAUM,QAAU,IAAI,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACnN1E,MAAa,oBAAoBE,MAAO;CAAC;CAAY;CAAU;AAAe,CAAC;AAC/E,MAAa,iBAAiBC,OAAS;CAEnC,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,QAAQF,MAAO;EAAC;EAAS;EAAS;EAAQ;EAAQ;CAAQ,CAAC,CAAC,CAAC,SAAS;CAEtE,cAAcG,MAAQ,iBAAiB,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAM7D,SAASC,QAAU,mBAAmB,CAAC,CAAC,SAAS;CAIjD,QAAQF,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CAInC,cAAcG,QAAU,CAAC,CAAC,SAAS;CASnC,cAAcH,OAAS,CAAC,CAAC,SAAS;AACtC,CAAC;AACD,MAAa,eAAeD,OAAS;CAEjC,UAAUG,QAAU,gBAAgB;CACpC,OAAOF,OAAS;CAChB,QAAQI,OAAS,CAAC,CAAC,IAAI;CAGvB,WAAWJ,OAAS,CAAC,CAAC,SAAS;CAC/B,cAAcA,OAAS;CACvB,QAAQF,MAAO,CAAC,QAAQ,OAAO,CAAC;AACpC,CAAC;;;;;;;;;;;;;;;;;;;;;;ACjDD,MAAa,eAAeO,OAAS;CACjC,aAAaC,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,cAAcA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACxC,eAAeA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACzC,kBAAkBA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC5C,mBAAmBA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC7C,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,YAAYA,OAAS,CAAC,CAAC,SAAS;CAChC,cAAcC,OAAS,CAAC,CAAC,SAAS;AACtC,CAAC;;AAED,MAAa,kBAAkBF,OAAS;CACpC,WAAWE,OAAS;CACpB,YAAY;CACZ,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,OAAOA,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,gBAAgBA,OAAS,CAAC,CAAC,SAAS;CACpC,OAAO,aAAa,SAAS;CAC7B,aAAaA,OAAS,CAAC,CAAC,SAAS;CAIjC,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,iBAAiBA,OAAS,CAAC,CAAC,SAAS;CAKrC,WAAWA,OAAS,CAAC,CAAC,SAAS;AACnC,CAAC;;AAED,MAAa,iBAAiBF,OAAS,EACnC,SAASE,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EACxC,CAAC;;AAED,MAAa,kBAAkBF,OAAS,EACpC,UAAUG,MAAQ,eAAe,EACrC,CAAC;AAMuBH,OAAS;CAC7B,YAAYE,OAAS;CACrB,MAAMA,OAAS,CAAC,CAAC,SAAS;CAC1B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,UAAUE,QAAU,CAAC,CAAC,SAAS;CAC/B,WAAWA,QAAU,CAAC,CAAC,SAAS;CAChC,SAASD,MAAQC,QAAU,CAAC,CAAC,CAAC,SAAS;CACvC,WAAWD,MAAQH,OAAS;EAAE,MAAME,OAAS;EAAG,MAAMD,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,CAAC,SAAS;CAC/F,WAAWI,QAAU,CAAC,CAAC,SAAS;AACpC,CAAC;;AAED,MAAa,iBAAiBL,OAAS;CACnC,KAAKC,OAAS,CAAC,CAAC,IAAI;CACpB,QAAQC,OAAS;CACjB,YAAYA,OAAS,CAAC,CAAC,SAAS;CAChC,IAAIA,OAAS;CACb,MAAMA,OAAS;CACf,MAAMA,OAAS;CAEf,YAAYA,OAAS,CAAC,CAAC,SAAS;CAChC,YAAYA,OAAS,CAAC,CAAC,SAAS;CAChC,UAAUA,OAAS,CAAC,CAAC,SAAS;CAC9B,MAAMA,OAAS,CAAC,CAAC,SAAS;CAC1B,eAAeG,QAAU,CAAC,CAAC,SAAS;CACpC,WAAWJ,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AACzC,CAAC;;AAED,MAAa,oBAAoBD,OAAS;CACtC,WAAWE,OAAS;CACpB,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,OAAOD,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE;AAC1D,CAAC;;AAED,MAAa,qBAAqBD,OAAS;CACvC,WAAWE,OAAS;CACpB,UAAUC,MAAQ,cAAc;CAChC,YAAYD,OAAS,CAAC,CAAC,SAAS;AACpC,CAAC;;;;;;AAMD,MAAa,qBAAqBF,OAAS;CACvC,WAAWE,OAAS;CACpB,YAAYA,OAAS;CACrB,QAAQD,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;;AAED,MAAa,uBAAuBD,OAAS;CACzC,WAAWE,OAAS;CACpB,YAAYA,OAAS;CACrB,MAAMA,OAAS;CACf,YAAYD,OAAS,CAAC,CAAC,IAAI;CAC3B,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;AAC1C,CAAC;;;;;;;;;;;;;;;;;;;;;;;;ACnGD,MAAa,eAAeK,OAAS;CACjC,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,MAAMA,OAAS;CACf,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,QAAQC,MAAO;EAAC;EAAU;EAAY;CAAQ,CAAC;AACnD,CAAC;;AAED,MAAa,mBAAmBF,OAAS;CACrC,UAAU;CACV,SAASC,OAAS;;;;CAIlB,kBAAkBA,OAAS,CAAC,CAAC,KAAK;AACtC,CAAC;;AAED,MAAa,kBAAkBD,OAAS;CACpC,UAAU;CACV,SAASC,OAAS;CAClB,QAAQE,MAAQ,YAAY;AAChC,CAAC;;;;;;;;;;;;;;;;;;;;;ACzBD,MAAa,iBAAiBC,OAAS;CACnC,MAAMC,OAAS;CACf,MAAMC,MAAO;EAAC;EAAO;EAAQ;EAAW;CAAO,CAAC;CAChD,MAAMC,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CAC9C,OAAOF,OAAS,CAAC,CAAC,SAAS;AAC/B,CAAC;;AAED,MAAa,mBAAmBD,OAAS;CACrC,SAASC,OAAS,CAAC,CAAC,IAAI,CAAC;CACzB,MAAMA,OAAS,CAAC,CAAC,QAAQ,EAAE;CAC3B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,OAAOE,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,GAAG;AAC3D,CAAC;;AAED,MAAa,oBAAoBH,OAAS;CACtC,SAASC,OAAS;CAClB,MAAMA,OAAS;CACf,QAAQG,QAAU;CAClB,SAASC,MAAQ,cAAc;CAC/B,YAAYJ,OAAS,CAAC,CAAC,SAAS;AACpC,CAAC;;AAED,MAAa,mBAAmBD,OAAS;CACrC,SAASC,OAAS,CAAC,CAAC,IAAI,CAAC;CACzB,MAAMA,OAAS,CAAC,CAAC,IAAI,CAAC;CACtB,QAAQE,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;CAChD,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK;AAC/D,CAAC;;AAED,MAAa,uBAAuBH,OAAS;CACzC,SAASC,OAAS;CAClB,MAAMA,OAAS;CACf,QAAQG,QAAU;CAClB,MAAMD,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CAC9C,OAAOF,OAAS,CAAC,CAAC,SAAS;CAC3B,UAAUC,MAAO,CAAC,QAAQ,MAAM,CAAC,CAAC,CAAC,SAAS;CAC5C,SAASD,OAAS,CAAC,CAAC,SAAS;CAC7B,QAAQE,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CAChD,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CACpD,WAAWC,QAAU,CAAC,CAAC,SAAS;AACpC,CAAC;;;;;;;;;;;;AAYD,MAAa,wBAAwBJ,OAAS,EAC1C,SAASC,OAAS,CAAC,CAAC,IAAI,CAAC,EAC7B,CAAC;;;AAGD,MAAa,mBAAmBD,OAAS;CACrC,MAAMC,OAAS;CACf,OAAOA,OAAS;CAChB,YAAYA,OAAS;AACzB,CAAC;;AAED,MAAa,qBAAqBD,OAAS;CACvC,KAAKC,OAAS;CACd,UAAUA,OAAS;CACnB,SAASA,OAAS;CAClB,aAAaA,OAAS;AAC1B,CAAC;;AAED,MAAa,qBAAqBD,OAAS;CACvC,SAASC,OAAS;CAClB,QAAQG,QAAU;CAClB,OAAOA,QAAU;CACjB,QAAQH,OAAS,CAAC,CAAC,SAAS;CAC5B,UAAUA,OAAS,CAAC,CAAC,SAAS;CAC9B,OAAOE,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CAC/C,QAAQA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CAChD,OAAOE,MAAQ,gBAAgB,CAAC,CAAC,SAAS;CAC1C,WAAWD,QAAU,CAAC,CAAC,SAAS;CAChC,YAAY,mBAAmB,SAAS;CACxC,aAAaH,OAAS,CAAC,CAAC,SAAS;AACrC,CAAC;;AAED,MAAa,sBAAsBD,OAAS,EACxC,SAASC,OAAS,CAAC,CAAC,IAAI,CAAC,EAC7B,CAAC;;;AAGD,MAAa,yBAAyBD,OAAS;CAC3C,SAASC,OAAS;CAClB,QAAQG,QAAU;CAClB,IAAIA,QAAU;CACd,QAAQH,OAAS,CAAC,CAAC,SAAS;CAC5B,SAASE,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CACjD,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CACpD,WAAWA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;AACvD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACzFD,MAAa,eAAe;;AAE5B,MAAa,cAAcG,OAAS;CAChC,MAAMC,OAAS;CACf,MAAMC,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACnC,OAAOD,OAAS;AACpB,CAAC;;AAED,MAAa,gBAAgBD,OAAS,EAClC,SAASC,OAAS,CAAC,CAAC,IAAI,CAAC,EAC7B,CAAC;;AAED,MAAa,iBAAiBD,OAAS;CACnC,SAASC,OAAS;CAClB,QAAQE,QAAU;CAClB,SAASC,MAAQ,WAAW;AAChC,CAAC;;AAED,MAAa,gBAAgBJ,OAAS;CAClC,SAASC,OAAS,CAAC,CAAC,IAAI,CAAC;CACzB,MAAMA,OAAS,CAAC,CAAC,QAAQ,YAAY;CACrC,QAAQC,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC;CAChD,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK;AAC/D,CAAC;;AAED,MAAa,oBAAoBF,OAAS;CACtC,SAASC,OAAS;CAClB,MAAMA,OAAS;CACf,QAAQE,QAAU;CAClB,MAAMD,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CAC9C,OAAOD,OAAS,CAAC,CAAC,SAAS;CAC3B,SAASA,OAAS,CAAC,CAAC,SAAS;CAC7B,QAAQC,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CAChD,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,SAAS;CACpD,WAAWC,QAAU,CAAC,CAAC,SAAS;AACpC,CAAC;;AAED,MAAa,iBAAiBH,OAAS;CACnC,SAASC,OAAS,CAAC,CAAC,IAAI,CAAC;CACzB,MAAMA,OAAS,CAAC,CAAC,QAAQ,YAAY;CACrC,SAASA,OAAS;CAIlB,cAAcA,OAAS,CAAC,CAAC,SAAS;AACtC,CAAC;;AAED,MAAa,gBAAgBD,OAAS;CAClC,SAASC,OAAS;CAClB,MAAMA,OAAS;CACf,MAAMC,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACnC,OAAOD,OAAS;AACpB,CAAC;;;;;;;;;;ACrED,MAAa,YAAYI,OAAS;CAC9B,MAAMA,OAAS;EACX,KAAKC,OAAS;EACd,KAAKA,OAAS;EACd,QAAQA,OAAS,CAAC,CAAC,IAAI;CAC3B,CAAC;CACD,QAAQC,MAAO,CAAC,MAAM,UAAU,CAAC;CACjC,gBAAgBD,OAAS,CAAC,CAAC,IAAI;CAC/B,gBAAgBE,MAAQC,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;;AAED,MAAa,eAAeJ,OAAS;CACjC,WAAWI,OAAS;CACpB,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACrC,OAAOF,MAAO;EAAC;EAAS;EAAQ;EAAW;CAAK,CAAC;CAGjD,UAAU,SAAS,SAAS;CAC5B,SAASE,OAAS,CAAC,CAAC,SAAS;CAC7B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,MAAMA,OAAS,CAAC,CAAC,SAAS;CAC1B,SAASA,OAAS,CAAC,CAAC,SAAS;CAG7B,OAAOA,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,gBAAgBA,OAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC/C,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,aAAaA,OAAS,CAAC,CAAC,SAAS;CACjC,iBAAiBA,OAAS,CAAC,CAAC,SAAS;CACrC,WAAWA,OAAS,CAAC,CAAC,SAAS;CAM/B,SAASA,OAAS,CAAC,CAAC,SAAS;CAC7B,OAAOA,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,UAAUC,QAAU,CAAC,CAAC,SAAS;CAC/B,gBAAgBD,OAAS,CAAC,CAAC,SAAS;CACpC,YAAYA,OAAS,CAAC,CAAC,SAAS;CAChC,IAAIA,OAAS,CAAC,CAAC,SAAS;AAC5B,CAAC;;;;;;;;AAQD,MAAa,cAAcJ,OAAS;CAChC,WAAWI,OAAS;CACpB,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,SAAS;CAC9B,SAASA,OAAS,CAAC,CAAC,SAAS;CAC7B,gBAAgBA,OAAS;CACzB,OAAO;AACX,CAAC;;;;;;;;;;;;;AAaD,MAAa,2BAA2BJ,OAAS;CAC7C,MAAMK,QAAU;CAChB,KAAKA,QAAU;AACnB,CAAC;AACD,MAAa,sBAAsBL,OAAS;CACxC,SAASI,OAAS;CAClB,SAASA,OAAS;CAClB,QAAQD,MAAQC,OAAS,CAAC;CAC1B,eAAeH,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACzC,YAAYC,MAAO;EAAC;EAAQ;EAAW;CAAM,CAAC;CAG9C,oBAAoBD,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CAC9C,aAAaI,QAAU;CAGvB,iBAAiB,yBAAyB,SAAS;AACvD,CAAC;;;;;;;AAOD,MAAa,iBAAiBL,OAAS;CACnC,MAAMI,OAAS;CACf,WAAWF,MAAO;EAAC;EAAS;EAAQ;CAAK,CAAC;;CAE1C,IAAIG,QAAU;CACd,OAAOF,MAAQC,OAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;CACrC,SAASA,OAAS,CAAC,CAAC,SAAS;CAC7B,OAAOA,OAAS,CAAC,CAAC,SAAS;AAC/B,CAAC;;;;;;;;;AASD,MAAa,iBAAiBJ,OAAS;CACnC,UAAUG,MAAQ,mBAAmB;CAGrC,YAAYA,MAAQ,cAAc,CAAC,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;;AAED,MAAa,aAAaH,OAAS,EAC/B,MAAMM,OAASF,OAAS,GAAGG,QAAU,CAAC,EAC1C,CAAC;;AAED,MAAa,gBAAgBP,OAAS;CAClC,QAAQI,OAAS;CACjB,YAAYC,QAAU,CAAC,CAAC,QAAQ,IAAI;AACxC,CAAC;;AAED,MAAa,gBAAgBL,OAAS;CAClC,eAAeI,OAAS;CACxB,YAAYC,QAAU,CAAC,CAAC,QAAQ,IAAI;AACxC,CAAC;;AAED,MAAa,mBAAmBL,OAAS;CACrC,UAAUK,QAAU;CACpB,gBAAgBD,OAAS,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;AACnD,CAAC;;;;;AAKD,MAAa,MAAMJ,OAAS;CACxB,IAAIK,QAAU;CACd,QAAQD,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC;AC7HD,MAAa,aAAaK,OAAS;CAC/B,MAxBqBD,MAAO;EAE5B;EACA;EACA;EACA;EAEA;EACA;EAEA;EACA;EAEA;EACA;EAEA;EACA;EAEA;EACA;EACA;CACJ,CAEU;CACN,SAASE,OAAS;CAClB,WAAWC,QAAU;CACrB,SAASC,OAASF,OAAS,GAAGG,QAAU,CAAC,CAAC,CAAC,SAAS;AACxD,CAAC;AC1ByBC,OAAS;CAC/B,UAAUC,QAAU;CACpB,QAAQC,OAAS,CAAC,CAAC,KAAK;CACxB,QAAQC,MAAO;EAAC;EAAU;EAAY;EAAQ;EAAU;CAAU,CAAC,CAAC,CAAC,SAAS;AAClF,CAAC;AAGD,MAAa,eAAeC,mBAAqB,QAAQ;CACrDJ,OAAS;EAAE,MAAMK,QAAU,SAAS;EAAG,MAAMH,OAAS;CAAE,CAAC;CACzDF,OAAS;EAAE,MAAMK,QAAU,UAAU;EAAG,MAAMH,OAAS;CAAE,CAAC;CAC1DF,OAAS;EAAE,MAAMK,QAAU,WAAW;EAAG,YAAYH,OAAS;EAAG,OAAOA,OAAS;EAAG,QAAQA,OAAS;CAAE,CAAC;CACxGF,OAAS;EAAE,MAAMK,QAAU,aAAa;EAAG,YAAYH,OAAS;EAAG,QAAQA,OAAS;CAAE,CAAC;CAKvFF,OAAS;EAAE,MAAMK,QAAU,cAAc;EAAG,OAAOH,OAAS;CAAE,CAAC;AACnE,CAAC;AAOD,MAAa,gBAAgBF,OAAS;CAClC,OAAOE,OAAS,CAAC,CAAC,SAAS;CAC3B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,gBAAgBA,OAAS,CAAC,CAAC,SAAS;CACpC,UAAUD,QAAU,CAAC,CAAC,SAAS;CAC/B,aAAaK,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACvC,YAAYA,OAAS,CAAC,CAAC,SAAS;CAChC,cAAcJ,OAAS,CAAC,CAAC,SAAS;CAGlC,QAAQK,MAAQL,OAAS,CAAC,CAAC,CAAC,SAAS;CAIrC,SAASK,MAAQL,OAAS,CAAC,CAAC,CAAC,SAAS;CAGtC,iBAAiBK,MAAQL,OAAS,CAAC,CAAC,CAAC,SAAS;CAI9C,mBAAmBD,QAAU,CAAC,CAAC,SAAS;CAGxC,WAAWC,OAAS,CAAC,CAAC,SAAS;AACnC,CAAC;AAID,MAAa,gBAAgBM,OACjB;CACR,gBAAgBN,OAAS,CAAC,CAAC,KAAK;CAChC,QAAQA,OAAS,CAAC,CAAC,KAAK;CACxB,OAAOI,OAAS,CAAC,CAAC,IAAI;CACtB,OAAO,aAAa,SAAS;CAC7B,QAAQ,cAAc,SAAS;AACnC,CAAC,CAAC,CAEG,QAAQ,MAAM,EAAE,UAAU,KAAA,KAAa,EAAE,WAAW,KAAA,GAAW,EAChE,SAAS,+CACb,CAAC;AAKD,MAAa,cAAcN,OAAS;CAChC,gBAAgBE,OAAS,CAAC,CAAC,KAAK;CAChC,QAAQA,OAAS,CAAC,CAAC,KAAK;CACxB,YAAYA,OAAS,CAAC,CAAC,SAAS;CAChC,OAAOF,OAAS;EAAE,MAAMM,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;EAAG,MAAMA,OAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CAC7F,OAAOJ,OAAS,CAAC,CAAC,SAAS;AAC/B,CAAC;;;;;;;;;;;;;;ACvDD,MAAa,gBAAgB;CAEzB,MAAM;CACN,WAAW;CAEX,UAAU;CACV,eAAe;CAEf,gBAAgB;CAEhB,wBAAwB;CAExB,WAAW;CAEX,gBAAgB;CAChB,kBAAkB;CAClB,cAAc;CACd,gBAAgB;CAChB,gBAAgB;CAChB,gBAAgB;CAChB,kBAAkB;CAClB,kBAAkB;CAClB,sBAAsB;CAEtB,gBAAgB;CAChB,oBAAoB;CACpB,gBAAgB;CAChB,gBAAgB;CAChB,kBAAkB;CAClB,cAAc;CAEd,eAAe;CACf,eAAe;CACf,eAAe;CACf,YAAY;CAEZ,eAAe;CACf,cAAc;CACd,iBAAiB;CACjB,2BAA2B;CAC3B,4BAA4B;CAC5B,wBAAwB;CACxB,2BAA2B;CAE3B,sBAAsB;CACtB,sBAAsB;CACtB,wBAAwB;CAExB,mBAAmB;CACnB,iBAAiB;CAEjB,mBAAmB;CACnB,iBAAiB;CACjB,iBAAiB;CACjB,kBAAkB;CAClB,qBAAqB;CAErB,iBAAiB;CACjB,gBAAgB;CAChB,yBAAyB;CACzB,yBAAyB;CAEzB,gBAAgB;CAChB,qBAAqB;CACrB,mBAAmB;CACnB,wBAAwB;CACxB,qBAAqB;CACrB,2BAA2B;CAE3B,kBAAkB;CAClB,qBAAqB;CAErB,kBAAkB;CAClB,uBAAuB;CACvB,kBAAkB;CAClB,0BAA0B;CAC1B,uBAAuB;CACvB,8BAA8B;CAC9B,qBAAqB;CACrB,4BAA4B;CAC5B,eAAe;CACf,oBAAoB;CACpB,eAAe;CACf,uBAAuB;CACvB,gBAAgB;CAChB,mBAAmB;CAEnB,eAAe;CACf,kBAAkB;CAClB,kBAAkB;CAElB,sBAAsB;CACtB,KAAK;CAEL,OAAO;AACX;AAE2B,OAAO,KAAK,aAAa;;;;;;;;;;;;;;AAcpD,SAAS,MAAM,MAAM,SAAS;CAC1B,OAAOO,OAAS;EACZ,GAAGC,QAAU,CAAC;EACd,IAAIC,OAAS,CAAC,CAAC,KAAK;EACpB,IAAIA,OAAS,CAAC,CAAC,SAAS;EACxB,MAAMD,QAAU,IAAI;EACpB,MAAMC,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;EACjC;CACJ,CAAC;AACL;AAMwBC,mBAAqB,QAAQ;CACjD,MAAM,QAAQ,cAAc,OAAO;CACnC,MAAM,WAAW,cAAc,UAAU;CACzC,MAAM,YAAY,cAAc,WAAW;CAC3C,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,wBAAwB,cAAc,uBAAuB;CACnE,MAAM,aAAa,cAAc,YAAY;CAC7C,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,cAAc,cAAc,aAAa;CAC/C,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,sBAAsB,cAAc,qBAAqB;CAE/D,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,oBAAoB,cAAc,mBAAmB;CAC3D,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,cAAc,cAAc,aAAa;CAC/C,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,YAAY,cAAc,WAAW;CAC3C,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,cAAc,cAAc,aAAa;CAC/C,MAAM,iBAAiB,cAAc,gBAAgB;CACrD,MAAM,2BAA2B,cAAc,0BAA0B;CACzE,MAAM,4BAA4B,cAAc,2BAA2B;CAC3E,MAAM,wBAAwB,cAAc,uBAAuB;CACnE,MAAM,2BAA2B,cAAc,0BAA0B;CACzE,MAAM,sBAAsB,cAAc,qBAAqB;CAC/D,MAAM,sBAAsB,cAAc,qBAAqB;CAC/D,MAAM,wBAAwB,cAAc,uBAAuB;CACnE,MAAM,mBAAmB,cAAc,kBAAkB;CACzD,MAAM,iBAAiB,cAAc,gBAAgB;CACrD,MAAM,mBAAmB,cAAc,kBAAkB;CACzD,MAAM,iBAAiB,cAAc,gBAAgB;CACrD,MAAM,iBAAiB,cAAc,gBAAgB;CACrD,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,qBAAqB,cAAc,oBAAoB;CAC7D,MAAM,iBAAiB,cAAc,gBAAgB;CACrD,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,yBAAyB,cAAc,wBAAwB;CACrE,MAAM,yBAAyB,cAAc,wBAAwB;CACrE,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,qBAAqB,cAAc,oBAAoB;CAC7D,MAAM,mBAAmB,cAAc,kBAAkB;CACzD,MAAM,wBAAwB,cAAc,uBAAuB;CACnE,MAAM,qBAAqB,cAAc,oBAAoB;CAC7D,MAAM,2BAA2B,cAAc,0BAA0B;CACzE,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,qBAAqB,cAAc,oBAAoB;CAC7D,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,uBAAuB,cAAc,sBAAsB;CACjE,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,0BAA0B,cAAc,yBAAyB;CACvE,MAAM,uBAAuB,cAAc,sBAAsB;CACjE,MAAM,8BAA8B,cAAc,6BAA6B;CAC/E,MAAM,qBAAqB,cAAc,oBAAoB;CAC7D,MAAM,4BAA4B,cAAc,2BAA2B;CAC3E,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,oBAAoB,cAAc,mBAAmB;CAC3D,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,uBAAuB,cAAc,sBAAsB;CACjE,MAAM,gBAAgB,cAAc,eAAe;CACnD,MAAM,mBAAmB,cAAc,kBAAkB;CACzD,MAAM,eAAe,cAAc,cAAc;CACjD,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,kBAAkB,cAAc,iBAAiB;CACvD,MAAM,sBAAsB,cAAc,qBAAqB;CAC/D,MAAM,OAAO,cAAc,MAAM;CACjC,MAAM,SAAS,cAAc,QAAQ;AACzC,CAAC;;;;;;;;;;;;;AC9ND,MAAa,kBAAkB,MAAM;AACrC,MAAM,cAAc,IAAI,YAAY;AACpC,SAAS,WAAW,MAAM;CACtB,OAAO,YAAY,OAAO,IAAI,CAAC,CAAC;AACpC;AACA,SAAS,kBAAkB,MAAM;CAC7B,IAAI,OAAO,SAAS,YAAY,SAAS,MACrC,OAAO,KAAA;CACX,MAAM,IAAI;CACV,MAAM,MAAM,CAAC;CACb,IAAI,OAAO,EAAE,UAAU,UACnB,IAAI,QAAQ,EAAE;CAClB,IAAI,OAAO,EAAE,YAAY,UACrB,IAAI,UAAU,EAAE;CACpB,IAAI,OAAO,EAAE,aAAa,UACtB,IAAI,WAAW,EAAE;CACrB,OAAO,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,IAAI,MAAM,KAAA;AAC/C;;;;;;AAMA,SAAgB,mBAAmB,SAAS,MAAM;CAC9C,IAAI,WAAW,IAAI,IAAA,QACf,OAAO;EAAE,IAAI;EAAO,IAAI;EAAU,KAAK;CAAkB;CAE7D,IAAI;CACJ,IAAI;EACA,OAAO,KAAK,MAAM,IAAI;CAC1B,QACM;EACF,OAAO;GAAE,IAAI;GAAO,IAAI;GAAU,KAAK;EAAe;CAC1D;CACA,MAAM,MAAM,SAAS,UAAU,IAAI;CACnC,IAAI,CAAC,IAAI,SAIL,OAAO;EAAE,IAAI;EAAO,IAHT,OAAO,SAAS,YAAY,SAAS,QAAQ,OAAO,KAAK,OAAO,WACrE,KAAK,KACL;EACkB,KAAK,IAAI,MAAM;CAAQ;CAEnD,MAAM,SAAS,QAAQ,IAAI,KAAK;CAChC,IAAI,CAAC,QACD,OAAO;EACH,IAAI;EACJ,IAAI,IAAI,KAAK;EACb,KAAK;EACL,GAAI,IAAI,KAAK,OAAO,EAAE,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;CACnD;CAEJ,MAAM,UAAU,OAAO,UAAU,IAAI,KAAK,OAAO;CACjD,IAAI,CAAC,QAAQ,SACT,OAAO;EACH,IAAI;EACJ,IAAI,IAAI,KAAK;EACb,KAAK,QAAQ,MAAM;EACnB,GAAI,IAAI,KAAK,OAAO,EAAE,MAAM,IAAI,KAAK,KAAK,IAAI,CAAC;CACnD;CAEJ,MAAM,MAAM,kBAAkB,IAAI;CAClC,OAAO;EACH,IAAI;EACJ,OAAO;GAAE,GAAG,IAAI;GAAM,SAAS,QAAQ;EAAK;EAC5C,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;CACzB;AACJ;;;;;;AAMA,SAAgB,iBAAiB,MAAM,SAAS,OAAO,CAAC,GAAG;CACvD,OAAO;EACH,GAAG;EACH,IAAI,KAAK,MAAM,WAAW;EAC1B,IAAI,KAAK,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACtC;EACA;EACA,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EACvC,GAAI,KAAK,OAAO,CAAC;CACrB;AACJ;;;ACrFA,SAAgB,eAAe,MAAM;CACjC,OAAO,mBAAmB,eAAe,IAAI;AACjD;AACA,SAAgB,cAAc,MAAM,SAAS,OAAO,CAAC,GAAG;CACpD,OAAO,iBAAiB,MAAM,SAAS,IAAI;AAC/C;AACA,SAAgB,OAAO,OAAO;CAC1B,OAAO,KAAK,UAAU,KAAK;AAC/B;;;ACgBA,MAAa,SAASC,OAAS;CAC3B,QAAQC,MAAO,CAAC,SAAS,QAAQ,CAAC;CAClC,YAAYC,OAAS,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,MAAa,WAAWF,OAAS;CAC7B,cAAcG,OAAS,CAAC,CAAC,IAAI;CAC7B,YAAYD,OAAS,CAAC,CAAC,SAAS;AACpC,CAAC;AAQD,MAAa,aAAaF,OAAS;CAC/B,MAAME,OAAS,CAAC,CAAC,IAAI,CAAC;CACtB,WAAWA,OAAS,CAAC,CAAC,IAAI,CAAC;AAC/B,CAAC;AAED,MAAa,eAAeF,OAAS,EACjC,SAASE,OAAS,CAAC,CAAC,KAAK,EAC7B,CAAC;AAED,MAAa,cAAcF,OAAS,CAAC,CAAC;AAKtC,MAAa,WAAWA,OAAS;CAC7B,MAAMC,MAAO,CAAC,cAAc,eAAe,CAAC;CAC5C,YAAYC,OAAS,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAMD,MAAa,iBAAiBF,OAAS;CACnC,IAAII,QAAU;CACd,QAAQF,OAAS,CAAC,CAAC,SAAS;CAC5B,OAAOA,OAAS,CAAC,CAAC,SAAS;CAC3B,UAAUA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACrC,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,MAAMA,OAAS,CAAC,CAAC,SAAS;CAC1B,SAASA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;AACxC,CAAC;AAMD,MAAa,uBAAuBG,OACxB;CACR,QAAQH,OAAS,CAAC,CAAC,KAAK;CACxB,gBAAgBA,OAAS,CAAC,CAAC,MAAM,YAAY;CAC7C,QAAQA,OAAS,CAAC,CAAC,MAAM,YAAY;CACrC,cAAcA,OAAS,CAAC,CAAC,MAAM,oBAAoB;CACnD,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC;CAG7B,gBAAgB;CAChB,kBAAkB;AACtB,CAAC,CAAC,CACG,OAAO;AAGZ,MAAa,6BAA6BF,OAAS,EAAE,SAASI,QAAU,EAAE,CAAC,CAAC,CAAC,OAAO;AAIpF,MAAa,oBAAoBC,OACrB;CACR,YAAYH,OAAS,CAAC,CAAC,MAAM,YAAY;CACzC,QAAQA,OAAS,CAAC,CAAC,MAAM,YAAY;CACrC,SAASA,OAAS,CAAC,CAAC,IAAI,CAAC;CACzB,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AAC1C,CAAC,CAAC,CACG,OAAO;AAIZ,MAAa,0BAA0BI,mBAAqB,WAAW,CACnEN,OAAS,EAAE,SAASO,QAAU,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,GAC/CC,OACY;CACR,SAASD,QAAU,IAAI;CACvB,QAAQL,OAAS,CAAC,CAAC,KAAK;CACxB,YAAYC,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;CACtC,gBAAgB;CAChB,kBAAkB;AACtB,CAAC,CAAC,CACG,OAAO,CAChB,CAAC;AASD,MAAa,eAAeE,OAChB;CACR,QAAQH,OAAS,CAAC,CAAC,KAAK;CACxB,MAAMD,MAAO,CAAC,WAAW,QAAQ,CAAC;CAClC,SAASC,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAG1B,GAAG,2BAA2B;CAG9B,aAAaD,MAAO;EAAC;EAAe;EAAa;CAAQ,CAAC;CAC1D,QAAQ,WAAW,SAAS;CAE5B,SAASO,OACG;EACR,UAAUN,OAAS,CAAC,CAAC,IAAI,CAAC;EAC1B,YAAYA,OAAS,CAAC,CAAC,SAAS;CACpC,CAAC,CAAC,CACG,SAAS;CAEd,QAAQM,OACI;EACR,QAAQN,OAAS;EACjB,cAAcA,OAAS;EACvB,QAAQO,MAAQP,OAAS,CAAC;EAC1B,aAAaO,MAAQP,OAAS,CAAC;EAI/B,iBAAiBO,MAAQR,MAAO,CAAC,UAAU,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;EAGtE,aAAaG,QAAU;EAIvB,SAASF,OAAS,CAAC,CAAC,SAAS;EAG7B,iBAAiBO,MAAQP,OAAS,CAAC;CACvC,CAAC,CAAC,CACG,SAAS;AAClB,CAAC,CAAC,CACG,aAAa,MAAM,QAAQ;CAC5B,IAAI,KAAK,qBAAqB,KAAA,KAAa,KAAK,qBAAqB,KAAK,UACtE,IAAI,SAAS;EACT,MAAM;EACN,MAAM,CAAC,kBAAkB;EACzB,SAAS;CACb,CAAC;AAET,CAAC;AAED,MAAa,eAAeF,OAAS,EACjC,QAAQE,OAAS,CAAC,CAAC,KAAK,EAC5B,CAAC;AAqBD,MAAa,cAAcG,OACf;CACR,QAAQH,OAAS,CAAC,CAAC,KAAK;CACxB,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC7B,SAASA,OAAS,CAAC,CAAC,SAAS;CAC7B,SAASA,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACrC,GAAG,2BAA2B;CAC9B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CAClC,QAAQ,mBAAmB,SAAS;CACpC,QAAQD,MAAO,CAAC,YAAY,QAAQ,CAAC;CACrC,QAAQC,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC,CAAC,CACG,aAAa,QAAQ,QAAQ;CAC9B,IAAI,OAAO,aAAa,KAAA,KACpB,OAAO,qBAAqB,KAAA,KAC5B,OAAO,aAAa,OAAO,kBAC3B,IAAI,SAAS;EACT,MAAM;EACN,MAAM,CAAC,kBAAkB;EACzB,SAAS;CACb,CAAC;AAET,CAAC;AAQD,MAAa,uBAAuBF,OAAS;CACzC,gBAAgBE,OAAS,CAAC,CAAC,IAAI,CAAC;CAChC,QAAQA,OAAS,CAAC,CAAC,IAAI,CAAC;AAC5B,CAAC;AAID,MAAa,iBAAiBF,OAAS,EACnC,UAAUE,OAAS,CAAC,CAAC,KAAK,EAC9B,CAAC;;;;AAiBD,MAAa,sBAAsB;CAC/B,MAAM;CACN,QAAQ;CACR,UAAU;CACV,WAAW;CACX,mBAAmB;CACnB,SAAS;CACT,WAAW;CACX,QAAQ;CACR,MAAM;AACV;;;AAGA,MAAa,4BAA4BD,MAAO;CAAC;CAAgB;CAAU;AAAQ,CAAC;AACpF,MAAM,iCAAiCI,OAC3B;CACR,GAAGE,QAAU,CAAC;CACd,QAAQ;CACR,QAAQL,OAAS,CAAC,CAAC,IAAI,CAAC;AAC5B,CAAC,CAAC,CACG,OAAO;AACZ,SAAgB,+BAA+B,QAAQ;CACnD,OAAO;AACX;AACA,SAAgB,+BAA+B,OAAO;CAClD,MAAM,UAAU,0BAA0B,UAAU,KAAK;CACzD,IAAI,QAAQ,SACR,OAAO,EAAE,QAAQ,QAAQ,KAAK;CAClC,IAAI;EACA,MAAM,SAAS,+BAA+B,UAAU,KAAK,MAAM,KAAK,CAAC;EACzE,OAAO,OAAO,UAAU;GAAE,QAAQ,OAAO,KAAK;GAAQ,QAAQ,OAAO,KAAK;EAAO,IAAI;CACzF,QACM;EACF,OAAO;CACX;AACJ;AAIuCG,OAC3B;CACR,GAAGE,QAAU,CAAC;CACd,SAASL,OAAS,CAAC,CAAC,IAAI,CAAC;CACzB,eAAeA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC/B,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC,CAAC,CACG,OAAO;AACZ,SAAgB,8BAA8B,QAAQ;CAClD,OAAO,KAAK,UAAU;EAAE,GAAG;EAAG,GAAG;CAAO,CAAC;AAC7C;AAiBA,MAAa,kBAAkBF,OAAS;CACpC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAC1B,eAAeA,OAAS,CAAC,CAAC,KAAK;CAC/B,OAAOF,OAAS;EAAE,SAASE,OAAS,CAAC,CAAC,SAAS;EAAG,QAAQA,OAAS,CAAC,CAAC,SAAS;CAAE,CAAC,CAAC,CAAC,SAAS;CAC5F,OAAO;AACX,CAAC;AAID,MAAa,eAAeF,OAAS;CACjC,UAAUE,OAAS;CACnB,UAAUA,OAAS,CAAC,CAAC,SAAS;AAClC,CAAC;AAID,MAAa,kBAAkBF,OAAS;CACpC,SAASE,OAAS,CAAC,CAAC,KAAK;CACzB,MAAMA,OAAS;CACf,UAAUA,OAAS,CAAC,CAAC,KAAK;AAC9B,CAAC;;AA8DD,MAAa,mBAAmB;CAC5B,WAAW;CACX,cAAc;CACd,eAAe;CACf,iBAAiB;CACjB,gBAAgB;CAChB,aAAa;CACb,gBAAgB;CAChB,2BAA2B;CAC3B,8BAA8B;CAC9B,uBAAuB;CACvB,0BAA0B;CAC1B,kBAAkB;CAClB,kBAAkB;CAClB,iBAAiB;CACjB,0BAA0B;CAC1B,oBAAoB;CACpB,iBAzEuBF,OAAS;EAChC,OAAOE,OAAS,CAAC,CAAC,KAAK;EACvB,UAAUD,MAAO;GAAC;GAAS;GAAY;EAAS,CAAC;EACjD,WAAWC,OAAS,CAAC,CAAC,SAAS;EAC/B,SAAS;EACT,SAASO,MAAQT,OAAS;GAAE,UAAUE,OAAS,CAAC,CAAC,KAAK;GAAG,UAAUO,MAAQP,OAAS,CAAC,CAAC,KAAK,CAAC;EAAE,CAAC,CAAC;EAChG,QAAQO,MAAQ,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC;EAC3C,QAAQA,MAAQ,eAAe;EAC/B,gBAAgBP,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;EAC3C,iBAAiBA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CAChD,CA+DqB;CACjB,mBA7DyBF,OAAS,EAClC,OAAOE,OAAS,CAAC,CAAC,KAAK,EAC3B,CA2DuB;CACnB,aAzDoBF,OAAS;EAC7B,OAAOE,OAAS,CAAC,CAAC,KAAK;EACvB,SAASO,MAAQT,OAAS;GAAE,UAAUE,OAAS,CAAC,CAAC,KAAK;GAAG,UAAUO,MAAQP,OAAS,CAAC,CAAC,KAAK,CAAC;EAAE,CAAC,CAAC;EAChG,QAAQO,MAAQ,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC;EAC3C,QAAQA,MAAQ,eAAe;EAC/B,gBAAgBP,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;EAC3C,iBAAiBA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CAChD,CAkDiB;CACb,aA7CoBF,OAAS;EAC7B,OAAOE,OAAS,CAAC,CAAC,KAAK;EACvB,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC;EAC5B,SAASA,OAAS,CAAC,CAAC,KAAK;EACzB,UAAUA,OAAS,CAAC,CAAC,KAAK;CAC9B,CAwCiB;CACb,wBAlC6BF,OAAS;EACtC,OAAOE,OAAS,CAAC,CAAC,KAAK;EACvB,WAAWA,OAAS,CAAC,CAAC,IAAI,CAAC;EAC3B,SAASA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACxC,CA8B4B;CACxB,oBAAoB;CACpB,OAAO;AACX;AAEoC,OAAO,KAAK,gBAAgB;AAEpCI,mBAAqB,QAAQ;CACrD,YAAY,WAAW,iBAAiB,UAAU;CAClD,YAAY,cAAc,iBAAiB,aAAa;CACxD,YAAY,eAAe,iBAAiB,cAAc;CAC1D,YAAY,iBAAiB,iBAAiB,gBAAgB;CAC9D,YAAY,gBAAgB,iBAAiB,eAAe;CAC5D,YAAY,aAAa,iBAAiB,YAAY;CACtD,YAAY,gBAAgB,iBAAiB,eAAe;CAC5D,YAAY,2BAA2B,iBAAiB,0BAA0B;CAClF,YAAY,8BAA8B,iBAAiB,6BAA6B;CACxF,YAAY,uBAAuB,iBAAiB,sBAAsB;CAC1E,YAAY,0BAA0B,iBAAiB,yBAAyB;CAChF,YAAY,kBAAkB,iBAAiB,iBAAiB;CAChE,YAAY,kBAAkB,iBAAiB,iBAAiB;CAChE,YAAY,iBAAiB,iBAAiB,gBAAgB;CAC9D,YAAY,0BAA0B,iBAAiB,yBAAyB;CAChF,YAAY,oBAAoB,iBAAiB,mBAAmB;CACpE,YAAY,iBAAiB,iBAAiB,gBAAgB;CAC9D,YAAY,mBAAmB,iBAAiB,kBAAkB;CAClE,YAAY,aAAa,iBAAiB,YAAY;CACtD,YAAY,aAAa,iBAAiB,YAAY;CACtD,YAAY,wBAAwB,iBAAiB,uBAAuB;CAC5E,YAAY,oBAAoB,iBAAiB,mBAAmB;CACpE,YAAY,SAAS,iBAAiB,QAAQ;AAClD,CAAC;;;;;;;;;;;;;;;;;;;;;;;AC3bD,MAAa,2BAA2B;;;;;AAKxC,MAAa,uBAAuB;AAKpC,MAAa,UAAUI,OAAS;CAC5B,QAAQC,OAAS,CAAC,CAAC,IAAI,CAAC;CACxB,UAAUA,OAAS,CAAC,CAAC,KAAK;AAC9B,CAAC;AAOD,MAAa,YAAYD,OAAS,EAC9B,SAASC,OAAS,CAAC,CAAC,KAAK,EAC7B,CAAC;AAKD,MAAa,iBAAiBC,mBAAqB,MAAM;CACrDF,OAAS;EAAE,IAAIG,QAAU,MAAM;EAAG,MAAMF,OAAS;EAAG,MAAMA,OAAS,CAAC,CAAC,SAAS;CAAE,CAAC;CACjFD,OAAS;EAAE,IAAIG,QAAU,WAAW;EAAG,OAAOF,OAAS;CAAE,CAAC;CAC1DD,OAAS;EAAE,IAAIG,QAAU,YAAY;EAAG,QAAQF,OAAS;CAAE,CAAC;CAC5DD,OAAS;EAAE,IAAIG,QAAU,qBAAqB;EAAG,gBAAgBF,OAAS;CAAE,CAAC;CAC7ED,OAAS;EAAE,IAAIG,QAAU,UAAU;EAAG,UAAUC,QAAU;CAAE,CAAC;CAC7DJ,OAAS,EAAE,IAAIG,QAAU,QAAQ,EAAE,CAAC;CACpCH,OAAS,EAAE,IAAIG,QAAU,OAAO,EAAE,CAAC;AACvC,CAAC;AAID,MAAa,eAAeH,OAAS;CACjC,QAAQG,QAAU,SAAS;CAC3B,SAASF,OAAS,CAAC,CAAC,KAAK;CAGzB,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC5B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC;CACvB,QAAQA,OAAS,CAAC,CAAC,KAAK;CACxB,SAAS;AACb,CAAC;AAKD,MAAa,iBAAiBD,OAAS;CACnC,IAAIC,OAAS;CACb,MAAMA,OAAS;CACf,UAAUA,OAAS;CACnB,MAAMI,OAAS,CAAC,CAAC,SAAS;CAC1B,WAAWJ,OAAS;AACxB,CAAC;AAKD,MAAa,wBAAwBD,OAAS;CAC1C,OAAOC,OAAS;CAChB,SAASA,OAAS;CAClB,QAAQK,MAAO;EAAC;EAAQ;EAAQ;CAAO,CAAC;CACxC,UAAUA,MAAO;EAAC;EAAS;EAAY;EAAW;CAAS,CAAC;CAC5D,SAASL,OAAS;CAClB,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,QAAQD,OAAS;EAAE,IAAIC,OAAS;EAAG,OAAOG,QAAU;CAAE,CAAC;CACvD,MAAMH,OAAS;CACf,eAAeM,MAAQN,OAAS,CAAC;CACjC,aAAaM,MAAQ,cAAc,CAAC,CAAC,SAAS;CAC9C,MAAMH,QAAU;CAChB,SAASH,OAAS,CAAC,CAAC,SAAS;CAC7B,iBAAiBA,OAAS,CAAC,CAAC,SAAS;CACrC,oBAAoBA,OAAS,CAAC,CAAC,SAAS;CACxC,iBAAiBG,QAAU,CAAC,CAAC,SAAS;CACtC,SAASE,MAAO;EAAC;EAAW;EAAM;EAAW;EAAQ;CAAM,CAAC,CAAC,CAAC,SAAS;CACvE,UAAUF,QAAU,CAAC,CAAC,SAAS;AACnC,CAAC;AAOD,MAAa,UAAUJ,OAAS;CAC5B,QAAQG,QAAU,IAAI;CACtB,SAASF,OAAS,CAAC,CAAC,KAAK;CACzB,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC;CAC5B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC;CACvB,OAAOA,OAAS,CAAC,CAAC,KAAK;CACvB,eAAeA,OAAS,CAAC,CAAC,KAAK;CAC/B,QAAQA,OAAS,CAAC,CAAC,SAAS;CAC5B,SAAS;AACb,CAAC;AAID,MAAa,gBAAgBC,mBAAqB,QAAQ;CACtDF,OAAS;EAAE,MAAMG,QAAU,aAAa;EAAG,WAAWF,OAAS,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CACzED,OAAS;EAAE,MAAMG,QAAU,WAAW;EAAG,OAAOF,OAAS,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CACnED,OAAS;EAAE,MAAMG,QAAU,YAAY;EAAG,QAAQF,OAAS,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CACrED,OAAS;EAAE,MAAMG,QAAU,qBAAqB;EAAG,gBAAgBF,OAAS,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CACtFD,OAAS;EAAE,MAAMG,QAAU,UAAU;EAAG,UAAUC,QAAU;CAAE,CAAC;CAC/DJ,OAAS;EAAE,MAAMG,QAAU,YAAY;EAAG,YAAYG,MAAO;GAAC;GAAO;GAAU;EAAM,CAAC;CAAE,CAAC;CACzFN,OAAS,EAAE,MAAMG,QAAU,QAAQ,EAAE,CAAC;AAC1C,CAAC;AA0CD,MAAa,QAAQD,mBAAqB,UAAU;CAAC;CAAc;CAvCnCF,OAAS;EACrC,QAAQG,QAAU,cAAc;EAChC,SAASF,OAAS,CAAC,CAAC,KAAK;EACzB,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC;EAC5B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC;EACvB,OAAOA,OAAS,CAAC,CAAC,KAAK;EACvB,eAAeA,OAAS,CAAC,CAAC,KAAK;EAC/B,SAAS;CACb,CA+B4E;CAxBnDD,OAAS;EAC9B,QAAQG,QAAU,MAAM;EACxB,SAASF,OAAS,CAAC,CAAC,KAAK;EAIzB,YAAYA,OAAS,CAAC,CAAC,IAAI,CAAC;EAE5B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC;EACvB,QAAQA,OAAS,CAAC,CAAC,KAAK;EACxB,aAAaA,OAAS,CAAC,CAAC,IAAI,CAAC;EAC7B,SAASA,OAAS,CAAC,CAAC,SAAS;EAI7B,GAAG,2BAA2B;EAC9B,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;EAGlC,QAAQ,mBAAmB,SAAS;EACpC,SAAS,YAAY,SAAS;EAC9B,QAAQ,WAAW,SAAS;CAChC,CAE8F;AAAS,CAAC;AAIxG,MAAa,QAAQD,OAAS;CAC1B,OAAOC,OAAS;CAChB,UAAUG,QAAU;CACpB,QAAQH,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CACnC,QAAQA,OAAS,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;;;;;;;AAkBD,MAAa,aAAaD,OAAS;CAC/B,oBAAoBC,OAAS,CAAC,CAAC,KAAK;CACpC,WAAWA,OAAS,CAAC,CAAC,KAAK;CAC3B,MAAMA,OAAS;CACf,QAAQD,OAAS;EACb,UAAUM,MAAO;GAAC;GAAS;GAAY;GAAW;EAAS,CAAC;EAC5D,SAASL,OAAS,CAAC,CAAC,IAAI,CAAC;EACzB,QAAQA,OAAS,CAAC,CAAC,SAAS;CAChC,CAAC;CACD,eAAeA,OAAS,CAAC,CAAC,SAAS;CACnC,UAAUI,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACvC,YAAYJ,OAAS,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;;;;;;;;;AASD,MAAa,gBAAgBD,OAAS;CAClC,oBAAoBC,OAAS,CAAC,CAAC,KAAK;CAEpC,OAAOA,OAAS,CAAC,CAAC,IAAI,CAAC;CACvB,WAAWA,OAAS,CAAC,CAAC,KAAK;CAC3B,eAAeA,OAAS,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS;CAC1C,MAAMA,OAAS;CACf,QAAQD,OAAS;EACb,UAAUM,MAAO;GAAC;GAAS;GAAY;GAAW;EAAS,CAAC;EAC5D,SAASL,OAAS,CAAC,CAAC,IAAI,CAAC;EACzB,QAAQA,OAAS,CAAC,CAAC,SAAS;CAChC,CAAC;CACD,eAAeA,OAAS,CAAC,CAAC,SAAS;CACnC,UAAUI,OAAS,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY;CACvC,YAAYJ,OAAS,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;;;;AAID,MAAa,mBAAmBK,MAAO;CAAC;CAAQ;CAAW;CAAc;CAAe;CAAa;AAAW,CAAC;AACjH,MAAa,gBAAgBN,OAAS;CAClC,YAAYC,OAAS,CAAC,CAAC,IAAI,CAAC;CAC5B,WAAWG,QAAU;CACrB,QAAQ,iBAAiB,SAAS;AACtC,CAAC;AAKD,MAAa,cAAcF,mBAAqB,QAAQ,CACpDF,OAAS;CAAE,MAAMG,QAAU,QAAQ;CAAG,QAAQ;AAAc,CAAC,GAC7DH,OAAS;CAAE,MAAMG,QAAU,MAAM;CAAG,MAAM;AAAY,CAAC,CAC3D,CAAC;;AAWD,MAAa,uBAAuB;CAChC,YAAY;CACZ,eAAe;CACf,UAAU;CACV,UAAU;CACV,eAAe;CACf,mBAAmB;CACnB,mBAAmB;CACnB,WAfkBH,OAAS;EAC3B,QAAQC,OAAS,CAAC,CAAC,KAAK;EACxB,KAAKI,OAAS,CAAC,CAAC,IAAI;EACpB,OAAO;CACX,CAWe;CACX,OAAO;AACX;AAEwC,OAAO,KAAK,oBAAoB;AAExCH,mBAAqB,QAAQ;CACzD,YAAY,YAAY,qBAAqB,WAAW;CACxD,YAAY,eAAe,qBAAqB,cAAc;CAC9D,YAAY,UAAU,qBAAqB,SAAS;CACpD,YAAY,UAAU,qBAAqB,SAAS;CACpD,YAAY,eAAe,qBAAqB,cAAc;CAC9D,YAAY,mBAAmB,qBAAqB,kBAAkB;CACtE,YAAY,mBAAmB,qBAAqB,kBAAkB;CACtE,YAAY,WAAW,qBAAqB,UAAU;CACtD,YAAY,SAAS,qBAAqB,QAAQ;AACtD,CAAC;;AAMD,SAAgB,uBAAuB,MAAM;CACzC,OAAO,mBAAmB,sBAAsB,IAAI;AACxD;;AAEA,SAAgB,sBAAsB,MAAM,SAAS,OAAO,CAAC,GAAG;CAC5D,OAAO,iBAAiB,MAAM,SAAS,IAAI;AAC/C;;;;;;;;;;;;;ACxSA,MAAM,YAAY;;AAElB,MAAM,SAAS;;;;;;;;;;AAUf,SAAgB,gBAAgB,OAAO;CACnC,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,QAAQ,QAAQ,EAAE;CACzC,IAAI,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,GACxC,OAAO;CACX,MAAM,WAAW,EAAE,MAAM,GAAG;CAE5B,IAAI,SAAS,UAAU,KAAK,SAAS,EAAE,CAAC,SAAS,GAAG,GAChD,OAAO,WAAW;CAEtB,IAAI,SAAS,WAAW,KAAK,SAAS,OAAO,MAAM,EAAE,SAAS,CAAC,GAC3D,OAAO,sBAAsB;CACjC,OAAO;AACX;;;;;;AAMA,SAAgB,aAAa,SAAS;CAClC,MAAM,IAAI,QACL,KAAK,CAAC,CACN,QAAQ,QAAQ,EAAE,CAAC,CACnB,QAAQ,UAAU,EAAE;CACzB,MAAM,MAAM,OAAO,KAAK,CAAC;CACzB,IAAI,KACA,OAAO,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CACpC,MAAM,MAAM,uCAAuC,KAAK,CAAC;CACzD,IAAI,KACA,OAAO,IAAI;CACf,MAAM,WAAW,EAAE,MAAM,GAAG;CAC5B,IAAI,SAAS,UAAU,KAAK,SAAS,EAAE,CAAC,SAAS,GAAG,GAChD,OAAO,SAAS,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;CACrC,OAAO;AACX;;;;;;;ACnBA,SAAgB,QAAQ,MAAM;CAC1B,QAAQ,UAAU,MAAM,SAAS;AACrC"}