@athenaintel/react 0.23.3 → 0.24.0

package/dist/packages/agent-runtime/src/interrupts.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"interrupts.cjs","sources":["../../../../../agent-runtime/src/interrupts.ts"],"sourcesContent":["/**\n * Human-in-the-loop interrupt primitives shared by every statewire chat\n * surface (Olympus, the React SDK, the Office add-in, the Chrome extension,\n * mobile).\n *\n * The agora deep-agent runtime parks a gated run on an `interrupt` input\n * request whose payload carries the Athena `hitl_approval` shape\n * (`athena_deep_agent/hitl_bridge.py`). A surface answers it with\n * `{ type: 'run/input', requestId, response: { type: 'resume', value } }` —\n * the exact command the backend's resume path consumes. This module holds the\n * payload contract (narrowing, resume values) and the shared resume-lock state\n * machine; rendering stays with each surface.\n *\n * Deliberately parameterized rather than self-wiring: these helpers never call\n * `useStatewireRuns`/`useAuiState` themselves. Each surface reads its own\n * statewire hooks (which its tests already mock) and passes the values in, so\n * the shared semantics cannot drift while per-surface wiring stays testable.\n */\n\nimport type { StatewireThread } from '@assistant-ui/react-statewire';\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport { hasClientToolInterruptSource } from './client-tools';\nimport { readDeepAgentStreamValues } from './statewire-state';\n\n/** Human-in-the-loop approval payload the agora deep-agent runtime parks a run\n *  on (shaped by `athena_deep_agent/hitl_bridge.py`). */\nexport interface HitlApprovalPayload {\n  source: string;\n  type: string;\n  message: string;\n  /** Risk headline/facts/warnings, when the host includes them. */\n  approval_context?: unknown;\n  context?: {\n    tool_name?: string;\n    tool_id?: string;\n    tool_call_id?: string;\n    tool_args?: Record<string, unknown>;\n    pending_action_count?: number;\n    approval_context?: unknown;\n    /**\n     * Every pending gated call (name + args), in decision order. Absent on\n     * older backends — fall back to the single `tool_name`/`tool_args` pair.\n     * Per-dispatch payloads also carry each lane's `tool_call_id` (the lane\n     * card key) and `interrupt_id` (the lane resume key).\n     */\n    action_requests?: {\n      name?: string;\n      args?: Record<string, unknown>;\n      tool_call_id?: string;\n      interrupt_id?: string;\n      /**\n       * True when \"approve all for this session\" would take effect for this\n       * tool (the workspace allows overriding its approval). Absent on older\n       * backends and on non-overridable tools: the option is not offered.\n       */\n      session_approval_allowed?: boolean;\n    }[];\n    /**\n     * True when each dispatch parked on its own interrupt: decisions submit\n     * per lane via `lane_decisions` and each approved lane starts immediately,\n     * instead of the legacy batch where one resume must answer every lane.\n     */\n    per_dispatch?: boolean;\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** A pending `interrupt` input request; a present `response` key marks it answered. */\nexport function isPendingInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  return request.type === 'interrupt' && !('response' in request);\n}\n\n/**\n * Interrupt sources that were system pauses before the host stamped\n * `requires_user_action: false` on them (a background deep-research wait). Kept\n * only for the deploy skew between an older agora and a newer client; delete\n * once every deployment's raiser stamps the flag.\n */\nconst LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES: ReadonlySet<string> = new Set(['deep_research_pending']);\n\n/**\n * A park nobody answers: the agent is still working (a background research\n * wait) and the backend resumes it itself. The raiser stamps\n * `requires_user_action: false`; older raisers are recognised by source.\n */\nexport function isSystemPauseInterrupt(payload: unknown): boolean {\n  if (!isRecord(payload)) return false;\n  if (payload.requires_user_action === false) return true;\n  return (\n    typeof payload.source === 'string' && LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES.has(payload.source)\n  );\n}\n\n/**\n * A pending interrupt an approval card may answer. Two kinds are excluded —\n * client-tool parks (the client-tool bridge owns those, and a generic resume\n * would corrupt the parked tool call) and system pauses (nothing to answer; the\n * backend resumes them). The source checks are deliberately loose so a skewed\n * deploy can never route one here.\n */\nexport function isApprovalCardInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  if (!isPendingInterrupt(request)) return false;\n  const payload = (request as { payload?: unknown }).payload;\n  return !hasClientToolInterruptSource(payload) && !isSystemPauseInterrupt(payload);\n}\n\n/** Narrow an interrupt payload to the Athena HITL approval shape. */\nexport function asHitlApproval(value: unknown): HitlApprovalPayload | null {\n  if (!isRecord(value)) return null;\n  return value.type === 'hitl' &&\n    value.source === 'hitl_approval' &&\n    typeof value.message === 'string'\n    ? (value as unknown as HitlApprovalPayload)\n    : null;\n}\n\n/** Default paused-run copy when an interrupt payload carries no message. */\nexport const DEFAULT_INTERRUPT_PAUSED_MESSAGE =\n  'The agent is paused and waiting for input.';\n\n/** Best-effort human-readable message from any interrupt payload. */\nexport function readInterruptMessage(\n  value: unknown,\n  fallback: string = DEFAULT_INTERRUPT_PAUSED_MESSAGE,\n): string {\n  if (isRecord(value) && typeof value.message === 'string' && value.message.length > 0) {\n    return value.message;\n  }\n  return fallback;\n}\n\nexport interface PendingActionRequest {\n  name: string;\n  args: Record<string, unknown>;\n  /** The lane's `task` tool-call id (present on per-dispatch payloads). */\n  toolCallId?: string;\n  /** The lane's langgraph interrupt id — the `lane_decisions` resume key. */\n  interruptId?: string;\n  /** Present (true) when a session-wide approval would cover later calls of this tool. */\n  sessionApprovalAllowed?: true;\n}\n\n/**\n * Every gated call this approval covers, in decision order. One resume answers\n * ALL of them, so every entry must stay reviewable somewhere. Falls back to\n * the single first-call fields on older backends without `action_requests`.\n */\nexport function pendingActionRequests(hitl: HitlApprovalPayload | null): PendingActionRequest[] {\n  const context = hitl?.context;\n  if (!context) return [];\n  // The payload crosses the wire with only its top-level shape narrowed\n  // (`asHitlApproval`), so the nested collection must be validated before any\n  // array/property access: a malformed host value must degrade to \"no\n  // reviewable entries\", never crash the approval surface.\n  const requests: Record<string, unknown>[] = Array.isArray(context.action_requests)\n    ? context.action_requests.filter(isRecord)\n    : context.tool_name && context.tool_args\n      ? [{ name: context.tool_name, args: context.tool_args }]\n      : [];\n  return requests.map((request) => ({\n    name: typeof request.name === 'string' ? request.name : 'tool',\n    args: isRecord(request.args) ? request.args : {},\n    ...(typeof request.tool_call_id === 'string' && { toolCallId: request.tool_call_id }),\n    ...(typeof request.interrupt_id === 'string' && { interruptId: request.interrupt_id }),\n    ...(request.session_approval_allowed === true && { sessionApprovalAllowed: true }),\n  }));\n}\n\n/**\n * Whether the card may offer \"approve all for this session\": every pending\n * call must be one the backend stamped as session-approvable, so a batch that\n * mixes in a tool the workspace pinned as always-prompt only offers the\n * one-time answer.\n */\nexport function canApproveForSession(actionRequests: readonly PendingActionRequest[]): boolean {\n  return (\n    actionRequests.length > 0 &&\n    actionRequests.every((request) => request.sessionApprovalAllowed === true)\n  );\n}\n\n/** An interrupt a non-resume dispatch dropped, published by the host. */\nexport interface AbandonedInputRequest {\n  id: string;\n  type: string;\n}\n\n/**\n * `useStatewireState` selector body for the host-published abandoned input\n * requests. Reads through {@link readDeepAgentStreamValues} so the selector is\n * safe on the pre-attach (`undefined`) wire state, and returns the raw array\n * reference so the subscription stays shallow-stable — derive (`.find`) on the\n * result, never inside the selector.\n */\nexport function readAbandonedInputRequests(\n  state: unknown,\n): readonly AbandonedInputRequest[] | undefined {\n  const abandoned = readDeepAgentStreamValues(state).abandonedInputRequests;\n  // Wire value: anything non-array (including a malformed host publication)\n  // reads as \"none\" rather than crashing the consuming surface. Identity-\n  // preserving for the valid case, so it stays selector-safe.\n  return Array.isArray(abandoned)\n    ? (abandoned as readonly AbandonedInputRequest[])\n    : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the host's mirrored interrupt\n * (`__interrupt__`, the LangGraph `{value, resumable}` wrapper). The mirror\n * is published the moment a lane parks on its gate — while sibling lanes are\n * still streaming and the run manager has NOT yet published an answerable\n * input request. Raw reference, selector-safe; unwrap with\n * {@link interruptMirrorPayload}.\n */\nexport function readInterruptMirror(state: unknown): unknown {\n  return readDeepAgentStreamValues(state).__interrupt__;\n}\n\n/** The payload of a mirrored interrupt wrapper, or `undefined` for anything else. */\nexport function interruptMirrorPayload(mirror: unknown): unknown {\n  return isRecord(mirror) ? mirror.value : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the per-dispatch lane decisions the\n * host accepted through `run/lane-input` while the run was still streaming\n * (`queuedLaneDecisions`, keyed by langgraph interrupt id). Held until the\n * run parks, then answered as a native `lane_decisions` resume; every attached\n * client reads a queued lane as decided. Raw reference, selector-safe.\n */\nexport function readQueuedLaneDecisions(\n  state: unknown,\n): Readonly<Record<string, unknown>> | undefined {\n  const queued = readDeepAgentStreamValues(state).queuedLaneDecisions;\n  return isRecord(queued) ? queued : undefined;\n}\n\n/**\n * The distinct langgraph interrupt ids a `lane_decisions` resume answers for\n * these gated calls, in first-seen order — or `null` when any call lacks its\n * stamp (a legacy batch payload only a positional resume can answer). A\n * nested HITL request gating several calls contributes one id: the lane is\n * the interrupt, and one decision fans across its calls server-side.\n */\nexport function laneInterruptIds(actionRequests: readonly PendingActionRequest[]): string[] | null {\n  if (actionRequests.length === 0) return null;\n  const ids: string[] = [];\n  for (const request of actionRequests) {\n    if (request.interruptId === undefined) return null;\n    if (!ids.includes(request.interruptId)) ids.push(request.interruptId);\n  }\n  return ids;\n}\n\n/** One decision for every lane — the `lane_decisions` map a run-wide approve or reject sends. */\nexport function fanLaneDecision<T>({\n  interruptIds,\n  decision,\n}: {\n  interruptIds: readonly string[];\n  decision: T;\n}): Record<string, T> {\n  return Object.fromEntries(interruptIds.map((id) => [id, decision]));\n}\n\n/** The abandoned `interrupt` entry, if any — the \"approval was cancelled\" notice. */\nexport function findAbandonedInterrupt(\n  abandoned: readonly AbandonedInputRequest[] | undefined,\n): AbandonedInputRequest | undefined {\n  return abandoned?.find(\n    (request) => isRecord(request) && request.type === 'interrupt' && typeof request.id === 'string',\n  );\n}\n\n/** Canonical reason string carried by a user rejection. */\nexport const HITL_REJECT_REASON = 'User rejected the action.';\n\n/**\n * Default {@link UseApprovalResumeLockOptions.pendingResumeGraceMs} for every\n * approval surface: how long a clicked decision waits for its resume run to\n * start before the actions unlock again. Covers a `run/input` the host\n * rejected or a disconnected transport swallowed before any run began — the\n * one failure neither identity-change nor observed-run recovery can detect.\n */\nexport const HITL_PENDING_RESUME_GRACE_MS = 15_000;\n\n/** `run/input` resume value approving the gated call(s). */\nexport function hitlResumeApprove(): Record<string, string> {\n  return { action: 'approve' };\n}\n\n/**\n * `run/input` resume value approving the gated call(s) AND every later call of\n * the same tool(s) on this thread. The backend records the tools from its own\n * parked interrupt (never from this payload), so the value carries no names.\n */\nexport function hitlResumeApproveForSession(): Record<string, string> {\n  return { action: 'approve', scope: 'session' };\n}\n\n/** `run/input` resume value rejecting the gated call(s). */\nexport function hitlResumeReject(reason: string = HITL_REJECT_REASON): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\n/** Canonical reason string carried by a user declining a non-HITL park. */\nexport const INTERRUPT_DECLINE_REASON = 'User declined the request.';\n\n/**\n * `run/input` resume value declining a non-HITL park. `{ action: 'reject' }`\n * is the one value every typed raiser treats as a clean user decline\n * (`FormCancelledError` / `ToolRejectedError`); a generic `continue` would be\n * rejected by their resume schemas and surface as a tool error the agent then\n * improvises around.\n */\nexport function interruptResumeDecline(\n  reason: string = INTERRUPT_DECLINE_REASON,\n): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\nexport interface UseApprovalResumeLockOptions<TValue> {\n  /** The pending interrupt's request id (`undefined` when nothing is parked). */\n  requestId: string | undefined;\n  /** The surface's thread `isRunning` read (mockable per surface). */\n  isRunning: boolean;\n  /**\n   * Dispatch the `run/input` resume for `requestId` on the surface's transport.\n   * Return the dispatch promise so a refused or lost command releases the lock\n   * at once and reaches `onResumeRejected`; a `void` return leaves the\n   * recovery paths below as the only release.\n   */\n  sendResume: (requestId: string, value: TValue) => void | Promise<unknown>;\n  /**\n   * The dispatch `sendResume` returned rejected — the host refused the\n   * `run/input` or the transport lost it. The lock is already released when\n   * this fires; the surface tells the user, since the request is back on\n   * screen with nothing else saying why.\n   */\n  onResumeRejected?: (error: unknown, requestId: string) => void;\n  /**\n   * Re-enable the actions when no resume run started within this window —\n   * covers a `run/input` that was rejected or lost before any run began, so\n   * neither reset path below can fire. Omit to keep the pre-existing surface\n   * behavior of staying locked until a resume run is observed.\n   */\n  pendingResumeGraceMs?: number;\n}\n\nexport interface ApprovalResumeLock<TValue> {\n  /** True after a resume until the request identity changes (or recovery fires). */\n  pending: boolean;\n  /**\n   * Send the resume value, locking the actions. No-op (returns `undefined`)\n   * while pending or unparked. Returns the dispatch promise when `sendResume`\n   * produced one, so a surface can hold its own state until the host settles.\n   */\n  resume: (value: TValue) => Promise<unknown> | undefined;\n}\n\n/**\n * Optimistic action lock shared by every approval surface: disable the\n * decision buttons the moment one is clicked, until the request identity\n * changes (it clears after the resume, or a fresh interrupt arrives). This\n * closes the double-click → duplicate-resume window.\n *\n * Recovery paths, in order of specificity:\n * 0. The dispatch itself rejected (a `sendResume` that returned a promise) —\n *    released at once, and reported through `onResumeRejected`.\n * 1. Identity change — the resume landed (or a new interrupt replaced the\n *    request). Reset during render via React's \"previous value\" pattern.\n * 2. A resume run was observed starting and then settling with the request\n *    still pending (failed/cancelled resume) — clear the lock so the user can\n *    answer again.\n * 3. Optional grace window ({@link UseApprovalResumeLockOptions.pendingResumeGraceMs})\n *    for a `run/input` that never started a run at all.\n */\nexport function useApprovalResumeLock<TValue = Record<string, string>>(\n  options: UseApprovalResumeLockOptions<TValue>,\n): ApprovalResumeLock<TValue> {\n  const { requestId, isRunning, sendResume, pendingResumeGraceMs, onResumeRejected } = options;\n\n  const [pending, setPending] = useState(false);\n  const prevRequestIdRef = useRef(requestId);\n  if (prevRequestIdRef.current !== requestId) {\n    prevRequestIdRef.current = requestId;\n    if (pending) setPending(false);\n  }\n\n  // Track the resume run we kicked off (isRunning observed true→false while\n  // pending) and clear `pending` when it ends with the request unresolved.\n  const sawResumeRunRef = useRef(false);\n  useEffect(() => {\n    if (!pending) {\n      sawResumeRunRef.current = false;\n      return;\n    }\n    if (isRunning) {\n      sawResumeRunRef.current = true;\n      return;\n    }\n    if (sawResumeRunRef.current) {\n      sawResumeRunRef.current = false;\n      setPending(false);\n    }\n  }, [pending, isRunning]);\n\n  // Pre-start failure recovery: re-enable after the grace window when no\n  // resume run began; answering the still-parked request again is exactly\n  // what the user needs to be able to do.\n  useEffect(() => {\n    if (!pending || pendingResumeGraceMs === undefined) return;\n    const timer = setTimeout(() => {\n      if (!sawResumeRunRef.current) setPending(false);\n    }, pendingResumeGraceMs);\n    return () => clearTimeout(timer);\n  }, [pending, requestId, pendingResumeGraceMs]);\n\n  const sendResumeRef = useRef(sendResume);\n  sendResumeRef.current = sendResume;\n  const onResumeRejectedRef = useRef(onResumeRejected);\n  onResumeRejectedRef.current = onResumeRejected;\n  const currentRequestIdRef = useRef(requestId);\n  currentRequestIdRef.current = requestId;\n  const pendingRef = useRef(pending);\n  pendingRef.current = pending;\n\n  const resume = useCallback(\n    (value: TValue): Promise<unknown> | undefined => {\n      if (requestId === undefined || pendingRef.current) return undefined;\n      setPending(true);\n      pendingRef.current = true;\n      const dispatched: unknown = sendResumeRef.current(requestId, value);\n      if (!(dispatched instanceof Promise)) return undefined;\n      dispatched.then(undefined, (error: unknown) => {\n        // A late refusal for a request the lock has since moved past (the\n        // park was re-keyed, or a newer answer is in flight) must neither\n        // release that answer's lock nor be reported as a failure of it.\n        const current = currentRequestIdRef.current;\n        if (current !== undefined && current !== requestId) return;\n        setPending(false);\n        pendingRef.current = false;\n        onResumeRejectedRef.current?.(error, requestId);\n      });\n      return dispatched;\n    },\n    [requestId],\n  );\n\n  return { pending, resume };\n}\n"],"names":["hasClientToolInterruptSource","readDeepAgentStreamValues","useState","useRef","useEffect","useCallback"],"mappings":";;;;;AAkEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAGO,SAAS,mBACd,SAC+C;AAC/C,SAAO,QAAQ,SAAS,eAAe,EAAE,cAAc;AACzD;AAQA,MAAM,wCAA6D,oBAAI,IAAI,CAAC,uBAAuB,CAAC;AAO7F,SAAS,uBAAuB,SAA2B;AAChE,MAAI,CAAC,SAAS,OAAO,EAAG,QAAO;AAC/B,MAAI,QAAQ,yBAAyB,MAAO,QAAO;AACnD,SACE,OAAO,QAAQ,WAAW,YAAY,sCAAsC,IAAI,QAAQ,MAAM;AAElG;AASO,SAAS,wBACd,SAC+C;AAC/C,MAAI,CAAC,mBAAmB,OAAO,EAAG,QAAO;AACzC,QAAM,UAAW,QAAkC;AACnD,SAAO,CAACA,YAAAA,6BAA6B,OAAO,KAAK,CAAC,uBAAuB,OAAO;AAClF;AAGO,SAAS,eAAe,OAA4C;AACzE,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,SAAO,MAAM,SAAS,UACpB,MAAM,WAAW,mBACjB,OAAO,MAAM,YAAY,WACtB,QACD;AACN;AAGO,MAAM,mCACX;AAGK,SAAS,qBACd,OACA,WAAmB,kCACX;AACR,MAAI,SAAS,KAAK,KAAK,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,SAAS,GAAG;AACpF,WAAO,MAAM;AAAA,EACf;AACA,SAAO;AACT;AAkBO,SAAS,sBAAsB,MAA0D;AAC9F,QAAM,UAAU,6BAAM;AACtB,MAAI,CAAC,QAAS,QAAO,CAAA;AAKrB,QAAM,WAAsC,MAAM,QAAQ,QAAQ,eAAe,IAC7E,QAAQ,gBAAgB,OAAO,QAAQ,IACvC,QAAQ,aAAa,QAAQ,YAC3B,CAAC,EAAE,MAAM,QAAQ,WAAW,MAAM,QAAQ,UAAA,CAAW,IACrD,CAAA;AACN,SAAO,SAAS,IAAI,CAAC,aAAa;AAAA,IAChC,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,MAAM,SAAS,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAA;AAAA,IAC9C,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,YAAY,QAAQ,aAAA;AAAA,IACtE,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,aAAa,QAAQ,aAAA;AAAA,IACvE,GAAI,QAAQ,6BAA6B,QAAQ,EAAE,wBAAwB,KAAA;AAAA,EAAK,EAChF;AACJ;AAQO,SAAS,qBAAqB,gBAA0D;AAC7F,SACE,eAAe,SAAS,KACxB,eAAe,MAAM,CAAC,YAAY,QAAQ,2BAA2B,IAAI;AAE7E;AAeO,SAAS,2BACd,OAC8C;AAC9C,QAAM,YAAYC,eAAAA,0BAA0B,KAAK,EAAE;AAInD,SAAO,MAAM,QAAQ,SAAS,IACzB,YACD;AACN;AAUO,SAAS,oBAAoB,OAAyB;AAC3D,SAAOA,eAAAA,0BAA0B,KAAK,EAAE;AAC1C;AAGO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO,SAAS,MAAM,IAAI,OAAO,QAAQ;AAC3C;AASO,SAAS,wBACd,OAC+C;AAC/C,QAAM,SAASA,eAAAA,0BAA0B,KAAK,EAAE;AAChD,SAAO,SAAS,MAAM,IAAI,SAAS;AACrC;AASO,SAAS,iBAAiB,gBAAkE;AACjG,MAAI,eAAe,WAAW,EAAG,QAAO;AACxC,QAAM,MAAgB,CAAA;AACtB,aAAW,WAAW,gBAAgB;AACpC,QAAI,QAAQ,gBAAgB,OAAW,QAAO;AAC9C,QAAI,CAAC,IAAI,SAAS,QAAQ,WAAW,EAAG,KAAI,KAAK,QAAQ,WAAW;AAAA,EACtE;AACA,SAAO;AACT;AAGO,SAAS,gBAAmB;AAAA,EACjC;AAAA,EACA;AACF,GAGsB;AACpB,SAAO,OAAO,YAAY,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;AACpE;AAGO,SAAS,uBACd,WACmC;AACnC,SAAO,uCAAW;AAAA,IAChB,CAAC,YAAY,SAAS,OAAO,KAAK,QAAQ,SAAS,eAAe,OAAO,QAAQ,OAAO;AAAA;AAE5F;AAGO,MAAM,qBAAqB;AAS3B,MAAM,+BAA+B;AAGrC,SAAS,oBAA4C;AAC1D,SAAO,EAAE,QAAQ,UAAA;AACnB;AAOO,SAAS,8BAAsD;AACpE,SAAO,EAAE,QAAQ,WAAW,OAAO,UAAA;AACrC;AAGO,SAAS,iBAAiB,SAAiB,oBAA4C;AAC5F,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AAGO,MAAM,2BAA2B;AASjC,SAAS,uBACd,SAAiB,0BACO;AACxB,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AA0DO,SAAS,sBACd,SAC4B;AAC5B,QAAM,EAAE,WAAW,WAAW,YAAY,sBAAsB,qBAAqB;AAErF,QAAM,CAAC,SAAS,UAAU,IAAIC,MAAAA,SAAS,KAAK;AAC5C,QAAM,mBAAmBC,MAAAA,OAAO,SAAS;AACzC,MAAI,iBAAiB,YAAY,WAAW;AAC1C,qBAAiB,UAAU;AAC3B,QAAI,oBAAoB,KAAK;AAAA,EAC/B;AAIA,QAAM,kBAAkBA,MAAAA,OAAO,KAAK;AACpCC,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,SAAS;AACZ,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,WAAW;AACb,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,gBAAgB,SAAS;AAC3B,sBAAgB,UAAU;AAC1B,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,SAAS,SAAS,CAAC;AAKvBA,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,yBAAyB,OAAW;AACpD,UAAM,QAAQ,WAAW,MAAM;AAC7B,UAAI,CAAC,gBAAgB,QAAS,YAAW,KAAK;AAAA,IAChD,GAAG,oBAAoB;AACvB,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,SAAS,WAAW,oBAAoB,CAAC;AAE7C,QAAM,gBAAgBD,MAAAA,OAAO,UAAU;AACvC,gBAAc,UAAU;AACxB,QAAM,sBAAsBA,MAAAA,OAAO,gBAAgB;AACnD,sBAAoB,UAAU;AAC9B,QAAM,sBAAsBA,MAAAA,OAAO,SAAS;AAC5C,sBAAoB,UAAU;AAC9B,QAAM,aAAaA,MAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AAErB,QAAM,SAASE,MAAAA;AAAAA,IACb,CAAC,UAAgD;AAC/C,UAAI,cAAc,UAAa,WAAW,QAAS,QAAO;AAC1D,iBAAW,IAAI;AACf,iBAAW,UAAU;AACrB,YAAM,aAAsB,cAAc,QAAQ,WAAW,KAAK;AAClE,UAAI,EAAE,sBAAsB,SAAU,QAAO;AAC7C,iBAAW,KAAK,QAAW,CAAC,UAAmB;;AAI7C,cAAM,UAAU,oBAAoB;AACpC,YAAI,YAAY,UAAa,YAAY,UAAW;AACpD,mBAAW,KAAK;AAChB,mBAAW,UAAU;AACrB,kCAAoB,YAApB,6CAA8B,OAAO;AAAA,MACvC,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,CAAC,SAAS;AAAA,EAAA;AAGZ,SAAO,EAAE,SAAS,OAAA;AACpB;;;;;;;;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"interrupts.cjs","sources":["../../../../../agent-runtime/src/interrupts.ts"],"sourcesContent":["/**\n * Human-in-the-loop interrupt primitives shared by every statewire chat\n * surface (Olympus, the React SDK, the Office add-in, the Chrome extension,\n * mobile).\n *\n * The agora deep-agent runtime parks a gated run on an `interrupt` input\n * request whose payload carries the Athena `hitl_approval` shape\n * (`athena_deep_agent/hitl_bridge.py`). A surface answers it with\n * `{ type: 'run/input', requestId, response: { type: 'resume', value } }` —\n * the exact command the backend's resume path consumes. This module holds the\n * payload contract (narrowing, resume values) and the shared resume-lock state\n * machine; rendering stays with each surface.\n *\n * Deliberately parameterized rather than self-wiring: these helpers never call\n * `useStatewireRuns`/`useAuiState` themselves. Each surface reads its own\n * statewire hooks (which its tests already mock) and passes the values in, so\n * the shared semantics cannot drift while per-surface wiring stays testable.\n */\n\nimport type { StatewireThread } from '@assistant-ui/react-statewire';\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport { hasClientToolInterruptSource } from './client-tools';\nimport { statewireTransportOutcome } from './errors';\nimport { readDeepAgentStreamValues } from './statewire-state';\n\n/** Human-in-the-loop approval payload the agora deep-agent runtime parks a run\n *  on (shaped by `athena_deep_agent/hitl_bridge.py`). */\nexport interface HitlApprovalPayload {\n  source: string;\n  type: string;\n  message: string;\n  /** Risk headline/facts/warnings, when the host includes them. */\n  approval_context?: unknown;\n  context?: {\n    tool_name?: string;\n    tool_id?: string;\n    tool_call_id?: string;\n    tool_args?: Record<string, unknown>;\n    pending_action_count?: number;\n    approval_context?: unknown;\n    /**\n     * Every pending gated call (name + args), in decision order. Absent on\n     * older backends — fall back to the single `tool_name`/`tool_args` pair.\n     * Per-dispatch payloads also carry each lane's `tool_call_id` (the lane\n     * card key) and `interrupt_id` (the lane resume key).\n     */\n    action_requests?: {\n      name?: string;\n      args?: Record<string, unknown>;\n      tool_call_id?: string;\n      interrupt_id?: string;\n      /**\n       * True when \"approve all for this session\" would take effect for this\n       * tool (the workspace allows overriding its approval). Absent on older\n       * backends and on non-overridable tools: the option is not offered.\n       */\n      session_approval_allowed?: boolean;\n    }[];\n    /**\n     * True when each dispatch parked on its own interrupt: decisions submit\n     * per lane via `lane_decisions` and each approved lane starts immediately,\n     * instead of the legacy batch where one resume must answer every lane.\n     */\n    per_dispatch?: boolean;\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** A pending `interrupt` input request; a present `response` key marks it answered. */\nexport function isPendingInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  return request.type === 'interrupt' && !('response' in request);\n}\n\n/**\n * Interrupt sources that were system pauses before the host stamped\n * `requires_user_action: false` on them (a background deep-research wait). Kept\n * only for the deploy skew between an older agora and a newer client; delete\n * once every deployment's raiser stamps the flag.\n */\nconst LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES: ReadonlySet<string> = new Set(['deep_research_pending']);\n\n/**\n * A park nobody answers: the agent is still working (a background research\n * wait) and the backend resumes it itself. The raiser stamps\n * `requires_user_action: false`; older raisers are recognised by source.\n */\nexport function isSystemPauseInterrupt(payload: unknown): boolean {\n  if (!isRecord(payload)) return false;\n  if (payload.requires_user_action === false) return true;\n  return (\n    typeof payload.source === 'string' && LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES.has(payload.source)\n  );\n}\n\n/**\n * A pending interrupt an approval card may answer. Two kinds are excluded —\n * client-tool parks (the client-tool bridge owns those, and a generic resume\n * would corrupt the parked tool call) and system pauses (nothing to answer; the\n * backend resumes them). The source checks are deliberately loose so a skewed\n * deploy can never route one here.\n */\nexport function isApprovalCardInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  if (!isPendingInterrupt(request)) return false;\n  const payload = (request as { payload?: unknown }).payload;\n  return !hasClientToolInterruptSource(payload) && !isSystemPauseInterrupt(payload);\n}\n\n/** Narrow an interrupt payload to the Athena HITL approval shape. */\nexport function asHitlApproval(value: unknown): HitlApprovalPayload | null {\n  if (!isRecord(value)) return null;\n  return value.type === 'hitl' &&\n    value.source === 'hitl_approval' &&\n    typeof value.message === 'string'\n    ? (value as unknown as HitlApprovalPayload)\n    : null;\n}\n\n/** Default paused-run copy when an interrupt payload carries no message. */\nexport const DEFAULT_INTERRUPT_PAUSED_MESSAGE =\n  'The agent is paused and waiting for input.';\n\n/** Best-effort human-readable message from any interrupt payload. */\nexport function readInterruptMessage(\n  value: unknown,\n  fallback: string = DEFAULT_INTERRUPT_PAUSED_MESSAGE,\n): string {\n  if (isRecord(value) && typeof value.message === 'string' && value.message.length > 0) {\n    return value.message;\n  }\n  return fallback;\n}\n\nexport interface PendingActionRequest {\n  name: string;\n  args: Record<string, unknown>;\n  /** The lane's `task` tool-call id (present on per-dispatch payloads). */\n  toolCallId?: string;\n  /** The lane's langgraph interrupt id — the `lane_decisions` resume key. */\n  interruptId?: string;\n  /** Present (true) when a session-wide approval would cover later calls of this tool. */\n  sessionApprovalAllowed?: true;\n}\n\n/**\n * Every gated call this approval covers, in decision order. One resume answers\n * ALL of them, so every entry must stay reviewable somewhere. Falls back to\n * the single first-call fields on older backends without `action_requests`.\n */\nexport function pendingActionRequests(hitl: HitlApprovalPayload | null): PendingActionRequest[] {\n  const context = hitl?.context;\n  if (!context) return [];\n  // The payload crosses the wire with only its top-level shape narrowed\n  // (`asHitlApproval`), so the nested collection must be validated before any\n  // array/property access: a malformed host value must degrade to \"no\n  // reviewable entries\", never crash the approval surface.\n  const requests: Record<string, unknown>[] = Array.isArray(context.action_requests)\n    ? context.action_requests.filter(isRecord)\n    : context.tool_name && context.tool_args\n      ? [{ name: context.tool_name, args: context.tool_args }]\n      : [];\n  return requests.map((request) => ({\n    name: typeof request.name === 'string' ? request.name : 'tool',\n    args: isRecord(request.args) ? request.args : {},\n    ...(typeof request.tool_call_id === 'string' && { toolCallId: request.tool_call_id }),\n    ...(typeof request.interrupt_id === 'string' && { interruptId: request.interrupt_id }),\n    ...(request.session_approval_allowed === true && { sessionApprovalAllowed: true }),\n  }));\n}\n\n/**\n * Whether the card may offer \"approve all for this session\": every pending\n * call must be one the backend stamped as session-approvable, so a batch that\n * mixes in a tool the workspace pinned as always-prompt only offers the\n * one-time answer.\n */\nexport function canApproveForSession(actionRequests: readonly PendingActionRequest[]): boolean {\n  return (\n    actionRequests.length > 0 &&\n    actionRequests.every((request) => request.sessionApprovalAllowed === true)\n  );\n}\n\n/** An interrupt a non-resume dispatch dropped, published by the host. */\nexport interface AbandonedInputRequest {\n  id: string;\n  type: string;\n}\n\n/**\n * `useStatewireState` selector body for the host-published abandoned input\n * requests. Reads through {@link readDeepAgentStreamValues} so the selector is\n * safe on the pre-attach (`undefined`) wire state, and returns the raw array\n * reference so the subscription stays shallow-stable — derive (`.find`) on the\n * result, never inside the selector.\n */\nexport function readAbandonedInputRequests(\n  state: unknown,\n): readonly AbandonedInputRequest[] | undefined {\n  const abandoned = readDeepAgentStreamValues(state).abandonedInputRequests;\n  // Wire value: anything non-array (including a malformed host publication)\n  // reads as \"none\" rather than crashing the consuming surface. Identity-\n  // preserving for the valid case, so it stays selector-safe.\n  return Array.isArray(abandoned)\n    ? (abandoned as readonly AbandonedInputRequest[])\n    : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the host's mirrored interrupt\n * (`__interrupt__`, the LangGraph `{value, resumable}` wrapper). The mirror\n * is published the moment a lane parks on its gate — while sibling lanes are\n * still streaming and the run manager has NOT yet published an answerable\n * input request. Raw reference, selector-safe; unwrap with\n * {@link interruptMirrorPayload}.\n */\nexport function readInterruptMirror(state: unknown): unknown {\n  return readDeepAgentStreamValues(state).__interrupt__;\n}\n\n/** The payload of a mirrored interrupt wrapper, or `undefined` for anything else. */\nexport function interruptMirrorPayload(mirror: unknown): unknown {\n  return isRecord(mirror) ? mirror.value : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the per-dispatch lane decisions the\n * host accepted through `run/lane-input` while the run was still streaming\n * (`queuedLaneDecisions`, keyed by langgraph interrupt id). Held until the\n * run parks, then answered as a native `lane_decisions` resume; every attached\n * client reads a queued lane as decided. Raw reference, selector-safe.\n */\nexport function readQueuedLaneDecisions(\n  state: unknown,\n): Readonly<Record<string, unknown>> | undefined {\n  const queued = readDeepAgentStreamValues(state).queuedLaneDecisions;\n  return isRecord(queued) ? queued : undefined;\n}\n\n/**\n * The distinct langgraph interrupt ids a `lane_decisions` resume answers for\n * these gated calls, in first-seen order — or `null` when any call lacks its\n * stamp (a legacy batch payload only a positional resume can answer). A\n * nested HITL request gating several calls contributes one id: the lane is\n * the interrupt, and one decision fans across its calls server-side.\n */\nexport function laneInterruptIds(actionRequests: readonly PendingActionRequest[]): string[] | null {\n  if (actionRequests.length === 0) return null;\n  const ids: string[] = [];\n  for (const request of actionRequests) {\n    if (request.interruptId === undefined) return null;\n    if (!ids.includes(request.interruptId)) ids.push(request.interruptId);\n  }\n  return ids;\n}\n\n/** One decision for every lane — the `lane_decisions` map a run-wide approve or reject sends. */\nexport function fanLaneDecision<T>({\n  interruptIds,\n  decision,\n}: {\n  interruptIds: readonly string[];\n  decision: T;\n}): Record<string, T> {\n  return Object.fromEntries(interruptIds.map((id) => [id, decision]));\n}\n\n/** The abandoned `interrupt` entry, if any — the \"approval was cancelled\" notice. */\nexport function findAbandonedInterrupt(\n  abandoned: readonly AbandonedInputRequest[] | undefined,\n): AbandonedInputRequest | undefined {\n  return abandoned?.find(\n    (request) => isRecord(request) && request.type === 'interrupt' && typeof request.id === 'string',\n  );\n}\n\n/** Canonical reason string carried by a user rejection. */\nexport const HITL_REJECT_REASON = 'User rejected the action.';\n\n/**\n * Default {@link UseApprovalResumeLockOptions.pendingResumeGraceMs} for every\n * approval surface: how long a clicked decision waits for its resume run to\n * start before the actions unlock again. Covers a `run/input` the host\n * rejected or a disconnected transport swallowed before any run began — the\n * one failure neither identity-change nor observed-run recovery can detect.\n */\nexport const HITL_PENDING_RESUME_GRACE_MS = 15_000;\n\n/**\n * Default {@link UseApprovalResumeLockOptions.maxTransportRetries}: how many\n * times a decision the transport lost (the websocket dropped or the statewire\n * session reset while the `run/input` was in flight) is re-sent on its own\n * before the user is asked to click again.\n */\nexport const HITL_RESUME_TRANSPORT_RETRIES = 3;\n\n/**\n * The dispatch died client-side without the host ever seeing it — a proven\n * session loss or a gone stream. Safe to re-send the same decision for the\n * same still-parked request. The complement (a server verdict, or the surface\n * unmounting) is not.\n */\nexport function isResumeTransportLoss(error: unknown): boolean {\n  const outcome = statewireTransportOutcome(error);\n  return outcome === 'session-lost' || outcome === 'stream-gone';\n}\n\n/** `run/input` resume value approving the gated call(s). */\nexport function hitlResumeApprove(): Record<string, string> {\n  return { action: 'approve' };\n}\n\n/**\n * `run/input` resume value approving the gated call(s) AND every later call of\n * the same tool(s) on this thread. The backend records the tools from its own\n * parked interrupt (never from this payload), so the value carries no names.\n */\nexport function hitlResumeApproveForSession(): Record<string, string> {\n  return { action: 'approve', scope: 'session' };\n}\n\n/** `run/input` resume value rejecting the gated call(s). */\nexport function hitlResumeReject(reason: string = HITL_REJECT_REASON): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\n/** Canonical reason string carried by a user declining a non-HITL park. */\nexport const INTERRUPT_DECLINE_REASON = 'User declined the request.';\n\n/**\n * `run/input` resume value declining a non-HITL park. `{ action: 'reject' }`\n * is the one value every typed raiser treats as a clean user decline\n * (`FormCancelledError` / `ToolRejectedError`); a generic `continue` would be\n * rejected by their resume schemas and surface as a tool error the agent then\n * improvises around.\n */\nexport function interruptResumeDecline(\n  reason: string = INTERRUPT_DECLINE_REASON,\n): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\nexport interface UseApprovalResumeLockOptions<TValue> {\n  /** The pending interrupt's request id (`undefined` when nothing is parked). */\n  requestId: string | undefined;\n  /** The surface's thread `isRunning` read (mockable per surface). */\n  isRunning: boolean;\n  /**\n   * Dispatch the `run/input` resume for `requestId` on the surface's transport.\n   * Return the dispatch promise so a refused or lost command releases the lock\n   * at once and reaches `onResumeRejected`; a `void` return leaves the\n   * recovery paths below as the only release.\n   */\n  sendResume: (requestId: string, value: TValue) => void | Promise<unknown>;\n  /**\n   * The dispatch `sendResume` returned rejected — the host refused the\n   * `run/input` or the transport lost it. The lock is already released when\n   * this fires; the surface tells the user, since the request is back on\n   * screen with nothing else saying why.\n   */\n  onResumeRejected?: (error: unknown, requestId: string) => void;\n  /**\n   * A dispatch the transport lost is being re-sent for the still-parked\n   * request; `attempt` counts the retries so far (1-based). Diagnostics only —\n   * the lock stays held across the retry.\n   */\n  onResumeRetry?: (error: unknown, requestId: string, attempt: number) => void;\n  /**\n   * Automatic re-sends of a decision the transport lost\n   * ({@link isResumeTransportLoss}) while the request is still parked. `0`\n   * disables retries. Defaults to {@link HITL_RESUME_TRANSPORT_RETRIES}.\n   */\n  maxTransportRetries?: number;\n  /**\n   * Re-enable the actions when no resume run started within this window —\n   * covers a `run/input` that was rejected or lost before any run began, so\n   * neither reset path below can fire. Omit to keep the pre-existing surface\n   * behavior of staying locked until a resume run is observed.\n   */\n  pendingResumeGraceMs?: number;\n}\n\nexport interface ApprovalResumeLock<TValue> {\n  /** True after a resume until the request identity changes (or recovery fires). */\n  pending: boolean;\n  /**\n   * Send the resume value, locking the actions. No-op (returns `undefined`)\n   * while pending or unparked. Returns the dispatch promise when `sendResume`\n   * produced one, so a surface can hold its own state until the host settles.\n   */\n  resume: (value: TValue) => Promise<unknown> | undefined;\n}\n\n/**\n * Optimistic action lock shared by every approval surface: disable the\n * decision buttons the moment one is clicked, until the request identity\n * changes (it clears after the resume, or a fresh interrupt arrives). This\n * closes the double-click → duplicate-resume window.\n *\n * Recovery paths, in order of specificity:\n * 0. The dispatch itself rejected (a `sendResume` that returned a promise) —\n *    released at once, and reported through `onResumeRejected`. A rejection\n *    that is a transport loss (the socket dropped mid-flight) is re-sent up to\n *    `maxTransportRetries` times first, the lock held throughout, so a flaky\n *    connection does not hand the card back to the user for another click.\n *    The returned promise settles with the final attempt.\n * 1. Identity change — the resume landed (or a new interrupt replaced the\n *    request). Reset during render via React's \"previous value\" pattern.\n * 2. A resume run was observed starting and then settling with the request\n *    still pending (failed/cancelled resume) — clear the lock so the user can\n *    answer again.\n * 3. Optional grace window ({@link UseApprovalResumeLockOptions.pendingResumeGraceMs})\n *    for a `run/input` that never started a run at all.\n */\nexport function useApprovalResumeLock<TValue = Record<string, string>>(\n  options: UseApprovalResumeLockOptions<TValue>,\n): ApprovalResumeLock<TValue> {\n  const {\n    requestId,\n    isRunning,\n    sendResume,\n    pendingResumeGraceMs,\n    onResumeRejected,\n    onResumeRetry,\n    maxTransportRetries = HITL_RESUME_TRANSPORT_RETRIES,\n  } = options;\n\n  const [pending, setPending] = useState(false);\n  // Bumped per re-send so the grace window restarts with each attempt.\n  const [attempt, setAttempt] = useState(0);\n  const prevRequestIdRef = useRef(requestId);\n  if (prevRequestIdRef.current !== requestId) {\n    prevRequestIdRef.current = requestId;\n    if (pending) setPending(false);\n  }\n\n  // Track the resume run we kicked off (isRunning observed true→false while\n  // pending) and clear `pending` when it ends with the request unresolved.\n  const sawResumeRunRef = useRef(false);\n  useEffect(() => {\n    if (!pending) {\n      sawResumeRunRef.current = false;\n      return;\n    }\n    if (isRunning) {\n      sawResumeRunRef.current = true;\n      return;\n    }\n    if (sawResumeRunRef.current) {\n      sawResumeRunRef.current = false;\n      setPending(false);\n    }\n  }, [pending, isRunning]);\n\n  // Pre-start failure recovery: re-enable after the grace window when no\n  // resume run began; answering the still-parked request again is exactly\n  // what the user needs to be able to do.\n  useEffect(() => {\n    if (!pending || pendingResumeGraceMs === undefined) return;\n    const timer = setTimeout(() => {\n      if (!sawResumeRunRef.current) setPending(false);\n    }, pendingResumeGraceMs);\n    return () => clearTimeout(timer);\n  }, [pending, requestId, pendingResumeGraceMs, attempt]);\n\n  const sendResumeRef = useRef(sendResume);\n  sendResumeRef.current = sendResume;\n  const onResumeRejectedRef = useRef(onResumeRejected);\n  onResumeRejectedRef.current = onResumeRejected;\n  const onResumeRetryRef = useRef(onResumeRetry);\n  onResumeRetryRef.current = onResumeRetry;\n  const maxTransportRetriesRef = useRef(maxTransportRetries);\n  maxTransportRetriesRef.current = maxTransportRetries;\n  const currentRequestIdRef = useRef(requestId);\n  currentRequestIdRef.current = requestId;\n  const pendingRef = useRef(pending);\n  pendingRef.current = pending;\n  // One token per `resume` call: a settle from an earlier submission must not\n  // retry over, or release, a newer one for the same request.\n  const submissionRef = useRef(0);\n\n  const resume = useCallback(\n    (value: TValue): Promise<unknown> | undefined => {\n      if (requestId === undefined || pendingRef.current) return undefined;\n      const submission = ++submissionRef.current;\n      setPending(true);\n      pendingRef.current = true;\n      setAttempt(0);\n      const first: unknown = sendResumeRef.current(requestId, value);\n      if (!(first instanceof Promise)) return undefined;\n      // The final failure is already reported through `onResumeRejected`;\n      // callers that drop the promise must not get an unhandled rejection.\n      const outcome = new Promise<unknown>((resolve, reject) => {\n        const settle = (dispatched: Promise<unknown>, retries: number) => {\n          dispatched.then(resolve, (error: unknown) => {\n            // A late refusal for a request the lock has since moved past (the\n            // park was re-keyed, or a newer answer is in flight) must neither\n            // release that answer's lock nor be reported as a failure of it.\n            // The optimistic fold hides the answered request until the fold\n            // rolls back, so `undefined` here is not a departure.\n            const current = currentRequestIdRef.current;\n            if (\n              submission !== submissionRef.current ||\n              (current !== undefined && current !== requestId)\n            ) {\n              reject(error);\n              return;\n            }\n            if (retries < maxTransportRetriesRef.current && isResumeTransportLoss(error)) {\n              const next = retries + 1;\n              onResumeRetryRef.current?.(error, requestId, next);\n              setPending(true);\n              pendingRef.current = true;\n              setAttempt(next);\n              const resent: unknown = sendResumeRef.current(requestId, value);\n              if (resent instanceof Promise) {\n                settle(resent, next);\n                return;\n              }\n              resolve(undefined);\n              return;\n            }\n            setPending(false);\n            pendingRef.current = false;\n            onResumeRejectedRef.current?.(error, requestId);\n            reject(error);\n          });\n        };\n        settle(first, 0);\n      });\n      outcome.catch(() => {});\n      return outcome;\n    },\n    [requestId],\n  );\n\n  return { pending, resume };\n}\n"],"names":["hasClientToolInterruptSource","readDeepAgentStreamValues","statewireTransportOutcome","useState","useRef","useEffect","useCallback"],"mappings":";;;;;;AAmEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAGO,SAAS,mBACd,SAC+C;AAC/C,SAAO,QAAQ,SAAS,eAAe,EAAE,cAAc;AACzD;AAQA,MAAM,wCAA6D,oBAAI,IAAI,CAAC,uBAAuB,CAAC;AAO7F,SAAS,uBAAuB,SAA2B;AAChE,MAAI,CAAC,SAAS,OAAO,EAAG,QAAO;AAC/B,MAAI,QAAQ,yBAAyB,MAAO,QAAO;AACnD,SACE,OAAO,QAAQ,WAAW,YAAY,sCAAsC,IAAI,QAAQ,MAAM;AAElG;AASO,SAAS,wBACd,SAC+C;AAC/C,MAAI,CAAC,mBAAmB,OAAO,EAAG,QAAO;AACzC,QAAM,UAAW,QAAkC;AACnD,SAAO,CAACA,YAAAA,6BAA6B,OAAO,KAAK,CAAC,uBAAuB,OAAO;AAClF;AAGO,SAAS,eAAe,OAA4C;AACzE,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,SAAO,MAAM,SAAS,UACpB,MAAM,WAAW,mBACjB,OAAO,MAAM,YAAY,WACtB,QACD;AACN;AAGO,MAAM,mCACX;AAGK,SAAS,qBACd,OACA,WAAmB,kCACX;AACR,MAAI,SAAS,KAAK,KAAK,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,SAAS,GAAG;AACpF,WAAO,MAAM;AAAA,EACf;AACA,SAAO;AACT;AAkBO,SAAS,sBAAsB,MAA0D;AAC9F,QAAM,UAAU,6BAAM;AACtB,MAAI,CAAC,QAAS,QAAO,CAAA;AAKrB,QAAM,WAAsC,MAAM,QAAQ,QAAQ,eAAe,IAC7E,QAAQ,gBAAgB,OAAO,QAAQ,IACvC,QAAQ,aAAa,QAAQ,YAC3B,CAAC,EAAE,MAAM,QAAQ,WAAW,MAAM,QAAQ,UAAA,CAAW,IACrD,CAAA;AACN,SAAO,SAAS,IAAI,CAAC,aAAa;AAAA,IAChC,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,MAAM,SAAS,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAA;AAAA,IAC9C,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,YAAY,QAAQ,aAAA;AAAA,IACtE,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,aAAa,QAAQ,aAAA;AAAA,IACvE,GAAI,QAAQ,6BAA6B,QAAQ,EAAE,wBAAwB,KAAA;AAAA,EAAK,EAChF;AACJ;AAQO,SAAS,qBAAqB,gBAA0D;AAC7F,SACE,eAAe,SAAS,KACxB,eAAe,MAAM,CAAC,YAAY,QAAQ,2BAA2B,IAAI;AAE7E;AAeO,SAAS,2BACd,OAC8C;AAC9C,QAAM,YAAYC,eAAAA,0BAA0B,KAAK,EAAE;AAInD,SAAO,MAAM,QAAQ,SAAS,IACzB,YACD;AACN;AAUO,SAAS,oBAAoB,OAAyB;AAC3D,SAAOA,eAAAA,0BAA0B,KAAK,EAAE;AAC1C;AAGO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO,SAAS,MAAM,IAAI,OAAO,QAAQ;AAC3C;AASO,SAAS,wBACd,OAC+C;AAC/C,QAAM,SAASA,eAAAA,0BAA0B,KAAK,EAAE;AAChD,SAAO,SAAS,MAAM,IAAI,SAAS;AACrC;AASO,SAAS,iBAAiB,gBAAkE;AACjG,MAAI,eAAe,WAAW,EAAG,QAAO;AACxC,QAAM,MAAgB,CAAA;AACtB,aAAW,WAAW,gBAAgB;AACpC,QAAI,QAAQ,gBAAgB,OAAW,QAAO;AAC9C,QAAI,CAAC,IAAI,SAAS,QAAQ,WAAW,EAAG,KAAI,KAAK,QAAQ,WAAW;AAAA,EACtE;AACA,SAAO;AACT;AAGO,SAAS,gBAAmB;AAAA,EACjC;AAAA,EACA;AACF,GAGsB;AACpB,SAAO,OAAO,YAAY,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;AACpE;AAGO,SAAS,uBACd,WACmC;AACnC,SAAO,uCAAW;AAAA,IAChB,CAAC,YAAY,SAAS,OAAO,KAAK,QAAQ,SAAS,eAAe,OAAO,QAAQ,OAAO;AAAA;AAE5F;AAGO,MAAM,qBAAqB;AAS3B,MAAM,+BAA+B;AAQrC,MAAM,gCAAgC;AAQtC,SAAS,sBAAsB,OAAyB;AAC7D,QAAM,UAAUC,OAAAA,0BAA0B,KAAK;AAC/C,SAAO,YAAY,kBAAkB,YAAY;AACnD;AAGO,SAAS,oBAA4C;AAC1D,SAAO,EAAE,QAAQ,UAAA;AACnB;AAOO,SAAS,8BAAsD;AACpE,SAAO,EAAE,QAAQ,WAAW,OAAO,UAAA;AACrC;AAGO,SAAS,iBAAiB,SAAiB,oBAA4C;AAC5F,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AAGO,MAAM,2BAA2B;AASjC,SAAS,uBACd,SAAiB,0BACO;AACxB,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AA0EO,SAAS,sBACd,SAC4B;AAC5B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBAAsB;AAAA,EAAA,IACpB;AAEJ,QAAM,CAAC,SAAS,UAAU,IAAIC,MAAAA,SAAS,KAAK;AAE5C,QAAM,CAAC,SAAS,UAAU,IAAIA,MAAAA,SAAS,CAAC;AACxC,QAAM,mBAAmBC,MAAAA,OAAO,SAAS;AACzC,MAAI,iBAAiB,YAAY,WAAW;AAC1C,qBAAiB,UAAU;AAC3B,QAAI,oBAAoB,KAAK;AAAA,EAC/B;AAIA,QAAM,kBAAkBA,MAAAA,OAAO,KAAK;AACpCC,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,SAAS;AACZ,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,WAAW;AACb,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,gBAAgB,SAAS;AAC3B,sBAAgB,UAAU;AAC1B,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,SAAS,SAAS,CAAC;AAKvBA,QAAAA,UAAU,MAAM;AACd,QAAI,CAAC,WAAW,yBAAyB,OAAW;AACpD,UAAM,QAAQ,WAAW,MAAM;AAC7B,UAAI,CAAC,gBAAgB,QAAS,YAAW,KAAK;AAAA,IAChD,GAAG,oBAAoB;AACvB,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,SAAS,WAAW,sBAAsB,OAAO,CAAC;AAEtD,QAAM,gBAAgBD,MAAAA,OAAO,UAAU;AACvC,gBAAc,UAAU;AACxB,QAAM,sBAAsBA,MAAAA,OAAO,gBAAgB;AACnD,sBAAoB,UAAU;AAC9B,QAAM,mBAAmBA,MAAAA,OAAO,aAAa;AAC7C,mBAAiB,UAAU;AAC3B,QAAM,yBAAyBA,MAAAA,OAAO,mBAAmB;AACzD,yBAAuB,UAAU;AACjC,QAAM,sBAAsBA,MAAAA,OAAO,SAAS;AAC5C,sBAAoB,UAAU;AAC9B,QAAM,aAAaA,MAAAA,OAAO,OAAO;AACjC,aAAW,UAAU;AAGrB,QAAM,gBAAgBA,MAAAA,OAAO,CAAC;AAE9B,QAAM,SAASE,MAAAA;AAAAA,IACb,CAAC,UAAgD;AAC/C,UAAI,cAAc,UAAa,WAAW,QAAS,QAAO;AAC1D,YAAM,aAAa,EAAE,cAAc;AACnC,iBAAW,IAAI;AACf,iBAAW,UAAU;AACrB,iBAAW,CAAC;AACZ,YAAM,QAAiB,cAAc,QAAQ,WAAW,KAAK;AAC7D,UAAI,EAAE,iBAAiB,SAAU,QAAO;AAGxC,YAAM,UAAU,IAAI,QAAiB,CAAC,SAAS,WAAW;AACxD,cAAM,SAAS,CAAC,YAA8B,YAAoB;AAChE,qBAAW,KAAK,SAAS,CAAC,UAAmB;;AAM3C,kBAAM,UAAU,oBAAoB;AACpC,gBACE,eAAe,cAAc,WAC5B,YAAY,UAAa,YAAY,WACtC;AACA,qBAAO,KAAK;AACZ;AAAA,YACF;AACA,gBAAI,UAAU,uBAAuB,WAAW,sBAAsB,KAAK,GAAG;AAC5E,oBAAM,OAAO,UAAU;AACvB,qCAAiB,YAAjB,0CAA2B,OAAO,WAAW;AAC7C,yBAAW,IAAI;AACf,yBAAW,UAAU;AACrB,yBAAW,IAAI;AACf,oBAAM,SAAkB,cAAc,QAAQ,WAAW,KAAK;AAC9D,kBAAI,kBAAkB,SAAS;AAC7B,uBAAO,QAAQ,IAAI;AACnB;AAAA,cACF;AACA,sBAAQ,MAAS;AACjB;AAAA,YACF;AACA,uBAAW,KAAK;AAChB,uBAAW,UAAU;AACrB,sCAAoB,YAApB,6CAA8B,OAAO;AACrC,mBAAO,KAAK;AAAA,UACd,CAAC;AAAA,QACH;AACA,eAAO,OAAO,CAAC;AAAA,MACjB,CAAC;AACD,cAAQ,MAAM,MAAM;AAAA,MAAC,CAAC;AACtB,aAAO;AAAA,IACT;AAAA,IACA,CAAC,SAAS;AAAA,EAAA;AAGZ,SAAO,EAAE,SAAS,OAAA;AACpB;;;;;;;;;;;;;;;;;;;;;;;;;;"}

package/dist/packages/agent-runtime/src/interrupts.js

@@ -1,5 +1,6 @@
 import { useState, useRef, useEffect, useCallback } from "react";
 import { hasClientToolInterruptSource } from "./client-tools.js";
+import { statewireTransportOutcome } from "./errors.js";
 import { readDeepAgentStreamValues } from "./statewire-state.js";
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -80,6 +81,11 @@ function findAbandonedInterrupt(abandoned) {
 }
 const HITL_REJECT_REASON = "User rejected the action.";
 const HITL_PENDING_RESUME_GRACE_MS = 15e3;
+const HITL_RESUME_TRANSPORT_RETRIES = 3;
+function isResumeTransportLoss(error) {
+  const outcome = statewireTransportOutcome(error);
+  return outcome === "session-lost" || outcome === "stream-gone";
+}
 function hitlResumeApprove() {
   return { action: "approve" };
 }
@@ -94,8 +100,17 @@ function interruptResumeDecline(reason = INTERRUPT_DECLINE_REASON) {
   return { action: "reject", reason };
 }
 function useApprovalResumeLock(options) {
-  const { requestId, isRunning, sendResume, pendingResumeGraceMs, onResumeRejected } = options;
+  const {
+    requestId,
+    isRunning,
+    sendResume,
+    pendingResumeGraceMs,
+    onResumeRejected,
+    onResumeRetry,
+    maxTransportRetries = HITL_RESUME_TRANSPORT_RETRIES
+  } = options;
   const [pending, setPending] = useState(false);
+  const [attempt, setAttempt] = useState(0);
   const prevRequestIdRef = useRef(requestId);
   if (prevRequestIdRef.current !== requestId) {
     prevRequestIdRef.current = requestId;
@@ -122,31 +137,63 @@ function useApprovalResumeLock(options) {
       if (!sawResumeRunRef.current) setPending(false);
     }, pendingResumeGraceMs);
     return () => clearTimeout(timer);
-  }, [pending, requestId, pendingResumeGraceMs]);
+  }, [pending, requestId, pendingResumeGraceMs, attempt]);
   const sendResumeRef = useRef(sendResume);
   sendResumeRef.current = sendResume;
   const onResumeRejectedRef = useRef(onResumeRejected);
   onResumeRejectedRef.current = onResumeRejected;
+  const onResumeRetryRef = useRef(onResumeRetry);
+  onResumeRetryRef.current = onResumeRetry;
+  const maxTransportRetriesRef = useRef(maxTransportRetries);
+  maxTransportRetriesRef.current = maxTransportRetries;
   const currentRequestIdRef = useRef(requestId);
   currentRequestIdRef.current = requestId;
   const pendingRef = useRef(pending);
   pendingRef.current = pending;
+  const submissionRef = useRef(0);
   const resume = useCallback(
     (value) => {
       if (requestId === void 0 || pendingRef.current) return void 0;
+      const submission = ++submissionRef.current;
       setPending(true);
       pendingRef.current = true;
-      const dispatched = sendResumeRef.current(requestId, value);
-      if (!(dispatched instanceof Promise)) return void 0;
-      dispatched.then(void 0, (error) => {
-        var _a;
-        const current = currentRequestIdRef.current;
-        if (current !== void 0 && current !== requestId) return;
-        setPending(false);
-        pendingRef.current = false;
-        (_a = onResumeRejectedRef.current) == null ? void 0 : _a.call(onResumeRejectedRef, error, requestId);
+      setAttempt(0);
+      const first = sendResumeRef.current(requestId, value);
+      if (!(first instanceof Promise)) return void 0;
+      const outcome = new Promise((resolve, reject) => {
+        const settle = (dispatched, retries) => {
+          dispatched.then(resolve, (error) => {
+            var _a, _b;
+            const current = currentRequestIdRef.current;
+            if (submission !== submissionRef.current || current !== void 0 && current !== requestId) {
+              reject(error);
+              return;
+            }
+            if (retries < maxTransportRetriesRef.current && isResumeTransportLoss(error)) {
+              const next = retries + 1;
+              (_a = onResumeRetryRef.current) == null ? void 0 : _a.call(onResumeRetryRef, error, requestId, next);
+              setPending(true);
+              pendingRef.current = true;
+              setAttempt(next);
+              const resent = sendResumeRef.current(requestId, value);
+              if (resent instanceof Promise) {
+                settle(resent, next);
+                return;
+              }
+              resolve(void 0);
+              return;
+            }
+            setPending(false);
+            pendingRef.current = false;
+            (_b = onResumeRejectedRef.current) == null ? void 0 : _b.call(onResumeRejectedRef, error, requestId);
+            reject(error);
+          });
+        };
+        settle(first, 0);
+      });
+      outcome.catch(() => {
       });
-      return dispatched;
+      return outcome;
     },
     [requestId]
   );
@@ -156,6 +203,7 @@ export {
   DEFAULT_INTERRUPT_PAUSED_MESSAGE,
   HITL_PENDING_RESUME_GRACE_MS,
   HITL_REJECT_REASON,
+  HITL_RESUME_TRANSPORT_RETRIES,
   INTERRUPT_DECLINE_REASON,
   asHitlApproval,
   canApproveForSession,
@@ -168,6 +216,7 @@ export {
   interruptResumeDecline,
   isApprovalCardInterrupt,
   isPendingInterrupt,
+  isResumeTransportLoss,
   isSystemPauseInterrupt,
   laneInterruptIds,
   pendingActionRequests,

package/dist/packages/agent-runtime/src/interrupts.js.map

@@ -1 +1 @@
-{"version":3,"file":"interrupts.js","sources":["../../../../../agent-runtime/src/interrupts.ts"],"sourcesContent":["/**\n * Human-in-the-loop interrupt primitives shared by every statewire chat\n * surface (Olympus, the React SDK, the Office add-in, the Chrome extension,\n * mobile).\n *\n * The agora deep-agent runtime parks a gated run on an `interrupt` input\n * request whose payload carries the Athena `hitl_approval` shape\n * (`athena_deep_agent/hitl_bridge.py`). A surface answers it with\n * `{ type: 'run/input', requestId, response: { type: 'resume', value } }` —\n * the exact command the backend's resume path consumes. This module holds the\n * payload contract (narrowing, resume values) and the shared resume-lock state\n * machine; rendering stays with each surface.\n *\n * Deliberately parameterized rather than self-wiring: these helpers never call\n * `useStatewireRuns`/`useAuiState` themselves. Each surface reads its own\n * statewire hooks (which its tests already mock) and passes the values in, so\n * the shared semantics cannot drift while per-surface wiring stays testable.\n */\n\nimport type { StatewireThread } from '@assistant-ui/react-statewire';\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport { hasClientToolInterruptSource } from './client-tools';\nimport { readDeepAgentStreamValues } from './statewire-state';\n\n/** Human-in-the-loop approval payload the agora deep-agent runtime parks a run\n *  on (shaped by `athena_deep_agent/hitl_bridge.py`). */\nexport interface HitlApprovalPayload {\n  source: string;\n  type: string;\n  message: string;\n  /** Risk headline/facts/warnings, when the host includes them. */\n  approval_context?: unknown;\n  context?: {\n    tool_name?: string;\n    tool_id?: string;\n    tool_call_id?: string;\n    tool_args?: Record<string, unknown>;\n    pending_action_count?: number;\n    approval_context?: unknown;\n    /**\n     * Every pending gated call (name + args), in decision order. Absent on\n     * older backends — fall back to the single `tool_name`/`tool_args` pair.\n     * Per-dispatch payloads also carry each lane's `tool_call_id` (the lane\n     * card key) and `interrupt_id` (the lane resume key).\n     */\n    action_requests?: {\n      name?: string;\n      args?: Record<string, unknown>;\n      tool_call_id?: string;\n      interrupt_id?: string;\n      /**\n       * True when \"approve all for this session\" would take effect for this\n       * tool (the workspace allows overriding its approval). Absent on older\n       * backends and on non-overridable tools: the option is not offered.\n       */\n      session_approval_allowed?: boolean;\n    }[];\n    /**\n     * True when each dispatch parked on its own interrupt: decisions submit\n     * per lane via `lane_decisions` and each approved lane starts immediately,\n     * instead of the legacy batch where one resume must answer every lane.\n     */\n    per_dispatch?: boolean;\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** A pending `interrupt` input request; a present `response` key marks it answered. */\nexport function isPendingInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  return request.type === 'interrupt' && !('response' in request);\n}\n\n/**\n * Interrupt sources that were system pauses before the host stamped\n * `requires_user_action: false` on them (a background deep-research wait). Kept\n * only for the deploy skew between an older agora and a newer client; delete\n * once every deployment's raiser stamps the flag.\n */\nconst LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES: ReadonlySet<string> = new Set(['deep_research_pending']);\n\n/**\n * A park nobody answers: the agent is still working (a background research\n * wait) and the backend resumes it itself. The raiser stamps\n * `requires_user_action: false`; older raisers are recognised by source.\n */\nexport function isSystemPauseInterrupt(payload: unknown): boolean {\n  if (!isRecord(payload)) return false;\n  if (payload.requires_user_action === false) return true;\n  return (\n    typeof payload.source === 'string' && LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES.has(payload.source)\n  );\n}\n\n/**\n * A pending interrupt an approval card may answer. Two kinds are excluded —\n * client-tool parks (the client-tool bridge owns those, and a generic resume\n * would corrupt the parked tool call) and system pauses (nothing to answer; the\n * backend resumes them). The source checks are deliberately loose so a skewed\n * deploy can never route one here.\n */\nexport function isApprovalCardInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  if (!isPendingInterrupt(request)) return false;\n  const payload = (request as { payload?: unknown }).payload;\n  return !hasClientToolInterruptSource(payload) && !isSystemPauseInterrupt(payload);\n}\n\n/** Narrow an interrupt payload to the Athena HITL approval shape. */\nexport function asHitlApproval(value: unknown): HitlApprovalPayload | null {\n  if (!isRecord(value)) return null;\n  return value.type === 'hitl' &&\n    value.source === 'hitl_approval' &&\n    typeof value.message === 'string'\n    ? (value as unknown as HitlApprovalPayload)\n    : null;\n}\n\n/** Default paused-run copy when an interrupt payload carries no message. */\nexport const DEFAULT_INTERRUPT_PAUSED_MESSAGE =\n  'The agent is paused and waiting for input.';\n\n/** Best-effort human-readable message from any interrupt payload. */\nexport function readInterruptMessage(\n  value: unknown,\n  fallback: string = DEFAULT_INTERRUPT_PAUSED_MESSAGE,\n): string {\n  if (isRecord(value) && typeof value.message === 'string' && value.message.length > 0) {\n    return value.message;\n  }\n  return fallback;\n}\n\nexport interface PendingActionRequest {\n  name: string;\n  args: Record<string, unknown>;\n  /** The lane's `task` tool-call id (present on per-dispatch payloads). */\n  toolCallId?: string;\n  /** The lane's langgraph interrupt id — the `lane_decisions` resume key. */\n  interruptId?: string;\n  /** Present (true) when a session-wide approval would cover later calls of this tool. */\n  sessionApprovalAllowed?: true;\n}\n\n/**\n * Every gated call this approval covers, in decision order. One resume answers\n * ALL of them, so every entry must stay reviewable somewhere. Falls back to\n * the single first-call fields on older backends without `action_requests`.\n */\nexport function pendingActionRequests(hitl: HitlApprovalPayload | null): PendingActionRequest[] {\n  const context = hitl?.context;\n  if (!context) return [];\n  // The payload crosses the wire with only its top-level shape narrowed\n  // (`asHitlApproval`), so the nested collection must be validated before any\n  // array/property access: a malformed host value must degrade to \"no\n  // reviewable entries\", never crash the approval surface.\n  const requests: Record<string, unknown>[] = Array.isArray(context.action_requests)\n    ? context.action_requests.filter(isRecord)\n    : context.tool_name && context.tool_args\n      ? [{ name: context.tool_name, args: context.tool_args }]\n      : [];\n  return requests.map((request) => ({\n    name: typeof request.name === 'string' ? request.name : 'tool',\n    args: isRecord(request.args) ? request.args : {},\n    ...(typeof request.tool_call_id === 'string' && { toolCallId: request.tool_call_id }),\n    ...(typeof request.interrupt_id === 'string' && { interruptId: request.interrupt_id }),\n    ...(request.session_approval_allowed === true && { sessionApprovalAllowed: true }),\n  }));\n}\n\n/**\n * Whether the card may offer \"approve all for this session\": every pending\n * call must be one the backend stamped as session-approvable, so a batch that\n * mixes in a tool the workspace pinned as always-prompt only offers the\n * one-time answer.\n */\nexport function canApproveForSession(actionRequests: readonly PendingActionRequest[]): boolean {\n  return (\n    actionRequests.length > 0 &&\n    actionRequests.every((request) => request.sessionApprovalAllowed === true)\n  );\n}\n\n/** An interrupt a non-resume dispatch dropped, published by the host. */\nexport interface AbandonedInputRequest {\n  id: string;\n  type: string;\n}\n\n/**\n * `useStatewireState` selector body for the host-published abandoned input\n * requests. Reads through {@link readDeepAgentStreamValues} so the selector is\n * safe on the pre-attach (`undefined`) wire state, and returns the raw array\n * reference so the subscription stays shallow-stable — derive (`.find`) on the\n * result, never inside the selector.\n */\nexport function readAbandonedInputRequests(\n  state: unknown,\n): readonly AbandonedInputRequest[] | undefined {\n  const abandoned = readDeepAgentStreamValues(state).abandonedInputRequests;\n  // Wire value: anything non-array (including a malformed host publication)\n  // reads as \"none\" rather than crashing the consuming surface. Identity-\n  // preserving for the valid case, so it stays selector-safe.\n  return Array.isArray(abandoned)\n    ? (abandoned as readonly AbandonedInputRequest[])\n    : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the host's mirrored interrupt\n * (`__interrupt__`, the LangGraph `{value, resumable}` wrapper). The mirror\n * is published the moment a lane parks on its gate — while sibling lanes are\n * still streaming and the run manager has NOT yet published an answerable\n * input request. Raw reference, selector-safe; unwrap with\n * {@link interruptMirrorPayload}.\n */\nexport function readInterruptMirror(state: unknown): unknown {\n  return readDeepAgentStreamValues(state).__interrupt__;\n}\n\n/** The payload of a mirrored interrupt wrapper, or `undefined` for anything else. */\nexport function interruptMirrorPayload(mirror: unknown): unknown {\n  return isRecord(mirror) ? mirror.value : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the per-dispatch lane decisions the\n * host accepted through `run/lane-input` while the run was still streaming\n * (`queuedLaneDecisions`, keyed by langgraph interrupt id). Held until the\n * run parks, then answered as a native `lane_decisions` resume; every attached\n * client reads a queued lane as decided. Raw reference, selector-safe.\n */\nexport function readQueuedLaneDecisions(\n  state: unknown,\n): Readonly<Record<string, unknown>> | undefined {\n  const queued = readDeepAgentStreamValues(state).queuedLaneDecisions;\n  return isRecord(queued) ? queued : undefined;\n}\n\n/**\n * The distinct langgraph interrupt ids a `lane_decisions` resume answers for\n * these gated calls, in first-seen order — or `null` when any call lacks its\n * stamp (a legacy batch payload only a positional resume can answer). A\n * nested HITL request gating several calls contributes one id: the lane is\n * the interrupt, and one decision fans across its calls server-side.\n */\nexport function laneInterruptIds(actionRequests: readonly PendingActionRequest[]): string[] | null {\n  if (actionRequests.length === 0) return null;\n  const ids: string[] = [];\n  for (const request of actionRequests) {\n    if (request.interruptId === undefined) return null;\n    if (!ids.includes(request.interruptId)) ids.push(request.interruptId);\n  }\n  return ids;\n}\n\n/** One decision for every lane — the `lane_decisions` map a run-wide approve or reject sends. */\nexport function fanLaneDecision<T>({\n  interruptIds,\n  decision,\n}: {\n  interruptIds: readonly string[];\n  decision: T;\n}): Record<string, T> {\n  return Object.fromEntries(interruptIds.map((id) => [id, decision]));\n}\n\n/** The abandoned `interrupt` entry, if any — the \"approval was cancelled\" notice. */\nexport function findAbandonedInterrupt(\n  abandoned: readonly AbandonedInputRequest[] | undefined,\n): AbandonedInputRequest | undefined {\n  return abandoned?.find(\n    (request) => isRecord(request) && request.type === 'interrupt' && typeof request.id === 'string',\n  );\n}\n\n/** Canonical reason string carried by a user rejection. */\nexport const HITL_REJECT_REASON = 'User rejected the action.';\n\n/**\n * Default {@link UseApprovalResumeLockOptions.pendingResumeGraceMs} for every\n * approval surface: how long a clicked decision waits for its resume run to\n * start before the actions unlock again. Covers a `run/input` the host\n * rejected or a disconnected transport swallowed before any run began — the\n * one failure neither identity-change nor observed-run recovery can detect.\n */\nexport const HITL_PENDING_RESUME_GRACE_MS = 15_000;\n\n/** `run/input` resume value approving the gated call(s). */\nexport function hitlResumeApprove(): Record<string, string> {\n  return { action: 'approve' };\n}\n\n/**\n * `run/input` resume value approving the gated call(s) AND every later call of\n * the same tool(s) on this thread. The backend records the tools from its own\n * parked interrupt (never from this payload), so the value carries no names.\n */\nexport function hitlResumeApproveForSession(): Record<string, string> {\n  return { action: 'approve', scope: 'session' };\n}\n\n/** `run/input` resume value rejecting the gated call(s). */\nexport function hitlResumeReject(reason: string = HITL_REJECT_REASON): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\n/** Canonical reason string carried by a user declining a non-HITL park. */\nexport const INTERRUPT_DECLINE_REASON = 'User declined the request.';\n\n/**\n * `run/input` resume value declining a non-HITL park. `{ action: 'reject' }`\n * is the one value every typed raiser treats as a clean user decline\n * (`FormCancelledError` / `ToolRejectedError`); a generic `continue` would be\n * rejected by their resume schemas and surface as a tool error the agent then\n * improvises around.\n */\nexport function interruptResumeDecline(\n  reason: string = INTERRUPT_DECLINE_REASON,\n): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\nexport interface UseApprovalResumeLockOptions<TValue> {\n  /** The pending interrupt's request id (`undefined` when nothing is parked). */\n  requestId: string | undefined;\n  /** The surface's thread `isRunning` read (mockable per surface). */\n  isRunning: boolean;\n  /**\n   * Dispatch the `run/input` resume for `requestId` on the surface's transport.\n   * Return the dispatch promise so a refused or lost command releases the lock\n   * at once and reaches `onResumeRejected`; a `void` return leaves the\n   * recovery paths below as the only release.\n   */\n  sendResume: (requestId: string, value: TValue) => void | Promise<unknown>;\n  /**\n   * The dispatch `sendResume` returned rejected — the host refused the\n   * `run/input` or the transport lost it. The lock is already released when\n   * this fires; the surface tells the user, since the request is back on\n   * screen with nothing else saying why.\n   */\n  onResumeRejected?: (error: unknown, requestId: string) => void;\n  /**\n   * Re-enable the actions when no resume run started within this window —\n   * covers a `run/input` that was rejected or lost before any run began, so\n   * neither reset path below can fire. Omit to keep the pre-existing surface\n   * behavior of staying locked until a resume run is observed.\n   */\n  pendingResumeGraceMs?: number;\n}\n\nexport interface ApprovalResumeLock<TValue> {\n  /** True after a resume until the request identity changes (or recovery fires). */\n  pending: boolean;\n  /**\n   * Send the resume value, locking the actions. No-op (returns `undefined`)\n   * while pending or unparked. Returns the dispatch promise when `sendResume`\n   * produced one, so a surface can hold its own state until the host settles.\n   */\n  resume: (value: TValue) => Promise<unknown> | undefined;\n}\n\n/**\n * Optimistic action lock shared by every approval surface: disable the\n * decision buttons the moment one is clicked, until the request identity\n * changes (it clears after the resume, or a fresh interrupt arrives). This\n * closes the double-click → duplicate-resume window.\n *\n * Recovery paths, in order of specificity:\n * 0. The dispatch itself rejected (a `sendResume` that returned a promise) —\n *    released at once, and reported through `onResumeRejected`.\n * 1. Identity change — the resume landed (or a new interrupt replaced the\n *    request). Reset during render via React's \"previous value\" pattern.\n * 2. A resume run was observed starting and then settling with the request\n *    still pending (failed/cancelled resume) — clear the lock so the user can\n *    answer again.\n * 3. Optional grace window ({@link UseApprovalResumeLockOptions.pendingResumeGraceMs})\n *    for a `run/input` that never started a run at all.\n */\nexport function useApprovalResumeLock<TValue = Record<string, string>>(\n  options: UseApprovalResumeLockOptions<TValue>,\n): ApprovalResumeLock<TValue> {\n  const { requestId, isRunning, sendResume, pendingResumeGraceMs, onResumeRejected } = options;\n\n  const [pending, setPending] = useState(false);\n  const prevRequestIdRef = useRef(requestId);\n  if (prevRequestIdRef.current !== requestId) {\n    prevRequestIdRef.current = requestId;\n    if (pending) setPending(false);\n  }\n\n  // Track the resume run we kicked off (isRunning observed true→false while\n  // pending) and clear `pending` when it ends with the request unresolved.\n  const sawResumeRunRef = useRef(false);\n  useEffect(() => {\n    if (!pending) {\n      sawResumeRunRef.current = false;\n      return;\n    }\n    if (isRunning) {\n      sawResumeRunRef.current = true;\n      return;\n    }\n    if (sawResumeRunRef.current) {\n      sawResumeRunRef.current = false;\n      setPending(false);\n    }\n  }, [pending, isRunning]);\n\n  // Pre-start failure recovery: re-enable after the grace window when no\n  // resume run began; answering the still-parked request again is exactly\n  // what the user needs to be able to do.\n  useEffect(() => {\n    if (!pending || pendingResumeGraceMs === undefined) return;\n    const timer = setTimeout(() => {\n      if (!sawResumeRunRef.current) setPending(false);\n    }, pendingResumeGraceMs);\n    return () => clearTimeout(timer);\n  }, [pending, requestId, pendingResumeGraceMs]);\n\n  const sendResumeRef = useRef(sendResume);\n  sendResumeRef.current = sendResume;\n  const onResumeRejectedRef = useRef(onResumeRejected);\n  onResumeRejectedRef.current = onResumeRejected;\n  const currentRequestIdRef = useRef(requestId);\n  currentRequestIdRef.current = requestId;\n  const pendingRef = useRef(pending);\n  pendingRef.current = pending;\n\n  const resume = useCallback(\n    (value: TValue): Promise<unknown> | undefined => {\n      if (requestId === undefined || pendingRef.current) return undefined;\n      setPending(true);\n      pendingRef.current = true;\n      const dispatched: unknown = sendResumeRef.current(requestId, value);\n      if (!(dispatched instanceof Promise)) return undefined;\n      dispatched.then(undefined, (error: unknown) => {\n        // A late refusal for a request the lock has since moved past (the\n        // park was re-keyed, or a newer answer is in flight) must neither\n        // release that answer's lock nor be reported as a failure of it.\n        const current = currentRequestIdRef.current;\n        if (current !== undefined && current !== requestId) return;\n        setPending(false);\n        pendingRef.current = false;\n        onResumeRejectedRef.current?.(error, requestId);\n      });\n      return dispatched;\n    },\n    [requestId],\n  );\n\n  return { pending, resume };\n}\n"],"names":[],"mappings":";;;AAkEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAGO,SAAS,mBACd,SAC+C;AAC/C,SAAO,QAAQ,SAAS,eAAe,EAAE,cAAc;AACzD;AAQA,MAAM,wCAA6D,oBAAI,IAAI,CAAC,uBAAuB,CAAC;AAO7F,SAAS,uBAAuB,SAA2B;AAChE,MAAI,CAAC,SAAS,OAAO,EAAG,QAAO;AAC/B,MAAI,QAAQ,yBAAyB,MAAO,QAAO;AACnD,SACE,OAAO,QAAQ,WAAW,YAAY,sCAAsC,IAAI,QAAQ,MAAM;AAElG;AASO,SAAS,wBACd,SAC+C;AAC/C,MAAI,CAAC,mBAAmB,OAAO,EAAG,QAAO;AACzC,QAAM,UAAW,QAAkC;AACnD,SAAO,CAAC,6BAA6B,OAAO,KAAK,CAAC,uBAAuB,OAAO;AAClF;AAGO,SAAS,eAAe,OAA4C;AACzE,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,SAAO,MAAM,SAAS,UACpB,MAAM,WAAW,mBACjB,OAAO,MAAM,YAAY,WACtB,QACD;AACN;AAGO,MAAM,mCACX;AAGK,SAAS,qBACd,OACA,WAAmB,kCACX;AACR,MAAI,SAAS,KAAK,KAAK,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,SAAS,GAAG;AACpF,WAAO,MAAM;AAAA,EACf;AACA,SAAO;AACT;AAkBO,SAAS,sBAAsB,MAA0D;AAC9F,QAAM,UAAU,6BAAM;AACtB,MAAI,CAAC,QAAS,QAAO,CAAA;AAKrB,QAAM,WAAsC,MAAM,QAAQ,QAAQ,eAAe,IAC7E,QAAQ,gBAAgB,OAAO,QAAQ,IACvC,QAAQ,aAAa,QAAQ,YAC3B,CAAC,EAAE,MAAM,QAAQ,WAAW,MAAM,QAAQ,UAAA,CAAW,IACrD,CAAA;AACN,SAAO,SAAS,IAAI,CAAC,aAAa;AAAA,IAChC,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,MAAM,SAAS,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAA;AAAA,IAC9C,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,YAAY,QAAQ,aAAA;AAAA,IACtE,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,aAAa,QAAQ,aAAA;AAAA,IACvE,GAAI,QAAQ,6BAA6B,QAAQ,EAAE,wBAAwB,KAAA;AAAA,EAAK,EAChF;AACJ;AAQO,SAAS,qBAAqB,gBAA0D;AAC7F,SACE,eAAe,SAAS,KACxB,eAAe,MAAM,CAAC,YAAY,QAAQ,2BAA2B,IAAI;AAE7E;AAeO,SAAS,2BACd,OAC8C;AAC9C,QAAM,YAAY,0BAA0B,KAAK,EAAE;AAInD,SAAO,MAAM,QAAQ,SAAS,IACzB,YACD;AACN;AAUO,SAAS,oBAAoB,OAAyB;AAC3D,SAAO,0BAA0B,KAAK,EAAE;AAC1C;AAGO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO,SAAS,MAAM,IAAI,OAAO,QAAQ;AAC3C;AASO,SAAS,wBACd,OAC+C;AAC/C,QAAM,SAAS,0BAA0B,KAAK,EAAE;AAChD,SAAO,SAAS,MAAM,IAAI,SAAS;AACrC;AASO,SAAS,iBAAiB,gBAAkE;AACjG,MAAI,eAAe,WAAW,EAAG,QAAO;AACxC,QAAM,MAAgB,CAAA;AACtB,aAAW,WAAW,gBAAgB;AACpC,QAAI,QAAQ,gBAAgB,OAAW,QAAO;AAC9C,QAAI,CAAC,IAAI,SAAS,QAAQ,WAAW,EAAG,KAAI,KAAK,QAAQ,WAAW;AAAA,EACtE;AACA,SAAO;AACT;AAGO,SAAS,gBAAmB;AAAA,EACjC;AAAA,EACA;AACF,GAGsB;AACpB,SAAO,OAAO,YAAY,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;AACpE;AAGO,SAAS,uBACd,WACmC;AACnC,SAAO,uCAAW;AAAA,IAChB,CAAC,YAAY,SAAS,OAAO,KAAK,QAAQ,SAAS,eAAe,OAAO,QAAQ,OAAO;AAAA;AAE5F;AAGO,MAAM,qBAAqB;AAS3B,MAAM,+BAA+B;AAGrC,SAAS,oBAA4C;AAC1D,SAAO,EAAE,QAAQ,UAAA;AACnB;AAOO,SAAS,8BAAsD;AACpE,SAAO,EAAE,QAAQ,WAAW,OAAO,UAAA;AACrC;AAGO,SAAS,iBAAiB,SAAiB,oBAA4C;AAC5F,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AAGO,MAAM,2BAA2B;AASjC,SAAS,uBACd,SAAiB,0BACO;AACxB,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AA0DO,SAAS,sBACd,SAC4B;AAC5B,QAAM,EAAE,WAAW,WAAW,YAAY,sBAAsB,qBAAqB;AAErF,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAC5C,QAAM,mBAAmB,OAAO,SAAS;AACzC,MAAI,iBAAiB,YAAY,WAAW;AAC1C,qBAAiB,UAAU;AAC3B,QAAI,oBAAoB,KAAK;AAAA,EAC/B;AAIA,QAAM,kBAAkB,OAAO,KAAK;AACpC,YAAU,MAAM;AACd,QAAI,CAAC,SAAS;AACZ,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,WAAW;AACb,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,gBAAgB,SAAS;AAC3B,sBAAgB,UAAU;AAC1B,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,SAAS,SAAS,CAAC;AAKvB,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,yBAAyB,OAAW;AACpD,UAAM,QAAQ,WAAW,MAAM;AAC7B,UAAI,CAAC,gBAAgB,QAAS,YAAW,KAAK;AAAA,IAChD,GAAG,oBAAoB;AACvB,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,SAAS,WAAW,oBAAoB,CAAC;AAE7C,QAAM,gBAAgB,OAAO,UAAU;AACvC,gBAAc,UAAU;AACxB,QAAM,sBAAsB,OAAO,gBAAgB;AACnD,sBAAoB,UAAU;AAC9B,QAAM,sBAAsB,OAAO,SAAS;AAC5C,sBAAoB,UAAU;AAC9B,QAAM,aAAa,OAAO,OAAO;AACjC,aAAW,UAAU;AAErB,QAAM,SAAS;AAAA,IACb,CAAC,UAAgD;AAC/C,UAAI,cAAc,UAAa,WAAW,QAAS,QAAO;AAC1D,iBAAW,IAAI;AACf,iBAAW,UAAU;AACrB,YAAM,aAAsB,cAAc,QAAQ,WAAW,KAAK;AAClE,UAAI,EAAE,sBAAsB,SAAU,QAAO;AAC7C,iBAAW,KAAK,QAAW,CAAC,UAAmB;;AAI7C,cAAM,UAAU,oBAAoB;AACpC,YAAI,YAAY,UAAa,YAAY,UAAW;AACpD,mBAAW,KAAK;AAChB,mBAAW,UAAU;AACrB,kCAAoB,YAApB,6CAA8B,OAAO;AAAA,MACvC,CAAC;AACD,aAAO;AAAA,IACT;AAAA,IACA,CAAC,SAAS;AAAA,EAAA;AAGZ,SAAO,EAAE,SAAS,OAAA;AACpB;"}
+{"version":3,"file":"interrupts.js","sources":["../../../../../agent-runtime/src/interrupts.ts"],"sourcesContent":["/**\n * Human-in-the-loop interrupt primitives shared by every statewire chat\n * surface (Olympus, the React SDK, the Office add-in, the Chrome extension,\n * mobile).\n *\n * The agora deep-agent runtime parks a gated run on an `interrupt` input\n * request whose payload carries the Athena `hitl_approval` shape\n * (`athena_deep_agent/hitl_bridge.py`). A surface answers it with\n * `{ type: 'run/input', requestId, response: { type: 'resume', value } }` —\n * the exact command the backend's resume path consumes. This module holds the\n * payload contract (narrowing, resume values) and the shared resume-lock state\n * machine; rendering stays with each surface.\n *\n * Deliberately parameterized rather than self-wiring: these helpers never call\n * `useStatewireRuns`/`useAuiState` themselves. Each surface reads its own\n * statewire hooks (which its tests already mock) and passes the values in, so\n * the shared semantics cannot drift while per-surface wiring stays testable.\n */\n\nimport type { StatewireThread } from '@assistant-ui/react-statewire';\nimport { useCallback, useEffect, useRef, useState } from 'react';\nimport { hasClientToolInterruptSource } from './client-tools';\nimport { statewireTransportOutcome } from './errors';\nimport { readDeepAgentStreamValues } from './statewire-state';\n\n/** Human-in-the-loop approval payload the agora deep-agent runtime parks a run\n *  on (shaped by `athena_deep_agent/hitl_bridge.py`). */\nexport interface HitlApprovalPayload {\n  source: string;\n  type: string;\n  message: string;\n  /** Risk headline/facts/warnings, when the host includes them. */\n  approval_context?: unknown;\n  context?: {\n    tool_name?: string;\n    tool_id?: string;\n    tool_call_id?: string;\n    tool_args?: Record<string, unknown>;\n    pending_action_count?: number;\n    approval_context?: unknown;\n    /**\n     * Every pending gated call (name + args), in decision order. Absent on\n     * older backends — fall back to the single `tool_name`/`tool_args` pair.\n     * Per-dispatch payloads also carry each lane's `tool_call_id` (the lane\n     * card key) and `interrupt_id` (the lane resume key).\n     */\n    action_requests?: {\n      name?: string;\n      args?: Record<string, unknown>;\n      tool_call_id?: string;\n      interrupt_id?: string;\n      /**\n       * True when \"approve all for this session\" would take effect for this\n       * tool (the workspace allows overriding its approval). Absent on older\n       * backends and on non-overridable tools: the option is not offered.\n       */\n      session_approval_allowed?: boolean;\n    }[];\n    /**\n     * True when each dispatch parked on its own interrupt: decisions submit\n     * per lane via `lane_decisions` and each approved lane starts immediately,\n     * instead of the legacy batch where one resume must answer every lane.\n     */\n    per_dispatch?: boolean;\n  };\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** A pending `interrupt` input request; a present `response` key marks it answered. */\nexport function isPendingInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  return request.type === 'interrupt' && !('response' in request);\n}\n\n/**\n * Interrupt sources that were system pauses before the host stamped\n * `requires_user_action: false` on them (a background deep-research wait). Kept\n * only for the deploy skew between an older agora and a newer client; delete\n * once every deployment's raiser stamps the flag.\n */\nconst LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES: ReadonlySet<string> = new Set(['deep_research_pending']);\n\n/**\n * A park nobody answers: the agent is still working (a background research\n * wait) and the backend resumes it itself. The raiser stamps\n * `requires_user_action: false`; older raisers are recognised by source.\n */\nexport function isSystemPauseInterrupt(payload: unknown): boolean {\n  if (!isRecord(payload)) return false;\n  if (payload.requires_user_action === false) return true;\n  return (\n    typeof payload.source === 'string' && LEGACY_SYSTEM_PAUSE_INTERRUPT_SOURCES.has(payload.source)\n  );\n}\n\n/**\n * A pending interrupt an approval card may answer. Two kinds are excluded —\n * client-tool parks (the client-tool bridge owns those, and a generic resume\n * would corrupt the parked tool call) and system pauses (nothing to answer; the\n * backend resumes them). The source checks are deliberately loose so a skewed\n * deploy can never route one here.\n */\nexport function isApprovalCardInterrupt(\n  request: StatewireThread.InputRequestState,\n): request is StatewireThread.CustomInputRequest {\n  if (!isPendingInterrupt(request)) return false;\n  const payload = (request as { payload?: unknown }).payload;\n  return !hasClientToolInterruptSource(payload) && !isSystemPauseInterrupt(payload);\n}\n\n/** Narrow an interrupt payload to the Athena HITL approval shape. */\nexport function asHitlApproval(value: unknown): HitlApprovalPayload | null {\n  if (!isRecord(value)) return null;\n  return value.type === 'hitl' &&\n    value.source === 'hitl_approval' &&\n    typeof value.message === 'string'\n    ? (value as unknown as HitlApprovalPayload)\n    : null;\n}\n\n/** Default paused-run copy when an interrupt payload carries no message. */\nexport const DEFAULT_INTERRUPT_PAUSED_MESSAGE =\n  'The agent is paused and waiting for input.';\n\n/** Best-effort human-readable message from any interrupt payload. */\nexport function readInterruptMessage(\n  value: unknown,\n  fallback: string = DEFAULT_INTERRUPT_PAUSED_MESSAGE,\n): string {\n  if (isRecord(value) && typeof value.message === 'string' && value.message.length > 0) {\n    return value.message;\n  }\n  return fallback;\n}\n\nexport interface PendingActionRequest {\n  name: string;\n  args: Record<string, unknown>;\n  /** The lane's `task` tool-call id (present on per-dispatch payloads). */\n  toolCallId?: string;\n  /** The lane's langgraph interrupt id — the `lane_decisions` resume key. */\n  interruptId?: string;\n  /** Present (true) when a session-wide approval would cover later calls of this tool. */\n  sessionApprovalAllowed?: true;\n}\n\n/**\n * Every gated call this approval covers, in decision order. One resume answers\n * ALL of them, so every entry must stay reviewable somewhere. Falls back to\n * the single first-call fields on older backends without `action_requests`.\n */\nexport function pendingActionRequests(hitl: HitlApprovalPayload | null): PendingActionRequest[] {\n  const context = hitl?.context;\n  if (!context) return [];\n  // The payload crosses the wire with only its top-level shape narrowed\n  // (`asHitlApproval`), so the nested collection must be validated before any\n  // array/property access: a malformed host value must degrade to \"no\n  // reviewable entries\", never crash the approval surface.\n  const requests: Record<string, unknown>[] = Array.isArray(context.action_requests)\n    ? context.action_requests.filter(isRecord)\n    : context.tool_name && context.tool_args\n      ? [{ name: context.tool_name, args: context.tool_args }]\n      : [];\n  return requests.map((request) => ({\n    name: typeof request.name === 'string' ? request.name : 'tool',\n    args: isRecord(request.args) ? request.args : {},\n    ...(typeof request.tool_call_id === 'string' && { toolCallId: request.tool_call_id }),\n    ...(typeof request.interrupt_id === 'string' && { interruptId: request.interrupt_id }),\n    ...(request.session_approval_allowed === true && { sessionApprovalAllowed: true }),\n  }));\n}\n\n/**\n * Whether the card may offer \"approve all for this session\": every pending\n * call must be one the backend stamped as session-approvable, so a batch that\n * mixes in a tool the workspace pinned as always-prompt only offers the\n * one-time answer.\n */\nexport function canApproveForSession(actionRequests: readonly PendingActionRequest[]): boolean {\n  return (\n    actionRequests.length > 0 &&\n    actionRequests.every((request) => request.sessionApprovalAllowed === true)\n  );\n}\n\n/** An interrupt a non-resume dispatch dropped, published by the host. */\nexport interface AbandonedInputRequest {\n  id: string;\n  type: string;\n}\n\n/**\n * `useStatewireState` selector body for the host-published abandoned input\n * requests. Reads through {@link readDeepAgentStreamValues} so the selector is\n * safe on the pre-attach (`undefined`) wire state, and returns the raw array\n * reference so the subscription stays shallow-stable — derive (`.find`) on the\n * result, never inside the selector.\n */\nexport function readAbandonedInputRequests(\n  state: unknown,\n): readonly AbandonedInputRequest[] | undefined {\n  const abandoned = readDeepAgentStreamValues(state).abandonedInputRequests;\n  // Wire value: anything non-array (including a malformed host publication)\n  // reads as \"none\" rather than crashing the consuming surface. Identity-\n  // preserving for the valid case, so it stays selector-safe.\n  return Array.isArray(abandoned)\n    ? (abandoned as readonly AbandonedInputRequest[])\n    : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the host's mirrored interrupt\n * (`__interrupt__`, the LangGraph `{value, resumable}` wrapper). The mirror\n * is published the moment a lane parks on its gate — while sibling lanes are\n * still streaming and the run manager has NOT yet published an answerable\n * input request. Raw reference, selector-safe; unwrap with\n * {@link interruptMirrorPayload}.\n */\nexport function readInterruptMirror(state: unknown): unknown {\n  return readDeepAgentStreamValues(state).__interrupt__;\n}\n\n/** The payload of a mirrored interrupt wrapper, or `undefined` for anything else. */\nexport function interruptMirrorPayload(mirror: unknown): unknown {\n  return isRecord(mirror) ? mirror.value : undefined;\n}\n\n/**\n * `useStatewireState` selector body for the per-dispatch lane decisions the\n * host accepted through `run/lane-input` while the run was still streaming\n * (`queuedLaneDecisions`, keyed by langgraph interrupt id). Held until the\n * run parks, then answered as a native `lane_decisions` resume; every attached\n * client reads a queued lane as decided. Raw reference, selector-safe.\n */\nexport function readQueuedLaneDecisions(\n  state: unknown,\n): Readonly<Record<string, unknown>> | undefined {\n  const queued = readDeepAgentStreamValues(state).queuedLaneDecisions;\n  return isRecord(queued) ? queued : undefined;\n}\n\n/**\n * The distinct langgraph interrupt ids a `lane_decisions` resume answers for\n * these gated calls, in first-seen order — or `null` when any call lacks its\n * stamp (a legacy batch payload only a positional resume can answer). A\n * nested HITL request gating several calls contributes one id: the lane is\n * the interrupt, and one decision fans across its calls server-side.\n */\nexport function laneInterruptIds(actionRequests: readonly PendingActionRequest[]): string[] | null {\n  if (actionRequests.length === 0) return null;\n  const ids: string[] = [];\n  for (const request of actionRequests) {\n    if (request.interruptId === undefined) return null;\n    if (!ids.includes(request.interruptId)) ids.push(request.interruptId);\n  }\n  return ids;\n}\n\n/** One decision for every lane — the `lane_decisions` map a run-wide approve or reject sends. */\nexport function fanLaneDecision<T>({\n  interruptIds,\n  decision,\n}: {\n  interruptIds: readonly string[];\n  decision: T;\n}): Record<string, T> {\n  return Object.fromEntries(interruptIds.map((id) => [id, decision]));\n}\n\n/** The abandoned `interrupt` entry, if any — the \"approval was cancelled\" notice. */\nexport function findAbandonedInterrupt(\n  abandoned: readonly AbandonedInputRequest[] | undefined,\n): AbandonedInputRequest | undefined {\n  return abandoned?.find(\n    (request) => isRecord(request) && request.type === 'interrupt' && typeof request.id === 'string',\n  );\n}\n\n/** Canonical reason string carried by a user rejection. */\nexport const HITL_REJECT_REASON = 'User rejected the action.';\n\n/**\n * Default {@link UseApprovalResumeLockOptions.pendingResumeGraceMs} for every\n * approval surface: how long a clicked decision waits for its resume run to\n * start before the actions unlock again. Covers a `run/input` the host\n * rejected or a disconnected transport swallowed before any run began — the\n * one failure neither identity-change nor observed-run recovery can detect.\n */\nexport const HITL_PENDING_RESUME_GRACE_MS = 15_000;\n\n/**\n * Default {@link UseApprovalResumeLockOptions.maxTransportRetries}: how many\n * times a decision the transport lost (the websocket dropped or the statewire\n * session reset while the `run/input` was in flight) is re-sent on its own\n * before the user is asked to click again.\n */\nexport const HITL_RESUME_TRANSPORT_RETRIES = 3;\n\n/**\n * The dispatch died client-side without the host ever seeing it — a proven\n * session loss or a gone stream. Safe to re-send the same decision for the\n * same still-parked request. The complement (a server verdict, or the surface\n * unmounting) is not.\n */\nexport function isResumeTransportLoss(error: unknown): boolean {\n  const outcome = statewireTransportOutcome(error);\n  return outcome === 'session-lost' || outcome === 'stream-gone';\n}\n\n/** `run/input` resume value approving the gated call(s). */\nexport function hitlResumeApprove(): Record<string, string> {\n  return { action: 'approve' };\n}\n\n/**\n * `run/input` resume value approving the gated call(s) AND every later call of\n * the same tool(s) on this thread. The backend records the tools from its own\n * parked interrupt (never from this payload), so the value carries no names.\n */\nexport function hitlResumeApproveForSession(): Record<string, string> {\n  return { action: 'approve', scope: 'session' };\n}\n\n/** `run/input` resume value rejecting the gated call(s). */\nexport function hitlResumeReject(reason: string = HITL_REJECT_REASON): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\n/** Canonical reason string carried by a user declining a non-HITL park. */\nexport const INTERRUPT_DECLINE_REASON = 'User declined the request.';\n\n/**\n * `run/input` resume value declining a non-HITL park. `{ action: 'reject' }`\n * is the one value every typed raiser treats as a clean user decline\n * (`FormCancelledError` / `ToolRejectedError`); a generic `continue` would be\n * rejected by their resume schemas and surface as a tool error the agent then\n * improvises around.\n */\nexport function interruptResumeDecline(\n  reason: string = INTERRUPT_DECLINE_REASON,\n): Record<string, string> {\n  return { action: 'reject', reason };\n}\n\nexport interface UseApprovalResumeLockOptions<TValue> {\n  /** The pending interrupt's request id (`undefined` when nothing is parked). */\n  requestId: string | undefined;\n  /** The surface's thread `isRunning` read (mockable per surface). */\n  isRunning: boolean;\n  /**\n   * Dispatch the `run/input` resume for `requestId` on the surface's transport.\n   * Return the dispatch promise so a refused or lost command releases the lock\n   * at once and reaches `onResumeRejected`; a `void` return leaves the\n   * recovery paths below as the only release.\n   */\n  sendResume: (requestId: string, value: TValue) => void | Promise<unknown>;\n  /**\n   * The dispatch `sendResume` returned rejected — the host refused the\n   * `run/input` or the transport lost it. The lock is already released when\n   * this fires; the surface tells the user, since the request is back on\n   * screen with nothing else saying why.\n   */\n  onResumeRejected?: (error: unknown, requestId: string) => void;\n  /**\n   * A dispatch the transport lost is being re-sent for the still-parked\n   * request; `attempt` counts the retries so far (1-based). Diagnostics only —\n   * the lock stays held across the retry.\n   */\n  onResumeRetry?: (error: unknown, requestId: string, attempt: number) => void;\n  /**\n   * Automatic re-sends of a decision the transport lost\n   * ({@link isResumeTransportLoss}) while the request is still parked. `0`\n   * disables retries. Defaults to {@link HITL_RESUME_TRANSPORT_RETRIES}.\n   */\n  maxTransportRetries?: number;\n  /**\n   * Re-enable the actions when no resume run started within this window —\n   * covers a `run/input` that was rejected or lost before any run began, so\n   * neither reset path below can fire. Omit to keep the pre-existing surface\n   * behavior of staying locked until a resume run is observed.\n   */\n  pendingResumeGraceMs?: number;\n}\n\nexport interface ApprovalResumeLock<TValue> {\n  /** True after a resume until the request identity changes (or recovery fires). */\n  pending: boolean;\n  /**\n   * Send the resume value, locking the actions. No-op (returns `undefined`)\n   * while pending or unparked. Returns the dispatch promise when `sendResume`\n   * produced one, so a surface can hold its own state until the host settles.\n   */\n  resume: (value: TValue) => Promise<unknown> | undefined;\n}\n\n/**\n * Optimistic action lock shared by every approval surface: disable the\n * decision buttons the moment one is clicked, until the request identity\n * changes (it clears after the resume, or a fresh interrupt arrives). This\n * closes the double-click → duplicate-resume window.\n *\n * Recovery paths, in order of specificity:\n * 0. The dispatch itself rejected (a `sendResume` that returned a promise) —\n *    released at once, and reported through `onResumeRejected`. A rejection\n *    that is a transport loss (the socket dropped mid-flight) is re-sent up to\n *    `maxTransportRetries` times first, the lock held throughout, so a flaky\n *    connection does not hand the card back to the user for another click.\n *    The returned promise settles with the final attempt.\n * 1. Identity change — the resume landed (or a new interrupt replaced the\n *    request). Reset during render via React's \"previous value\" pattern.\n * 2. A resume run was observed starting and then settling with the request\n *    still pending (failed/cancelled resume) — clear the lock so the user can\n *    answer again.\n * 3. Optional grace window ({@link UseApprovalResumeLockOptions.pendingResumeGraceMs})\n *    for a `run/input` that never started a run at all.\n */\nexport function useApprovalResumeLock<TValue = Record<string, string>>(\n  options: UseApprovalResumeLockOptions<TValue>,\n): ApprovalResumeLock<TValue> {\n  const {\n    requestId,\n    isRunning,\n    sendResume,\n    pendingResumeGraceMs,\n    onResumeRejected,\n    onResumeRetry,\n    maxTransportRetries = HITL_RESUME_TRANSPORT_RETRIES,\n  } = options;\n\n  const [pending, setPending] = useState(false);\n  // Bumped per re-send so the grace window restarts with each attempt.\n  const [attempt, setAttempt] = useState(0);\n  const prevRequestIdRef = useRef(requestId);\n  if (prevRequestIdRef.current !== requestId) {\n    prevRequestIdRef.current = requestId;\n    if (pending) setPending(false);\n  }\n\n  // Track the resume run we kicked off (isRunning observed true→false while\n  // pending) and clear `pending` when it ends with the request unresolved.\n  const sawResumeRunRef = useRef(false);\n  useEffect(() => {\n    if (!pending) {\n      sawResumeRunRef.current = false;\n      return;\n    }\n    if (isRunning) {\n      sawResumeRunRef.current = true;\n      return;\n    }\n    if (sawResumeRunRef.current) {\n      sawResumeRunRef.current = false;\n      setPending(false);\n    }\n  }, [pending, isRunning]);\n\n  // Pre-start failure recovery: re-enable after the grace window when no\n  // resume run began; answering the still-parked request again is exactly\n  // what the user needs to be able to do.\n  useEffect(() => {\n    if (!pending || pendingResumeGraceMs === undefined) return;\n    const timer = setTimeout(() => {\n      if (!sawResumeRunRef.current) setPending(false);\n    }, pendingResumeGraceMs);\n    return () => clearTimeout(timer);\n  }, [pending, requestId, pendingResumeGraceMs, attempt]);\n\n  const sendResumeRef = useRef(sendResume);\n  sendResumeRef.current = sendResume;\n  const onResumeRejectedRef = useRef(onResumeRejected);\n  onResumeRejectedRef.current = onResumeRejected;\n  const onResumeRetryRef = useRef(onResumeRetry);\n  onResumeRetryRef.current = onResumeRetry;\n  const maxTransportRetriesRef = useRef(maxTransportRetries);\n  maxTransportRetriesRef.current = maxTransportRetries;\n  const currentRequestIdRef = useRef(requestId);\n  currentRequestIdRef.current = requestId;\n  const pendingRef = useRef(pending);\n  pendingRef.current = pending;\n  // One token per `resume` call: a settle from an earlier submission must not\n  // retry over, or release, a newer one for the same request.\n  const submissionRef = useRef(0);\n\n  const resume = useCallback(\n    (value: TValue): Promise<unknown> | undefined => {\n      if (requestId === undefined || pendingRef.current) return undefined;\n      const submission = ++submissionRef.current;\n      setPending(true);\n      pendingRef.current = true;\n      setAttempt(0);\n      const first: unknown = sendResumeRef.current(requestId, value);\n      if (!(first instanceof Promise)) return undefined;\n      // The final failure is already reported through `onResumeRejected`;\n      // callers that drop the promise must not get an unhandled rejection.\n      const outcome = new Promise<unknown>((resolve, reject) => {\n        const settle = (dispatched: Promise<unknown>, retries: number) => {\n          dispatched.then(resolve, (error: unknown) => {\n            // A late refusal for a request the lock has since moved past (the\n            // park was re-keyed, or a newer answer is in flight) must neither\n            // release that answer's lock nor be reported as a failure of it.\n            // The optimistic fold hides the answered request until the fold\n            // rolls back, so `undefined` here is not a departure.\n            const current = currentRequestIdRef.current;\n            if (\n              submission !== submissionRef.current ||\n              (current !== undefined && current !== requestId)\n            ) {\n              reject(error);\n              return;\n            }\n            if (retries < maxTransportRetriesRef.current && isResumeTransportLoss(error)) {\n              const next = retries + 1;\n              onResumeRetryRef.current?.(error, requestId, next);\n              setPending(true);\n              pendingRef.current = true;\n              setAttempt(next);\n              const resent: unknown = sendResumeRef.current(requestId, value);\n              if (resent instanceof Promise) {\n                settle(resent, next);\n                return;\n              }\n              resolve(undefined);\n              return;\n            }\n            setPending(false);\n            pendingRef.current = false;\n            onResumeRejectedRef.current?.(error, requestId);\n            reject(error);\n          });\n        };\n        settle(first, 0);\n      });\n      outcome.catch(() => {});\n      return outcome;\n    },\n    [requestId],\n  );\n\n  return { pending, resume };\n}\n"],"names":[],"mappings":";;;;AAmEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAGO,SAAS,mBACd,SAC+C;AAC/C,SAAO,QAAQ,SAAS,eAAe,EAAE,cAAc;AACzD;AAQA,MAAM,wCAA6D,oBAAI,IAAI,CAAC,uBAAuB,CAAC;AAO7F,SAAS,uBAAuB,SAA2B;AAChE,MAAI,CAAC,SAAS,OAAO,EAAG,QAAO;AAC/B,MAAI,QAAQ,yBAAyB,MAAO,QAAO;AACnD,SACE,OAAO,QAAQ,WAAW,YAAY,sCAAsC,IAAI,QAAQ,MAAM;AAElG;AASO,SAAS,wBACd,SAC+C;AAC/C,MAAI,CAAC,mBAAmB,OAAO,EAAG,QAAO;AACzC,QAAM,UAAW,QAAkC;AACnD,SAAO,CAAC,6BAA6B,OAAO,KAAK,CAAC,uBAAuB,OAAO;AAClF;AAGO,SAAS,eAAe,OAA4C;AACzE,MAAI,CAAC,SAAS,KAAK,EAAG,QAAO;AAC7B,SAAO,MAAM,SAAS,UACpB,MAAM,WAAW,mBACjB,OAAO,MAAM,YAAY,WACtB,QACD;AACN;AAGO,MAAM,mCACX;AAGK,SAAS,qBACd,OACA,WAAmB,kCACX;AACR,MAAI,SAAS,KAAK,KAAK,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,SAAS,GAAG;AACpF,WAAO,MAAM;AAAA,EACf;AACA,SAAO;AACT;AAkBO,SAAS,sBAAsB,MAA0D;AAC9F,QAAM,UAAU,6BAAM;AACtB,MAAI,CAAC,QAAS,QAAO,CAAA;AAKrB,QAAM,WAAsC,MAAM,QAAQ,QAAQ,eAAe,IAC7E,QAAQ,gBAAgB,OAAO,QAAQ,IACvC,QAAQ,aAAa,QAAQ,YAC3B,CAAC,EAAE,MAAM,QAAQ,WAAW,MAAM,QAAQ,UAAA,CAAW,IACrD,CAAA;AACN,SAAO,SAAS,IAAI,CAAC,aAAa;AAAA,IAChC,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,MAAM,SAAS,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAA;AAAA,IAC9C,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,YAAY,QAAQ,aAAA;AAAA,IACtE,GAAI,OAAO,QAAQ,iBAAiB,YAAY,EAAE,aAAa,QAAQ,aAAA;AAAA,IACvE,GAAI,QAAQ,6BAA6B,QAAQ,EAAE,wBAAwB,KAAA;AAAA,EAAK,EAChF;AACJ;AAQO,SAAS,qBAAqB,gBAA0D;AAC7F,SACE,eAAe,SAAS,KACxB,eAAe,MAAM,CAAC,YAAY,QAAQ,2BAA2B,IAAI;AAE7E;AAeO,SAAS,2BACd,OAC8C;AAC9C,QAAM,YAAY,0BAA0B,KAAK,EAAE;AAInD,SAAO,MAAM,QAAQ,SAAS,IACzB,YACD;AACN;AAUO,SAAS,oBAAoB,OAAyB;AAC3D,SAAO,0BAA0B,KAAK,EAAE;AAC1C;AAGO,SAAS,uBAAuB,QAA0B;AAC/D,SAAO,SAAS,MAAM,IAAI,OAAO,QAAQ;AAC3C;AASO,SAAS,wBACd,OAC+C;AAC/C,QAAM,SAAS,0BAA0B,KAAK,EAAE;AAChD,SAAO,SAAS,MAAM,IAAI,SAAS;AACrC;AASO,SAAS,iBAAiB,gBAAkE;AACjG,MAAI,eAAe,WAAW,EAAG,QAAO;AACxC,QAAM,MAAgB,CAAA;AACtB,aAAW,WAAW,gBAAgB;AACpC,QAAI,QAAQ,gBAAgB,OAAW,QAAO;AAC9C,QAAI,CAAC,IAAI,SAAS,QAAQ,WAAW,EAAG,KAAI,KAAK,QAAQ,WAAW;AAAA,EACtE;AACA,SAAO;AACT;AAGO,SAAS,gBAAmB;AAAA,EACjC;AAAA,EACA;AACF,GAGsB;AACpB,SAAO,OAAO,YAAY,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,CAAC;AACpE;AAGO,SAAS,uBACd,WACmC;AACnC,SAAO,uCAAW;AAAA,IAChB,CAAC,YAAY,SAAS,OAAO,KAAK,QAAQ,SAAS,eAAe,OAAO,QAAQ,OAAO;AAAA;AAE5F;AAGO,MAAM,qBAAqB;AAS3B,MAAM,+BAA+B;AAQrC,MAAM,gCAAgC;AAQtC,SAAS,sBAAsB,OAAyB;AAC7D,QAAM,UAAU,0BAA0B,KAAK;AAC/C,SAAO,YAAY,kBAAkB,YAAY;AACnD;AAGO,SAAS,oBAA4C;AAC1D,SAAO,EAAE,QAAQ,UAAA;AACnB;AAOO,SAAS,8BAAsD;AACpE,SAAO,EAAE,QAAQ,WAAW,OAAO,UAAA;AACrC;AAGO,SAAS,iBAAiB,SAAiB,oBAA4C;AAC5F,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AAGO,MAAM,2BAA2B;AASjC,SAAS,uBACd,SAAiB,0BACO;AACxB,SAAO,EAAE,QAAQ,UAAU,OAAA;AAC7B;AA0EO,SAAS,sBACd,SAC4B;AAC5B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,sBAAsB;AAAA,EAAA,IACpB;AAEJ,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,KAAK;AAE5C,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,CAAC;AACxC,QAAM,mBAAmB,OAAO,SAAS;AACzC,MAAI,iBAAiB,YAAY,WAAW;AAC1C,qBAAiB,UAAU;AAC3B,QAAI,oBAAoB,KAAK;AAAA,EAC/B;AAIA,QAAM,kBAAkB,OAAO,KAAK;AACpC,YAAU,MAAM;AACd,QAAI,CAAC,SAAS;AACZ,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,WAAW;AACb,sBAAgB,UAAU;AAC1B;AAAA,IACF;AACA,QAAI,gBAAgB,SAAS;AAC3B,sBAAgB,UAAU;AAC1B,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,SAAS,SAAS,CAAC;AAKvB,YAAU,MAAM;AACd,QAAI,CAAC,WAAW,yBAAyB,OAAW;AACpD,UAAM,QAAQ,WAAW,MAAM;AAC7B,UAAI,CAAC,gBAAgB,QAAS,YAAW,KAAK;AAAA,IAChD,GAAG,oBAAoB;AACvB,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,SAAS,WAAW,sBAAsB,OAAO,CAAC;AAEtD,QAAM,gBAAgB,OAAO,UAAU;AACvC,gBAAc,UAAU;AACxB,QAAM,sBAAsB,OAAO,gBAAgB;AACnD,sBAAoB,UAAU;AAC9B,QAAM,mBAAmB,OAAO,aAAa;AAC7C,mBAAiB,UAAU;AAC3B,QAAM,yBAAyB,OAAO,mBAAmB;AACzD,yBAAuB,UAAU;AACjC,QAAM,sBAAsB,OAAO,SAAS;AAC5C,sBAAoB,UAAU;AAC9B,QAAM,aAAa,OAAO,OAAO;AACjC,aAAW,UAAU;AAGrB,QAAM,gBAAgB,OAAO,CAAC;AAE9B,QAAM,SAAS;AAAA,IACb,CAAC,UAAgD;AAC/C,UAAI,cAAc,UAAa,WAAW,QAAS,QAAO;AAC1D,YAAM,aAAa,EAAE,cAAc;AACnC,iBAAW,IAAI;AACf,iBAAW,UAAU;AACrB,iBAAW,CAAC;AACZ,YAAM,QAAiB,cAAc,QAAQ,WAAW,KAAK;AAC7D,UAAI,EAAE,iBAAiB,SAAU,QAAO;AAGxC,YAAM,UAAU,IAAI,QAAiB,CAAC,SAAS,WAAW;AACxD,cAAM,SAAS,CAAC,YAA8B,YAAoB;AAChE,qBAAW,KAAK,SAAS,CAAC,UAAmB;;AAM3C,kBAAM,UAAU,oBAAoB;AACpC,gBACE,eAAe,cAAc,WAC5B,YAAY,UAAa,YAAY,WACtC;AACA,qBAAO,KAAK;AACZ;AAAA,YACF;AACA,gBAAI,UAAU,uBAAuB,WAAW,sBAAsB,KAAK,GAAG;AAC5E,oBAAM,OAAO,UAAU;AACvB,qCAAiB,YAAjB,0CAA2B,OAAO,WAAW;AAC7C,yBAAW,IAAI;AACf,yBAAW,UAAU;AACrB,yBAAW,IAAI;AACf,oBAAM,SAAkB,cAAc,QAAQ,WAAW,KAAK;AAC9D,kBAAI,kBAAkB,SAAS;AAC7B,uBAAO,QAAQ,IAAI;AACnB;AAAA,cACF;AACA,sBAAQ,MAAS;AACjB;AAAA,YACF;AACA,uBAAW,KAAK;AAChB,uBAAW,UAAU;AACrB,sCAAoB,YAApB,6CAA8B,OAAO;AACrC,mBAAO,KAAK;AAAA,UACd,CAAC;AAAA,QACH;AACA,eAAO,OAAO,CAAC;AAAA,MACjB,CAAC;AACD,cAAQ,MAAM,MAAM;AAAA,MAAC,CAAC;AACtB,aAAO;AAAA,IACT;AAAA,IACA,CAAC,SAAS;AAAA,EAAA;AAGZ,SAAO,EAAE,SAAS,OAAA;AACpB;"}

package/dist/packages/agent-runtime/src/quota-safe-local-storage-session.cjs

@@ -40,6 +40,43 @@ function readFailedSendStampsFromRecord(record) {
   }
   return stamps;
 }
+const inRange = (value, range) => value >= (range.minVersion ?? range.version) && value <= range.version;
+const storedCommandCompatible = (protocol, command, current) => {
+  if (!command.produced || !inRange(command.produced.wire.version, current.wire))
+    return false;
+  if (current.protocols === "*") return true;
+  if (command.produced.protocols === "*") return false;
+  const produced = command.produced.protocols.find((p) => p.name === protocol);
+  const offer = current.protocols.find((p) => p.name === protocol);
+  return produced !== void 0 && offer !== void 0 && inRange(produced.version, offer);
+};
+function parkIncompatibleSessionCommands(record, current, now = Date.now()) {
+  let parked = 0;
+  const lanes = {};
+  for (const [protocol, lane] of Object.entries(record.lanes)) {
+    const kept = [];
+    const failed = [];
+    for (const command of lane.commands) {
+      if (storedCommandCompatible(protocol, command, current)) {
+        kept.push(command);
+        continue;
+      }
+      failed.push({
+        protocol,
+        produced: current,
+        command: command.method,
+        params: command.params,
+        ...command.meta !== void 0 && { meta: command.meta },
+        failure: { fate: "lost", cause: "session-lost" },
+        ts: now,
+        seq: command.seq
+      });
+    }
+    parked += failed.length;
+    lanes[protocol] = failed.length === 0 ? lane : { ...lane, commands: kept, failed: [...lane.failed ?? [], ...failed] };
+  }
+  return parked === 0 ? { record, parked } : { record: { ...record, lanes }, parked };
+}
 function isStorageQuotaError(error) {
   if (typeof error !== "object" || error === null) return false;
   const { name, code, message } = error;
@@ -285,6 +322,17 @@ const useQuotaSafeLocalStorageSession = ({
       key: sessionKey,
       namespace: SESSION_PREFIX,
       protocol: statewireTransport.DEEP_AGENT_STATEWIRE_PROTOCOL,
+      migrate: (record, current) => {
+        const migrated = parkIncompatibleSessionCommands(record, current);
+        reportDegradation({
+          operation: "migrate",
+          key: storageKey,
+          error: new Error(
+            `${migrated.parked} queued statewire command(s) predate the current protocol range; parked as failed sends`
+          )
+        });
+        return migrated.record;
+      },
       retention: { maxAgeMs: ttl, maxEntries: max },
       // A failure statewire raises itself (a structurally invalid stored
       // record) still stops the session; it is at least reported the same way.
@@ -327,6 +375,7 @@ const QuotaSafeLocalStorageSession = tap.resource(
 );
 exports.QuotaSafeLocalStorageSession = QuotaSafeLocalStorageSession;
 exports.isStorageQuotaError = isStorageQuotaError;
+exports.parkIncompatibleSessionCommands = parkIncompatibleSessionCommands;
 exports.quotaTolerantBackend = quotaTolerantBackend;
 exports.readFailedSendStampsFromRecord = readFailedSendStampsFromRecord;
 exports.readPersistedFailedSendStamps = readPersistedFailedSendStamps;

package/dist/packages/agent-runtime/src/quota-safe-local-storage-session.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"quota-safe-local-storage-session.cjs","sources":["../../../../../agent-runtime/src/quota-safe-local-storage-session.ts"],"sourcesContent":["import { resource, useResource } from \"@assistant-ui/tap\";\nimport type { StatewireClient } from \"statewire\";\nimport { KeyValueSessionStorage } from \"statewire/storage\";\nimport { useEffect, useMemo, useRef } from \"react\";\nimport { DEEP_AGENT_STATEWIRE_PROTOCOL } from \"./statewire-transport\";\n\nconst SESSION_PREFIX = \"aui:statewire-session:\";\nconst SESSION_LOCK_PREFIX = \"aui:statewire-session-lock:\";\nconst SESSION_ACTIVE_PREFIX = \"aui:statewire-session-active:\";\nconst DAY_MS = 24 * 60 * 60 * 1000;\n/** The stored-record formats the statewire this build ships reads (it writes 3). */\nconst READABLE_STORAGE_VERSIONS: ReadonlySet<unknown> = new Set([1, 2, 3]);\n\n/** Structural view of the browser storage global — this package compiles\n * without the DOM lib (React Native honesty; see `globals.d.ts`). */\ntype StorageLike = {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n  key(index: number): string | null;\n  readonly length: number;\n};\n\ntype LockGrant = object | null;\n\n/** The Web Locks API surface the session uses (`navigator.locks`). */\ntype LockManagerLike = {\n  request<T>(\n    name: string,\n    callback: (lock: LockGrant) => T | Promise<T>,\n  ): Promise<T>;\n  request<T>(\n    name: string,\n    options: { mode?: \"shared\" | \"exclusive\"; ifAvailable?: boolean },\n    callback: (lock: LockGrant) => T | Promise<T>,\n  ): Promise<T>;\n};\n\ntype StorageEventLike = { key: string | null };\n\ntype BrowserGlobals = {\n  localStorage?: StorageLike;\n  navigator?: { locks?: LockManagerLike };\n  addEventListener?: (\n    type: \"storage\",\n    listener: (event: StorageEventLike) => void,\n  ) => void;\n  removeEventListener?: (\n    type: \"storage\",\n    listener: (event: StorageEventLike) => void,\n  ) => void;\n};\n\nconst browserGlobals = globalThis as BrowserGlobals;\n\n/** A persisted session record: per-lane failed entries (a pre-lane record carried them at the root). */\ntype SessionRecordLike = {\n  failed?: unknown;\n  lanes?: Record<string, { failed?: unknown } | null | undefined> | null;\n};\n\nexport function readPersistedFailedSendStamps(\n  sessionKey: string,\n): ReadonlyMap<string, number> | null {\n  const storage = browserGlobals.localStorage;\n  if (!storage) return null;\n  let record: SessionRecordLike | null;\n  try {\n    const raw = storage.getItem(SESSION_PREFIX + sessionKey);\n    record = raw === null ? null : (JSON.parse(raw) as SessionRecordLike | null);\n  } catch {\n    return null;\n  }\n  return readFailedSendStampsFromRecord(record);\n}\n\n/**\n * Send stamps (message id → epoch ms of the original send) off an already\n * loaded session record's failed lane — the storage-agnostic half of\n * {@link readPersistedFailedSendStamps}, for hosts whose session store is not\n * localStorage (the React Native AsyncStorage-backed store reads its record\n * synchronously through `SessionStorage.load()`).\n *\n * Returns `null` for no record (every failed entry then counts as fresh) and\n * an empty map for a record without failures.\n */\nexport function readFailedSendStampsFromRecord(\n  record: SessionRecordLike | null | undefined,\n): ReadonlyMap<string, number> | null {\n  if (!record || typeof record !== \"object\") return null;\n  const stamps = new Map<string, number>();\n  const lanes = record.lanes && typeof record.lanes === \"object\" ? record.lanes : {};\n  const failed = [\n    ...(Array.isArray(record.failed) ? record.failed : []),\n    ...Object.values(lanes).flatMap((lane) => (Array.isArray(lane?.failed) ? lane.failed : [])),\n  ];\n  for (const entry of failed) {\n    const failed = entry as {\n      ts?: unknown;\n      params?: readonly { message?: { id?: unknown } }[];\n    } | null;\n    const messageId = failed?.params?.[0]?.message?.id;\n    if (typeof messageId === \"string\" && typeof failed?.ts === \"number\") {\n      stamps.set(messageId, failed.ts);\n    }\n  }\n  return stamps;\n}\n\n/** A storage operation the session survived by degrading instead of failing. */\nexport type SessionStorageDegradation = {\n  operation:\n    | \"getItem\"\n    | \"setItem\"\n    | \"removeItem\"\n    | \"getAllKeys\"\n    | \"withUnused\"\n    /** The lock manager refused the transaction fence; it ran unfenced. */\n    | \"lock\"\n    /**\n     * The stored record is one this build cannot read (not JSON, or a newer\n     * storage version): served as absent, and the key is shielded from being\n     * overwritten so the record survives this tab.\n     */\n    | \"record\"\n    /** statewire's own storage failure (a structurally invalid stored record). */\n    | \"session\";\n  key: string;\n  error: unknown;\n};\n\n/**\n * Whether `error` is the browser refusing a write for lack of room, under\n * every name the engines use — `QuotaExceededError` (Chromium, WebKit, current\n * Firefox), `NS_ERROR_DOM_QUOTA_REACHED` (older Firefox), the legacy\n * `DOMException` codes 22 (WebKit) and 1014 (Firefox) — or a plain error whose\n * message carries one of those (storage proxies and WebViews rewrap the\n * exception). Olympus's `isStorageQuotaError` recognises the same set; the two\n * stay in step.\n */\nexport function isStorageQuotaError(error: unknown): boolean {\n  if (typeof error !== \"object\" || error === null) return false;\n  const { name, code, message } = error as {\n    name?: unknown;\n    code?: unknown;\n    message?: unknown;\n  };\n  return (\n    name === \"QuotaExceededError\" ||\n    name === \"NS_ERROR_DOM_QUOTA_REACHED\" ||\n    code === 22 ||\n    code === 1014 ||\n    (typeof message === \"string\" &&\n      /exceeded the quota|quotaexceedederror|ns_error_dom_quota_reached/i.test(\n        message,\n      ))\n  );\n}\n\n/** The one quota shape statewire's retention sweep recognises. */\nfunction asStatewireQuotaError(error: unknown): Error {\n  if (error instanceof Error && error.name === \"QuotaExceededError\")\n    return error;\n  const normalized = new Error(\n    error instanceof Error ? error.message : \"storage quota exceeded\",\n  );\n  normalized.name = \"QuotaExceededError\";\n  return normalized;\n}\n\n/**\n * Why `raw` is a stored record this build cannot read, or `undefined` when it\n * may be one. Mirrors the two decode failures statewire raises for a record it\n * cannot read — invalid JSON, and a `statewireStorageVersion` newer than the\n * ones this build's statewire decodes (a tab left open across a\n * statewire upgrade, reading the record a newer tab keeps) — because statewire\n * throws those out of the resource at mount instead of treating the record as\n * absent. A structurally invalid record of the right version still fails\n * inside statewire.\n */\nfunction unreadableRecord(raw: string): Error | undefined {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    return error instanceof Error\n      ? error\n      : new Error(\"stored session record is not JSON\");\n  }\n  if (typeof parsed !== \"object\" || parsed === null) {\n    return new Error(\"stored session record is not an object\");\n  }\n  const version = (parsed as { statewireStorageVersion?: unknown })\n    .statewireStorageVersion;\n  if (version !== undefined && !READABLE_STORAGE_VERSIONS.has(version)) {\n    return new Error(\n      `stored session record uses storage version ${String(version)}`,\n    );\n  }\n  return undefined;\n}\n\ntype SyncBackend = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n  getAllKeys: () => readonly string[];\n  withUnused: (key: string, action: () => Promise<void>) => Promise<void>;\n};\n\n/**\n * The browser backend `@assistant-ui/react-statewire`'s `LocalStorageSession`\n * uses, reproduced here because that resource does not take a backend: raw\n * `localStorage`, with retention cleanup fenced by the same Web Locks so a\n * sweep never removes a record another tab is actively sharing.\n */\nfunction browserBackend({\n  storage,\n  locks,\n}: {\n  storage: StorageLike;\n  locks: LockManagerLike;\n}): SyncBackend {\n  return {\n    getItem: (key) => storage.getItem(key),\n    setItem: (key, value) => storage.setItem(key, value),\n    removeItem: (key) => storage.removeItem(key),\n    getAllKeys: () =>\n      Array.from({ length: storage.length }, (_, index) =>\n        storage.key(index),\n      ).filter((key): key is string => key !== null),\n    withUnused: async (key, action) => {\n      await locks.request(\n        SESSION_ACTIVE_PREFIX + key,\n        { ifAvailable: true },\n        async (active) => {\n          if (active === null) return;\n          await locks.request(\n            SESSION_LOCK_PREFIX + key.slice(SESSION_PREFIX.length),\n            { ifAvailable: true },\n            async (lock) => {\n              if (lock === null) return;\n              await action();\n            },\n          );\n        },\n      );\n    },\n  };\n}\n\n/**\n * Wraps a synchronous key-value backend so a failing origin degrades the\n * session to memory-only persistence instead of stopping the connection.\n *\n * statewire's session storage latches the first unrecognised write failure\n * and from then on rejects every send (`stopped/storage-error`, \"session\n * storage failed\" on the connection chip). It only recovers a\n * `QuotaExceededError` by that exact name — sweeping old session records and\n * retrying the write once — and latches again when the retry fails too. Here\n * the first quota failure per key is surfaced under that name so the sweep\n * runs; the retry that follows it and every other storage failure are absorbed\n * and reported through `onDegraded`, so chat keeps working.\n *\n * An absorbed write is kept in an in-memory overlay that `getItem` serves\n * first: statewire re-reads the record through `load()` on every shared-mode\n * transaction, so a stale persisted copy would otherwise win back its old\n * `nextSeq`, `clientId` and command journal. The overlay is per tab — another\n * tab sharing the thread still reads the last persisted copy, which is the\n * memory-only degradation this backend exists to allow. A later successful\n * write clears the overlay entry.\n *\n * A key whose read threw, or whose stored value this build cannot read (see\n * {@link unreadableRecord}), is served as absent and shielded: writes to it\n * stay in the overlay for good, so a fresh lane minted over an unreadable\n * record never overwrites what another tab or a newer build persisted.\n */\nexport function quotaTolerantBackend({\n  inner,\n  onDegraded,\n}: {\n  inner: SyncBackend;\n  onDegraded: (degradation: SessionStorageDegradation) => void;\n}): KeyValueSessionStorage.Backend {\n  // Keys whose write already surfaced a quota error to statewire: until a\n  // write succeeds again, later failures on the key are absorbed instead of\n  // surfaced, or every save would re-run statewire's sweep (which evicts\n  // other threads' idle records) and the failure would latch on the retry.\n  const quotaSurfaced = new Set<string>();\n  // Absorbed writes, served ahead of the backend (see the function docs).\n  const overlay = new Map<string, string>();\n  // Keys served as absent and never written through (see the function docs).\n  const shielded = new Set<string>();\n  // statewire re-reads and re-decodes the record on every transaction; the\n  // readability check is memoised on the raw string so it costs one string\n  // comparison per read, not a second parse.\n  const checked = new Map<\n    string,\n    { raw: string; verdict: Error | undefined }\n  >();\n  const readable = (key: string, raw: string): Error | undefined => {\n    const previous = checked.get(key);\n    if (previous !== undefined && previous.raw === raw) return previous.verdict;\n    const verdict = unreadableRecord(raw);\n    checked.set(key, { raw, verdict });\n    return verdict;\n  };\n  return {\n    getItem: (key) => {\n      const shadowed = overlay.get(key);\n      if (shadowed !== undefined) return shadowed;\n      if (shielded.has(key)) return null;\n      let raw: string | null;\n      try {\n        raw = inner.getItem(key);\n      } catch (error) {\n        shielded.add(key);\n        onDegraded({ operation: \"getItem\", key, error });\n        return null;\n      }\n      if (raw === null) return null;\n      const unreadable = readable(key, raw);\n      if (unreadable === undefined) return raw;\n      shielded.add(key);\n      onDegraded({ operation: \"record\", key, error: unreadable });\n      return null;\n    },\n    setItem: (key, value) => {\n      if (shielded.has(key)) {\n        overlay.set(key, value);\n        return;\n      }\n      try {\n        inner.setItem(key, value);\n        overlay.delete(key);\n        quotaSurfaced.delete(key);\n      } catch (error) {\n        if (isStorageQuotaError(error) && !quotaSurfaced.has(key)) {\n          quotaSurfaced.add(key);\n          throw asStatewireQuotaError(error);\n        }\n        overlay.set(key, value);\n        onDegraded({ operation: \"setItem\", key, error });\n      }\n    },\n    removeItem: (key) => {\n      overlay.delete(key);\n      if (shielded.has(key)) return;\n      try {\n        inner.removeItem(key);\n      } catch (error) {\n        onDegraded({ operation: \"removeItem\", key, error });\n      }\n    },\n    getAllKeys: () => {\n      const keys = new Set<string>(overlay.keys());\n      try {\n        for (const key of inner.getAllKeys()) keys.add(key);\n      } catch (error) {\n        onDegraded({ operation: \"getAllKeys\", key: \"\", error });\n      }\n      return [...keys];\n    },\n    withUnused: async (key, action) => {\n      try {\n        await inner.withUnused(key, action);\n      } catch (error) {\n        onDegraded({ operation: \"withUnused\", key, error });\n      }\n    },\n  };\n}\n\ntype DegradationListener = (degradation: SessionStorageDegradation) => void;\n\ntype SharedBackend = {\n  backend: KeyValueSessionStorage.Backend;\n  listeners: Set<DegradationListener>;\n};\n\n/**\n * One backend per storage object — per origin, in a browser — shared by every\n * session mounted in the tab, exactly as the upstream resource's module-level\n * backend is. statewire keys its in-tab \"active\" bookkeeping by backend\n * identity, so a mount's retention sweep only skips the records of other\n * mounts on the *same* backend; and the absorbed-write overlay has to outlive\n * a remount of the same thread (a thread switch and back) or the remount would\n * read the stale persisted copy. Degradations fan out to every mounted\n * session's reporter.\n */\nconst sharedBackends = new WeakMap<StorageLike, SharedBackend>();\n\nfunction sharedBackend({\n  storage,\n  locks,\n}: {\n  storage: StorageLike;\n  locks: LockManagerLike;\n}): SharedBackend {\n  let shared = sharedBackends.get(storage);\n  if (shared === undefined) {\n    const listeners = new Set<DegradationListener>();\n    shared = {\n      listeners,\n      backend: quotaTolerantBackend({\n        inner: browserBackend({ storage, locks }),\n        onDegraded: (degradation) => {\n          for (const listener of listeners) listener(degradation);\n        },\n      }),\n    };\n    sharedBackends.set(storage, shared);\n  }\n  return shared;\n}\n\n/**\n * Athena's browser session store: `@assistant-ui/react-statewire`'s\n * `LocalStorageSession` contract (per-thread key under the shared prefix,\n * cross-tab Web Lock, storage-event subscription, retention) on top of\n * {@link quotaTolerantBackend}, with Athena's protocol lane and retention\n * policy.\n */\nconst useQuotaSafeLocalStorageSession = ({\n  threadId,\n  key = (id) => id,\n  ttl = 7 * DAY_MS,\n  max = 50,\n  onStorageDegraded,\n}: QuotaSafeLocalStorageSession.Options): StatewireClient.SessionStorage => {\n  const storage = browserGlobals.localStorage;\n  const locks = browserGlobals.navigator?.locks;\n  if (!storage)\n    throw new Error(\n      \"statewire: QuotaSafeLocalStorageSession requires localStorage\",\n    );\n  if (!locks)\n    throw new Error(\n      \"statewire: QuotaSafeLocalStorageSession requires the Web Locks API (navigator.locks)\",\n    );\n  const sessionKey = key(threadId);\n  const storageKey = SESSION_PREFIX + sessionKey;\n  const lockName = SESSION_LOCK_PREFIX + sessionKey;\n\n  const latestOnDegraded = useRef(onStorageDegraded);\n  latestOnDegraded.current = onStorageDegraded;\n  const reportDegradation = useMemo(() => {\n    const reported = new Set<string>();\n    return (degradation: SessionStorageDegradation) => {\n      const handler = latestOnDegraded.current;\n      if (handler) {\n        try {\n          handler(degradation);\n        } catch {\n          // Reporting runs inside the session's recovery path and must never\n          // become the failure it is reporting.\n        }\n        return;\n      }\n      const dedupeKey = `${degradation.operation}:${degradation.key}`;\n      if (reported.has(dedupeKey)) return;\n      reported.add(dedupeKey);\n      console.warn(\n        `[statewire] session storage degraded to memory only (${degradation.operation} ${degradation.key})`,\n        degradation.error,\n      );\n    };\n  }, []);\n\n  const shared = sharedBackend({ storage, locks });\n  // Registered during render as well as in the effect: the read statewire\n  // makes while mounting below happens before any effect runs, and tap may\n  // clean an effect up and re-run it within one commit.\n  shared.listeners.add(reportDegradation);\n  useEffect(() => {\n    shared.listeners.add(reportDegradation);\n    return () => {\n      shared.listeners.delete(reportDegradation);\n    };\n  }, [shared, reportDegradation]);\n\n  // Hold the record's shared \"active\" lock while mounted so another tab's\n  // retention sweep skips it (the same fence the upstream resource holds).\n  useEffect(() => {\n    let release: (() => void) | undefined;\n    let disposed = false;\n    Promise.resolve(\n      locks.request(\n        SESSION_ACTIVE_PREFIX + storageKey,\n        { mode: \"shared\" },\n        () => {\n          if (disposed) return;\n          return new Promise<void>((resolve) => {\n            release = resolve;\n          });\n        },\n      ),\n    ).catch((error: unknown) =>\n      reportDegradation({ operation: \"lock\", key: storageKey, error }),\n    );\n    return () => {\n      disposed = true;\n      release?.();\n    };\n  }, [locks, storageKey, reportDegradation]);\n\n  const sessionStorage = useResource(\n    KeyValueSessionStorage({\n      backend: shared.backend,\n      key: sessionKey,\n      namespace: SESSION_PREFIX,\n      protocol: DEEP_AGENT_STATEWIRE_PROTOCOL,\n      retention: { maxAgeMs: ttl, maxEntries: max },\n      // A failure statewire raises itself (a structurally invalid stored\n      // record) still stops the session; it is at least reported the same way.\n      onError: (error) =>\n        reportDegradation({ operation: \"session\", key: storageKey, error }),\n    }),\n  );\n\n  return useMemo(\n    () => ({\n      ...sessionStorage,\n      lock: async <T>(fn: () => T | Promise<T>): Promise<T> => {\n        let granted = false;\n        try {\n          return await locks.request(lockName, async () => {\n            granted = true;\n            return fn();\n          });\n        } catch (error) {\n          if (granted) throw error;\n          // The lock manager refused the request itself (a detached or\n          // back/forward-cached document, a lockdown-mode origin): the\n          // transaction runs unfenced rather than stopping the session.\n          reportDegradation({ operation: \"lock\", key: storageKey, error });\n          return fn();\n        }\n      },\n      subscribe: (listener: () => void) => {\n        const onStorage = (event: StorageEventLike) => {\n          if (event.key === storageKey) listener();\n        };\n        browserGlobals.addEventListener?.(\"storage\", onStorage);\n        return () => browserGlobals.removeEventListener?.(\"storage\", onStorage);\n      },\n    }),\n    [sessionStorage, locks, storageKey, lockName, reportDegradation],\n  );\n};\n\n/** Athena's browser session keys and retention policy. */\nexport const QuotaSafeLocalStorageSession = resource(\n  useQuotaSafeLocalStorageSession,\n);\n\nexport namespace QuotaSafeLocalStorageSession {\n  export type Options = {\n    threadId: string;\n    key?: (threadId: string) => string;\n    ttl?: number;\n    max?: number;\n    /**\n     * Called when a storage operation failed and the session carried on in\n     * memory. Defaults to one `console.warn` per operation and key.\n     */\n    onStorageDegraded?: (degradation: SessionStorageDegradation) => void;\n  };\n}\n"],"names":["storage","failed","useRef","useMemo","useEffect","useResource","KeyValueSessionStorage","DEEP_AGENT_STATEWIRE_PROTOCOL","_a","resource"],"mappings":";;;;;;AAMA,MAAM,iBAAiB;AACvB,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;AAC9B,MAAM,SAAS,KAAK,KAAK,KAAK;AAE9B,MAAM,4BAAkD,oBAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;AA0CzE,MAAM,iBAAiB;AAQhB,SAAS,8BACd,YACoC;AACpC,QAAMA,WAAU,eAAe;AAC/B,MAAI,CAACA,SAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,MAAMA,SAAQ,QAAQ,iBAAiB,UAAU;AACvD,aAAS,QAAQ,OAAO,OAAQ,KAAK,MAAM,GAAG;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,+BAA+B,MAAM;AAC9C;AAYO,SAAS,+BACd,QACoC;;AACpC,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,6BAAa,IAAA;AACnB,QAAM,QAAQ,OAAO,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,CAAA;AAChF,QAAM,SAAS;AAAA,IACb,GAAI,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,SAAS,CAAA;AAAA,IACnD,GAAG,OAAO,OAAO,KAAK,EAAE,QAAQ,CAAC,SAAU,MAAM,QAAQ,6BAAM,MAAM,IAAI,KAAK,SAAS,CAAA,CAAG;AAAA,EAAA;AAE5F,aAAW,SAAS,QAAQ;AAC1B,UAAMC,UAAS;AAIf,UAAM,aAAYA,oDAAQ,WAARA,mBAAiB,OAAjBA,mBAAqB,YAArBA,mBAA8B;AAChD,QAAI,OAAO,cAAc,YAAY,QAAOA,mCAAQ,QAAO,UAAU;AACnE,aAAO,IAAI,WAAWA,QAAO,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAiCO,SAAS,oBAAoB,OAAyB;AAC3D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,EAAE,MAAM,MAAM,QAAA,IAAY;AAKhC,SACE,SAAS,wBACT,SAAS,gCACT,SAAS,MACT,SAAS,QACR,OAAO,YAAY,YAClB,oEAAoE;AAAA,IAClE;AAAA,EAAA;AAGR;AAGA,SAAS,sBAAsB,OAAuB;AACpD,MAAI,iBAAiB,SAAS,MAAM,SAAS;AAC3C,WAAO;AACT,QAAM,aAAa,IAAI;AAAA,IACrB,iBAAiB,QAAQ,MAAM,UAAU;AAAA,EAAA;AAE3C,aAAW,OAAO;AAClB,SAAO;AACT;AAYA,SAAS,iBAAiB,KAAgC;AACxD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,WAAO,iBAAiB,QACpB,QACA,IAAI,MAAM,mCAAmC;AAAA,EACnD;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,WAAO,IAAI,MAAM,wCAAwC;AAAA,EAC3D;AACA,QAAM,UAAW,OACd;AACH,MAAI,YAAY,UAAa,CAAC,0BAA0B,IAAI,OAAO,GAAG;AACpE,WAAO,IAAI;AAAA,MACT,8CAA8C,OAAO,OAAO,CAAC;AAAA,IAAA;AAAA,EAEjE;AACA,SAAO;AACT;AAgBA,SAAS,eAAe;AAAA,EACtB,SAAAD;AAAA,EACA;AACF,GAGgB;AACd,SAAO;AAAA,IACL,SAAS,CAAC,QAAQA,SAAQ,QAAQ,GAAG;AAAA,IACrC,SAAS,CAAC,KAAK,UAAUA,SAAQ,QAAQ,KAAK,KAAK;AAAA,IACnD,YAAY,CAAC,QAAQA,SAAQ,WAAW,GAAG;AAAA,IAC3C,YAAY,MACV,MAAM;AAAA,MAAK,EAAE,QAAQA,SAAQ,OAAA;AAAA,MAAU,CAAC,GAAG,UACzCA,SAAQ,IAAI,KAAK;AAAA,IAAA,EACjB,OAAO,CAAC,QAAuB,QAAQ,IAAI;AAAA,IAC/C,YAAY,OAAO,KAAK,WAAW;AACjC,YAAM,MAAM;AAAA,QACV,wBAAwB;AAAA,QACxB,EAAE,aAAa,KAAA;AAAA,QACf,OAAO,WAAW;AAChB,cAAI,WAAW,KAAM;AACrB,gBAAM,MAAM;AAAA,YACV,sBAAsB,IAAI,MAAM,eAAe,MAAM;AAAA,YACrD,EAAE,aAAa,KAAA;AAAA,YACf,OAAO,SAAS;AACd,kBAAI,SAAS,KAAM;AACnB,oBAAM,OAAA;AAAA,YACR;AAAA,UAAA;AAAA,QAEJ;AAAA,MAAA;AAAA,IAEJ;AAAA,EAAA;AAEJ;AA4BO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AACF,GAGmC;AAKjC,QAAM,oCAAoB,IAAA;AAE1B,QAAM,8BAAc,IAAA;AAEpB,QAAM,+BAAe,IAAA;AAIrB,QAAM,8BAAc,IAAA;AAIpB,QAAM,WAAW,CAAC,KAAa,QAAmC;AAChE,UAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,QAAI,aAAa,UAAa,SAAS,QAAQ,YAAY,SAAS;AACpE,UAAM,UAAU,iBAAiB,GAAG;AACpC,YAAQ,IAAI,KAAK,EAAE,KAAK,SAAS;AACjC,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ;AAChB,YAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,UAAI,aAAa,OAAW,QAAO;AACnC,UAAI,SAAS,IAAI,GAAG,EAAG,QAAO;AAC9B,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,QAAQ,GAAG;AAAA,MACzB,SAAS,OAAO;AACd,iBAAS,IAAI,GAAG;AAChB,mBAAW,EAAE,WAAW,WAAW,KAAK,OAAO;AAC/C,eAAO;AAAA,MACT;AACA,UAAI,QAAQ,KAAM,QAAO;AACzB,YAAM,aAAa,SAAS,KAAK,GAAG;AACpC,UAAI,eAAe,OAAW,QAAO;AACrC,eAAS,IAAI,GAAG;AAChB,iBAAW,EAAE,WAAW,UAAU,KAAK,OAAO,YAAY;AAC1D,aAAO;AAAA,IACT;AAAA,IACA,SAAS,CAAC,KAAK,UAAU;AACvB,UAAI,SAAS,IAAI,GAAG,GAAG;AACrB,gBAAQ,IAAI,KAAK,KAAK;AACtB;AAAA,MACF;AACA,UAAI;AACF,cAAM,QAAQ,KAAK,KAAK;AACxB,gBAAQ,OAAO,GAAG;AAClB,sBAAc,OAAO,GAAG;AAAA,MAC1B,SAAS,OAAO;AACd,YAAI,oBAAoB,KAAK,KAAK,CAAC,cAAc,IAAI,GAAG,GAAG;AACzD,wBAAc,IAAI,GAAG;AACrB,gBAAM,sBAAsB,KAAK;AAAA,QACnC;AACA,gBAAQ,IAAI,KAAK,KAAK;AACtB,mBAAW,EAAE,WAAW,WAAW,KAAK,OAAO;AAAA,MACjD;AAAA,IACF;AAAA,IACA,YAAY,CAAC,QAAQ;AACnB,cAAQ,OAAO,GAAG;AAClB,UAAI,SAAS,IAAI,GAAG,EAAG;AACvB,UAAI;AACF,cAAM,WAAW,GAAG;AAAA,MACtB,SAAS,OAAO;AACd,mBAAW,EAAE,WAAW,cAAc,KAAK,OAAO;AAAA,MACpD;AAAA,IACF;AAAA,IACA,YAAY,MAAM;AAChB,YAAM,OAAO,IAAI,IAAY,QAAQ,MAAM;AAC3C,UAAI;AACF,mBAAW,OAAO,MAAM,WAAA,EAAc,MAAK,IAAI,GAAG;AAAA,MACpD,SAAS,OAAO;AACd,mBAAW,EAAE,WAAW,cAAc,KAAK,IAAI,OAAO;AAAA,MACxD;AACA,aAAO,CAAC,GAAG,IAAI;AAAA,IACjB;AAAA,IACA,YAAY,OAAO,KAAK,WAAW;AACjC,UAAI;AACF,cAAM,MAAM,WAAW,KAAK,MAAM;AAAA,MACpC,SAAS,OAAO;AACd,mBAAW,EAAE,WAAW,cAAc,KAAK,OAAO;AAAA,MACpD;AAAA,IACF;AAAA,EAAA;AAEJ;AAmBA,MAAM,qCAAqB,QAAA;AAE3B,SAAS,cAAc;AAAA,EACrB,SAAAA;AAAA,EACA;AACF,GAGkB;AAChB,MAAI,SAAS,eAAe,IAAIA,QAAO;AACvC,MAAI,WAAW,QAAW;AACxB,UAAM,gCAAgB,IAAA;AACtB,aAAS;AAAA,MACP;AAAA,MACA,SAAS,qBAAqB;AAAA,QAC5B,OAAO,eAAe,EAAE,SAAAA,UAAS,OAAO;AAAA,QACxC,YAAY,CAAC,gBAAgB;AAC3B,qBAAW,YAAY,UAAW,UAAS,WAAW;AAAA,QACxD;AAAA,MAAA,CACD;AAAA,IAAA;AAEH,mBAAe,IAAIA,UAAS,MAAM;AAAA,EACpC;AACA,SAAO;AACT;AASA,MAAM,kCAAkC,CAAC;AAAA,EACvC;AAAA,EACA,MAAM,CAAC,OAAO;AAAA,EACd,MAAM,IAAI;AAAA,EACV,MAAM;AAAA,EACN;AACF,MAA4E;;AAC1E,QAAMA,YAAU,eAAe;AAC/B,QAAM,SAAQ,oBAAe,cAAf,mBAA0B;AACxC,MAAI,CAACA;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAEJ,MAAI,CAAC;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAEJ,QAAM,aAAa,IAAI,QAAQ;AAC/B,QAAM,aAAa,iBAAiB;AACpC,QAAM,WAAW,sBAAsB;AAEvC,QAAM,mBAAmBE,MAAAA,OAAO,iBAAiB;AACjD,mBAAiB,UAAU;AAC3B,QAAM,oBAAoBC,MAAAA,QAAQ,MAAM;AACtC,UAAM,+BAAe,IAAA;AACrB,WAAO,CAAC,gBAA2C;AACjD,YAAM,UAAU,iBAAiB;AACjC,UAAI,SAAS;AACX,YAAI;AACF,kBAAQ,WAAW;AAAA,QACrB,QAAQ;AAAA,QAGR;AACA;AAAA,MACF;AACA,YAAM,YAAY,GAAG,YAAY,SAAS,IAAI,YAAY,GAAG;AAC7D,UAAI,SAAS,IAAI,SAAS,EAAG;AAC7B,eAAS,IAAI,SAAS;AACtB,cAAQ;AAAA,QACN,wDAAwD,YAAY,SAAS,IAAI,YAAY,GAAG;AAAA,QAChG,YAAY;AAAA,MAAA;AAAA,IAEhB;AAAA,EACF,GAAG,CAAA,CAAE;AAEL,QAAM,SAAS,cAAc,WAAEH,WAAS,OAAO;AAI/C,SAAO,UAAU,IAAI,iBAAiB;AACtCI,QAAAA,UAAU,MAAM;AACd,WAAO,UAAU,IAAI,iBAAiB;AACtC,WAAO,MAAM;AACX,aAAO,UAAU,OAAO,iBAAiB;AAAA,IAC3C;AAAA,EACF,GAAG,CAAC,QAAQ,iBAAiB,CAAC;AAI9BA,QAAAA,UAAU,MAAM;AACd,QAAI;AACJ,QAAI,WAAW;AACf,YAAQ;AAAA,MACN,MAAM;AAAA,QACJ,wBAAwB;AAAA,QACxB,EAAE,MAAM,SAAA;AAAA,QACR,MAAM;AACJ,cAAI,SAAU;AACd,iBAAO,IAAI,QAAc,CAAC,YAAY;AACpC,sBAAU;AAAA,UACZ,CAAC;AAAA,QACH;AAAA,MAAA;AAAA,IACF,EACA;AAAA,MAAM,CAAC,UACP,kBAAkB,EAAE,WAAW,QAAQ,KAAK,YAAY,MAAA,CAAO;AAAA,IAAA;AAEjE,WAAO,MAAM;AACX,iBAAW;AACX;AAAA,IACF;AAAA,EACF,GAAG,CAAC,OAAO,YAAY,iBAAiB,CAAC;AAEzC,QAAM,iBAAiBC,IAAAA;AAAAA,IACrBC,+BAAuB;AAAA,MACrB,SAAS,OAAO;AAAA,MAChB,KAAK;AAAA,MACL,WAAW;AAAA,MACX,UAAUC,mBAAAA;AAAAA,MACV,WAAW,EAAE,UAAU,KAAK,YAAY,IAAA;AAAA;AAAA;AAAA,MAGxC,SAAS,CAAC,UACR,kBAAkB,EAAE,WAAW,WAAW,KAAK,YAAY,MAAA,CAAO;AAAA,IAAA,CACrE;AAAA,EAAA;AAGH,SAAOJ,MAAAA;AAAAA,IACL,OAAO;AAAA,MACL,GAAG;AAAA,MACH,MAAM,OAAU,OAAyC;AACvD,YAAI,UAAU;AACd,YAAI;AACF,iBAAO,MAAM,MAAM,QAAQ,UAAU,YAAY;AAC/C,sBAAU;AACV,mBAAO,GAAA;AAAA,UACT,CAAC;AAAA,QACH,SAAS,OAAO;AACd,cAAI,QAAS,OAAM;AAInB,4BAAkB,EAAE,WAAW,QAAQ,KAAK,YAAY,OAAO;AAC/D,iBAAO,GAAA;AAAA,QACT;AAAA,MACF;AAAA,MACA,WAAW,CAAC,aAAyB;;AACnC,cAAM,YAAY,CAAC,UAA4B;AAC7C,cAAI,MAAM,QAAQ,WAAY,UAAA;AAAA,QAChC;AACA,SAAAK,MAAA,eAAe,qBAAf,gBAAAA,IAAA,qBAAkC,WAAW;AAC7C,eAAO;;AAAM,kBAAAA,MAAA,eAAe,wBAAf,gBAAAA,IAAA,qBAAqC,WAAW;AAAA;AAAA,MAC/D;AAAA,IAAA;AAAA,IAEF,CAAC,gBAAgB,OAAO,YAAY,UAAU,iBAAiB;AAAA,EAAA;AAEnE;AAGO,MAAM,+BAA+BC,IAAAA;AAAAA,EAC1C;AACF;;;;;;"}
+{"version":3,"file":"quota-safe-local-storage-session.cjs","sources":["../../../../../agent-runtime/src/quota-safe-local-storage-session.ts"],"sourcesContent":["import { resource, useResource } from \"@assistant-ui/tap\";\nimport type { StatewireClient, StatewireProtocol } from \"statewire\";\nimport { KeyValueSessionStorage } from \"statewire/storage\";\nimport { useEffect, useMemo, useRef } from \"react\";\nimport { DEEP_AGENT_STATEWIRE_PROTOCOL } from \"./statewire-transport\";\n\nconst SESSION_PREFIX = \"aui:statewire-session:\";\nconst SESSION_LOCK_PREFIX = \"aui:statewire-session-lock:\";\nconst SESSION_ACTIVE_PREFIX = \"aui:statewire-session-active:\";\nconst DAY_MS = 24 * 60 * 60 * 1000;\n/** The stored-record formats the statewire this build ships reads (it writes 3). */\nconst READABLE_STORAGE_VERSIONS: ReadonlySet<unknown> = new Set([1, 2, 3]);\n\n/** Structural view of the browser storage global — this package compiles\n * without the DOM lib (React Native honesty; see `globals.d.ts`). */\ntype StorageLike = {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n  key(index: number): string | null;\n  readonly length: number;\n};\n\ntype LockGrant = object | null;\n\n/** The Web Locks API surface the session uses (`navigator.locks`). */\ntype LockManagerLike = {\n  request<T>(\n    name: string,\n    callback: (lock: LockGrant) => T | Promise<T>,\n  ): Promise<T>;\n  request<T>(\n    name: string,\n    options: { mode?: \"shared\" | \"exclusive\"; ifAvailable?: boolean },\n    callback: (lock: LockGrant) => T | Promise<T>,\n  ): Promise<T>;\n};\n\ntype StorageEventLike = { key: string | null };\n\ntype BrowserGlobals = {\n  localStorage?: StorageLike;\n  navigator?: { locks?: LockManagerLike };\n  addEventListener?: (\n    type: \"storage\",\n    listener: (event: StorageEventLike) => void,\n  ) => void;\n  removeEventListener?: (\n    type: \"storage\",\n    listener: (event: StorageEventLike) => void,\n  ) => void;\n};\n\nconst browserGlobals = globalThis as BrowserGlobals;\n\n/** A persisted session record: per-lane failed entries (a pre-lane record carried them at the root). */\ntype SessionRecordLike = {\n  failed?: unknown;\n  lanes?: Record<string, { failed?: unknown } | null | undefined> | null;\n};\n\nexport function readPersistedFailedSendStamps(\n  sessionKey: string,\n): ReadonlyMap<string, number> | null {\n  const storage = browserGlobals.localStorage;\n  if (!storage) return null;\n  let record: SessionRecordLike | null;\n  try {\n    const raw = storage.getItem(SESSION_PREFIX + sessionKey);\n    record = raw === null ? null : (JSON.parse(raw) as SessionRecordLike | null);\n  } catch {\n    return null;\n  }\n  return readFailedSendStampsFromRecord(record);\n}\n\n/**\n * Send stamps (message id → epoch ms of the original send) off an already\n * loaded session record's failed lane — the storage-agnostic half of\n * {@link readPersistedFailedSendStamps}, for hosts whose session store is not\n * localStorage (the React Native AsyncStorage-backed store reads its record\n * synchronously through `SessionStorage.load()`).\n *\n * Returns `null` for no record (every failed entry then counts as fresh) and\n * an empty map for a record without failures.\n */\nexport function readFailedSendStampsFromRecord(\n  record: SessionRecordLike | null | undefined,\n): ReadonlyMap<string, number> | null {\n  if (!record || typeof record !== \"object\") return null;\n  const stamps = new Map<string, number>();\n  const lanes = record.lanes && typeof record.lanes === \"object\" ? record.lanes : {};\n  const failed = [\n    ...(Array.isArray(record.failed) ? record.failed : []),\n    ...Object.values(lanes).flatMap((lane) => (Array.isArray(lane?.failed) ? lane.failed : [])),\n  ];\n  for (const entry of failed) {\n    const failed = entry as {\n      ts?: unknown;\n      params?: readonly { message?: { id?: unknown } }[];\n    } | null;\n    const messageId = failed?.params?.[0]?.message?.id;\n    if (typeof messageId === \"string\" && typeof failed?.ts === \"number\") {\n      stamps.set(messageId, failed.ts);\n    }\n  }\n  return stamps;\n}\n\n/** A storage operation the session survived by degrading instead of failing. */\nexport type SessionStorageDegradation = {\n  operation:\n    | \"getItem\"\n    | \"setItem\"\n    | \"removeItem\"\n    | \"getAllKeys\"\n    | \"withUnused\"\n    /** The lock manager refused the transaction fence; it ran unfenced. */\n    | \"lock\"\n    /**\n     * The stored record is one this build cannot read (not JSON, or a newer\n     * storage version): served as absent, and the key is shielded from being\n     * overwritten so the record survives this tab.\n     */\n    | \"record\"\n    /** statewire's own storage failure (a structurally invalid stored record). */\n    | \"session\"\n    /**\n     * Queued commands persisted by an earlier statewire build no longer fit\n     * the current wire/protocol range: parked in the lane's failed list (the\n     * send-recovery sweep re-dispatches them) instead of blocking the mount.\n     */\n    | \"migrate\";\n  key: string;\n  error: unknown;\n};\n\ntype ProducedRange = NonNullable<StatewireClient.SessionCommand[\"produced\"]>;\n\nconst inRange = (value: string, range: StatewireProtocol.Range) =>\n  value >= (range.minVersion ?? range.version) && value <= range.version;\n\n/** Mirrors statewire's own stored-command compatibility check. */\nconst storedCommandCompatible = (\n  protocol: string,\n  command: StatewireClient.SessionCommand,\n  current: ProducedRange,\n): boolean => {\n  if (!command.produced || !inRange(command.produced.wire.version, current.wire))\n    return false;\n  if (current.protocols === \"*\") return true;\n  if (command.produced.protocols === \"*\") return false;\n  const produced = command.produced.protocols.find((p) => p.name === protocol);\n  const offer = current.protocols.find((p) => p.name === protocol);\n  return produced !== undefined && offer !== undefined && inRange(produced.version, offer);\n};\n\n/**\n * statewire's `migrate` for a record whose queued commands were produced by\n * an earlier build: every incompatible command leaves its lane's queue and is\n * retained as a `lost`/`session-lost` failed send re-stamped with the current\n * range. Client identity, lane clocks, compatible commands and existing failed\n * history are untouched, so the mount proceeds and the send-recovery sweep\n * (or the user, via the failed-send UI) re-dispatches the parked sends under\n * the negotiated format instead of the runtime throwing before it dials.\n *\n * Returns the record itself when nothing needed migrating, and the count of\n * parked commands otherwise.\n */\nexport function parkIncompatibleSessionCommands(\n  record: StatewireClient.SessionRecord,\n  current: ProducedRange,\n  now: number = Date.now(),\n): { record: StatewireClient.SessionRecord; parked: number } {\n  let parked = 0;\n  const lanes: Record<string, StatewireClient.SessionLane> = {};\n  for (const [protocol, lane] of Object.entries(record.lanes)) {\n    const kept: StatewireClient.SessionCommand[] = [];\n    const failed: StatewireClient.FailedCommand[] = [];\n    for (const command of lane.commands) {\n      if (storedCommandCompatible(protocol, command, current)) {\n        kept.push(command);\n        continue;\n      }\n      failed.push({\n        protocol,\n        produced: current,\n        command: command.method,\n        params: command.params,\n        ...(command.meta !== undefined && { meta: command.meta }),\n        failure: { fate: \"lost\", cause: \"session-lost\" },\n        ts: now,\n        seq: command.seq,\n      });\n    }\n    parked += failed.length;\n    lanes[protocol] =\n      failed.length === 0\n        ? lane\n        : { ...lane, commands: kept, failed: [...(lane.failed ?? []), ...failed] };\n  }\n  return parked === 0 ? { record, parked } : { record: { ...record, lanes }, parked };\n}\n\n/**\n * Whether `error` is the browser refusing a write for lack of room, under\n * every name the engines use — `QuotaExceededError` (Chromium, WebKit, current\n * Firefox), `NS_ERROR_DOM_QUOTA_REACHED` (older Firefox), the legacy\n * `DOMException` codes 22 (WebKit) and 1014 (Firefox) — or a plain error whose\n * message carries one of those (storage proxies and WebViews rewrap the\n * exception). Olympus's `isStorageQuotaError` recognises the same set; the two\n * stay in step.\n */\nexport function isStorageQuotaError(error: unknown): boolean {\n  if (typeof error !== \"object\" || error === null) return false;\n  const { name, code, message } = error as {\n    name?: unknown;\n    code?: unknown;\n    message?: unknown;\n  };\n  return (\n    name === \"QuotaExceededError\" ||\n    name === \"NS_ERROR_DOM_QUOTA_REACHED\" ||\n    code === 22 ||\n    code === 1014 ||\n    (typeof message === \"string\" &&\n      /exceeded the quota|quotaexceedederror|ns_error_dom_quota_reached/i.test(\n        message,\n      ))\n  );\n}\n\n/** The one quota shape statewire's retention sweep recognises. */\nfunction asStatewireQuotaError(error: unknown): Error {\n  if (error instanceof Error && error.name === \"QuotaExceededError\")\n    return error;\n  const normalized = new Error(\n    error instanceof Error ? error.message : \"storage quota exceeded\",\n  );\n  normalized.name = \"QuotaExceededError\";\n  return normalized;\n}\n\n/**\n * Why `raw` is a stored record this build cannot read, or `undefined` when it\n * may be one. Mirrors the two decode failures statewire raises for a record it\n * cannot read — invalid JSON, and a `statewireStorageVersion` newer than the\n * ones this build's statewire decodes (a tab left open across a\n * statewire upgrade, reading the record a newer tab keeps) — because statewire\n * throws those out of the resource at mount instead of treating the record as\n * absent. A structurally invalid record of the right version still fails\n * inside statewire.\n */\nfunction unreadableRecord(raw: string): Error | undefined {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (error) {\n    return error instanceof Error\n      ? error\n      : new Error(\"stored session record is not JSON\");\n  }\n  if (typeof parsed !== \"object\" || parsed === null) {\n    return new Error(\"stored session record is not an object\");\n  }\n  const version = (parsed as { statewireStorageVersion?: unknown })\n    .statewireStorageVersion;\n  if (version !== undefined && !READABLE_STORAGE_VERSIONS.has(version)) {\n    return new Error(\n      `stored session record uses storage version ${String(version)}`,\n    );\n  }\n  return undefined;\n}\n\ntype SyncBackend = {\n  getItem: (key: string) => string | null;\n  setItem: (key: string, value: string) => void;\n  removeItem: (key: string) => void;\n  getAllKeys: () => readonly string[];\n  withUnused: (key: string, action: () => Promise<void>) => Promise<void>;\n};\n\n/**\n * The browser backend `@assistant-ui/react-statewire`'s `LocalStorageSession`\n * uses, reproduced here because that resource does not take a backend: raw\n * `localStorage`, with retention cleanup fenced by the same Web Locks so a\n * sweep never removes a record another tab is actively sharing.\n */\nfunction browserBackend({\n  storage,\n  locks,\n}: {\n  storage: StorageLike;\n  locks: LockManagerLike;\n}): SyncBackend {\n  return {\n    getItem: (key) => storage.getItem(key),\n    setItem: (key, value) => storage.setItem(key, value),\n    removeItem: (key) => storage.removeItem(key),\n    getAllKeys: () =>\n      Array.from({ length: storage.length }, (_, index) =>\n        storage.key(index),\n      ).filter((key): key is string => key !== null),\n    withUnused: async (key, action) => {\n      await locks.request(\n        SESSION_ACTIVE_PREFIX + key,\n        { ifAvailable: true },\n        async (active) => {\n          if (active === null) return;\n          await locks.request(\n            SESSION_LOCK_PREFIX + key.slice(SESSION_PREFIX.length),\n            { ifAvailable: true },\n            async (lock) => {\n              if (lock === null) return;\n              await action();\n            },\n          );\n        },\n      );\n    },\n  };\n}\n\n/**\n * Wraps a synchronous key-value backend so a failing origin degrades the\n * session to memory-only persistence instead of stopping the connection.\n *\n * statewire's session storage latches the first unrecognised write failure\n * and from then on rejects every send (`stopped/storage-error`, \"session\n * storage failed\" on the connection chip). It only recovers a\n * `QuotaExceededError` by that exact name — sweeping old session records and\n * retrying the write once — and latches again when the retry fails too. Here\n * the first quota failure per key is surfaced under that name so the sweep\n * runs; the retry that follows it and every other storage failure are absorbed\n * and reported through `onDegraded`, so chat keeps working.\n *\n * An absorbed write is kept in an in-memory overlay that `getItem` serves\n * first: statewire re-reads the record through `load()` on every shared-mode\n * transaction, so a stale persisted copy would otherwise win back its old\n * `nextSeq`, `clientId` and command journal. The overlay is per tab — another\n * tab sharing the thread still reads the last persisted copy, which is the\n * memory-only degradation this backend exists to allow. A later successful\n * write clears the overlay entry.\n *\n * A key whose read threw, or whose stored value this build cannot read (see\n * {@link unreadableRecord}), is served as absent and shielded: writes to it\n * stay in the overlay for good, so a fresh lane minted over an unreadable\n * record never overwrites what another tab or a newer build persisted.\n */\nexport function quotaTolerantBackend({\n  inner,\n  onDegraded,\n}: {\n  inner: SyncBackend;\n  onDegraded: (degradation: SessionStorageDegradation) => void;\n}): KeyValueSessionStorage.Backend {\n  // Keys whose write already surfaced a quota error to statewire: until a\n  // write succeeds again, later failures on the key are absorbed instead of\n  // surfaced, or every save would re-run statewire's sweep (which evicts\n  // other threads' idle records) and the failure would latch on the retry.\n  const quotaSurfaced = new Set<string>();\n  // Absorbed writes, served ahead of the backend (see the function docs).\n  const overlay = new Map<string, string>();\n  // Keys served as absent and never written through (see the function docs).\n  const shielded = new Set<string>();\n  // statewire re-reads and re-decodes the record on every transaction; the\n  // readability check is memoised on the raw string so it costs one string\n  // comparison per read, not a second parse.\n  const checked = new Map<\n    string,\n    { raw: string; verdict: Error | undefined }\n  >();\n  const readable = (key: string, raw: string): Error | undefined => {\n    const previous = checked.get(key);\n    if (previous !== undefined && previous.raw === raw) return previous.verdict;\n    const verdict = unreadableRecord(raw);\n    checked.set(key, { raw, verdict });\n    return verdict;\n  };\n  return {\n    getItem: (key) => {\n      const shadowed = overlay.get(key);\n      if (shadowed !== undefined) return shadowed;\n      if (shielded.has(key)) return null;\n      let raw: string | null;\n      try {\n        raw = inner.getItem(key);\n      } catch (error) {\n        shielded.add(key);\n        onDegraded({ operation: \"getItem\", key, error });\n        return null;\n      }\n      if (raw === null) return null;\n      const unreadable = readable(key, raw);\n      if (unreadable === undefined) return raw;\n      shielded.add(key);\n      onDegraded({ operation: \"record\", key, error: unreadable });\n      return null;\n    },\n    setItem: (key, value) => {\n      if (shielded.has(key)) {\n        overlay.set(key, value);\n        return;\n      }\n      try {\n        inner.setItem(key, value);\n        overlay.delete(key);\n        quotaSurfaced.delete(key);\n      } catch (error) {\n        if (isStorageQuotaError(error) && !quotaSurfaced.has(key)) {\n          quotaSurfaced.add(key);\n          throw asStatewireQuotaError(error);\n        }\n        overlay.set(key, value);\n        onDegraded({ operation: \"setItem\", key, error });\n      }\n    },\n    removeItem: (key) => {\n      overlay.delete(key);\n      if (shielded.has(key)) return;\n      try {\n        inner.removeItem(key);\n      } catch (error) {\n        onDegraded({ operation: \"removeItem\", key, error });\n      }\n    },\n    getAllKeys: () => {\n      const keys = new Set<string>(overlay.keys());\n      try {\n        for (const key of inner.getAllKeys()) keys.add(key);\n      } catch (error) {\n        onDegraded({ operation: \"getAllKeys\", key: \"\", error });\n      }\n      return [...keys];\n    },\n    withUnused: async (key, action) => {\n      try {\n        await inner.withUnused(key, action);\n      } catch (error) {\n        onDegraded({ operation: \"withUnused\", key, error });\n      }\n    },\n  };\n}\n\ntype DegradationListener = (degradation: SessionStorageDegradation) => void;\n\ntype SharedBackend = {\n  backend: KeyValueSessionStorage.Backend;\n  listeners: Set<DegradationListener>;\n};\n\n/**\n * One backend per storage object — per origin, in a browser — shared by every\n * session mounted in the tab, exactly as the upstream resource's module-level\n * backend is. statewire keys its in-tab \"active\" bookkeeping by backend\n * identity, so a mount's retention sweep only skips the records of other\n * mounts on the *same* backend; and the absorbed-write overlay has to outlive\n * a remount of the same thread (a thread switch and back) or the remount would\n * read the stale persisted copy. Degradations fan out to every mounted\n * session's reporter.\n */\nconst sharedBackends = new WeakMap<StorageLike, SharedBackend>();\n\nfunction sharedBackend({\n  storage,\n  locks,\n}: {\n  storage: StorageLike;\n  locks: LockManagerLike;\n}): SharedBackend {\n  let shared = sharedBackends.get(storage);\n  if (shared === undefined) {\n    const listeners = new Set<DegradationListener>();\n    shared = {\n      listeners,\n      backend: quotaTolerantBackend({\n        inner: browserBackend({ storage, locks }),\n        onDegraded: (degradation) => {\n          for (const listener of listeners) listener(degradation);\n        },\n      }),\n    };\n    sharedBackends.set(storage, shared);\n  }\n  return shared;\n}\n\n/**\n * Athena's browser session store: `@assistant-ui/react-statewire`'s\n * `LocalStorageSession` contract (per-thread key under the shared prefix,\n * cross-tab Web Lock, storage-event subscription, retention) on top of\n * {@link quotaTolerantBackend}, with Athena's protocol lane and retention\n * policy.\n */\nconst useQuotaSafeLocalStorageSession = ({\n  threadId,\n  key = (id) => id,\n  ttl = 7 * DAY_MS,\n  max = 50,\n  onStorageDegraded,\n}: QuotaSafeLocalStorageSession.Options): StatewireClient.SessionStorage => {\n  const storage = browserGlobals.localStorage;\n  const locks = browserGlobals.navigator?.locks;\n  if (!storage)\n    throw new Error(\n      \"statewire: QuotaSafeLocalStorageSession requires localStorage\",\n    );\n  if (!locks)\n    throw new Error(\n      \"statewire: QuotaSafeLocalStorageSession requires the Web Locks API (navigator.locks)\",\n    );\n  const sessionKey = key(threadId);\n  const storageKey = SESSION_PREFIX + sessionKey;\n  const lockName = SESSION_LOCK_PREFIX + sessionKey;\n\n  const latestOnDegraded = useRef(onStorageDegraded);\n  latestOnDegraded.current = onStorageDegraded;\n  const reportDegradation = useMemo(() => {\n    const reported = new Set<string>();\n    return (degradation: SessionStorageDegradation) => {\n      const handler = latestOnDegraded.current;\n      if (handler) {\n        try {\n          handler(degradation);\n        } catch {\n          // Reporting runs inside the session's recovery path and must never\n          // become the failure it is reporting.\n        }\n        return;\n      }\n      const dedupeKey = `${degradation.operation}:${degradation.key}`;\n      if (reported.has(dedupeKey)) return;\n      reported.add(dedupeKey);\n      console.warn(\n        `[statewire] session storage degraded to memory only (${degradation.operation} ${degradation.key})`,\n        degradation.error,\n      );\n    };\n  }, []);\n\n  const shared = sharedBackend({ storage, locks });\n  // Registered during render as well as in the effect: the read statewire\n  // makes while mounting below happens before any effect runs, and tap may\n  // clean an effect up and re-run it within one commit.\n  shared.listeners.add(reportDegradation);\n  useEffect(() => {\n    shared.listeners.add(reportDegradation);\n    return () => {\n      shared.listeners.delete(reportDegradation);\n    };\n  }, [shared, reportDegradation]);\n\n  // Hold the record's shared \"active\" lock while mounted so another tab's\n  // retention sweep skips it (the same fence the upstream resource holds).\n  useEffect(() => {\n    let release: (() => void) | undefined;\n    let disposed = false;\n    Promise.resolve(\n      locks.request(\n        SESSION_ACTIVE_PREFIX + storageKey,\n        { mode: \"shared\" },\n        () => {\n          if (disposed) return;\n          return new Promise<void>((resolve) => {\n            release = resolve;\n          });\n        },\n      ),\n    ).catch((error: unknown) =>\n      reportDegradation({ operation: \"lock\", key: storageKey, error }),\n    );\n    return () => {\n      disposed = true;\n      release?.();\n    };\n  }, [locks, storageKey, reportDegradation]);\n\n  const sessionStorage = useResource(\n    KeyValueSessionStorage({\n      backend: shared.backend,\n      key: sessionKey,\n      namespace: SESSION_PREFIX,\n      protocol: DEEP_AGENT_STATEWIRE_PROTOCOL,\n      migrate: (record, current) => {\n        const migrated = parkIncompatibleSessionCommands(record, current);\n        reportDegradation({\n          operation: \"migrate\",\n          key: storageKey,\n          error: new Error(\n            `${migrated.parked} queued statewire command(s) predate the current protocol range; parked as failed sends`,\n          ),\n        });\n        return migrated.record;\n      },\n      retention: { maxAgeMs: ttl, maxEntries: max },\n      // A failure statewire raises itself (a structurally invalid stored\n      // record) still stops the session; it is at least reported the same way.\n      onError: (error) =>\n        reportDegradation({ operation: \"session\", key: storageKey, error }),\n    }),\n  );\n\n  return useMemo(\n    () => ({\n      ...sessionStorage,\n      lock: async <T>(fn: () => T | Promise<T>): Promise<T> => {\n        let granted = false;\n        try {\n          return await locks.request(lockName, async () => {\n            granted = true;\n            return fn();\n          });\n        } catch (error) {\n          if (granted) throw error;\n          // The lock manager refused the request itself (a detached or\n          // back/forward-cached document, a lockdown-mode origin): the\n          // transaction runs unfenced rather than stopping the session.\n          reportDegradation({ operation: \"lock\", key: storageKey, error });\n          return fn();\n        }\n      },\n      subscribe: (listener: () => void) => {\n        const onStorage = (event: StorageEventLike) => {\n          if (event.key === storageKey) listener();\n        };\n        browserGlobals.addEventListener?.(\"storage\", onStorage);\n        return () => browserGlobals.removeEventListener?.(\"storage\", onStorage);\n      },\n    }),\n    [sessionStorage, locks, storageKey, lockName, reportDegradation],\n  );\n};\n\n/** Athena's browser session keys and retention policy. */\nexport const QuotaSafeLocalStorageSession = resource(\n  useQuotaSafeLocalStorageSession,\n);\n\nexport namespace QuotaSafeLocalStorageSession {\n  export type Options = {\n    threadId: string;\n    key?: (threadId: string) => string;\n    ttl?: number;\n    max?: number;\n    /**\n     * Called when a storage operation failed and the session carried on in\n     * memory. Defaults to one `console.warn` per operation and key.\n     */\n    onStorageDegraded?: (degradation: SessionStorageDegradation) => void;\n  };\n}\n"],"names":["storage","failed","useRef","useMemo","useEffect","useResource","KeyValueSessionStorage","DEEP_AGENT_STATEWIRE_PROTOCOL","_a","resource"],"mappings":";;;;;;AAMA,MAAM,iBAAiB;AACvB,MAAM,sBAAsB;AAC5B,MAAM,wBAAwB;AAC9B,MAAM,SAAS,KAAK,KAAK,KAAK;AAE9B,MAAM,4BAAkD,oBAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;AA0CzE,MAAM,iBAAiB;AAQhB,SAAS,8BACd,YACoC;AACpC,QAAMA,WAAU,eAAe;AAC/B,MAAI,CAACA,SAAS,QAAO;AACrB,MAAI;AACJ,MAAI;AACF,UAAM,MAAMA,SAAQ,QAAQ,iBAAiB,UAAU;AACvD,aAAS,QAAQ,OAAO,OAAQ,KAAK,MAAM,GAAG;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO,+BAA+B,MAAM;AAC9C;AAYO,SAAS,+BACd,QACoC;;AACpC,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAClD,QAAM,6BAAa,IAAA;AACnB,QAAM,QAAQ,OAAO,SAAS,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ,CAAA;AAChF,QAAM,SAAS;AAAA,IACb,GAAI,MAAM,QAAQ,OAAO,MAAM,IAAI,OAAO,SAAS,CAAA;AAAA,IACnD,GAAG,OAAO,OAAO,KAAK,EAAE,QAAQ,CAAC,SAAU,MAAM,QAAQ,6BAAM,MAAM,IAAI,KAAK,SAAS,CAAA,CAAG;AAAA,EAAA;AAE5F,aAAW,SAAS,QAAQ;AAC1B,UAAMC,UAAS;AAIf,UAAM,aAAYA,oDAAQ,WAARA,mBAAiB,OAAjBA,mBAAqB,YAArBA,mBAA8B;AAChD,QAAI,OAAO,cAAc,YAAY,QAAOA,mCAAQ,QAAO,UAAU;AACnE,aAAO,IAAI,WAAWA,QAAO,EAAE;AAAA,IACjC;AAAA,EACF;AACA,SAAO;AACT;AAgCA,MAAM,UAAU,CAAC,OAAe,UAC9B,UAAU,MAAM,cAAc,MAAM,YAAY,SAAS,MAAM;AAGjE,MAAM,0BAA0B,CAC9B,UACA,SACA,YACY;AACZ,MAAI,CAAC,QAAQ,YAAY,CAAC,QAAQ,QAAQ,SAAS,KAAK,SAAS,QAAQ,IAAI;AAC3E,WAAO;AACT,MAAI,QAAQ,cAAc,IAAK,QAAO;AACtC,MAAI,QAAQ,SAAS,cAAc,IAAK,QAAO;AAC/C,QAAM,WAAW,QAAQ,SAAS,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC3E,QAAM,QAAQ,QAAQ,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC/D,SAAO,aAAa,UAAa,UAAU,UAAa,QAAQ,SAAS,SAAS,KAAK;AACzF;AAcO,SAAS,gCACd,QACA,SACA,MAAc,KAAK,OACwC;AAC3D,MAAI,SAAS;AACb,QAAM,QAAqD,CAAA;AAC3D,aAAW,CAAC,UAAU,IAAI,KAAK,OAAO,QAAQ,OAAO,KAAK,GAAG;AAC3D,UAAM,OAAyC,CAAA;AAC/C,UAAM,SAA0C,CAAA;AAChD,eAAW,WAAW,KAAK,UAAU;AACnC,UAAI,wBAAwB,UAAU,SAAS,OAAO,GAAG;AACvD,aAAK,KAAK,OAAO;AACjB;AAAA,MACF;AACA,aAAO,KAAK;AAAA,QACV;AAAA,QACA,UAAU;AAAA,QACV,SAAS,QAAQ;AAAA,QACjB,QAAQ,QAAQ;AAAA,QAChB,GAAI,QAAQ,SAAS,UAAa,EAAE,MAAM,QAAQ,KAAA;AAAA,QAClD,SAAS,EAAE,MAAM,QAAQ,OAAO,eAAA;AAAA,QAChC,IAAI;AAAA,QACJ,KAAK,QAAQ;AAAA,MAAA,CACd;AAAA,IACH;AACA,cAAU,OAAO;AACjB,UAAM,QAAQ,IACZ,OAAO,WAAW,IACd,OACA,EAAE,GAAG,MAAM,UAAU,MAAM,QAAQ,CAAC,GAAI,KAAK,UAAU,CAAA,GAAK,GAAG,MAAM,EAAA;AAAA,EAC7E;AACA,SAAO,WAAW,IAAI,EAAE,QAAQ,OAAA,IAAW,EAAE,QAAQ,EAAE,GAAG,QAAQ,MAAA,GAAS,OAAA;AAC7E;AAWO,SAAS,oBAAoB,OAAyB;AAC3D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,EAAE,MAAM,MAAM,QAAA,IAAY;AAKhC,SACE,SAAS,wBACT,SAAS,gCACT,SAAS,MACT,SAAS,QACR,OAAO,YAAY,YAClB,oEAAoE;AAAA,IAClE;AAAA,EAAA;AAGR;AAGA,SAAS,sBAAsB,OAAuB;AACpD,MAAI,iBAAiB,SAAS,MAAM,SAAS;AAC3C,WAAO;AACT,QAAM,aAAa,IAAI;AAAA,IACrB,iBAAiB,QAAQ,MAAM,UAAU;AAAA,EAAA;AAE3C,aAAW,OAAO;AAClB,SAAO;AACT;AAYA,SAAS,iBAAiB,KAAgC;AACxD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,OAAO;AACd,WAAO,iBAAiB,QACpB,QACA,IAAI,MAAM,mCAAmC;AAAA,EACnD;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,WAAO,IAAI,MAAM,wCAAwC;AAAA,EAC3D;AACA,QAAM,UAAW,OACd;AACH,MAAI,YAAY,UAAa,CAAC,0BAA0B,IAAI,OAAO,GAAG;AACpE,WAAO,IAAI;AAAA,MACT,8CAA8C,OAAO,OAAO,CAAC;AAAA,IAAA;AAAA,EAEjE;AACA,SAAO;AACT;AAgBA,SAAS,eAAe;AAAA,EACtB,SAAAD;AAAA,EACA;AACF,GAGgB;AACd,SAAO;AAAA,IACL,SAAS,CAAC,QAAQA,SAAQ,QAAQ,GAAG;AAAA,IACrC,SAAS,CAAC,KAAK,UAAUA,SAAQ,QAAQ,KAAK,KAAK;AAAA,IACnD,YAAY,CAAC,QAAQA,SAAQ,WAAW,GAAG;AAAA,IAC3C,YAAY,MACV,MAAM;AAAA,MAAK,EAAE,QAAQA,SAAQ,OAAA;AAAA,MAAU,CAAC,GAAG,UACzCA,SAAQ,IAAI,KAAK;AAAA,IAAA,EACjB,OAAO,CAAC,QAAuB,QAAQ,IAAI;AAAA,IAC/C,YAAY,OAAO,KAAK,WAAW;AACjC,YAAM,MAAM;AAAA,QACV,wBAAwB;AAAA,QACxB,EAAE,aAAa,KAAA;AAAA,QACf,OAAO,WAAW;AAChB,cAAI,WAAW,KAAM;AACrB,gBAAM,MAAM;AAAA,YACV,sBAAsB,IAAI,MAAM,eAAe,MAAM;AAAA,YACrD,EAAE,aAAa,KAAA;AAAA,YACf,OAAO,SAAS;AACd,kBAAI,SAAS,KAAM;AACnB,oBAAM,OAAA;AAAA,YACR;AAAA,UAAA;AAAA,QAEJ;AAAA,MAAA;AAAA,IAEJ;AAAA,EAAA;AAEJ;AA4BO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA;AACF,GAGmC;AAKjC,QAAM,oCAAoB,IAAA;AAE1B,QAAM,8BAAc,IAAA;AAEpB,QAAM,+BAAe,IAAA;AAIrB,QAAM,8BAAc,IAAA;AAIpB,QAAM,WAAW,CAAC,KAAa,QAAmC;AAChE,UAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,QAAI,aAAa,UAAa,SAAS,QAAQ,YAAY,SAAS;AACpE,UAAM,UAAU,iBAAiB,GAAG;AACpC,YAAQ,IAAI,KAAK,EAAE,KAAK,SAAS;AACjC,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,SAAS,CAAC,QAAQ;AAChB,YAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,UAAI,aAAa,OAAW,QAAO;AACnC,UAAI,SAAS,IAAI,GAAG,EAAG,QAAO;AAC9B,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,QAAQ,GAAG;AAAA,MACzB,SAAS,OAAO;AACd,iBAAS,IAAI,GAAG;AAChB,mBAAW,EAAE,WAAW,WAAW,KAAK,OAAO;AAC/C,eAAO;AAAA,MACT;AACA,UAAI,QAAQ,KAAM,QAAO;AACzB,YAAM,aAAa,SAAS,KAAK,GAAG;AACpC,UAAI,eAAe,OAAW,QAAO;AACrC,eAAS,IAAI,GAAG;AAChB,iBAAW,EAAE,WAAW,UAAU,KAAK,OAAO,YAAY;AAC1D,aAAO;AAAA,IACT;AAAA,IACA,SAAS,CAAC,KAAK,UAAU;AACvB,UAAI,SAAS,IAAI,GAAG,GAAG;AACrB,gBAAQ,IAAI,KAAK,KAAK;AACtB;AAAA,MACF;AACA,UAAI;AACF,cAAM,QAAQ,KAAK,KAAK;AACxB,gBAAQ,OAAO,GAAG;AAClB,sBAAc,OAAO,GAAG;AAAA,MAC1B,SAAS,OAAO;AACd,YAAI,oBAAoB,KAAK,KAAK,CAAC,cAAc,IAAI,GAAG,GAAG;AACzD,wBAAc,IAAI,GAAG;AACrB,gBAAM,sBAAsB,KAAK;AAAA,QACnC;AACA,gBAAQ,IAAI,KAAK,KAAK;AACtB,mBAAW,EAAE,WAAW,WAAW,KAAK,OAAO;AAAA,MACjD;AAAA,IACF;AAAA,IACA,YAAY,CAAC,QAAQ;AACnB,cAAQ,OAAO,GAAG;AAClB,UAAI,SAAS,IAAI,GAAG,EAAG;AACvB,UAAI;AACF,cAAM,WAAW,GAAG;AAAA,MACtB,SAAS,OAAO;AACd,mBAAW,EAAE,WAAW,cAAc,KAAK,OAAO;AAAA,MACpD;AAAA,IACF;AAAA,IACA,YAAY,MAAM;AAChB,YAAM,OAAO,IAAI,IAAY,QAAQ,MAAM;AAC3C,UAAI;AACF,mBAAW,OAAO,MAAM,WAAA,EAAc,MAAK,IAAI,GAAG;AAAA,MACpD,SAAS,OAAO;AACd,mBAAW,EAAE,WAAW,cAAc,KAAK,IAAI,OAAO;AAAA,MACxD;AACA,aAAO,CAAC,GAAG,IAAI;AAAA,IACjB;AAAA,IACA,YAAY,OAAO,KAAK,WAAW;AACjC,UAAI;AACF,cAAM,MAAM,WAAW,KAAK,MAAM;AAAA,MACpC,SAAS,OAAO;AACd,mBAAW,EAAE,WAAW,cAAc,KAAK,OAAO;AAAA,MACpD;AAAA,IACF;AAAA,EAAA;AAEJ;AAmBA,MAAM,qCAAqB,QAAA;AAE3B,SAAS,cAAc;AAAA,EACrB,SAAAA;AAAA,EACA;AACF,GAGkB;AAChB,MAAI,SAAS,eAAe,IAAIA,QAAO;AACvC,MAAI,WAAW,QAAW;AACxB,UAAM,gCAAgB,IAAA;AACtB,aAAS;AAAA,MACP;AAAA,MACA,SAAS,qBAAqB;AAAA,QAC5B,OAAO,eAAe,EAAE,SAAAA,UAAS,OAAO;AAAA,QACxC,YAAY,CAAC,gBAAgB;AAC3B,qBAAW,YAAY,UAAW,UAAS,WAAW;AAAA,QACxD;AAAA,MAAA,CACD;AAAA,IAAA;AAEH,mBAAe,IAAIA,UAAS,MAAM;AAAA,EACpC;AACA,SAAO;AACT;AASA,MAAM,kCAAkC,CAAC;AAAA,EACvC;AAAA,EACA,MAAM,CAAC,OAAO;AAAA,EACd,MAAM,IAAI;AAAA,EACV,MAAM;AAAA,EACN;AACF,MAA4E;;AAC1E,QAAMA,YAAU,eAAe;AAC/B,QAAM,SAAQ,oBAAe,cAAf,mBAA0B;AACxC,MAAI,CAACA;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAEJ,MAAI,CAAC;AACH,UAAM,IAAI;AAAA,MACR;AAAA,IAAA;AAEJ,QAAM,aAAa,IAAI,QAAQ;AAC/B,QAAM,aAAa,iBAAiB;AACpC,QAAM,WAAW,sBAAsB;AAEvC,QAAM,mBAAmBE,MAAAA,OAAO,iBAAiB;AACjD,mBAAiB,UAAU;AAC3B,QAAM,oBAAoBC,MAAAA,QAAQ,MAAM;AACtC,UAAM,+BAAe,IAAA;AACrB,WAAO,CAAC,gBAA2C;AACjD,YAAM,UAAU,iBAAiB;AACjC,UAAI,SAAS;AACX,YAAI;AACF,kBAAQ,WAAW;AAAA,QACrB,QAAQ;AAAA,QAGR;AACA;AAAA,MACF;AACA,YAAM,YAAY,GAAG,YAAY,SAAS,IAAI,YAAY,GAAG;AAC7D,UAAI,SAAS,IAAI,SAAS,EAAG;AAC7B,eAAS,IAAI,SAAS;AACtB,cAAQ;AAAA,QACN,wDAAwD,YAAY,SAAS,IAAI,YAAY,GAAG;AAAA,QAChG,YAAY;AAAA,MAAA;AAAA,IAEhB;AAAA,EACF,GAAG,CAAA,CAAE;AAEL,QAAM,SAAS,cAAc,WAAEH,WAAS,OAAO;AAI/C,SAAO,UAAU,IAAI,iBAAiB;AACtCI,QAAAA,UAAU,MAAM;AACd,WAAO,UAAU,IAAI,iBAAiB;AACtC,WAAO,MAAM;AACX,aAAO,UAAU,OAAO,iBAAiB;AAAA,IAC3C;AAAA,EACF,GAAG,CAAC,QAAQ,iBAAiB,CAAC;AAI9BA,QAAAA,UAAU,MAAM;AACd,QAAI;AACJ,QAAI,WAAW;AACf,YAAQ;AAAA,MACN,MAAM;AAAA,QACJ,wBAAwB;AAAA,QACxB,EAAE,MAAM,SAAA;AAAA,QACR,MAAM;AACJ,cAAI,SAAU;AACd,iBAAO,IAAI,QAAc,CAAC,YAAY;AACpC,sBAAU;AAAA,UACZ,CAAC;AAAA,QACH;AAAA,MAAA;AAAA,IACF,EACA;AAAA,MAAM,CAAC,UACP,kBAAkB,EAAE,WAAW,QAAQ,KAAK,YAAY,MAAA,CAAO;AAAA,IAAA;AAEjE,WAAO,MAAM;AACX,iBAAW;AACX;AAAA,IACF;AAAA,EACF,GAAG,CAAC,OAAO,YAAY,iBAAiB,CAAC;AAEzC,QAAM,iBAAiBC,IAAAA;AAAAA,IACrBC,+BAAuB;AAAA,MACrB,SAAS,OAAO;AAAA,MAChB,KAAK;AAAA,MACL,WAAW;AAAA,MACX,UAAUC,mBAAAA;AAAAA,MACV,SAAS,CAAC,QAAQ,YAAY;AAC5B,cAAM,WAAW,gCAAgC,QAAQ,OAAO;AAChE,0BAAkB;AAAA,UAChB,WAAW;AAAA,UACX,KAAK;AAAA,UACL,OAAO,IAAI;AAAA,YACT,GAAG,SAAS,MAAM;AAAA,UAAA;AAAA,QACpB,CACD;AACD,eAAO,SAAS;AAAA,MAClB;AAAA,MACA,WAAW,EAAE,UAAU,KAAK,YAAY,IAAA;AAAA;AAAA;AAAA,MAGxC,SAAS,CAAC,UACR,kBAAkB,EAAE,WAAW,WAAW,KAAK,YAAY,MAAA,CAAO;AAAA,IAAA,CACrE;AAAA,EAAA;AAGH,SAAOJ,MAAAA;AAAAA,IACL,OAAO;AAAA,MACL,GAAG;AAAA,MACH,MAAM,OAAU,OAAyC;AACvD,YAAI,UAAU;AACd,YAAI;AACF,iBAAO,MAAM,MAAM,QAAQ,UAAU,YAAY;AAC/C,sBAAU;AACV,mBAAO,GAAA;AAAA,UACT,CAAC;AAAA,QACH,SAAS,OAAO;AACd,cAAI,QAAS,OAAM;AAInB,4BAAkB,EAAE,WAAW,QAAQ,KAAK,YAAY,OAAO;AAC/D,iBAAO,GAAA;AAAA,QACT;AAAA,MACF;AAAA,MACA,WAAW,CAAC,aAAyB;;AACnC,cAAM,YAAY,CAAC,UAA4B;AAC7C,cAAI,MAAM,QAAQ,WAAY,UAAA;AAAA,QAChC;AACA,SAAAK,MAAA,eAAe,qBAAf,gBAAAA,IAAA,qBAAkC,WAAW;AAC7C,eAAO;;AAAM,kBAAAA,MAAA,eAAe,wBAAf,gBAAAA,IAAA,qBAAqC,WAAW;AAAA;AAAA,MAC/D;AAAA,IAAA;AAAA,IAEF,CAAC,gBAAgB,OAAO,YAAY,UAAU,iBAAiB;AAAA,EAAA;AAEnE;AAGO,MAAM,+BAA+BC,IAAAA;AAAAA,EAC1C;AACF;;;;;;;"}