@creatornader/agent-bridge 0.2.0 → 0.3.1

package/dist/chunk-45BZGB77.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrations.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readdir, readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { PgQueryable } from \"./postgres-bridge-store.js\";\n\nconst MIGRATION_NAME = /^(\\d+)_([a-z0-9_]+)\\.sql$/;\n// Native DR holds this database-local key with pg_advisory_lock. Migration and\n// Agent Bridge membership mutations take the shared transaction form.\nexport const NATIVE_DR_ADVISORY_LOCK_KEY = 1646705664;\nconst REQUIRED_COLUMNS = new Map([\n  [\"workspaces.id\", \"text\"],\n  [\"agents.id\", \"uuid\"],\n  [\"agents.workspace_id\", \"text\"],\n  [\"agents.principal\", \"text\"],\n  [\"credentials.id\", \"uuid\"],\n  [\"credentials.workspace_id\", \"text\"],\n  [\"credentials.agent_id\", \"uuid\"],\n  [\"credentials.token_hash\", \"bpchar\"],\n  [\"credentials.scopes\", \"_text\"],\n  [\"credentials.scope_set_name\", \"text\"],\n  [\"credentials.replaces_credential_id\", \"uuid\"],\n  [\"credentials.revoked_by\", \"text\"],\n  [\"credentials.revocation_reason\", \"text\"],\n  [\"credentials.expiry_grace_until\", \"timestamptz\"],\n  [\"credential_scope_sets.name\", \"text\"],\n  [\"credential_scope_sets.scopes\", \"_text\"],\n  [\"credential_scope_sets.created_at\", \"timestamptz\"],\n  [\"security_events.sequence\", \"int8\"],\n  [\"security_events.event_id\", \"uuid\"],\n  [\"security_events.event_type\", \"text\"],\n  [\"security_events.outcome\", \"text\"],\n  [\"security_events.reason_code\", \"text\"],\n  [\"security_events.workspace_id\", \"text\"],\n  [\"security_events.principal\", \"text\"],\n  [\"security_events.actor_principal\", \"text\"],\n  [\"security_events.credential_id\", \"uuid\"],\n  [\"security_events.related_credential_id\", \"uuid\"],\n  [\"security_events.operation_id\", \"text\"],\n  [\"security_events.request_id\", \"uuid\"],\n  [\"security_events.policy_id\", \"text\"],\n  [\"security_events.retry_after_seconds\", \"int4\"],\n  [\"security_events.created_at\", \"timestamptz\"],\n  [\"rate_limit_policies.policy_id\", \"text\"],\n  [\"rate_limit_policies.operation_id\", \"text\"],\n  [\"rate_limit_policies.capacity\", \"int4\"],\n  [\"rate_limit_policies.refill_per_second\", \"numeric\"],\n  [\"rate_limit_policies.enabled\", \"bool\"],\n  [\"rate_limit_buckets.credential_id\", \"uuid\"],\n  [\"rate_limit_buckets.policy_id\", \"text\"],\n  [\"rate_limit_buckets.tokens\", \"numeric\"],\n  [\"rate_limit_buckets.updated_at\", \"timestamptz\"],\n  [\"request_authorities.backend_pid\", \"int4\"],\n  [\"request_authorities.transaction_id\", \"xid8\"],\n  [\"request_authorities.request_id\", \"uuid\"],\n  [\"request_authorities.credential_id\", \"uuid\"],\n  [\"request_authorities.workspace_id\", \"text\"],\n  [\"request_authorities.principal\", \"text\"],\n  [\"request_authorities.scopes\", \"_text\"],\n  [\"request_authorities.opened_session_user\", \"name\"],\n  [\"row_isolation_attestations.name\", \"text\"],\n  [\"row_isolation_attestations.catalog_definition\", \"text\"],\n  [\"row_isolation_attestations.attested_at\", \"timestamptz\"],\n  [\"control_requests.request_id\", \"uuid\"],\n  [\"control_requests.operation\", \"text\"],\n  [\"control_requests.fingerprint\", \"bpchar\"],\n  [\"control_requests.actor\", \"name\"],\n  [\"control_requests.result\", \"jsonb\"],\n  [\"control_requests.created_at\", \"timestamptz\"],\n  [\"control_events.sequence\", \"int8\"],\n  [\"control_events.event_id\", \"uuid\"],\n  [\"control_events.request_id\", \"uuid\"],\n  [\"control_events.operation\", \"text\"],\n  [\"control_events.outcome\", \"text\"],\n  [\"control_events.actor\", \"name\"],\n  [\"control_events.workspace_id\", \"text\"],\n  [\"control_events.principal\", \"text\"],\n  [\"control_events.credential_id\", \"uuid\"],\n  [\"control_events.related_credential_id\", \"uuid\"],\n  [\"control_events.reason_code\", \"text\"],\n  [\"control_events.created_at\", \"timestamptz\"],\n  [\"owner_control_attestations.name\", \"text\"],\n  [\"owner_control_attestations.catalog_definition\", \"text\"],\n  [\"owner_control_attestations.attested_at\", \"timestamptz\"],\n  [\"control_membership_events.sequence\", \"int8\"],\n  [\"control_membership_events.request_id\", \"uuid\"],\n  [\"control_membership_events.action\", \"text\"],\n  [\"control_membership_events.member_role\", \"name\"],\n  [\"control_membership_events.control_role\", \"text\"],\n  [\"control_membership_events.actor\", \"name\"],\n  [\"control_membership_events.created_at\", \"timestamptz\"],\n  [\"archive_membership_events.sequence\", \"int8\"],\n  [\"archive_membership_events.request_id\", \"uuid\"],\n  [\"archive_membership_events.action\", \"text\"],\n  [\"archive_membership_events.member_role\", \"name\"],\n  [\"archive_membership_events.actor\", \"name\"],\n  [\"archive_membership_events.created_at\", \"timestamptz\"],\n  [\"archive_operations.sequence\", \"int8\"],\n  [\"archive_operations.request_id\", \"uuid\"],\n  [\"archive_operations.phase\", \"text\"],\n  [\"archive_operations.operation\", \"text\"],\n  [\"archive_operations.workspace\", \"text\"],\n  [\"archive_operations.client_verified_digest\", \"bpchar\"],\n  [\"archive_operations.message_count\", \"int8\"],\n  [\"archive_operations.receipt_count\", \"int8\"],\n  [\"archive_operations.message_inserted_count\", \"int8\"],\n  [\"archive_operations.receipt_inserted_count\", \"int8\"],\n  [\"archive_operations.server_content_binding\", \"bpchar\"],\n  [\"archive_operations.outcome\", \"text\"],\n  [\"archive_operations.failure_code\", \"text\"],\n  [\"archive_operations.published_at\", \"timestamptz\"],\n  [\"archive_operations.apply\", \"bool\"],\n  [\"archive_operations.actor\", \"name\"],\n  [\"archive_operations.created_at\", \"timestamptz\"],\n  [\"archive_operation_batches.sequence\", \"int8\"],\n  [\"archive_operation_batches.request_id\", \"uuid\"],\n  [\"archive_operation_batches.record_kind\", \"text\"],\n  [\"archive_operation_batches.batch_ordinal\", \"int8\"],\n  [\"archive_operation_batches.record_count\", \"int8\"],\n  [\"archive_operation_batches.batch_fingerprint\", \"bpchar\"],\n  [\"archive_operation_batches.chain_binding\", \"bpchar\"],\n  [\"archive_operation_batches.actor\", \"name\"],\n  [\"archive_operation_batches.created_at\", \"timestamptz\"],\n  [\"archive_import_records.sequence\", \"int8\"],\n  [\"archive_import_records.request_id\", \"uuid\"],\n  [\"archive_import_records.record_kind\", \"text\"],\n  [\"archive_import_records.record_key\", \"text\"],\n  [\"archive_import_records.batch_ordinal\", \"int8\"],\n  [\"archive_import_records.semantic_fingerprint\", \"bpchar\"],\n  [\"archive_import_records.inserted\", \"bool\"],\n  [\"archive_import_records.actor\", \"name\"],\n  [\"archive_import_records.created_at\", \"timestamptz\"],\n  [\"archive_transaction_authorizations.backend_pid\", \"int4\"],\n  [\"archive_transaction_authorizations.transaction_id\", \"text\"],\n  [\"archive_transaction_authorizations.request_id\", \"uuid\"],\n  [\"archive_transaction_authorizations.operation\", \"text\"],\n  [\"archive_transaction_authorizations.workspace\", \"text\"],\n  [\"archive_transaction_authorizations.client_verified_digest\", \"bpchar\"],\n  [\"archive_transaction_authorizations.actor\", \"name\"],\n  [\"archive_transaction_authorizations.messages_consumed\", \"bool\"],\n  [\"archive_transaction_authorizations.receipts_consumed\", \"bool\"],\n  [\"archive_transaction_authorizations.created_at\", \"timestamptz\"],\n  [\"portable_archive_attestations.name\", \"text\"],\n  [\"portable_archive_attestations.catalog_definition\", \"text\"],\n  [\"portable_archive_attestations.attested_at\", \"timestamptz\"],\n  [\"messages.sequence\", \"int8\"],\n  [\"messages.id\", \"uuid\"],\n  [\"messages.workspace\", \"text\"],\n  [\"messages.project\", \"text\"],\n  [\"messages.source\", \"text\"],\n  [\"messages.targets\", \"jsonb\"],\n  [\"messages.delivery_mode\", \"text\"],\n  [\"messages.delivery_max_attempts\", \"int4\"],\n  [\"messages.delivery_retry_base_delay_ms\", \"int4\"],\n  [\"messages.delivery_retry_max_delay_ms\", \"int4\"],\n  [\"messages.delivery_retry_jitter_ratio\", \"float8\"],\n  [\"messages.delivery_not_before\", \"timestamptz\"],\n  [\"receipts.workspace\", \"text\"],\n  [\"receipts.message_id\", \"uuid\"],\n  [\"receipts.principal\", \"text\"],\n  [\"deliveries.id\", \"uuid\"],\n  [\"deliveries.message_id\", \"uuid\"],\n  [\"deliveries.workspace\", \"text\"],\n  [\"deliveries.publisher\", \"text\"],\n  [\"deliveries.recipient\", \"text\"],\n  [\"deliveries.state\", \"text\"],\n  [\"deliveries.lease_token\", \"uuid\"],\n  [\"deliveries.created_at\", \"timestamptz\"],\n  [\"deliveries.priority_rank\", \"int2\"],\n  [\"deliveries.cycle_attempt\", \"int4\"],\n  [\"deliveries.requeue_count\", \"int4\"],\n  [\"deliveries.last_actor\", \"text\"],\n  [\"deliveries.last_action\", \"text\"],\n  [\"delivery_events.delivery_id\", \"uuid\"],\n  [\"delivery_events.publisher\", \"text\"],\n  [\"delivery_events.to_state\", \"text\"],\n  [\"delivery_events.cycle_attempt\", \"int4\"],\n  [\"delivery_events.requeue_count\", \"int4\"],\n  [\"delivery_events.actor\", \"text\"],\n  [\"delivery_events.action\", \"text\"],\n  [\"agent_instances.workspace\", \"text\"],\n  [\"agent_instances.instance\", \"text\"],\n  [\"agent_instances.capabilities\", \"jsonb\"],\n]);\n\nexport interface AppliedMigration {\n  version: number;\n  name: string;\n  checksum: string;\n}\n\nexport interface MigrationPlanEntry extends AppliedMigration {\n  source: string;\n}\n\nexport const REQUIRED_MIGRATIONS = [\n  { version: 1, name: \"schema_state\" },\n  { version: 2, name: \"workspaces_agents_credentials\" },\n  { version: 3, name: \"messages_receipts_deliveries\" },\n  { version: 4, name: \"message_query_indexes\" },\n  { version: 5, name: \"delivery_events_presence\" },\n  { version: 6, name: \"legacy_shared_context_import\" },\n  { version: 7, name: \"runtime_role\" },\n  { version: 8, name: \"message_projects\" },\n  { version: 9, name: \"mailbox_query_indexes\" },\n  { version: 10, name: \"publisher_delivery_policy\" },\n  { version: 11, name: \"credential_security\" },\n  { version: 12, name: \"request_authority\" },\n  { version: 13, name: \"row_isolation\" },\n  { version: 14, name: \"owner_control_plane\" },\n  { version: 15, name: \"portable_archives\" },\n  { version: 16, name: \"native_dr_fence\" },\n] as const;\n\nfunction withNativeDrSharedLock(source: string): string {\n  if (!/^begin;\\s/i.test(source)) {\n    throw new Error(\"migration must begin with an explicit transaction\");\n  }\n  return source.replace(\n    /^begin;\\s/i,\n    `begin;\\n\\nselect pg_advisory_xact_lock_shared(${NATIVE_DR_ADVISORY_LOCK_KEY});\\n\\n`,\n  );\n}\n\nfunction checksum(source: string): string {\n  return createHash(\"sha256\").update(source, \"utf8\").digest(\"hex\");\n}\n\nasync function recordedMigrations(db: PgQueryable): Promise<AppliedMigration[]> {\n  const exists = await db.query<{ table_name: string | null }>(\n    \"SELECT to_regclass('agent_bridge.schema_migrations')::text AS table_name\",\n  );\n  if (!exists.rows[0]?.table_name) return [];\n  const result = await db.query<{ version: number; name: string; checksum: string }>(\n    \"SELECT version, name, checksum FROM agent_bridge.schema_migrations ORDER BY version\",\n  );\n  return result.rows.map((row) => ({\n    version: Number(row.version),\n    name: row.name,\n    checksum: row.checksum,\n  }));\n}\n\nexport async function loadMigrationPlan(directory: string): Promise<MigrationPlanEntry[]> {\n  const files = (await readdir(directory))\n    .filter((file) => MIGRATION_NAME.test(file))\n    .sort((left, right) => left.localeCompare(right));\n  const expected = await Promise.all(files.map(async (file) => {\n    const match = file.match(MIGRATION_NAME)!;\n    const source = await readFile(join(directory, file), \"utf8\");\n    return { version: Number(match[1]), name: match[2], source, checksum: checksum(source) };\n  }));\n\n  if (\n    expected.length !== REQUIRED_MIGRATIONS.length ||\n    !expected.every(\n      (migration, index) =>\n        migration.version === REQUIRED_MIGRATIONS[index]?.version &&\n        migration.name === REQUIRED_MIGRATIONS[index]?.name,\n    )\n  ) {\n    throw new Error(\"migration directory does not match the required migration sequence\");\n  }\n  return expected;\n}\n\nexport async function migrationsReady(\n  db: PgQueryable,\n  expected: ReadonlyArray<Pick<MigrationPlanEntry, \"version\" | \"name\" | \"checksum\">>,\n): Promise<boolean> {\n  const applied = await recordedMigrations(db);\n  return expected.every(\n    (required, index) =>\n      applied[index]?.version === required.version &&\n      applied[index]?.name === required.name &&\n      applied[index]?.checksum === required.checksum,\n  ) && applied.length === expected.length;\n}\n\nexport async function rowIsolationReady(db: PgQueryable, allowPrivilegedCaller: boolean): Promise<boolean> {\n  const result = await db.query<{\n    rolesReady: boolean;\n    callerReady: boolean;\n    callerBypasses: boolean;\n    ownershipReady: boolean;\n    policiesReady: boolean;\n    functionsReady: boolean;\n    constraintsReady: boolean;\n    triggersReady: boolean;\n    grantsReady: boolean;\n    catalogReady: boolean;\n  }>(`WITH names AS (\n      SELECT\n        ('agent_bridge_runtime_' || substr(md5(current_database()),1,16))::name AS runtime_role,\n        ('agent_bridge_data_owner_' || substr(md5(current_database()),1,16))::name AS data_owner,\n        ('agent_bridge_context_reader_' || substr(md5(current_database()),1,16))::name AS context_reader,\n        ('agent_bridge_event_writer_' || substr(md5(current_database()),1,16))::name AS event_writer\n    ), required_roles(role_name) AS (\n      SELECT runtime_role FROM names UNION ALL SELECT data_owner FROM names\n      UNION ALL SELECT context_reader FROM names UNION ALL SELECT event_writer FROM names\n    ), domain_tables(table_name) AS (\n      VALUES ('messages'),('receipts'),('deliveries'),('delivery_events'),('agent_instances')\n    ), caller_role AS (\n      SELECT * FROM pg_roles WHERE rolname=current_user\n    ), expected_policies(table_name,policy_name,command_name,role_name,needs_workspace,needs_principal) AS (\n      SELECT 'messages','messages_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'messages','messages_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'messages','messages_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'receipts','receipts_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'receipts','receipts_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'receipts','receipts_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_update','w',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_writer_insert','a',event_writer::text,false,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_select','r',runtime_role::text,true,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_update','w',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_delete','d',runtime_role::text,true,true FROM names\n    ), actual_policies AS (\n      SELECT relation.relname AS table_name,policy.polname AS policy_name,\n        policy.polcmd AS command_name,policy.polpermissive,\n        ARRAY(SELECT role.rolname::text FROM unnest(policy.polroles) member(oid)\n          JOIN pg_roles role ON role.oid=member.oid ORDER BY role.rolname) AS role_names,\n        coalesce(pg_get_expr(policy.polqual,policy.polrelid),'') || ' ' ||\n          coalesce(pg_get_expr(policy.polwithcheck,policy.polrelid),'') AS expressions\n      FROM pg_policy policy\n      JOIN pg_class relation ON relation.oid=policy.polrelid\n      JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n      WHERE namespace.nspname='agent_bridge'\n        AND relation.relname IN (SELECT table_name FROM domain_tables)\n    )\n    SELECT\n      (SELECT count(*)=4 AND bool_and(\n          role.rolname=(required.role_name::text)\n          AND NOT role.rolcanlogin AND NOT role.rolsuper AND NOT role.rolcreatedb\n          AND NOT role.rolcreaterole AND NOT role.rolreplication AND NOT role.rolbypassrls\n        )\n       FROM required_roles required JOIN pg_roles role ON role.rolname=required.role_name::text) AS \"rolesReady\",\n      ((SELECT rolsuper OR rolbypassrls FROM caller_role) OR (\n        (SELECT rolcanlogin AND rolinherit AND NOT rolsuper AND NOT rolcreatedb\n           AND NOT rolcreaterole AND NOT rolreplication AND NOT rolbypassrls\n         FROM caller_role)\n        AND pg_has_role(current_user,(SELECT runtime_role FROM names),'MEMBER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_roles unexpected\n          WHERE unexpected.oid<>(SELECT oid FROM caller_role)\n            AND unexpected.rolname<>(SELECT runtime_role::text FROM names)\n            AND pg_has_role(current_user,unexpected.oid,'MEMBER')\n        )\n      )) AS \"callerReady\",\n      EXISTS (\n        SELECT 1 FROM pg_roles elevated\n        WHERE (elevated.rolsuper OR elevated.rolbypassrls)\n          AND pg_has_role(current_user,elevated.oid,'MEMBER')\n      ) AS \"callerBypasses\",\n      (SELECT count(*)=5 AND bool_and(\n          relation.relrowsecurity AND relation.relforcerowsecurity\n          AND owner.rolname=(SELECT data_owner::text FROM names)\n        )\n       FROM domain_tables required\n       JOIN pg_namespace namespace ON namespace.nspname='agent_bridge'\n       JOIN pg_class relation ON relation.relnamespace=namespace.oid AND relation.relname=required.table_name\n       JOIN pg_roles owner ON owner.oid=relation.relowner)\n        AND EXISTS (\n          SELECT 1 FROM pg_class attestation\n          JOIN pg_namespace namespace ON namespace.oid=attestation.relnamespace\n          WHERE namespace.nspname='agent_bridge'\n            AND attestation.relname='row_isolation_attestations'\n            AND attestation.relowner=namespace.nspowner\n        ) AS \"ownershipReady\",\n      ((SELECT count(*) FROM actual_policies)=18 AND NOT EXISTS (\n        SELECT 1 FROM expected_policies expected\n        LEFT JOIN actual_policies actual\n          ON actual.table_name=expected.table_name AND actual.policy_name=expected.policy_name\n        WHERE actual.policy_name IS NULL OR actual.command_name<>expected.command_name\n          OR NOT actual.polpermissive OR actual.role_names<>ARRAY[expected.role_name]\n          OR (expected.needs_workspace AND position('current_request_workspace' in actual.expressions)=0)\n          OR (expected.needs_principal AND position('current_request_principal' in actual.expressions)=0)\n          OR (NOT expected.needs_workspace AND NOT expected.needs_principal\n            AND position('true' in actual.expressions)=0)\n      )) AS \"policiesReady\",\n      (SELECT count(*)=4 AND bool_and(\n          procedure.proconfig @> ARRAY['search_path=\"\"']::text[]\n          AND CASE procedure.proname\n            WHEN 'record_delivery_event' THEN owner.rolname=(SELECT event_writer::text FROM names)\n              AND procedure.prosecdef AND procedure.provolatile='v'\n            WHEN 'row_isolation_catalog_definition' THEN\n              owner.oid=(SELECT relation.relowner FROM pg_class relation\n                JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n                WHERE namespace.nspname='agent_bridge'\n                  AND relation.relname='row_isolation_attestations')\n              AND NOT procedure.prosecdef AND procedure.provolatile='s'\n            ELSE owner.rolname=(SELECT context_reader::text FROM names)\n              AND procedure.prosecdef AND procedure.provolatile='s'\n          END\n        )\n       FROM pg_proc procedure\n       JOIN pg_namespace namespace ON namespace.oid=procedure.pronamespace\n       JOIN pg_roles owner ON owner.oid=procedure.proowner\n       WHERE namespace.nspname='agent_bridge'\n         AND procedure.proname IN (\n           'current_request_workspace','current_request_principal',\n           'record_delivery_event','row_isolation_catalog_definition'\n         ))\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_proc private_function\n          JOIN pg_namespace private_namespace ON private_namespace.oid=private_function.pronamespace\n          WHERE private_namespace.nspname='agent_bridge'\n            AND has_function_privilege('public',private_function.oid,'EXECUTE')\n        )\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.current_request_workspace()','EXECUTE')\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.current_request_principal()','EXECUTE')\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_catalog_definition()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_delivery_event()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.reject_delivery_identity_mutation()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.enforce_delivery_actor_role()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.reject_delivery_event_mutation()','EXECUTE')\n        AS \"functionsReady\",\n      ((SELECT count(*)=5 AND bool_and(constraint_record.convalidated)\n       FROM (VALUES\n          ('agent_bridge.messages'::regclass,'messages_workspace_id_source_unique'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_publisher_message_fk'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_event_identity_unique'),\n          ('agent_bridge.delivery_events'::regclass,'delivery_events_delivery_publisher_fk'),\n          ('agent_bridge.row_isolation_attestations'::regclass,'row_isolation_attestation_name')\n       ) required(relation_id,constraint_name)\n       JOIN pg_constraint constraint_record\n         ON constraint_record.conrelid=required.relation_id\n        AND constraint_record.conname=required.constraint_name)\n        AND (SELECT count(*)=2 AND bool_and(attribute.attnotnull)\n          FROM pg_attribute attribute\n          WHERE (attribute.attrelid,attribute.attname) IN (\n            ('agent_bridge.deliveries'::regclass,'publisher'),\n            ('agent_bridge.delivery_events'::regclass,'publisher')\n          ) AND attribute.attnum>0 AND NOT attribute.attisdropped)\n      ) AS \"constraintsReady\",\n      (SELECT count(*)=4 AND bool_and(trigger.tgenabled='O')\n       FROM (VALUES\n          ('agent_bridge.deliveries'::regclass,'deliveries_record_event'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_identity_immutable'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_actor_role'),\n          ('agent_bridge.delivery_events'::regclass,'delivery_events_append_only')\n       ) required(relation_id,trigger_name)\n       JOIN pg_trigger trigger ON trigger.tgrelid=required.relation_id\n        AND trigger.tgname=required.trigger_name AND NOT trigger.tgisinternal) AS \"triggersReady\",\n      (has_schema_privilege((SELECT runtime_role FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT runtime_role FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT data_owner FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT data_owner FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT context_reader FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT context_reader FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT event_writer FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT event_writer FROM names),'agent_bridge','CREATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','INSERT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','INSERT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','INSERT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','UPDATE')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events','SELECT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','INSERT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','UPDATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','DELETE')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','TRUNCATE,REFERENCES,TRIGGER')\n        AND has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.messages_sequence_seq','USAGE')\n        AND NOT has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.messages_sequence_seq','SELECT,UPDATE')\n        AND NOT has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events_sequence_seq','USAGE,SELECT,UPDATE')\n        AND has_table_privilege((SELECT context_reader FROM names),'agent_bridge.request_authorities','SELECT')\n        AND NOT has_table_privilege((SELECT context_reader FROM names),'agent_bridge.request_authorities','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events','INSERT')\n        AND NOT has_table_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events','SELECT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_class relation\n          JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n          WHERE namespace.nspname='agent_bridge' AND relation.relkind IN ('r','p','v','m','f')\n            AND (\n              (relation.relname<>'request_authorities' AND has_table_privilege(\n                (SELECT context_reader FROM names),relation.oid,\n                'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER'\n              ))\n              OR (relation.relname<>'delivery_events' AND has_table_privilege(\n                (SELECT event_writer FROM names),relation.oid,\n                'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER'\n              ))\n            )\n        )\n        AND has_sequence_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events_sequence_seq','USAGE')\n        AND NOT has_sequence_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events_sequence_seq','SELECT,UPDATE')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_class sequence\n          JOIN pg_namespace namespace ON namespace.oid=sequence.relnamespace\n          WHERE namespace.nspname='agent_bridge' AND sequence.relkind='S'\n            AND (\n              has_sequence_privilege((SELECT context_reader FROM names),sequence.oid,'USAGE,SELECT,UPDATE')\n              OR (sequence.relname<>'delivery_events_sequence_seq' AND has_sequence_privilege(\n                (SELECT event_writer FROM names),sequence.oid,'USAGE,SELECT,UPDATE'\n              ))\n            )\n        )\n        AND NOT has_sequence_privilege('public','agent_bridge.messages_sequence_seq','USAGE,SELECT,UPDATE')\n        AND NOT has_sequence_privilege('public','agent_bridge.delivery_events_sequence_seq','USAGE,SELECT,UPDATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_attestations','SELECT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_attestations','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT EXISTS (\n          SELECT 1\n          FROM unnest(ARRAY[\n            'agent_bridge.credentials','agent_bridge.agents',\n            'agent_bridge.workspaces','agent_bridge.request_authorities'\n          ]) protected_table(value)\n          CROSS JOIN unnest(ARRAY[\n            'SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER'\n          ]) requested_privilege(value)\n          WHERE has_table_privilege(\n            (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n          )\n        )\n        AND NOT EXISTS (\n          SELECT 1\n          FROM unnest(ARRAY[\n            'agent_bridge.credentials','agent_bridge.agents',\n            'agent_bridge.workspaces','agent_bridge.request_authorities'\n          ]) protected_table(value)\n          CROSS JOIN unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) requested_privilege(value)\n          WHERE has_any_column_privilege(\n            (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n          )\n        )\n        AND NOT has_table_privilege('public','agent_bridge.row_isolation_attestations','SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT data_owner FROM names),'MEMBER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT context_reader FROM names),'MEMBER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT event_writer FROM names),'MEMBER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_proc private_function\n          JOIN pg_namespace namespace ON namespace.oid=private_function.pronamespace\n          WHERE namespace.nspname='agent_bridge'\n            AND (\n              (NOT (private_function.proname IN ('current_request_workspace','current_request_principal')\n                    AND private_function.pronargs=0)\n                AND has_function_privilege((SELECT context_reader FROM names),private_function.oid,'EXECUTE'))\n              OR (NOT (private_function.proname='record_delivery_event' AND private_function.pronargs=0)\n                AND has_function_privilege((SELECT event_writer FROM names),private_function.oid,'EXECUTE'))\n            )\n        )\n      ) AS \"grantsReady\",\n      (SELECT count(*)=1 AND bool_and(\n          attestation.catalog_definition=agent_bridge.row_isolation_catalog_definition()\n        )\n       FROM agent_bridge.row_isolation_attestations attestation\n       WHERE attestation.name='domain-v1') AS \"catalogReady\"\n  `);\n  const row = result.rows[0];\n  const callerReady = row?.callerReady && (allowPrivilegedCaller || !row.callerBypasses);\n  return Boolean(\n    row?.rolesReady && callerReady && row.ownershipReady && row.policiesReady &&\n    row.functionsReady && row.constraintsReady && row.triggersReady && row.grantsReady && row.catalogReady\n  );\n}\n\nexport async function runtimeSchemaReady(\n  db: PgQueryable,\n  options: { allowPrivilegedCaller?: boolean } = {},\n): Promise<boolean> {\n  const columns = await db.query<{ table_name: string; column_name: string; udt_name: string }>(\n    `SELECT relation.relname AS table_name, attribute.attname AS column_name,\n       type.typname AS udt_name\n     FROM pg_catalog.pg_attribute attribute\n     JOIN pg_catalog.pg_class relation ON relation.oid=attribute.attrelid\n     JOIN pg_catalog.pg_namespace namespace ON namespace.oid=relation.relnamespace\n     JOIN pg_catalog.pg_type type ON type.oid=attribute.atttypid\n     WHERE namespace.nspname='agent_bridge'\n       AND attribute.attnum>0 AND NOT attribute.attisdropped`,\n  );\n  const actual = new Map(\n    columns.rows.map((row) => [`${row.table_name}.${row.column_name}`, row.udt_name]),\n  );\n  if ([...REQUIRED_COLUMNS].some(([name, type]) => actual.get(name) !== type)) return false;\n\n  const objects = await db.query<{ immutable: boolean; deliveryAudit: boolean; idempotency: boolean; claim: boolean; publisher: boolean; terminal: boolean; source: boolean; thread: boolean; created: boolean; presence: boolean; project: boolean; targets: boolean; scopeSets: boolean; securityEvents: boolean; ratePolicies: boolean; rateBuckets: boolean; replacement: boolean; rateCleanup: boolean; credentialSecurity: boolean; eventAppendOnly: boolean; scopeAudit: boolean; rateConsume: boolean; securityReady: boolean; requestAuthorities: boolean; authorityOpen: boolean; authorityClose: boolean; credentialDigestHidden: boolean; authorityRowsHidden: boolean; principalTablesHidden: boolean; authorityTablesLocked: boolean; authorityCatalog: boolean }>(\n    `WITH names AS (\n       SELECT ('agent_bridge_runtime_' || substr(md5(current_database()),1,16))::name AS runtime_role\n     ) SELECT\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid='agent_bridge.messages'::regclass\n           AND tgname='messages_immutable' AND NOT tgisinternal\n       ) AS immutable,\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid='agent_bridge.deliveries'::regclass\n           AND tgname='deliveries_record_event' AND NOT tgisinternal\n       ) AS \"deliveryAudit\",\n       to_regclass('agent_bridge.messages_idempotency') IS NOT NULL AS idempotency,\n       to_regclass('agent_bridge.deliveries_claim') IS NOT NULL AS claim,\n       to_regclass('agent_bridge.deliveries_publisher_lookup') IS NOT NULL AS publisher,\n       to_regclass('agent_bridge.deliveries_terminal_lookup') IS NOT NULL AS terminal,\n       to_regclass('agent_bridge.messages_source') IS NOT NULL AS source,\n       to_regclass('agent_bridge.messages_thread') IS NOT NULL AS thread,\n       to_regclass('agent_bridge.messages_created') IS NOT NULL AS created,\n       to_regclass('agent_bridge.messages_project') IS NOT NULL AS project,\n       to_regclass('agent_bridge.messages_targets_gin') IS NOT NULL AS targets,\n       to_regclass('agent_bridge.agent_instances_active') IS NOT NULL AS presence,\n       to_regclass('agent_bridge.credential_scope_sets') IS NOT NULL AS \"scopeSets\",\n       to_regclass('agent_bridge.security_events') IS NOT NULL AS \"securityEvents\",\n       to_regclass('agent_bridge.rate_limit_policies') IS NOT NULL AS \"ratePolicies\",\n       to_regclass('agent_bridge.rate_limit_buckets') IS NOT NULL AS \"rateBuckets\",\n       to_regclass('agent_bridge.credentials_replacement_lineage') IS NOT NULL AS replacement,\n       to_regclass('agent_bridge.rate_limit_buckets_cleanup') IS NOT NULL AS \"rateCleanup\",\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid=to_regclass('agent_bridge.credentials')\n           AND tgname='credentials_validate_security' AND NOT tgisinternal\n       ) AS \"credentialSecurity\",\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid=to_regclass('agent_bridge.security_events')\n           AND tgname='security_events_append_only' AND NOT tgisinternal\n       ) AS \"eventAppendOnly\",\n       to_regprocedure('agent_bridge.record_scope_denial(uuid,text,uuid)') IS NOT NULL AS \"scopeAudit\",\n       to_regprocedure('agent_bridge.consume_rate_limit(uuid,text,uuid)') IS NOT NULL AS \"rateConsume\",\n       to_regprocedure('agent_bridge.security_schema_ready()') IS NOT NULL AS \"securityReady\",\n       to_regclass('agent_bridge.request_authorities') IS NOT NULL AS \"requestAuthorities\",\n       to_regprocedure('agent_bridge.open_request_authority(uuid,text,uuid)') IS NOT NULL\n         AND to_regprocedure('agent_bridge.resolve_credential_hash(text)') IS NOT NULL AS \"authorityOpen\",\n       to_regprocedure('agent_bridge.close_request_authority()') IS NOT NULL AS \"authorityClose\",\n       NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.credentials','SELECT') AS \"credentialDigestHidden\",\n       NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.request_authorities','SELECT') AS \"authorityRowsHidden\",\n       (NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agents','SELECT')\n         AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.workspaces','SELECT')) AS \"principalTablesHidden\",\n       (\n         NOT EXISTS (\n           SELECT 1\n           FROM unnest(ARRAY[\n             'agent_bridge.credentials','agent_bridge.agents',\n             'agent_bridge.workspaces','agent_bridge.request_authorities'\n           ]) protected_table(value)\n           CROSS JOIN unnest(ARRAY[\n             'SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER'\n           ]) requested_privilege(value)\n           WHERE has_table_privilege(\n             (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n           )\n         )\n         AND NOT EXISTS (\n           SELECT 1\n           FROM unnest(ARRAY[\n             'agent_bridge.credentials','agent_bridge.agents',\n             'agent_bridge.workspaces','agent_bridge.request_authorities'\n           ]) protected_table(value)\n           CROSS JOIN unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) requested_privilege(value)\n           WHERE has_any_column_privilege(\n             (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n           )\n         )\n       ) AS \"authorityTablesLocked\",\n       (\n         has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.resolve_credential_hash(text)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.open_request_authority(uuid,text,uuid)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.close_request_authority()','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_scope_denial(uuid,text,uuid)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.consume_rate_limit(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.active_request_authority()','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.assert_active_request_credential(uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_scope_denial_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.consume_rate_limit_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.resolve_credential_hash(text)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.open_request_authority(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.close_request_authority()','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.record_scope_denial(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.consume_rate_limit(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.record_scope_denial_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.consume_rate_limit_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT EXISTS (\n           SELECT 1 FROM pg_proc procedure\n           JOIN pg_namespace namespace ON namespace.oid=procedure.pronamespace\n           WHERE namespace.nspname='agent_bridge'\n             AND procedure.proname IN (\n               'resolve_credential_hash','open_request_authority','active_request_authority',\n               'assert_active_request_credential','close_request_authority','record_scope_denial',\n               'consume_rate_limit','record_scope_denial_unbound_011','consume_rate_limit_unbound_011'\n             )\n             AND (\n               NOT procedure.prosecdef\n               OR procedure.proowner <> (SELECT nspowner FROM pg_namespace WHERE nspname='agent_bridge')\n               OR NOT coalesce(procedure.proconfig @> ARRAY['search_path=\"\"'],false)\n             )\n         )\n       ) AS \"authorityCatalog\"`,\n  );\n  const row = objects.rows[0];\n  if (!Boolean(\n    row?.immutable && row.deliveryAudit && row.idempotency && row.claim && row.publisher &&\n    row.terminal && row.source && row.thread && row.created && row.presence && row.project &&\n    row.targets && row.scopeSets && row.securityEvents && row.ratePolicies && row.rateBuckets &&\n    row.replacement && row.rateCleanup && row.credentialSecurity && row.eventAppendOnly &&\n    row.scopeAudit && row.rateConsume && row.securityReady && row.requestAuthorities &&\n    row.authorityOpen && row.authorityClose && row.credentialDigestHidden && row.authorityRowsHidden &&\n    row.principalTablesHidden && row.authorityTablesLocked && row.authorityCatalog\n  )) return false;\n  try {\n    const security = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.security_schema_ready() AS ready\",\n    );\n    const ownerControl = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.owner_control_plane_ready() AS ready\",\n    );\n    const portableArchive = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.portable_archive_ready() AS ready\",\n    );\n    return security.rows[0]?.ready === true && ownerControl.rows[0]?.ready === true &&\n      portableArchive.rows[0]?.ready === true && await rowIsolationReady(\n      db,\n      options.allowPrivilegedCaller === true,\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport async function runMigrations(\n  db: PgQueryable,\n  directory: string,\n): Promise<AppliedMigration[]> {\n  const expected = await loadMigrationPlan(directory);\n\n  for (const migration of expected) {\n    const applied = await recordedMigrations(db);\n    const recorded = applied.find((entry) => entry.version === migration.version);\n    if (recorded) {\n      if (recorded.name !== migration.name || recorded.checksum !== migration.checksum) {\n        throw new Error(`migration ${migration.version}_${migration.name} conflicts with schema state`);\n      }\n      continue;\n    }\n    await db.query(withNativeDrSharedLock(\n      migration.source.split(\"__AGENT_BRIDGE_MIGRATION_CHECKSUM__\").join(migration.checksum),\n    ));\n    const verified = (await recordedMigrations(db)).find(\n      (entry) => entry.version === migration.version,\n    );\n    if (verified?.name !== migration.name || verified.checksum !== migration.checksum) {\n      throw new Error(`migration ${migration.version}_${migration.name} was not recorded correctly`);\n    }\n  }\n\n  return recordedMigrations(db);\n}\n"],"mappings":";;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS,gBAAgB;AAClC,SAAS,YAAY;AAGrB,IAAM,iBAAiB;AAGhB,IAAM,8BAA8B;AAC3C,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B,CAAC,iBAAiB,MAAM;AAAA,EACxB,CAAC,aAAa,MAAM;AAAA,EACpB,CAAC,uBAAuB,MAAM;AAAA,EAC9B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,kBAAkB,MAAM;AAAA,EACzB,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,0BAA0B,QAAQ;AAAA,EACnC,CAAC,sBAAsB,OAAO;AAAA,EAC9B,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,kCAAkC,aAAa;AAAA,EAChD,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,gCAAgC,OAAO;AAAA,EACxC,CAAC,oCAAoC,aAAa;AAAA,EAClD,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,uCAAuC,MAAM;AAAA,EAC9C,CAAC,8BAA8B,aAAa;AAAA,EAC5C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,yCAAyC,SAAS;AAAA,EACnD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6BAA6B,SAAS;AAAA,EACvC,CAAC,iCAAiC,aAAa;AAAA,EAC/C,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,kCAAkC,MAAM;AAAA,EACzC,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,8BAA8B,OAAO;AAAA,EACtC,CAAC,2CAA2C,MAAM;AAAA,EAClD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,0CAA0C,aAAa;AAAA,EACxD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,gCAAgC,QAAQ;AAAA,EACzC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,2BAA2B,OAAO;AAAA,EACnC,CAAC,+BAA+B,aAAa;AAAA,EAC7C,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,6BAA6B,aAAa;AAAA,EAC3C,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,0CAA0C,aAAa;AAAA,EACxD,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,0CAA0C,MAAM;AAAA,EACjD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6CAA6C,QAAQ;AAAA,EACtD,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,6CAA6C,MAAM;AAAA,EACpD,CAAC,6CAA6C,MAAM;AAAA,EACpD,CAAC,6CAA6C,QAAQ;AAAA,EACtD,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,mCAAmC,aAAa;AAAA,EACjD,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,iCAAiC,aAAa;AAAA,EAC/C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,2CAA2C,MAAM;AAAA,EAClD,CAAC,0CAA0C,MAAM;AAAA,EACjD,CAAC,+CAA+C,QAAQ;AAAA,EACxD,CAAC,2CAA2C,QAAQ;AAAA,EACpD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,+CAA+C,QAAQ;AAAA,EACxD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,qCAAqC,aAAa;AAAA,EACnD,CAAC,kDAAkD,MAAM;AAAA,EACzD,CAAC,qDAAqD,MAAM;AAAA,EAC5D,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,6DAA6D,QAAQ;AAAA,EACtE,CAAC,4CAA4C,MAAM;AAAA,EACnD,CAAC,wDAAwD,MAAM;AAAA,EAC/D,CAAC,wDAAwD,MAAM;AAAA,EAC/D,CAAC,iDAAiD,aAAa;AAAA,EAC/D,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,oDAAoD,MAAM;AAAA,EAC3D,CAAC,6CAA6C,aAAa;AAAA,EAC3D,CAAC,qBAAqB,MAAM;AAAA,EAC5B,CAAC,eAAe,MAAM;AAAA,EACtB,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,mBAAmB,MAAM;AAAA,EAC1B,CAAC,oBAAoB,OAAO;AAAA,EAC5B,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,kCAAkC,MAAM;AAAA,EACzC,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,wCAAwC,QAAQ;AAAA,EACjD,CAAC,gCAAgC,aAAa;AAAA,EAC9C,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,uBAAuB,MAAM;AAAA,EAC9B,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,iBAAiB,MAAM;AAAA,EACxB,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,yBAAyB,aAAa;AAAA,EACvC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,OAAO;AAC1C,CAAC;AAYM,IAAM,sBAAsB;AAAA,EACjC,EAAE,SAAS,GAAG,MAAM,eAAe;AAAA,EACnC,EAAE,SAAS,GAAG,MAAM,gCAAgC;AAAA,EACpD,EAAE,SAAS,GAAG,MAAM,+BAA+B;AAAA,EACnD,EAAE,SAAS,GAAG,MAAM,wBAAwB;AAAA,EAC5C,EAAE,SAAS,GAAG,MAAM,2BAA2B;AAAA,EAC/C,EAAE,SAAS,GAAG,MAAM,+BAA+B;AAAA,EACnD,EAAE,SAAS,GAAG,MAAM,eAAe;AAAA,EACnC,EAAE,SAAS,GAAG,MAAM,mBAAmB;AAAA,EACvC,EAAE,SAAS,GAAG,MAAM,wBAAwB;AAAA,EAC5C,EAAE,SAAS,IAAI,MAAM,4BAA4B;AAAA,EACjD,EAAE,SAAS,IAAI,MAAM,sBAAsB;AAAA,EAC3C,EAAE,SAAS,IAAI,MAAM,oBAAoB;AAAA,EACzC,EAAE,SAAS,IAAI,MAAM,gBAAgB;AAAA,EACrC,EAAE,SAAS,IAAI,MAAM,sBAAsB;AAAA,EAC3C,EAAE,SAAS,IAAI,MAAM,oBAAoB;AAAA,EACzC,EAAE,SAAS,IAAI,MAAM,kBAAkB;AACzC;AAEA,SAAS,uBAAuB,QAAwB;AACtD,MAAI,CAAC,aAAa,KAAK,MAAM,GAAG;AAC9B,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA;AAAA,sCAAiD,2BAA2B;AAAA;AAAA;AAAA,EAC9E;AACF;AAEA,SAAS,SAAS,QAAwB;AACxC,SAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,MAAM,EAAE,OAAO,KAAK;AACjE;AAEA,eAAe,mBAAmB,IAA8C;AAC9E,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,KAAK,CAAC,GAAG,WAAY,QAAO,CAAC;AACzC,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,EACF;AACA,SAAO,OAAO,KAAK,IAAI,CAAC,SAAS;AAAA,IAC/B,SAAS,OAAO,IAAI,OAAO;AAAA,IAC3B,MAAM,IAAI;AAAA,IACV,UAAU,IAAI;AAAA,EAChB,EAAE;AACJ;AAEA,eAAsB,kBAAkB,WAAkD;AACxF,QAAM,SAAS,MAAM,QAAQ,SAAS,GACnC,OAAO,CAAC,SAAS,eAAe,KAAK,IAAI,CAAC,EAC1C,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAClD,QAAM,WAAW,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO,SAAS;AAC3D,UAAM,QAAQ,KAAK,MAAM,cAAc;AACvC,UAAM,SAAS,MAAM,SAAS,KAAK,WAAW,IAAI,GAAG,MAAM;AAC3D,WAAO,EAAE,SAAS,OAAO,MAAM,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,QAAQ,UAAU,SAAS,MAAM,EAAE;AAAA,EACzF,CAAC,CAAC;AAEF,MACE,SAAS,WAAW,oBAAoB,UACxC,CAAC,SAAS;AAAA,IACR,CAAC,WAAW,UACV,UAAU,YAAY,oBAAoB,KAAK,GAAG,WAClD,UAAU,SAAS,oBAAoB,KAAK,GAAG;AAAA,EACnD,GACA;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,gBACpB,IACA,UACkB;AAClB,QAAM,UAAU,MAAM,mBAAmB,EAAE;AAC3C,SAAO,SAAS;AAAA,IACd,CAAC,UAAU,UACT,QAAQ,KAAK,GAAG,YAAY,SAAS,WACrC,QAAQ,KAAK,GAAG,SAAS,SAAS,QAClC,QAAQ,KAAK,GAAG,aAAa,SAAS;AAAA,EAC1C,KAAK,QAAQ,WAAW,SAAS;AACnC;AAEA,eAAsB,kBAAkB,IAAiB,uBAAkD;AACzG,QAAM,SAAS,MAAM,GAAG,MAWrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GA6QF;AACD,QAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAM,cAAc,KAAK,gBAAgB,yBAAyB,CAAC,IAAI;AACvE,SAAO;AAAA,IACL,KAAK,cAAc,eAAe,IAAI,kBAAkB,IAAI,iBAC5D,IAAI,kBAAkB,IAAI,oBAAoB,IAAI,iBAAiB,IAAI,eAAe,IAAI;AAAA,EAC5F;AACF;AAEA,eAAsB,mBACpB,IACA,UAA+C,CAAC,GAC9B;AAClB,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQF;AACA,QAAM,SAAS,IAAI;AAAA,IACjB,QAAQ,KAAK,IAAI,CAACA,SAAQ,CAAC,GAAGA,KAAI,UAAU,IAAIA,KAAI,WAAW,IAAIA,KAAI,QAAQ,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,GAAG,gBAAgB,EAAE,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,IAAI,EAAG,QAAO;AAEpF,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6GF;AACA,QAAM,MAAM,QAAQ,KAAK,CAAC;AAC1B,MAAI,CAAC;AAAA,IACH,KAAK,aAAa,IAAI,iBAAiB,IAAI,eAAe,IAAI,SAAS,IAAI,aAC3E,IAAI,YAAY,IAAI,UAAU,IAAI,UAAU,IAAI,WAAW,IAAI,YAAY,IAAI,WAC/E,IAAI,WAAW,IAAI,aAAa,IAAI,kBAAkB,IAAI,gBAAgB,IAAI,eAC9E,IAAI,eAAe,IAAI,eAAe,IAAI,sBAAsB,IAAI,mBACpE,IAAI,cAAc,IAAI,eAAe,IAAI,iBAAiB,IAAI,sBAC9D,IAAI,iBAAiB,IAAI,kBAAkB,IAAI,0BAA0B,IAAI,uBAC7E,IAAI,yBAAyB,IAAI,yBAAyB,IAAI;AAAA,EAChE,EAAG,QAAO;AACV,MAAI;AACF,UAAM,WAAW,MAAM,GAAG;AAAA,MACxB;AAAA,IACF;AACA,UAAM,eAAe,MAAM,GAAG;AAAA,MAC5B;AAAA,IACF;AACA,UAAM,kBAAkB,MAAM,GAAG;AAAA,MAC/B;AAAA,IACF;AACA,WAAO,SAAS,KAAK,CAAC,GAAG,UAAU,QAAQ,aAAa,KAAK,CAAC,GAAG,UAAU,QACzE,gBAAgB,KAAK,CAAC,GAAG,UAAU,QAAQ,MAAM;AAAA,MACjD;AAAA,MACA,QAAQ,0BAA0B;AAAA,IACpC;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,cACpB,IACA,WAC6B;AAC7B,QAAM,WAAW,MAAM,kBAAkB,SAAS;AAElD,aAAW,aAAa,UAAU;AAChC,UAAM,UAAU,MAAM,mBAAmB,EAAE;AAC3C,UAAM,WAAW,QAAQ,KAAK,CAAC,UAAU,MAAM,YAAY,UAAU,OAAO;AAC5E,QAAI,UAAU;AACZ,UAAI,SAAS,SAAS,UAAU,QAAQ,SAAS,aAAa,UAAU,UAAU;AAChF,cAAM,IAAI,MAAM,aAAa,UAAU,OAAO,IAAI,UAAU,IAAI,8BAA8B;AAAA,MAChG;AACA;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,MACb,UAAU,OAAO,MAAM,qCAAqC,EAAE,KAAK,UAAU,QAAQ;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,mBAAmB,EAAE,GAAG;AAAA,MAC9C,CAAC,UAAU,MAAM,YAAY,UAAU;AAAA,IACzC;AACA,QAAI,UAAU,SAAS,UAAU,QAAQ,SAAS,aAAa,UAAU,UAAU;AACjF,YAAM,IAAI,MAAM,aAAa,UAAU,OAAO,IAAI,UAAU,IAAI,6BAA6B;AAAA,IAC/F;AAAA,EACF;AAEA,SAAO,mBAAmB,EAAE;AAC9B;","names":["row"]}

package/dist/chunk-4VB44KJU.js

@@ -0,0 +1,230 @@
+#!/usr/bin/env node
+import {
+  BridgePrincipalMismatchError,
+  BridgeValidationError,
+  validateMessageDraft,
+  validatePrincipal,
+  validateProject,
+  validateUuid
+} from "./chunk-BZLMF5O5.js";
+
+// src/bridge-service.ts
+function validateDeprecatedMaxAttempts(value) {
+  if (value === void 0) return;
+  if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 100) {
+    throw new BridgeValidationError("maxAttempts must be between 1 and 100");
+  }
+}
+function validateDeprecatedRetryPolicy(value) {
+  if (value === void 0) return;
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new BridgeValidationError("retryPolicy must be an object");
+  }
+  const allowed = /* @__PURE__ */ new Set(["maxAttempts", "baseDelayMs", "maxDelayMs", "jitterRatio"]);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw new BridgeValidationError(`retryPolicy.${key} is not supported`);
+  }
+  const policy = value;
+  validateDeprecatedMaxAttempts(policy.maxAttempts);
+  for (const [key, maximum] of [["baseDelayMs", 36e5], ["maxDelayMs", 864e5]]) {
+    if (policy[key] !== void 0 && (!Number.isSafeInteger(policy[key]) || Number(policy[key]) < 1 || Number(policy[key]) > maximum)) {
+      throw new BridgeValidationError(`${key} is invalid`);
+    }
+  }
+  if (policy.jitterRatio !== void 0 && (!Number.isFinite(policy.jitterRatio) || Number(policy.jitterRatio) < 0 || Number(policy.jitterRatio) > 1)) {
+    throw new BridgeValidationError("jitterRatio must be between 0 and 1");
+  }
+}
+function validateLeaseMs(value = 3e4) {
+  if (!Number.isSafeInteger(value) || value < 1e3 || value > 15 * 6e4) {
+    throw new BridgeValidationError("leaseMs must be between 1000 and 900000");
+  }
+  return value;
+}
+function validateQuery(query, principal) {
+  const limit = query.limit ?? 50;
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) {
+    throw new BridgeValidationError("limit must be between 1 and 200");
+  }
+  if (query.types !== void 0) {
+    if (!Array.isArray(query.types) || query.types.length > 64) {
+      throw new BridgeValidationError("types must contain at most 64 entries");
+    }
+    for (const type of query.types) {
+      if (typeof type !== "string" || !type.trim() || type.length > 128) {
+        throw new BridgeValidationError("type filter is invalid");
+      }
+    }
+  }
+  const source = query.source?.trim();
+  if (source !== void 0 && (!source || source.length > 128)) {
+    throw new BridgeValidationError("source filter is invalid");
+  }
+  const unacknowledgedBy = query.unacknowledgedBy?.trim();
+  if (unacknowledgedBy !== void 0 && (!unacknowledgedBy || unacknowledgedBy.length > 128)) {
+    throw new BridgeValidationError("unacknowledgedBy filter is invalid");
+  }
+  if (unacknowledgedBy !== void 0 && unacknowledgedBy !== principal.agent) {
+    throw new BridgePrincipalMismatchError("unacknowledgedBy must equal the configured principal");
+  }
+  const mailbox = query.mailbox ?? "inbox";
+  if (!["inbox", "sent", "all"].includes(mailbox)) throw new BridgeValidationError("mailbox is invalid");
+  const receiptState = query.receiptState ?? (unacknowledgedBy ? "unread" : "any");
+  if (!["any", "unread", "read"].includes(receiptState)) throw new BridgeValidationError("receiptState is invalid");
+  if (mailbox !== "inbox" && receiptState !== "any") {
+    throw new BridgeValidationError("receiptState is valid only for inbox");
+  }
+  let since;
+  if (query.since !== void 0) {
+    const date = new Date(query.since);
+    if (Number.isNaN(date.getTime())) throw new BridgeValidationError("since must be an ISO timestamp");
+    since = date.toISOString();
+  }
+  const threadId = query.threadId?.trim();
+  if (threadId !== void 0 && (!threadId || threadId.length > 128)) {
+    throw new BridgeValidationError("threadId filter is invalid");
+  }
+  if (query.latest && query.cursor) {
+    throw new BridgeValidationError("latest cannot be combined with cursor");
+  }
+  const { unacknowledgedBy: _compat, ...storeQuery } = query;
+  return { ...storeQuery, mailbox, receiptState, project: validateProject(query.project), limit, source, since, threadId, latest: query.latest === true };
+}
+var BridgeService = class {
+  constructor(store) {
+    this.store = store;
+  }
+  async publish(principalInput, draftInput) {
+    const principal = validatePrincipal(principalInput);
+    const draft = validateMessageDraft(draftInput);
+    return this.store.insertMessage({
+      ...draft,
+      workspace: principal.workspace,
+      source: principal.agent
+    });
+  }
+  async history(principalInput, query = {}) {
+    const principal = validatePrincipal(principalInput);
+    return this.store.listMessages(principal, validateQuery(query, principal));
+  }
+  async acknowledge(principalInput, messageIds) {
+    const principal = validatePrincipal(principalInput);
+    if (!Array.isArray(messageIds) || !messageIds.length || messageIds.length > 200) {
+      throw new BridgeValidationError("messageIds must contain between 1 and 200 entries");
+    }
+    const ids = messageIds.map((id) => validateUuid(id, "messageId"));
+    return this.store.recordReceipt(principal, ids);
+  }
+  async claim(principalInput, options = {}) {
+    const principal = validatePrincipal(principalInput);
+    validateDeprecatedMaxAttempts(options.maxAttempts);
+    const delivery = await this.store.claimDelivery(principal, {
+      leaseMs: validateLeaseMs(options.leaseMs)
+    });
+    return delivery?.leaseToken ? { delivery, leaseToken: delivery.leaseToken } : null;
+  }
+  async extend(principalInput, deliveryId, leaseToken, leaseMs = 3e4) {
+    const principal = validatePrincipal(principalInput);
+    return this.store.renewDelivery(
+      principal,
+      validateUuid(deliveryId, "deliveryId"),
+      validateUuid(leaseToken, "leaseToken"),
+      validateLeaseMs(leaseMs)
+    );
+  }
+  async ack(principalInput, deliveryId, leaseToken) {
+    const principal = validatePrincipal(principalInput);
+    return this.store.settleDelivery(
+      principal,
+      validateUuid(deliveryId, "deliveryId"),
+      validateUuid(leaseToken, "leaseToken"),
+      "acked",
+      void 0
+    );
+  }
+  async nack(principalInput, deliveryId, leaseToken, error, disposition = "retry", deprecatedRetryPolicy) {
+    const principal = validatePrincipal(principalInput);
+    if (!["retry", "dead", true, false].includes(disposition)) {
+      throw new BridgeValidationError("disposition must be retry or dead");
+    }
+    if (typeof error !== "string" || !error.trim()) {
+      throw new BridgeValidationError("error is required");
+    }
+    validateDeprecatedRetryPolicy(deprecatedRetryPolicy);
+    return this.store.settleDelivery(
+      principal,
+      validateUuid(deliveryId, "deliveryId"),
+      validateUuid(leaseToken, "leaseToken"),
+      disposition === "dead" || disposition === true ? "dead" : "retrying",
+      error.slice(0, 1024)
+    );
+  }
+  async deliveries(principalInput, query = {}) {
+    const principal = validatePrincipal(principalInput);
+    if (!this.store.listDeliveries) throw new BridgeValidationError("delivery listing is not supported by this provider");
+    const limit = query.limit ?? 50;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new BridgeValidationError("limit must be between 1 and 200");
+    const role = query.role ?? "all";
+    if (!["recipient", "publisher", "all"].includes(role)) throw new BridgeValidationError("role is invalid");
+    const validStates = ["pending", "claimed", "acked", "retrying", "dead", "cancelled"];
+    if (query.states !== void 0 && (!Array.isArray(query.states) || query.states.some((state) => !validStates.includes(state)))) {
+      throw new BridgeValidationError("states contains an invalid delivery state");
+    }
+    const recipient = query.recipient?.trim();
+    if (recipient !== void 0 && (!recipient || recipient.length > 128)) throw new BridgeValidationError("recipient is invalid");
+    return this.store.listDeliveries(principal, {
+      ...query,
+      role,
+      limit,
+      messageId: query.messageId ? validateUuid(query.messageId, "messageId") : void 0,
+      recipient,
+      states: query.states ? [...new Set(query.states)].sort() : void 0
+    });
+  }
+  async deliveryEvents(principalInput, deliveryId, query = {}) {
+    const principal = validatePrincipal(principalInput);
+    if (!this.store.listDeliveryEvents) throw new BridgeValidationError("delivery event listing is not supported by this provider");
+    const limit = query.limit ?? 50;
+    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new BridgeValidationError("limit must be between 1 and 200");
+    return this.store.listDeliveryEvents(principal, validateUuid(deliveryId, "deliveryId"), { ...query, limit });
+  }
+  async cancel(principalInput, deliveryId) {
+    const principal = validatePrincipal(principalInput);
+    if (!this.store.cancelDelivery) throw new BridgeValidationError("delivery cancellation is not supported by this provider");
+    return this.store.cancelDelivery(principal, validateUuid(deliveryId, "deliveryId"));
+  }
+  async requeue(principalInput, deliveryId) {
+    const principal = validatePrincipal(principalInput);
+    if (!this.store.requeueDelivery) throw new BridgeValidationError("delivery requeue is not supported by this provider");
+    return this.store.requeueDelivery(principal, validateUuid(deliveryId, "deliveryId"));
+  }
+  async heartbeat(principalInput, options = {}) {
+    const principal = validatePrincipal(principalInput);
+    if (!principal.instance) throw new BridgeValidationError("instance is required for presence");
+    if (!this.store.heartbeat) throw new BridgeValidationError("presence is not supported by this provider");
+    if (options.runtimeType !== void 0 && typeof options.runtimeType !== "string") {
+      throw new BridgeValidationError("runtimeType must be a string");
+    }
+    const runtimeType = options.runtimeType?.trim();
+    if (runtimeType && runtimeType.length > 128) throw new BridgeValidationError("runtimeType exceeds 128 characters");
+    if (options.capabilities !== void 0 && !Array.isArray(options.capabilities)) {
+      throw new BridgeValidationError("capabilities must be an array");
+    }
+    const capabilities = [...new Set(options.capabilities ?? [])].map((value) => {
+      if (typeof value !== "string" || !value.trim() || value.length > 128) throw new BridgeValidationError("capability is invalid");
+      return value.trim();
+    });
+    if (capabilities.length > 64) throw new BridgeValidationError("capabilities exceeds 64 entries");
+    return this.store.heartbeat(principal, validateLeaseMs(options.leaseMs), runtimeType, capabilities);
+  }
+  async presence(principalInput) {
+    const principal = validatePrincipal(principalInput);
+    if (!this.store.listPresence) throw new BridgeValidationError("presence is not supported by this provider");
+    return this.store.listPresence(principal);
+  }
+};
+
+export {
+  BridgeService
+};
+//# sourceMappingURL=chunk-4VB44KJU.js.map

package/dist/chunk-4VB44KJU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bridge-service.ts"],"sourcesContent":["import {\n  BridgePrincipalMismatchError,\n  BridgeValidationError,\n  encodeCursor,\n  validateMessageDraft,\n  validatePrincipal,\n  validateProject,\n  validateUuid,\n  type BridgeDelivery,\n  type BridgeMessage,\n  type BridgePrincipal,\n  type MessageDraft,\n  type AgentPresence,\n  type DeliveryState,\n} from \"./bridge-domain.js\";\nimport type {\n  BridgeStore,\n  DeliveryQuery,\n  InsertMessageResult,\n  MessagePage,\n  MessageQuery,\n} from \"./bridge-store.js\";\n\nfunction validateDeprecatedMaxAttempts(value: unknown): void {\n  if (value === undefined) return;\n  if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 100) {\n    throw new BridgeValidationError(\"maxAttempts must be between 1 and 100\");\n  }\n}\n\nfunction validateDeprecatedRetryPolicy(value: unknown): void {\n  if (value === undefined) return;\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new BridgeValidationError(\"retryPolicy must be an object\");\n  }\n  const allowed = new Set([\"maxAttempts\", \"baseDelayMs\", \"maxDelayMs\", \"jitterRatio\"]);\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new BridgeValidationError(`retryPolicy.${key} is not supported`);\n  }\n  const policy = value as Record<string, unknown>;\n  validateDeprecatedMaxAttempts(policy.maxAttempts);\n  for (const [key, maximum] of [[\"baseDelayMs\", 3_600_000], [\"maxDelayMs\", 86_400_000]] as const) {\n    if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || Number(policy[key]) < 1 || Number(policy[key]) > maximum)) {\n      throw new BridgeValidationError(`${key} is invalid`);\n    }\n  }\n  if (policy.jitterRatio !== undefined && (!Number.isFinite(policy.jitterRatio) || Number(policy.jitterRatio) < 0 || Number(policy.jitterRatio) > 1)) {\n    throw new BridgeValidationError(\"jitterRatio must be between 0 and 1\");\n  }\n}\n\nfunction validateLeaseMs(value = 30_000): number {\n  if (!Number.isSafeInteger(value) || value < 1_000 || value > 15 * 60_000) {\n    throw new BridgeValidationError(\"leaseMs must be between 1000 and 900000\");\n  }\n  return value;\n}\n\nexport type PublicMessageQuery = MessageQuery & { unacknowledgedBy?: string };\n\nfunction validateQuery(query: PublicMessageQuery, principal: BridgePrincipal): MessageQuery {\n  const limit = query.limit ?? 50;\n  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) {\n    throw new BridgeValidationError(\"limit must be between 1 and 200\");\n  }\n  if (query.types !== undefined) {\n    if (!Array.isArray(query.types) || query.types.length > 64) {\n      throw new BridgeValidationError(\"types must contain at most 64 entries\");\n    }\n    for (const type of query.types) {\n      if (typeof type !== \"string\" || !type.trim() || type.length > 128) {\n        throw new BridgeValidationError(\"type filter is invalid\");\n      }\n    }\n  }\n  const source = query.source?.trim();\n  if (source !== undefined && (!source || source.length > 128)) {\n    throw new BridgeValidationError(\"source filter is invalid\");\n  }\n  const unacknowledgedBy = query.unacknowledgedBy?.trim();\n  if (\n    unacknowledgedBy !== undefined &&\n    (!unacknowledgedBy || unacknowledgedBy.length > 128)\n  ) {\n    throw new BridgeValidationError(\"unacknowledgedBy filter is invalid\");\n  }\n  if (unacknowledgedBy !== undefined && unacknowledgedBy !== principal.agent) {\n    throw new BridgePrincipalMismatchError(\"unacknowledgedBy must equal the configured principal\");\n  }\n  const mailbox = query.mailbox ?? \"inbox\";\n  if (![\"inbox\", \"sent\", \"all\"].includes(mailbox)) throw new BridgeValidationError(\"mailbox is invalid\");\n  const receiptState = query.receiptState ?? (unacknowledgedBy ? \"unread\" : \"any\");\n  if (![\"any\", \"unread\", \"read\"].includes(receiptState)) throw new BridgeValidationError(\"receiptState is invalid\");\n  if (mailbox !== \"inbox\" && receiptState !== \"any\") {\n    throw new BridgeValidationError(\"receiptState is valid only for inbox\");\n  }\n  let since: string | undefined;\n  if (query.since !== undefined) {\n    const date = new Date(query.since);\n    if (Number.isNaN(date.getTime())) throw new BridgeValidationError(\"since must be an ISO timestamp\");\n    since = date.toISOString();\n  }\n  const threadId = query.threadId?.trim();\n  if (threadId !== undefined && (!threadId || threadId.length > 128)) {\n    throw new BridgeValidationError(\"threadId filter is invalid\");\n  }\n  if (query.latest && query.cursor) {\n    throw new BridgeValidationError(\"latest cannot be combined with cursor\");\n  }\n  const { unacknowledgedBy: _compat, ...storeQuery } = query;\n  return { ...storeQuery, mailbox, receiptState, project: validateProject(query.project), limit, source, since, threadId, latest: query.latest === true };\n}\n\nexport class BridgeService {\n  constructor(private readonly store: BridgeStore) {}\n\n  async publish(\n    principalInput: BridgePrincipal,\n    draftInput: MessageDraft,\n  ): Promise<InsertMessageResult> {\n    const principal = validatePrincipal(principalInput);\n    const draft = validateMessageDraft(draftInput);\n    return this.store.insertMessage({\n      ...draft,\n      workspace: principal.workspace,\n      source: principal.agent,\n    });\n  }\n\n  async history(\n    principalInput: BridgePrincipal,\n    query: PublicMessageQuery = {},\n  ): Promise<MessagePage> {\n    const principal = validatePrincipal(principalInput);\n    return this.store.listMessages(principal, validateQuery(query, principal));\n  }\n\n  async acknowledge(principalInput: BridgePrincipal, messageIds: string[]): Promise<number> {\n    const principal = validatePrincipal(principalInput);\n    if (!Array.isArray(messageIds) || !messageIds.length || messageIds.length > 200) {\n      throw new BridgeValidationError(\"messageIds must contain between 1 and 200 entries\");\n    }\n    const ids = messageIds.map((id) => validateUuid(id, \"messageId\"));\n    return this.store.recordReceipt(principal, ids);\n  }\n\n  async claim(\n    principalInput: BridgePrincipal,\n    options: { leaseMs?: number; maxAttempts?: number } = {},\n  ): Promise<{ delivery: BridgeDelivery; leaseToken: string } | null> {\n    const principal = validatePrincipal(principalInput);\n    validateDeprecatedMaxAttempts(options.maxAttempts);\n    const delivery = await this.store.claimDelivery(principal, {\n      leaseMs: validateLeaseMs(options.leaseMs),\n    });\n    return delivery?.leaseToken ? { delivery, leaseToken: delivery.leaseToken } : null;\n  }\n\n  async extend(\n    principalInput: BridgePrincipal,\n    deliveryId: string,\n    leaseToken: string,\n    leaseMs = 30_000,\n  ): Promise<BridgeDelivery | null> {\n    const principal = validatePrincipal(principalInput);\n    return this.store.renewDelivery(\n      principal,\n      validateUuid(deliveryId, \"deliveryId\"),\n      validateUuid(leaseToken, \"leaseToken\"),\n      validateLeaseMs(leaseMs),\n    );\n  }\n\n  async ack(\n    principalInput: BridgePrincipal,\n    deliveryId: string,\n    leaseToken: string,\n  ): Promise<BridgeDelivery | null> {\n    const principal = validatePrincipal(principalInput);\n    return this.store.settleDelivery(\n      principal,\n      validateUuid(deliveryId, \"deliveryId\"),\n      validateUuid(leaseToken, \"leaseToken\"),\n      \"acked\",\n      undefined,\n    );\n  }\n\n  async nack(\n    principalInput: BridgePrincipal,\n    deliveryId: string,\n    leaseToken: string,\n    error: string,\n    disposition: \"retry\" | \"dead\" | boolean = \"retry\",\n    deprecatedRetryPolicy?: unknown,\n  ): Promise<BridgeDelivery | null> {\n    const principal = validatePrincipal(principalInput);\n    if (![\"retry\", \"dead\", true, false].includes(disposition as never)) {\n      throw new BridgeValidationError(\"disposition must be retry or dead\");\n    }\n    if (typeof error !== \"string\" || !error.trim()) {\n      throw new BridgeValidationError(\"error is required\");\n    }\n    validateDeprecatedRetryPolicy(deprecatedRetryPolicy);\n    return this.store.settleDelivery(\n      principal,\n      validateUuid(deliveryId, \"deliveryId\"),\n      validateUuid(leaseToken, \"leaseToken\"),\n      disposition === \"dead\" || disposition === true ? \"dead\" : \"retrying\",\n      error.slice(0, 1_024),\n    );\n  }\n\n  async deliveries(principalInput: BridgePrincipal, query: DeliveryQuery = {}) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.listDeliveries) throw new BridgeValidationError(\"delivery listing is not supported by this provider\");\n    const limit = query.limit ?? 50;\n    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new BridgeValidationError(\"limit must be between 1 and 200\");\n    const role = query.role ?? \"all\";\n    if (![\"recipient\", \"publisher\", \"all\"].includes(role)) throw new BridgeValidationError(\"role is invalid\");\n    const validStates: DeliveryState[] = [\"pending\", \"claimed\", \"acked\", \"retrying\", \"dead\", \"cancelled\"];\n    if (query.states !== undefined && (!Array.isArray(query.states) || query.states.some((state) => !validStates.includes(state)))) {\n      throw new BridgeValidationError(\"states contains an invalid delivery state\");\n    }\n    const recipient = query.recipient?.trim();\n    if (recipient !== undefined && (!recipient || recipient.length > 128)) throw new BridgeValidationError(\"recipient is invalid\");\n    return this.store.listDeliveries(principal, {\n      ...query,\n      role,\n      limit,\n      messageId: query.messageId ? validateUuid(query.messageId, \"messageId\") : undefined,\n      recipient,\n      states: query.states ? [...new Set(query.states)].sort() : undefined,\n    });\n  }\n\n  async deliveryEvents(principalInput: BridgePrincipal, deliveryId: string, query: { cursor?: string; limit?: number } = {}) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.listDeliveryEvents) throw new BridgeValidationError(\"delivery event listing is not supported by this provider\");\n    const limit = query.limit ?? 50;\n    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new BridgeValidationError(\"limit must be between 1 and 200\");\n    return this.store.listDeliveryEvents(principal, validateUuid(deliveryId, \"deliveryId\"), { ...query, limit });\n  }\n\n  async cancel(principalInput: BridgePrincipal, deliveryId: string) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.cancelDelivery) throw new BridgeValidationError(\"delivery cancellation is not supported by this provider\");\n    return this.store.cancelDelivery(principal, validateUuid(deliveryId, \"deliveryId\"));\n  }\n\n  async requeue(principalInput: BridgePrincipal, deliveryId: string) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.requeueDelivery) throw new BridgeValidationError(\"delivery requeue is not supported by this provider\");\n    return this.store.requeueDelivery(principal, validateUuid(deliveryId, \"deliveryId\"));\n  }\n\n  async heartbeat(\n    principalInput: BridgePrincipal,\n    options: { leaseMs?: number; runtimeType?: string; capabilities?: string[] } = {},\n  ): Promise<AgentPresence> {\n    const principal = validatePrincipal(principalInput);\n    if (!principal.instance) throw new BridgeValidationError(\"instance is required for presence\");\n    if (!this.store.heartbeat) throw new BridgeValidationError(\"presence is not supported by this provider\");\n    if (\n      options.runtimeType !== undefined &&\n      typeof options.runtimeType !== \"string\"\n    ) {\n      throw new BridgeValidationError(\"runtimeType must be a string\");\n    }\n    const runtimeType = options.runtimeType?.trim();\n    if (runtimeType && runtimeType.length > 128) throw new BridgeValidationError(\"runtimeType exceeds 128 characters\");\n    if (options.capabilities !== undefined && !Array.isArray(options.capabilities)) {\n      throw new BridgeValidationError(\"capabilities must be an array\");\n    }\n    const capabilities = [...new Set(options.capabilities ?? [])].map((value) => {\n      if (typeof value !== \"string\" || !value.trim() || value.length > 128) throw new BridgeValidationError(\"capability is invalid\");\n      return value.trim();\n    });\n    if (capabilities.length > 64) throw new BridgeValidationError(\"capabilities exceeds 64 entries\");\n    return this.store.heartbeat(principal, validateLeaseMs(options.leaseMs), runtimeType, capabilities);\n  }\n\n  async presence(principalInput: BridgePrincipal): Promise<AgentPresence[]> {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.listPresence) throw new BridgeValidationError(\"presence is not supported by this provider\");\n    return this.store.listPresence(principal);\n  }\n}\n\nexport { encodeCursor, type BridgeMessage };\n"],"mappings":";;;;;;;;;;;AAuBA,SAAS,8BAA8B,OAAsB;AAC3D,MAAI,UAAU,OAAW;AACzB,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,KAAK,IAAI,KAAK;AAC5E,UAAM,IAAI,sBAAsB,uCAAuC;AAAA,EACzE;AACF;AAEA,SAAS,8BAA8B,OAAsB;AAC3D,MAAI,UAAU,OAAW;AACzB,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,+BAA+B;AAAA,EACjE;AACA,QAAM,UAAU,oBAAI,IAAI,CAAC,eAAe,eAAe,cAAc,aAAa,CAAC;AACnF,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,QAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,OAAM,IAAI,sBAAsB,eAAe,GAAG,mBAAmB;AAAA,EAC9F;AACA,QAAM,SAAS;AACf,gCAA8B,OAAO,WAAW;AAChD,aAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,eAAe,IAAS,GAAG,CAAC,cAAc,KAAU,CAAC,GAAY;AAC9F,QAAI,OAAO,GAAG,MAAM,WAAc,CAAC,OAAO,cAAc,OAAO,GAAG,CAAC,KAAK,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,OAAO,GAAG,CAAC,IAAI,UAAU;AACjI,YAAM,IAAI,sBAAsB,GAAG,GAAG,aAAa;AAAA,IACrD;AAAA,EACF;AACA,MAAI,OAAO,gBAAgB,WAAc,CAAC,OAAO,SAAS,OAAO,WAAW,KAAK,OAAO,OAAO,WAAW,IAAI,KAAK,OAAO,OAAO,WAAW,IAAI,IAAI;AAClJ,UAAM,IAAI,sBAAsB,qCAAqC;AAAA,EACvE;AACF;AAEA,SAAS,gBAAgB,QAAQ,KAAgB;AAC/C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,OAAS,QAAQ,KAAK,KAAQ;AACxE,UAAM,IAAI,sBAAsB,yCAAyC;AAAA,EAC3E;AACA,SAAO;AACT;AAIA,SAAS,cAAc,OAA2B,WAA0C;AAC1F,QAAM,QAAQ,MAAM,SAAS;AAC7B,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK;AAC5D,UAAM,IAAI,sBAAsB,iCAAiC;AAAA,EACnE;AACA,MAAI,MAAM,UAAU,QAAW;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,SAAS,IAAI;AAC1D,YAAM,IAAI,sBAAsB,uCAAuC;AAAA,IACzE;AACA,eAAW,QAAQ,MAAM,OAAO;AAC9B,UAAI,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS,KAAK;AACjE,cAAM,IAAI,sBAAsB,wBAAwB;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,KAAK;AAClC,MAAI,WAAW,WAAc,CAAC,UAAU,OAAO,SAAS,MAAM;AAC5D,UAAM,IAAI,sBAAsB,0BAA0B;AAAA,EAC5D;AACA,QAAM,mBAAmB,MAAM,kBAAkB,KAAK;AACtD,MACE,qBAAqB,WACpB,CAAC,oBAAoB,iBAAiB,SAAS,MAChD;AACA,UAAM,IAAI,sBAAsB,oCAAoC;AAAA,EACtE;AACA,MAAI,qBAAqB,UAAa,qBAAqB,UAAU,OAAO;AAC1E,UAAM,IAAI,6BAA6B,sDAAsD;AAAA,EAC/F;AACA,QAAM,UAAU,MAAM,WAAW;AACjC,MAAI,CAAC,CAAC,SAAS,QAAQ,KAAK,EAAE,SAAS,OAAO,EAAG,OAAM,IAAI,sBAAsB,oBAAoB;AACrG,QAAM,eAAe,MAAM,iBAAiB,mBAAmB,WAAW;AAC1E,MAAI,CAAC,CAAC,OAAO,UAAU,MAAM,EAAE,SAAS,YAAY,EAAG,OAAM,IAAI,sBAAsB,yBAAyB;AAChH,MAAI,YAAY,WAAW,iBAAiB,OAAO;AACjD,UAAM,IAAI,sBAAsB,sCAAsC;AAAA,EACxE;AACA,MAAI;AACJ,MAAI,MAAM,UAAU,QAAW;AAC7B,UAAM,OAAO,IAAI,KAAK,MAAM,KAAK;AACjC,QAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,OAAM,IAAI,sBAAsB,gCAAgC;AAClG,YAAQ,KAAK,YAAY;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,UAAU,KAAK;AACtC,MAAI,aAAa,WAAc,CAAC,YAAY,SAAS,SAAS,MAAM;AAClE,UAAM,IAAI,sBAAsB,4BAA4B;AAAA,EAC9D;AACA,MAAI,MAAM,UAAU,MAAM,QAAQ;AAChC,UAAM,IAAI,sBAAsB,uCAAuC;AAAA,EACzE;AACA,QAAM,EAAE,kBAAkB,SAAS,GAAG,WAAW,IAAI;AACrD,SAAO,EAAE,GAAG,YAAY,SAAS,cAAc,SAAS,gBAAgB,MAAM,OAAO,GAAG,OAAO,QAAQ,OAAO,UAAU,QAAQ,MAAM,WAAW,KAAK;AACxJ;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAA6B,OAAoB;AAApB;AAAA,EAAqB;AAAA,EAElD,MAAM,QACJ,gBACA,YAC8B;AAC9B,UAAM,YAAY,kBAAkB,cAAc;AAClD,UAAM,QAAQ,qBAAqB,UAAU;AAC7C,WAAO,KAAK,MAAM,cAAc;AAAA,MAC9B,GAAG;AAAA,MACH,WAAW,UAAU;AAAA,MACrB,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QACJ,gBACA,QAA4B,CAAC,GACP;AACtB,UAAM,YAAY,kBAAkB,cAAc;AAClD,WAAO,KAAK,MAAM,aAAa,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAC3E;AAAA,EAEA,MAAM,YAAY,gBAAiC,YAAuC;AACxF,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,CAAC,WAAW,UAAU,WAAW,SAAS,KAAK;AAC/E,YAAM,IAAI,sBAAsB,mDAAmD;AAAA,IACrF;AACA,UAAM,MAAM,WAAW,IAAI,CAAC,OAAO,aAAa,IAAI,WAAW,CAAC;AAChE,WAAO,KAAK,MAAM,cAAc,WAAW,GAAG;AAAA,EAChD;AAAA,EAEA,MAAM,MACJ,gBACA,UAAsD,CAAC,GACW;AAClE,UAAM,YAAY,kBAAkB,cAAc;AAClD,kCAA8B,QAAQ,WAAW;AACjD,UAAM,WAAW,MAAM,KAAK,MAAM,cAAc,WAAW;AAAA,MACzD,SAAS,gBAAgB,QAAQ,OAAO;AAAA,IAC1C,CAAC;AACD,WAAO,UAAU,aAAa,EAAE,UAAU,YAAY,SAAS,WAAW,IAAI;AAAA,EAChF;AAAA,EAEA,MAAM,OACJ,gBACA,YACA,YACA,UAAU,KACsB;AAChC,UAAM,YAAY,kBAAkB,cAAc;AAClD,WAAO,KAAK,MAAM;AAAA,MAChB;AAAA,MACA,aAAa,YAAY,YAAY;AAAA,MACrC,aAAa,YAAY,YAAY;AAAA,MACrC,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,gBACA,YACA,YACgC;AAChC,UAAM,YAAY,kBAAkB,cAAc;AAClD,WAAO,KAAK,MAAM;AAAA,MAChB;AAAA,MACA,aAAa,YAAY,YAAY;AAAA,MACrC,aAAa,YAAY,YAAY;AAAA,MACrC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,gBACA,YACA,YACA,OACA,cAA0C,SAC1C,uBACgC;AAChC,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,CAAC,SAAS,QAAQ,MAAM,KAAK,EAAE,SAAS,WAAoB,GAAG;AAClE,YAAM,IAAI,sBAAsB,mCAAmC;AAAA,IACrE;AACA,QAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAC9C,YAAM,IAAI,sBAAsB,mBAAmB;AAAA,IACrD;AACA,kCAA8B,qBAAqB;AACnD,WAAO,KAAK,MAAM;AAAA,MAChB;AAAA,MACA,aAAa,YAAY,YAAY;AAAA,MACrC,aAAa,YAAY,YAAY;AAAA,MACrC,gBAAgB,UAAU,gBAAgB,OAAO,SAAS;AAAA,MAC1D,MAAM,MAAM,GAAG,IAAK;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,gBAAiC,QAAuB,CAAC,GAAG;AAC3E,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,eAAgB,OAAM,IAAI,sBAAsB,oDAAoD;AACpH,UAAM,QAAQ,MAAM,SAAS;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAK,OAAM,IAAI,sBAAsB,iCAAiC;AAC/H,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,CAAC,aAAa,aAAa,KAAK,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,sBAAsB,iBAAiB;AACxG,UAAM,cAA+B,CAAC,WAAW,WAAW,SAAS,YAAY,QAAQ,WAAW;AACpG,QAAI,MAAM,WAAW,WAAc,CAAC,MAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,OAAO,KAAK,CAAC,UAAU,CAAC,YAAY,SAAS,KAAK,CAAC,IAAI;AAC9H,YAAM,IAAI,sBAAsB,2CAA2C;AAAA,IAC7E;AACA,UAAM,YAAY,MAAM,WAAW,KAAK;AACxC,QAAI,cAAc,WAAc,CAAC,aAAa,UAAU,SAAS,KAAM,OAAM,IAAI,sBAAsB,sBAAsB;AAC7H,WAAO,KAAK,MAAM,eAAe,WAAW;AAAA,MAC1C,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,WAAW,MAAM,YAAY,aAAa,MAAM,WAAW,WAAW,IAAI;AAAA,MAC1E;AAAA,MACA,QAAQ,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK,IAAI;AAAA,IAC7D,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,eAAe,gBAAiC,YAAoB,QAA6C,CAAC,GAAG;AACzH,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,mBAAoB,OAAM,IAAI,sBAAsB,0DAA0D;AAC9H,UAAM,QAAQ,MAAM,SAAS;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAK,OAAM,IAAI,sBAAsB,iCAAiC;AAC/H,WAAO,KAAK,MAAM,mBAAmB,WAAW,aAAa,YAAY,YAAY,GAAG,EAAE,GAAG,OAAO,MAAM,CAAC;AAAA,EAC7G;AAAA,EAEA,MAAM,OAAO,gBAAiC,YAAoB;AAChE,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,eAAgB,OAAM,IAAI,sBAAsB,yDAAyD;AACzH,WAAO,KAAK,MAAM,eAAe,WAAW,aAAa,YAAY,YAAY,CAAC;AAAA,EACpF;AAAA,EAEA,MAAM,QAAQ,gBAAiC,YAAoB;AACjE,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,gBAAiB,OAAM,IAAI,sBAAsB,oDAAoD;AACrH,WAAO,KAAK,MAAM,gBAAgB,WAAW,aAAa,YAAY,YAAY,CAAC;AAAA,EACrF;AAAA,EAEA,MAAM,UACJ,gBACA,UAA+E,CAAC,GACxD;AACxB,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,UAAU,SAAU,OAAM,IAAI,sBAAsB,mCAAmC;AAC5F,QAAI,CAAC,KAAK,MAAM,UAAW,OAAM,IAAI,sBAAsB,4CAA4C;AACvG,QACE,QAAQ,gBAAgB,UACxB,OAAO,QAAQ,gBAAgB,UAC/B;AACA,YAAM,IAAI,sBAAsB,8BAA8B;AAAA,IAChE;AACA,UAAM,cAAc,QAAQ,aAAa,KAAK;AAC9C,QAAI,eAAe,YAAY,SAAS,IAAK,OAAM,IAAI,sBAAsB,oCAAoC;AACjH,QAAI,QAAQ,iBAAiB,UAAa,CAAC,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAC9E,YAAM,IAAI,sBAAsB,+BAA+B;AAAA,IACjE;AACA,UAAM,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU;AAC3E,UAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,KAAK,MAAM,SAAS,IAAK,OAAM,IAAI,sBAAsB,uBAAuB;AAC7H,aAAO,MAAM,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,aAAa,SAAS,GAAI,OAAM,IAAI,sBAAsB,iCAAiC;AAC/F,WAAO,KAAK,MAAM,UAAU,WAAW,gBAAgB,QAAQ,OAAO,GAAG,aAAa,YAAY;AAAA,EACpG;AAAA,EAEA,MAAM,SAAS,gBAA2D;AACxE,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,aAAc,OAAM,IAAI,sBAAsB,4CAA4C;AAC1G,WAAO,KAAK,MAAM,aAAa,SAAS;AAAA,EAC1C;AACF;","names":[]}