@creatornader/agent-bridge 0.3.1 → 0.4.0

package/dist/chunk-DQOZJJZ2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/sqlite-database-contract.ts","../src/sqlite-bridge-store.ts","../src/sqlite-retry.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport type { DatabaseSync as Database } from \"node:sqlite\";\n\ntype Row = Record<string, unknown>;\n\nexport const LOCAL_SQLITE_APPLICATION_ID = 0x41424732;\nexport const EDGE_SQLITE_APPLICATION_ID = 0x41424745;\nexport const SQLITE_DATABASE_SCHEMA_VERSION = 1;\nexport const SQLITE_METADATA_TABLE = \"agent_bridge_metadata\";\nexport const LOCAL_SQLITE_SCHEMA_CONTRACTS = Object.freeze([\n  Object.freeze({ id: \"current-created-schema\", sha256: \"e2f978c27ea5d151a4b4b3ec349166833441e42401fedfe60dc3ba20f3d713aa\" }),\n  Object.freeze({ id: \"current-upgraded-project-column\", sha256: \"cb0975bbc1ccc7a2a66d8f4d76df619804449cf81119972337afad6cdab64451\" }),\n  Object.freeze({ id: \"current-upgraded-delivery-policy\", sha256: \"d4fd8905ea73057b27662454c16c038834f5a1bf017db9cfc041792104aa2e6d\" }),\n  Object.freeze({ id: \"current-upgraded-delivery-events\", sha256: \"35bdab0cbdf4ce619ba1c7d36032379ae4d9692bd7509e49bb90b409bbbcf632\" }),\n] as const);\nexport const EDGE_SQLITE_SCHEMA_CONTRACTS = Object.freeze([\n  Object.freeze({ id: \"current-created-schema\", sha256: \"27f22b2f4024585c87e8d6f76f8999a8df92bb1f585d46594a7a1e852fd53c4c\" }),\n  Object.freeze({ id: \"current-upgraded-project-column\", sha256: \"171ae11f520b4963f517d3102de64cb8a5f45c080078ff02e20aeb17891b585c\" }),\n  Object.freeze({ id: \"current-upgraded-project-column-migration-gate\", sha256: \"790b4bfed373ff776ba6700065154f7a3cbbecd94f37ea09a654768ac2a8455c\" }),\n  Object.freeze({ id: \"current-upgraded-migration-gate\", sha256: \"64634eae28f344f02324e6c002e4cc35ea9a99fe878de843df018482bdde38ef\" }),\n] as const);\nconst localContractHashes = new Set<string>(LOCAL_SQLITE_SCHEMA_CONTRACTS.map((contract) => contract.sha256));\nconst edgeContractHashes = new Set<string>(EDGE_SQLITE_SCHEMA_CONTRACTS.map((contract) => contract.sha256));\nexport const isSupportedLocalSqliteSchemaContract = (hash: string): boolean => localContractHashes.has(hash);\nexport const isSupportedEdgeSqliteSchemaContract = (hash: string): boolean => edgeContractHashes.has(hash);\n\nconst localMetadata = {\n  database_kind: \"local-authority\",\n  schema_name: \"agent-bridge-local-v2\",\n  schema_version: SQLITE_DATABASE_SCHEMA_VERSION,\n} as const;\n\nconst edgeMetadata = {\n  database_kind: \"edge-cache\",\n  schema_name: \"agent-bridge-edge-v1\",\n  schema_version: SQLITE_DATABASE_SCHEMA_VERSION,\n} as const;\n\nconst localColumns: Record<string, readonly string[]> = {\n  agent_bridge_metadata: [\"singleton\", \"database_kind\", \"schema_name\", \"schema_version\"],\n  bridge_messages: [\n    \"sequence\", \"id\", \"workspace\", \"project\", \"source\", \"type\", \"content\", \"content_type\", \"data\", \"targets\",\n    \"thread_id\", \"reply_to_id\", \"correlation_id\", \"causation_id\", \"priority\", \"expires_at\", \"idempotency_key\",\n    \"atrib_receipt_id\", \"informed_by\", \"metadata\", \"delivery_policy\", \"created_at\",\n  ],\n  bridge_receipts: [\"workspace\", \"message_id\", \"principal\", \"read_at\"],\n  bridge_deliveries: [\n    \"id\", \"message_id\", \"workspace\", \"recipient\", \"state\", \"attempt\", \"cycle_attempt\", \"requeue_count\", \"created_at\",\n    \"priority_rank\", \"available_at\", \"lease_token\", \"lease_owner\", \"lease_expires_at\", \"last_error\", \"last_actor\", \"last_action\",\n  ],\n  bridge_delivery_events: [\n    \"sequence\", \"delivery_id\", \"message_id\", \"workspace\", \"recipient\", \"from_state\", \"to_state\", \"attempt\", \"cycle_attempt\",\n    \"requeue_count\", \"lease_owner\", \"error\", \"actor\", \"action\", \"created_at\",\n  ],\n  bridge_presence: [\"workspace\", \"agent\", \"instance\", \"runtime_type\", \"capabilities\", \"lease_expires_at\", \"last_seen_at\"],\n};\n\nconst localObjects = new Map<string, [string, string]>([\n  [\"agent_bridge_metadata\", [\"table\", \"agent_bridge_metadata\"]],\n  [\"bridge_deliveries\", [\"table\", \"bridge_deliveries\"]],\n  [\"bridge_delivery_events\", [\"table\", \"bridge_delivery_events\"]],\n  [\"bridge_messages\", [\"table\", \"bridge_messages\"]],\n  [\"bridge_presence\", [\"table\", \"bridge_presence\"]],\n  [\"bridge_receipts\", [\"table\", \"bridge_receipts\"]],\n  [\"bridge_deliveries_claim\", [\"index\", \"bridge_deliveries\"]],\n  [\"bridge_deliveries_publisher\", [\"index\", \"bridge_deliveries\"]],\n  [\"bridge_deliveries_terminal\", [\"index\", \"bridge_deliveries\"]],\n  [\"bridge_delivery_events_lookup\", [\"index\", \"bridge_delivery_events\"]],\n  [\"bridge_messages_created\", [\"index\", \"bridge_messages\"]],\n  [\"bridge_messages_cursor\", [\"index\", \"bridge_messages\"]],\n  [\"bridge_messages_idempotency\", [\"index\", \"bridge_messages\"]],\n  [\"bridge_messages_project\", [\"index\", \"bridge_messages\"]],\n  [\"bridge_messages_source\", [\"index\", \"bridge_messages\"]],\n  [\"bridge_messages_thread\", [\"index\", \"bridge_messages\"]],\n  [\"bridge_presence_active\", [\"index\", \"bridge_presence\"]],\n  [\"bridge_delivery_events_insert\", [\"trigger\", \"bridge_deliveries\"]],\n  [\"bridge_delivery_events_update\", [\"trigger\", \"bridge_deliveries\"]],\n  [\"bridge_messages_no_delete\", [\"trigger\", \"bridge_messages\"]],\n  [\"bridge_messages_no_update\", [\"trigger\", \"bridge_messages\"]],\n  [\"bridge_messages_policy_insert\", [\"trigger\", \"bridge_messages\"]],\n  [\"bridge_messages_domain_insert\", [\"trigger\", \"bridge_messages\"]],\n  [\"agent_bridge_metadata_no_delete\", [\"trigger\", \"agent_bridge_metadata\"]],\n  [\"agent_bridge_metadata_no_update\", [\"trigger\", \"agent_bridge_metadata\"]],\n]);\n\nconst edgeColumns: Record<string, readonly string[]> = {\n  agent_bridge_metadata: [\"singleton\", \"database_kind\", \"schema_name\", \"schema_version\"],\n  edge_scopes: [\"scope_key\", \"endpoint_hash\", \"workspace\", \"agent\", \"pull_cursor\", \"last_sync_at\", \"last_error\", \"last_outbound_sync_at\", \"last_inbound_sync_at\", \"last_attempt_at\", \"cache_contract\"],\n  edge_migration_gates: [\"scope_key\", \"state\", \"operation_id\", \"lease_token\", \"lease_expires_at\", \"updated_at\"],\n  edge_outbox: [\"position\", \"scope_key\", \"message_id\", \"idempotency_key\", \"payload_hash\", \"draft_json\", \"state\", \"attempts\", \"available_at\", \"lease_token\", \"lease_expires_at\", \"last_error\", \"blocked_at\", \"created_at\"],\n  edge_inbox: [\"scope_key\", \"message_id\", \"remote_sequence\", \"sequence_key\", \"workspace\", \"project\", \"source\", \"type\", \"thread_id\", \"created_at\", \"expires_at\", \"message_json\"],\n};\n\nconst edgeObjects = new Map<string, [string, string]>([\n  [\"agent_bridge_metadata\", [\"table\", \"agent_bridge_metadata\"]],\n  [\"edge_scopes\", [\"table\", \"edge_scopes\"]],\n  [\"edge_migration_gates\", [\"table\", \"edge_migration_gates\"]],\n  [\"edge_outbox\", [\"table\", \"edge_outbox\"]],\n  [\"edge_inbox\", [\"table\", \"edge_inbox\"]],\n  [\"edge_inbox_created\", [\"index\", \"edge_inbox\"]],\n  [\"edge_inbox_cursor\", [\"index\", \"edge_inbox\"]],\n  [\"edge_inbox_project\", [\"index\", \"edge_inbox\"]],\n  [\"edge_inbox_source\", [\"index\", \"edge_inbox\"]],\n  [\"edge_inbox_thread\", [\"index\", \"edge_inbox\"]],\n  [\"edge_outbox_due\", [\"index\", \"edge_outbox\"]],\n  [\"edge_migration_gates_state\", [\"index\", \"edge_migration_gates\"]],\n  [\"edge_outbox_migration_gate_insert\", [\"trigger\", \"edge_outbox\"]],\n  [\"agent_bridge_metadata_no_delete\", [\"trigger\", \"agent_bridge_metadata\"]],\n  [\"agent_bridge_metadata_no_update\", [\"trigger\", \"agent_bridge_metadata\"]],\n]);\n\nexport class SQLiteDatabaseContractError extends Error {}\n\nfunction normalizeSql(sql: string): string {\n  let output = \"\"; let quote = \"\"; let pendingSpace = false;\n  for (let index = 0; index < sql.length; index += 1) {\n    const character = sql[index]!;\n    if (quote) {\n      output += character;\n      if ((quote === \"]\" && character === \"]\") || (quote !== \"]\" && character === quote)) {\n        if (sql[index + 1] === character && quote !== \"]\") { output += sql[++index]!; }\n        else quote = \"\";\n      }\n      continue;\n    }\n    if (/\\s/u.test(character)) { pendingSpace = output.length > 0; continue; }\n    if (pendingSpace && !/[(),;]/u.test(character) && !/[(),;]/u.test(output[output.length - 1] ?? \"\")) output += \" \";\n    pendingSpace = false;\n    if (character === \"'\" || character === '\"' || character === \"`\") quote = character;\n    else if (character === \"[\") quote = \"]\";\n    output += quote ? character : character.toLowerCase();\n  }\n  return output.trim();\n}\n\nfunction stableRows(rows: Row[]): Array<Record<string, string | number | null>> {\n  return rows.map((row) => Object.fromEntries(Object.keys(row).sort().map((key) => {\n    const value = row[key]; return [key, value === null ? null : typeof value === \"number\" ? value : String(value)];\n  })));\n}\n\nfunction quoteIdentifier(value: string): string { return `\"${value.split('\"').join('\"\"')}\"`; }\n\nexport function sqliteSchemaContractHash(db: Database): string {\n  const objects = (db.prepare(\"SELECT type,name,tbl_name,sql FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' ORDER BY type,name\").all() as Row[])\n    .map((row) => ({ type: String(row.type), name: String(row.name), table: String(row.tbl_name), sql: normalizeSql(String(row.sql)) }));\n  const tables = objects.filter((object) => object.type === \"table\").map((object) => ({\n    name: object.name,\n    columns: stableRows(db.prepare(`PRAGMA table_info(${quoteIdentifier(object.name)})`).all() as Row[]),\n    foreignKeys: stableRows(db.prepare(`PRAGMA foreign_key_list(${quoteIdentifier(object.name)})`).all() as Row[]),\n    indexes: (db.prepare(`PRAGMA index_list(${quoteIdentifier(object.name)})`).all() as Row[])\n      .sort((left, right) => String(left.name).localeCompare(String(right.name))).map((row) => ({\n        ...Object.fromEntries(Object.keys(row).filter((key) => key !== \"seq\").sort().map((key) => [key, row[key] === null ? null : typeof row[key] === \"number\" ? row[key] : String(row[key])])),\n        columns: stableRows(db.prepare(`PRAGMA index_xinfo(${quoteIdentifier(String(row.name))})`).all() as Row[]),\n      })),\n  }));\n  return createHash(\"sha256\").update(JSON.stringify({ objects, tables })).digest(\"hex\");\n}\n\nfunction assertUpgradeCandidate(db: Database, allowed: ReadonlyMap<string, [string, string]>, oppositePrefix: string, label: string): void {\n  if (objectNames(db, oppositePrefix).length) throw new SQLiteDatabaseContractError(`${label} database kind is invalid`);\n  const rows = db.prepare(\"SELECT type,name,tbl_name FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' ORDER BY name\").all() as Row[];\n  for (const row of rows) {\n    const expected = allowed.get(String(row.name));\n    if (!expected || expected[0] !== String(row.type) || expected[1] !== String(row.tbl_name)) {\n      throw new SQLiteDatabaseContractError(`${label} database has an unexpected pre-migration schema object`);\n    }\n  }\n}\n\nexport function assertLocalUpgradeCandidate(db: Database): void { assertUpgradeCandidate(db, localObjects, \"edge_\", \"local authority\"); }\nexport function assertEdgeUpgradeCandidate(db: Database): void { assertUpgradeCandidate(db, edgeObjects, \"bridge_\", \"edge\"); }\n\nfunction scalar(db: Database, pragma: string): number {\n  const row = db.prepare(pragma).get() as Row;\n  return Number(Object.values(row)[0]);\n}\n\nfunction objectNames(db: Database, prefix: string): string[] {\n  return (db.prepare(\"SELECT name FROM sqlite_master WHERE type='table' AND name LIKE ? ORDER BY name\").all(`${prefix}%`) as Row[])\n    .map((row) => String(row.name));\n}\n\nfunction metadata(db: Database): Record<string, string | number> {\n  const exists = db.prepare(\"SELECT 1 FROM sqlite_master WHERE type='table' AND name=?\").get(SQLITE_METADATA_TABLE);\n  if (!exists) return {};\n  const row = db.prepare(`SELECT singleton,database_kind,schema_name,schema_version FROM ${SQLITE_METADATA_TABLE}`).get() as Row | undefined;\n  if (!row || Number(row.singleton) !== 1) return {};\n  return { database_kind: String(row.database_kind), schema_name: String(row.schema_name), schema_version: Number(row.schema_version) };\n}\n\nfunction installMarkers(db: Database, applicationId: number, expected: { database_kind: string; schema_name: string; schema_version: number }): void {\n  const currentApplicationId = scalar(db, \"PRAGMA application_id\");\n  if (currentApplicationId !== 0 && currentApplicationId !== applicationId) {\n    throw new SQLiteDatabaseContractError(\"SQLite database kind marker does not match the selected store\");\n  }\n  const currentVersion = scalar(db, \"PRAGMA user_version\");\n  if (currentVersion !== 0 && currentVersion !== SQLITE_DATABASE_SCHEMA_VERSION) {\n    throw new SQLiteDatabaseContractError(\"SQLite database schema version is unsupported\");\n  }\n  db.exec(`CREATE TABLE IF NOT EXISTS ${SQLITE_METADATA_TABLE} (\n    singleton INTEGER PRIMARY KEY CHECK(singleton=1), database_kind TEXT NOT NULL,\n    schema_name TEXT NOT NULL, schema_version INTEGER NOT NULL CHECK(schema_version>=1)\n  ) WITHOUT ROWID`);\n  const existing = metadata(db);\n  if (Object.keys(existing).length && Object.entries(expected).some(([key, value]) => existing[key] !== value)) {\n    throw new SQLiteDatabaseContractError(\"SQLite database metadata does not match the selected store\");\n  }\n  db.prepare(`INSERT OR IGNORE INTO ${SQLITE_METADATA_TABLE}(singleton,database_kind,schema_name,schema_version) VALUES (1,?,?,?)`)\n    .run(expected.database_kind, expected.schema_name, expected.schema_version);\n  db.exec(`CREATE TRIGGER IF NOT EXISTS agent_bridge_metadata_no_update BEFORE UPDATE ON ${SQLITE_METADATA_TABLE}\n    BEGIN SELECT RAISE(ABORT,'database metadata is immutable'); END;\n    CREATE TRIGGER IF NOT EXISTS agent_bridge_metadata_no_delete BEFORE DELETE ON ${SQLITE_METADATA_TABLE}\n    BEGIN SELECT RAISE(ABORT,'database metadata is immutable'); END`);\n  db.exec(`PRAGMA application_id = ${applicationId}; PRAGMA user_version = ${SQLITE_DATABASE_SCHEMA_VERSION}`);\n}\n\nexport function installLocalAuthorityMarkers(db: Database): void {\n  if (objectNames(db, \"edge_\").length) throw new SQLiteDatabaseContractError(\"edge databases cannot be opened as local authority stores\");\n  installMarkers(db, LOCAL_SQLITE_APPLICATION_ID, localMetadata);\n  assertLocalAuthorityDatabase(db);\n}\n\nexport function installEdgeMarkers(db: Database): void {\n  if (objectNames(db, \"bridge_\").length) throw new SQLiteDatabaseContractError(\"local authority databases cannot be opened as edge stores\");\n  installMarkers(db, EDGE_SQLITE_APPLICATION_ID, edgeMetadata);\n  assertEdgeDatabase(db);\n}\n\nexport function identifySqliteDatabase(db: Database): \"local-authority\" | \"edge-cache\" | \"legacy-local\" | \"legacy-edge\" | \"unknown\" {\n  const applicationId = scalar(db, \"PRAGMA application_id\");\n  const declared = metadata(db).database_kind;\n  if ((applicationId === LOCAL_SQLITE_APPLICATION_ID && declared === \"edge-cache\")\n    || (applicationId === EDGE_SQLITE_APPLICATION_ID && declared === \"local-authority\")) {\n    throw new SQLiteDatabaseContractError(\"SQLite application and metadata kind markers conflict\");\n  }\n  if (applicationId === LOCAL_SQLITE_APPLICATION_ID || declared === \"local-authority\") return \"local-authority\";\n  if (applicationId === EDGE_SQLITE_APPLICATION_ID || declared === \"edge-cache\") return \"edge-cache\";\n  if (objectNames(db, \"edge_\").length) return \"legacy-edge\";\n  if (objectNames(db, \"bridge_\").length) return \"legacy-local\";\n  return \"unknown\";\n}\n\nexport function assertEdgeDatabase(db: Database): void {\n  if (identifySqliteDatabase(db) !== \"edge-cache\") throw new SQLiteDatabaseContractError(\"database is not a marked edge store\");\n  if (scalar(db, \"PRAGMA application_id\") !== EDGE_SQLITE_APPLICATION_ID\n    || scalar(db, \"PRAGMA user_version\") !== SQLITE_DATABASE_SCHEMA_VERSION) throw new SQLiteDatabaseContractError(\"edge database markers are invalid\");\n  const actualMetadata = metadata(db);\n  if (Object.keys(actualMetadata).length !== Object.keys(edgeMetadata).length\n    || Object.entries(edgeMetadata).some(([key, value]) => actualMetadata[key] !== value)) throw new SQLiteDatabaseContractError(\"edge database metadata is invalid\");\n  const rows = db.prepare(\"SELECT type,name,tbl_name FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' ORDER BY name\").all() as Row[];\n  if (rows.length !== edgeObjects.size) throw new SQLiteDatabaseContractError(\"edge database has an unexpected schema object set\");\n  for (const row of rows) {\n    const expected = edgeObjects.get(String(row.name));\n    if (!expected || expected[0] !== String(row.type) || expected[1] !== String(row.tbl_name)) throw new SQLiteDatabaseContractError(\"edge database has an unexpected schema object\");\n  }\n  for (const [table, expected] of Object.entries(edgeColumns)) {\n    const columns = (db.prepare(`PRAGMA table_info(${table})`).all() as Row[]).map((row) => String(row.name));\n    const ordered = [...columns].sort(); const expectedOrdered = [...expected].sort();\n    if (ordered.length !== expectedOrdered.length || ordered.some((column, index) => column !== expectedOrdered[index])) throw new SQLiteDatabaseContractError(\"edge database column contract is invalid\");\n  }\n  const contract = sqliteSchemaContractHash(db);\n  if (!isSupportedEdgeSqliteSchemaContract(contract)) throw new SQLiteDatabaseContractError(\"edge database schema contract hash is invalid\");\n}\n\nexport function assertLocalAuthorityDatabase(db: Database): void {\n  if (identifySqliteDatabase(db) !== \"local-authority\") throw new SQLiteDatabaseContractError(\"database is not a marked local authority store\");\n  if (scalar(db, \"PRAGMA application_id\") !== LOCAL_SQLITE_APPLICATION_ID\n    || scalar(db, \"PRAGMA user_version\") !== SQLITE_DATABASE_SCHEMA_VERSION) {\n    throw new SQLiteDatabaseContractError(\"local authority database markers are invalid\");\n  }\n  const actualMetadata = metadata(db);\n  if (Object.keys(actualMetadata).length !== Object.keys(localMetadata).length\n    || Object.entries(localMetadata).some(([key, value]) => actualMetadata[key] !== value)) {\n    throw new SQLiteDatabaseContractError(\"local authority database metadata is invalid\");\n  }\n  const rows = db.prepare(\"SELECT type,name,tbl_name FROM sqlite_master WHERE name NOT LIKE 'sqlite_%' ORDER BY name\").all() as Row[];\n  if (rows.length !== localObjects.size) throw new SQLiteDatabaseContractError(\"local authority database has an unexpected schema object set\");\n  for (const row of rows) {\n    const expected = localObjects.get(String(row.name));\n    if (!expected || expected[0] !== String(row.type) || expected[1] !== String(row.tbl_name)) {\n      throw new SQLiteDatabaseContractError(\"local authority database has an unexpected schema object\");\n    }\n  }\n  for (const [table, expected] of Object.entries(localColumns)) {\n    const columns = (db.prepare(`PRAGMA table_info(${table})`).all() as Row[]).map((row) => String(row.name));\n    const ordered = [...columns].sort(); const expectedOrdered = [...expected].sort();\n    if (ordered.length !== expectedOrdered.length || ordered.some((column, index) => column !== expectedOrdered[index])) {\n      throw new SQLiteDatabaseContractError(\"local authority database column contract is invalid\");\n    }\n  }\n  const contract = sqliteSchemaContractHash(db);\n  if (!isSupportedLocalSqliteSchemaContract(contract)) throw new SQLiteDatabaseContractError(\"local authority database schema contract hash is invalid\");\n}\n\nexport function verifySqliteHealth(db: Database): void {\n  const integrity = db.prepare(\"PRAGMA integrity_check\").all() as Row[];\n  if (integrity.length !== 1 || String(Object.values(integrity[0]!)[0]) !== \"ok\") {\n    throw new SQLiteDatabaseContractError(\"SQLite integrity check failed\");\n  }\n  const foreignKeys = db.prepare(\"PRAGMA foreign_key_check\").all() as Row[];\n  if (foreignKeys.length) throw new SQLiteDatabaseContractError(\"SQLite foreign key check failed\");\n}\n","import { randomUUID } from \"node:crypto\";\nimport { existsSync, lstatSync } from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport type { DatabaseSync as Database, SQLInputValue } from \"node:sqlite\";\nimport { DeliveryStateConflictError, cursorScope, decodeCursor, decodeScopedCursor, encodeCursor, encodeScopedCursor, scopedCursorScope, validateDeliveryCursorPosition, validateEventCursorPosition, type AgentPresence, type BridgeDelivery, type BridgeDeliveryEvent, type BridgeMessage, type BridgePrincipal } from \"./bridge-domain.js\";\nimport type { BridgeDiagnostics, BridgeStore, ClaimOptions, DeliveryQuery, InsertMessageResult, MessagePage, MessageQuery } from \"./bridge-store.js\";\nimport { assertIdempotentReplay } from \"./idempotency.js\";\nimport { retrySqliteBusy, SQLITE_INITIALIZATION_BUSY_TIMEOUT_MS } from \"./sqlite-retry.js\";\nimport { preparePrivateSqliteLocation, securePrivatePath, securePrivateSqliteSidecar, verifyPrivatePathAccess } from \"./private-path.js\";\nimport { assertLocalUpgradeCandidate, installLocalAuthorityMarkers } from \"./sqlite-database-contract.js\";\n\ntype Row = Record<string, unknown>;\nconst require = createRequire(import.meta.url);\nfunction openDatabase(path: string): Database {\n  const { DatabaseSync } = require(\"node:sqlite\") as typeof import(\"node:sqlite\");\n  return new DatabaseSync(path);\n}\nconst schema = `\nPRAGMA journal_mode = WAL;\nPRAGMA synchronous = FULL;\nPRAGMA foreign_keys = ON;\nCREATE TABLE IF NOT EXISTS bridge_messages (\n sequence INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT NOT NULL UNIQUE, workspace TEXT NOT NULL, project TEXT, source TEXT NOT NULL,\n type TEXT NOT NULL, content TEXT NOT NULL, content_type TEXT NOT NULL, data TEXT, targets TEXT NOT NULL DEFAULT '[]',\n thread_id TEXT, reply_to_id TEXT, correlation_id TEXT, causation_id TEXT, priority TEXT NOT NULL, expires_at TEXT,\n idempotency_key TEXT, atrib_receipt_id TEXT, informed_by TEXT, metadata TEXT, delivery_policy TEXT NOT NULL, created_at TEXT NOT NULL,\n UNIQUE(workspace, id), CHECK(json_valid(targets) AND json_type(targets) = 'array'),\n CHECK(priority IN ('info', 'high', 'urgent')),\n CHECK(json_valid(delivery_policy) AND json_type(delivery_policy)='object'),\n CHECK(\n   (json_extract(delivery_policy,'$.mode')='mailbox'\n     AND json_type(delivery_policy,'$.maxAttempts') IS NULL\n     AND json_type(delivery_policy,'$.retryBaseDelayMs') IS NULL\n     AND json_type(delivery_policy,'$.retryMaxDelayMs') IS NULL\n     AND json_type(delivery_policy,'$.retryJitterRatio') IS NULL\n     AND json_type(delivery_policy,'$.notBefore') IS NULL)\n   OR\n   (json_extract(delivery_policy,'$.mode')='leased'\n     AND json_array_length(targets)>0\n     AND json_type(delivery_policy,'$.maxAttempts')='integer'\n     AND json_extract(delivery_policy,'$.maxAttempts') BETWEEN 1 AND 100\n     AND json_type(delivery_policy,'$.retryBaseDelayMs')='integer'\n     AND json_extract(delivery_policy,'$.retryBaseDelayMs') BETWEEN 1 AND 3600000\n     AND json_type(delivery_policy,'$.retryMaxDelayMs')='integer'\n     AND json_extract(delivery_policy,'$.retryMaxDelayMs') BETWEEN json_extract(delivery_policy,'$.retryBaseDelayMs') AND 86400000\n     AND json_type(delivery_policy,'$.retryJitterRatio') IN ('integer','real')\n     AND json_extract(delivery_policy,'$.retryJitterRatio') BETWEEN 0 AND 1\n     AND (json_type(delivery_policy,'$.notBefore') IS NULL OR (\n       json_type(delivery_policy,'$.notBefore')='text'\n       AND julianday(json_extract(delivery_policy,'$.notBefore')) IS NOT NULL\n       AND (expires_at IS NULL OR julianday(json_extract(delivery_policy,'$.notBefore'))<julianday(expires_at))\n     )))\n )\n);\nCREATE UNIQUE INDEX IF NOT EXISTS bridge_messages_idempotency ON bridge_messages(workspace, source, idempotency_key) WHERE idempotency_key IS NOT NULL;\nCREATE INDEX IF NOT EXISTS bridge_messages_cursor ON bridge_messages(workspace, sequence);\nCREATE INDEX IF NOT EXISTS bridge_messages_source ON bridge_messages(workspace, source, sequence);\nCREATE INDEX IF NOT EXISTS bridge_messages_thread ON bridge_messages(workspace, thread_id, sequence) WHERE thread_id IS NOT NULL;\nCREATE INDEX IF NOT EXISTS bridge_messages_created ON bridge_messages(workspace, created_at, sequence);\nCREATE TABLE IF NOT EXISTS bridge_receipts (workspace TEXT NOT NULL, message_id TEXT NOT NULL, principal TEXT NOT NULL, read_at TEXT NOT NULL, PRIMARY KEY(workspace, message_id, principal), FOREIGN KEY(workspace, message_id) REFERENCES bridge_messages(workspace, id) ON DELETE CASCADE);\nCREATE TABLE IF NOT EXISTS bridge_deliveries (\n id TEXT PRIMARY KEY, message_id TEXT NOT NULL, workspace TEXT NOT NULL, recipient TEXT NOT NULL,\n state TEXT NOT NULL, attempt INTEGER NOT NULL DEFAULT 0, cycle_attempt INTEGER NOT NULL DEFAULT 0, requeue_count INTEGER NOT NULL DEFAULT 0,\n created_at TEXT NOT NULL, priority_rank INTEGER NOT NULL, available_at TEXT NOT NULL,\n lease_token TEXT, lease_owner TEXT, lease_expires_at TEXT, last_error TEXT, last_actor TEXT, last_action TEXT NOT NULL,\n UNIQUE(message_id, recipient), FOREIGN KEY(workspace, message_id) REFERENCES bridge_messages(workspace, id) ON DELETE CASCADE,\n CHECK(state IN ('pending', 'claimed', 'acked', 'retrying', 'dead', 'cancelled')), CHECK(attempt >= 0 AND cycle_attempt >= 0 AND cycle_attempt <= attempt AND requeue_count >= 0),\n CHECK(priority_rank BETWEEN 0 AND 2),\n CHECK((state = 'claimed' AND lease_token IS NOT NULL AND lease_expires_at IS NOT NULL) OR (state <> 'claimed' AND lease_token IS NULL AND lease_owner IS NULL AND lease_expires_at IS NULL))\n);\nCREATE TABLE IF NOT EXISTS bridge_delivery_events (\n sequence INTEGER PRIMARY KEY AUTOINCREMENT, delivery_id TEXT NOT NULL,\n message_id TEXT NOT NULL, workspace TEXT NOT NULL, recipient TEXT NOT NULL,\n from_state TEXT, to_state TEXT NOT NULL, attempt INTEGER NOT NULL, cycle_attempt INTEGER NOT NULL,\n requeue_count INTEGER NOT NULL, lease_owner TEXT, error TEXT, actor TEXT NOT NULL, action TEXT NOT NULL, created_at TEXT NOT NULL\n);\nCREATE TABLE IF NOT EXISTS bridge_presence (\n workspace TEXT NOT NULL, agent TEXT NOT NULL, instance TEXT NOT NULL, runtime_type TEXT,\n capabilities TEXT NOT NULL DEFAULT '[]', lease_expires_at TEXT NOT NULL, last_seen_at TEXT NOT NULL,\n PRIMARY KEY(workspace, agent, instance), CHECK(json_valid(capabilities) AND json_type(capabilities)='array')\n);\nCREATE INDEX IF NOT EXISTS bridge_presence_active ON bridge_presence(workspace, lease_expires_at);\nCREATE TRIGGER IF NOT EXISTS bridge_messages_no_update BEFORE UPDATE ON bridge_messages BEGIN SELECT RAISE(ABORT, 'bridge messages are immutable'); END;\nCREATE TRIGGER IF NOT EXISTS bridge_messages_no_delete BEFORE DELETE ON bridge_messages BEGIN SELECT RAISE(ABORT, 'bridge messages are immutable'); END;\n`;\n\nfunction stringify(value: unknown): string | null { return value === undefined ? null : JSON.stringify(value); }\nfunction parse(value: unknown): any { return typeof value === \"string\" ? JSON.parse(value) : undefined; }\nfunction optionalString(value: unknown): string | undefined { return value == null ? undefined : String(value); }\nfunction message(row: Row): BridgeMessage { const policy=parse(row.delivery_policy);if(policy?.notBefore==null)delete policy?.notBefore;return { id: String(row.id), workspace: String(row.workspace), project: optionalString(row.project), source: String(row.source), sequence: String(row.sequence), type: String(row.type), content: String(row.content), contentType: String(row.content_type), data: parse(row.data), targets: parse(row.targets) ?? [], threadId: optionalString(row.thread_id), replyToId: optionalString(row.reply_to_id), correlationId: optionalString(row.correlation_id), causationId: optionalString(row.causation_id), priority: row.priority as BridgeMessage[\"priority\"], expiresAt: optionalString(row.expires_at), idempotencyKey: optionalString(row.idempotency_key), atribReceiptId: optionalString(row.atrib_receipt_id), informedBy: parse(row.informed_by), metadata: parse(row.metadata), deliveryPolicy: policy, createdAt: String(row.created_at) }; }\nfunction delivery(row: Row): BridgeDelivery { return { id: String(row.id), messageId: String(row.message_id), workspace: String(row.workspace), recipient: String(row.recipient), state: row.state as BridgeDelivery[\"state\"], attempt: Number(row.attempt), cycleAttempt: Number(row.cycle_attempt), requeueCount: Number(row.requeue_count), createdAt: String(row.created_at), priorityRank: Number(row.priority_rank), availableAt: String(row.available_at), leaseToken: optionalString(row.lease_token), leaseOwner: optionalString(row.lease_owner), leaseExpiresAt: optionalString(row.lease_expires_at), lastError: optionalString(row.last_error), lastActor: optionalString(row.last_actor), lastAction: row.last_action as BridgeDelivery[\"lastAction\"] }; }\nfunction presence(row: Row): AgentPresence { return { workspace: String(row.workspace), agent: String(row.agent), instance: String(row.instance), runtimeType: optionalString(row.runtime_type), capabilities: parse(row.capabilities) ?? [], leaseExpiresAt: String(row.lease_expires_at), lastSeenAt: String(row.last_seen_at) }; }\nfunction deliveryEvent(row: Row): BridgeDeliveryEvent { return { sequence: String(row.sequence), deliveryId: String(row.delivery_id), messageId: String(row.message_id), workspace: String(row.workspace), recipient: String(row.recipient), fromState: row.from_state == null ? undefined : row.from_state as BridgeDeliveryEvent[\"fromState\"], toState: row.to_state as BridgeDeliveryEvent[\"toState\"], attempt: Number(row.attempt), cycleAttempt: Number(row.cycle_attempt), requeueCount: Number(row.requeue_count), leaseOwner: optionalString(row.lease_owner), error: optionalString(row.error), actor: String(row.actor), action: row.action as BridgeDeliveryEvent[\"action\"], createdAt: String(row.created_at) }; }\n\nexport class SQLiteBridgeStore implements BridgeStore {\n  private readonly db: Database;\n  private readonly databasePath: string;\n  private readonly preexistingFiles: ReadonlySet<string>;\n  private initialized = false;\n  private initialization?: Promise<void>;\n  constructor(private readonly path = \":memory:\", private readonly busyTimeoutMs = 2_000) {\n    const selected = preparePrivateSqliteLocation(path, false, \"defer\");\n    this.databasePath = selected;\n    this.preexistingFiles = new Set(selected === \":memory:\" ? [] : [selected, `${selected}-wal`, `${selected}-shm`].filter(existsSync));\n    const before = selected === \":memory:\" || !existsSync(selected) ? undefined : lstatSync(selected);\n    this.db = openDatabase(selected);\n    try {\n      this.db.exec(`PRAGMA busy_timeout = ${Math.max(1, Math.trunc(this.busyTimeoutMs))}`);\n      this.restrictFiles(false);\n      if (before) {\n        const after = lstatSync(selected);\n        if (after.dev !== before.dev || after.ino !== before.ino) throw new Error(\"SQLite database path identity changed while opening\");\n      }\n    } catch (error) { this.db.close(); throw error; }\n  }\n  private restrictFiles(includeSidecars = true): void {\n    if (this.databasePath === \":memory:\") return;\n    const paths = includeSidecars\n      ? [this.databasePath, `${this.databasePath}-wal`, `${this.databasePath}-shm`]\n      : [this.databasePath];\n    for (const path of paths) {\n      if (!existsSync(path)) continue;\n      if (path === this.databasePath && this.preexistingFiles.has(path)) verifyPrivatePathAccess(path, \"file\");\n      else if (path === this.databasePath) securePrivatePath(path, \"file\");\n      else securePrivateSqliteSidecar(path);\n    }\n  }\n  async initialize(): Promise<void> {\n    if (this.initialized) return;\n    if (!this.initialization) {\n      this.initialization = this.initializeOnce().then(() => {\n        this.initialized = true;\n      }).catch((error) => {\n        this.initialization = undefined;\n        throw error;\n      });\n    }\n    return this.initialization;\n  }\n\n  private async initializeOnce(): Promise<void> {\n    const versionRow = this.db.prepare(\"SELECT sqlite_version() AS version\").get() as Row;\n    const parts = String(versionRow.version).split(\".\").map(Number);\n    const encoded = (parts[0] ?? 0) * 1_000_000 + (parts[1] ?? 0) * 1_000 + (parts[2] ?? 0);\n    if (encoded < 3_051_003) throw new Error(\"SQLite 3.51.3 or newer is required\");\n    assertLocalUpgradeCandidate(this.db);\n    const initializationTimeoutMs = Math.max(this.busyTimeoutMs, SQLITE_INITIALIZATION_BUSY_TIMEOUT_MS);\n    await retrySqliteBusy(() => this.db.exec(schema), initializationTimeoutMs);\n    await retrySqliteBusy(() => this.db.exec(\"BEGIN IMMEDIATE\"), initializationTimeoutMs);\n    try {\n      const columns = this.db.prepare(\"PRAGMA table_info(bridge_messages)\").all() as Row[];\n      if (!columns.some((column) => column.name === \"project\")) {\n        this.db.exec(\"ALTER TABLE bridge_messages ADD COLUMN project TEXT\");\n      }\n      const addedDeliveryPolicy = !columns.some((column) => column.name === \"delivery_policy\");\n      if (addedDeliveryPolicy) {\n        this.db.exec(\"DROP TRIGGER IF EXISTS bridge_messages_no_update\");\n        this.db.exec(`ALTER TABLE bridge_messages ADD COLUMN delivery_policy TEXT NOT NULL DEFAULT '{\"mode\":\"leased\",\"maxAttempts\":5,\"retryBaseDelayMs\":1000,\"retryMaxDelayMs\":60000,\"retryJitterRatio\":0.2}'`);\n        this.db.exec(\"CREATE TRIGGER bridge_messages_no_update BEFORE UPDATE ON bridge_messages BEGIN SELECT RAISE(ABORT, 'bridge messages are immutable'); END\");\n      }\n      const legacyPolicy = addedDeliveryPolicy || Boolean((this.db.prepare(`SELECT 1 FROM bridge_messages\n        WHERE json_type(delivery_policy,'$.publisherOwned') IS NOT NULL\n           OR json_type(delivery_policy,'$.baseDelayMs') IS NOT NULL\n           OR json_type(delivery_policy,'$.maxDelayMs') IS NOT NULL\n           OR json_type(delivery_policy,'$.jitterRatio') IS NOT NULL\n        LIMIT 1`).get() as Row | undefined));\n      if (legacyPolicy) {\n        this.db.exec(\"DROP TRIGGER IF EXISTS bridge_messages_no_update\");\n        if (addedDeliveryPolicy) {\n          this.db.exec(`UPDATE bridge_messages SET delivery_policy=CASE\n            WHEN json_array_length(targets)=0 THEN '{\"mode\":\"mailbox\"}'\n            ELSE '{\"mode\":\"leased\",\"maxAttempts\":5,\"retryBaseDelayMs\":1000,\"retryMaxDelayMs\":60000,\"retryJitterRatio\":0.2}' END`);\n        } else {\n          this.db.exec(`UPDATE bridge_messages SET delivery_policy=CASE\n            WHEN json_extract(delivery_policy,'$.mode')='mailbox' THEN\n              json_remove(delivery_policy,'$.publisherOwned','$.maxAttempts','$.baseDelayMs','$.maxDelayMs','$.jitterRatio','$.retryBaseDelayMs','$.retryMaxDelayMs','$.retryJitterRatio','$.notBefore')\n            ELSE json_set(\n              json_remove(delivery_policy,'$.publisherOwned','$.baseDelayMs','$.maxDelayMs','$.jitterRatio'),\n              '$.mode','leased',\n              '$.maxAttempts',coalesce(json_extract(delivery_policy,'$.maxAttempts'),5),\n              '$.retryBaseDelayMs',coalesce(json_extract(delivery_policy,'$.retryBaseDelayMs'),json_extract(delivery_policy,'$.baseDelayMs'),1000),\n              '$.retryMaxDelayMs',coalesce(json_extract(delivery_policy,'$.retryMaxDelayMs'),json_extract(delivery_policy,'$.maxDelayMs'),60000),\n              '$.retryJitterRatio',coalesce(json_extract(delivery_policy,'$.retryJitterRatio'),json_extract(delivery_policy,'$.jitterRatio'),0.2)\n            ) END\n            WHERE json_type(delivery_policy,'$.publisherOwned') IS NOT NULL\n               OR json_type(delivery_policy,'$.baseDelayMs') IS NOT NULL\n               OR json_type(delivery_policy,'$.maxDelayMs') IS NOT NULL\n               OR json_type(delivery_policy,'$.jitterRatio') IS NOT NULL`);\n        }\n        this.db.exec(\"CREATE TRIGGER bridge_messages_no_update BEFORE UPDATE ON bridge_messages BEGIN SELECT RAISE(ABORT, 'bridge messages are immutable'); END\");\n      }\n      const deliveryColumns = this.db.prepare(\"PRAGMA table_info(bridge_deliveries)\").all() as Row[];\n      if (!deliveryColumns.some((column) => column.name === \"last_action\")) {\n        this.db.exec(\"DROP TRIGGER IF EXISTS bridge_delivery_events_insert; DROP TRIGGER IF EXISTS bridge_delivery_events_update; DROP INDEX IF EXISTS bridge_deliveries_claim\");\n        const eventColumns = this.db.prepare(\"PRAGMA table_info(bridge_delivery_events)\").all() as Row[];\n        this.db.exec(`CREATE TABLE bridge_delivery_events_v10 (\n          sequence INTEGER PRIMARY KEY AUTOINCREMENT, delivery_id TEXT NOT NULL,\n          message_id TEXT NOT NULL, workspace TEXT NOT NULL, recipient TEXT NOT NULL,\n          from_state TEXT, to_state TEXT NOT NULL, attempt INTEGER NOT NULL,\n          cycle_attempt INTEGER NOT NULL, requeue_count INTEGER NOT NULL,\n          lease_owner TEXT, error TEXT, actor TEXT NOT NULL, action TEXT NOT NULL, created_at TEXT NOT NULL)`);\n        if (eventColumns.length) {\n          this.db.exec(`INSERT INTO bridge_delivery_events_v10\n            (sequence,delivery_id,message_id,workspace,recipient,from_state,to_state,attempt,cycle_attempt,requeue_count,lease_owner,error,actor,action,created_at)\n            SELECT event.sequence,event.delivery_id,event.message_id,event.workspace,event.recipient,\n              event.from_state,event.to_state,event.attempt,event.attempt,0,event.lease_owner,event.error,\n              CASE\n                WHEN event.from_state IS NULL THEN message.source\n                WHEN event.to_state='dead' AND event.error IN ('message expired','maximum attempts reached') THEN 'agent-bridge'\n                WHEN event.to_state IN ('acked','retrying','dead') THEN coalesce(\n                  event.lease_owner,\n                  (SELECT claim.lease_owner FROM bridge_delivery_events claim\n                   WHERE claim.delivery_id=event.delivery_id AND claim.to_state='claimed'\n                     AND claim.attempt=event.attempt AND claim.sequence<event.sequence\n                     AND claim.lease_owner IS NOT NULL\n                   ORDER BY claim.sequence DESC LIMIT 1),\n                  event.recipient)\n                ELSE coalesce(event.lease_owner,event.recipient)\n              END,CASE\n                WHEN event.from_state IS NULL THEN 'created'\n                WHEN event.to_state='claimed' THEN 'claim'\n                WHEN event.to_state='acked' THEN 'ack'\n                WHEN event.to_state='retrying' THEN 'nack_retry'\n                WHEN event.to_state='dead' AND event.error='message expired' THEN 'message_expired'\n                WHEN event.to_state='dead' AND event.error='maximum attempts reached' THEN 'attempts_exhausted'\n                WHEN event.to_state='dead' THEN 'nack_dead'\n                WHEN event.to_state='cancelled' THEN 'cancel'\n                ELSE 'created' END,event.created_at\n            FROM bridge_delivery_events event JOIN bridge_messages message\n              ON message.workspace=event.workspace AND message.id=event.message_id`);\n          this.db.exec(\"DROP TABLE bridge_delivery_events\");\n        }\n        this.db.exec(`CREATE TABLE bridge_deliveries_v10 (\n          id TEXT PRIMARY KEY, message_id TEXT NOT NULL, workspace TEXT NOT NULL, recipient TEXT NOT NULL,\n          state TEXT NOT NULL, attempt INTEGER NOT NULL DEFAULT 0, cycle_attempt INTEGER NOT NULL DEFAULT 0,\n          requeue_count INTEGER NOT NULL DEFAULT 0, created_at TEXT NOT NULL, priority_rank INTEGER NOT NULL,\n          available_at TEXT NOT NULL, lease_token TEXT, lease_owner TEXT,\n          lease_expires_at TEXT, last_error TEXT, last_actor TEXT, last_action TEXT NOT NULL, UNIQUE(message_id, recipient),\n          FOREIGN KEY(workspace,message_id) REFERENCES bridge_messages(workspace,id) ON DELETE CASCADE,\n          CHECK(state IN ('pending','claimed','acked','retrying','dead','cancelled')),\n          CHECK(attempt>=0 AND cycle_attempt>=0 AND cycle_attempt<=attempt AND requeue_count>=0),\n          CHECK(priority_rank BETWEEN 0 AND 2),\n          CHECK((state='claimed' AND lease_token IS NOT NULL AND lease_expires_at IS NOT NULL) OR (state<>'claimed' AND lease_token IS NULL AND lease_owner IS NULL AND lease_expires_at IS NULL)))`);\n        this.db.exec(`INSERT INTO bridge_deliveries_v10\n          (id,message_id,workspace,recipient,state,attempt,cycle_attempt,requeue_count,created_at,priority_rank,available_at,lease_token,lease_owner,lease_expires_at,last_error,last_actor,last_action)\n          SELECT delivery.id,delivery.message_id,delivery.workspace,delivery.recipient,delivery.state,delivery.attempt,delivery.attempt,0,\n            message.created_at,CASE message.priority WHEN 'urgent' THEN 0 WHEN 'high' THEN 1 ELSE 2 END,\n            delivery.available_at,delivery.lease_token,delivery.lease_owner,delivery.lease_expires_at,delivery.last_error,\n            CASE\n              WHEN delivery.state='pending' AND delivery.attempt=0 THEN message.source\n              WHEN delivery.state='dead' AND delivery.last_error IN ('message expired','maximum attempts reached') THEN 'agent-bridge'\n              ELSE coalesce(\n                delivery.lease_owner,\n                (SELECT event.lease_owner FROM bridge_delivery_events_v10 event\n                 WHERE event.delivery_id=delivery.id AND event.to_state='claimed'\n                   AND event.attempt=delivery.attempt AND event.lease_owner IS NOT NULL\n                 ORDER BY event.sequence DESC LIMIT 1),\n                delivery.recipient)\n            END,CASE\n              WHEN delivery.state='pending' AND delivery.attempt=0 THEN 'created'\n              WHEN delivery.state='claimed' THEN 'claim'\n              WHEN delivery.state='acked' THEN 'ack'\n              WHEN delivery.state='retrying' THEN 'nack_retry'\n              WHEN delivery.state='dead' AND delivery.last_error='message expired' THEN 'message_expired'\n              WHEN delivery.state='dead' AND delivery.last_error='maximum attempts reached' THEN 'attempts_exhausted'\n              WHEN delivery.state='dead' THEN 'nack_dead'\n              WHEN delivery.state='cancelled' THEN 'cancel'\n              ELSE 'created' END\n          FROM bridge_deliveries delivery JOIN bridge_messages message\n            ON message.workspace=delivery.workspace AND message.id=delivery.message_id`);\n        this.db.exec(\"DROP TABLE bridge_deliveries; ALTER TABLE bridge_deliveries_v10 RENAME TO bridge_deliveries\");\n        this.db.exec(\"ALTER TABLE bridge_delivery_events_v10 RENAME TO bridge_delivery_events\");\n      }\n      this.db.exec(\"CREATE INDEX IF NOT EXISTS bridge_deliveries_claim ON bridge_deliveries(workspace,recipient,priority_rank,available_at,created_at,id) WHERE state IN ('pending','retrying','claimed'); CREATE INDEX IF NOT EXISTS bridge_deliveries_publisher ON bridge_deliveries(workspace,message_id,created_at,id); CREATE INDEX IF NOT EXISTS bridge_deliveries_terminal ON bridge_deliveries(workspace,recipient,state,created_at,id) WHERE state IN ('dead','cancelled'); CREATE INDEX IF NOT EXISTS bridge_delivery_events_lookup ON bridge_delivery_events(workspace,delivery_id,sequence)\");\n      this.db.exec(`CREATE TRIGGER IF NOT EXISTS bridge_delivery_events_insert AFTER INSERT ON bridge_deliveries BEGIN INSERT INTO bridge_delivery_events (delivery_id,message_id,workspace,recipient,from_state,to_state,attempt,cycle_attempt,requeue_count,lease_owner,error,actor,action,created_at) VALUES (NEW.id,NEW.message_id,NEW.workspace,NEW.recipient,NULL,NEW.state,NEW.attempt,NEW.cycle_attempt,NEW.requeue_count,NEW.lease_owner,NEW.last_error,coalesce(NEW.last_actor,NEW.recipient),NEW.last_action,strftime('%Y-%m-%dT%H:%M:%fZ','now')); END;\n        CREATE TRIGGER IF NOT EXISTS bridge_delivery_events_update AFTER UPDATE ON bridge_deliveries WHEN OLD.state IS NOT NEW.state OR OLD.attempt IS NOT NEW.attempt OR OLD.requeue_count IS NOT NEW.requeue_count OR OLD.last_action IS NOT NEW.last_action BEGIN INSERT INTO bridge_delivery_events (delivery_id,message_id,workspace,recipient,from_state,to_state,attempt,cycle_attempt,requeue_count,lease_owner,error,actor,action,created_at) VALUES (NEW.id,NEW.message_id,NEW.workspace,NEW.recipient,OLD.state,NEW.state,NEW.attempt,NEW.cycle_attempt,NEW.requeue_count,NEW.lease_owner,NEW.last_error,coalesce(NEW.last_actor,NEW.recipient),NEW.last_action,strftime('%Y-%m-%dT%H:%M:%fZ','now')); END`);\n      this.db.exec(`CREATE TRIGGER IF NOT EXISTS bridge_messages_policy_insert BEFORE INSERT ON bridge_messages\n        WHEN NOT (\n          json_valid(NEW.delivery_policy) AND json_type(NEW.delivery_policy)='object'\n          AND NOT EXISTS (SELECT 1 FROM json_each(NEW.delivery_policy) WHERE key NOT IN ('mode','maxAttempts','retryBaseDelayMs','retryMaxDelayMs','retryJitterRatio','notBefore'))\n          AND (\n            (json_extract(NEW.delivery_policy,'$.mode')='mailbox' AND json_array_length(NEW.targets)>=0\n              AND (SELECT count(*) FROM json_each(NEW.delivery_policy))=1)\n            OR\n            (json_extract(NEW.delivery_policy,'$.mode')='leased' AND json_array_length(NEW.targets)>0\n              AND json_type(NEW.delivery_policy,'$.maxAttempts')='integer' AND json_extract(NEW.delivery_policy,'$.maxAttempts') BETWEEN 1 AND 100\n              AND json_type(NEW.delivery_policy,'$.retryBaseDelayMs')='integer' AND json_extract(NEW.delivery_policy,'$.retryBaseDelayMs') BETWEEN 1 AND 3600000\n              AND json_type(NEW.delivery_policy,'$.retryMaxDelayMs')='integer' AND json_extract(NEW.delivery_policy,'$.retryMaxDelayMs') BETWEEN json_extract(NEW.delivery_policy,'$.retryBaseDelayMs') AND 86400000\n              AND json_type(NEW.delivery_policy,'$.retryJitterRatio') IN ('integer','real') AND json_extract(NEW.delivery_policy,'$.retryJitterRatio') BETWEEN 0 AND 1\n              AND (json_type(NEW.delivery_policy,'$.notBefore') IS NULL OR (\n                json_type(NEW.delivery_policy,'$.notBefore')='text'\n                AND julianday(json_extract(NEW.delivery_policy,'$.notBefore')) IS NOT NULL\n                AND (NEW.expires_at IS NULL OR julianday(json_extract(NEW.delivery_policy,'$.notBefore'))<julianday(NEW.expires_at))\n              ))\n            )\n          )\n        ) BEGIN SELECT RAISE(ABORT,'invalid delivery policy'); END`);\n      this.db.exec(`CREATE TRIGGER IF NOT EXISTS bridge_messages_domain_insert BEFORE INSERT ON bridge_messages\n        WHEN NOT (json_valid(NEW.targets) AND json_type(NEW.targets)='array' AND NEW.priority IN ('info','high','urgent'))\n        BEGIN SELECT RAISE(ABORT,'invalid message domain'); END`);\n      this.db.exec(\"CREATE INDEX IF NOT EXISTS bridge_messages_project ON bridge_messages(workspace, project, sequence)\");\n      installLocalAuthorityMarkers(this.db);\n      this.db.exec(\"COMMIT\");\n    } catch (error) {\n      this.db.exec(\"ROLLBACK\");\n      throw error;\n    }\n    this.restrictFiles();\n  }\n  private async ready() { await this.initialize(); }\n  async insertMessage(input: Omit<BridgeMessage, \"sequence\" | \"createdAt\">): Promise<InsertMessageResult> {\n    await this.ready(); const createdAt = new Date().toISOString(); const storedPolicy = input.deliveryPolicy ?? (input.targets.length ? { mode: \"leased\" as const, maxAttempts: 5, retryBaseDelayMs: 1_000, retryMaxDelayMs: 60_000, retryJitterRatio: 0.2 } : { mode: \"mailbox\" as const });\n    this.db.exec(\"BEGIN IMMEDIATE\");\n    try {\n      if (input.idempotencyKey) { const existing = this.db.prepare(\"SELECT * FROM bridge_messages WHERE workspace = ? AND source = ? AND idempotency_key = ?\").get(input.workspace, input.source, input.idempotencyKey) as Row | undefined; if (existing) { const replay = message(existing); assertIdempotentReplay(replay, input); this.db.exec(\"COMMIT\"); return { message: replay, created: false }; } }\n      this.db.prepare(`INSERT INTO bridge_messages (id,workspace,project,source,type,content,content_type,data,targets,thread_id,reply_to_id,correlation_id,causation_id,priority,expires_at,idempotency_key,atrib_receipt_id,informed_by,metadata,delivery_policy,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(input.id,input.workspace,input.project ?? null,input.source,input.type,input.content,input.contentType,stringify(input.data),JSON.stringify(input.targets),input.threadId ?? null,input.replyToId ?? null,input.correlationId ?? null,input.causationId ?? null,input.priority,input.expiresAt ?? null,input.idempotencyKey ?? null,input.atribReceiptId ?? null,stringify(input.informedBy),stringify(input.metadata),JSON.stringify(storedPolicy),createdAt);\n      if (storedPolicy.mode === \"leased\") {\n        const availableAt = storedPolicy.notBefore && storedPolicy.notBefore > createdAt ? storedPolicy.notBefore : createdAt;\n        const priorityRank = input.priority === \"urgent\" ? 0 : input.priority === \"high\" ? 1 : 2;\n        for (const recipient of input.targets) {\n          this.db.prepare(\"INSERT INTO bridge_deliveries (id,message_id,workspace,recipient,state,created_at,priority_rank,available_at,last_actor,last_action) VALUES (?,?,?,?,?,?,?,?,?,?)\")\n            .run(randomUUID(), input.id, input.workspace, recipient, \"pending\", createdAt, priorityRank, availableAt, input.source, \"created\");\n        }\n      }\n      const row = this.db.prepare(\"SELECT * FROM bridge_messages WHERE id = ?\").get(input.id) as Row; this.db.exec(\"COMMIT\"); return { message: message(row), created: true };\n    } catch (error) { this.db.exec(\"ROLLBACK\"); throw error; }\n  }\n  async listMessages(principal: BridgePrincipal, query: MessageQuery = {}): Promise<MessagePage> {\n    await this.ready(); const scope = cursorScope(principal, query); const cursor = decodeCursor(query.cursor, scope); const limit = Math.min(Math.max(Math.trunc(query.limit ?? 50), 1), 200); const now = new Date().toISOString();\n    const highWaterRow = query.latest ? undefined : this.db.prepare(\"SELECT max(sequence) AS sequence FROM bridge_messages WHERE workspace=?\").get(principal.workspace) as Row;\n    const highWater = highWaterRow?.sequence === null || highWaterRow?.sequence === undefined\n      ? undefined\n      : String(highWaterRow.sequence);\n    const mailbox = query.mailbox ?? \"inbox\"; const visibility = mailbox === \"sent\" ? \"source = ?\" : mailbox === \"all\" ? \"(source = ? OR targets = '[]' OR EXISTS (SELECT 1 FROM json_each(targets) WHERE value = ?))\" : \"(targets = '[]' OR EXISTS (SELECT 1 FROM json_each(targets) WHERE value = ?))\"; const clauses = [\"workspace = ?\", query.latest ? \"1=1\" : \"sequence > ?\", visibility]; const args: SQLInputValue[] = query.latest ? [principal.workspace] : [principal.workspace, cursor ?? \"0\"]; if (mailbox === \"all\") args.push(principal.agent, principal.agent); else args.push(principal.agent);\n    if (highWater) { clauses.push(\"sequence <= ?\"); args.push(highWater); }\n    if (!query.includeExpired) { clauses.push(\"(expires_at IS NULL OR expires_at > ?)\"); args.push(now); }\n    if (query.types?.length) { clauses.push(`type IN (${query.types.map(() => \"?\").join(\",\")})`); args.push(...query.types); }\n    if (query.source) { clauses.push(\"source = ?\"); args.push(query.source); }\n    if (query.project) { clauses.push(\"project = ?\"); args.push(query.project); }\n    if (query.since) { clauses.push(\"created_at >= ?\"); args.push(query.since); }\n    if (query.receiptState && query.receiptState !== \"any\") {\n      clauses.push(`${query.receiptState === \"unread\" ? \"NOT \" : \"\"}EXISTS (SELECT 1 FROM bridge_receipts receipt WHERE receipt.workspace=bridge_messages.workspace AND receipt.message_id=bridge_messages.id AND receipt.principal=?)`);\n      args.push(principal.agent);\n    }\n    if (query.threadId) { clauses.push(\"thread_id = ?\"); args.push(query.threadId); }\n    const rows = this.db.prepare(`SELECT * FROM bridge_messages WHERE ${clauses.join(\" AND \")} ORDER BY sequence ${query.latest ? \"DESC\" : \"ASC\"} LIMIT ?`).all(...args, limit) as Row[];\n    const messages = rows.map(message);\n    const last = messages[messages.length - 1];\n    if (query.latest) return { messages, cursor: messages[0] ? encodeCursor(messages[0].sequence, scope) : query.cursor };\n    if (messages.length === limit) return { messages, cursor: encodeCursor(last!.sequence, scope) };\n    return { messages, cursor: highWater ? encodeCursor(highWater, scope) : query.cursor };\n  }\n  async recordReceipt(principal: BridgePrincipal, messageIds: string[], readAt = new Date()): Promise<number> { await this.ready(); const stmt = this.db.prepare(\"INSERT OR IGNORE INTO bridge_receipts (workspace,message_id,principal,read_at) SELECT workspace,id,?,? FROM bridge_messages WHERE workspace=? AND id=? AND (targets='[]' OR EXISTS (SELECT 1 FROM json_each(targets) WHERE value=?))\"); let changed = 0; this.db.exec(\"BEGIN IMMEDIATE\"); try { for (const id of messageIds) changed += Number(stmt.run(principal.agent,readAt.toISOString(),principal.workspace,id,principal.agent).changes); this.db.exec(\"COMMIT\"); return changed; } catch (e) { this.db.exec(\"ROLLBACK\"); throw e; } }\n  async claimDelivery(principal: BridgePrincipal, options: ClaimOptions): Promise<BridgeDelivery | null> {\n    await this.ready(); const now = options.now ?? new Date(); const nowText = now.toISOString(); const expires = new Date(now.getTime() + options.leaseMs).toISOString(); const owner = principal.instance ?? principal.agent;\n    this.db.exec(\"BEGIN IMMEDIATE\"); try {\n      this.db.prepare(\"UPDATE bridge_deliveries SET state='dead',last_error='message expired',lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_actor='agent-bridge',last_action='message_expired' WHERE workspace=? AND recipient=? AND state IN ('pending','retrying','claimed') AND EXISTS (SELECT 1 FROM bridge_messages message WHERE message.workspace=bridge_deliveries.workspace AND message.id=bridge_deliveries.message_id AND message.expires_at IS NOT NULL AND message.expires_at<=?)\").run(principal.workspace,principal.agent,nowText);\n      this.db.prepare(\"UPDATE bridge_deliveries SET state='dead',last_error='maximum attempts reached',lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_actor='agent-bridge',last_action='attempts_exhausted' WHERE workspace=? AND recipient=? AND cycle_attempt>=(SELECT json_extract(delivery_policy,'$.maxAttempts') FROM bridge_messages WHERE workspace=bridge_deliveries.workspace AND id=bridge_deliveries.message_id) AND (state IN ('pending','retrying') OR (state='claimed' AND lease_expires_at<=?))\").run(principal.workspace,principal.agent,nowText);\n      this.db.prepare(\"UPDATE bridge_deliveries SET state='retrying',available_at=?,last_error='lease expired',lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_actor='agent-bridge',last_action='lease_expired' WHERE workspace=? AND recipient=? AND state='claimed' AND lease_expires_at<=? AND cycle_attempt<(SELECT json_extract(delivery_policy,'$.maxAttempts') FROM bridge_messages WHERE workspace=bridge_deliveries.workspace AND id=bridge_deliveries.message_id)\").run(nowText,principal.workspace,principal.agent,nowText);\n      const candidate = this.db.prepare(\"SELECT delivery.id FROM bridge_deliveries delivery JOIN bridge_messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id WHERE delivery.workspace=? AND delivery.recipient=? AND delivery.state IN ('pending','retrying') AND delivery.available_at<=? AND delivery.cycle_attempt<json_extract(message.delivery_policy,'$.maxAttempts') AND (message.expires_at IS NULL OR message.expires_at>?) ORDER BY delivery.priority_rank,delivery.available_at,delivery.created_at,delivery.id LIMIT 1\").get(principal.workspace,principal.agent,nowText,nowText) as Row | undefined;\n      if (!candidate) { this.db.exec(\"COMMIT\"); return null; }\n      const candidateId = String(candidate.id);\n      const token = randomUUID(); this.db.prepare(\"UPDATE bridge_deliveries SET state='claimed',attempt=attempt+1,cycle_attempt=cycle_attempt+1,lease_token=?,lease_owner=?,lease_expires_at=?,last_error=NULL,last_actor=?,last_action='claim' WHERE id=?\").run(token,owner,expires,principal.agent,candidateId);\n      const claimed = this.db.prepare(\"SELECT * FROM bridge_deliveries WHERE id=?\").get(candidateId) as Row; this.db.exec(\"COMMIT\"); return delivery(claimed);\n    } catch (e) { this.db.exec(\"ROLLBACK\"); throw e; }\n  }\n  async renewDelivery(principal: BridgePrincipal, id: string, token: string, leaseMs: number): Promise<BridgeDelivery | null> { await this.ready(); const now = new Date(); const expires = new Date(now.getTime() + leaseMs).toISOString(); const owner = principal.instance ?? principal.agent; const result = this.db.prepare(\"UPDATE bridge_deliveries SET lease_expires_at=? WHERE workspace=? AND recipient=? AND lease_owner=? AND id=? AND lease_token=? AND state='claimed' AND lease_expires_at > ?\").run(expires,principal.workspace,principal.agent,owner,id,token,now.toISOString()); if (!result.changes) return null; return delivery(this.db.prepare(\"SELECT * FROM bridge_deliveries WHERE id=?\").get(id) as Row); }\n  async settleDelivery(principal: BridgePrincipal, id: string, token: string, state: \"acked\" | \"retrying\" | \"dead\", error?: string, _retryPolicy?: import(\"./bridge-domain.js\").RetryPolicy): Promise<BridgeDelivery | null> {\n    await this.ready(); const now = new Date(); const owner = principal.instance ?? principal.agent;\n    this.db.exec(\"BEGIN IMMEDIATE\");\n    try {\n      const current = this.db.prepare(\"SELECT delivery.*,message.delivery_policy FROM bridge_deliveries delivery JOIN bridge_messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id WHERE delivery.workspace=? AND delivery.recipient=? AND delivery.lease_owner=? AND delivery.id=? AND delivery.lease_token=? AND delivery.state='claimed' AND delivery.lease_expires_at>?\").get(principal.workspace,principal.agent,owner,id,token,now.toISOString()) as Row | undefined;\n      if (!current) { this.db.exec(\"COMMIT\"); return null; }\n      const policy = parse(current.delivery_policy);\n      const exhausted = state === \"retrying\" && Number(current.cycle_attempt) >= Number(policy.maxAttempts);\n      const nextState = exhausted ? \"dead\" : state;\n      const exponential = Math.min(policy.retryMaxDelayMs, policy.retryBaseDelayMs * 2 ** Math.max(0, Number(current.cycle_attempt) - 1));\n      const jitter = 1 + (Math.random() * 2 - 1) * policy.retryJitterRatio;\n      const delay = nextState === \"retrying\" ? Math.max(1, Math.round(exponential * jitter)) : 0;\n      const available = nextState === \"retrying\" ? new Date(now.getTime() + delay).toISOString() : String(current.available_at);\n      const action = state === \"acked\" ? \"ack\" : state === \"dead\" ? \"nack_dead\" : exhausted ? \"attempts_exhausted\" : \"nack_retry\";\n      this.db.prepare(\"UPDATE bridge_deliveries SET state=?,available_at=?,last_error=?,lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_actor=?,last_action=? WHERE id=?\").run(nextState,available,error?.slice(0,1024) ?? null,principal.agent,action,id);\n      const result = delivery(this.db.prepare(\"SELECT * FROM bridge_deliveries WHERE id=?\").get(id) as Row); this.db.exec(\"COMMIT\"); return result;\n    } catch (caught) { this.db.exec(\"ROLLBACK\"); throw caught; }\n  }\n  async diagnostics(principal: BridgePrincipal): Promise<BridgeDiagnostics> {\n    await this.ready();\n    const now = new Date();\n    const nowText = now.toISOString();\n    const queue = this.db.prepare(`SELECT\n      sum(CASE WHEN state='pending' THEN 1 ELSE 0 END) AS pending,\n      sum(CASE WHEN state='claimed' THEN 1 ELSE 0 END) AS claimed,\n      sum(CASE WHEN state='retrying' THEN 1 ELSE 0 END) AS retrying,\n      sum(CASE WHEN state='dead' THEN 1 ELSE 0 END) AS dead,\n      sum(CASE WHEN state='cancelled' THEN 1 ELSE 0 END) AS cancelled,\n      min(CASE WHEN state IN ('pending','retrying') THEN available_at END) AS oldest_available,\n      sum(CASE WHEN state IN ('pending','retrying') AND available_at<=? THEN 1 ELSE 0 END) AS due,\n      sum(CASE WHEN state IN ('pending','retrying') AND available_at>? THEN 1 ELSE 0 END) AS scheduled,\n      sum(CASE WHEN state='claimed' AND lease_expires_at<=? THEN 1 ELSE 0 END) AS expired_leases,\n      min(CASE WHEN state IN ('pending','retrying') AND available_at<=? THEN available_at END) AS oldest_due\n      FROM bridge_deliveries WHERE workspace=? AND recipient=?`).get(nowText, nowText, nowText, nowText, principal.workspace, principal.agent) as Row;\n    const oldestDueAt = queue.oldest_due ? String(queue.oldest_due) : undefined;\n    return { schemaVersion: \"local-v2\", deliverySupported: true, pending: Number(queue.pending ?? 0), claimed: Number(queue.claimed ?? 0), retrying: Number(queue.retrying ?? 0), dead: Number(queue.dead ?? 0), cancelled: Number(queue.cancelled ?? 0), oldestAvailableAt: queue.oldest_available ? String(queue.oldest_available) : undefined, due: Number(queue.due ?? 0), scheduled: Number(queue.scheduled ?? 0), expiredLeases: Number(queue.expired_leases ?? 0), oldestDueAt, queueLagMs: oldestDueAt ? Math.max(0, now.getTime() - Date.parse(oldestDueAt)) : 0 };\n  }\n  async heartbeat(principal: BridgePrincipal, leaseMs: number, runtimeType?: string, capabilities: string[] = []): Promise<AgentPresence> {\n    await this.ready();\n    const now = new Date();\n    const nowText = now.toISOString();\n    const expires = new Date(now.getTime() + leaseMs).toISOString();\n    this.db.exec(\"BEGIN IMMEDIATE\");\n    try {\n      this.db.prepare(\"DELETE FROM bridge_presence WHERE workspace=? AND lease_expires_at<=?\")\n        .run(principal.workspace, nowText);\n      const current = this.db.prepare(\"SELECT 1 FROM bridge_presence WHERE workspace=? AND agent=? AND instance=?\")\n        .get(principal.workspace, principal.agent, principal.instance!) as Row | undefined;\n      const agentCount = this.db.prepare(\"SELECT count(*) AS count FROM bridge_presence WHERE workspace=? AND agent=?\")\n        .get(principal.workspace, principal.agent) as Row;\n      const workspaceCount = this.db.prepare(\"SELECT count(*) AS count FROM bridge_presence WHERE workspace=?\")\n        .get(principal.workspace) as Row;\n      if (!current && (Number(agentCount.count) >= 128 || Number(workspaceCount.count) >= 4096)) {\n        throw Object.assign(new Error(\"active instance limit reached\"), {\n          status: 429,\n          code: \"presence_limit\",\n        });\n      }\n      this.db.prepare(\"INSERT INTO bridge_presence (workspace,agent,instance,runtime_type,capabilities,lease_expires_at,last_seen_at) VALUES (?,?,?,?,?,?,?) ON CONFLICT(workspace,agent,instance) DO UPDATE SET runtime_type=excluded.runtime_type, capabilities=excluded.capabilities, lease_expires_at=excluded.lease_expires_at, last_seen_at=excluded.last_seen_at\")\n        .run(principal.workspace,principal.agent,principal.instance!,runtimeType ?? null,JSON.stringify(capabilities),expires,nowText);\n      const result = presence(this.db.prepare(\"SELECT * FROM bridge_presence WHERE workspace=? AND agent=? AND instance=?\")\n        .get(principal.workspace,principal.agent,principal.instance!) as Row);\n      this.db.exec(\"COMMIT\");\n      return result;\n    } catch (error) {\n      this.db.exec(\"ROLLBACK\");\n      throw error;\n    }\n  }\n  async listPresence(principal: BridgePrincipal): Promise<AgentPresence[]> {\n    await this.ready();\n    const now = new Date().toISOString();\n    this.db.prepare(\"DELETE FROM bridge_presence WHERE workspace=? AND lease_expires_at<=?\")\n      .run(principal.workspace, now);\n    const rows = this.db.prepare(\"SELECT * FROM bridge_presence WHERE workspace=? ORDER BY agent,instance\")\n      .all(principal.workspace) as Row[];\n    return rows.map(presence);\n  }\n  async listDeliveries(principal: BridgePrincipal, query: DeliveryQuery = {}) {\n    await this.ready();\n    const filters = { role: query.role ?? \"all\", states: [...(query.states ?? [])].sort(), messageId: query.messageId ?? null, recipient: query.recipient ?? null };\n    const scope = scopedCursorScope(\"deliveries\", principal, filters);\n    const position = validateDeliveryCursorPosition(decodeScopedCursor(query.cursor, scope));\n    const limit = query.limit ?? 50;\n    const clauses = [\"delivery.workspace=?\"];\n    const args: SQLInputValue[] = [principal.workspace];\n    const role = query.role ?? \"all\";\n    clauses.push(role === \"recipient\" ? \"delivery.recipient=?\" : role === \"publisher\" ? \"message.source=?\" : \"(delivery.recipient=? OR message.source=?)\");\n    args.push(principal.agent); if (role === \"all\") args.push(principal.agent);\n    if (position) { clauses.push(\"(delivery.created_at>? OR (delivery.created_at=? AND delivery.id>?))\"); args.push(position.createdAt as string, position.createdAt as string, position.id as string); }\n    if (query.messageId) { clauses.push(\"delivery.message_id=?\"); args.push(query.messageId); }\n    if (query.recipient) { clauses.push(\"delivery.recipient=?\"); args.push(query.recipient); }\n    if (query.states?.length) { clauses.push(`delivery.state IN (${query.states.map(() => \"?\").join(\",\")})`); args.push(...query.states); }\n    const rows = this.db.prepare(`SELECT delivery.* FROM bridge_deliveries delivery JOIN bridge_messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id WHERE ${clauses.join(\" AND \")} ORDER BY delivery.created_at,delivery.id LIMIT ?`).all(...args, limit) as Row[];\n    const deliveries = rows.map(delivery); const last = deliveries[deliveries.length - 1];\n    return { deliveries, cursor: deliveries.length === limit && last ? encodeScopedCursor(scope, { createdAt: last.createdAt, id: last.id }) : undefined };\n  }\n  async listDeliveryEvents(principal: BridgePrincipal, deliveryId: string, query: {cursor?:string;limit?:number} = {}) {\n    await this.ready(); const limit = query.limit ?? 50;\n    const scope = scopedCursorScope(\"delivery-events\", principal, { deliveryId });\n    const position = validateEventCursorPosition(decodeScopedCursor(query.cursor, scope));\n    const rows = this.db.prepare(\"SELECT event.* FROM bridge_delivery_events event JOIN bridge_messages message ON message.workspace=event.workspace AND message.id=event.message_id WHERE event.workspace=? AND event.delivery_id=? AND event.sequence>? AND (event.recipient=? OR message.source=?) ORDER BY event.sequence LIMIT ?\").all(principal.workspace,deliveryId,position ?? \"0\",principal.agent,principal.agent,limit) as Row[];\n    const events = rows.map(deliveryEvent); const last = events[events.length - 1];\n    return { events, cursor: events.length === limit && last ? encodeScopedCursor(scope, last.sequence) : undefined };\n  }\n  async cancelDelivery(principal: BridgePrincipal,id:string) {\n    await this.ready(); this.db.exec(\"BEGIN IMMEDIATE\");\n    try {\n      const current = this.db.prepare(\"SELECT delivery.* FROM bridge_deliveries delivery JOIN bridge_messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id WHERE delivery.id=? AND delivery.workspace=? AND message.source=?\").get(id,principal.workspace,principal.agent) as Row | undefined;\n      if (!current) { this.db.exec(\"COMMIT\"); return null; }\n      if (current.state === \"cancelled\") { this.db.exec(\"COMMIT\"); return delivery(current); }\n      if (![\"pending\",\"retrying\",\"claimed\"].includes(String(current.state))) throw new DeliveryStateConflictError(`cannot cancel a ${current.state} delivery`);\n      this.db.prepare(\"UPDATE bridge_deliveries SET state='cancelled',lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_error=NULL,last_actor=?,last_action='cancel' WHERE id=?\").run(principal.agent,id);\n      const result = delivery(this.db.prepare(\"SELECT * FROM bridge_deliveries WHERE id=?\").get(id) as Row); this.db.exec(\"COMMIT\"); return result;\n    } catch (error) { this.db.exec(\"ROLLBACK\"); throw error; }\n  }\n  async requeueDelivery(principal: BridgePrincipal,id:string) {\n    await this.ready(); this.db.exec(\"BEGIN IMMEDIATE\");\n    try {\n      const current = this.db.prepare(\"SELECT delivery.*,message.expires_at,message.delivery_policy FROM bridge_deliveries delivery JOIN bridge_messages message ON message.workspace=delivery.workspace AND message.id=delivery.message_id WHERE delivery.id=? AND delivery.workspace=? AND message.source=?\").get(id,principal.workspace,principal.agent) as Row | undefined;\n      if (!current) { this.db.exec(\"COMMIT\"); return null; }\n      if (![\"dead\",\"cancelled\"].includes(String(current.state))) throw new DeliveryStateConflictError(`cannot requeue a ${current.state} delivery`);\n      const now = new Date().toISOString(); if (current.expires_at && String(current.expires_at) <= now) throw new DeliveryStateConflictError(\"cannot requeue an expired message\");\n      const policy = parse(current.delivery_policy); const availableAt = policy.notBefore && policy.notBefore > now ? policy.notBefore : now;\n      this.db.prepare(\"UPDATE bridge_deliveries SET state='pending',available_at=?,cycle_attempt=0,requeue_count=requeue_count+1,lease_token=NULL,lease_owner=NULL,lease_expires_at=NULL,last_error=NULL,last_actor=?,last_action='requeue' WHERE id=?\").run(availableAt,principal.agent,id);\n      const result = delivery(this.db.prepare(\"SELECT * FROM bridge_deliveries WHERE id=?\").get(id) as Row); this.db.exec(\"COMMIT\"); return result;\n    } catch (error) { this.db.exec(\"ROLLBACK\"); throw error; }\n  }\n  async close(): Promise<void> { this.db.close(); }\n}\n","function isBusy(error: unknown): boolean {\n  if (!(error instanceof Error)) return false;\n  const sqlite = error as Error & { errcode?: number };\n  return sqlite.errcode === 5 || /database is (?:locked|busy)/i.test(error.message);\n}\n\nexport const SQLITE_INITIALIZATION_BUSY_TIMEOUT_MS = 15_000;\n\nexport async function retrySqliteBusy<T>(\n  operation: () => T,\n  timeoutMs: number,\n): Promise<T> {\n  const deadline = Date.now() + Math.max(1, Math.trunc(timeoutMs));\n  let delayMs = 5;\n  while (true) {\n    try {\n      return operation();\n    } catch (error) {\n      if (!isBusy(error) || Date.now() >= deadline) throw error;\n      await new Promise((resolve) => setTimeout(resolve, delayMs));\n      delayMs = Math.min(delayMs * 2, 50);\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAKpB,IAAM,8BAA8B;AACpC,IAAM,6BAA6B;AACnC,IAAM,iCAAiC;AACvC,IAAM,wBAAwB;AAC9B,IAAM,gCAAgC,OAAO,OAAO;AAAA,EACzD,OAAO,OAAO,EAAE,IAAI,0BAA0B,QAAQ,mEAAmE,CAAC;AAAA,EAC1H,OAAO,OAAO,EAAE,IAAI,mCAAmC,QAAQ,mEAAmE,CAAC;AAAA,EACnI,OAAO,OAAO,EAAE,IAAI,oCAAoC,QAAQ,mEAAmE,CAAC;AAAA,EACpI,OAAO,OAAO,EAAE,IAAI,oCAAoC,QAAQ,mEAAmE,CAAC;AACtI,CAAU;AACH,IAAM,+BAA+B,OAAO,OAAO;AAAA,EACxD,OAAO,OAAO,EAAE,IAAI,0BAA0B,QAAQ,mEAAmE,CAAC;AAAA,EAC1H,OAAO,OAAO,EAAE,IAAI,mCAAmC,QAAQ,mEAAmE,CAAC;AAAA,EACnI,OAAO,OAAO,EAAE,IAAI,kDAAkD,QAAQ,mEAAmE,CAAC;AAAA,EAClJ,OAAO,OAAO,EAAE,IAAI,mCAAmC,QAAQ,mEAAmE,CAAC;AACrI,CAAU;AACV,IAAM,sBAAsB,IAAI,IAAY,8BAA8B,IAAI,CAAC,aAAa,SAAS,MAAM,CAAC;AAC5G,IAAM,qBAAqB,IAAI,IAAY,6BAA6B,IAAI,CAAC,aAAa,SAAS,MAAM,CAAC;AACnG,IAAM,uCAAuC,CAAC,SAA0B,oBAAoB,IAAI,IAAI;AACpG,IAAM,sCAAsC,CAAC,SAA0B,mBAAmB,IAAI,IAAI;AAEzG,IAAM,gBAAgB;AAAA,EACpB,eAAe;AAAA,EACf,aAAa;AAAA,EACb,gBAAgB;AAClB;AAEA,IAAM,eAAe;AAAA,EACnB,eAAe;AAAA,EACf,aAAa;AAAA,EACb,gBAAgB;AAClB;AAEA,IAAM,eAAkD;AAAA,EACtD,uBAAuB,CAAC,aAAa,iBAAiB,eAAe,gBAAgB;AAAA,EACrF,iBAAiB;AAAA,IACf;AAAA,IAAY;AAAA,IAAM;AAAA,IAAa;AAAA,IAAW;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAgB;AAAA,IAAQ;AAAA,IAC/F;AAAA,IAAa;AAAA,IAAe;AAAA,IAAkB;AAAA,IAAgB;AAAA,IAAY;AAAA,IAAc;AAAA,IACxF;AAAA,IAAoB;AAAA,IAAe;AAAA,IAAY;AAAA,IAAmB;AAAA,EACpE;AAAA,EACA,iBAAiB,CAAC,aAAa,cAAc,aAAa,SAAS;AAAA,EACnE,mBAAmB;AAAA,IACjB;AAAA,IAAM;AAAA,IAAc;AAAA,IAAa;AAAA,IAAa;AAAA,IAAS;AAAA,IAAW;AAAA,IAAiB;AAAA,IAAiB;AAAA,IACpG;AAAA,IAAiB;AAAA,IAAgB;AAAA,IAAe;AAAA,IAAe;AAAA,IAAoB;AAAA,IAAc;AAAA,IAAc;AAAA,EACjH;AAAA,EACA,wBAAwB;AAAA,IACtB;AAAA,IAAY;AAAA,IAAe;AAAA,IAAc;AAAA,IAAa;AAAA,IAAa;AAAA,IAAc;AAAA,IAAY;AAAA,IAAW;AAAA,IACxG;AAAA,IAAiB;AAAA,IAAe;AAAA,IAAS;AAAA,IAAS;AAAA,IAAU;AAAA,EAC9D;AAAA,EACA,iBAAiB,CAAC,aAAa,SAAS,YAAY,gBAAgB,gBAAgB,oBAAoB,cAAc;AACxH;AAEA,IAAM,eAAe,oBAAI,IAA8B;AAAA,EACrD,CAAC,yBAAyB,CAAC,SAAS,uBAAuB,CAAC;AAAA,EAC5D,CAAC,qBAAqB,CAAC,SAAS,mBAAmB,CAAC;AAAA,EACpD,CAAC,0BAA0B,CAAC,SAAS,wBAAwB,CAAC;AAAA,EAC9D,CAAC,mBAAmB,CAAC,SAAS,iBAAiB,CAAC;AAAA,EAChD,CAAC,mBAAmB,CAAC,SAAS,iBAAiB,CAAC;AAAA,EAChD,CAAC,mBAAmB,CAAC,SAAS,iBAAiB,CAAC;AAAA,EAChD,CAAC,2BAA2B,CAAC,SAAS,mBAAmB,CAAC;AAAA,EAC1D,CAAC,+BAA+B,CAAC,SAAS,mBAAmB,CAAC;AAAA,EAC9D,CAAC,8BAA8B,CAAC,SAAS,mBAAmB,CAAC;AAAA,EAC7D,CAAC,iCAAiC,CAAC,SAAS,wBAAwB,CAAC;AAAA,EACrE,CAAC,2BAA2B,CAAC,SAAS,iBAAiB,CAAC;AAAA,EACxD,CAAC,0BAA0B,CAAC,SAAS,iBAAiB,CAAC;AAAA,EACvD,CAAC,+BAA+B,CAAC,SAAS,iBAAiB,CAAC;AAAA,EAC5D,CAAC,2BAA2B,CAAC,SAAS,iBAAiB,CAAC;AAAA,EACxD,CAAC,0BAA0B,CAAC,SAAS,iBAAiB,CAAC;AAAA,EACvD,CAAC,0BAA0B,CAAC,SAAS,iBAAiB,CAAC;AAAA,EACvD,CAAC,0BAA0B,CAAC,SAAS,iBAAiB,CAAC;AAAA,EACvD,CAAC,iCAAiC,CAAC,WAAW,mBAAmB,CAAC;AAAA,EAClE,CAAC,iCAAiC,CAAC,WAAW,mBAAmB,CAAC;AAAA,EAClE,CAAC,6BAA6B,CAAC,WAAW,iBAAiB,CAAC;AAAA,EAC5D,CAAC,6BAA6B,CAAC,WAAW,iBAAiB,CAAC;AAAA,EAC5D,CAAC,iCAAiC,CAAC,WAAW,iBAAiB,CAAC;AAAA,EAChE,CAAC,iCAAiC,CAAC,WAAW,iBAAiB,CAAC;AAAA,EAChE,CAAC,mCAAmC,CAAC,WAAW,uBAAuB,CAAC;AAAA,EACxE,CAAC,mCAAmC,CAAC,WAAW,uBAAuB,CAAC;AAC1E,CAAC;AAED,IAAM,cAAiD;AAAA,EACrD,uBAAuB,CAAC,aAAa,iBAAiB,eAAe,gBAAgB;AAAA,EACrF,aAAa,CAAC,aAAa,iBAAiB,aAAa,SAAS,eAAe,gBAAgB,cAAc,yBAAyB,wBAAwB,mBAAmB,gBAAgB;AAAA,EACnM,sBAAsB,CAAC,aAAa,SAAS,gBAAgB,eAAe,oBAAoB,YAAY;AAAA,EAC5G,aAAa,CAAC,YAAY,aAAa,cAAc,mBAAmB,gBAAgB,cAAc,SAAS,YAAY,gBAAgB,eAAe,oBAAoB,cAAc,cAAc,YAAY;AAAA,EACtN,YAAY,CAAC,aAAa,cAAc,mBAAmB,gBAAgB,aAAa,WAAW,UAAU,QAAQ,aAAa,cAAc,cAAc,cAAc;AAC9K;AAEA,IAAM,cAAc,oBAAI,IAA8B;AAAA,EACpD,CAAC,yBAAyB,CAAC,SAAS,uBAAuB,CAAC;AAAA,EAC5D,CAAC,eAAe,CAAC,SAAS,aAAa,CAAC;AAAA,EACxC,CAAC,wBAAwB,CAAC,SAAS,sBAAsB,CAAC;AAAA,EAC1D,CAAC,eAAe,CAAC,SAAS,aAAa,CAAC;AAAA,EACxC,CAAC,cAAc,CAAC,SAAS,YAAY,CAAC;AAAA,EACtC,CAAC,sBAAsB,CAAC,SAAS,YAAY,CAAC;AAAA,EAC9C,CAAC,qBAAqB,CAAC,SAAS,YAAY,CAAC;AAAA,EAC7C,CAAC,sBAAsB,CAAC,SAAS,YAAY,CAAC;AAAA,EAC9C,CAAC,qBAAqB,CAAC,SAAS,YAAY,CAAC;AAAA,EAC7C,CAAC,qBAAqB,CAAC,SAAS,YAAY,CAAC;AAAA,EAC7C,CAAC,mBAAmB,CAAC,SAAS,aAAa,CAAC;AAAA,EAC5C,CAAC,8BAA8B,CAAC,SAAS,sBAAsB,CAAC;AAAA,EAChE,CAAC,qCAAqC,CAAC,WAAW,aAAa,CAAC;AAAA,EAChE,CAAC,mCAAmC,CAAC,WAAW,uBAAuB,CAAC;AAAA,EACxE,CAAC,mCAAmC,CAAC,WAAW,uBAAuB,CAAC;AAC1E,CAAC;AAEM,IAAM,8BAAN,cAA0C,MAAM;AAAC;AAExD,SAAS,aAAa,KAAqB;AACzC,MAAI,SAAS;AAAI,MAAI,QAAQ;AAAI,MAAI,eAAe;AACpD,WAAS,QAAQ,GAAG,QAAQ,IAAI,QAAQ,SAAS,GAAG;AAClD,UAAM,YAAY,IAAI,KAAK;AAC3B,QAAI,OAAO;AACT,gBAAU;AACV,UAAK,UAAU,OAAO,cAAc,OAAS,UAAU,OAAO,cAAc,OAAQ;AAClF,YAAI,IAAI,QAAQ,CAAC,MAAM,aAAa,UAAU,KAAK;AAAE,oBAAU,IAAI,EAAE,KAAK;AAAA,QAAI,MACzE,SAAQ;AAAA,MACf;AACA;AAAA,IACF;AACA,QAAI,MAAM,KAAK,SAAS,GAAG;AAAE,qBAAe,OAAO,SAAS;AAAG;AAAA,IAAU;AACzE,QAAI,gBAAgB,CAAC,UAAU,KAAK,SAAS,KAAK,CAAC,UAAU,KAAK,OAAO,OAAO,SAAS,CAAC,KAAK,EAAE,EAAG,WAAU;AAC9G,mBAAe;AACf,QAAI,cAAc,OAAO,cAAc,OAAO,cAAc,IAAK,SAAQ;AAAA,aAChE,cAAc,IAAK,SAAQ;AACpC,cAAU,QAAQ,YAAY,UAAU,YAAY;AAAA,EACtD;AACA,SAAO,OAAO,KAAK;AACrB;AAEA,SAAS,WAAW,MAA4D;AAC9E,SAAO,KAAK,IAAI,CAAC,QAAQ,OAAO,YAAY,OAAO,KAAK,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ;AAC/E,UAAM,QAAQ,IAAI,GAAG;AAAG,WAAO,CAAC,KAAK,UAAU,OAAO,OAAO,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK,CAAC;AAAA,EAChH,CAAC,CAAC,CAAC;AACL;AAEA,SAAS,gBAAgB,OAAuB;AAAE,SAAO,IAAI,MAAM,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC;AAAK;AAEtF,SAAS,yBAAyB,IAAsB;AAC7D,QAAM,UAAW,GAAG,QAAQ,oGAAoG,EAAE,IAAI,EACnI,IAAI,CAAC,SAAS,EAAE,MAAM,OAAO,IAAI,IAAI,GAAG,MAAM,OAAO,IAAI,IAAI,GAAG,OAAO,OAAO,IAAI,QAAQ,GAAG,KAAK,aAAa,OAAO,IAAI,GAAG,CAAC,EAAE,EAAE;AACrI,QAAM,SAAS,QAAQ,OAAO,CAAC,WAAW,OAAO,SAAS,OAAO,EAAE,IAAI,CAAC,YAAY;AAAA,IAClF,MAAM,OAAO;AAAA,IACb,SAAS,WAAW,GAAG,QAAQ,qBAAqB,gBAAgB,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAU;AAAA,IACnG,aAAa,WAAW,GAAG,QAAQ,2BAA2B,gBAAgB,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,CAAU;AAAA,IAC7G,SAAU,GAAG,QAAQ,qBAAqB,gBAAgB,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAC5E,KAAK,CAAC,MAAM,UAAU,OAAO,KAAK,IAAI,EAAE,cAAc,OAAO,MAAM,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS;AAAA,MACxF,GAAG,OAAO,YAAY,OAAO,KAAK,GAAG,EAAE,OAAO,CAAC,QAAQ,QAAQ,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,MAAM,OAAO,OAAO,OAAO,IAAI,GAAG,MAAM,WAAW,IAAI,GAAG,IAAI,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,MACvL,SAAS,WAAW,GAAG,QAAQ,sBAAsB,gBAAgB,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,EAAE,IAAI,CAAU;AAAA,IAC3G,EAAE;AAAA,EACN,EAAE;AACF,SAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,UAAU,EAAE,SAAS,OAAO,CAAC,CAAC,EAAE,OAAO,KAAK;AACtF;AAEA,SAAS,uBAAuB,IAAc,SAAgD,gBAAwB,OAAqB;AACzI,MAAI,YAAY,IAAI,cAAc,EAAE,OAAQ,OAAM,IAAI,4BAA4B,GAAG,KAAK,2BAA2B;AACrH,QAAM,OAAO,GAAG,QAAQ,2FAA2F,EAAE,IAAI;AACzH,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,QAAQ,IAAI,OAAO,IAAI,IAAI,CAAC;AAC7C,QAAI,CAAC,YAAY,SAAS,CAAC,MAAM,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC,MAAM,OAAO,IAAI,QAAQ,GAAG;AACzF,YAAM,IAAI,4BAA4B,GAAG,KAAK,yDAAyD;AAAA,IACzG;AAAA,EACF;AACF;AAEO,SAAS,4BAA4B,IAAoB;AAAE,yBAAuB,IAAI,cAAc,SAAS,iBAAiB;AAAG;AACjI,SAAS,2BAA2B,IAAoB;AAAE,yBAAuB,IAAI,aAAa,WAAW,MAAM;AAAG;AAE7H,SAAS,OAAO,IAAc,QAAwB;AACpD,QAAM,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI;AACnC,SAAO,OAAO,OAAO,OAAO,GAAG,EAAE,CAAC,CAAC;AACrC;AAEA,SAAS,YAAY,IAAc,QAA0B;AAC3D,SAAQ,GAAG,QAAQ,iFAAiF,EAAE,IAAI,GAAG,MAAM,GAAG,EACnH,IAAI,CAAC,QAAQ,OAAO,IAAI,IAAI,CAAC;AAClC;AAEA,SAAS,SAAS,IAA+C;AAC/D,QAAM,SAAS,GAAG,QAAQ,2DAA2D,EAAE,IAAI,qBAAqB;AAChH,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,MAAM,GAAG,QAAQ,kEAAkE,qBAAqB,EAAE,EAAE,IAAI;AACtH,MAAI,CAAC,OAAO,OAAO,IAAI,SAAS,MAAM,EAAG,QAAO,CAAC;AACjD,SAAO,EAAE,eAAe,OAAO,IAAI,aAAa,GAAG,aAAa,OAAO,IAAI,WAAW,GAAG,gBAAgB,OAAO,IAAI,cAAc,EAAE;AACtI;AAEA,SAAS,eAAe,IAAc,eAAuB,UAAwF;AACnJ,QAAM,uBAAuB,OAAO,IAAI,uBAAuB;AAC/D,MAAI,yBAAyB,KAAK,yBAAyB,eAAe;AACxE,UAAM,IAAI,4BAA4B,+DAA+D;AAAA,EACvG;AACA,QAAM,iBAAiB,OAAO,IAAI,qBAAqB;AACvD,MAAI,mBAAmB,KAAK,mBAAmB,gCAAgC;AAC7E,UAAM,IAAI,4BAA4B,+CAA+C;AAAA,EACvF;AACA,KAAG,KAAK,8BAA8B,qBAAqB;AAAA;AAAA;AAAA,kBAG3C;AAChB,QAAM,WAAW,SAAS,EAAE;AAC5B,MAAI,OAAO,KAAK,QAAQ,EAAE,UAAU,OAAO,QAAQ,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG;AAC5G,UAAM,IAAI,4BAA4B,4DAA4D;AAAA,EACpG;AACA,KAAG,QAAQ,yBAAyB,qBAAqB,uEAAuE,EAC7H,IAAI,SAAS,eAAe,SAAS,aAAa,SAAS,cAAc;AAC5E,KAAG,KAAK,iFAAiF,qBAAqB;AAAA;AAAA,oFAE5B,qBAAqB;AAAA,oEACrC;AAClE,KAAG,KAAK,2BAA2B,aAAa,2BAA2B,8BAA8B,EAAE;AAC7G;AAEO,SAAS,6BAA6B,IAAoB;AAC/D,MAAI,YAAY,IAAI,OAAO,EAAE,OAAQ,OAAM,IAAI,4BAA4B,2DAA2D;AACtI,iBAAe,IAAI,6BAA6B,aAAa;AAC7D,+BAA6B,EAAE;AACjC;AAEO,SAAS,mBAAmB,IAAoB;AACrD,MAAI,YAAY,IAAI,SAAS,EAAE,OAAQ,OAAM,IAAI,4BAA4B,2DAA2D;AACxI,iBAAe,IAAI,4BAA4B,YAAY;AAC3D,qBAAmB,EAAE;AACvB;AAEO,SAAS,uBAAuB,IAA6F;AAClI,QAAM,gBAAgB,OAAO,IAAI,uBAAuB;AACxD,QAAM,WAAW,SAAS,EAAE,EAAE;AAC9B,MAAK,kBAAkB,+BAA+B,aAAa,gBAC7D,kBAAkB,8BAA8B,aAAa,mBAAoB;AACrF,UAAM,IAAI,4BAA4B,uDAAuD;AAAA,EAC/F;AACA,MAAI,kBAAkB,+BAA+B,aAAa,kBAAmB,QAAO;AAC5F,MAAI,kBAAkB,8BAA8B,aAAa,aAAc,QAAO;AACtF,MAAI,YAAY,IAAI,OAAO,EAAE,OAAQ,QAAO;AAC5C,MAAI,YAAY,IAAI,SAAS,EAAE,OAAQ,QAAO;AAC9C,SAAO;AACT;AAEO,SAAS,mBAAmB,IAAoB;AACrD,MAAI,uBAAuB,EAAE,MAAM,aAAc,OAAM,IAAI,4BAA4B,qCAAqC;AAC5H,MAAI,OAAO,IAAI,uBAAuB,MAAM,8BACvC,OAAO,IAAI,qBAAqB,MAAM,+BAAgC,OAAM,IAAI,4BAA4B,mCAAmC;AACpJ,QAAM,iBAAiB,SAAS,EAAE;AAClC,MAAI,OAAO,KAAK,cAAc,EAAE,WAAW,OAAO,KAAK,YAAY,EAAE,UAChE,OAAO,QAAQ,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,eAAe,GAAG,MAAM,KAAK,EAAG,OAAM,IAAI,4BAA4B,mCAAmC;AAClK,QAAM,OAAO,GAAG,QAAQ,2FAA2F,EAAE,IAAI;AACzH,MAAI,KAAK,WAAW,YAAY,KAAM,OAAM,IAAI,4BAA4B,mDAAmD;AAC/H,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,YAAY,IAAI,OAAO,IAAI,IAAI,CAAC;AACjD,QAAI,CAAC,YAAY,SAAS,CAAC,MAAM,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC,MAAM,OAAO,IAAI,QAAQ,EAAG,OAAM,IAAI,4BAA4B,+CAA+C;AAAA,EAClL;AACA,aAAW,CAAC,OAAO,QAAQ,KAAK,OAAO,QAAQ,WAAW,GAAG;AAC3D,UAAM,UAAW,GAAG,QAAQ,qBAAqB,KAAK,GAAG,EAAE,IAAI,EAAY,IAAI,CAAC,QAAQ,OAAO,IAAI,IAAI,CAAC;AACxG,UAAM,UAAU,CAAC,GAAG,OAAO,EAAE,KAAK;AAAG,UAAM,kBAAkB,CAAC,GAAG,QAAQ,EAAE,KAAK;AAChF,QAAI,QAAQ,WAAW,gBAAgB,UAAU,QAAQ,KAAK,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,EAAG,OAAM,IAAI,4BAA4B,0CAA0C;AAAA,EACvM;AACA,QAAM,WAAW,yBAAyB,EAAE;AAC5C,MAAI,CAAC,oCAAoC,QAAQ,EAAG,OAAM,IAAI,4BAA4B,+CAA+C;AAC3I;AAEO,SAAS,6BAA6B,IAAoB;AAC/D,MAAI,uBAAuB,EAAE,MAAM,kBAAmB,OAAM,IAAI,4BAA4B,gDAAgD;AAC5I,MAAI,OAAO,IAAI,uBAAuB,MAAM,+BACvC,OAAO,IAAI,qBAAqB,MAAM,gCAAgC;AACzE,UAAM,IAAI,4BAA4B,8CAA8C;AAAA,EACtF;AACA,QAAM,iBAAiB,SAAS,EAAE;AAClC,MAAI,OAAO,KAAK,cAAc,EAAE,WAAW,OAAO,KAAK,aAAa,EAAE,UACjE,OAAO,QAAQ,aAAa,EAAE,KAAK,CAAC,CAAC,KAAK,KAAK,MAAM,eAAe,GAAG,MAAM,KAAK,GAAG;AACxF,UAAM,IAAI,4BAA4B,8CAA8C;AAAA,EACtF;AACA,QAAM,OAAO,GAAG,QAAQ,2FAA2F,EAAE,IAAI;AACzH,MAAI,KAAK,WAAW,aAAa,KAAM,OAAM,IAAI,4BAA4B,8DAA8D;AAC3I,aAAW,OAAO,MAAM;AACtB,UAAM,WAAW,aAAa,IAAI,OAAO,IAAI,IAAI,CAAC;AAClD,QAAI,CAAC,YAAY,SAAS,CAAC,MAAM,OAAO,IAAI,IAAI,KAAK,SAAS,CAAC,MAAM,OAAO,IAAI,QAAQ,GAAG;AACzF,YAAM,IAAI,4BAA4B,0DAA0D;AAAA,IAClG;AAAA,EACF;AACA,aAAW,CAAC,OAAO,QAAQ,KAAK,OAAO,QAAQ,YAAY,GAAG;AAC5D,UAAM,UAAW,GAAG,QAAQ,qBAAqB,KAAK,GAAG,EAAE,IAAI,EAAY,IAAI,CAAC,QAAQ,OAAO,IAAI,IAAI,CAAC;AACxG,UAAM,UAAU,CAAC,GAAG,OAAO,EAAE,KAAK;AAAG,UAAM,kBAAkB,CAAC,GAAG,QAAQ,EAAE,KAAK;AAChF,QAAI,QAAQ,WAAW,gBAAgB,UAAU,QAAQ,KAAK,CAAC,QAAQ,UAAU,WAAW,gBAAgB,KAAK,CAAC,GAAG;AACnH,YAAM,IAAI,4BAA4B,qDAAqD;AAAA,IAC7F;AAAA,EACF;AACA,QAAM,WAAW,yBAAyB,EAAE;AAC5C,MAAI,CAAC,qCAAqC,QAAQ,EAAG,OAAM,IAAI,4BAA4B,0DAA0D;AACvJ;AAEO,SAAS,mBAAmB,IAAoB;AACrD,QAAM,YAAY,GAAG,QAAQ,wBAAwB,EAAE,IAAI;AAC3D,MAAI,UAAU,WAAW,KAAK,OAAO,OAAO,OAAO,UAAU,CAAC,CAAE,EAAE,CAAC,CAAC,MAAM,MAAM;AAC9E,UAAM,IAAI,4BAA4B,+BAA+B;AAAA,EACvE;AACA,QAAM,cAAc,GAAG,QAAQ,0BAA0B,EAAE,IAAI;AAC/D,MAAI,YAAY,OAAQ,OAAM,IAAI,4BAA4B,iCAAiC;AACjG;;;AC9SA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,iBAAiB;AACtC,SAAS,qBAAqB;;;ACF9B,SAAS,OAAO,OAAyB;AACvC,MAAI,EAAE,iBAAiB,OAAQ,QAAO;AACtC,QAAM,SAAS;AACf,SAAO,OAAO,YAAY,KAAK,+BAA+B,KAAK,MAAM,OAAO;AAClF;AAEO,IAAM,wCAAwC;AAErD,eAAsB,gBACpB,WACA,WACY;AACZ,QAAM,WAAW,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,CAAC;AAC/D,MAAI,UAAU;AACd,SAAO,MAAM;AACX,QAAI;AACF,aAAO,UAAU;AAAA,IACnB,SAAS,OAAO;AACd,UAAI,CAAC,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,SAAU,OAAM;AACpD,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC;AAC3D,gBAAU,KAAK,IAAI,UAAU,GAAG,EAAE;AAAA,IACpC;AAAA,EACF;AACF;;;ADXA,IAAMA,WAAU,cAAc,YAAY,GAAG;AAC7C,SAAS,aAAa,MAAwB;AAC5C,QAAM,EAAE,aAAa,IAAIA,SAAQ,aAAa;AAC9C,SAAO,IAAI,aAAa,IAAI;AAC9B;AACA,IAAM,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAqEf,SAAS,UAAU,OAA+B;AAAE,SAAO,UAAU,SAAY,OAAO,KAAK,UAAU,KAAK;AAAG;AAC/G,SAAS,MAAM,OAAqB;AAAE,SAAO,OAAO,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AAAW;AACxG,SAAS,eAAe,OAAoC;AAAE,SAAO,SAAS,OAAO,SAAY,OAAO,KAAK;AAAG;AAChH,SAAS,QAAQ,KAAyB;AAAE,QAAM,SAAO,MAAM,IAAI,eAAe;AAAE,MAAG,QAAQ,aAAW,KAAK,QAAO,QAAQ;AAAU,SAAO,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,WAAW,OAAO,IAAI,SAAS,GAAG,SAAS,eAAe,IAAI,OAAO,GAAG,QAAQ,OAAO,IAAI,MAAM,GAAG,UAAU,OAAO,IAAI,QAAQ,GAAG,MAAM,OAAO,IAAI,IAAI,GAAG,SAAS,OAAO,IAAI,OAAO,GAAG,aAAa,OAAO,IAAI,YAAY,GAAG,MAAM,MAAM,IAAI,IAAI,GAAG,SAAS,MAAM,IAAI,OAAO,KAAK,CAAC,GAAG,UAAU,eAAe,IAAI,SAAS,GAAG,WAAW,eAAe,IAAI,WAAW,GAAG,eAAe,eAAe,IAAI,cAAc,GAAG,aAAa,eAAe,IAAI,YAAY,GAAG,UAAU,IAAI,UAAuC,WAAW,eAAe,IAAI,UAAU,GAAG,gBAAgB,eAAe,IAAI,eAAe,GAAG,gBAAgB,eAAe,IAAI,gBAAgB,GAAG,YAAY,MAAM,IAAI,WAAW,GAAG,UAAU,MAAM,IAAI,QAAQ,GAAG,gBAAgB,QAAQ,WAAW,OAAO,IAAI,UAAU,EAAE;AAAG;AACl8B,SAAS,SAAS,KAA0B;AAAE,SAAO,EAAE,IAAI,OAAO,IAAI,EAAE,GAAG,WAAW,OAAO,IAAI,UAAU,GAAG,WAAW,OAAO,IAAI,SAAS,GAAG,WAAW,OAAO,IAAI,SAAS,GAAG,OAAO,IAAI,OAAkC,SAAS,OAAO,IAAI,OAAO,GAAG,cAAc,OAAO,IAAI,aAAa,GAAG,cAAc,OAAO,IAAI,aAAa,GAAG,WAAW,OAAO,IAAI,UAAU,GAAG,cAAc,OAAO,IAAI,aAAa,GAAG,aAAa,OAAO,IAAI,YAAY,GAAG,YAAY,eAAe,IAAI,WAAW,GAAG,YAAY,eAAe,IAAI,WAAW,GAAG,gBAAgB,eAAe,IAAI,gBAAgB,GAAG,WAAW,eAAe,IAAI,UAAU,GAAG,WAAW,eAAe,IAAI,UAAU,GAAG,YAAY,IAAI,YAA4C;AAAG;AACvuB,SAAS,SAAS,KAAyB;AAAE,SAAO,EAAE,WAAW,OAAO,IAAI,SAAS,GAAG,OAAO,OAAO,IAAI,KAAK,GAAG,UAAU,OAAO,IAAI,QAAQ,GAAG,aAAa,eAAe,IAAI,YAAY,GAAG,cAAc,MAAM,IAAI,YAAY,KAAK,CAAC,GAAG,gBAAgB,OAAO,IAAI,gBAAgB,GAAG,YAAY,OAAO,IAAI,YAAY,EAAE;AAAG;AACpU,SAAS,cAAc,KAA+B;AAAE,SAAO,EAAE,UAAU,OAAO,IAAI,QAAQ,GAAG,YAAY,OAAO,IAAI,WAAW,GAAG,WAAW,OAAO,IAAI,UAAU,GAAG,WAAW,OAAO,IAAI,SAAS,GAAG,WAAW,OAAO,IAAI,SAAS,GAAG,WAAW,IAAI,cAAc,OAAO,SAAY,IAAI,YAAgD,SAAS,IAAI,UAA4C,SAAS,OAAO,IAAI,OAAO,GAAG,cAAc,OAAO,IAAI,aAAa,GAAG,cAAc,OAAO,IAAI,aAAa,GAAG,YAAY,eAAe,IAAI,WAAW,GAAG,OAAO,eAAe,IAAI,KAAK,GAAG,OAAO,OAAO,IAAI,KAAK,GAAG,QAAQ,IAAI,QAAyC,WAAW,OAAO,IAAI,UAAU,EAAE;AAAG;AAEtrB,IAAM,oBAAN,MAA+C;AAAA,EAMpD,YAA6B,OAAO,YAA6B,gBAAgB,KAAO;AAA3D;AAAoC;AAFjE,SAAQ,cAAc;AAGpB,UAAM,WAAW,6BAA6B,MAAM,OAAO,OAAO;AAClE,SAAK,eAAe;AACpB,SAAK,mBAAmB,IAAI,IAAI,aAAa,aAAa,CAAC,IAAI,CAAC,UAAU,GAAG,QAAQ,QAAQ,GAAG,QAAQ,MAAM,EAAE,OAAO,UAAU,CAAC;AAClI,UAAM,SAAS,aAAa,cAAc,CAAC,WAAW,QAAQ,IAAI,SAAY,UAAU,QAAQ;AAChG,SAAK,KAAK,aAAa,QAAQ;AAC/B,QAAI;AACF,WAAK,GAAG,KAAK,yBAAyB,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,aAAa,CAAC,CAAC,EAAE;AACnF,WAAK,cAAc,KAAK;AACxB,UAAI,QAAQ;AACV,cAAM,QAAQ,UAAU,QAAQ;AAChC,YAAI,MAAM,QAAQ,OAAO,OAAO,MAAM,QAAQ,OAAO,IAAK,OAAM,IAAI,MAAM,qDAAqD;AAAA,MACjI;AAAA,IACF,SAAS,OAAO;AAAE,WAAK,GAAG,MAAM;AAAG,YAAM;AAAA,IAAO;AAAA,EAClD;AAAA,EACQ,cAAc,kBAAkB,MAAY;AAClD,QAAI,KAAK,iBAAiB,WAAY;AACtC,UAAM,QAAQ,kBACV,CAAC,KAAK,cAAc,GAAG,KAAK,YAAY,QAAQ,GAAG,KAAK,YAAY,MAAM,IAC1E,CAAC,KAAK,YAAY;AACtB,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,WAAW,IAAI,EAAG;AACvB,UAAI,SAAS,KAAK,gBAAgB,KAAK,iBAAiB,IAAI,IAAI,EAAG,yBAAwB,MAAM,MAAM;AAAA,eAC9F,SAAS,KAAK,aAAc,mBAAkB,MAAM,MAAM;AAAA,UAC9D,4BAA2B,IAAI;AAAA,IACtC;AAAA,EACF;AAAA,EACA,MAAM,aAA4B;AAChC,QAAI,KAAK,YAAa;AACtB,QAAI,CAAC,KAAK,gBAAgB;AACxB,WAAK,iBAAiB,KAAK,eAAe,EAAE,KAAK,MAAM;AACrD,aAAK,cAAc;AAAA,MACrB,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,aAAK,iBAAiB;AACtB,cAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,MAAc,iBAAgC;AAC5C,UAAM,aAAa,KAAK,GAAG,QAAQ,oCAAoC,EAAE,IAAI;AAC7E,UAAM,QAAQ,OAAO,WAAW,OAAO,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM;AAC9D,UAAM,WAAW,MAAM,CAAC,KAAK,KAAK,OAAa,MAAM,CAAC,KAAK,KAAK,OAAS,MAAM,CAAC,KAAK;AACrF,QAAI,UAAU,QAAW,OAAM,IAAI,MAAM,oCAAoC;AAC7E,gCAA4B,KAAK,EAAE;AACnC,UAAM,0BAA0B,KAAK,IAAI,KAAK,eAAe,qCAAqC;AAClG,UAAM,gBAAgB,MAAM,KAAK,GAAG,KAAK,MAAM,GAAG,uBAAuB;AACzE,UAAM,gBAAgB,MAAM,KAAK,GAAG,KAAK,iBAAiB,GAAG,uBAAuB;AACpF,QAAI;AACF,YAAM,UAAU,KAAK,GAAG,QAAQ,oCAAoC,EAAE,IAAI;AAC1E,UAAI,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,SAAS,GAAG;AACxD,aAAK,GAAG,KAAK,qDAAqD;AAAA,MACpE;AACA,YAAM,sBAAsB,CAAC,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,iBAAiB;AACvF,UAAI,qBAAqB;AACvB,aAAK,GAAG,KAAK,kDAAkD;AAC/D,aAAK,GAAG,KAAK,yLAAyL;AACtM,aAAK,GAAG,KAAK,2IAA2I;AAAA,MAC1J;AACA,YAAM,eAAe,uBAAuB,QAAS,KAAK,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,gBAK3D,EAAE,IAAI,CAAqB;AACrC,UAAI,cAAc;AAChB,aAAK,GAAG,KAAK,kDAAkD;AAC/D,YAAI,qBAAqB;AACvB,eAAK,GAAG,KAAK;AAAA;AAAA,gIAEyG;AAAA,QACxH,OAAO;AACL,eAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yEAckD;AAAA,QACjE;AACA,aAAK,GAAG,KAAK,2IAA2I;AAAA,MAC1J;AACA,YAAM,kBAAkB,KAAK,GAAG,QAAQ,sCAAsC,EAAE,IAAI;AACpF,UAAI,CAAC,gBAAgB,KAAK,CAAC,WAAW,OAAO,SAAS,aAAa,GAAG;AACpE,aAAK,GAAG,KAAK,0JAA0J;AACvK,cAAM,eAAe,KAAK,GAAG,QAAQ,2CAA2C,EAAE,IAAI;AACtF,aAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,6GAKwF;AACrG,YAAI,aAAa,QAAQ;AACvB,eAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mFA2B4D;AACzE,eAAK,GAAG,KAAK,mCAAmC;AAAA,QAClD;AACA,aAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,oMAU+K;AAC5L,aAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,uFA0BkE;AAC/E,aAAK,GAAG,KAAK,6FAA6F;AAC1G,aAAK,GAAG,KAAK,yEAAyE;AAAA,MACxF;AACA,WAAK,GAAG,KAAK,qjBAAqjB;AAClkB,WAAK,GAAG,KAAK;AAAA,srBACmqB;AAChrB,WAAK,GAAG,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mEAoBgD;AAC7D,WAAK,GAAG,KAAK;AAAA;AAAA,gEAE6C;AAC1D,WAAK,GAAG,KAAK,qGAAqG;AAClH,mCAA6B,KAAK,EAAE;AACpC,WAAK,GAAG,KAAK,QAAQ;AAAA,IACvB,SAAS,OAAO;AACd,WAAK,GAAG,KAAK,UAAU;AACvB,YAAM;AAAA,IACR;AACA,SAAK,cAAc;AAAA,EACrB;AAAA,EACA,MAAc,QAAQ;AAAE,UAAM,KAAK,WAAW;AAAA,EAAG;AAAA,EACjD,MAAM,cAAc,OAAoF;AACtG,UAAM,KAAK,MAAM;AAAG,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAG,UAAM,eAAe,MAAM,mBAAmB,MAAM,QAAQ,SAAS,EAAE,MAAM,UAAmB,aAAa,GAAG,kBAAkB,KAAO,iBAAiB,KAAQ,kBAAkB,IAAI,IAAI,EAAE,MAAM,UAAmB;AACvR,SAAK,GAAG,KAAK,iBAAiB;AAC9B,QAAI;AACF,UAAI,MAAM,gBAAgB;AAAE,cAAM,WAAW,KAAK,GAAG,QAAQ,0FAA0F,EAAE,IAAI,MAAM,WAAW,MAAM,QAAQ,MAAM,cAAc;AAAsB,YAAI,UAAU;AAAE,gBAAM,SAAS,QAAQ,QAAQ;AAAG,iCAAuB,QAAQ,KAAK;AAAG,eAAK,GAAG,KAAK,QAAQ;AAAG,iBAAO,EAAE,SAAS,QAAQ,SAAS,MAAM;AAAA,QAAG;AAAA,MAAE;AACrY,WAAK,GAAG,QAAQ,4SAA4S,EAAE,IAAI,MAAM,IAAG,MAAM,WAAU,MAAM,WAAW,MAAK,MAAM,QAAO,MAAM,MAAK,MAAM,SAAQ,MAAM,aAAY,UAAU,MAAM,IAAI,GAAE,KAAK,UAAU,MAAM,OAAO,GAAE,MAAM,YAAY,MAAK,MAAM,aAAa,MAAK,MAAM,iBAAiB,MAAK,MAAM,eAAe,MAAK,MAAM,UAAS,MAAM,aAAa,MAAK,MAAM,kBAAkB,MAAK,MAAM,kBAAkB,MAAK,UAAU,MAAM,UAAU,GAAE,UAAU,MAAM,QAAQ,GAAE,KAAK,UAAU,YAAY,GAAE,SAAS;AAC/vB,UAAI,aAAa,SAAS,UAAU;AAClC,cAAM,cAAc,aAAa,aAAa,aAAa,YAAY,YAAY,aAAa,YAAY;AAC5G,cAAM,eAAe,MAAM,aAAa,WAAW,IAAI,MAAM,aAAa,SAAS,IAAI;AACvF,mBAAW,aAAa,MAAM,SAAS;AACrC,eAAK,GAAG,QAAQ,mKAAmK,EAChL,IAAI,WAAW,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,WAAW,WAAW,cAAc,aAAa,MAAM,QAAQ,SAAS;AAAA,QACrI;AAAA,MACF;AACA,YAAM,MAAM,KAAK,GAAG,QAAQ,4CAA4C,EAAE,IAAI,MAAM,EAAE;AAAU,WAAK,GAAG,KAAK,QAAQ;AAAG,aAAO,EAAE,SAAS,QAAQ,GAAG,GAAG,SAAS,KAAK;AAAA,IACxK,SAAS,OAAO;AAAE,WAAK,GAAG,KAAK,UAAU;AAAG,YAAM;AAAA,IAAO;AAAA,EAC3D;AAAA,EACA,MAAM,aAAa,WAA4B,QAAsB,CAAC,GAAyB;AAC7F,UAAM,KAAK,MAAM;AAAG,UAAM,QAAQ,YAAY,WAAW,KAAK;AAAG,UAAM,SAAS,aAAa,MAAM,QAAQ,KAAK;AAAG,UAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,MAAM,SAAS,EAAE,GAAG,CAAC,GAAG,GAAG;AAAG,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AAC/N,UAAM,eAAe,MAAM,SAAS,SAAY,KAAK,GAAG,QAAQ,yEAAyE,EAAE,IAAI,UAAU,SAAS;AAClK,UAAM,YAAY,cAAc,aAAa,QAAQ,cAAc,aAAa,SAC5E,SACA,OAAO,aAAa,QAAQ;AAChC,UAAM,UAAU,MAAM,WAAW;AAAS,UAAM,aAAa,YAAY,SAAS,eAAe,YAAY,QAAQ,gGAAgG;AAAiF,UAAM,UAAU,CAAC,iBAAiB,MAAM,SAAS,QAAQ,gBAAgB,UAAU;AAAG,UAAM,OAAwB,MAAM,SAAS,CAAC,UAAU,SAAS,IAAI,CAAC,UAAU,WAAW,UAAU,GAAG;AAAG,QAAI,YAAY,MAAO,MAAK,KAAK,UAAU,OAAO,UAAU,KAAK;AAAA,QAAQ,MAAK,KAAK,UAAU,KAAK;AACzkB,QAAI,WAAW;AAAE,cAAQ,KAAK,eAAe;AAAG,WAAK,KAAK,SAAS;AAAA,IAAG;AACtE,QAAI,CAAC,MAAM,gBAAgB;AAAE,cAAQ,KAAK,wCAAwC;AAAG,WAAK,KAAK,GAAG;AAAA,IAAG;AACrG,QAAI,MAAM,OAAO,QAAQ;AAAE,cAAQ,KAAK,YAAY,MAAM,MAAM,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG;AAAG,WAAK,KAAK,GAAG,MAAM,KAAK;AAAA,IAAG;AACzH,QAAI,MAAM,QAAQ;AAAE,cAAQ,KAAK,YAAY;AAAG,WAAK,KAAK,MAAM,MAAM;AAAA,IAAG;AACzE,QAAI,MAAM,SAAS;AAAE,cAAQ,KAAK,aAAa;AAAG,WAAK,KAAK,MAAM,OAAO;AAAA,IAAG;AAC5E,QAAI,MAAM,OAAO;AAAE,cAAQ,KAAK,iBAAiB;AAAG,WAAK,KAAK,MAAM,KAAK;AAAA,IAAG;AAC5E,QAAI,MAAM,gBAAgB,MAAM,iBAAiB,OAAO;AACtD,cAAQ,KAAK,GAAG,MAAM,iBAAiB,WAAW,SAAS,EAAE,oKAAoK;AACjO,WAAK,KAAK,UAAU,KAAK;AAAA,IAC3B;AACA,QAAI,MAAM,UAAU;AAAE,cAAQ,KAAK,eAAe;AAAG,WAAK,KAAK,MAAM,QAAQ;AAAA,IAAG;AAChF,UAAM,OAAO,KAAK,GAAG,QAAQ,uCAAuC,QAAQ,KAAK,OAAO,CAAC,sBAAsB,MAAM,SAAS,SAAS,KAAK,UAAU,EAAE,IAAI,GAAG,MAAM,KAAK;AAC1K,UAAM,WAAW,KAAK,IAAI,OAAO;AACjC,UAAM,OAAO,SAAS,SAAS,SAAS,CAAC;AACzC,QAAI,MAAM,OAAQ,QAAO,EAAE,UAAU,QAAQ,SAAS,CAAC,IAAI,aAAa,SAAS,CAAC,EAAE,UAAU,KAAK,IAAI,MAAM,OAAO;AACpH,QAAI,SAAS,WAAW,MAAO,QAAO,EAAE,UAAU,QAAQ,aAAa,KAAM,UAAU,KAAK,EAAE;AAC9F,WAAO,EAAE,UAAU,QAAQ,YAAY,aAAa,WAAW,KAAK,IAAI,MAAM,OAAO;AAAA,EACvF;AAAA,EACA,MAAM,cAAc,WAA4B,YAAsB,SAAS,oBAAI,KAAK,GAAoB;AAAE,UAAM,KAAK,MAAM;AAAG,UAAM,OAAO,KAAK,GAAG,QAAQ,sOAAsO;AAAG,QAAI,UAAU;AAAG,SAAK,GAAG,KAAK,iBAAiB;AAAG,QAAI;AAAE,iBAAW,MAAM,WAAY,YAAW,OAAO,KAAK,IAAI,UAAU,OAAM,OAAO,YAAY,GAAE,UAAU,WAAU,IAAG,UAAU,KAAK,EAAE,OAAO;AAAG,WAAK,GAAG,KAAK,QAAQ;AAAG,aAAO;AAAA,IAAS,SAAS,GAAG;AAAE,WAAK,GAAG,KAAK,UAAU;AAAG,YAAM;AAAA,IAAG;AAAA,EAAE;AAAA,EAC1qB,MAAM,cAAc,WAA4B,SAAuD;AACrG,UAAM,KAAK,MAAM;AAAG,UAAM,MAAM,QAAQ,OAAO,oBAAI,KAAK;AAAG,UAAM,UAAU,IAAI,YAAY;AAAG,UAAM,UAAU,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,OAAO,EAAE,YAAY;AAAG,UAAM,QAAQ,UAAU,YAAY,UAAU;AACrN,SAAK,GAAG,KAAK,iBAAiB;AAAG,QAAI;AACnC,WAAK,GAAG,QAAQ,wdAAwd,EAAE,IAAI,UAAU,WAAU,UAAU,OAAM,OAAO;AACzhB,WAAK,GAAG,QAAQ,weAAwe,EAAE,IAAI,UAAU,WAAU,UAAU,OAAM,OAAO;AACziB,WAAK,GAAG,QAAQ,mcAAmc,EAAE,IAAI,SAAQ,UAAU,WAAU,UAAU,OAAM,OAAO;AAC5gB,YAAM,YAAY,KAAK,GAAG,QAAQ,kgBAAkgB,EAAE,IAAI,UAAU,WAAU,UAAU,OAAM,SAAQ,OAAO;AAC7lB,UAAI,CAAC,WAAW;AAAE,aAAK,GAAG,KAAK,QAAQ;AAAG,eAAO;AAAA,MAAM;AACvD,YAAM,cAAc,OAAO,UAAU,EAAE;AACvC,YAAM,QAAQ,WAAW;AAAG,WAAK,GAAG,QAAQ,yMAAyM,EAAE,IAAI,OAAM,OAAM,SAAQ,UAAU,OAAM,WAAW;AAC1S,YAAM,UAAU,KAAK,GAAG,QAAQ,4CAA4C,EAAE,IAAI,WAAW;AAAU,WAAK,GAAG,KAAK,QAAQ;AAAG,aAAO,SAAS,OAAO;AAAA,IACxJ,SAAS,GAAG;AAAE,WAAK,GAAG,KAAK,UAAU;AAAG,YAAM;AAAA,IAAG;AAAA,EACnD;AAAA,EACA,MAAM,cAAc,WAA4B,IAAY,OAAe,SAAiD;AAAE,UAAM,KAAK,MAAM;AAAG,UAAM,MAAM,oBAAI,KAAK;AAAG,UAAM,UAAU,IAAI,KAAK,IAAI,QAAQ,IAAI,OAAO,EAAE,YAAY;AAAG,UAAM,QAAQ,UAAU,YAAY,UAAU;AAAO,UAAM,SAAS,KAAK,GAAG,QAAQ,6KAA6K,EAAE,IAAI,SAAQ,UAAU,WAAU,UAAU,OAAM,OAAM,IAAG,OAAM,IAAI,YAAY,CAAC;AAAG,QAAI,CAAC,OAAO,QAAS,QAAO;AAAM,WAAO,SAAS,KAAK,GAAG,QAAQ,4CAA4C,EAAE,IAAI,EAAE,CAAQ;AAAA,EAAG;AAAA,EAClsB,MAAM,eAAe,WAA4B,IAAY,OAAe,OAAsC,OAAgB,cAAyF;AACzN,UAAM,KAAK,MAAM;AAAG,UAAM,MAAM,oBAAI,KAAK;AAAG,UAAM,QAAQ,UAAU,YAAY,UAAU;AAC1F,SAAK,GAAG,KAAK,iBAAiB;AAC9B,QAAI;AACF,YAAM,UAAU,KAAK,GAAG,QAAQ,4WAA4W,EAAE,IAAI,UAAU,WAAU,UAAU,OAAM,OAAM,IAAG,OAAM,IAAI,YAAY,CAAC;AACtd,UAAI,CAAC,SAAS;AAAE,aAAK,GAAG,KAAK,QAAQ;AAAG,eAAO;AAAA,MAAM;AACrD,YAAM,SAAS,MAAM,QAAQ,eAAe;AAC5C,YAAM,YAAY,UAAU,cAAc,OAAO,QAAQ,aAAa,KAAK,OAAO,OAAO,WAAW;AACpG,YAAM,YAAY,YAAY,SAAS;AACvC,YAAM,cAAc,KAAK,IAAI,OAAO,iBAAiB,OAAO,mBAAmB,KAAK,KAAK,IAAI,GAAG,OAAO,QAAQ,aAAa,IAAI,CAAC,CAAC;AAClI,YAAM,SAAS,KAAK,KAAK,OAAO,IAAI,IAAI,KAAK,OAAO;AACpD,YAAM,QAAQ,cAAc,aAAa,KAAK,IAAI,GAAG,KAAK,MAAM,cAAc,MAAM,CAAC,IAAI;AACzF,YAAM,YAAY,cAAc,aAAa,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,EAAE,YAAY,IAAI,OAAO,QAAQ,YAAY;AACxH,YAAM,SAAS,UAAU,UAAU,QAAQ,UAAU,SAAS,cAAc,YAAY,uBAAuB;AAC/G,WAAK,GAAG,QAAQ,gKAAgK,EAAE,IAAI,WAAU,WAAU,OAAO,MAAM,GAAE,IAAI,KAAK,MAAK,UAAU,OAAM,QAAO,EAAE;AAChQ,YAAM,SAAS,SAAS,KAAK,GAAG,QAAQ,4CAA4C,EAAE,IAAI,EAAE,CAAQ;AAAG,WAAK,GAAG,KAAK,QAAQ;AAAG,aAAO;AAAA,IACxI,SAAS,QAAQ;AAAE,WAAK,GAAG,KAAK,UAAU;AAAG,YAAM;AAAA,IAAQ;AAAA,EAC7D;AAAA,EACA,MAAM,YAAY,WAAwD;AACxE,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,QAAQ,KAAK,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,+DAW6B,EAAE,IAAI,SAAS,SAAS,SAAS,SAAS,UAAU,WAAW,UAAU,KAAK;AACzI,UAAM,cAAc,MAAM,aAAa,OAAO,MAAM,UAAU,IAAI;AAClE,WAAO,EAAE,eAAe,YAAY,mBAAmB,MAAM,SAAS,OAAO,MAAM,WAAW,CAAC,GAAG,SAAS,OAAO,MAAM,WAAW,CAAC,GAAG,UAAU,OAAO,MAAM,YAAY,CAAC,GAAG,MAAM,OAAO,MAAM,QAAQ,CAAC,GAAG,WAAW,OAAO,MAAM,aAAa,CAAC,GAAG,mBAAmB,MAAM,mBAAmB,OAAO,MAAM,gBAAgB,IAAI,QAAW,KAAK,OAAO,MAAM,OAAO,CAAC,GAAG,WAAW,OAAO,MAAM,aAAa,CAAC,GAAG,eAAe,OAAO,MAAM,kBAAkB,CAAC,GAAG,aAAa,YAAY,cAAc,KAAK,IAAI,GAAG,IAAI,QAAQ,IAAI,KAAK,MAAM,WAAW,CAAC,IAAI,EAAE;AAAA,EACxiB;AAAA,EACA,MAAM,UAAU,WAA4B,SAAiB,aAAsB,eAAyB,CAAC,GAA2B;AACtI,UAAM,KAAK,MAAM;AACjB,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,UAAU,IAAI,YAAY;AAChC,UAAM,UAAU,IAAI,KAAK,IAAI,QAAQ,IAAI,OAAO,EAAE,YAAY;AAC9D,SAAK,GAAG,KAAK,iBAAiB;AAC9B,QAAI;AACF,WAAK,GAAG,QAAQ,uEAAuE,EACpF,IAAI,UAAU,WAAW,OAAO;AACnC,YAAM,UAAU,KAAK,GAAG,QAAQ,4EAA4E,EACzG,IAAI,UAAU,WAAW,UAAU,OAAO,UAAU,QAAS;AAChE,YAAM,aAAa,KAAK,GAAG,QAAQ,6EAA6E,EAC7G,IAAI,UAAU,WAAW,UAAU,KAAK;AAC3C,YAAM,iBAAiB,KAAK,GAAG,QAAQ,iEAAiE,EACrG,IAAI,UAAU,SAAS;AAC1B,UAAI,CAAC,YAAY,OAAO,WAAW,KAAK,KAAK,OAAO,OAAO,eAAe,KAAK,KAAK,OAAO;AACzF,cAAM,OAAO,OAAO,IAAI,MAAM,+BAA+B,GAAG;AAAA,UAC9D,QAAQ;AAAA,UACR,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,WAAK,GAAG,QAAQ,kVAAkV,EAC/V,IAAI,UAAU,WAAU,UAAU,OAAM,UAAU,UAAU,eAAe,MAAK,KAAK,UAAU,YAAY,GAAE,SAAQ,OAAO;AAC/H,YAAM,SAAS,SAAS,KAAK,GAAG,QAAQ,4EAA4E,EACjH,IAAI,UAAU,WAAU,UAAU,OAAM,UAAU,QAAS,CAAQ;AACtE,WAAK,GAAG,KAAK,QAAQ;AACrB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,WAAK,GAAG,KAAK,UAAU;AACvB,YAAM;AAAA,IACR;AAAA,EACF;AAAA,EACA,MAAM,aAAa,WAAsD;AACvE,UAAM,KAAK,MAAM;AACjB,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,SAAK,GAAG,QAAQ,uEAAuE,EACpF,IAAI,UAAU,WAAW,GAAG;AAC/B,UAAM,OAAO,KAAK,GAAG,QAAQ,yEAAyE,EACnG,IAAI,UAAU,SAAS;AAC1B,WAAO,KAAK,IAAI,QAAQ;AAAA,EAC1B;AAAA,EACA,MAAM,eAAe,WAA4B,QAAuB,CAAC,GAAG;AAC1E,UAAM,KAAK,MAAM;AACjB,UAAM,UAAU,EAAE,MAAM,MAAM,QAAQ,OAAO,QAAQ,CAAC,GAAI,MAAM,UAAU,CAAC,CAAE,EAAE,KAAK,GAAG,WAAW,MAAM,aAAa,MAAM,WAAW,MAAM,aAAa,KAAK;AAC9J,UAAM,QAAQ,kBAAkB,cAAc,WAAW,OAAO;AAChE,UAAM,WAAW,+BAA+B,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AACvF,UAAM,QAAQ,MAAM,SAAS;AAC7B,UAAM,UAAU,CAAC,sBAAsB;AACvC,UAAM,OAAwB,CAAC,UAAU,SAAS;AAClD,UAAM,OAAO,MAAM,QAAQ;AAC3B,YAAQ,KAAK,SAAS,cAAc,yBAAyB,SAAS,cAAc,qBAAqB,4CAA4C;AACrJ,SAAK,KAAK,UAAU,KAAK;AAAG,QAAI,SAAS,MAAO,MAAK,KAAK,UAAU,KAAK;AACzE,QAAI,UAAU;AAAE,cAAQ,KAAK,sEAAsE;AAAG,WAAK,KAAK,SAAS,WAAqB,SAAS,WAAqB,SAAS,EAAY;AAAA,IAAG;AACpM,QAAI,MAAM,WAAW;AAAE,cAAQ,KAAK,uBAAuB;AAAG,WAAK,KAAK,MAAM,SAAS;AAAA,IAAG;AAC1F,QAAI,MAAM,WAAW;AAAE,cAAQ,KAAK,sBAAsB;AAAG,WAAK,KAAK,MAAM,SAAS;AAAA,IAAG;AACzF,QAAI,MAAM,QAAQ,QAAQ;AAAE,cAAQ,KAAK,sBAAsB,MAAM,OAAO,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG,CAAC,GAAG;AAAG,WAAK,KAAK,GAAG,MAAM,MAAM;AAAA,IAAG;AACtI,UAAM,OAAO,KAAK,GAAG,QAAQ,mKAAmK,QAAQ,KAAK,OAAO,CAAC,mDAAmD,EAAE,IAAI,GAAG,MAAM,KAAK;AAC5R,UAAM,aAAa,KAAK,IAAI,QAAQ;AAAG,UAAM,OAAO,WAAW,WAAW,SAAS,CAAC;AACpF,WAAO,EAAE,YAAY,QAAQ,WAAW,WAAW,SAAS,OAAO,mBAAmB,OAAO,EAAE,WAAW,KAAK,WAAW,IAAI,KAAK,GAAG,CAAC,IAAI,OAAU;AAAA,EACvJ;AAAA,EACA,MAAM,mBAAmB,WAA4B,YAAoB,QAAwC,CAAC,GAAG;AACnH,UAAM,KAAK,MAAM;AAAG,UAAM,QAAQ,MAAM,SAAS;AACjD,UAAM,QAAQ,kBAAkB,mBAAmB,WAAW,EAAE,WAAW,CAAC;AAC5E,UAAM,WAAW,4BAA4B,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AACpF,UAAM,OAAO,KAAK,GAAG,QAAQ,qSAAqS,EAAE,IAAI,UAAU,WAAU,YAAW,YAAY,KAAI,UAAU,OAAM,UAAU,OAAM,KAAK;AAC5Z,UAAM,SAAS,KAAK,IAAI,aAAa;AAAG,UAAM,OAAO,OAAO,OAAO,SAAS,CAAC;AAC7E,WAAO,EAAE,QAAQ,QAAQ,OAAO,WAAW,SAAS,OAAO,mBAAmB,OAAO,KAAK,QAAQ,IAAI,OAAU;AAAA,EAClH;AAAA,EACA,MAAM,eAAe,WAA2B,IAAW;AACzD,UAAM,KAAK,MAAM;AAAG,SAAK,GAAG,KAAK,iBAAiB;AAClD,QAAI;AACF,YAAM,UAAU,KAAK,GAAG,QAAQ,6NAA6N,EAAE,IAAI,IAAG,UAAU,WAAU,UAAU,KAAK;AACzS,UAAI,CAAC,SAAS;AAAE,aAAK,GAAG,KAAK,QAAQ;AAAG,eAAO;AAAA,MAAM;AACrD,UAAI,QAAQ,UAAU,aAAa;AAAE,aAAK,GAAG,KAAK,QAAQ;AAAG,eAAO,SAAS,OAAO;AAAA,MAAG;AACvF,UAAI,CAAC,CAAC,WAAU,YAAW,SAAS,EAAE,SAAS,OAAO,QAAQ,KAAK,CAAC,EAAG,OAAM,IAAI,2BAA2B,mBAAmB,QAAQ,KAAK,WAAW;AACvJ,WAAK,GAAG,QAAQ,qKAAqK,EAAE,IAAI,UAAU,OAAM,EAAE;AAC7M,YAAM,SAAS,SAAS,KAAK,GAAG,QAAQ,4CAA4C,EAAE,IAAI,EAAE,CAAQ;AAAG,WAAK,GAAG,KAAK,QAAQ;AAAG,aAAO;AAAA,IACxI,SAAS,OAAO;AAAE,WAAK,GAAG,KAAK,UAAU;AAAG,YAAM;AAAA,IAAO;AAAA,EAC3D;AAAA,EACA,MAAM,gBAAgB,WAA2B,IAAW;AAC1D,UAAM,KAAK,MAAM;AAAG,SAAK,GAAG,KAAK,iBAAiB;AAClD,QAAI;AACF,YAAM,UAAU,KAAK,GAAG,QAAQ,wQAAwQ,EAAE,IAAI,IAAG,UAAU,WAAU,UAAU,KAAK;AACpV,UAAI,CAAC,SAAS;AAAE,aAAK,GAAG,KAAK,QAAQ;AAAG,eAAO;AAAA,MAAM;AACrD,UAAI,CAAC,CAAC,QAAO,WAAW,EAAE,SAAS,OAAO,QAAQ,KAAK,CAAC,EAAG,OAAM,IAAI,2BAA2B,oBAAoB,QAAQ,KAAK,WAAW;AAC5I,YAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AAAG,UAAI,QAAQ,cAAc,OAAO,QAAQ,UAAU,KAAK,IAAK,OAAM,IAAI,2BAA2B,mCAAmC;AAC3K,YAAM,SAAS,MAAM,QAAQ,eAAe;AAAG,YAAM,cAAc,OAAO,aAAa,OAAO,YAAY,MAAM,OAAO,YAAY;AACnI,WAAK,GAAG,QAAQ,iOAAiO,EAAE,IAAI,aAAY,UAAU,OAAM,EAAE;AACrR,YAAM,SAAS,SAAS,KAAK,GAAG,QAAQ,4CAA4C,EAAE,IAAI,EAAE,CAAQ;AAAG,WAAK,GAAG,KAAK,QAAQ;AAAG,aAAO;AAAA,IACxI,SAAS,OAAO;AAAE,WAAK,GAAG,KAAK,UAAU;AAAG,YAAM;AAAA,IAAO;AAAA,EAC3D;AAAA,EACA,MAAM,QAAuB;AAAE,SAAK,GAAG,MAAM;AAAA,EAAG;AAClD;","names":["require"]}

package/dist/{chunk-NCO7RLBM.js → chunk-GTK4KOED.js}

@@ -2,9 +2,14 @@
 
 // src/private-path.ts
 import { chmodSync, existsSync, lstatSync, mkdirSync } from "fs";
+import { AsyncLocalStorage } from "async_hooks";
 import { dirname, resolve } from "path";
 import { spawnSync } from "child_process";
 var PrivatePathError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
 };
 var defaults = {
   platform: process.platform,
@@ -15,6 +20,59 @@ var defaults = {
   }),
   inspect: (path) => lstatSync(path)
 };
+var scopedPolicy = new AsyncLocalStorage();
+function privateDirectoryIdentity(path, dependencies) {
+  const details = dependencies.inspect(path);
+  if (details.isSymbolicLink() || !details.isDirectory()) {
+    throw new PrivatePathError("private path has the wrong file type");
+  }
+  return { device: details.dev, inode: details.ino };
+}
+function createPrivateDirectoryAccessCache() {
+  const entries = /* @__PURE__ */ new Map();
+  const same = (left, right) => left.device === right.device && left.inode === right.inode;
+  return {
+    verify(path, dependencies) {
+      const identityDependencies = dependencies ?? defaults;
+      if (identityDependencies.platform !== "win32") {
+        verifyPrivatePathAccess(path, "directory", dependencies);
+        return;
+      }
+      const cached = entries.get(path);
+      if (cached) {
+        const current = privateDirectoryIdentity(path, identityDependencies);
+        if (!same(current, cached)) {
+          throw new PrivatePathError("private path identity changed after cached policy validation", "PATH_REPLACED");
+        }
+        return;
+      }
+      const before = privateDirectoryIdentity(path, identityDependencies);
+      verifyPrivatePathAccess(path, "directory", dependencies);
+      const after = privateDirectoryIdentity(path, identityDependencies);
+      if (!same(before, after)) {
+        throw new PrivatePathError("private directory identity changed during policy validation", "PATH_REPLACED");
+      }
+      entries.set(path, after);
+    },
+    secure(path, dependencies) {
+      const identityDependencies = dependencies ?? defaults;
+      if (identityDependencies.platform !== "win32") {
+        securePrivatePath(path, "directory", dependencies);
+        return;
+      }
+      const before = privateDirectoryIdentity(path, identityDependencies);
+      securePrivatePath(path, "directory", dependencies);
+      const after = privateDirectoryIdentity(path, identityDependencies);
+      if (!same(before, after)) {
+        throw new PrivatePathError("private directory identity changed during policy validation", "PATH_REPLACED");
+      }
+      entries.set(path, after);
+    },
+    clear() {
+      entries.clear();
+    }
+  };
+}
 function windowsScript(kind, apply) {
   const flags = kind === "directory" ? "[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'" : "[System.Security.AccessControl.InheritanceFlags]::None";
   const pathInfo = kind === "directory" ? "[System.IO.DirectoryInfo]::new($p)" : "[System.IO.FileInfo]::new($p)";
@@ -25,6 +83,7 @@ function windowsScript(kind, apply) {
     "$tokenOwner=$identity.Owner",
     `$pathInfo=${pathInfo}`,
     "$pathInfo.Refresh()",
+    "if(-not $pathInfo.Exists){exit 26}",
     "if(($pathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}",
     `$flags=${flags}`,
     "$sections=[System.Security.AccessControl.AccessControlSections]([System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access)",
@@ -46,6 +105,7 @@ function windowsScript(kind, apply) {
     ] : [],
     `$checkPathInfo=${pathInfo}`,
     "$checkPathInfo.Refresh()",
+    "if(-not $checkPathInfo.Exists){exit 26}",
     "if(($checkPathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}",
     "$check=$checkPathInfo.GetAccessControl($sections)",
     "$owner=$check.GetOwner([System.Security.Principal.SecurityIdentifier])",
@@ -74,6 +134,9 @@ function windowsPrivatePath(path, kind, apply, dependencies) {
     windowsScript(kind, apply)
   ], { ...process.env, AGENT_BRIDGE_PRIVATE_PATH: path });
   if (result.status !== 0) {
+    if (result.status === 26) {
+      throw new PrivatePathError("private Windows path disappeared during policy validation", "PATH_DISAPPEARED");
+    }
     const phase = result.status === 23 ? `final ACL verification failed${result.stdout.trim() ? ` (${result.stdout.trim()})` : ""}` : result.status === 24 ? `the existing owner is not trusted${result.stdout.trim() ? ` (${result.stdout.trim()})` : ""}` : result.status === 25 ? "the path is a reparse object" : "the native ACL command failed";
     throw new PrivatePathError(`${apply ? "cannot apply" : "path does not satisfy"} the current-user private path policy: ${phase}`);
   }
@@ -82,6 +145,25 @@ function windowsPrivatePath(path, kind, apply, dependencies) {
     throw new PrivatePathError("private Windows path identity changed during policy validation");
   }
 }
+function securePrivateSqliteSidecar(path, dependencies) {
+  const pathDisappeared = (error) => error instanceof PrivatePathError ? error.code === "PATH_DISAPPEARED" : typeof error === "object" && error !== null && error.code === "ENOENT";
+  const pathEntryExists = () => {
+    try {
+      lstatSync(path);
+      return true;
+    } catch (error) {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    }
+  };
+  if (!pathEntryExists()) return;
+  try {
+    securePrivatePath(path, "file", dependencies);
+  } catch (error) {
+    if (pathDisappeared(error) && !pathEntryExists()) return;
+    throw error;
+  }
+}
 function posixPrivatePath(path, kind, apply) {
   const details = lstatSync(path);
   if (details.isSymbolicLink() || (kind === "file" ? !details.isFile() : !details.isDirectory())) {
@@ -97,12 +179,26 @@ function posixPrivatePath(path, kind, apply) {
     throw new PrivatePathError("private path permissions are not owner-only");
   }
 }
-function securePrivatePath(path, kind, dependencies = defaults) {
-  if (dependencies.platform === "win32") windowsPrivatePath(path, kind, true, dependencies);
+function securePrivatePath(path, kind, dependencies) {
+  if (dependencies) {
+    if (dependencies.platform === "win32") windowsPrivatePath(path, kind, true, dependencies);
+    else posixPrivatePath(path, kind, true);
+    return;
+  }
+  const policy = scopedPolicy.getStore();
+  if (policy) policy.secure(path, kind);
+  else if (defaults.platform === "win32") windowsPrivatePath(path, kind, true, defaults);
   else posixPrivatePath(path, kind, true);
 }
-function verifyPrivatePathAccess(path, kind, dependencies = defaults) {
-  if (dependencies.platform === "win32") windowsPrivatePath(path, kind, false, dependencies);
+function verifyPrivatePathAccess(path, kind, dependencies) {
+  if (dependencies) {
+    if (dependencies.platform === "win32") windowsPrivatePath(path, kind, false, dependencies);
+    else posixPrivatePath(path, kind, false);
+    return;
+  }
+  const policy = scopedPolicy.getStore();
+  if (policy) policy.verify(path, kind);
+  else if (defaults.platform === "win32") windowsPrivatePath(path, kind, false, defaults);
   else posixPrivatePath(path, kind, false);
 }
 function preparePrivateFileLocation(path, createParent = false) {
@@ -126,21 +222,25 @@ function securePrivateSqliteFiles(path) {
     verifyPrivatePathAccess(candidate, "file");
   }
 }
-function preparePrivateSqliteLocation(path, createParent = false) {
+function preparePrivateSqliteLocation(path, createParent = false, sidecarPolicy = "secure") {
   if (path === ":memory:") return path;
   const target = preparePrivateFileLocation(path, createParent);
-  for (const candidate of [`${target}-wal`, `${target}-shm`]) {
-    if (existsSync(candidate)) securePrivatePath(candidate, "file");
+  if (sidecarPolicy === "secure") {
+    for (const candidate of [`${target}-wal`, `${target}-shm`]) {
+      securePrivateSqliteSidecar(candidate);
+    }
   }
   return target;
 }
 
 export {
   PrivatePathError,
+  createPrivateDirectoryAccessCache,
+  securePrivateSqliteSidecar,
   securePrivatePath,
   verifyPrivatePathAccess,
   preparePrivateFileLocation,
   securePrivateSqliteFiles,
   preparePrivateSqliteLocation
 };
-//# sourceMappingURL=chunk-NCO7RLBM.js.map
+//# sourceMappingURL=chunk-GTK4KOED.js.map

package/dist/chunk-GTK4KOED.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/private-path.ts"],"sourcesContent":["import { chmodSync, existsSync, lstatSync, mkdirSync } from \"node:fs\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { dirname, resolve } from \"node:path\";\nimport { spawnSync, type SpawnSyncReturns } from \"node:child_process\";\n\nexport type PrivatePathKind = \"file\" | \"directory\";\n\nexport class PrivatePathError extends Error {\n  constructor(message: string, readonly code?: \"PATH_DISAPPEARED\" | \"PATH_REPLACED\") {\n    super(message);\n  }\n}\n\nexport interface PrivatePathDependencies {\n  platform: NodeJS.Platform;\n  execute(command: string, args: string[], env: NodeJS.ProcessEnv): SpawnSyncReturns<string>;\n  inspect(path: string): {\n    dev: number;\n    ino: number;\n    isSymbolicLink(): boolean;\n    isFile(): boolean;\n    isDirectory(): boolean;\n  };\n}\n\n/** Test policy for semantic suites that do not exercise native ACLs. */\nexport interface PrivatePathPolicy {\n  secure(path: string, kind: PrivatePathKind): void;\n  verify(path: string, kind: PrivatePathKind): void;\n}\n\ninterface PrivateDirectoryIdentity {\n  device: number;\n  inode: number;\n}\n\n/**\n * Keep verified Windows directories within one caller-owned critical section.\n *\n * A cache hit still checks the directory type and identity. The cache does not\n * detect ACL changes made to the same directory by the current OS user.\n */\nexport interface PrivateDirectoryAccessCache {\n  verify(path: string, dependencies?: PrivatePathDependencies): void;\n  secure(path: string, dependencies?: PrivatePathDependencies): void;\n  clear(): void;\n}\n\nconst defaults: PrivatePathDependencies = {\n  platform: process.platform,\n  execute: (command, args, env) => spawnSync(command, args, {\n    encoding: \"utf8\",\n    windowsHide: true,\n    env,\n  }),\n  inspect: (path) => lstatSync(path),\n};\n\nconst scopedPolicy = new AsyncLocalStorage<PrivatePathPolicy>();\n\nfunction assertInProcessPath(path: string, kind: PrivatePathKind, apply: boolean): void {\n  const details = lstatSync(path);\n  if (details.isSymbolicLink()\n    || (kind === \"file\" ? !details.isFile() : !details.isDirectory())) {\n    throw new PrivatePathError(\"private path has the wrong file type\");\n  }\n  if (process.platform === \"win32\") return;\n  if (typeof process.getuid === \"function\" && details.uid !== process.getuid()) {\n    throw new PrivatePathError(\"private path must be owned by the current user\");\n  }\n  const mode = kind === \"file\" ? 0o600 : 0o700;\n  if (apply) chmodSync(path, mode);\n  if ((lstatSync(path).mode & 0o777) !== mode) {\n    throw new PrivatePathError(\"private path permissions are not owner-only\");\n  }\n}\n\n/**\n * Create an in-process policy for semantic tests.\n *\n * It preserves file-kind and link rejection. It does not inspect or modify\n * native permissions or ACLs. Direct policy tests use the default unscoped\n * implementation.\n */\nexport function createInProcessPrivatePathPolicy(): PrivatePathPolicy {\n  return Object.freeze({\n    secure: (path: string, kind: PrivatePathKind) => assertInProcessPath(path, kind, true),\n    verify: (path: string, kind: PrivatePathKind) => assertInProcessPath(path, kind, false),\n  });\n}\n\n/** Invoke a callback with an injected private-path policy. */\nexport function withPrivatePathPolicy<T>(policy: PrivatePathPolicy, callback: () => T): T {\n  return scopedPolicy.run(policy, callback);\n}\n\nfunction privateDirectoryIdentity(\n  path: string,\n  dependencies: PrivatePathDependencies,\n): PrivateDirectoryIdentity {\n  const details = dependencies.inspect(path);\n  if (details.isSymbolicLink() || !details.isDirectory()) {\n    throw new PrivatePathError(\"private path has the wrong file type\");\n  }\n  return { device: details.dev, inode: details.ino };\n}\n\n/** Create an empty, caller-owned cache for verified private directories. */\nexport function createPrivateDirectoryAccessCache(): PrivateDirectoryAccessCache {\n  const entries = new Map<string, PrivateDirectoryIdentity>();\n  const same = (left: PrivateDirectoryIdentity, right: PrivateDirectoryIdentity): boolean => left.device === right.device\n    && left.inode === right.inode;\n  return {\n    verify(path, dependencies): void {\n      const identityDependencies = dependencies ?? defaults;\n      if (identityDependencies.platform !== \"win32\") {\n        verifyPrivatePathAccess(path, \"directory\", dependencies);\n        return;\n      }\n      const cached = entries.get(path);\n      if (cached) {\n        const current = privateDirectoryIdentity(path, identityDependencies);\n        if (!same(current, cached)) {\n          throw new PrivatePathError(\"private path identity changed after cached policy validation\", \"PATH_REPLACED\");\n        }\n        return;\n      }\n      const before = privateDirectoryIdentity(path, identityDependencies);\n      verifyPrivatePathAccess(path, \"directory\", dependencies);\n      const after = privateDirectoryIdentity(path, identityDependencies);\n      if (!same(before, after)) {\n        throw new PrivatePathError(\"private directory identity changed during policy validation\", \"PATH_REPLACED\");\n      }\n      entries.set(path, after);\n    },\n    secure(path, dependencies): void {\n      const identityDependencies = dependencies ?? defaults;\n      if (identityDependencies.platform !== \"win32\") {\n        securePrivatePath(path, \"directory\", dependencies);\n        return;\n      }\n      const before = privateDirectoryIdentity(path, identityDependencies);\n      securePrivatePath(path, \"directory\", dependencies);\n      const after = privateDirectoryIdentity(path, identityDependencies);\n      if (!same(before, after)) {\n        throw new PrivatePathError(\"private directory identity changed during policy validation\", \"PATH_REPLACED\");\n      }\n      entries.set(path, after);\n    },\n    clear(): void { entries.clear(); },\n  };\n}\n\nfunction windowsScript(kind: PrivatePathKind, apply: boolean): string {\n  const flags = kind === \"directory\"\n    ? \"[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'\"\n    : \"[System.Security.AccessControl.InheritanceFlags]::None\";\n  const pathInfo = kind === \"directory\"\n    ? \"[System.IO.DirectoryInfo]::new($p)\"\n    : \"[System.IO.FileInfo]::new($p)\";\n  return [\n    \"$p=$env:AGENT_BRIDGE_PRIVATE_PATH\",\n    \"$identity=[System.Security.Principal.WindowsIdentity]::GetCurrent()\",\n    \"$sid=$identity.User\",\n    \"$tokenOwner=$identity.Owner\",\n    `$pathInfo=${pathInfo}`,\n    \"$pathInfo.Refresh()\",\n    \"if(-not $pathInfo.Exists){exit 26}\",\n    \"if(($pathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}\",\n    `$flags=${flags}`,\n    \"$sections=[System.Security.AccessControl.AccessControlSections]([System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access)\",\n    \"$before=$pathInfo.GetAccessControl($sections)\",\n    \"$beforeOwner=$before.GetOwner([System.Security.Principal.SecurityIdentifier])\",\n    \"$beforeMatchesUser=$false\",\n    \"$beforeMatchesToken=$false\",\n    \"if($null -ne $beforeOwner){$beforeMatchesUser=$beforeOwner.Equals($sid);if($null -ne $tokenOwner){$beforeMatchesToken=$beforeOwner.Equals($tokenOwner)}}\",\n    \"if(-not $beforeMatchesUser -and -not $beforeMatchesToken){Write-Output (\\\"explicit owner present {0}; matches user {1}; matches token {2}\\\" -f ($null -ne $beforeOwner),$beforeMatchesUser,$beforeMatchesToken);exit 24}\",\n    ...(apply ? [\n      \"$acl=$before\",\n      \"$acl.SetAccessRuleProtection($true,$false)\",\n      \"$existingRules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))\",\n      \"foreach($existing in $existingRules){$acl.RemoveAccessRuleSpecific($existing)}\",\n      \"$acl.SetOwner($sid)\",\n      \"$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow)\",\n      \"$acl.AddAccessRule($rule)\",\n      \"$pathInfo.SetAccessControl($acl)\",\n    ] : []),\n    `$checkPathInfo=${pathInfo}`,\n    \"$checkPathInfo.Refresh()\",\n    \"if(-not $checkPathInfo.Exists){exit 26}\",\n    \"if(($checkPathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}\",\n    \"$check=$checkPathInfo.GetAccessControl($sections)\",\n    \"$owner=$check.GetOwner([System.Security.Principal.SecurityIdentifier])\",\n    \"$ownerMatches=$false\",\n    \"if($null -ne $owner){$ownerMatches=$owner.Equals($sid)}\",\n    \"$rules=@($check.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))\",\n    \"$ruleMatches=$false\",\n    \"$ruleInherited=$true\",\n    \"$ruleAllow=$false\",\n    \"$rightsExact=$false\",\n    \"$inheritanceExact=$false\",\n    \"$propagationExact=$false\",\n    \"if($rules.Count -eq 1){$ruleSid=$rules[0].IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]);$ruleMatches=$ruleSid.Equals($sid);$ruleInherited=$rules[0].IsInherited;$ruleAllow=$rules[0].AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow;$rightsExact=$rules[0].FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl;$inheritanceExact=$rules[0].InheritanceFlags -eq $flags;$propagationExact=$rules[0].PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None}\",\n    \"if(-not $ownerMatches -or -not $check.AreAccessRulesProtected -or $rules.Count -ne 1 -or -not $ruleMatches -or $ruleInherited -or -not $ruleAllow -or -not $rightsExact -or -not $inheritanceExact -or -not $propagationExact){Write-Output (\\\"final owner {0}; protected {1}; rules {2}; sid {3}; inherited {4}; allow {5}; rights {6}; inheritance {7}; propagation {8}\\\" -f $ownerMatches,$check.AreAccessRulesProtected,$rules.Count,$ruleMatches,$ruleInherited,$ruleAllow,$rightsExact,$inheritanceExact,$propagationExact);exit 23}\",\n  ].join(\";\");\n}\n\nfunction windowsPrivatePath(\n  path: string,\n  kind: PrivatePathKind,\n  apply: boolean,\n  dependencies: PrivatePathDependencies,\n): void {\n  const before = dependencies.inspect(path);\n  if (before.isSymbolicLink()\n    || (kind === \"file\" ? !before.isFile() : !before.isDirectory())) {\n    throw new PrivatePathError(\"private Windows paths cannot be symlinks, junctions, or reparse objects\");\n  }\n  const result = dependencies.execute(\"powershell.exe\", [\n    \"-NoProfile\", \"-NonInteractive\", \"-Command\", windowsScript(kind, apply),\n  ], { ...process.env, AGENT_BRIDGE_PRIVATE_PATH: path });\n  if (result.status !== 0) {\n    if (result.status === 26) {\n      throw new PrivatePathError(\"private Windows path disappeared during policy validation\", \"PATH_DISAPPEARED\");\n    }\n    const phase = result.status === 23\n      ? `final ACL verification failed${result.stdout.trim() ? ` (${result.stdout.trim()})` : \"\"}`\n      : result.status === 24\n        ? `the existing owner is not trusted${result.stdout.trim() ? ` (${result.stdout.trim()})` : \"\"}`\n        : result.status === 25\n          ? \"the path is a reparse object\"\n          : \"the native ACL command failed\";\n    throw new PrivatePathError(`${apply\n      ? \"cannot apply\"\n      : \"path does not satisfy\"} the current-user private path policy: ${phase}`);\n  }\n  const after = dependencies.inspect(path);\n  if (after.isSymbolicLink()\n    || (kind === \"file\" ? !after.isFile() : !after.isDirectory())\n    || after.dev !== before.dev || after.ino !== before.ino) {\n    throw new PrivatePathError(\"private Windows path identity changed during policy validation\");\n  }\n}\n\n/** Secure an ephemeral SQLite sidecar, accepting deletion but never replacement. */\nexport function securePrivateSqliteSidecar(\n  path: string,\n  dependencies?: PrivatePathDependencies,\n): void {\n  const pathDisappeared = (error: unknown): boolean => error instanceof PrivatePathError\n    ? error.code === \"PATH_DISAPPEARED\"\n    : typeof error === \"object\" && error !== null && (error as NodeJS.ErrnoException).code === \"ENOENT\";\n  const pathEntryExists = (): boolean => {\n    try { lstatSync(path); return true; } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n      throw error;\n    }\n  };\n  if (!pathEntryExists()) return;\n  try {\n    securePrivatePath(path, \"file\", dependencies);\n  } catch (error) {\n    if (pathDisappeared(error) && !pathEntryExists()) return;\n    throw error;\n  }\n}\n\nfunction posixPrivatePath(path: string, kind: PrivatePathKind, apply: boolean): void {\n  const details = lstatSync(path);\n  if (details.isSymbolicLink()\n    || (kind === \"file\" ? !details.isFile() : !details.isDirectory())) {\n    throw new PrivatePathError(\"private path has the wrong file type\");\n  }\n  if (typeof process.getuid === \"function\" && details.uid !== process.getuid()) {\n    throw new PrivatePathError(\"private path must be owned by the current user\");\n  }\n  const mode = kind === \"file\" ? 0o600 : 0o700;\n  if (apply) chmodSync(path, mode);\n  const secured = lstatSync(path);\n  if ((secured.mode & 0o777) !== mode) {\n    throw new PrivatePathError(\"private path permissions are not owner-only\");\n  }\n}\n\nexport function securePrivatePath(\n  path: string,\n  kind: PrivatePathKind,\n  dependencies?: PrivatePathDependencies,\n): void {\n  if (dependencies) {\n    if (dependencies.platform === \"win32\") windowsPrivatePath(path, kind, true, dependencies);\n    else posixPrivatePath(path, kind, true);\n    return;\n  }\n  const policy = scopedPolicy.getStore();\n  if (policy) policy.secure(path, kind);\n  else if (defaults.platform === \"win32\") windowsPrivatePath(path, kind, true, defaults);\n  else posixPrivatePath(path, kind, true);\n}\n\nexport function verifyPrivatePathAccess(\n  path: string,\n  kind: PrivatePathKind,\n  dependencies?: PrivatePathDependencies,\n): void {\n  if (dependencies) {\n    if (dependencies.platform === \"win32\") windowsPrivatePath(path, kind, false, dependencies);\n    else posixPrivatePath(path, kind, false);\n    return;\n  }\n  const policy = scopedPolicy.getStore();\n  if (policy) policy.verify(path, kind);\n  else if (defaults.platform === \"win32\") windowsPrivatePath(path, kind, false, defaults);\n  else posixPrivatePath(path, kind, false);\n}\n\n/** Prepare an immediate parent and reject link-like file locations before use. */\nexport function preparePrivateFileLocation(path: string, createParent = false): string {\n  const target = resolve(path);\n  const parent = dirname(target);\n  const parentExisted = existsSync(parent);\n  if (createParent && !parentExisted) mkdirSync(parent, { recursive: true, mode: 0o700 });\n  if (!existsSync(parent)) throw new PrivatePathError(\"private path parent does not exist\");\n  if (!parentExisted) securePrivatePath(parent, \"directory\");\n  verifyPrivatePathAccess(parent, \"directory\");\n  if (existsSync(target)) verifyPrivatePathAccess(target, \"file\");\n  return target;\n}\n\n/** Apply and verify owner-only policy for a SQLite database and live sidecars. */\nexport function securePrivateSqliteFiles(path: string): void {\n  if (path === \":memory:\") return;\n  const target = resolve(path);\n  verifyPrivatePathAccess(dirname(target), \"directory\");\n  for (const candidate of [target, `${target}-wal`, `${target}-shm`]) {\n    if (!existsSync(candidate)) continue;\n    securePrivatePath(candidate, \"file\");\n    verifyPrivatePathAccess(candidate, \"file\");\n  }\n}\n\nexport function preparePrivateSqliteLocation(\n  path: string,\n  createParent = false,\n  sidecarPolicy: \"secure\" | \"defer\" = \"secure\",\n): string {\n  if (path === \":memory:\") return path;\n  const target = preparePrivateFileLocation(path, createParent);\n  if (sidecarPolicy === \"secure\") {\n    for (const candidate of [`${target}-wal`, `${target}-shm`]) {\n      securePrivateSqliteSidecar(candidate);\n    }\n  }\n  return target;\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,YAAY,WAAW,iBAAiB;AAC5D,SAAS,yBAAyB;AAClC,SAAS,SAAS,eAAe;AACjC,SAAS,iBAAwC;AAI1C,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAY,SAA0B,MAA6C;AACjF,UAAM,OAAO;AADuB;AAAA,EAEtC;AACF;AAqCA,IAAM,WAAoC;AAAA,EACxC,UAAU,QAAQ;AAAA,EAClB,SAAS,CAAC,SAAS,MAAM,QAAQ,UAAU,SAAS,MAAM;AAAA,IACxD,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,EACF,CAAC;AAAA,EACD,SAAS,CAAC,SAAS,UAAU,IAAI;AACnC;AAEA,IAAM,eAAe,IAAI,kBAAqC;AAsC9D,SAAS,yBACP,MACA,cAC0B;AAC1B,QAAM,UAAU,aAAa,QAAQ,IAAI;AACzC,MAAI,QAAQ,eAAe,KAAK,CAAC,QAAQ,YAAY,GAAG;AACtD,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,SAAO,EAAE,QAAQ,QAAQ,KAAK,OAAO,QAAQ,IAAI;AACnD;AAGO,SAAS,oCAAiE;AAC/E,QAAM,UAAU,oBAAI,IAAsC;AAC1D,QAAM,OAAO,CAAC,MAAgC,UAA6C,KAAK,WAAW,MAAM,UAC5G,KAAK,UAAU,MAAM;AAC1B,SAAO;AAAA,IACL,OAAO,MAAM,cAAoB;AAC/B,YAAM,uBAAuB,gBAAgB;AAC7C,UAAI,qBAAqB,aAAa,SAAS;AAC7C,gCAAwB,MAAM,aAAa,YAAY;AACvD;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,IAAI,IAAI;AAC/B,UAAI,QAAQ;AACV,cAAM,UAAU,yBAAyB,MAAM,oBAAoB;AACnE,YAAI,CAAC,KAAK,SAAS,MAAM,GAAG;AAC1B,gBAAM,IAAI,iBAAiB,gEAAgE,eAAe;AAAA,QAC5G;AACA;AAAA,MACF;AACA,YAAM,SAAS,yBAAyB,MAAM,oBAAoB;AAClE,8BAAwB,MAAM,aAAa,YAAY;AACvD,YAAM,QAAQ,yBAAyB,MAAM,oBAAoB;AACjE,UAAI,CAAC,KAAK,QAAQ,KAAK,GAAG;AACxB,cAAM,IAAI,iBAAiB,+DAA+D,eAAe;AAAA,MAC3G;AACA,cAAQ,IAAI,MAAM,KAAK;AAAA,IACzB;AAAA,IACA,OAAO,MAAM,cAAoB;AAC/B,YAAM,uBAAuB,gBAAgB;AAC7C,UAAI,qBAAqB,aAAa,SAAS;AAC7C,0BAAkB,MAAM,aAAa,YAAY;AACjD;AAAA,MACF;AACA,YAAM,SAAS,yBAAyB,MAAM,oBAAoB;AAClE,wBAAkB,MAAM,aAAa,YAAY;AACjD,YAAM,QAAQ,yBAAyB,MAAM,oBAAoB;AACjE,UAAI,CAAC,KAAK,QAAQ,KAAK,GAAG;AACxB,cAAM,IAAI,iBAAiB,+DAA+D,eAAe;AAAA,MAC3G;AACA,cAAQ,IAAI,MAAM,KAAK;AAAA,IACzB;AAAA,IACA,QAAc;AAAE,cAAQ,MAAM;AAAA,IAAG;AAAA,EACnC;AACF;AAEA,SAAS,cAAc,MAAuB,OAAwB;AACpE,QAAM,QAAQ,SAAS,cACnB,qFACA;AACJ,QAAM,WAAW,SAAS,cACtB,uCACA;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI,CAAC;AAAA,IACL,kBAAkB,QAAQ;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,mBACP,MACA,MACA,OACA,cACM;AACN,QAAM,SAAS,aAAa,QAAQ,IAAI;AACxC,MAAI,OAAO,eAAe,MACpB,SAAS,SAAS,CAAC,OAAO,OAAO,IAAI,CAAC,OAAO,YAAY,IAAI;AACjE,UAAM,IAAI,iBAAiB,yEAAyE;AAAA,EACtG;AACA,QAAM,SAAS,aAAa,QAAQ,kBAAkB;AAAA,IACpD;AAAA,IAAc;AAAA,IAAmB;AAAA,IAAY,cAAc,MAAM,KAAK;AAAA,EACxE,GAAG,EAAE,GAAG,QAAQ,KAAK,2BAA2B,KAAK,CAAC;AACtD,MAAI,OAAO,WAAW,GAAG;AACvB,QAAI,OAAO,WAAW,IAAI;AACxB,YAAM,IAAI,iBAAiB,6DAA6D,kBAAkB;AAAA,IAC5G;AACA,UAAM,QAAQ,OAAO,WAAW,KAC5B,gCAAgC,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,KACxF,OAAO,WAAW,KAChB,oCAAoC,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,KAC5F,OAAO,WAAW,KAChB,iCACA;AACR,UAAM,IAAI,iBAAiB,GAAG,QAC1B,iBACA,uBAAuB,0CAA0C,KAAK,EAAE;AAAA,EAC9E;AACA,QAAM,QAAQ,aAAa,QAAQ,IAAI;AACvC,MAAI,MAAM,eAAe,MACnB,SAAS,SAAS,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,YAAY,MACxD,MAAM,QAAQ,OAAO,OAAO,MAAM,QAAQ,OAAO,KAAK;AACzD,UAAM,IAAI,iBAAiB,gEAAgE;AAAA,EAC7F;AACF;AAGO,SAAS,2BACd,MACA,cACM;AACN,QAAM,kBAAkB,CAAC,UAA4B,iBAAiB,mBAClE,MAAM,SAAS,qBACf,OAAO,UAAU,YAAY,UAAU,QAAS,MAAgC,SAAS;AAC7F,QAAM,kBAAkB,MAAe;AACrC,QAAI;AAAE,gBAAU,IAAI;AAAG,aAAO;AAAA,IAAM,SAAS,OAAO;AAClD,UAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,CAAC,gBAAgB,EAAG;AACxB,MAAI;AACF,sBAAkB,MAAM,QAAQ,YAAY;AAAA,EAC9C,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EAAG;AAClD,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBAAiB,MAAc,MAAuB,OAAsB;AACnF,QAAM,UAAU,UAAU,IAAI;AAC9B,MAAI,QAAQ,eAAe,MACrB,SAAS,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,YAAY,IAAI;AACnE,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,MAAI,OAAO,QAAQ,WAAW,cAAc,QAAQ,QAAQ,QAAQ,OAAO,GAAG;AAC5E,UAAM,IAAI,iBAAiB,gDAAgD;AAAA,EAC7E;AACA,QAAM,OAAO,SAAS,SAAS,MAAQ;AACvC,MAAI,MAAO,WAAU,MAAM,IAAI;AAC/B,QAAM,UAAU,UAAU,IAAI;AAC9B,OAAK,QAAQ,OAAO,SAAW,MAAM;AACnC,UAAM,IAAI,iBAAiB,6CAA6C;AAAA,EAC1E;AACF;AAEO,SAAS,kBACd,MACA,MACA,cACM;AACN,MAAI,cAAc;AAChB,QAAI,aAAa,aAAa,QAAS,oBAAmB,MAAM,MAAM,MAAM,YAAY;AAAA,QACnF,kBAAiB,MAAM,MAAM,IAAI;AACtC;AAAA,EACF;AACA,QAAM,SAAS,aAAa,SAAS;AACrC,MAAI,OAAQ,QAAO,OAAO,MAAM,IAAI;AAAA,WAC3B,SAAS,aAAa,QAAS,oBAAmB,MAAM,MAAM,MAAM,QAAQ;AAAA,MAChF,kBAAiB,MAAM,MAAM,IAAI;AACxC;AAEO,SAAS,wBACd,MACA,MACA,cACM;AACN,MAAI,cAAc;AAChB,QAAI,aAAa,aAAa,QAAS,oBAAmB,MAAM,MAAM,OAAO,YAAY;AAAA,QACpF,kBAAiB,MAAM,MAAM,KAAK;AACvC;AAAA,EACF;AACA,QAAM,SAAS,aAAa,SAAS;AACrC,MAAI,OAAQ,QAAO,OAAO,MAAM,IAAI;AAAA,WAC3B,SAAS,aAAa,QAAS,oBAAmB,MAAM,MAAM,OAAO,QAAQ;AAAA,MACjF,kBAAiB,MAAM,MAAM,KAAK;AACzC;AAGO,SAAS,2BAA2B,MAAc,eAAe,OAAe;AACrF,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,SAAS,QAAQ,MAAM;AAC7B,QAAM,gBAAgB,WAAW,MAAM;AACvC,MAAI,gBAAgB,CAAC,cAAe,WAAU,QAAQ,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtF,MAAI,CAAC,WAAW,MAAM,EAAG,OAAM,IAAI,iBAAiB,oCAAoC;AACxF,MAAI,CAAC,cAAe,mBAAkB,QAAQ,WAAW;AACzD,0BAAwB,QAAQ,WAAW;AAC3C,MAAI,WAAW,MAAM,EAAG,yBAAwB,QAAQ,MAAM;AAC9D,SAAO;AACT;AAGO,SAAS,yBAAyB,MAAoB;AAC3D,MAAI,SAAS,WAAY;AACzB,QAAM,SAAS,QAAQ,IAAI;AAC3B,0BAAwB,QAAQ,MAAM,GAAG,WAAW;AACpD,aAAW,aAAa,CAAC,QAAQ,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG;AAClE,QAAI,CAAC,WAAW,SAAS,EAAG;AAC5B,sBAAkB,WAAW,MAAM;AACnC,4BAAwB,WAAW,MAAM;AAAA,EAC3C;AACF;AAEO,SAAS,6BACd,MACA,eAAe,OACf,gBAAoC,UAC5B;AACR,MAAI,SAAS,WAAY,QAAO;AAChC,QAAM,SAAS,2BAA2B,MAAM,YAAY;AAC5D,MAAI,kBAAkB,UAAU;AAC9B,eAAW,aAAa,CAAC,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG;AAC1D,iCAA2B,SAAS;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-GADH244D.js → chunk-IHZFI7TH.js}

@@ -17,6 +17,7 @@ var OptionalNumber = (options = {}) => Type.Optional(Type.Number(options));
 var OptionalBoolean = () => Type.Optional(Type.Boolean());
 var NullableString = () => Type.Union([Type.String(), Type.Null()]);
 var NullableNumber = () => Type.Union([Type.Number(), Type.Null()]);
+var UUID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$";
 var UUID_V7_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$";
 var ErrorIssueSchema = Type.Object({
   path: Type.String(),
@@ -212,6 +213,8 @@ var DeliveryDiagnosticsProperties = {
   expiredLeases: Type.Optional(NullableNumber()),
   oldestDueAt: OptionalString(),
   queueLagMs: Type.Optional(NullableNumber()),
+  gatewayAuthorityId: OptionalString(),
+  credentialId: OptionalString(),
   principal: Type.Optional(Type.Object({ workspace: Type.String(), agent: Type.String() }, { additionalProperties: true }))
 };
 var DiagnosticsSchema = Type.Object(DeliveryDiagnosticsProperties, { additionalProperties: true });
@@ -236,9 +239,12 @@ var ClientDiagnosticsSchema = Type.Object({
   lastOutboundSyncAt: OptionalString(),
   lastInboundSyncAt: OptionalString(),
   lastSyncAttemptAt: OptionalString(),
-  syncLoopState: Type.Optional(Type.Enum(["disabled", "idle", "running", "backoff", "stopped", "failed"])),
+  syncLoopState: Type.Optional(Type.Enum(["disabled", "idle", "running", "backoff", "paused", "stopped", "failed"])),
   syncLoopError: OptionalString(),
-  remoteError: OptionalString()
+  remoteError: OptionalString(),
+  migrationState: Type.Optional(Type.Enum(["active", "draining", "retired"])),
+  migrationOperationId: OptionalString(),
+  migrationLeaseExpiresAt: OptionalString()
 }, { additionalProperties: true });
 var ClientStatusSchema = Type.Object({
   status: Type.Enum(["ok", "unknown", "degraded", "failed"]),
@@ -353,8 +359,10 @@ var ReceiptCliResponseSchema = Type.Object({
   agent: Type.String()
 }, { additionalProperties: true });
 var operations = [
-  operation({ id: "capabilities", summary: "Discover operations available on the current surface.", request: Empty, response: Type.Object({ protocolVersion: Type.String(), currentProtocolVersion: Type.String(), selectedProtocolVersion: Type.String(), supportedProtocolVersions: StringArray, scopeEnforcement: Type.Boolean(), requestAuthority: Type.Boolean(), rowIsolation: Type.Boolean(), authorizationModel: Type.Enum(["scoped-credential", "credential-wide", "process-identity", "legacy-key"]), surface: Type.Enum(["mcp", "http", "cli"]), provider: Type.Enum(["local", "gateway", "legacy-supabase"]), operations: Type.Array(Type.Object({ id: Type.String(), summary: Type.String(), requiredScopes: StringArray, mcp: Type.Optional(Type.Any()), http: Type.Optional(Type.Any()), cli: Type.Optional(Type.Any()) }, { additionalProperties: true })) }, { additionalProperties: true }), scopes: [], providers: ALL_PROVIDERS, mcp: { name: "capabilities" }, http: { method: "GET", path: "/v2/capabilities" }, cli: { command: "capabilities", options: [] } }),
+  operation({ id: "capabilities", summary: "Discover operations available on the current surface.", request: Empty, response: Type.Object({ protocolVersion: Type.String(), currentProtocolVersion: Type.String(), selectedProtocolVersion: Type.String(), supportedProtocolVersions: StringArray, scopeEnforcement: Type.Boolean(), requestAuthority: Type.Boolean(), rowIsolation: Type.Boolean(), authorizationModel: Type.Enum(["scoped-credential", "credential-wide", "process-identity", "legacy-key"]), surface: Type.Enum(["mcp", "http", "cli"]), provider: Type.Enum(["local", "gateway", "legacy-supabase"]), grantedScopes: Type.Optional(StringArray), operations: Type.Array(Type.Object({ id: Type.String(), summary: Type.String(), requiredScopes: StringArray, mcp: Type.Optional(Type.Any()), http: Type.Optional(Type.Any()), cli: Type.Optional(Type.Any()) }, { additionalProperties: true })) }, { additionalProperties: true }), scopes: [], providers: ALL_PROVIDERS, mcp: { name: "capabilities" }, http: { method: "GET", path: "/v2/capabilities" }, cli: { command: "capabilities", options: [] } }),
   operation({ id: "status", summary: "Read gateway delivery diagnostics.", request: Empty, response: DiagnosticsSchema, scopes: ["status:read"], providers: ALL_PROVIDERS, http: { method: "GET", path: "/v2/status" } }),
+  operation({ id: "issue_endpoint_migration_challenge", summary: "Issue a short-lived endpoint migration challenge commitment.", request: Type.Object({ challenge: Type.String({ pattern: "^[0-9a-f]{64}$" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), verifierCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.String() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: "POST", path: "/v2/endpoint-migration-challenges" } }),
+  operation({ id: "consume_endpoint_migration_challenge", summary: "Consume a short-lived endpoint migration challenge commitment.", request: Type.Object({ challenge: Type.String({ pattern: "^[0-9a-f]{64}$" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), issuerCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.Union([Type.String(), Type.Null()]), consumed: Type.Boolean() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: "POST", path: "/v2/endpoint-migration-challenges/consume" } }),
   operation({ id: "client_status", summary: "Read client connectivity and provider diagnostics.", request: Empty, response: ClientStatusSchema, scopes: ["status:read"], providers: ALL_PROVIDERS, cli: { command: "status", aliases: ["doctor"], options: [] } }),
   operation({ id: "gateway_metrics", summary: "Read Prometheus gateway counters.", request: Empty, response: Type.String(), scopes: ["gateway:metrics"], providers: GATEWAY_PROVIDER, http: { method: "GET", path: "/metrics", responseContentType: "text/plain" } }),
   operation({ id: "publish_message", summary: "Create an immutable Agent Bridge v2 message.", request: MessageDraftSchema, response: Type.Object({ created: Type.Boolean(), message: MessageSchema, disposition: Type.Optional(Type.Enum(["committed", "queued"])), authoritative: OptionalBoolean() }, { additionalProperties: true }), scopes: ["messages:write"], providers: ALL_PROVIDERS, mcp: { name: "send" }, http: { method: "POST", path: "/v2/messages", successStatus: 201 }, cli: { command: "send", aliases: ["post"], options: ["source", "project", "type", "kind", "category", "content", "content-type", "data", "payload", "payload-mime", "payload-ref", "payload-ciphertext", "target", "target-agent", "target-agents", "thread-id", "reply-to-id", "correlation-id", "causation-id", "priority", "expires-at", "idempotency-key", "atrib-receipt-id", "informed-by", "metadata", "delivery-mode", "delivery-policy", "delivery-max-attempts", "retry-base-ms", "retry-max-ms", "retry-jitter", "not-before", "message-id"] } }),
@@ -524,4 +532,4 @@ export {
   capabilityDocument,
   negotiateProtocolVersion
 };
-//# sourceMappingURL=chunk-GADH244D.js.map
+//# sourceMappingURL=chunk-IHZFI7TH.js.map