@creatornader/agent-bridge 0.3.1 → 0.5.0

package/dist/{chunk-GADH244D.js → chunk-E4OWHGUE.js}

@@ -17,6 +17,7 @@ var OptionalNumber = (options = {}) => Type.Optional(Type.Number(options));
 var OptionalBoolean = () => Type.Optional(Type.Boolean());
 var NullableString = () => Type.Union([Type.String(), Type.Null()]);
 var NullableNumber = () => Type.Union([Type.Number(), Type.Null()]);
+var UUID_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$";
 var UUID_V7_PATTERN = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$";
 var ErrorIssueSchema = Type.Object({
   path: Type.String(),
@@ -212,6 +213,8 @@ var DeliveryDiagnosticsProperties = {
   expiredLeases: Type.Optional(NullableNumber()),
   oldestDueAt: OptionalString(),
   queueLagMs: Type.Optional(NullableNumber()),
+  gatewayAuthorityId: OptionalString(),
+  credentialId: OptionalString(),
   principal: Type.Optional(Type.Object({ workspace: Type.String(), agent: Type.String() }, { additionalProperties: true }))
 };
 var DiagnosticsSchema = Type.Object(DeliveryDiagnosticsProperties, { additionalProperties: true });
@@ -236,9 +239,12 @@ var ClientDiagnosticsSchema = Type.Object({
   lastOutboundSyncAt: OptionalString(),
   lastInboundSyncAt: OptionalString(),
   lastSyncAttemptAt: OptionalString(),
-  syncLoopState: Type.Optional(Type.Enum(["disabled", "idle", "running", "backoff", "stopped", "failed"])),
+  syncLoopState: Type.Optional(Type.Enum(["disabled", "idle", "running", "backoff", "paused", "stopped", "failed"])),
   syncLoopError: OptionalString(),
-  remoteError: OptionalString()
+  remoteError: OptionalString(),
+  migrationState: Type.Optional(Type.Enum(["active", "draining", "retired"])),
+  migrationOperationId: OptionalString(),
+  migrationLeaseExpiresAt: OptionalString()
 }, { additionalProperties: true });
 var ClientStatusSchema = Type.Object({
   status: Type.Enum(["ok", "unknown", "degraded", "failed"]),
@@ -353,14 +359,16 @@ var ReceiptCliResponseSchema = Type.Object({
   agent: Type.String()
 }, { additionalProperties: true });
 var operations = [
-  operation({ id: "capabilities", summary: "Discover operations available on the current surface.", request: Empty, response: Type.Object({ protocolVersion: Type.String(), currentProtocolVersion: Type.String(), selectedProtocolVersion: Type.String(), supportedProtocolVersions: StringArray, scopeEnforcement: Type.Boolean(), requestAuthority: Type.Boolean(), rowIsolation: Type.Boolean(), authorizationModel: Type.Enum(["scoped-credential", "credential-wide", "process-identity", "legacy-key"]), surface: Type.Enum(["mcp", "http", "cli"]), provider: Type.Enum(["local", "gateway", "legacy-supabase"]), operations: Type.Array(Type.Object({ id: Type.String(), summary: Type.String(), requiredScopes: StringArray, mcp: Type.Optional(Type.Any()), http: Type.Optional(Type.Any()), cli: Type.Optional(Type.Any()) }, { additionalProperties: true })) }, { additionalProperties: true }), scopes: [], providers: ALL_PROVIDERS, mcp: { name: "capabilities" }, http: { method: "GET", path: "/v2/capabilities" }, cli: { command: "capabilities", options: [] } }),
+  operation({ id: "capabilities", summary: "Discover operations available on the current surface.", request: Empty, response: Type.Object({ protocolVersion: Type.String(), currentProtocolVersion: Type.String(), selectedProtocolVersion: Type.String(), supportedProtocolVersions: StringArray, scopeEnforcement: Type.Boolean(), requestAuthority: Type.Boolean(), rowIsolation: Type.Boolean(), authorizationModel: Type.Enum(["scoped-credential", "credential-wide", "process-identity", "legacy-key"]), surface: Type.Enum(["mcp", "http", "cli"]), provider: Type.Enum(["local", "gateway", "legacy-supabase"]), grantedScopes: Type.Optional(StringArray), operations: Type.Array(Type.Object({ id: Type.String(), summary: Type.String(), requiredScopes: StringArray, mcp: Type.Optional(Type.Any()), http: Type.Optional(Type.Any()), cli: Type.Optional(Type.Any()) }, { additionalProperties: true })) }, { additionalProperties: true }), scopes: [], providers: ALL_PROVIDERS, mcp: { name: "capabilities" }, http: { method: "GET", path: "/v2/capabilities" }, cli: { command: "capabilities", options: [] } }),
   operation({ id: "status", summary: "Read gateway delivery diagnostics.", request: Empty, response: DiagnosticsSchema, scopes: ["status:read"], providers: ALL_PROVIDERS, http: { method: "GET", path: "/v2/status" } }),
+  operation({ id: "issue_endpoint_migration_challenge", summary: "Issue a short-lived endpoint migration challenge commitment.", request: Type.Object({ challenge: Type.String({ pattern: "^[0-9a-f]{64}$" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), verifierCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.String() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: "POST", path: "/v2/endpoint-migration-challenges" } }),
+  operation({ id: "consume_endpoint_migration_challenge", summary: "Consume a short-lived endpoint migration challenge commitment.", request: Type.Object({ challenge: Type.String({ pattern: "^[0-9a-f]{64}$" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), issuerCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.Union([Type.String(), Type.Null()]), consumed: Type.Boolean() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: "POST", path: "/v2/endpoint-migration-challenges/consume" } }),
   operation({ id: "client_status", summary: "Read client connectivity and provider diagnostics.", request: Empty, response: ClientStatusSchema, scopes: ["status:read"], providers: ALL_PROVIDERS, cli: { command: "status", aliases: ["doctor"], options: [] } }),
   operation({ id: "gateway_metrics", summary: "Read Prometheus gateway counters.", request: Empty, response: Type.String(), scopes: ["gateway:metrics"], providers: GATEWAY_PROVIDER, http: { method: "GET", path: "/metrics", responseContentType: "text/plain" } }),
   operation({ id: "publish_message", summary: "Create an immutable Agent Bridge v2 message.", request: MessageDraftSchema, response: Type.Object({ created: Type.Boolean(), message: MessageSchema, disposition: Type.Optional(Type.Enum(["committed", "queued"])), authoritative: OptionalBoolean() }, { additionalProperties: true }), scopes: ["messages:write"], providers: ALL_PROVIDERS, mcp: { name: "send" }, http: { method: "POST", path: "/v2/messages", successStatus: 201 }, cli: { command: "send", aliases: ["post"], options: ["source", "project", "type", "kind", "category", "content", "content-type", "data", "payload", "payload-mime", "payload-ref", "payload-ciphertext", "target", "target-agent", "target-agents", "thread-id", "reply-to-id", "correlation-id", "causation-id", "priority", "expires-at", "idempotency-key", "atrib-receipt-id", "informed-by", "metadata", "delivery-mode", "delivery-policy", "delivery-max-attempts", "retry-base-ms", "retry-max-ms", "retry-jitter", "not-before", "message-id"] } }),
   operation({ id: "history", summary: "Read visible messages after an opaque cursor.", request: HistoryRequestSchema, response: MessagePageSchema, scopes: ["messages:read"], providers: ALL_PROVIDERS, mcp: { name: "history" }, http: { method: "GET", path: "/v2/history", queryAliases: { unacknowledgedBy: ["unacked_by"] } }, cli: { command: "history", aliases: ["inbox", "sent"], options: HistoryCliOptions, variants: [{ command: "get", condition: { kind: "always" }, routesTo: "history", options: HistoryCliOptions, response: Type.Array(LegacyGetRowSchema) }] } }),
   operation({ id: "record_receipt", summary: "Record caller-bound inbox read receipts.", request: Type.Object({ messageIds: Type.Array(Type.String(), { minItems: 1, maxItems: 200 }) }, { additionalProperties: false }), response: Type.Object({ recorded: Type.Number() }, { additionalProperties: true }), scopes: ["receipts:write"], providers: ALL_PROVIDERS, http: { method: "POST", path: "/v2/receipts" }, cli: { command: "acknowledge", aliases: ["receipt"], options: ["ids"], response: ReceiptCliResponseSchema, variants: [{ command: "ack", condition: { kind: "option-present", option: "ids" }, routesTo: "record_receipt", options: ["ids"], response: ReceiptCliResponseSchema }] } }),
-  operation({ id: "claim_delivery", summary: "Atomically claim the next targeted delivery.", request: Type.Object({ leaseMs: OptionalNumber(), maxAttempts: OptionalNumber() }, { additionalProperties: false }), response: ClaimResponseSchema, scopes: ["deliveries:claim"], providers: DELIVERY_PROVIDERS, mcp: { name: "claim" }, http: { method: "POST", path: "/v2/deliveries/claim" }, cli: { command: "claim", options: ["lease-ms", "max-attempts"], response: Type.Union([Type.Object({ delivery: DeliverySchema, leaseToken: Type.String() }, { additionalProperties: true }), Type.Null()]) } }),
+  operation({ id: "claim_delivery", summary: "Atomically claim the next targeted delivery, or one eligible message when requested.", request: Type.Object({ leaseMs: OptionalNumber(), messageId: Type.Optional(Type.String({ pattern: UUID_PATTERN })), maxAttempts: OptionalNumber() }, { additionalProperties: false }), response: ClaimResponseSchema, scopes: ["deliveries:claim"], providers: DELIVERY_PROVIDERS, mcp: { name: "claim" }, http: { method: "POST", path: "/v2/deliveries/claim" }, cli: { command: "claim", options: ["lease-ms", "message-id", "max-attempts"], response: Type.Union([Type.Object({ delivery: DeliverySchema, leaseToken: Type.String() }, { additionalProperties: true }), Type.Null()]) } }),
   operation({ id: "list_deliveries", summary: "List caller-visible deliveries.", request: Type.Object({ cursor: OptionalString(), limit: OptionalNumber(), role: Type.Optional(Type.Enum(["recipient", "publisher", "all"])), messageId: OptionalString(), recipient: OptionalString(), states: Type.Optional(Type.Array(DeliveryStateSchema)) }, { additionalProperties: false }), response: DeliveryPageSchema, scopes: ["deliveries:read"], providers: DELIVERY_PROVIDERS, mcp: { name: "list_deliveries" }, http: { method: "GET", path: "/v2/deliveries" }, cli: { command: "deliveries", aliases: ["dead-letters"], options: ["cursor", "limit", "role", "message-id", "recipient", "state"] } }),
   operation({ id: "list_delivery_events", summary: "List the append-only event history for a delivery.", request: Type.Object({ deliveryId: Type.String(), cursor: OptionalString(), limit: OptionalNumber() }, { additionalProperties: false }), response: DeliveryEventPageSchema, scopes: ["deliveries:read"], providers: DELIVERY_PROVIDERS, mcp: { name: "list_delivery_events" }, http: { method: "GET", path: "/v2/deliveries/{deliveryId}/events" }, cli: { command: "delivery-events", options: ["delivery-id", "cursor", "limit"] } }),
   operation({ id: "cancel_delivery", summary: "Cancel a delivery as its publisher.", request: DeliveryIdSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: ["deliveries:manage"], providers: DELIVERY_PROVIDERS, mcp: { name: "cancel_delivery" }, http: { method: "POST", path: "/v2/deliveries/{deliveryId}/cancel" }, cli: { command: "cancel", options: ["delivery-id"], response: Type.Union([DeliverySchema, Type.Null()]) } }),
@@ -417,6 +425,9 @@ function validateRequestForProtocol(operationId, value, protocolVersion) {
       const unsupported = ["mailbox", "receiptState", "project"].find((field) => value[field] !== void 0);
       if (unsupported) throw new ContractValidationError(operationId, [{ path: `/${unsupported}`, message: `Field is not supported by protocol ${LEGACY_PROTOCOL_VERSION}` }]);
     }
+    if (operationId === "claim_delivery" && value && typeof value === "object" && value.messageId !== void 0) {
+      throw new ContractValidationError(operationId, [{ path: "/messageId", message: `Field is not supported by protocol ${LEGACY_PROTOCOL_VERSION}` }]);
+    }
   }
   if (operationId !== "negative_acknowledge_delivery" || protocolVersion !== LEGACY_PROTOCOL_VERSION) {
     return validateRequest(operationId, value);
@@ -524,4 +535,4 @@ export {
   capabilityDocument,
   negotiateProtocolVersion
 };
-//# sourceMappingURL=chunk-GADH244D.js.map
+//# sourceMappingURL=chunk-E4OWHGUE.js.map

package/dist/chunk-E4OWHGUE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/contracts/registry.ts"],"sourcesContent":["import Type, { type TSchema } from \"@sinclair/typebox\";\nimport { Check, Errors } from \"@sinclair/typebox/value\";\n\nexport const PROTOCOL_VERSION = \"2.1\";\nexport const LEGACY_PROTOCOL_VERSION = \"2.0\";\nexport const SUPPORTED_PROTOCOL_VERSIONS = [LEGACY_PROTOCOL_VERSION, PROTOCOL_VERSION] as const;\nexport const SUPPORTED_PROTOCOL_RANGE = SUPPORTED_PROTOCOL_VERSIONS.join(\",\");\nexport const PROTOCOL_HEADER = \"x-agent-bridge-protocol-version\";\nexport const SUPPORTED_PROTOCOL_HEADER = \"x-agent-bridge-supported-protocol-versions\";\nexport const SCOPE_ENFORCEMENT = true;\n\nconst StringArray = Type.Array(Type.String());\nconst Empty = Type.Object({}, { additionalProperties: false });\nconst OptionalString = () => Type.Optional(Type.String());\nconst OptionalNumber = (options: Record<string, unknown> = {}) => Type.Optional(Type.Number(options));\nconst OptionalBoolean = () => Type.Optional(Type.Boolean());\nconst NullableString = () => Type.Union([Type.String(), Type.Null()]);\nconst NullableNumber = () => Type.Union([Type.Number(), Type.Null()]);\nconst UUID_PATTERN = \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$\";\nconst UUID_V7_PATTERN = \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$\";\n\nexport const ErrorIssueSchema = Type.Object({\n  path: Type.String(),\n  message: Type.String(),\n}, { additionalProperties: true });\n\nexport const ErrorEnvelopeSchema = Type.Object({\n  error: Type.Object({\n    code: Type.String(),\n    requestId: Type.String(),\n    message: OptionalString(),\n    operation: OptionalString(),\n    issues: Type.Optional(Type.Array(ErrorIssueSchema)),\n    details: Type.Optional(Type.Any()),\n    supportedProtocolVersions: Type.Optional(StringArray),\n  }, { additionalProperties: true }),\n}, { additionalProperties: true });\n\nconst DeliveryPolicySchema = Type.Union([\n  Type.Object({ mode: Type.Literal(\"mailbox\") }, { additionalProperties: false }),\n  Type.Object({\n    mode: Type.Literal(\"leased\"),\n    maxAttempts: Type.Number(),\n    retryBaseDelayMs: Type.Number(),\n    retryMaxDelayMs: Type.Number(),\n    retryJitterRatio: Type.Number(),\n    notBefore: OptionalString(),\n  }, { additionalProperties: false }),\n]);\n\nconst DeliveryPolicyInputSchema = Type.Object({\n  mode: Type.Optional(Type.Enum([\"mailbox\", \"leased\"])),\n  maxAttempts: OptionalNumber(),\n  retryBaseDelayMs: OptionalNumber(),\n  retryMaxDelayMs: OptionalNumber(),\n  retryJitterRatio: OptionalNumber(),\n  notBefore: OptionalString(),\n}, { additionalProperties: false });\n\nconst MessageDraftSchema = Type.Object({\n  id: Type.Optional(Type.String({ pattern: UUID_V7_PATTERN })),\n  source: OptionalString(),\n  project: OptionalString(),\n  type: Type.String(),\n  content: Type.String(),\n  contentType: OptionalString(),\n  data: Type.Optional(Type.Any()),\n  targets: Type.Optional(StringArray),\n  threadId: OptionalString(),\n  replyToId: OptionalString(),\n  correlationId: OptionalString(),\n  causationId: OptionalString(),\n  priority: Type.Optional(Type.Enum([\"info\", \"high\", \"urgent\"])),\n  expiresAt: OptionalString(),\n  idempotencyKey: OptionalString(),\n  atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray),\n  metadata: Type.Optional(Type.Any()),\n  deliveryPolicy: Type.Optional(DeliveryPolicyInputSchema),\n}, { additionalProperties: false });\n\n// Exact field set released by package 0.2.0 at d8184fe. A headerless\n// gateway response selects this wire contract, not the current one.\nexport const LegacyMessageDraftSchema = Type.Object({\n  id: OptionalString(), source: OptionalString(), type: Type.String(), content: Type.String(),\n  contentType: OptionalString(), data: Type.Optional(Type.Any()), targets: Type.Optional(StringArray),\n  threadId: OptionalString(), replyToId: OptionalString(), correlationId: OptionalString(),\n  causationId: OptionalString(), priority: Type.Optional(Type.Enum([\"info\", \"high\", \"urgent\"])),\n  expiresAt: OptionalString(), idempotencyKey: OptionalString(), atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray), metadata: Type.Optional(Type.Any()),\n}, { additionalProperties: false });\n\nconst MessageSchema = Type.Object({\n  id: Type.String(),\n  workspace: Type.String(),\n  project: OptionalString(),\n  source: Type.String(),\n  type: Type.String(),\n  content: Type.String(),\n  contentType: Type.String(),\n  sequence: Type.String(),\n  createdAt: Type.String(),\n  data: Type.Optional(Type.Any()),\n  targets: StringArray,\n  threadId: OptionalString(),\n  replyToId: OptionalString(),\n  correlationId: OptionalString(),\n  causationId: OptionalString(),\n  priority: Type.Enum([\"info\", \"high\", \"urgent\"]),\n  expiresAt: OptionalString(),\n  idempotencyKey: OptionalString(),\n  atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray),\n  metadata: Type.Optional(Type.Any()),\n  deliveryPolicy: DeliveryPolicySchema,\n}, { additionalProperties: true });\n\nexport const LegacyMessageSchema = Type.Object({\n  id: Type.String(), workspace: Type.String(), source: Type.String(), type: Type.String(),\n  content: Type.String(), contentType: Type.String(), sequence: Type.String(), createdAt: Type.String(),\n  data: Type.Optional(Type.Any()), targets: StringArray, threadId: OptionalString(), replyToId: OptionalString(),\n  correlationId: OptionalString(), causationId: OptionalString(), priority: Type.Enum([\"info\", \"high\", \"urgent\"]),\n  expiresAt: OptionalString(), idempotencyKey: OptionalString(), atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray), metadata: Type.Optional(Type.Any()),\n}, { additionalProperties: true });\n\nconst DeliveryStateSchema = Type.Enum([\"pending\", \"claimed\", \"acked\", \"retrying\", \"dead\", \"cancelled\"]);\nconst DeliveryActionSchema = Type.Enum([\"created\", \"claim\", \"ack\", \"nack_retry\", \"nack_dead\", \"lease_expired\", \"attempts_exhausted\", \"message_expired\", \"cancel\", \"requeue\"]);\nconst DeliverySchema = Type.Object({\n  id: Type.String(),\n  messageId: Type.String(),\n  workspace: Type.String(),\n  recipient: Type.String(),\n  state: DeliveryStateSchema,\n  attempt: Type.Number(),\n  cycleAttempt: Type.Number(),\n  requeueCount: Type.Number(),\n  createdAt: Type.String(),\n  priorityRank: Type.Number(),\n  availableAt: Type.String(),\n  leaseToken: OptionalString(),\n  leaseOwner: OptionalString(),\n  leaseExpiresAt: OptionalString(),\n  lastError: OptionalString(),\n  lastActor: OptionalString(),\n  lastAction: DeliveryActionSchema,\n}, { additionalProperties: true });\n\nexport const LegacyDeliverySchema = Type.Object({\n  id: Type.String(), messageId: Type.String(), workspace: Type.String(), recipient: Type.String(),\n  state: Type.Enum([\"pending\", \"claimed\", \"acked\", \"retrying\", \"dead\"]), attempt: Type.Number(),\n  availableAt: Type.String(), leaseToken: OptionalString(), leaseOwner: OptionalString(),\n  leaseExpiresAt: OptionalString(), lastError: OptionalString(),\n}, { additionalProperties: true });\n\nconst DeliveryEventSchema = Type.Object({\n  sequence: Type.String(),\n  deliveryId: Type.String(),\n  messageId: Type.String(),\n  workspace: Type.String(),\n  recipient: Type.String(),\n  fromState: Type.Optional(DeliveryStateSchema),\n  toState: DeliveryStateSchema,\n  attempt: Type.Number(),\n  cycleAttempt: Type.Number(),\n  requeueCount: Type.Number(),\n  leaseOwner: OptionalString(),\n  error: OptionalString(),\n  actor: Type.String(),\n  action: DeliveryActionSchema,\n  createdAt: Type.String(),\n}, { additionalProperties: true });\n\nconst PresenceSchema = Type.Object({\n  workspace: Type.String(),\n  agent: Type.String(),\n  instance: Type.String(),\n  runtimeType: OptionalString(),\n  capabilities: StringArray,\n  leaseExpiresAt: Type.String(),\n  lastSeenAt: Type.String(),\n}, { additionalProperties: true });\n\nconst DeliveryDiagnosticsProperties = {\n  schemaVersion: Type.Enum([\"local-v2\", \"postgres-v2\", \"legacy-v1\"]),\n  deliverySupported: Type.Boolean(),\n  pending: NullableNumber(),\n  claimed: NullableNumber(),\n  retrying: NullableNumber(),\n  dead: NullableNumber(),\n  cancelled: Type.Optional(NullableNumber()),\n  oldestAvailableAt: OptionalString(),\n  due: Type.Optional(NullableNumber()),\n  scheduled: Type.Optional(NullableNumber()),\n  expiredLeases: Type.Optional(NullableNumber()),\n  oldestDueAt: OptionalString(),\n  queueLagMs: Type.Optional(NullableNumber()),\n  gatewayAuthorityId: OptionalString(),\n  credentialId: OptionalString(),\n  principal: Type.Optional(Type.Object({ workspace: Type.String(), agent: Type.String() }, { additionalProperties: true })),\n} as const;\n\nconst DiagnosticsSchema = Type.Object(DeliveryDiagnosticsProperties, { additionalProperties: true });\n\nconst ClientDiagnosticsSchema = Type.Object({\n  ...DeliveryDiagnosticsProperties,\n  remoteReachable: Type.Optional(Type.Union([Type.Boolean(), Type.Null()])),\n  outboxPending: OptionalNumber(),\n  outboxBlocked: OptionalNumber(),\n  cachedMessages: OptionalNumber(),\n  lastSyncAt: OptionalString(),\n  lastSyncError: OptionalString(),\n  outboxDue: OptionalNumber(),\n  outboxScheduled: OptionalNumber(),\n  outboxLeased: OptionalNumber(),\n  outboxOldestDueAt: OptionalString(),\n  outboxQueueLagMs: OptionalNumber(),\n  outboxOldestBlockedAt: OptionalString(),\n  outboxBlockedAgeMs: Type.Optional(NullableNumber()),\n  outboxBlockedMaxAttempts: OptionalNumber(),\n  outboxBlockedLastError: OptionalString(),\n  outboxNextRetryAt: OptionalString(),\n  lastOutboundSyncAt: OptionalString(),\n  lastInboundSyncAt: OptionalString(),\n  lastSyncAttemptAt: OptionalString(),\n  syncLoopState: Type.Optional(Type.Enum([\"disabled\", \"idle\", \"running\", \"backoff\", \"paused\", \"stopped\", \"failed\"])),\n  syncLoopError: OptionalString(),\n  remoteError: OptionalString(),\n  migrationState: Type.Optional(Type.Enum([\"active\", \"draining\", \"retired\"])),\n  migrationOperationId: OptionalString(),\n  migrationLeaseExpiresAt: OptionalString(),\n}, { additionalProperties: true });\n\nconst ClientStatusSchema = Type.Object({\n  status: Type.Enum([\"ok\", \"unknown\", \"degraded\", \"failed\"]),\n  localHealthy: Type.Boolean(),\n  connected: Type.Boolean(),\n  remoteReachable: Type.Union([Type.Boolean(), Type.Null()]),\n  provider: Type.Enum([\"local\", \"gateway\", \"legacy-supabase\"]),\n  workspace: Type.String(),\n  agent: Type.String(),\n  instance: Type.Union([Type.String(), Type.Null()]),\n  schemaVersion: Type.Enum([\"local-v2\", \"postgres-v2\", \"legacy-v1\"]),\n  endpoint: Type.Union([Type.String(), Type.Null()]),\n  database: Type.Union([Type.String(), Type.Null()]),\n  cursorPath: Type.String(),\n  lastCursor: Type.Union([Type.String(), Type.Null()]),\n  queue: ClientDiagnosticsSchema,\n  checks: Type.Array(Type.Object({\n    name: Type.String(),\n    status: Type.Enum([\"ok\", \"unknown\", \"degraded\", \"failed\"]),\n    message: Type.String(),\n  }, { additionalProperties: false })),\n}, { additionalProperties: true });\n\nconst HistoryRequestSchema = Type.Object({\n  cursor: OptionalString(),\n  limit: OptionalNumber({ minimum: 1, maximum: 200 }),\n  types: Type.Optional(StringArray),\n  mailbox: Type.Optional(Type.Enum([\"inbox\", \"sent\", \"all\"])),\n  receiptState: Type.Optional(Type.Enum([\"any\", \"unread\", \"read\"])),\n  includeExpired: OptionalBoolean(),\n  source: OptionalString(),\n  project: OptionalString(),\n  since: OptionalString(),\n  unacknowledgedBy: OptionalString(),\n  threadId: OptionalString(),\n  latest: OptionalBoolean(),\n}, { additionalProperties: false });\n\nconst MessagePageSchema = Type.Object({\n  messages: Type.Array(MessageSchema),\n  cursor: OptionalString(),\n  source: Type.Optional(Type.Enum([\"remote\", \"cache\"])),\n  stale: OptionalBoolean(),\n  degraded: OptionalBoolean(),\n  acknowledgements: Type.Optional(Type.Enum([\"authoritative\", \"unknown\"])),\n  lastSyncedAt: OptionalString(),\n}, { additionalProperties: true });\n\nconst DeliveryPageSchema = Type.Object({ deliveries: Type.Array(DeliverySchema), cursor: OptionalString() }, { additionalProperties: true });\nconst DeliveryEventPageSchema = Type.Object({ events: Type.Array(DeliveryEventSchema), cursor: OptionalString() }, { additionalProperties: true });\nconst DeliveryIdSchema = Type.Object({ deliveryId: Type.String() }, { additionalProperties: false });\nconst LeaseSchema = Type.Object({ deliveryId: Type.String(), leaseToken: Type.String() }, { additionalProperties: false });\nconst RetryPolicySchema = Type.Object({\n  maxAttempts: OptionalNumber(),\n  baseDelayMs: OptionalNumber(),\n  maxDelayMs: OptionalNumber(),\n  jitterRatio: OptionalNumber(),\n}, { additionalProperties: false });\n\nconst NegativeAcknowledgeRequestSchema = Type.Object({\n  deliveryId: Type.String(),\n  leaseToken: Type.String(),\n  error: Type.String(),\n  disposition: Type.Optional(Type.Enum([\"retry\", \"dead\"])),\n  dead: OptionalBoolean(),\n  retryPolicy: Type.Optional(RetryPolicySchema),\n}, { additionalProperties: false });\n\nconst LegacyNegativeAcknowledgeRequestSchema = Type.Object({\n  deliveryId: Type.String(),\n  leaseToken: Type.String(),\n  error: OptionalString(),\n  disposition: Type.Optional(Type.Enum([\"retry\", \"dead\"])),\n  dead: OptionalBoolean(),\n  retryPolicy: Type.Optional(RetryPolicySchema),\n}, { additionalProperties: false });\n\nconst SyncResponseSchema = Type.Object({\n  online: Type.Boolean(),\n  pushed: Type.Number(),\n  deduplicated: Type.Number(),\n  pulled: Type.Number(),\n  pending: Type.Number(),\n  blocked: Type.Number(),\n  cached: Type.Number(),\n  cursor: Type.Optional(NullableString()),\n  lastSyncedAt: Type.Optional(NullableString()),\n  lastError: Type.Optional(NullableString()),\n  failureRetryable: OptionalBoolean(),\n}, { additionalProperties: true });\n\nconst ClaimResponseSchema = Type.Object({\n  delivery: Type.Union([DeliverySchema, Type.Null()]),\n  leaseToken: OptionalString(),\n}, {\n  additionalProperties: true,\n  oneOf: [\n    { properties: { delivery: { type: \"null\" }, leaseToken: false }, required: [\"delivery\"] },\n    { properties: { delivery: DeliverySchema, leaseToken: { type: \"string\" } }, required: [\"delivery\", \"leaseToken\"] },\n  ],\n});\n\nexport const AUTHORIZATION_SCOPES = [\n  \"deliveries:claim\",\n  \"deliveries:manage\",\n  \"deliveries:read\",\n  \"deliveries:settle\",\n  \"gateway:metrics\",\n  \"messages:read\",\n  \"messages:write\",\n  \"presence:read\",\n  \"presence:write\",\n  \"receipts:write\",\n  \"status:read\",\n] as const;\n\nexport type AuthorizationScope = typeof AUTHORIZATION_SCOPES[number];\n\nexport type ContractProvider = \"local\" | \"gateway\" | \"legacy-supabase\";\nexport type ContractSurface = \"mcp\" | \"http\" | \"cli\";\nexport type OperationId =\n  | \"capabilities\" | \"status\" | \"client_status\" | \"gateway_metrics\" | \"publish_message\" | \"history\"\n  | \"issue_endpoint_migration_challenge\" | \"consume_endpoint_migration_challenge\"\n  | \"record_receipt\" | \"claim_delivery\" | \"list_deliveries\" | \"list_delivery_events\"\n  | \"cancel_delivery\" | \"requeue_delivery\" | \"extend_delivery\" | \"acknowledge_delivery\"\n  | \"negative_acknowledge_delivery\" | \"heartbeat\" | \"presence\" | \"sync\";\n\nexport interface HttpContract {\n  method: \"GET\" | \"POST\";\n  path: string;\n  successStatus?: 200 | 201;\n  responseContentType?: \"application/json\" | \"text/plain\";\n  queryAliases?: Readonly<Record<string, readonly string[]>>;\n}\n\nexport interface CliContract {\n  command: string;\n  aliases?: readonly string[];\n  options: readonly string[];\n  response?: TSchema;\n  variants?: readonly CliCompatibilityVariant[];\n}\n\nexport interface CliCompatibilityVariant {\n  command: string;\n  condition: { kind: \"always\" } | { kind: \"option-present\"; option: string };\n  routesTo: OperationId;\n  options: readonly string[];\n  response: TSchema;\n}\n\nexport interface OperationContract {\n  id: OperationId;\n  summary: string;\n  request: TSchema;\n  response: TSchema;\n  scopes: readonly AuthorizationScope[];\n  providers: readonly ContractProvider[];\n  mcp?: { name: string };\n  http?: HttpContract;\n  cli?: CliContract;\n}\n\nconst ALL_PROVIDERS = [\"local\", \"gateway\", \"legacy-supabase\"] as const;\nconst DELIVERY_PROVIDERS = [\"local\", \"gateway\"] as const;\nconst GATEWAY_PROVIDER = [\"gateway\"] as const;\nconst operation = (entry: OperationContract): OperationContract => entry;\nconst HistoryCliOptions = [\"cursor\", \"limit\", \"type\", \"category\", \"mailbox\", \"receipt-state\", \"source\", \"project\", \"since\", \"unacked-by\", \"thread-id\", \"latest\"] as const;\nconst LegacyGetRowSchema = Type.Object({\n  id: Type.Union([Type.String(), Type.Number()]),\n  source: Type.String(),\n  category: Type.String(),\n  content: Type.String(),\n  priority: Type.Enum([\"info\", \"high\", \"urgent\"]),\n  project: NullableString(),\n  metadata: Type.Any(),\n  created_at: Type.String(),\n}, { additionalProperties: false });\nconst ReceiptCliResponseSchema = Type.Object({\n  acknowledged: Type.Number(),\n  agent: Type.String(),\n}, { additionalProperties: true });\n\nexport const operations: readonly OperationContract[] = [\n  operation({ id: \"capabilities\", summary: \"Discover operations available on the current surface.\", request: Empty, response: Type.Object({ protocolVersion: Type.String(), currentProtocolVersion: Type.String(), selectedProtocolVersion: Type.String(), supportedProtocolVersions: StringArray, scopeEnforcement: Type.Boolean(), requestAuthority: Type.Boolean(), rowIsolation: Type.Boolean(), authorizationModel: Type.Enum([\"scoped-credential\", \"credential-wide\", \"process-identity\", \"legacy-key\"]), surface: Type.Enum([\"mcp\", \"http\", \"cli\"]), provider: Type.Enum([\"local\", \"gateway\", \"legacy-supabase\"]), grantedScopes: Type.Optional(StringArray), operations: Type.Array(Type.Object({ id: Type.String(), summary: Type.String(), requiredScopes: StringArray, mcp: Type.Optional(Type.Any()), http: Type.Optional(Type.Any()), cli: Type.Optional(Type.Any()) }, { additionalProperties: true })) }, { additionalProperties: true }), scopes: [], providers: ALL_PROVIDERS, mcp: { name: \"capabilities\" }, http: { method: \"GET\", path: \"/v2/capabilities\" }, cli: { command: \"capabilities\", options: [] } }),\n  operation({ id: \"status\", summary: \"Read gateway delivery diagnostics.\", request: Empty, response: DiagnosticsSchema, scopes: [\"status:read\"], providers: ALL_PROVIDERS, http: { method: \"GET\", path: \"/v2/status\" } }),\n  operation({ id: \"issue_endpoint_migration_challenge\", summary: \"Issue a short-lived endpoint migration challenge commitment.\", request: Type.Object({ challenge: Type.String({ pattern: \"^[0-9a-f]{64}$\" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), verifierCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.String() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: \"POST\", path: \"/v2/endpoint-migration-challenges\" } }),\n  operation({ id: \"consume_endpoint_migration_challenge\", summary: \"Consume a short-lived endpoint migration challenge commitment.\", request: Type.Object({ challenge: Type.String({ pattern: \"^[0-9a-f]{64}$\" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), issuerCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.Union([Type.String(), Type.Null()]), consumed: Type.Boolean() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: \"POST\", path: \"/v2/endpoint-migration-challenges/consume\" } }),\n  operation({ id: \"client_status\", summary: \"Read client connectivity and provider diagnostics.\", request: Empty, response: ClientStatusSchema, scopes: [\"status:read\"], providers: ALL_PROVIDERS, cli: { command: \"status\", aliases: [\"doctor\"], options: [] } }),\n  operation({ id: \"gateway_metrics\", summary: \"Read Prometheus gateway counters.\", request: Empty, response: Type.String(), scopes: [\"gateway:metrics\"], providers: GATEWAY_PROVIDER, http: { method: \"GET\", path: \"/metrics\", responseContentType: \"text/plain\" } }),\n  operation({ id: \"publish_message\", summary: \"Create an immutable Agent Bridge v2 message.\", request: MessageDraftSchema, response: Type.Object({ created: Type.Boolean(), message: MessageSchema, disposition: Type.Optional(Type.Enum([\"committed\", \"queued\"])), authoritative: OptionalBoolean() }, { additionalProperties: true }), scopes: [\"messages:write\"], providers: ALL_PROVIDERS, mcp: { name: \"send\" }, http: { method: \"POST\", path: \"/v2/messages\", successStatus: 201 }, cli: { command: \"send\", aliases: [\"post\"], options: [\"source\", \"project\", \"type\", \"kind\", \"category\", \"content\", \"content-type\", \"data\", \"payload\", \"payload-mime\", \"payload-ref\", \"payload-ciphertext\", \"target\", \"target-agent\", \"target-agents\", \"thread-id\", \"reply-to-id\", \"correlation-id\", \"causation-id\", \"priority\", \"expires-at\", \"idempotency-key\", \"atrib-receipt-id\", \"informed-by\", \"metadata\", \"delivery-mode\", \"delivery-policy\", \"delivery-max-attempts\", \"retry-base-ms\", \"retry-max-ms\", \"retry-jitter\", \"not-before\", \"message-id\"] } }),\n  operation({ id: \"history\", summary: \"Read visible messages after an opaque cursor.\", request: HistoryRequestSchema, response: MessagePageSchema, scopes: [\"messages:read\"], providers: ALL_PROVIDERS, mcp: { name: \"history\" }, http: { method: \"GET\", path: \"/v2/history\", queryAliases: { unacknowledgedBy: [\"unacked_by\"] } }, cli: { command: \"history\", aliases: [\"inbox\", \"sent\"], options: HistoryCliOptions, variants: [{ command: \"get\", condition: { kind: \"always\" }, routesTo: \"history\", options: HistoryCliOptions, response: Type.Array(LegacyGetRowSchema) }] } }),\n  operation({ id: \"record_receipt\", summary: \"Record caller-bound inbox read receipts.\", request: Type.Object({ messageIds: Type.Array(Type.String(), { minItems: 1, maxItems: 200 }) }, { additionalProperties: false }), response: Type.Object({ recorded: Type.Number() }, { additionalProperties: true }), scopes: [\"receipts:write\"], providers: ALL_PROVIDERS, http: { method: \"POST\", path: \"/v2/receipts\" }, cli: { command: \"acknowledge\", aliases: [\"receipt\"], options: [\"ids\"], response: ReceiptCliResponseSchema, variants: [{ command: \"ack\", condition: { kind: \"option-present\", option: \"ids\" }, routesTo: \"record_receipt\", options: [\"ids\"], response: ReceiptCliResponseSchema }] } }),\n  operation({ id: \"claim_delivery\", summary: \"Atomically claim the next targeted delivery, or one eligible message when requested.\", request: Type.Object({ leaseMs: OptionalNumber(), messageId: Type.Optional(Type.String({ pattern: UUID_PATTERN })), maxAttempts: OptionalNumber() }, { additionalProperties: false }), response: ClaimResponseSchema, scopes: [\"deliveries:claim\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"claim\" }, http: { method: \"POST\", path: \"/v2/deliveries/claim\" }, cli: { command: \"claim\", options: [\"lease-ms\", \"message-id\", \"max-attempts\"], response: Type.Union([Type.Object({ delivery: DeliverySchema, leaseToken: Type.String() }, { additionalProperties: true }), Type.Null()]) } }),\n  operation({ id: \"list_deliveries\", summary: \"List caller-visible deliveries.\", request: Type.Object({ cursor: OptionalString(), limit: OptionalNumber(), role: Type.Optional(Type.Enum([\"recipient\", \"publisher\", \"all\"])), messageId: OptionalString(), recipient: OptionalString(), states: Type.Optional(Type.Array(DeliveryStateSchema)) }, { additionalProperties: false }), response: DeliveryPageSchema, scopes: [\"deliveries:read\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"list_deliveries\" }, http: { method: \"GET\", path: \"/v2/deliveries\" }, cli: { command: \"deliveries\", aliases: [\"dead-letters\"], options: [\"cursor\", \"limit\", \"role\", \"message-id\", \"recipient\", \"state\"] } }),\n  operation({ id: \"list_delivery_events\", summary: \"List the append-only event history for a delivery.\", request: Type.Object({ deliveryId: Type.String(), cursor: OptionalString(), limit: OptionalNumber() }, { additionalProperties: false }), response: DeliveryEventPageSchema, scopes: [\"deliveries:read\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"list_delivery_events\" }, http: { method: \"GET\", path: \"/v2/deliveries/{deliveryId}/events\" }, cli: { command: \"delivery-events\", options: [\"delivery-id\", \"cursor\", \"limit\"] } }),\n  operation({ id: \"cancel_delivery\", summary: \"Cancel a delivery as its publisher.\", request: DeliveryIdSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:manage\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"cancel_delivery\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/cancel\" }, cli: { command: \"cancel\", options: [\"delivery-id\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"requeue_delivery\", summary: \"Requeue a delivery as its publisher.\", request: DeliveryIdSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:manage\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"requeue_delivery\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/requeue\" }, cli: { command: \"requeue\", options: [\"delivery-id\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"extend_delivery\", summary: \"Extend a claimed delivery lease.\", request: Type.Object({ deliveryId: Type.String(), leaseToken: Type.String(), leaseMs: Type.Number() }, { additionalProperties: false }), response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:settle\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"extend\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/extend\" }, cli: { command: \"extend\", options: [\"delivery-id\", \"lease-token\", \"lease-ms\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"acknowledge_delivery\", summary: \"Settle a claimed delivery successfully.\", request: LeaseSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:settle\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"acknowledge\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/ack\" }, cli: { command: \"ack\", options: [\"delivery-id\", \"lease-token\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"negative_acknowledge_delivery\", summary: \"Settle a claimed delivery for retry or dead letter.\", request: NegativeAcknowledgeRequestSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:settle\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"negative_acknowledge\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/nack\" }, cli: { command: \"nack\", options: [\"delivery-id\", \"lease-token\", \"error\", \"disposition\", \"dead\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"heartbeat\", summary: \"Publish a leased runtime presence record.\", request: Type.Object({ leaseMs: OptionalNumber({ minimum: 1000, maximum: 900000 }), runtimeType: OptionalString(), capabilities: Type.Optional(StringArray) }, { additionalProperties: false }), response: PresenceSchema, scopes: [\"presence:write\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"heartbeat\" }, http: { method: \"POST\", path: \"/v2/presence/heartbeat\" }, cli: { command: \"join\", options: [\"lease-ms\", \"runtime\", \"capability\"] } }),\n  operation({ id: \"presence\", summary: \"List active agent runtime instances.\", request: Empty, response: Type.Object({ agents: Type.Array(PresenceSchema) }, { additionalProperties: true }), scopes: [\"presence:read\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"presence\" }, http: { method: \"GET\", path: \"/v2/presence\" }, cli: { command: \"presence\", options: [] } }),\n  operation({ id: \"sync\", summary: \"Replay a gateway outbox and refresh its inbox cache.\", request: Type.Object({ maxPush: OptionalNumber(), maxPages: OptionalNumber() }, { additionalProperties: false }), response: SyncResponseSchema, scopes: [\"messages:write\", \"messages:read\"], providers: GATEWAY_PROVIDER, mcp: { name: \"sync\" }, cli: { command: \"sync\", options: [\"max-push\", \"max-pages\", \"limit\"] } }),\n];\n\nconst byId = new Map(operations.map((entry) => [entry.id, entry]));\n\nexport class ContractValidationError extends Error {\n  readonly code = \"invalid_input\";\n  readonly status = 400;\n  constructor(readonly operation: string, readonly issues: readonly { path: string; message: string }[]) {\n    super(`Request does not match the ${operation} schema`);\n  }\n}\n\nexport class ContractResponseError extends Error {\n  readonly code = \"protocol_mismatch\";\n  readonly status = 502;\n  constructor(readonly operation: string, readonly issues: readonly { path: string; message: string }[]) {\n    super(`Response does not match the ${operation} schema`);\n  }\n}\n\nfunction issues(schema: TSchema, value: unknown): readonly { path: string; message: string }[] {\n  return [...Errors(schema, value)].map((entry) => ({ path: entry.instancePath || \"/\", message: entry.message }));\n}\n\nexport function operationContract(operationId: string): OperationContract {\n  const contract = byId.get(operationId as OperationId);\n  if (!contract) throw new Error(`Unknown operation contract: ${operationId}`);\n  return contract;\n}\n\nexport function validateRequest(operationId: string, value: unknown): Record<string, unknown> {\n  const contract = operationContract(operationId);\n  if (!Check(contract.request, value)) throw new ContractValidationError(operationId, issues(contract.request, value));\n  return value as Record<string, unknown>;\n}\n\nexport function validateRequestForProtocol(operationId: string, value: unknown, protocolVersion: string): Record<string, unknown> {\n  if (protocolVersion === LEGACY_PROTOCOL_VERSION) {\n    if (operationId === \"publish_message\") {\n      if (!Check(LegacyMessageDraftSchema, value)) throw new ContractValidationError(operationId, issues(LegacyMessageDraftSchema, value));\n      return value as Record<string, unknown>;\n    }\n    if ([\"list_deliveries\", \"list_delivery_events\", \"cancel_delivery\", \"requeue_delivery\", \"capabilities\"].includes(operationId)) {\n      throw new ContractValidationError(operationId, [{ path: \"/\", message: `Operation is not supported by protocol ${LEGACY_PROTOCOL_VERSION}` }]);\n    }\n    if (operationId === \"history\" && value && typeof value === \"object\") {\n      const unsupported = [\"mailbox\", \"receiptState\", \"project\"].find((field) => (value as Record<string, unknown>)[field] !== undefined);\n      if (unsupported) throw new ContractValidationError(operationId, [{ path: `/${unsupported}`, message: `Field is not supported by protocol ${LEGACY_PROTOCOL_VERSION}` }]);\n    }\n    if (operationId === \"claim_delivery\" && value && typeof value === \"object\"\n      && (value as Record<string, unknown>).messageId !== undefined) {\n      throw new ContractValidationError(operationId, [{ path: \"/messageId\", message: `Field is not supported by protocol ${LEGACY_PROTOCOL_VERSION}` }]);\n    }\n  }\n  if (operationId !== \"negative_acknowledge_delivery\" || protocolVersion !== LEGACY_PROTOCOL_VERSION) {\n    return validateRequest(operationId, value);\n  }\n  if (!Check(LegacyNegativeAcknowledgeRequestSchema, value)) {\n    throw new ContractValidationError(operationId, issues(LegacyNegativeAcknowledgeRequestSchema, value));\n  }\n  return value as Record<string, unknown>;\n}\n\nexport function parseResponse(operationId: string, value: unknown): unknown {\n  const contract = operationContract(operationId);\n  const serialized = JSON.stringify(value);\n  const wireValue = serialized === undefined ? value : JSON.parse(serialized);\n  if (!Check(contract.response, wireValue)) throw new ContractResponseError(operationId, issues(contract.response, wireValue));\n  return wireValue;\n}\n\nexport function parseResponseForProtocol(operationId: string, value: unknown, protocolVersion: string): unknown {\n  if (protocolVersion !== LEGACY_PROTOCOL_VERSION) return parseResponse(operationId, value);\n  let schema: TSchema | undefined;\n  let normalized = value;\n  if (operationId === \"publish_message\") schema = Type.Object({ created: Type.Boolean(), message: LegacyMessageSchema }, { additionalProperties: true });\n  else if (operationId === \"history\") schema = Type.Object({ messages: Type.Array(LegacyMessageSchema), cursor: OptionalString() }, { additionalProperties: true });\n  else if (operationId === \"claim_delivery\") {\n    schema = Type.Union([Type.Object({ delivery: LegacyDeliverySchema, leaseToken: Type.String() }, { additionalProperties: true }), Type.Null()]);\n    normalized = value === null ? { delivery: null } : value;\n  } else if ([\"extend_delivery\", \"acknowledge_delivery\", \"negative_acknowledge_delivery\"].includes(operationId)) {\n    schema = LegacyDeliverySchema;\n    normalized = { delivery: value };\n  }\n  if (!schema) return parseResponse(operationId, value);\n  if (!Check(schema, value)) throw new ContractResponseError(operationId, issues(schema, value));\n  return normalized;\n}\n\nexport function parseCliResponse(\n  operationId: string,\n  value: unknown,\n  invocation?: { command: string; optionNames?: readonly string[] },\n): unknown {\n  const contract = operationContract(operationId);\n  const optionNames = new Set(invocation?.optionNames ?? []);\n  const variant = contract.cli?.variants?.find((entry) =>\n    entry.command === invocation?.command && cliVariantMatches(entry, optionNames));\n  const schema = variant?.response ?? contract.cli?.response ?? contract.response;\n  const serialized = JSON.stringify(value);\n  const wireValue = serialized === undefined ? value : JSON.parse(serialized);\n  if (!Check(schema, wireValue)) throw new ContractResponseError(operationId, issues(schema, wireValue));\n  return wireValue;\n}\n\nexport function availableOperations(context: { surface: ContractSurface; provider: ContractProvider }): readonly OperationContract[] {\n  return operations.filter((entry) => entry.providers.includes(context.provider) && Boolean(entry[context.surface]));\n}\n\nexport function operationForMcp(name: string, provider: ContractProvider): OperationContract | undefined {\n  return availableOperations({ surface: \"mcp\", provider }).find((entry) => entry.mcp?.name === name);\n}\n\nexport function operationForHttp(method: string, path: string): OperationContract | undefined {\n  return availableOperations({ surface: \"http\", provider: \"gateway\" }).find((entry) => entry.http?.method === method && entry.http.path === path);\n}\n\nfunction cliVariantMatches(\n  variant: CliCompatibilityVariant,\n  optionNames: ReadonlySet<string>,\n): boolean {\n  return variant.condition.kind === \"always\" || optionNames.has(variant.condition.option);\n}\n\nexport function operationForCli(\n  command: string,\n  provider: ContractProvider,\n  optionNames: readonly string[] = [],\n): OperationContract | undefined {\n  const selectedOptions = new Set(optionNames);\n  return availableOperations({ surface: \"cli\", provider }).find((entry) =>\n    entry.cli?.command === command ||\n    entry.cli?.aliases?.includes(command) ||\n    entry.cli?.variants?.some((variant) =>\n      variant.command === command && cliVariantMatches(variant, selectedOptions)));\n}\n\nexport function capabilityDocument(context: { surface: ContractSurface; provider: ContractProvider; selectedProtocolVersion?: string; requestAuthority?: boolean; rowIsolation?: boolean } = { surface: \"http\", provider: \"gateway\" }) {\n  const selectedProtocolVersion = context.selectedProtocolVersion ?? PROTOCOL_VERSION;\n  return {\n    protocolVersion: selectedProtocolVersion,\n    currentProtocolVersion: PROTOCOL_VERSION,\n    selectedProtocolVersion,\n    supportedProtocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS],\n    scopeEnforcement: context.provider === \"gateway\" ? SCOPE_ENFORCEMENT : false,\n    requestAuthority: context.provider === \"gateway\" && context.requestAuthority === true,\n    rowIsolation: context.provider === \"gateway\" && context.requestAuthority === true && context.rowIsolation === true,\n    authorizationModel: context.provider === \"gateway\"\n      ? \"scoped-credential\"\n      : context.provider === \"local\"\n        ? \"process-identity\"\n        : \"legacy-key\",\n    surface: context.surface,\n    provider: context.provider,\n    operations: availableOperations(context).map(({ request: _request, response, providers: _providers, scopes, cli, ...entry }) => ({\n      ...entry,\n      ...(cli ? {\n        cli: {\n          command: cli.command,\n          ...(cli.aliases ? { aliases: cli.aliases } : {}),\n          options: cli.options,\n          outputSchema: cli.response ?? response,\n          ...(cli.variants ? {\n            variants: cli.variants.map((variant) => ({\n              command: variant.command,\n              condition: variant.condition,\n              routesTo: variant.routesTo,\n              options: variant.options,\n              outputSchema: variant.response,\n            })),\n          } : {}),\n        },\n      } : {}),\n      requiredScopes: [...scopes],\n    })),\n  };\n}\n\nexport function negotiateProtocolVersion(value: string | string[] | undefined): string {\n  const requested = Array.isArray(value) ? value[0] : value;\n  if (requested === undefined || requested.trim() === \"\") return LEGACY_PROTOCOL_VERSION;\n  if ((SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(requested.trim())) return requested.trim();\n  const error = new Error(\"Unsupported Agent Bridge protocol version\") as Error & { status: number; code: string; supported: string };\n  error.status = 426;\n  error.code = \"unsupported_protocol_version\";\n  error.supported = SUPPORTED_PROTOCOL_RANGE;\n  throw error;\n}\n"],"mappings":";;;AAAA,OAAO,UAA4B;AACnC,SAAS,OAAO,cAAc;AAEvB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,8BAA8B,CAAC,yBAAyB,gBAAgB;AAC9E,IAAM,2BAA2B,4BAA4B,KAAK,GAAG;AACrE,IAAM,kBAAkB;AACxB,IAAM,4BAA4B;AAClC,IAAM,oBAAoB;AAEjC,IAAM,cAAc,KAAK,MAAM,KAAK,OAAO,CAAC;AAC5C,IAAM,QAAQ,KAAK,OAAO,CAAC,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAC7D,IAAM,iBAAiB,MAAM,KAAK,SAAS,KAAK,OAAO,CAAC;AACxD,IAAM,iBAAiB,CAAC,UAAmC,CAAC,MAAM,KAAK,SAAS,KAAK,OAAO,OAAO,CAAC;AACpG,IAAM,kBAAkB,MAAM,KAAK,SAAS,KAAK,QAAQ,CAAC;AAC1D,IAAM,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AACpE,IAAM,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AACpE,IAAM,eAAe;AACrB,IAAM,kBAAkB;AAEjB,IAAM,mBAAmB,KAAK,OAAO;AAAA,EAC1C,MAAM,KAAK,OAAO;AAAA,EAClB,SAAS,KAAK,OAAO;AACvB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,sBAAsB,KAAK,OAAO;AAAA,EAC7C,OAAO,KAAK,OAAO;AAAA,IACjB,MAAM,KAAK,OAAO;AAAA,IAClB,WAAW,KAAK,OAAO;AAAA,IACvB,SAAS,eAAe;AAAA,IACxB,WAAW,eAAe;AAAA,IAC1B,QAAQ,KAAK,SAAS,KAAK,MAAM,gBAAgB,CAAC;AAAA,IAClD,SAAS,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,IACjC,2BAA2B,KAAK,SAAS,WAAW;AAAA,EACtD,GAAG,EAAE,sBAAsB,KAAK,CAAC;AACnC,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,uBAAuB,KAAK,MAAM;AAAA,EACtC,KAAK,OAAO,EAAE,MAAM,KAAK,QAAQ,SAAS,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAAA,EAC9E,KAAK,OAAO;AAAA,IACV,MAAM,KAAK,QAAQ,QAAQ;AAAA,IAC3B,aAAa,KAAK,OAAO;AAAA,IACzB,kBAAkB,KAAK,OAAO;AAAA,IAC9B,iBAAiB,KAAK,OAAO;AAAA,IAC7B,kBAAkB,KAAK,OAAO;AAAA,IAC9B,WAAW,eAAe;AAAA,EAC5B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AACpC,CAAC;AAED,IAAM,4BAA4B,KAAK,OAAO;AAAA,EAC5C,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC;AAAA,EACpD,aAAa,eAAe;AAAA,EAC5B,kBAAkB,eAAe;AAAA,EACjC,iBAAiB,eAAe;AAAA,EAChC,kBAAkB,eAAe;AAAA,EACjC,WAAW,eAAe;AAC5B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,IAAI,KAAK,SAAS,KAAK,OAAO,EAAE,SAAS,gBAAgB,CAAC,CAAC;AAAA,EAC3D,QAAQ,eAAe;AAAA,EACvB,SAAS,eAAe;AAAA,EACxB,MAAM,KAAK,OAAO;AAAA,EAClB,SAAS,KAAK,OAAO;AAAA,EACrB,aAAa,eAAe;AAAA,EAC5B,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAC9B,SAAS,KAAK,SAAS,WAAW;AAAA,EAClC,UAAU,eAAe;AAAA,EACzB,WAAW,eAAe;AAAA,EAC1B,eAAe,eAAe;AAAA,EAC9B,aAAa,eAAe;AAAA,EAC5B,UAAU,KAAK,SAAS,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC7D,WAAW,eAAe;AAAA,EAC1B,gBAAgB,eAAe;AAAA,EAC/B,gBAAgB,eAAe;AAAA,EAC/B,YAAY,KAAK,SAAS,WAAW;AAAA,EACrC,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAClC,gBAAgB,KAAK,SAAS,yBAAyB;AACzD,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAI3B,IAAM,2BAA2B,KAAK,OAAO;AAAA,EAClD,IAAI,eAAe;AAAA,EAAG,QAAQ,eAAe;AAAA,EAAG,MAAM,KAAK,OAAO;AAAA,EAAG,SAAS,KAAK,OAAO;AAAA,EAC1F,aAAa,eAAe;AAAA,EAAG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAAG,SAAS,KAAK,SAAS,WAAW;AAAA,EAClG,UAAU,eAAe;AAAA,EAAG,WAAW,eAAe;AAAA,EAAG,eAAe,eAAe;AAAA,EACvF,aAAa,eAAe;AAAA,EAAG,UAAU,KAAK,SAAS,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC5F,WAAW,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAC9F,YAAY,KAAK,SAAS,WAAW;AAAA,EAAG,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAC5E,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,gBAAgB,KAAK,OAAO;AAAA,EAChC,IAAI,KAAK,OAAO;AAAA,EAChB,WAAW,KAAK,OAAO;AAAA,EACvB,SAAS,eAAe;AAAA,EACxB,QAAQ,KAAK,OAAO;AAAA,EACpB,MAAM,KAAK,OAAO;AAAA,EAClB,SAAS,KAAK,OAAO;AAAA,EACrB,aAAa,KAAK,OAAO;AAAA,EACzB,UAAU,KAAK,OAAO;AAAA,EACtB,WAAW,KAAK,OAAO;AAAA,EACvB,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAC9B,SAAS;AAAA,EACT,UAAU,eAAe;AAAA,EACzB,WAAW,eAAe;AAAA,EAC1B,eAAe,eAAe;AAAA,EAC9B,aAAa,eAAe;AAAA,EAC5B,UAAU,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,EAC9C,WAAW,eAAe;AAAA,EAC1B,gBAAgB,eAAe;AAAA,EAC/B,gBAAgB,eAAe;AAAA,EAC/B,YAAY,KAAK,SAAS,WAAW;AAAA,EACrC,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAClC,gBAAgB;AAClB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,sBAAsB,KAAK,OAAO;AAAA,EAC7C,IAAI,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAAG,QAAQ,KAAK,OAAO;AAAA,EAAG,MAAM,KAAK,OAAO;AAAA,EACtF,SAAS,KAAK,OAAO;AAAA,EAAG,aAAa,KAAK,OAAO;AAAA,EAAG,UAAU,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EACpG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAAG,SAAS;AAAA,EAAa,UAAU,eAAe;AAAA,EAAG,WAAW,eAAe;AAAA,EAC7G,eAAe,eAAe;AAAA,EAAG,aAAa,eAAe;AAAA,EAAG,UAAU,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,EAC9G,WAAW,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAC9F,YAAY,KAAK,SAAS,WAAW;AAAA,EAAG,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAC5E,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,sBAAsB,KAAK,KAAK,CAAC,WAAW,WAAW,SAAS,YAAY,QAAQ,WAAW,CAAC;AACtG,IAAM,uBAAuB,KAAK,KAAK,CAAC,WAAW,SAAS,OAAO,cAAc,aAAa,iBAAiB,sBAAsB,mBAAmB,UAAU,SAAS,CAAC;AAC5K,IAAM,iBAAiB,KAAK,OAAO;AAAA,EACjC,IAAI,KAAK,OAAO;AAAA,EAChB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,OAAO;AAAA,EACP,SAAS,KAAK,OAAO;AAAA,EACrB,cAAc,KAAK,OAAO;AAAA,EAC1B,cAAc,KAAK,OAAO;AAAA,EAC1B,WAAW,KAAK,OAAO;AAAA,EACvB,cAAc,KAAK,OAAO;AAAA,EAC1B,aAAa,KAAK,OAAO;AAAA,EACzB,YAAY,eAAe;AAAA,EAC3B,YAAY,eAAe;AAAA,EAC3B,gBAAgB,eAAe;AAAA,EAC/B,WAAW,eAAe;AAAA,EAC1B,WAAW,eAAe;AAAA,EAC1B,YAAY;AACd,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,uBAAuB,KAAK,OAAO;AAAA,EAC9C,IAAI,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAC9F,OAAO,KAAK,KAAK,CAAC,WAAW,WAAW,SAAS,YAAY,MAAM,CAAC;AAAA,EAAG,SAAS,KAAK,OAAO;AAAA,EAC5F,aAAa,KAAK,OAAO;AAAA,EAAG,YAAY,eAAe;AAAA,EAAG,YAAY,eAAe;AAAA,EACrF,gBAAgB,eAAe;AAAA,EAAG,WAAW,eAAe;AAC9D,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,sBAAsB,KAAK,OAAO;AAAA,EACtC,UAAU,KAAK,OAAO;AAAA,EACtB,YAAY,KAAK,OAAO;AAAA,EACxB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,SAAS,mBAAmB;AAAA,EAC5C,SAAS;AAAA,EACT,SAAS,KAAK,OAAO;AAAA,EACrB,cAAc,KAAK,OAAO;AAAA,EAC1B,cAAc,KAAK,OAAO;AAAA,EAC1B,YAAY,eAAe;AAAA,EAC3B,OAAO,eAAe;AAAA,EACtB,OAAO,KAAK,OAAO;AAAA,EACnB,QAAQ;AAAA,EACR,WAAW,KAAK,OAAO;AACzB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,iBAAiB,KAAK,OAAO;AAAA,EACjC,WAAW,KAAK,OAAO;AAAA,EACvB,OAAO,KAAK,OAAO;AAAA,EACnB,UAAU,KAAK,OAAO;AAAA,EACtB,aAAa,eAAe;AAAA,EAC5B,cAAc;AAAA,EACd,gBAAgB,KAAK,OAAO;AAAA,EAC5B,YAAY,KAAK,OAAO;AAC1B,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,gCAAgC;AAAA,EACpC,eAAe,KAAK,KAAK,CAAC,YAAY,eAAe,WAAW,CAAC;AAAA,EACjE,mBAAmB,KAAK,QAAQ;AAAA,EAChC,SAAS,eAAe;AAAA,EACxB,SAAS,eAAe;AAAA,EACxB,UAAU,eAAe;AAAA,EACzB,MAAM,eAAe;AAAA,EACrB,WAAW,KAAK,SAAS,eAAe,CAAC;AAAA,EACzC,mBAAmB,eAAe;AAAA,EAClC,KAAK,KAAK,SAAS,eAAe,CAAC;AAAA,EACnC,WAAW,KAAK,SAAS,eAAe,CAAC;AAAA,EACzC,eAAe,KAAK,SAAS,eAAe,CAAC;AAAA,EAC7C,aAAa,eAAe;AAAA,EAC5B,YAAY,KAAK,SAAS,eAAe,CAAC;AAAA,EAC1C,oBAAoB,eAAe;AAAA,EACnC,cAAc,eAAe;AAAA,EAC7B,WAAW,KAAK,SAAS,KAAK,OAAO,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,CAAC;AAC1H;AAEA,IAAM,oBAAoB,KAAK,OAAO,+BAA+B,EAAE,sBAAsB,KAAK,CAAC;AAEnG,IAAM,0BAA0B,KAAK,OAAO;AAAA,EAC1C,GAAG;AAAA,EACH,iBAAiB,KAAK,SAAS,KAAK,MAAM,CAAC,KAAK,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,eAAe,eAAe;AAAA,EAC9B,eAAe,eAAe;AAAA,EAC9B,gBAAgB,eAAe;AAAA,EAC/B,YAAY,eAAe;AAAA,EAC3B,eAAe,eAAe;AAAA,EAC9B,WAAW,eAAe;AAAA,EAC1B,iBAAiB,eAAe;AAAA,EAChC,cAAc,eAAe;AAAA,EAC7B,mBAAmB,eAAe;AAAA,EAClC,kBAAkB,eAAe;AAAA,EACjC,uBAAuB,eAAe;AAAA,EACtC,oBAAoB,KAAK,SAAS,eAAe,CAAC;AAAA,EAClD,0BAA0B,eAAe;AAAA,EACzC,wBAAwB,eAAe;AAAA,EACvC,mBAAmB,eAAe;AAAA,EAClC,oBAAoB,eAAe;AAAA,EACnC,mBAAmB,eAAe;AAAA,EAClC,mBAAmB,eAAe;AAAA,EAClC,eAAe,KAAK,SAAS,KAAK,KAAK,CAAC,YAAY,QAAQ,WAAW,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC;AAAA,EACjH,eAAe,eAAe;AAAA,EAC9B,aAAa,eAAe;AAAA,EAC5B,gBAAgB,KAAK,SAAS,KAAK,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC,CAAC;AAAA,EAC1E,sBAAsB,eAAe;AAAA,EACrC,yBAAyB,eAAe;AAC1C,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,QAAQ,KAAK,KAAK,CAAC,MAAM,WAAW,YAAY,QAAQ,CAAC;AAAA,EACzD,cAAc,KAAK,QAAQ;AAAA,EAC3B,WAAW,KAAK,QAAQ;AAAA,EACxB,iBAAiB,KAAK,MAAM,CAAC,KAAK,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACzD,UAAU,KAAK,KAAK,CAAC,SAAS,WAAW,iBAAiB,CAAC;AAAA,EAC3D,WAAW,KAAK,OAAO;AAAA,EACvB,OAAO,KAAK,OAAO;AAAA,EACnB,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACjD,eAAe,KAAK,KAAK,CAAC,YAAY,eAAe,WAAW,CAAC;AAAA,EACjE,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACjD,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACjD,YAAY,KAAK,OAAO;AAAA,EACxB,YAAY,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACnD,OAAO;AAAA,EACP,QAAQ,KAAK,MAAM,KAAK,OAAO;AAAA,IAC7B,MAAM,KAAK,OAAO;AAAA,IAClB,QAAQ,KAAK,KAAK,CAAC,MAAM,WAAW,YAAY,QAAQ,CAAC;AAAA,IACzD,SAAS,KAAK,OAAO;AAAA,EACvB,GAAG,EAAE,sBAAsB,MAAM,CAAC,CAAC;AACrC,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,uBAAuB,KAAK,OAAO;AAAA,EACvC,QAAQ,eAAe;AAAA,EACvB,OAAO,eAAe,EAAE,SAAS,GAAG,SAAS,IAAI,CAAC;AAAA,EAClD,OAAO,KAAK,SAAS,WAAW;AAAA,EAChC,SAAS,KAAK,SAAS,KAAK,KAAK,CAAC,SAAS,QAAQ,KAAK,CAAC,CAAC;AAAA,EAC1D,cAAc,KAAK,SAAS,KAAK,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC,CAAC;AAAA,EAChE,gBAAgB,gBAAgB;AAAA,EAChC,QAAQ,eAAe;AAAA,EACvB,SAAS,eAAe;AAAA,EACxB,OAAO,eAAe;AAAA,EACtB,kBAAkB,eAAe;AAAA,EACjC,UAAU,eAAe;AAAA,EACzB,QAAQ,gBAAgB;AAC1B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,oBAAoB,KAAK,OAAO;AAAA,EACpC,UAAU,KAAK,MAAM,aAAa;AAAA,EAClC,QAAQ,eAAe;AAAA,EACvB,QAAQ,KAAK,SAAS,KAAK,KAAK,CAAC,UAAU,OAAO,CAAC,CAAC;AAAA,EACpD,OAAO,gBAAgB;AAAA,EACvB,UAAU,gBAAgB;AAAA,EAC1B,kBAAkB,KAAK,SAAS,KAAK,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC;AAAA,EACvE,cAAc,eAAe;AAC/B,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,qBAAqB,KAAK,OAAO,EAAE,YAAY,KAAK,MAAM,cAAc,GAAG,QAAQ,eAAe,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAC3I,IAAM,0BAA0B,KAAK,OAAO,EAAE,QAAQ,KAAK,MAAM,mBAAmB,GAAG,QAAQ,eAAe,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC;AACjJ,IAAM,mBAAmB,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;AACnG,IAAM,cAAc,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,GAAG,YAAY,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;AACzH,IAAM,oBAAoB,KAAK,OAAO;AAAA,EACpC,aAAa,eAAe;AAAA,EAC5B,aAAa,eAAe;AAAA,EAC5B,YAAY,eAAe;AAAA,EAC3B,aAAa,eAAe;AAC9B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,mCAAmC,KAAK,OAAO;AAAA,EACnD,YAAY,KAAK,OAAO;AAAA,EACxB,YAAY,KAAK,OAAO;AAAA,EACxB,OAAO,KAAK,OAAO;AAAA,EACnB,aAAa,KAAK,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,CAAC,CAAC;AAAA,EACvD,MAAM,gBAAgB;AAAA,EACtB,aAAa,KAAK,SAAS,iBAAiB;AAC9C,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,yCAAyC,KAAK,OAAO;AAAA,EACzD,YAAY,KAAK,OAAO;AAAA,EACxB,YAAY,KAAK,OAAO;AAAA,EACxB,OAAO,eAAe;AAAA,EACtB,aAAa,KAAK,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,CAAC,CAAC;AAAA,EACvD,MAAM,gBAAgB;AAAA,EACtB,aAAa,KAAK,SAAS,iBAAiB;AAC9C,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,QAAQ,KAAK,QAAQ;AAAA,EACrB,QAAQ,KAAK,OAAO;AAAA,EACpB,cAAc,KAAK,OAAO;AAAA,EAC1B,QAAQ,KAAK,OAAO;AAAA,EACpB,SAAS,KAAK,OAAO;AAAA,EACrB,SAAS,KAAK,OAAO;AAAA,EACrB,QAAQ,KAAK,OAAO;AAAA,EACpB,QAAQ,KAAK,SAAS,eAAe,CAAC;AAAA,EACtC,cAAc,KAAK,SAAS,eAAe,CAAC;AAAA,EAC5C,WAAW,KAAK,SAAS,eAAe,CAAC;AAAA,EACzC,kBAAkB,gBAAgB;AACpC,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,sBAAsB,KAAK,OAAO;AAAA,EACtC,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;AAAA,EAClD,YAAY,eAAe;AAC7B,GAAG;AAAA,EACD,sBAAsB;AAAA,EACtB,OAAO;AAAA,IACL,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,OAAO,GAAG,YAAY,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE;AAAA,IACxF,EAAE,YAAY,EAAE,UAAU,gBAAgB,YAAY,EAAE,MAAM,SAAS,EAAE,GAAG,UAAU,CAAC,YAAY,YAAY,EAAE;AAAA,EACnH;AACF,CAAC;AA+DD,IAAM,gBAAgB,CAAC,SAAS,WAAW,iBAAiB;AAC5D,IAAM,qBAAqB,CAAC,SAAS,SAAS;AAC9C,IAAM,mBAAmB,CAAC,SAAS;AACnC,IAAM,YAAY,CAAC,UAAgD;AACnE,IAAM,oBAAoB,CAAC,UAAU,SAAS,QAAQ,YAAY,WAAW,iBAAiB,UAAU,WAAW,SAAS,cAAc,aAAa,QAAQ;AAC/J,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,IAAI,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC;AAAA,EAC7C,QAAQ,KAAK,OAAO;AAAA,EACpB,UAAU,KAAK,OAAO;AAAA,EACtB,SAAS,KAAK,OAAO;AAAA,EACrB,UAAU,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,EAC9C,SAAS,eAAe;AAAA,EACxB,UAAU,KAAK,IAAI;AAAA,EACnB,YAAY,KAAK,OAAO;AAC1B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAClC,IAAM,2BAA2B,KAAK,OAAO;AAAA,EAC3C,cAAc,KAAK,OAAO;AAAA,EAC1B,OAAO,KAAK,OAAO;AACrB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,aAA2C;AAAA,EACtD,UAAU,EAAE,IAAI,gBAAgB,SAAS,yDAAyD,SAAS,OAAO,UAAU,KAAK,OAAO,EAAE,iBAAiB,KAAK,OAAO,GAAG,wBAAwB,KAAK,OAAO,GAAG,yBAAyB,KAAK,OAAO,GAAG,2BAA2B,aAAa,kBAAkB,KAAK,QAAQ,GAAG,kBAAkB,KAAK,QAAQ,GAAG,cAAc,KAAK,QAAQ,GAAG,oBAAoB,KAAK,KAAK,CAAC,qBAAqB,mBAAmB,oBAAoB,YAAY,CAAC,GAAG,SAAS,KAAK,KAAK,CAAC,OAAO,QAAQ,KAAK,CAAC,GAAG,UAAU,KAAK,KAAK,CAAC,SAAS,WAAW,iBAAiB,CAAC,GAAG,eAAe,KAAK,SAAS,WAAW,GAAG,YAAY,KAAK,MAAM,KAAK,OAAO,EAAE,IAAI,KAAK,OAAO,GAAG,SAAS,KAAK,OAAO,GAAG,gBAAgB,aAAa,KAAK,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG,KAAK,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,GAAG,WAAW,eAAe,KAAK,EAAE,MAAM,eAAe,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,mBAAmB,GAAG,KAAK,EAAE,SAAS,gBAAgB,SAAS,CAAC,EAAE,EAAE,CAAC;AAAA,EAC/jC,UAAU,EAAE,IAAI,UAAU,SAAS,sCAAsC,SAAS,OAAO,UAAU,mBAAmB,QAAQ,CAAC,aAAa,GAAG,WAAW,eAAe,MAAM,EAAE,QAAQ,OAAO,MAAM,aAAa,EAAE,CAAC;AAAA,EACtN,UAAU,EAAE,IAAI,sCAAsC,SAAS,gEAAgE,SAAS,KAAK,OAAO,EAAE,WAAW,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC,GAAG,4BAA4B,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,GAAG,sBAAsB,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,oBAAoB,KAAK,OAAO,GAAG,oBAAoB,KAAK,OAAO,GAAG,sBAAsB,KAAK,OAAO,GAAG,WAAW,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,WAAW,kBAAkB,MAAM,EAAE,QAAQ,QAAQ,MAAM,oCAAoC,EAAE,CAAC;AAAA,EAClqB,UAAU,EAAE,IAAI,wCAAwC,SAAS,kEAAkE,SAAS,KAAK,OAAO,EAAE,WAAW,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC,GAAG,4BAA4B,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,GAAG,oBAAoB,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,oBAAoB,KAAK,OAAO,GAAG,oBAAoB,KAAK,OAAO,GAAG,sBAAsB,KAAK,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,GAAG,UAAU,KAAK,QAAQ,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,WAAW,kBAAkB,MAAM,EAAE,QAAQ,QAAQ,MAAM,4CAA4C,EAAE,CAAC;AAAA,EACjuB,UAAU,EAAE,IAAI,iBAAiB,SAAS,sDAAsD,SAAS,OAAO,UAAU,oBAAoB,QAAQ,CAAC,aAAa,GAAG,WAAW,eAAe,KAAK,EAAE,SAAS,UAAU,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC;AAAA,EAC/P,UAAU,EAAE,IAAI,mBAAmB,SAAS,qCAAqC,SAAS,OAAO,UAAU,KAAK,OAAO,GAAG,QAAQ,CAAC,iBAAiB,GAAG,WAAW,kBAAkB,MAAM,EAAE,QAAQ,OAAO,MAAM,YAAY,qBAAqB,aAAa,EAAE,CAAC;AAAA,EAClQ,UAAU,EAAE,IAAI,mBAAmB,SAAS,gDAAgD,SAAS,oBAAoB,UAAU,KAAK,OAAO,EAAE,SAAS,KAAK,QAAQ,GAAG,SAAS,eAAe,aAAa,KAAK,SAAS,KAAK,KAAK,CAAC,aAAa,QAAQ,CAAC,CAAC,GAAG,eAAe,gBAAgB,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,gBAAgB,GAAG,WAAW,eAAe,KAAK,EAAE,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,gBAAgB,eAAe,IAAI,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW,QAAQ,QAAQ,YAAY,WAAW,gBAAgB,QAAQ,WAAW,gBAAgB,eAAe,sBAAsB,UAAU,gBAAgB,iBAAiB,aAAa,eAAe,kBAAkB,gBAAgB,YAAY,cAAc,mBAAmB,oBAAoB,eAAe,YAAY,iBAAiB,mBAAmB,yBAAyB,iBAAiB,gBAAgB,gBAAgB,cAAc,YAAY,EAAE,EAAE,CAAC;AAAA,EACn/B,UAAU,EAAE,IAAI,WAAW,SAAS,iDAAiD,SAAS,sBAAsB,UAAU,mBAAmB,QAAQ,CAAC,eAAe,GAAG,WAAW,eAAe,KAAK,EAAE,MAAM,UAAU,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,eAAe,cAAc,EAAE,kBAAkB,CAAC,YAAY,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,WAAW,SAAS,CAAC,SAAS,MAAM,GAAG,SAAS,mBAAmB,UAAU,CAAC,EAAE,SAAS,OAAO,WAAW,EAAE,MAAM,SAAS,GAAG,UAAU,WAAW,SAAS,mBAAmB,UAAU,KAAK,MAAM,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC;AAAA,EACjjB,UAAU,EAAE,IAAI,kBAAkB,SAAS,4CAA4C,SAAS,KAAK,OAAO,EAAE,YAAY,KAAK,MAAM,KAAK,OAAO,GAAG,EAAE,UAAU,GAAG,UAAU,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,gBAAgB,GAAG,WAAW,eAAe,MAAM,EAAE,QAAQ,QAAQ,MAAM,eAAe,GAAG,KAAK,EAAE,SAAS,eAAe,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,GAAG,UAAU,0BAA0B,UAAU,CAAC,EAAE,SAAS,OAAO,WAAW,EAAE,MAAM,kBAAkB,QAAQ,MAAM,GAAG,UAAU,kBAAkB,SAAS,CAAC,KAAK,GAAG,UAAU,yBAAyB,CAAC,EAAE,EAAE,CAAC;AAAA,EACxqB,UAAU,EAAE,IAAI,kBAAkB,SAAS,wFAAwF,SAAS,KAAK,OAAO,EAAE,SAAS,eAAe,GAAG,WAAW,KAAK,SAAS,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,CAAC,GAAG,aAAa,eAAe,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,qBAAqB,QAAQ,CAAC,kBAAkB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,uBAAuB,GAAG,KAAK,EAAE,SAAS,SAAS,SAAS,CAAC,YAAY,cAAc,cAAc,GAAG,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,EAAE,UAAU,gBAAgB,YAAY,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EACjsB,UAAU,EAAE,IAAI,mBAAmB,SAAS,mCAAmC,SAAS,KAAK,OAAO,EAAE,QAAQ,eAAe,GAAG,OAAO,eAAe,GAAG,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC,aAAa,aAAa,KAAK,CAAC,CAAC,GAAG,WAAW,eAAe,GAAG,WAAW,eAAe,GAAG,QAAQ,KAAK,SAAS,KAAK,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,oBAAoB,QAAQ,CAAC,iBAAiB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,kBAAkB,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,iBAAiB,GAAG,KAAK,EAAE,SAAS,cAAc,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,UAAU,SAAS,QAAQ,cAAc,aAAa,OAAO,EAAE,EAAE,CAAC;AAAA,EACpqB,UAAU,EAAE,IAAI,wBAAwB,SAAS,sDAAsD,SAAS,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,GAAG,QAAQ,eAAe,GAAG,OAAO,eAAe,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,yBAAyB,QAAQ,CAAC,iBAAiB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,uBAAuB,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,qCAAqC,GAAG,KAAK,EAAE,SAAS,mBAAmB,SAAS,CAAC,eAAe,UAAU,OAAO,EAAE,EAAE,CAAC;AAAA,EAC7gB,UAAU,EAAE,IAAI,mBAAmB,SAAS,uCAAuC,SAAS,kBAAkB,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,kBAAkB,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,qCAAqC,GAAG,KAAK,EAAE,SAAS,UAAU,SAAS,CAAC,aAAa,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EAC/e,UAAU,EAAE,IAAI,oBAAoB,SAAS,wCAAwC,SAAS,kBAAkB,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,mBAAmB,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,sCAAsC,GAAG,KAAK,EAAE,SAAS,WAAW,SAAS,CAAC,aAAa,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EACpf,UAAU,EAAE,IAAI,mBAAmB,SAAS,oCAAoC,SAAS,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,GAAG,YAAY,KAAK,OAAO,GAAG,SAAS,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,qCAAqC,GAAG,KAAK,EAAE,SAAS,UAAU,SAAS,CAAC,eAAe,eAAe,UAAU,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EAC5mB,UAAU,EAAE,IAAI,wBAAwB,SAAS,2CAA2C,SAAS,aAAa,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,cAAc,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,kCAAkC,GAAG,KAAK,EAAE,SAAS,OAAO,SAAS,CAAC,eAAe,aAAa,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EACxf,UAAU,EAAE,IAAI,iCAAiC,SAAS,uDAAuD,SAAS,kCAAkC,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,uBAAuB,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,mCAAmC,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,eAAe,eAAe,SAAS,eAAe,MAAM,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EAC7kB,UAAU,EAAE,IAAI,aAAa,SAAS,6CAA6C,SAAS,KAAK,OAAO,EAAE,SAAS,eAAe,EAAE,SAAS,KAAM,SAAS,IAAO,CAAC,GAAG,aAAa,eAAe,GAAG,cAAc,KAAK,SAAS,WAAW,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,gBAAgB,QAAQ,CAAC,gBAAgB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,YAAY,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,yBAAyB,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,YAAY,WAAW,YAAY,EAAE,EAAE,CAAC;AAAA,EACzgB,UAAU,EAAE,IAAI,YAAY,SAAS,wCAAwC,SAAS,OAAO,UAAU,KAAK,OAAO,EAAE,QAAQ,KAAK,MAAM,cAAc,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,eAAe,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,eAAe,GAAG,KAAK,EAAE,SAAS,YAAY,SAAS,CAAC,EAAE,EAAE,CAAC;AAAA,EAC3W,UAAU,EAAE,IAAI,QAAQ,SAAS,wDAAwD,SAAS,KAAK,OAAO,EAAE,SAAS,eAAe,GAAG,UAAU,eAAe,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,oBAAoB,QAAQ,CAAC,kBAAkB,eAAe,GAAG,WAAW,kBAAkB,KAAK,EAAE,MAAM,OAAO,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,YAAY,aAAa,OAAO,EAAE,EAAE,CAAC;AACnZ;AAEA,IAAM,OAAO,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAE1D,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAGjD,YAAqBA,YAA4BC,SAAsD;AACrG,UAAM,8BAA8BD,UAAS,SAAS;AADnC,qBAAAA;AAA4B,kBAAAC;AAFjD,SAAS,OAAO;AAChB,SAAS,SAAS;AAAA,EAGlB;AACF;AAEO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAqBD,YAA4BC,SAAsD;AACrG,UAAM,+BAA+BD,UAAS,SAAS;AADpC,qBAAAA;AAA4B,kBAAAC;AAFjD,SAAS,OAAO;AAChB,SAAS,SAAS;AAAA,EAGlB;AACF;AAEA,SAAS,OAAO,QAAiB,OAA8D;AAC7F,SAAO,CAAC,GAAG,OAAO,QAAQ,KAAK,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM,QAAQ,EAAE;AAChH;AAEO,SAAS,kBAAkB,aAAwC;AACxE,QAAM,WAAW,KAAK,IAAI,WAA0B;AACpD,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,+BAA+B,WAAW,EAAE;AAC3E,SAAO;AACT;AAEO,SAAS,gBAAgB,aAAqB,OAAyC;AAC5F,QAAM,WAAW,kBAAkB,WAAW;AAC9C,MAAI,CAAC,MAAM,SAAS,SAAS,KAAK,EAAG,OAAM,IAAI,wBAAwB,aAAa,OAAO,SAAS,SAAS,KAAK,CAAC;AACnH,SAAO;AACT;AAEO,SAAS,2BAA2B,aAAqB,OAAgB,iBAAkD;AAChI,MAAI,oBAAoB,yBAAyB;AAC/C,QAAI,gBAAgB,mBAAmB;AACrC,UAAI,CAAC,MAAM,0BAA0B,KAAK,EAAG,OAAM,IAAI,wBAAwB,aAAa,OAAO,0BAA0B,KAAK,CAAC;AACnI,aAAO;AAAA,IACT;AACA,QAAI,CAAC,mBAAmB,wBAAwB,mBAAmB,oBAAoB,cAAc,EAAE,SAAS,WAAW,GAAG;AAC5H,YAAM,IAAI,wBAAwB,aAAa,CAAC,EAAE,MAAM,KAAK,SAAS,0CAA0C,uBAAuB,GAAG,CAAC,CAAC;AAAA,IAC9I;AACA,QAAI,gBAAgB,aAAa,SAAS,OAAO,UAAU,UAAU;AACnE,YAAM,cAAc,CAAC,WAAW,gBAAgB,SAAS,EAAE,KAAK,CAAC,UAAW,MAAkC,KAAK,MAAM,MAAS;AAClI,UAAI,YAAa,OAAM,IAAI,wBAAwB,aAAa,CAAC,EAAE,MAAM,IAAI,WAAW,IAAI,SAAS,sCAAsC,uBAAuB,GAAG,CAAC,CAAC;AAAA,IACzK;AACA,QAAI,gBAAgB,oBAAoB,SAAS,OAAO,UAAU,YAC5D,MAAkC,cAAc,QAAW;AAC/D,YAAM,IAAI,wBAAwB,aAAa,CAAC,EAAE,MAAM,cAAc,SAAS,sCAAsC,uBAAuB,GAAG,CAAC,CAAC;AAAA,IACnJ;AAAA,EACF;AACA,MAAI,gBAAgB,mCAAmC,oBAAoB,yBAAyB;AAClG,WAAO,gBAAgB,aAAa,KAAK;AAAA,EAC3C;AACA,MAAI,CAAC,MAAM,wCAAwC,KAAK,GAAG;AACzD,UAAM,IAAI,wBAAwB,aAAa,OAAO,wCAAwC,KAAK,CAAC;AAAA,EACtG;AACA,SAAO;AACT;AAEO,SAAS,cAAc,aAAqB,OAAyB;AAC1E,QAAM,WAAW,kBAAkB,WAAW;AAC9C,QAAM,aAAa,KAAK,UAAU,KAAK;AACvC,QAAM,YAAY,eAAe,SAAY,QAAQ,KAAK,MAAM,UAAU;AAC1E,MAAI,CAAC,MAAM,SAAS,UAAU,SAAS,EAAG,OAAM,IAAI,sBAAsB,aAAa,OAAO,SAAS,UAAU,SAAS,CAAC;AAC3H,SAAO;AACT;AAoBO,SAAS,iBACd,aACA,OACA,YACS;AACT,QAAM,WAAW,kBAAkB,WAAW;AAC9C,QAAM,cAAc,IAAI,IAAI,YAAY,eAAe,CAAC,CAAC;AACzD,QAAM,UAAU,SAAS,KAAK,UAAU,KAAK,CAAC,UAC5C,MAAM,YAAY,YAAY,WAAW,kBAAkB,OAAO,WAAW,CAAC;AAChF,QAAM,SAAS,SAAS,YAAY,SAAS,KAAK,YAAY,SAAS;AACvE,QAAM,aAAa,KAAK,UAAU,KAAK;AACvC,QAAM,YAAY,eAAe,SAAY,QAAQ,KAAK,MAAM,UAAU;AAC1E,MAAI,CAAC,MAAM,QAAQ,SAAS,EAAG,OAAM,IAAI,sBAAsB,aAAa,OAAO,QAAQ,SAAS,CAAC;AACrG,SAAO;AACT;AAEO,SAAS,oBAAoB,SAAiG;AACnI,SAAO,WAAW,OAAO,CAAC,UAAU,MAAM,UAAU,SAAS,QAAQ,QAAQ,KAAK,QAAQ,MAAM,QAAQ,OAAO,CAAC,CAAC;AACnH;AAUA,SAAS,kBACP,SACA,aACS;AACT,SAAO,QAAQ,UAAU,SAAS,YAAY,YAAY,IAAI,QAAQ,UAAU,MAAM;AACxF;AAEO,SAAS,gBACd,SACA,UACA,cAAiC,CAAC,GACH;AAC/B,QAAM,kBAAkB,IAAI,IAAI,WAAW;AAC3C,SAAO,oBAAoB,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE,KAAK,CAAC,UAC7D,MAAM,KAAK,YAAY,WACvB,MAAM,KAAK,SAAS,SAAS,OAAO,KACpC,MAAM,KAAK,UAAU,KAAK,CAAC,YACzB,QAAQ,YAAY,WAAW,kBAAkB,SAAS,eAAe,CAAC,CAAC;AACjF;AAEO,SAAS,mBAAmB,UAA0J,EAAE,SAAS,QAAQ,UAAU,UAAU,GAAG;AACrO,QAAM,0BAA0B,QAAQ,2BAA2B;AACnE,SAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,wBAAwB;AAAA,IACxB;AAAA,IACA,2BAA2B,CAAC,GAAG,2BAA2B;AAAA,IAC1D,kBAAkB,QAAQ,aAAa,YAAY,oBAAoB;AAAA,IACvE,kBAAkB,QAAQ,aAAa,aAAa,QAAQ,qBAAqB;AAAA,IACjF,cAAc,QAAQ,aAAa,aAAa,QAAQ,qBAAqB,QAAQ,QAAQ,iBAAiB;AAAA,IAC9G,oBAAoB,QAAQ,aAAa,YACrC,sBACA,QAAQ,aAAa,UACnB,qBACA;AAAA,IACN,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,YAAY,oBAAoB,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,UAAU,UAAU,WAAW,YAAY,QAAQ,KAAK,GAAG,MAAM,OAAO;AAAA,MAC/H,GAAG;AAAA,MACH,GAAI,MAAM;AAAA,QACR,KAAK;AAAA,UACH,SAAS,IAAI;AAAA,UACb,GAAI,IAAI,UAAU,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;AAAA,UAC9C,SAAS,IAAI;AAAA,UACb,cAAc,IAAI,YAAY;AAAA,UAC9B,GAAI,IAAI,WAAW;AAAA,YACjB,UAAU,IAAI,SAAS,IAAI,CAAC,aAAa;AAAA,cACvC,SAAS,QAAQ;AAAA,cACjB,WAAW,QAAQ;AAAA,cACnB,UAAU,QAAQ;AAAA,cAClB,SAAS,QAAQ;AAAA,cACjB,cAAc,QAAQ;AAAA,YACxB,EAAE;AAAA,UACJ,IAAI,CAAC;AAAA,QACP;AAAA,MACF,IAAI,CAAC;AAAA,MACL,gBAAgB,CAAC,GAAG,MAAM;AAAA,IAC5B,EAAE;AAAA,EACJ;AACF;AAEO,SAAS,yBAAyB,OAA8C;AACrF,QAAM,YAAY,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AACpD,MAAI,cAAc,UAAa,UAAU,KAAK,MAAM,GAAI,QAAO;AAC/D,MAAK,4BAAkD,SAAS,UAAU,KAAK,CAAC,EAAG,QAAO,UAAU,KAAK;AACzG,QAAM,QAAQ,IAAI,MAAM,2CAA2C;AACnE,QAAM,SAAS;AACf,QAAM,OAAO;AACb,QAAM,YAAY;AAClB,QAAM;AACR;","names":["operation","issues"]}

package/dist/{chunk-NCO7RLBM.js → chunk-GTK4KOED.js}

@@ -2,9 +2,14 @@
 
 // src/private-path.ts
 import { chmodSync, existsSync, lstatSync, mkdirSync } from "fs";
+import { AsyncLocalStorage } from "async_hooks";
 import { dirname, resolve } from "path";
 import { spawnSync } from "child_process";
 var PrivatePathError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
 };
 var defaults = {
   platform: process.platform,
@@ -15,6 +20,59 @@ var defaults = {
   }),
   inspect: (path) => lstatSync(path)
 };
+var scopedPolicy = new AsyncLocalStorage();
+function privateDirectoryIdentity(path, dependencies) {
+  const details = dependencies.inspect(path);
+  if (details.isSymbolicLink() || !details.isDirectory()) {
+    throw new PrivatePathError("private path has the wrong file type");
+  }
+  return { device: details.dev, inode: details.ino };
+}
+function createPrivateDirectoryAccessCache() {
+  const entries = /* @__PURE__ */ new Map();
+  const same = (left, right) => left.device === right.device && left.inode === right.inode;
+  return {
+    verify(path, dependencies) {
+      const identityDependencies = dependencies ?? defaults;
+      if (identityDependencies.platform !== "win32") {
+        verifyPrivatePathAccess(path, "directory", dependencies);
+        return;
+      }
+      const cached = entries.get(path);
+      if (cached) {
+        const current = privateDirectoryIdentity(path, identityDependencies);
+        if (!same(current, cached)) {
+          throw new PrivatePathError("private path identity changed after cached policy validation", "PATH_REPLACED");
+        }
+        return;
+      }
+      const before = privateDirectoryIdentity(path, identityDependencies);
+      verifyPrivatePathAccess(path, "directory", dependencies);
+      const after = privateDirectoryIdentity(path, identityDependencies);
+      if (!same(before, after)) {
+        throw new PrivatePathError("private directory identity changed during policy validation", "PATH_REPLACED");
+      }
+      entries.set(path, after);
+    },
+    secure(path, dependencies) {
+      const identityDependencies = dependencies ?? defaults;
+      if (identityDependencies.platform !== "win32") {
+        securePrivatePath(path, "directory", dependencies);
+        return;
+      }
+      const before = privateDirectoryIdentity(path, identityDependencies);
+      securePrivatePath(path, "directory", dependencies);
+      const after = privateDirectoryIdentity(path, identityDependencies);
+      if (!same(before, after)) {
+        throw new PrivatePathError("private directory identity changed during policy validation", "PATH_REPLACED");
+      }
+      entries.set(path, after);
+    },
+    clear() {
+      entries.clear();
+    }
+  };
+}
 function windowsScript(kind, apply) {
   const flags = kind === "directory" ? "[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'" : "[System.Security.AccessControl.InheritanceFlags]::None";
   const pathInfo = kind === "directory" ? "[System.IO.DirectoryInfo]::new($p)" : "[System.IO.FileInfo]::new($p)";
@@ -25,6 +83,7 @@ function windowsScript(kind, apply) {
     "$tokenOwner=$identity.Owner",
     `$pathInfo=${pathInfo}`,
     "$pathInfo.Refresh()",
+    "if(-not $pathInfo.Exists){exit 26}",
     "if(($pathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}",
     `$flags=${flags}`,
     "$sections=[System.Security.AccessControl.AccessControlSections]([System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access)",
@@ -46,6 +105,7 @@ function windowsScript(kind, apply) {
     ] : [],
     `$checkPathInfo=${pathInfo}`,
     "$checkPathInfo.Refresh()",
+    "if(-not $checkPathInfo.Exists){exit 26}",
     "if(($checkPathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}",
     "$check=$checkPathInfo.GetAccessControl($sections)",
     "$owner=$check.GetOwner([System.Security.Principal.SecurityIdentifier])",
@@ -74,6 +134,9 @@ function windowsPrivatePath(path, kind, apply, dependencies) {
     windowsScript(kind, apply)
   ], { ...process.env, AGENT_BRIDGE_PRIVATE_PATH: path });
   if (result.status !== 0) {
+    if (result.status === 26) {
+      throw new PrivatePathError("private Windows path disappeared during policy validation", "PATH_DISAPPEARED");
+    }
     const phase = result.status === 23 ? `final ACL verification failed${result.stdout.trim() ? ` (${result.stdout.trim()})` : ""}` : result.status === 24 ? `the existing owner is not trusted${result.stdout.trim() ? ` (${result.stdout.trim()})` : ""}` : result.status === 25 ? "the path is a reparse object" : "the native ACL command failed";
     throw new PrivatePathError(`${apply ? "cannot apply" : "path does not satisfy"} the current-user private path policy: ${phase}`);
   }
@@ -82,6 +145,25 @@ function windowsPrivatePath(path, kind, apply, dependencies) {
     throw new PrivatePathError("private Windows path identity changed during policy validation");
   }
 }
+function securePrivateSqliteSidecar(path, dependencies) {
+  const pathDisappeared = (error) => error instanceof PrivatePathError ? error.code === "PATH_DISAPPEARED" : typeof error === "object" && error !== null && error.code === "ENOENT";
+  const pathEntryExists = () => {
+    try {
+      lstatSync(path);
+      return true;
+    } catch (error) {
+      if (error.code === "ENOENT") return false;
+      throw error;
+    }
+  };
+  if (!pathEntryExists()) return;
+  try {
+    securePrivatePath(path, "file", dependencies);
+  } catch (error) {
+    if (pathDisappeared(error) && !pathEntryExists()) return;
+    throw error;
+  }
+}
 function posixPrivatePath(path, kind, apply) {
   const details = lstatSync(path);
   if (details.isSymbolicLink() || (kind === "file" ? !details.isFile() : !details.isDirectory())) {
@@ -97,12 +179,26 @@ function posixPrivatePath(path, kind, apply) {
     throw new PrivatePathError("private path permissions are not owner-only");
   }
 }
-function securePrivatePath(path, kind, dependencies = defaults) {
-  if (dependencies.platform === "win32") windowsPrivatePath(path, kind, true, dependencies);
+function securePrivatePath(path, kind, dependencies) {
+  if (dependencies) {
+    if (dependencies.platform === "win32") windowsPrivatePath(path, kind, true, dependencies);
+    else posixPrivatePath(path, kind, true);
+    return;
+  }
+  const policy = scopedPolicy.getStore();
+  if (policy) policy.secure(path, kind);
+  else if (defaults.platform === "win32") windowsPrivatePath(path, kind, true, defaults);
   else posixPrivatePath(path, kind, true);
 }
-function verifyPrivatePathAccess(path, kind, dependencies = defaults) {
-  if (dependencies.platform === "win32") windowsPrivatePath(path, kind, false, dependencies);
+function verifyPrivatePathAccess(path, kind, dependencies) {
+  if (dependencies) {
+    if (dependencies.platform === "win32") windowsPrivatePath(path, kind, false, dependencies);
+    else posixPrivatePath(path, kind, false);
+    return;
+  }
+  const policy = scopedPolicy.getStore();
+  if (policy) policy.verify(path, kind);
+  else if (defaults.platform === "win32") windowsPrivatePath(path, kind, false, defaults);
   else posixPrivatePath(path, kind, false);
 }
 function preparePrivateFileLocation(path, createParent = false) {
@@ -126,21 +222,25 @@ function securePrivateSqliteFiles(path) {
     verifyPrivatePathAccess(candidate, "file");
   }
 }
-function preparePrivateSqliteLocation(path, createParent = false) {
+function preparePrivateSqliteLocation(path, createParent = false, sidecarPolicy = "secure") {
   if (path === ":memory:") return path;
   const target = preparePrivateFileLocation(path, createParent);
-  for (const candidate of [`${target}-wal`, `${target}-shm`]) {
-    if (existsSync(candidate)) securePrivatePath(candidate, "file");
+  if (sidecarPolicy === "secure") {
+    for (const candidate of [`${target}-wal`, `${target}-shm`]) {
+      securePrivateSqliteSidecar(candidate);
+    }
   }
   return target;
 }
 
 export {
   PrivatePathError,
+  createPrivateDirectoryAccessCache,
+  securePrivateSqliteSidecar,
   securePrivatePath,
   verifyPrivatePathAccess,
   preparePrivateFileLocation,
   securePrivateSqliteFiles,
   preparePrivateSqliteLocation
 };
-//# sourceMappingURL=chunk-NCO7RLBM.js.map
+//# sourceMappingURL=chunk-GTK4KOED.js.map

package/dist/chunk-GTK4KOED.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/private-path.ts"],"sourcesContent":["import { chmodSync, existsSync, lstatSync, mkdirSync } from \"node:fs\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { dirname, resolve } from \"node:path\";\nimport { spawnSync, type SpawnSyncReturns } from \"node:child_process\";\n\nexport type PrivatePathKind = \"file\" | \"directory\";\n\nexport class PrivatePathError extends Error {\n  constructor(message: string, readonly code?: \"PATH_DISAPPEARED\" | \"PATH_REPLACED\") {\n    super(message);\n  }\n}\n\nexport interface PrivatePathDependencies {\n  platform: NodeJS.Platform;\n  execute(command: string, args: string[], env: NodeJS.ProcessEnv): SpawnSyncReturns<string>;\n  inspect(path: string): {\n    dev: number;\n    ino: number;\n    isSymbolicLink(): boolean;\n    isFile(): boolean;\n    isDirectory(): boolean;\n  };\n}\n\n/** Test policy for semantic suites that do not exercise native ACLs. */\nexport interface PrivatePathPolicy {\n  secure(path: string, kind: PrivatePathKind): void;\n  verify(path: string, kind: PrivatePathKind): void;\n}\n\ninterface PrivateDirectoryIdentity {\n  device: number;\n  inode: number;\n}\n\n/**\n * Keep verified Windows directories within one caller-owned critical section.\n *\n * A cache hit still checks the directory type and identity. The cache does not\n * detect ACL changes made to the same directory by the current OS user.\n */\nexport interface PrivateDirectoryAccessCache {\n  verify(path: string, dependencies?: PrivatePathDependencies): void;\n  secure(path: string, dependencies?: PrivatePathDependencies): void;\n  clear(): void;\n}\n\nconst defaults: PrivatePathDependencies = {\n  platform: process.platform,\n  execute: (command, args, env) => spawnSync(command, args, {\n    encoding: \"utf8\",\n    windowsHide: true,\n    env,\n  }),\n  inspect: (path) => lstatSync(path),\n};\n\nconst scopedPolicy = new AsyncLocalStorage<PrivatePathPolicy>();\n\nfunction assertInProcessPath(path: string, kind: PrivatePathKind, apply: boolean): void {\n  const details = lstatSync(path);\n  if (details.isSymbolicLink()\n    || (kind === \"file\" ? !details.isFile() : !details.isDirectory())) {\n    throw new PrivatePathError(\"private path has the wrong file type\");\n  }\n  if (process.platform === \"win32\") return;\n  if (typeof process.getuid === \"function\" && details.uid !== process.getuid()) {\n    throw new PrivatePathError(\"private path must be owned by the current user\");\n  }\n  const mode = kind === \"file\" ? 0o600 : 0o700;\n  if (apply) chmodSync(path, mode);\n  if ((lstatSync(path).mode & 0o777) !== mode) {\n    throw new PrivatePathError(\"private path permissions are not owner-only\");\n  }\n}\n\n/**\n * Create an in-process policy for semantic tests.\n *\n * It preserves file-kind and link rejection. It does not inspect or modify\n * native permissions or ACLs. Direct policy tests use the default unscoped\n * implementation.\n */\nexport function createInProcessPrivatePathPolicy(): PrivatePathPolicy {\n  return Object.freeze({\n    secure: (path: string, kind: PrivatePathKind) => assertInProcessPath(path, kind, true),\n    verify: (path: string, kind: PrivatePathKind) => assertInProcessPath(path, kind, false),\n  });\n}\n\n/** Invoke a callback with an injected private-path policy. */\nexport function withPrivatePathPolicy<T>(policy: PrivatePathPolicy, callback: () => T): T {\n  return scopedPolicy.run(policy, callback);\n}\n\nfunction privateDirectoryIdentity(\n  path: string,\n  dependencies: PrivatePathDependencies,\n): PrivateDirectoryIdentity {\n  const details = dependencies.inspect(path);\n  if (details.isSymbolicLink() || !details.isDirectory()) {\n    throw new PrivatePathError(\"private path has the wrong file type\");\n  }\n  return { device: details.dev, inode: details.ino };\n}\n\n/** Create an empty, caller-owned cache for verified private directories. */\nexport function createPrivateDirectoryAccessCache(): PrivateDirectoryAccessCache {\n  const entries = new Map<string, PrivateDirectoryIdentity>();\n  const same = (left: PrivateDirectoryIdentity, right: PrivateDirectoryIdentity): boolean => left.device === right.device\n    && left.inode === right.inode;\n  return {\n    verify(path, dependencies): void {\n      const identityDependencies = dependencies ?? defaults;\n      if (identityDependencies.platform !== \"win32\") {\n        verifyPrivatePathAccess(path, \"directory\", dependencies);\n        return;\n      }\n      const cached = entries.get(path);\n      if (cached) {\n        const current = privateDirectoryIdentity(path, identityDependencies);\n        if (!same(current, cached)) {\n          throw new PrivatePathError(\"private path identity changed after cached policy validation\", \"PATH_REPLACED\");\n        }\n        return;\n      }\n      const before = privateDirectoryIdentity(path, identityDependencies);\n      verifyPrivatePathAccess(path, \"directory\", dependencies);\n      const after = privateDirectoryIdentity(path, identityDependencies);\n      if (!same(before, after)) {\n        throw new PrivatePathError(\"private directory identity changed during policy validation\", \"PATH_REPLACED\");\n      }\n      entries.set(path, after);\n    },\n    secure(path, dependencies): void {\n      const identityDependencies = dependencies ?? defaults;\n      if (identityDependencies.platform !== \"win32\") {\n        securePrivatePath(path, \"directory\", dependencies);\n        return;\n      }\n      const before = privateDirectoryIdentity(path, identityDependencies);\n      securePrivatePath(path, \"directory\", dependencies);\n      const after = privateDirectoryIdentity(path, identityDependencies);\n      if (!same(before, after)) {\n        throw new PrivatePathError(\"private directory identity changed during policy validation\", \"PATH_REPLACED\");\n      }\n      entries.set(path, after);\n    },\n    clear(): void { entries.clear(); },\n  };\n}\n\nfunction windowsScript(kind: PrivatePathKind, apply: boolean): string {\n  const flags = kind === \"directory\"\n    ? \"[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'\"\n    : \"[System.Security.AccessControl.InheritanceFlags]::None\";\n  const pathInfo = kind === \"directory\"\n    ? \"[System.IO.DirectoryInfo]::new($p)\"\n    : \"[System.IO.FileInfo]::new($p)\";\n  return [\n    \"$p=$env:AGENT_BRIDGE_PRIVATE_PATH\",\n    \"$identity=[System.Security.Principal.WindowsIdentity]::GetCurrent()\",\n    \"$sid=$identity.User\",\n    \"$tokenOwner=$identity.Owner\",\n    `$pathInfo=${pathInfo}`,\n    \"$pathInfo.Refresh()\",\n    \"if(-not $pathInfo.Exists){exit 26}\",\n    \"if(($pathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}\",\n    `$flags=${flags}`,\n    \"$sections=[System.Security.AccessControl.AccessControlSections]([System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access)\",\n    \"$before=$pathInfo.GetAccessControl($sections)\",\n    \"$beforeOwner=$before.GetOwner([System.Security.Principal.SecurityIdentifier])\",\n    \"$beforeMatchesUser=$false\",\n    \"$beforeMatchesToken=$false\",\n    \"if($null -ne $beforeOwner){$beforeMatchesUser=$beforeOwner.Equals($sid);if($null -ne $tokenOwner){$beforeMatchesToken=$beforeOwner.Equals($tokenOwner)}}\",\n    \"if(-not $beforeMatchesUser -and -not $beforeMatchesToken){Write-Output (\\\"explicit owner present {0}; matches user {1}; matches token {2}\\\" -f ($null -ne $beforeOwner),$beforeMatchesUser,$beforeMatchesToken);exit 24}\",\n    ...(apply ? [\n      \"$acl=$before\",\n      \"$acl.SetAccessRuleProtection($true,$false)\",\n      \"$existingRules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))\",\n      \"foreach($existing in $existingRules){$acl.RemoveAccessRuleSpecific($existing)}\",\n      \"$acl.SetOwner($sid)\",\n      \"$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow)\",\n      \"$acl.AddAccessRule($rule)\",\n      \"$pathInfo.SetAccessControl($acl)\",\n    ] : []),\n    `$checkPathInfo=${pathInfo}`,\n    \"$checkPathInfo.Refresh()\",\n    \"if(-not $checkPathInfo.Exists){exit 26}\",\n    \"if(($checkPathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}\",\n    \"$check=$checkPathInfo.GetAccessControl($sections)\",\n    \"$owner=$check.GetOwner([System.Security.Principal.SecurityIdentifier])\",\n    \"$ownerMatches=$false\",\n    \"if($null -ne $owner){$ownerMatches=$owner.Equals($sid)}\",\n    \"$rules=@($check.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))\",\n    \"$ruleMatches=$false\",\n    \"$ruleInherited=$true\",\n    \"$ruleAllow=$false\",\n    \"$rightsExact=$false\",\n    \"$inheritanceExact=$false\",\n    \"$propagationExact=$false\",\n    \"if($rules.Count -eq 1){$ruleSid=$rules[0].IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]);$ruleMatches=$ruleSid.Equals($sid);$ruleInherited=$rules[0].IsInherited;$ruleAllow=$rules[0].AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow;$rightsExact=$rules[0].FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl;$inheritanceExact=$rules[0].InheritanceFlags -eq $flags;$propagationExact=$rules[0].PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None}\",\n    \"if(-not $ownerMatches -or -not $check.AreAccessRulesProtected -or $rules.Count -ne 1 -or -not $ruleMatches -or $ruleInherited -or -not $ruleAllow -or -not $rightsExact -or -not $inheritanceExact -or -not $propagationExact){Write-Output (\\\"final owner {0}; protected {1}; rules {2}; sid {3}; inherited {4}; allow {5}; rights {6}; inheritance {7}; propagation {8}\\\" -f $ownerMatches,$check.AreAccessRulesProtected,$rules.Count,$ruleMatches,$ruleInherited,$ruleAllow,$rightsExact,$inheritanceExact,$propagationExact);exit 23}\",\n  ].join(\";\");\n}\n\nfunction windowsPrivatePath(\n  path: string,\n  kind: PrivatePathKind,\n  apply: boolean,\n  dependencies: PrivatePathDependencies,\n): void {\n  const before = dependencies.inspect(path);\n  if (before.isSymbolicLink()\n    || (kind === \"file\" ? !before.isFile() : !before.isDirectory())) {\n    throw new PrivatePathError(\"private Windows paths cannot be symlinks, junctions, or reparse objects\");\n  }\n  const result = dependencies.execute(\"powershell.exe\", [\n    \"-NoProfile\", \"-NonInteractive\", \"-Command\", windowsScript(kind, apply),\n  ], { ...process.env, AGENT_BRIDGE_PRIVATE_PATH: path });\n  if (result.status !== 0) {\n    if (result.status === 26) {\n      throw new PrivatePathError(\"private Windows path disappeared during policy validation\", \"PATH_DISAPPEARED\");\n    }\n    const phase = result.status === 23\n      ? `final ACL verification failed${result.stdout.trim() ? ` (${result.stdout.trim()})` : \"\"}`\n      : result.status === 24\n        ? `the existing owner is not trusted${result.stdout.trim() ? ` (${result.stdout.trim()})` : \"\"}`\n        : result.status === 25\n          ? \"the path is a reparse object\"\n          : \"the native ACL command failed\";\n    throw new PrivatePathError(`${apply\n      ? \"cannot apply\"\n      : \"path does not satisfy\"} the current-user private path policy: ${phase}`);\n  }\n  const after = dependencies.inspect(path);\n  if (after.isSymbolicLink()\n    || (kind === \"file\" ? !after.isFile() : !after.isDirectory())\n    || after.dev !== before.dev || after.ino !== before.ino) {\n    throw new PrivatePathError(\"private Windows path identity changed during policy validation\");\n  }\n}\n\n/** Secure an ephemeral SQLite sidecar, accepting deletion but never replacement. */\nexport function securePrivateSqliteSidecar(\n  path: string,\n  dependencies?: PrivatePathDependencies,\n): void {\n  const pathDisappeared = (error: unknown): boolean => error instanceof PrivatePathError\n    ? error.code === \"PATH_DISAPPEARED\"\n    : typeof error === \"object\" && error !== null && (error as NodeJS.ErrnoException).code === \"ENOENT\";\n  const pathEntryExists = (): boolean => {\n    try { lstatSync(path); return true; } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return false;\n      throw error;\n    }\n  };\n  if (!pathEntryExists()) return;\n  try {\n    securePrivatePath(path, \"file\", dependencies);\n  } catch (error) {\n    if (pathDisappeared(error) && !pathEntryExists()) return;\n    throw error;\n  }\n}\n\nfunction posixPrivatePath(path: string, kind: PrivatePathKind, apply: boolean): void {\n  const details = lstatSync(path);\n  if (details.isSymbolicLink()\n    || (kind === \"file\" ? !details.isFile() : !details.isDirectory())) {\n    throw new PrivatePathError(\"private path has the wrong file type\");\n  }\n  if (typeof process.getuid === \"function\" && details.uid !== process.getuid()) {\n    throw new PrivatePathError(\"private path must be owned by the current user\");\n  }\n  const mode = kind === \"file\" ? 0o600 : 0o700;\n  if (apply) chmodSync(path, mode);\n  const secured = lstatSync(path);\n  if ((secured.mode & 0o777) !== mode) {\n    throw new PrivatePathError(\"private path permissions are not owner-only\");\n  }\n}\n\nexport function securePrivatePath(\n  path: string,\n  kind: PrivatePathKind,\n  dependencies?: PrivatePathDependencies,\n): void {\n  if (dependencies) {\n    if (dependencies.platform === \"win32\") windowsPrivatePath(path, kind, true, dependencies);\n    else posixPrivatePath(path, kind, true);\n    return;\n  }\n  const policy = scopedPolicy.getStore();\n  if (policy) policy.secure(path, kind);\n  else if (defaults.platform === \"win32\") windowsPrivatePath(path, kind, true, defaults);\n  else posixPrivatePath(path, kind, true);\n}\n\nexport function verifyPrivatePathAccess(\n  path: string,\n  kind: PrivatePathKind,\n  dependencies?: PrivatePathDependencies,\n): void {\n  if (dependencies) {\n    if (dependencies.platform === \"win32\") windowsPrivatePath(path, kind, false, dependencies);\n    else posixPrivatePath(path, kind, false);\n    return;\n  }\n  const policy = scopedPolicy.getStore();\n  if (policy) policy.verify(path, kind);\n  else if (defaults.platform === \"win32\") windowsPrivatePath(path, kind, false, defaults);\n  else posixPrivatePath(path, kind, false);\n}\n\n/** Prepare an immediate parent and reject link-like file locations before use. */\nexport function preparePrivateFileLocation(path: string, createParent = false): string {\n  const target = resolve(path);\n  const parent = dirname(target);\n  const parentExisted = existsSync(parent);\n  if (createParent && !parentExisted) mkdirSync(parent, { recursive: true, mode: 0o700 });\n  if (!existsSync(parent)) throw new PrivatePathError(\"private path parent does not exist\");\n  if (!parentExisted) securePrivatePath(parent, \"directory\");\n  verifyPrivatePathAccess(parent, \"directory\");\n  if (existsSync(target)) verifyPrivatePathAccess(target, \"file\");\n  return target;\n}\n\n/** Apply and verify owner-only policy for a SQLite database and live sidecars. */\nexport function securePrivateSqliteFiles(path: string): void {\n  if (path === \":memory:\") return;\n  const target = resolve(path);\n  verifyPrivatePathAccess(dirname(target), \"directory\");\n  for (const candidate of [target, `${target}-wal`, `${target}-shm`]) {\n    if (!existsSync(candidate)) continue;\n    securePrivatePath(candidate, \"file\");\n    verifyPrivatePathAccess(candidate, \"file\");\n  }\n}\n\nexport function preparePrivateSqliteLocation(\n  path: string,\n  createParent = false,\n  sidecarPolicy: \"secure\" | \"defer\" = \"secure\",\n): string {\n  if (path === \":memory:\") return path;\n  const target = preparePrivateFileLocation(path, createParent);\n  if (sidecarPolicy === \"secure\") {\n    for (const candidate of [`${target}-wal`, `${target}-shm`]) {\n      securePrivateSqliteSidecar(candidate);\n    }\n  }\n  return target;\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,YAAY,WAAW,iBAAiB;AAC5D,SAAS,yBAAyB;AAClC,SAAS,SAAS,eAAe;AACjC,SAAS,iBAAwC;AAI1C,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAY,SAA0B,MAA6C;AACjF,UAAM,OAAO;AADuB;AAAA,EAEtC;AACF;AAqCA,IAAM,WAAoC;AAAA,EACxC,UAAU,QAAQ;AAAA,EAClB,SAAS,CAAC,SAAS,MAAM,QAAQ,UAAU,SAAS,MAAM;AAAA,IACxD,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,EACF,CAAC;AAAA,EACD,SAAS,CAAC,SAAS,UAAU,IAAI;AACnC;AAEA,IAAM,eAAe,IAAI,kBAAqC;AAsC9D,SAAS,yBACP,MACA,cAC0B;AAC1B,QAAM,UAAU,aAAa,QAAQ,IAAI;AACzC,MAAI,QAAQ,eAAe,KAAK,CAAC,QAAQ,YAAY,GAAG;AACtD,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,SAAO,EAAE,QAAQ,QAAQ,KAAK,OAAO,QAAQ,IAAI;AACnD;AAGO,SAAS,oCAAiE;AAC/E,QAAM,UAAU,oBAAI,IAAsC;AAC1D,QAAM,OAAO,CAAC,MAAgC,UAA6C,KAAK,WAAW,MAAM,UAC5G,KAAK,UAAU,MAAM;AAC1B,SAAO;AAAA,IACL,OAAO,MAAM,cAAoB;AAC/B,YAAM,uBAAuB,gBAAgB;AAC7C,UAAI,qBAAqB,aAAa,SAAS;AAC7C,gCAAwB,MAAM,aAAa,YAAY;AACvD;AAAA,MACF;AACA,YAAM,SAAS,QAAQ,IAAI,IAAI;AAC/B,UAAI,QAAQ;AACV,cAAM,UAAU,yBAAyB,MAAM,oBAAoB;AACnE,YAAI,CAAC,KAAK,SAAS,MAAM,GAAG;AAC1B,gBAAM,IAAI,iBAAiB,gEAAgE,eAAe;AAAA,QAC5G;AACA;AAAA,MACF;AACA,YAAM,SAAS,yBAAyB,MAAM,oBAAoB;AAClE,8BAAwB,MAAM,aAAa,YAAY;AACvD,YAAM,QAAQ,yBAAyB,MAAM,oBAAoB;AACjE,UAAI,CAAC,KAAK,QAAQ,KAAK,GAAG;AACxB,cAAM,IAAI,iBAAiB,+DAA+D,eAAe;AAAA,MAC3G;AACA,cAAQ,IAAI,MAAM,KAAK;AAAA,IACzB;AAAA,IACA,OAAO,MAAM,cAAoB;AAC/B,YAAM,uBAAuB,gBAAgB;AAC7C,UAAI,qBAAqB,aAAa,SAAS;AAC7C,0BAAkB,MAAM,aAAa,YAAY;AACjD;AAAA,MACF;AACA,YAAM,SAAS,yBAAyB,MAAM,oBAAoB;AAClE,wBAAkB,MAAM,aAAa,YAAY;AACjD,YAAM,QAAQ,yBAAyB,MAAM,oBAAoB;AACjE,UAAI,CAAC,KAAK,QAAQ,KAAK,GAAG;AACxB,cAAM,IAAI,iBAAiB,+DAA+D,eAAe;AAAA,MAC3G;AACA,cAAQ,IAAI,MAAM,KAAK;AAAA,IACzB;AAAA,IACA,QAAc;AAAE,cAAQ,MAAM;AAAA,IAAG;AAAA,EACnC;AACF;AAEA,SAAS,cAAc,MAAuB,OAAwB;AACpE,QAAM,QAAQ,SAAS,cACnB,qFACA;AACJ,QAAM,WAAW,SAAS,cACtB,uCACA;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI,CAAC;AAAA,IACL,kBAAkB,QAAQ;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,mBACP,MACA,MACA,OACA,cACM;AACN,QAAM,SAAS,aAAa,QAAQ,IAAI;AACxC,MAAI,OAAO,eAAe,MACpB,SAAS,SAAS,CAAC,OAAO,OAAO,IAAI,CAAC,OAAO,YAAY,IAAI;AACjE,UAAM,IAAI,iBAAiB,yEAAyE;AAAA,EACtG;AACA,QAAM,SAAS,aAAa,QAAQ,kBAAkB;AAAA,IACpD;AAAA,IAAc;AAAA,IAAmB;AAAA,IAAY,cAAc,MAAM,KAAK;AAAA,EACxE,GAAG,EAAE,GAAG,QAAQ,KAAK,2BAA2B,KAAK,CAAC;AACtD,MAAI,OAAO,WAAW,GAAG;AACvB,QAAI,OAAO,WAAW,IAAI;AACxB,YAAM,IAAI,iBAAiB,6DAA6D,kBAAkB;AAAA,IAC5G;AACA,UAAM,QAAQ,OAAO,WAAW,KAC5B,gCAAgC,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,KACxF,OAAO,WAAW,KAChB,oCAAoC,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,KAC5F,OAAO,WAAW,KAChB,iCACA;AACR,UAAM,IAAI,iBAAiB,GAAG,QAC1B,iBACA,uBAAuB,0CAA0C,KAAK,EAAE;AAAA,EAC9E;AACA,QAAM,QAAQ,aAAa,QAAQ,IAAI;AACvC,MAAI,MAAM,eAAe,MACnB,SAAS,SAAS,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,YAAY,MACxD,MAAM,QAAQ,OAAO,OAAO,MAAM,QAAQ,OAAO,KAAK;AACzD,UAAM,IAAI,iBAAiB,gEAAgE;AAAA,EAC7F;AACF;AAGO,SAAS,2BACd,MACA,cACM;AACN,QAAM,kBAAkB,CAAC,UAA4B,iBAAiB,mBAClE,MAAM,SAAS,qBACf,OAAO,UAAU,YAAY,UAAU,QAAS,MAAgC,SAAS;AAC7F,QAAM,kBAAkB,MAAe;AACrC,QAAI;AAAE,gBAAU,IAAI;AAAG,aAAO;AAAA,IAAM,SAAS,OAAO;AAClD,UAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,CAAC,gBAAgB,EAAG;AACxB,MAAI;AACF,sBAAkB,MAAM,QAAQ,YAAY;AAAA,EAC9C,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EAAG;AAClD,UAAM;AAAA,EACR;AACF;AAEA,SAAS,iBAAiB,MAAc,MAAuB,OAAsB;AACnF,QAAM,UAAU,UAAU,IAAI;AAC9B,MAAI,QAAQ,eAAe,MACrB,SAAS,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,YAAY,IAAI;AACnE,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,MAAI,OAAO,QAAQ,WAAW,cAAc,QAAQ,QAAQ,QAAQ,OAAO,GAAG;AAC5E,UAAM,IAAI,iBAAiB,gDAAgD;AAAA,EAC7E;AACA,QAAM,OAAO,SAAS,SAAS,MAAQ;AACvC,MAAI,MAAO,WAAU,MAAM,IAAI;AAC/B,QAAM,UAAU,UAAU,IAAI;AAC9B,OAAK,QAAQ,OAAO,SAAW,MAAM;AACnC,UAAM,IAAI,iBAAiB,6CAA6C;AAAA,EAC1E;AACF;AAEO,SAAS,kBACd,MACA,MACA,cACM;AACN,MAAI,cAAc;AAChB,QAAI,aAAa,aAAa,QAAS,oBAAmB,MAAM,MAAM,MAAM,YAAY;AAAA,QACnF,kBAAiB,MAAM,MAAM,IAAI;AACtC;AAAA,EACF;AACA,QAAM,SAAS,aAAa,SAAS;AACrC,MAAI,OAAQ,QAAO,OAAO,MAAM,IAAI;AAAA,WAC3B,SAAS,aAAa,QAAS,oBAAmB,MAAM,MAAM,MAAM,QAAQ;AAAA,MAChF,kBAAiB,MAAM,MAAM,IAAI;AACxC;AAEO,SAAS,wBACd,MACA,MACA,cACM;AACN,MAAI,cAAc;AAChB,QAAI,aAAa,aAAa,QAAS,oBAAmB,MAAM,MAAM,OAAO,YAAY;AAAA,QACpF,kBAAiB,MAAM,MAAM,KAAK;AACvC;AAAA,EACF;AACA,QAAM,SAAS,aAAa,SAAS;AACrC,MAAI,OAAQ,QAAO,OAAO,MAAM,IAAI;AAAA,WAC3B,SAAS,aAAa,QAAS,oBAAmB,MAAM,MAAM,OAAO,QAAQ;AAAA,MACjF,kBAAiB,MAAM,MAAM,KAAK;AACzC;AAGO,SAAS,2BAA2B,MAAc,eAAe,OAAe;AACrF,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,SAAS,QAAQ,MAAM;AAC7B,QAAM,gBAAgB,WAAW,MAAM;AACvC,MAAI,gBAAgB,CAAC,cAAe,WAAU,QAAQ,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtF,MAAI,CAAC,WAAW,MAAM,EAAG,OAAM,IAAI,iBAAiB,oCAAoC;AACxF,MAAI,CAAC,cAAe,mBAAkB,QAAQ,WAAW;AACzD,0BAAwB,QAAQ,WAAW;AAC3C,MAAI,WAAW,MAAM,EAAG,yBAAwB,QAAQ,MAAM;AAC9D,SAAO;AACT;AAGO,SAAS,yBAAyB,MAAoB;AAC3D,MAAI,SAAS,WAAY;AACzB,QAAM,SAAS,QAAQ,IAAI;AAC3B,0BAAwB,QAAQ,MAAM,GAAG,WAAW;AACpD,aAAW,aAAa,CAAC,QAAQ,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG;AAClE,QAAI,CAAC,WAAW,SAAS,EAAG;AAC5B,sBAAkB,WAAW,MAAM;AACnC,4BAAwB,WAAW,MAAM;AAAA,EAC3C;AACF;AAEO,SAAS,6BACd,MACA,eAAe,OACf,gBAAoC,UAC5B;AACR,MAAI,SAAS,WAAY,QAAO;AAChC,QAAM,SAAS,2BAA2B,MAAM,YAAY;AAC5D,MAAI,kBAAkB,UAAU;AAC9B,eAAW,aAAa,CAAC,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG;AAC1D,iCAA2B,SAAS;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-SPSMZOCJ.js → chunk-HUHG7XTB.js}

@@ -5,21 +5,21 @@ import {
 } from "./chunk-2EVLG3YA.js";
 import {
   createStore
-} from "./chunk-UAHMP6GC.js";
+} from "./chunk-QPC6JHA3.js";
 import {
   legacyContextMetadata,
   legacyNumericMessageId
-} from "./chunk-CEXBMOI5.js";
+} from "./chunk-Z6JP6MYD.js";
 import {
   BridgeService
-} from "./chunk-4VB44KJU.js";
+} from "./chunk-AWE3DFZV.js";
 import {
   ContractValidationError,
   availableOperations,
   capabilityDocument,
   parseResponse,
   validateRequest
-} from "./chunk-GADH244D.js";
+} from "./chunk-E4OWHGUE.js";
 import {
   BridgePrincipalMismatchError,
   BridgeValidationError,
@@ -693,6 +693,7 @@ function createAgentBridgeServer(config) {
           const input = validateRequest("claim_delivery", args ?? {});
           const result = await service.claim(principal, {
             leaseMs: input.leaseMs,
+            messageId: input.messageId,
             maxAttempts: input.maxAttempts
           });
           return canonicalResult("claim_delivery", result ?? { delivery: null });
@@ -795,4 +796,4 @@ export {
   createAgentBridgeServer,
   startServer
 };
-//# sourceMappingURL=chunk-SPSMZOCJ.js.map
+//# sourceMappingURL=chunk-HUHG7XTB.js.map