@creatornader/agent-bridge 0.4.0 → 0.5.1

package/dist/chunk-3YHVUPU2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/gateway.ts","../src/gateway-auth.ts"],"sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { createServer, type IncomingMessage, type ServerResponse } from \"node:http\";\nimport { BridgePrincipalMismatchError, BridgeValidationError, type MessageDraft } from \"./bridge-domain.js\";\nimport { BridgeService } from \"./bridge-service.js\";\nimport type { BridgeStore } from \"./bridge-store.js\";\nimport { bearerToken, hashCredential, type CredentialResolver } from \"./gateway-auth.js\";\nimport type { GatewaySecurity } from \"./gateway-security.js\";\nimport type { RequestAuthority, RequestAuthorityContext } from \"./postgres-request-authority.js\";\nimport {\n  capabilityDocument,\n  ContractResponseError,\n  ContractValidationError,\n  LEGACY_PROTOCOL_VERSION,\n  negotiateProtocolVersion,\n  operationContract,\n  parseResponse,\n  PROTOCOL_HEADER,\n  PROTOCOL_VERSION,\n  SUPPORTED_PROTOCOL_HEADER,\n  SUPPORTED_PROTOCOL_VERSIONS,\n  type OperationId,\n  validateRequest,\n  validateRequestForProtocol,\n} from \"./contracts/registry.js\";\n\nexport interface GatewayOptions {\n  store: BridgeStore;\n  credentials: CredentialResolver;\n  security: GatewaySecurity;\n  allowedOrigins?: string[];\n  bodyLimitBytes?: number;\n  requestDeadlineMs?: number;\n  ready?: () => Promise<boolean>;\n  /** Reports whether the configured database has verified row isolation. */\n  rowIsolationReady?: () => Promise<boolean>;\n  /** Production PostgreSQL request authority. Other providers omit this. */\n  requestAuthority?: RequestAuthority;\n}\n\ntype Metrics = { requests: number; errors: number; timeouts: number; authFailures: number };\nconst jsonHeaders = { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" };\n\ninterface ResponseWriter {\n  readonly writableEnded: boolean;\n  getHeader(name: string): string | number | readonly string[] | undefined;\n  setHeader(name: string, value: string | number | readonly string[]): unknown;\n  writeHead(status: number, headers?: any): unknown;\n  end(chunk?: any): unknown;\n}\n\nclass BufferedResponse implements ResponseWriter {\n  private readonly headers = new Map<string, string | number | readonly string[]>();\n  private status: number | undefined;\n  private headHeaders: any;\n  private body: any;\n\n  constructor(private readonly target: ServerResponse) {}\n  get writableEnded(): boolean { return this.body !== undefined; }\n  getHeader(name: string) { return this.headers.get(name.toLowerCase()) ?? this.target.getHeader(name); }\n  setHeader(name: string, value: string | number | readonly string[]) { this.headers.set(name.toLowerCase(), value); return this; }\n  writeHead(status: number, headers?: any) {\n    this.status = status;\n    this.headHeaders = headers;\n    return this;\n  }\n  end(chunk?: any) { this.body = chunk ?? null; return this; }\n  flush(): void {\n    if (this.target.writableEnded) return;\n    for (const [name, value] of this.headers) this.target.setHeader(name, value);\n    if (this.status !== undefined) this.target.writeHead(this.status, this.headHeaders);\n    if (this.body !== undefined) this.target.end(this.body);\n  }\n}\n\nfunction send(res: ResponseWriter, status: number, value: unknown, requestId: string): void {\n  if (res.writableEnded) return;\n  res.writeHead(status, {\n    ...jsonHeaders,\n    \"x-request-id\": requestId,\n  });\n  res.end(JSON.stringify(value));\n}\n\nfunction sendOperation(res: ResponseWriter, status: number, operation: string, value: unknown, requestId: string): void {\n  const canonical = parseResponse(operation, value) as Record<string, unknown>;\n  const protocolVersion = String(res.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n  if (protocolVersion !== LEGACY_PROTOCOL_VERSION) {\n    send(res, status, canonical, requestId);\n    return;\n  }\n  if (operation === \"claim_delivery\") {\n    send(res, status, canonical.delivery === null ? null : canonical, requestId);\n    return;\n  }\n  if ([\"cancel_delivery\", \"requeue_delivery\", \"extend_delivery\", \"acknowledge_delivery\", \"negative_acknowledge_delivery\"].includes(operation)) {\n    send(res, status, canonical.delivery, requestId);\n    return;\n  }\n  send(res, status, canonical, requestId);\n}\n\nfunction failure(\n  res: ResponseWriter,\n  status: number,\n  code: string,\n  requestId: string,\n  details: Record<string, unknown> = {},\n): void {\n  send(res, status, { error: { code, requestId, ...details } }, requestId);\n}\n\nasync function body(\n  req: IncomingMessage,\n  limit: number,\n  signal: AbortSignal,\n): Promise<Record<string, any>> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    const cleanup = () => {\n      req.off(\"data\", onData);\n      req.off(\"end\", onEnd);\n      req.off(\"error\", onError);\n      signal.removeEventListener(\"abort\", onAbort);\n    };\n    const finish = (callback: () => void) => {\n      cleanup();\n      callback();\n    };\n    const onData = (chunk: Buffer | string) => {\n      const buffer = Buffer.from(chunk);\n      size += buffer.length;\n      if (size > limit) {\n        finish(() => reject(Object.assign(new Error(\"body too large\"), {\n          status: 413,\n          code: \"body_too_large\",\n        })));\n        req.resume();\n        return;\n      }\n      chunks.push(buffer);\n    };\n    const onEnd = () => finish(() => {\n      if (!size) {\n        resolve({});\n        return;\n      }\n      try {\n        const parsed = JSON.parse(Buffer.concat(chunks).toString(\"utf8\"));\n        if (!parsed || Array.isArray(parsed) || typeof parsed !== \"object\") throw new Error();\n        resolve(parsed);\n      } catch {\n        reject(Object.assign(new Error(\"invalid JSON\"), { status: 400, code: \"malformed_json\" }));\n      }\n    });\n    const onError = (error: Error) => finish(() => reject(error));\n    const onAbort = () => {\n      finish(() => reject(signal.reason));\n      req.resume();\n    };\n    req.on(\"data\", onData);\n    req.on(\"end\", onEnd);\n    req.on(\"error\", onError);\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n    if (signal.aborted) onAbort();\n  });\n}\n\nasync function jsonBody(\n  req: IncomingMessage,\n  limit: number,\n  signal: AbortSignal,\n): Promise<Record<string, any>> {\n  if (hasRequestBody(req) && req.headers[\"content-type\"]?.split(\";\", 1)[0] !== \"application/json\") {\n    throw Object.assign(new Error(\"unsupported media type\"), {\n      status: 415,\n      code: \"unsupported_media_type\",\n    });\n  }\n  return body(req, limit, signal);\n}\n\nfunction numberParam(value: string | null, name: string): number | undefined {\n  if (value === null) return undefined;\n  const result = Number(value);\n  if (!Number.isSafeInteger(result)) throw new BridgeValidationError(`${name} is invalid`);\n  return result;\n}\n\nfunction booleanParam(value: string | null, name: string): boolean | undefined {\n  if (value === null) return undefined;\n  if (value === \"true\") return true;\n  if (value === \"false\") return false;\n  throw new BridgeValidationError(`${name} must be true or false`);\n}\n\nfunction hasRequestBody(req: IncomingMessage): boolean {\n  const length = req.headers[\"content-length\"];\n  return req.headers[\"transfer-encoding\"] !== undefined || (length !== undefined && length !== \"0\");\n}\n\nfunction pathBoundInput(\n  operation: string,\n  deliveryId: string,\n  rawInput: Record<string, unknown>,\n  protocolVersion?: string,\n): Record<string, unknown> {\n  if (Object.prototype.hasOwnProperty.call(rawInput, \"deliveryId\")) {\n    throw new ContractValidationError(operation, [{ path: \"/deliveryId\", message: \"deliveryId is supplied by the request path\" }]);\n  }\n  const value = { ...rawInput, deliveryId };\n  return protocolVersion\n    ? validateRequestForProtocol(operation, value, protocolVersion)\n    : validateRequest(operation, value);\n}\n\nfunction active(signal: AbortSignal): void {\n  if (signal.aborted) throw signal.reason;\n}\n\nfunction closedQuery(url: URL, operation: string, allowed: readonly string[]): void {\n  const unknown = [...url.searchParams.keys()].find((key) => !allowed.includes(key));\n  if (unknown) throw new ContractValidationError(operation, [{ path: `/${unknown}`, message: \"Unexpected query parameter\" }]);\n}\n\nfunction selectedProtocol(res: ResponseWriter): string {\n  return String(res.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n}\n\nfunction requireCurrentProtocol(res: ResponseWriter): void {\n  if (selectedProtocol(res) === LEGACY_PROTOCOL_VERSION) {\n    const error = new Error(\"Operation is not available in protocol 2.0\") as Error & { status: number; code: string };\n    error.status = 404;\n    error.code = \"not_found\";\n    throw error;\n  }\n}\n\nexport function createGateway(options: GatewayOptions) {\n  const metrics: Metrics = { requests: 0, errors: 0, timeouts: 0, authFailures: 0 };\n  const limit = options.bodyLimitBytes ?? 128 * 1024;\n  const deadline = options.requestDeadlineMs ?? 10_000;\n  const origins = new Set(options.allowedOrigins ?? []);\n\n  return createServer((req, res) => {\n    const requestId = randomUUID();\n    const abort = new AbortController();\n    let mutationStarted = false;\n    metrics.requests += 1;\n    const requestedProtocol = req.headers[PROTOCOL_HEADER];\n    const rawRequestedProtocol = Array.isArray(requestedProtocol) ? requestedProtocol[0] : requestedProtocol;\n    const initialProtocol = rawRequestedProtocol === undefined || rawRequestedProtocol.trim() === \"\"\n      ? LEGACY_PROTOCOL_VERSION\n      : (SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(rawRequestedProtocol.trim())\n        ? rawRequestedProtocol.trim()\n        : PROTOCOL_VERSION;\n    res.setHeader(PROTOCOL_HEADER, initialProtocol);\n    res.setHeader(SUPPORTED_PROTOCOL_HEADER, SUPPORTED_PROTOCOL_VERSIONS.join(\",\"));\n    const timer = setTimeout(() => {\n      abort.abort(new Error(\"request deadline exceeded\"));\n      metrics.timeouts += 1; metrics.errors += 1;\n      res.once(\"finish\", () => {\n        if (!req.complete) req.destroy();\n      });\n      failure(\n        res,\n        504,\n        mutationStarted ? \"mutation_outcome_unknown\" : \"request_timeout\",\n        requestId,\n      );\n    }, deadline);\n    let parsedBody: Promise<Record<string, any>> | undefined;\n    const requestBody = () => parsedBody ??= jsonBody(req, limit, abort.signal);\n\n    const dispatch = async (authority?: RequestAuthorityContext, response: ResponseWriter = res): Promise<void> => {\n      const url = new URL(req.url ?? \"/\", \"http://gateway.invalid\");\n      if (req.method === \"GET\" && url.pathname === \"/readyz\") {\n        let ready = false;\n        try {\n          ready = await (options.ready?.() ?? options.store.initialize().then(() => true));\n        } catch {\n          ready = false;\n        }\n        send(response, ready ? 200 : 503, { status: ready ? \"ready\" : \"not_ready\" }, requestId);\n        return;\n      }\n      const origin = req.headers.origin;\n      if (origin && !origins.has(origin)) {\n        failure(response, 403, \"origin_forbidden\", requestId); return;\n      }\n      const token = bearerToken(req.headers.authorization);\n      if (options.requestAuthority && !authority) {\n        if (!token) {\n          metrics.authFailures += 1;\n          failure(response, 401, \"unauthorized\", requestId); return;\n        }\n        const preflight = await options.credentials.resolve(token, abort.signal);\n        active(abort.signal);\n        if (!preflight) {\n          metrics.authFailures += 1;\n          failure(response, 401, \"unauthorized\", requestId); return;\n        }\n        if (hasRequestBody(req)) await requestBody();\n        active(abort.signal);\n        const buffered = new BufferedResponse(res);\n        await options.requestAuthority!.run(\n          preflight.id,\n          hashCredential(token),\n          requestId,\n          abort.signal,\n          (context) => dispatch(context, buffered),\n        );\n        active(abort.signal);\n        buffered.flush();\n        return;\n      }\n      const credential = authority?.credential ?? (token ? await options.credentials.resolve(token, abort.signal) : null);\n      active(abort.signal);\n      if (!credential) {\n        metrics.authFailures += 1;\n        failure(response, 401, \"unauthorized\", requestId); return;\n      }\n      if (!Array.isArray(credential.scopes)) {\n        failure(response, 503, \"security_unavailable\", requestId); return;\n      }\n      const service = new BridgeService(authority?.store ?? options.store);\n      const security = authority?.security ?? options.security;\n      if (url.pathname.startsWith(\"/v2/\") || url.pathname === \"/metrics\") {\n        response.setHeader(PROTOCOL_HEADER, negotiateProtocolVersion(req.headers[PROTOCOL_HEADER]));\n      }\n      const authorize = async (operationId: OperationId): Promise<void> => {\n        const requiredScopes = operationContract(operationId).scopes;\n        if (requiredScopes.some((scope) => !credential.scopes.includes(scope))) {\n          try {\n            await security.recordScopeDenial(credential.id, operationId, requestId, abort.signal);\n          } catch {\n            throw Object.assign(new Error(\"Scope denial could not be audited\"), {\n              status: 503,\n              code: \"security_unavailable\",\n            });\n          }\n          throw Object.assign(new Error(\"Credential lacks a required scope\"), {\n            status: 403, code: \"insufficient_scope\", requiredScopes,\n          });\n        }\n        let decision;\n        try {\n          decision = await security.consume(credential.id, operationId, requestId, abort.signal);\n        } catch {\n          throw Object.assign(new Error(\"Rate limit state is unavailable\"), {\n            status: 503,\n            code: \"security_unavailable\",\n          });\n        }\n        if (!decision.allowed) {\n          const retryAfter = Math.max(1, Math.ceil(decision.retryAfterSeconds));\n          response.setHeader(\"retry-after\", String(retryAfter));\n          throw Object.assign(new Error(\"Credential rate limit exceeded\"), {\n            status: 429, code: \"rate_limited\", retryAfterSeconds: retryAfter,\n          });\n        }\n      };\n      if (req.method === \"GET\" && url.pathname === \"/metrics\") {\n        await authorize(\"gateway_metrics\");\n        validateRequest(\"gateway_metrics\", {});\n        const result = Object.entries(metrics).map(([key, value]) => `agent_bridge_gateway_${key}_total ${value}`).join(\"\\n\") + \"\\n\";\n        parseResponse(\"gateway_metrics\", result);\n        response.writeHead(200, {\n          ...jsonHeaders,\n          \"content-type\": \"text/plain; version=0.0.4\",\n          \"x-request-id\": requestId,\n        });\n        response.end(result);\n        return;\n      }\n      const instanceHeader = req.headers[\"x-agent-bridge-instance\"];\n      const principal = {\n        ...credential.principal,\n        instance: Array.isArray(instanceHeader) ? instanceHeader[0] : instanceHeader,\n      };\n\n      if (req.method === \"GET\" && url.pathname === \"/v2/capabilities\") {\n        requireCurrentProtocol(response);\n        await authorize(\"capabilities\");\n        closedQuery(url, \"capabilities\", []);\n        validateRequest(\"capabilities\", {});\n        let rowIsolation = false;\n        if (options.requestAuthority && options.rowIsolationReady) {\n          try {\n            rowIsolation = await options.rowIsolationReady();\n          } catch {\n            rowIsolation = false;\n          }\n        }\n        sendOperation(response, 200, \"capabilities\", {\n          ...capabilityDocument({\n            surface: \"http\",\n            provider: \"gateway\",\n            selectedProtocolVersion: String(response.getHeader(PROTOCOL_HEADER)),\n            requestAuthority: Boolean(options.requestAuthority),\n            rowIsolation,\n          }),\n          grantedScopes: [...credential.scopes],\n        }, requestId); return;\n      }\n\n      if (req.method === \"GET\" && url.pathname === \"/v2/status\") {\n        await authorize(\"status\");\n        closedQuery(url, \"status\", []);\n        validateRequest(\"status\", {});\n        const activeStore = authority?.store ?? options.store;\n        const authorityBinding = authority && response.getHeader(PROTOCOL_HEADER) === PROTOCOL_VERSION ? {\n          gatewayAuthorityId: authority.gatewayAuthorityId,\n          credentialId: authority.credential.id,\n        } : {};\n        if (!activeStore.diagnostics) {\n          sendOperation(response, 200, \"status\", { schemaVersion: \"postgres-v2\", deliverySupported: false, pending: null, claimed: null, retrying: null, dead: null, ...authorityBinding, principal: credential.principal }, requestId);\n        } else {\n          sendOperation(response, 200, \"status\", { ...await activeStore.diagnostics(principal), ...authorityBinding, principal: credential.principal }, requestId);\n        }\n        return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/endpoint-migration-challenges\") {\n        requireCurrentProtocol(response);\n        await authorize(\"issue_endpoint_migration_challenge\");\n        const input = validateRequestForProtocol(\"issue_endpoint_migration_challenge\", await requestBody(), selectedProtocol(response));\n        if (!authority?.endpointMigrationChallenges) throw Object.assign(new Error(\"endpoint migration challenges require request authority\"), { status: 503, code: \"security_unavailable\" });\n        active(abort.signal);\n        await authority.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"issue_endpoint_migration_challenge\", await authority.endpointMigrationChallenges.issue({\n          challenge: String(input.challenge),\n          expectedGatewayAuthorityId: String(input.expectedGatewayAuthorityId),\n          verifierCredentialId: String(input.verifierCredentialId),\n        }), requestId); return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/endpoint-migration-challenges/consume\") {\n        requireCurrentProtocol(response);\n        await authorize(\"consume_endpoint_migration_challenge\");\n        const input = validateRequestForProtocol(\"consume_endpoint_migration_challenge\", await requestBody(), selectedProtocol(response));\n        if (!authority?.endpointMigrationChallenges) throw Object.assign(new Error(\"endpoint migration challenges require request authority\"), { status: 503, code: \"security_unavailable\" });\n        active(abort.signal);\n        await authority.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"consume_endpoint_migration_challenge\", await authority.endpointMigrationChallenges.consume({\n          challenge: String(input.challenge),\n          expectedGatewayAuthorityId: String(input.expectedGatewayAuthorityId),\n          issuerCredentialId: String(input.issuerCredentialId),\n        }), requestId); return;\n      }\n\n      if (req.method === \"POST\" && url.pathname === \"/v2/messages\") {\n        await authorize(\"publish_message\");\n        const input = validateRequestForProtocol(\"publish_message\", await requestBody(), String(response.getHeader(PROTOCOL_HEADER)));\n        if (input.source !== undefined && input.source !== principal.agent) {\n          throw new BridgePrincipalMismatchError(\"source must match the authenticated principal\");\n        }\n        const { source: _source, ...draft } = input;\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 201, \"publish_message\", await service.publish(principal, draft as unknown as MessageDraft), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/history\") {\n        await authorize(\"history\");\n        closedQuery(url, \"history\", [\"cursor\", \"mailbox\", \"receiptState\", \"limit\", \"type\", \"includeExpired\", \"source\", \"project\", \"since\", \"unacknowledgedBy\", \"unacked_by\", \"threadId\", \"latest\"]);\n        const types = url.searchParams.getAll(\"type\");\n        const input = validateRequestForProtocol(\"history\", {\n          cursor: url.searchParams.get(\"cursor\") ?? undefined,\n          mailbox: url.searchParams.get(\"mailbox\") ?? undefined as any,\n          receiptState: url.searchParams.get(\"receiptState\") ?? undefined as any,\n          limit: numberParam(url.searchParams.get(\"limit\"), \"limit\"),\n          types: types.length ? types : undefined,\n          includeExpired: booleanParam(url.searchParams.get(\"includeExpired\"), \"includeExpired\"),\n          source: url.searchParams.get(\"source\") ?? undefined,\n          project: url.searchParams.get(\"project\") ?? undefined,\n          since: url.searchParams.get(\"since\") ?? undefined,\n          unacknowledgedBy: url.searchParams.get(\"unacknowledgedBy\") ?? url.searchParams.get(\"unacked_by\") ?? undefined,\n          threadId: url.searchParams.get(\"threadId\") ?? undefined,\n          latest: booleanParam(url.searchParams.get(\"latest\"), \"latest\"),\n        }, String(response.getHeader(PROTOCOL_HEADER)));\n        sendOperation(response, 200, \"history\", await service.history(principal, input), requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/receipts\") {\n        await authorize(\"record_receipt\");\n        const input = validateRequest(\"record_receipt\", await requestBody());\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"record_receipt\", { recorded: await service.acknowledge(principal, input.messageIds as string[]) }, requestId); return;\n      }\n      if (req.method === \"POST\" && url.pathname === \"/v2/deliveries/claim\") {\n        await authorize(\"claim_delivery\");\n        const input = validateRequest(\"claim_delivery\", await requestBody());\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"claim_delivery\", await service.claim(principal, input) ?? { delivery: null }, requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/deliveries\") {\n        requireCurrentProtocol(response);\n        await authorize(\"list_deliveries\");\n        closedQuery(url, \"list_deliveries\", [\"cursor\", \"limit\", \"role\", \"messageId\", \"recipient\", \"state\"]);\n        const input = validateRequest(\"list_deliveries\", {cursor:url.searchParams.get(\"cursor\")??undefined,limit:numberParam(url.searchParams.get(\"limit\"),\"limit\"),role:url.searchParams.get(\"role\")??undefined,messageId:url.searchParams.get(\"messageId\")??undefined,recipient:url.searchParams.get(\"recipient\")??undefined,states:url.searchParams.getAll(\"state\")});\n        sendOperation(response,200,\"list_deliveries\",await service.deliveries(principal,input as any),requestId);return;\n      }\n      const eventsMatch=url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/events$/);\n      if(req.method===\"GET\"&&eventsMatch){requireCurrentProtocol(response);await authorize(\"list_delivery_events\");closedQuery(url,\"list_delivery_events\",[\"cursor\",\"limit\"]);const input=validateRequest(\"list_delivery_events\",{deliveryId:eventsMatch[1],cursor:url.searchParams.get(\"cursor\")??undefined,limit:numberParam(url.searchParams.get(\"limit\"),\"limit\")});sendOperation(response,200,\"list_delivery_events\",await service.deliveryEvents(principal,eventsMatch[1]!,input as any),requestId);return;}\n      const controlMatch=url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/(cancel|requeue)$/);\n      if(req.method===\"POST\"&&controlMatch){requireCurrentProtocol(response);const operation=controlMatch[2]===\"cancel\"?\"cancel_delivery\":\"requeue_delivery\";await authorize(operation);pathBoundInput(operation,controlMatch[1]!,await requestBody());await authority?.beginDomainWork();mutationStarted=true;const result=controlMatch[2]===\"cancel\"?await service.cancel(principal,controlMatch[1]!):await service.requeue(principal,controlMatch[1]!);if(!result)failure(response,404,\"not_found\",requestId);else sendOperation(response,200,operation,{delivery:result},requestId);return;}\n      if (req.method === \"POST\" && url.pathname === \"/v2/presence/heartbeat\") {\n        await authorize(\"heartbeat\");\n        const input = validateRequest(\"heartbeat\", await requestBody());\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        sendOperation(response, 200, \"heartbeat\", await service.heartbeat(principal, input), requestId); return;\n      }\n      if (req.method === \"GET\" && url.pathname === \"/v2/presence\") {\n        await authorize(\"presence\");\n        closedQuery(url, \"presence\", []);\n        validateRequest(\"presence\", {});\n        sendOperation(response, 200, \"presence\", { agents: await service.presence(principal) }, requestId); return;\n      }\n      const match = url.pathname.match(/^\\/v2\\/deliveries\\/([^/]+)\\/(extend|ack|nack)$/);\n      if (req.method === \"POST\" && match) {\n        const operationId = match[2] === \"extend\" ? \"extend_delivery\" : match[2] === \"ack\" ? \"acknowledge_delivery\" : \"negative_acknowledge_delivery\";\n        await authorize(operationId);\n        const rawInput = await requestBody();\n        const protocolVersion = String(response.getHeader(PROTOCOL_HEADER) ?? PROTOCOL_VERSION);\n        const input = pathBoundInput(operationId, match[1]!, rawInput, protocolVersion);\n        active(abort.signal);\n        await authority?.beginDomainWork(); mutationStarted = true;\n        const [, id, action] = match;\n        const result = action === \"extend\"\n          ? await service.extend(principal, id, input.leaseToken as string, input.leaseMs as number)\n          : action === \"ack\"\n            ? await service.ack(principal, id, input.leaseToken as string)\n            : await service.nack(\n                principal,\n                id,\n                input.leaseToken as string,\n                (input.error as string | undefined) ?? \"negative acknowledgment\",\n                (input.disposition ?? input.dead ?? \"retry\") as \"retry\" | \"dead\" | boolean,\n                input.retryPolicy,\n              );\n        if (!result) failure(response, 409, \"lease_conflict\", requestId);\n        else sendOperation(response, 200, operationId, { delivery: result }, requestId);\n        return;\n      }\n      failure(response, 404, \"not_found\", requestId);\n    };\n    void dispatch().catch((error: any) => {\n      if (res.writableEnded) return;\n      metrics.errors += 1;\n      if (error instanceof ContractValidationError || error instanceof ContractResponseError) {\n        failure(res, error.status, error.code, requestId, { operation: error.operation, issues: error.issues });\n      } else if (error?.status === 426) {\n        failure(res, 426, error.code, requestId, { supportedProtocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS] });\n      } else if (error?.code === \"insufficient_scope\") {\n        failure(res, 403, error.code, requestId, { details: { requiredScopes: [...error.requiredScopes] } });\n      } else if (error?.code === \"rate_limited\") {\n        res.setHeader(\"retry-after\", String(error.retryAfterSeconds));\n        failure(res, 429, error.code, requestId, { details: { retryAfterSeconds: error.retryAfterSeconds } });\n      } else if (error instanceof BridgeValidationError || error instanceof BridgePrincipalMismatchError) {\n        failure(res, \"status\" in error ? error.status : 400, error.code, requestId, { message: error.message });\n      } else {\n        failure(res, error?.status ?? 500, error?.code ?? \"internal_error\", requestId);\n      }\n    }).finally(() => clearTimeout(timer));\n  });\n}\n","import { createHash, timingSafeEqual } from \"node:crypto\";\nimport type { BridgePrincipal } from \"./bridge-domain.js\";\nimport type { AuthorizationScope } from \"./contracts/registry.js\";\nimport type { PgQueryable } from \"./postgres-bridge-store.js\";\n\nexport interface AuthenticatedCredential {\n  id: string;\n  principal: BridgePrincipal;\n  /** Canonical authorization scopes granted to this credential. */\n  scopes: readonly AuthorizationScope[];\n}\n\nexport interface CredentialResolver {\n  resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null>;\n}\n\nexport function hashCredential(token: string): string {\n  return createHash(\"sha256\").update(token, \"utf8\").digest(\"hex\");\n}\n\nexport class PostgresCredentialResolver implements CredentialResolver {\n  constructor(private readonly db: PgQueryable) {}\n\n  async resolve(token: string, signal?: AbortSignal): Promise<AuthenticatedCredential | null> {\n    if (signal?.aborted) throw signal.reason;\n    const result = await this.db.query<{\n      credential_id: string; workspace_id: string; principal: string; scopes: AuthorizationScope[];\n    }>(\n      `SELECT credential_id,workspace_id,principal,scopes\n       FROM agent_bridge.resolve_credential_hash($1::text)`,\n      [hashCredential(token)],\n    );\n    const row = result.rows[0];\n    if (signal?.aborted) throw signal.reason;\n    return row ? {\n      id: row.credential_id,\n      principal: { workspace: row.workspace_id, agent: row.principal },\n      scopes: row.scopes,\n    } : null;\n  }\n}\n\nexport function bearerToken(value: string | undefined): string | null {\n  if (!value?.startsWith(\"Bearer \")) return null;\n  const token = value.slice(7);\n  if (!token || token.length > 4096 || /\\s/.test(token)) return null;\n  return token;\n}\n\nexport function safeTokenHashEqual(token: string, expectedHash: string): boolean {\n  const actual = Buffer.from(hashCredential(token));\n  const expected = Buffer.from(expectedHash);\n  return actual.length === expected.length && timingSafeEqual(actual, expected);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,oBAA+D;;;ACDxE,SAAS,YAAY,uBAAuB;AAgBrC,SAAS,eAAe,OAAuB;AACpD,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,MAAM,EAAE,OAAO,KAAK;AAChE;AAEO,IAAM,6BAAN,MAA+D;AAAA,EACpE,YAA6B,IAAiB;AAAjB;AAAA,EAAkB;AAAA,EAE/C,MAAM,QAAQ,OAAe,QAA+D;AAC1F,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,UAAM,SAAS,MAAM,KAAK,GAAG;AAAA,MAG3B;AAAA;AAAA,MAEA,CAAC,eAAe,KAAK,CAAC;AAAA,IACxB;AACA,UAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAI,QAAQ,QAAS,OAAM,OAAO;AAClC,WAAO,MAAM;AAAA,MACX,IAAI,IAAI;AAAA,MACR,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,IAAI,UAAU;AAAA,MAC/D,QAAQ,IAAI;AAAA,IACd,IAAI;AAAA,EACN;AACF;AAEO,SAAS,YAAY,OAA0C;AACpE,MAAI,CAAC,OAAO,WAAW,SAAS,EAAG,QAAO;AAC1C,QAAM,QAAQ,MAAM,MAAM,CAAC;AAC3B,MAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,KAAK,KAAK,KAAK,EAAG,QAAO;AAC9D,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAe,cAA+B;AAC/E,QAAM,SAAS,OAAO,KAAK,eAAe,KAAK,CAAC;AAChD,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,SAAO,OAAO,WAAW,SAAS,UAAU,gBAAgB,QAAQ,QAAQ;AAC9E;;;ADbA,IAAM,cAAc,EAAE,gBAAgB,mCAAmC,iBAAiB,WAAW;AAUrG,IAAM,mBAAN,MAAiD;AAAA,EAM/C,YAA6B,QAAwB;AAAxB;AAL7B,SAAiB,UAAU,oBAAI,IAAiD;AAAA,EAK1B;AAAA,EACtD,IAAI,gBAAyB;AAAE,WAAO,KAAK,SAAS;AAAA,EAAW;AAAA,EAC/D,UAAU,MAAc;AAAE,WAAO,KAAK,QAAQ,IAAI,KAAK,YAAY,CAAC,KAAK,KAAK,OAAO,UAAU,IAAI;AAAA,EAAG;AAAA,EACtG,UAAU,MAAc,OAA4C;AAAE,SAAK,QAAQ,IAAI,KAAK,YAAY,GAAG,KAAK;AAAG,WAAO;AAAA,EAAM;AAAA,EAChI,UAAU,QAAgB,SAAe;AACvC,SAAK,SAAS;AACd,SAAK,cAAc;AACnB,WAAO;AAAA,EACT;AAAA,EACA,IAAI,OAAa;AAAE,SAAK,OAAO,SAAS;AAAM,WAAO;AAAA,EAAM;AAAA,EAC3D,QAAc;AACZ,QAAI,KAAK,OAAO,cAAe;AAC/B,eAAW,CAAC,MAAM,KAAK,KAAK,KAAK,QAAS,MAAK,OAAO,UAAU,MAAM,KAAK;AAC3E,QAAI,KAAK,WAAW,OAAW,MAAK,OAAO,UAAU,KAAK,QAAQ,KAAK,WAAW;AAClF,QAAI,KAAK,SAAS,OAAW,MAAK,OAAO,IAAI,KAAK,IAAI;AAAA,EACxD;AACF;AAEA,SAAS,KAAK,KAAqB,QAAgB,OAAgB,WAAyB;AAC1F,MAAI,IAAI,cAAe;AACvB,MAAI,UAAU,QAAQ;AAAA,IACpB,GAAG;AAAA,IACH,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,IAAI,KAAK,UAAU,KAAK,CAAC;AAC/B;AAEA,SAAS,cAAc,KAAqB,QAAgB,WAAmB,OAAgB,WAAyB;AACtH,QAAM,YAAY,cAAc,WAAW,KAAK;AAChD,QAAM,kBAAkB,OAAO,IAAI,UAAU,eAAe,KAAK,gBAAgB;AACjF,MAAI,oBAAoB,yBAAyB;AAC/C,SAAK,KAAK,QAAQ,WAAW,SAAS;AACtC;AAAA,EACF;AACA,MAAI,cAAc,kBAAkB;AAClC,SAAK,KAAK,QAAQ,UAAU,aAAa,OAAO,OAAO,WAAW,SAAS;AAC3E;AAAA,EACF;AACA,MAAI,CAAC,mBAAmB,oBAAoB,mBAAmB,wBAAwB,+BAA+B,EAAE,SAAS,SAAS,GAAG;AAC3I,SAAK,KAAK,QAAQ,UAAU,UAAU,SAAS;AAC/C;AAAA,EACF;AACA,OAAK,KAAK,QAAQ,WAAW,SAAS;AACxC;AAEA,SAAS,QACP,KACA,QACA,MACA,WACA,UAAmC,CAAC,GAC9B;AACN,OAAK,KAAK,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,GAAG,QAAQ,EAAE,GAAG,SAAS;AACzE;AAEA,eAAe,KACb,KACA,OACA,QAC8B;AAC9B,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAmB,CAAC;AAC1B,QAAI,OAAO;AACX,UAAM,UAAU,MAAM;AACpB,UAAI,IAAI,QAAQ,MAAM;AACtB,UAAI,IAAI,OAAO,KAAK;AACpB,UAAI,IAAI,SAAS,OAAO;AACxB,aAAO,oBAAoB,SAAS,OAAO;AAAA,IAC7C;AACA,UAAM,SAAS,CAAC,aAAyB;AACvC,cAAQ;AACR,eAAS;AAAA,IACX;AACA,UAAM,SAAS,CAAC,UAA2B;AACzC,YAAM,SAAS,OAAO,KAAK,KAAK;AAChC,cAAQ,OAAO;AACf,UAAI,OAAO,OAAO;AAChB,eAAO,MAAM,OAAO,OAAO,OAAO,IAAI,MAAM,gBAAgB,GAAG;AAAA,UAC7D,QAAQ;AAAA,UACR,MAAM;AAAA,QACR,CAAC,CAAC,CAAC;AACH,YAAI,OAAO;AACX;AAAA,MACF;AACA,aAAO,KAAK,MAAM;AAAA,IACpB;AACA,UAAM,QAAQ,MAAM,OAAO,MAAM;AAC/B,UAAI,CAAC,MAAM;AACT,gBAAQ,CAAC,CAAC;AACV;AAAA,MACF;AACA,UAAI;AACF,cAAM,SAAS,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAChE,YAAI,CAAC,UAAU,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,SAAU,OAAM,IAAI,MAAM;AACpF,gBAAQ,MAAM;AAAA,MAChB,QAAQ;AACN,eAAO,OAAO,OAAO,IAAI,MAAM,cAAc,GAAG,EAAE,QAAQ,KAAK,MAAM,iBAAiB,CAAC,CAAC;AAAA,MAC1F;AAAA,IACF,CAAC;AACD,UAAM,UAAU,CAAC,UAAiB,OAAO,MAAM,OAAO,KAAK,CAAC;AAC5D,UAAM,UAAU,MAAM;AACpB,aAAO,MAAM,OAAO,OAAO,MAAM,CAAC;AAClC,UAAI,OAAO;AAAA,IACb;AACA,QAAI,GAAG,QAAQ,MAAM;AACrB,QAAI,GAAG,OAAO,KAAK;AACnB,QAAI,GAAG,SAAS,OAAO;AACvB,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,QAAI,OAAO,QAAS,SAAQ;AAAA,EAC9B,CAAC;AACH;AAEA,eAAe,SACb,KACA,OACA,QAC8B;AAC9B,MAAI,eAAe,GAAG,KAAK,IAAI,QAAQ,cAAc,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,MAAM,oBAAoB;AAC/F,UAAM,OAAO,OAAO,IAAI,MAAM,wBAAwB,GAAG;AAAA,MACvD,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,KAAK,KAAK,OAAO,MAAM;AAChC;AAEA,SAAS,YAAY,OAAsB,MAAkC;AAC3E,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,CAAC,OAAO,cAAc,MAAM,EAAG,OAAM,IAAI,sBAAsB,GAAG,IAAI,aAAa;AACvF,SAAO;AACT;AAEA,SAAS,aAAa,OAAsB,MAAmC;AAC7E,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,UAAU,OAAQ,QAAO;AAC7B,MAAI,UAAU,QAAS,QAAO;AAC9B,QAAM,IAAI,sBAAsB,GAAG,IAAI,wBAAwB;AACjE;AAEA,SAAS,eAAe,KAA+B;AACrD,QAAM,SAAS,IAAI,QAAQ,gBAAgB;AAC3C,SAAO,IAAI,QAAQ,mBAAmB,MAAM,UAAc,WAAW,UAAa,WAAW;AAC/F;AAEA,SAAS,eACP,WACA,YACA,UACA,iBACyB;AACzB,MAAI,OAAO,UAAU,eAAe,KAAK,UAAU,YAAY,GAAG;AAChE,UAAM,IAAI,wBAAwB,WAAW,CAAC,EAAE,MAAM,eAAe,SAAS,6CAA6C,CAAC,CAAC;AAAA,EAC/H;AACA,QAAM,QAAQ,EAAE,GAAG,UAAU,WAAW;AACxC,SAAO,kBACH,2BAA2B,WAAW,OAAO,eAAe,IAC5D,gBAAgB,WAAW,KAAK;AACtC;AAEA,SAAS,OAAO,QAA2B;AACzC,MAAI,OAAO,QAAS,OAAM,OAAO;AACnC;AAEA,SAAS,YAAY,KAAU,WAAmB,SAAkC;AAClF,QAAM,UAAU,CAAC,GAAG,IAAI,aAAa,KAAK,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,SAAS,GAAG,CAAC;AACjF,MAAI,QAAS,OAAM,IAAI,wBAAwB,WAAW,CAAC,EAAE,MAAM,IAAI,OAAO,IAAI,SAAS,6BAA6B,CAAC,CAAC;AAC5H;AAEA,SAAS,iBAAiB,KAA6B;AACrD,SAAO,OAAO,IAAI,UAAU,eAAe,KAAK,gBAAgB;AAClE;AAEA,SAAS,uBAAuB,KAA2B;AACzD,MAAI,iBAAiB,GAAG,MAAM,yBAAyB;AACrD,UAAM,QAAQ,IAAI,MAAM,4CAA4C;AACpE,UAAM,SAAS;AACf,UAAM,OAAO;AACb,UAAM;AAAA,EACR;AACF;AAEO,SAAS,cAAc,SAAyB;AACrD,QAAM,UAAmB,EAAE,UAAU,GAAG,QAAQ,GAAG,UAAU,GAAG,cAAc,EAAE;AAChF,QAAM,QAAQ,QAAQ,kBAAkB,MAAM;AAC9C,QAAM,WAAW,QAAQ,qBAAqB;AAC9C,QAAM,UAAU,IAAI,IAAI,QAAQ,kBAAkB,CAAC,CAAC;AAEpD,SAAO,aAAa,CAAC,KAAK,QAAQ;AAChC,UAAM,YAAY,WAAW;AAC7B,UAAM,QAAQ,IAAI,gBAAgB;AAClC,QAAI,kBAAkB;AACtB,YAAQ,YAAY;AACpB,UAAM,oBAAoB,IAAI,QAAQ,eAAe;AACrD,UAAM,uBAAuB,MAAM,QAAQ,iBAAiB,IAAI,kBAAkB,CAAC,IAAI;AACvF,UAAM,kBAAkB,yBAAyB,UAAa,qBAAqB,KAAK,MAAM,KAC1F,0BACC,4BAAkD,SAAS,qBAAqB,KAAK,CAAC,IACrF,qBAAqB,KAAK,IAC1B;AACN,QAAI,UAAU,iBAAiB,eAAe;AAC9C,QAAI,UAAU,2BAA2B,4BAA4B,KAAK,GAAG,CAAC;AAC9E,UAAM,QAAQ,WAAW,MAAM;AAC7B,YAAM,MAAM,IAAI,MAAM,2BAA2B,CAAC;AAClD,cAAQ,YAAY;AAAG,cAAQ,UAAU;AACzC,UAAI,KAAK,UAAU,MAAM;AACvB,YAAI,CAAC,IAAI,SAAU,KAAI,QAAQ;AAAA,MACjC,CAAC;AACD;AAAA,QACE;AAAA,QACA;AAAA,QACA,kBAAkB,6BAA6B;AAAA,QAC/C;AAAA,MACF;AAAA,IACF,GAAG,QAAQ;AACX,QAAI;AACJ,UAAM,cAAc,MAAM,4BAAe,SAAS,KAAK,OAAO,MAAM,MAAM;AAE1E,UAAM,WAAW,OAAO,WAAqC,WAA2B,QAAuB;AAC7G,YAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,wBAAwB;AAC5D,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,WAAW;AACtD,YAAI,QAAQ;AACZ,YAAI;AACF,kBAAQ,OAAO,QAAQ,QAAQ,KAAK,QAAQ,MAAM,WAAW,EAAE,KAAK,MAAM,IAAI;AAAA,QAChF,QAAQ;AACN,kBAAQ;AAAA,QACV;AACA,aAAK,UAAU,QAAQ,MAAM,KAAK,EAAE,QAAQ,QAAQ,UAAU,YAAY,GAAG,SAAS;AACtF;AAAA,MACF;AACA,YAAM,SAAS,IAAI,QAAQ;AAC3B,UAAI,UAAU,CAAC,QAAQ,IAAI,MAAM,GAAG;AAClC,gBAAQ,UAAU,KAAK,oBAAoB,SAAS;AAAG;AAAA,MACzD;AACA,YAAM,QAAQ,YAAY,IAAI,QAAQ,aAAa;AACnD,UAAI,QAAQ,oBAAoB,CAAC,WAAW;AAC1C,YAAI,CAAC,OAAO;AACV,kBAAQ,gBAAgB;AACxB,kBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,QACrD;AACA,cAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ,OAAO,MAAM,MAAM;AACvE,eAAO,MAAM,MAAM;AACnB,YAAI,CAAC,WAAW;AACd,kBAAQ,gBAAgB;AACxB,kBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,QACrD;AACA,YAAI,eAAe,GAAG,EAAG,OAAM,YAAY;AAC3C,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,IAAI,iBAAiB,GAAG;AACzC,cAAM,QAAQ,iBAAkB;AAAA,UAC9B,UAAU;AAAA,UACV,eAAe,KAAK;AAAA,UACpB;AAAA,UACA,MAAM;AAAA,UACN,CAAC,YAAY,SAAS,SAAS,QAAQ;AAAA,QACzC;AACA,eAAO,MAAM,MAAM;AACnB,iBAAS,MAAM;AACf;AAAA,MACF;AACA,YAAM,aAAa,WAAW,eAAe,QAAQ,MAAM,QAAQ,YAAY,QAAQ,OAAO,MAAM,MAAM,IAAI;AAC9G,aAAO,MAAM,MAAM;AACnB,UAAI,CAAC,YAAY;AACf,gBAAQ,gBAAgB;AACxB,gBAAQ,UAAU,KAAK,gBAAgB,SAAS;AAAG;AAAA,MACrD;AACA,UAAI,CAAC,MAAM,QAAQ,WAAW,MAAM,GAAG;AACrC,gBAAQ,UAAU,KAAK,wBAAwB,SAAS;AAAG;AAAA,MAC7D;AACA,YAAM,UAAU,IAAI,cAAc,WAAW,SAAS,QAAQ,KAAK;AACnE,YAAM,WAAW,WAAW,YAAY,QAAQ;AAChD,UAAI,IAAI,SAAS,WAAW,MAAM,KAAK,IAAI,aAAa,YAAY;AAClE,iBAAS,UAAU,iBAAiB,yBAAyB,IAAI,QAAQ,eAAe,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,YAAY,OAAO,gBAA4C;AACnE,cAAM,iBAAiB,kBAAkB,WAAW,EAAE;AACtD,YAAI,eAAe,KAAK,CAAC,UAAU,CAAC,WAAW,OAAO,SAAS,KAAK,CAAC,GAAG;AACtE,cAAI;AACF,kBAAM,SAAS,kBAAkB,WAAW,IAAI,aAAa,WAAW,MAAM,MAAM;AAAA,UACtF,QAAQ;AACN,kBAAM,OAAO,OAAO,IAAI,MAAM,mCAAmC,GAAG;AAAA,cAClE,QAAQ;AAAA,cACR,MAAM;AAAA,YACR,CAAC;AAAA,UACH;AACA,gBAAM,OAAO,OAAO,IAAI,MAAM,mCAAmC,GAAG;AAAA,YAClE,QAAQ;AAAA,YAAK,MAAM;AAAA,YAAsB;AAAA,UAC3C,CAAC;AAAA,QACH;AACA,YAAI;AACJ,YAAI;AACF,qBAAW,MAAM,SAAS,QAAQ,WAAW,IAAI,aAAa,WAAW,MAAM,MAAM;AAAA,QACvF,QAAQ;AACN,gBAAM,OAAO,OAAO,IAAI,MAAM,iCAAiC,GAAG;AAAA,YAChE,QAAQ;AAAA,YACR,MAAM;AAAA,UACR,CAAC;AAAA,QACH;AACA,YAAI,CAAC,SAAS,SAAS;AACrB,gBAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,SAAS,iBAAiB,CAAC;AACpE,mBAAS,UAAU,eAAe,OAAO,UAAU,CAAC;AACpD,gBAAM,OAAO,OAAO,IAAI,MAAM,gCAAgC,GAAG;AAAA,YAC/D,QAAQ;AAAA,YAAK,MAAM;AAAA,YAAgB,mBAAmB;AAAA,UACxD,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,YAAY;AACvD,cAAM,UAAU,iBAAiB;AACjC,wBAAgB,mBAAmB,CAAC,CAAC;AACrC,cAAM,SAAS,OAAO,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,wBAAwB,GAAG,UAAU,KAAK,EAAE,EAAE,KAAK,IAAI,IAAI;AACxH,sBAAc,mBAAmB,MAAM;AACvC,iBAAS,UAAU,KAAK;AAAA,UACtB,GAAG;AAAA,UACH,gBAAgB;AAAA,UAChB,gBAAgB;AAAA,QAClB,CAAC;AACD,iBAAS,IAAI,MAAM;AACnB;AAAA,MACF;AACA,YAAM,iBAAiB,IAAI,QAAQ,yBAAyB;AAC5D,YAAM,YAAY;AAAA,QAChB,GAAG,WAAW;AAAA,QACd,UAAU,MAAM,QAAQ,cAAc,IAAI,eAAe,CAAC,IAAI;AAAA,MAChE;AAEA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,oBAAoB;AAC/D,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,cAAc;AAC9B,oBAAY,KAAK,gBAAgB,CAAC,CAAC;AACnC,wBAAgB,gBAAgB,CAAC,CAAC;AAClC,YAAI,eAAe;AACnB,YAAI,QAAQ,oBAAoB,QAAQ,mBAAmB;AACzD,cAAI;AACF,2BAAe,MAAM,QAAQ,kBAAkB;AAAA,UACjD,QAAQ;AACN,2BAAe;AAAA,UACjB;AAAA,QACF;AACA,sBAAc,UAAU,KAAK,gBAAgB;AAAA,UAC3C,GAAG,mBAAmB;AAAA,YACpB,SAAS;AAAA,YACT,UAAU;AAAA,YACV,yBAAyB,OAAO,SAAS,UAAU,eAAe,CAAC;AAAA,YACnE,kBAAkB,QAAQ,QAAQ,gBAAgB;AAAA,YAClD;AAAA,UACF,CAAC;AAAA,UACD,eAAe,CAAC,GAAG,WAAW,MAAM;AAAA,QACtC,GAAG,SAAS;AAAG;AAAA,MACjB;AAEA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,cAAc;AACzD,cAAM,UAAU,QAAQ;AACxB,oBAAY,KAAK,UAAU,CAAC,CAAC;AAC7B,wBAAgB,UAAU,CAAC,CAAC;AAC5B,cAAM,cAAc,WAAW,SAAS,QAAQ;AAChD,cAAM,mBAAmB,aAAa,SAAS,UAAU,eAAe,MAAM,mBAAmB;AAAA,UAC/F,oBAAoB,UAAU;AAAA,UAC9B,cAAc,UAAU,WAAW;AAAA,QACrC,IAAI,CAAC;AACL,YAAI,CAAC,YAAY,aAAa;AAC5B,wBAAc,UAAU,KAAK,UAAU,EAAE,eAAe,eAAe,mBAAmB,OAAO,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM,MAAM,MAAM,GAAG,kBAAkB,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QAC9N,OAAO;AACL,wBAAc,UAAU,KAAK,UAAU,EAAE,GAAG,MAAM,YAAY,YAAY,SAAS,GAAG,GAAG,kBAAkB,WAAW,WAAW,UAAU,GAAG,SAAS;AAAA,QACzJ;AACA;AAAA,MACF;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,qCAAqC;AACjF,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,oCAAoC;AACpD,cAAM,QAAQ,2BAA2B,sCAAsC,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAC9H,YAAI,CAAC,WAAW,4BAA6B,OAAM,OAAO,OAAO,IAAI,MAAM,yDAAyD,GAAG,EAAE,QAAQ,KAAK,MAAM,uBAAuB,CAAC;AACpL,eAAO,MAAM,MAAM;AACnB,cAAM,UAAU,gBAAgB;AAAG,0BAAkB;AACrD,sBAAc,UAAU,KAAK,sCAAsC,MAAM,UAAU,4BAA4B,MAAM;AAAA,UACnH,WAAW,OAAO,MAAM,SAAS;AAAA,UACjC,4BAA4B,OAAO,MAAM,0BAA0B;AAAA,UACnE,sBAAsB,OAAO,MAAM,oBAAoB;AAAA,QACzD,CAAC,GAAG,SAAS;AAAG;AAAA,MAClB;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,6CAA6C;AACzF,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,sCAAsC;AACtD,cAAM,QAAQ,2BAA2B,wCAAwC,MAAM,YAAY,GAAG,iBAAiB,QAAQ,CAAC;AAChI,YAAI,CAAC,WAAW,4BAA6B,OAAM,OAAO,OAAO,IAAI,MAAM,yDAAyD,GAAG,EAAE,QAAQ,KAAK,MAAM,uBAAuB,CAAC;AACpL,eAAO,MAAM,MAAM;AACnB,cAAM,UAAU,gBAAgB;AAAG,0BAAkB;AACrD,sBAAc,UAAU,KAAK,wCAAwC,MAAM,UAAU,4BAA4B,QAAQ;AAAA,UACvH,WAAW,OAAO,MAAM,SAAS;AAAA,UACjC,4BAA4B,OAAO,MAAM,0BAA0B;AAAA,UACnE,oBAAoB,OAAO,MAAM,kBAAkB;AAAA,QACrD,CAAC,GAAG,SAAS;AAAG;AAAA,MAClB;AAEA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,UAAU,iBAAiB;AACjC,cAAM,QAAQ,2BAA2B,mBAAmB,MAAM,YAAY,GAAG,OAAO,SAAS,UAAU,eAAe,CAAC,CAAC;AAC5H,YAAI,MAAM,WAAW,UAAa,MAAM,WAAW,UAAU,OAAO;AAClE,gBAAM,IAAI,6BAA6B,+CAA+C;AAAA,QACxF;AACA,cAAM,EAAE,QAAQ,SAAS,GAAG,MAAM,IAAI;AACtC,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,mBAAmB,MAAM,QAAQ,QAAQ,WAAW,KAAgC,GAAG,SAAS;AAAG;AAAA,MAClI;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,eAAe;AAC1D,cAAM,UAAU,SAAS;AACzB,oBAAY,KAAK,WAAW,CAAC,UAAU,WAAW,gBAAgB,SAAS,QAAQ,kBAAkB,UAAU,WAAW,SAAS,oBAAoB,cAAc,YAAY,QAAQ,CAAC;AAC1L,cAAM,QAAQ,IAAI,aAAa,OAAO,MAAM;AAC5C,cAAM,QAAQ,2BAA2B,WAAW;AAAA,UAClD,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,UAC5C,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,UACtD,OAAO,YAAY,IAAI,aAAa,IAAI,OAAO,GAAG,OAAO;AAAA,UACzD,OAAO,MAAM,SAAS,QAAQ;AAAA,UAC9B,gBAAgB,aAAa,IAAI,aAAa,IAAI,gBAAgB,GAAG,gBAAgB;AAAA,UACrF,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,UAC1C,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK;AAAA,UAC5C,OAAO,IAAI,aAAa,IAAI,OAAO,KAAK;AAAA,UACxC,kBAAkB,IAAI,aAAa,IAAI,kBAAkB,KAAK,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,UACpG,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,UAC9C,QAAQ,aAAa,IAAI,aAAa,IAAI,QAAQ,GAAG,QAAQ;AAAA,QAC/D,GAAG,OAAO,SAAS,UAAU,eAAe,CAAC,CAAC;AAC9C,sBAAc,UAAU,KAAK,WAAW,MAAM,QAAQ,QAAQ,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MAC/F;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,gBAAgB;AAC5D,cAAM,UAAU,gBAAgB;AAChC,cAAM,QAAQ,gBAAgB,kBAAkB,MAAM,YAAY,CAAC;AACnE,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,kBAAkB,EAAE,UAAU,MAAM,QAAQ,YAAY,WAAW,MAAM,UAAsB,EAAE,GAAG,SAAS;AAAG;AAAA,MAC/I;AACA,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,wBAAwB;AACpE,cAAM,UAAU,gBAAgB;AAChC,cAAM,QAAQ,gBAAgB,kBAAkB,MAAM,YAAY,CAAC;AACnE,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,kBAAkB,MAAM,QAAQ,MAAM,WAAW,KAAK,KAAK,EAAE,UAAU,KAAK,GAAG,SAAS;AAAG;AAAA,MAC1H;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,kBAAkB;AAC7D,+BAAuB,QAAQ;AAC/B,cAAM,UAAU,iBAAiB;AACjC,oBAAY,KAAK,mBAAmB,CAAC,UAAU,SAAS,QAAQ,aAAa,aAAa,OAAO,CAAC;AAClG,cAAM,QAAQ,gBAAgB,mBAAmB,EAAC,QAAO,IAAI,aAAa,IAAI,QAAQ,KAAG,QAAU,OAAM,YAAY,IAAI,aAAa,IAAI,OAAO,GAAE,OAAO,GAAE,MAAK,IAAI,aAAa,IAAI,MAAM,KAAG,QAAU,WAAU,IAAI,aAAa,IAAI,WAAW,KAAG,QAAU,WAAU,IAAI,aAAa,IAAI,WAAW,KAAG,QAAU,QAAO,IAAI,aAAa,OAAO,OAAO,EAAC,CAAC;AAC/V,sBAAc,UAAS,KAAI,mBAAkB,MAAM,QAAQ,WAAW,WAAU,KAAY,GAAE,SAAS;AAAE;AAAA,MAC3G;AACA,YAAM,cAAY,IAAI,SAAS,MAAM,qCAAqC;AAC1E,UAAG,IAAI,WAAS,SAAO,aAAY;AAAC,+BAAuB,QAAQ;AAAE,cAAM,UAAU,sBAAsB;AAAE,oBAAY,KAAI,wBAAuB,CAAC,UAAS,OAAO,CAAC;AAAE,cAAM,QAAM,gBAAgB,wBAAuB,EAAC,YAAW,YAAY,CAAC,GAAE,QAAO,IAAI,aAAa,IAAI,QAAQ,KAAG,QAAU,OAAM,YAAY,IAAI,aAAa,IAAI,OAAO,GAAE,OAAO,EAAC,CAAC;AAAE,sBAAc,UAAS,KAAI,wBAAuB,MAAM,QAAQ,eAAe,WAAU,YAAY,CAAC,GAAG,KAAY,GAAE,SAAS;AAAE;AAAA,MAAO;AAC3e,YAAM,eAAa,IAAI,SAAS,MAAM,+CAA+C;AACrF,UAAG,IAAI,WAAS,UAAQ,cAAa;AAAC,+BAAuB,QAAQ;AAAE,cAAM,YAAU,aAAa,CAAC,MAAI,WAAS,oBAAkB;AAAmB,cAAM,UAAU,SAAS;AAAE,uBAAe,WAAU,aAAa,CAAC,GAAG,MAAM,YAAY,CAAC;AAAE,cAAM,WAAW,gBAAgB;AAAE,0BAAgB;AAAK,cAAM,SAAO,aAAa,CAAC,MAAI,WAAS,MAAM,QAAQ,OAAO,WAAU,aAAa,CAAC,CAAE,IAAE,MAAM,QAAQ,QAAQ,WAAU,aAAa,CAAC,CAAE;AAAE,YAAG,CAAC,OAAO,SAAQ,UAAS,KAAI,aAAY,SAAS;AAAA,YAAO,eAAc,UAAS,KAAI,WAAU,EAAC,UAAS,OAAM,GAAE,SAAS;AAAE;AAAA,MAAO;AACzjB,UAAI,IAAI,WAAW,UAAU,IAAI,aAAa,0BAA0B;AACtE,cAAM,UAAU,WAAW;AAC3B,cAAM,QAAQ,gBAAgB,aAAa,MAAM,YAAY,CAAC;AAC9D,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,sBAAc,UAAU,KAAK,aAAa,MAAM,QAAQ,UAAU,WAAW,KAAK,GAAG,SAAS;AAAG;AAAA,MACnG;AACA,UAAI,IAAI,WAAW,SAAS,IAAI,aAAa,gBAAgB;AAC3D,cAAM,UAAU,UAAU;AAC1B,oBAAY,KAAK,YAAY,CAAC,CAAC;AAC/B,wBAAgB,YAAY,CAAC,CAAC;AAC9B,sBAAc,UAAU,KAAK,YAAY,EAAE,QAAQ,MAAM,QAAQ,SAAS,SAAS,EAAE,GAAG,SAAS;AAAG;AAAA,MACtG;AACA,YAAM,QAAQ,IAAI,SAAS,MAAM,gDAAgD;AACjF,UAAI,IAAI,WAAW,UAAU,OAAO;AAClC,cAAM,cAAc,MAAM,CAAC,MAAM,WAAW,oBAAoB,MAAM,CAAC,MAAM,QAAQ,yBAAyB;AAC9G,cAAM,UAAU,WAAW;AAC3B,cAAM,WAAW,MAAM,YAAY;AACnC,cAAM,kBAAkB,OAAO,SAAS,UAAU,eAAe,KAAK,gBAAgB;AACtF,cAAM,QAAQ,eAAe,aAAa,MAAM,CAAC,GAAI,UAAU,eAAe;AAC9E,eAAO,MAAM,MAAM;AACnB,cAAM,WAAW,gBAAgB;AAAG,0BAAkB;AACtD,cAAM,CAAC,EAAE,IAAI,MAAM,IAAI;AACvB,cAAM,SAAS,WAAW,WACtB,MAAM,QAAQ,OAAO,WAAW,IAAI,MAAM,YAAsB,MAAM,OAAiB,IACvF,WAAW,QACT,MAAM,QAAQ,IAAI,WAAW,IAAI,MAAM,UAAoB,IAC3D,MAAM,QAAQ;AAAA,UACZ;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACL,MAAM,SAAgC;AAAA,UACtC,MAAM,eAAe,MAAM,QAAQ;AAAA,UACpC,MAAM;AAAA,QACR;AACN,YAAI,CAAC,OAAQ,SAAQ,UAAU,KAAK,kBAAkB,SAAS;AAAA,YAC1D,eAAc,UAAU,KAAK,aAAa,EAAE,UAAU,OAAO,GAAG,SAAS;AAC9E;AAAA,MACF;AACA,cAAQ,UAAU,KAAK,aAAa,SAAS;AAAA,IAC/C;AACA,SAAK,SAAS,EAAE,MAAM,CAAC,UAAe;AACpC,UAAI,IAAI,cAAe;AACvB,cAAQ,UAAU;AAClB,UAAI,iBAAiB,2BAA2B,iBAAiB,uBAAuB;AACtF,gBAAQ,KAAK,MAAM,QAAQ,MAAM,MAAM,WAAW,EAAE,WAAW,MAAM,WAAW,QAAQ,MAAM,OAAO,CAAC;AAAA,MACxG,WAAW,OAAO,WAAW,KAAK;AAChC,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,2BAA2B,CAAC,GAAG,2BAA2B,EAAE,CAAC;AAAA,MAC1G,WAAW,OAAO,SAAS,sBAAsB;AAC/C,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,gBAAgB,CAAC,GAAG,MAAM,cAAc,EAAE,EAAE,CAAC;AAAA,MACrG,WAAW,OAAO,SAAS,gBAAgB;AACzC,YAAI,UAAU,eAAe,OAAO,MAAM,iBAAiB,CAAC;AAC5D,gBAAQ,KAAK,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,EAAE,mBAAmB,MAAM,kBAAkB,EAAE,CAAC;AAAA,MACtG,WAAW,iBAAiB,yBAAyB,iBAAiB,8BAA8B;AAClG,gBAAQ,KAAK,YAAY,QAAQ,MAAM,SAAS,KAAK,MAAM,MAAM,WAAW,EAAE,SAAS,MAAM,QAAQ,CAAC;AAAA,MACxG,OAAO;AACL,gBAAQ,KAAK,OAAO,UAAU,KAAK,OAAO,QAAQ,kBAAkB,SAAS;AAAA,MAC/E;AAAA,IACF,CAAC,EAAE,QAAQ,MAAM,aAAa,KAAK,CAAC;AAAA,EACtC,CAAC;AACH;","names":[]}

package/dist/chunk-4VB44KJU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/bridge-service.ts"],"sourcesContent":["import {\n  BridgePrincipalMismatchError,\n  BridgeValidationError,\n  encodeCursor,\n  validateMessageDraft,\n  validatePrincipal,\n  validateProject,\n  validateUuid,\n  type BridgeDelivery,\n  type BridgeMessage,\n  type BridgePrincipal,\n  type MessageDraft,\n  type AgentPresence,\n  type DeliveryState,\n} from \"./bridge-domain.js\";\nimport type {\n  BridgeStore,\n  DeliveryQuery,\n  InsertMessageResult,\n  MessagePage,\n  MessageQuery,\n} from \"./bridge-store.js\";\n\nfunction validateDeprecatedMaxAttempts(value: unknown): void {\n  if (value === undefined) return;\n  if (!Number.isSafeInteger(value) || Number(value) < 1 || Number(value) > 100) {\n    throw new BridgeValidationError(\"maxAttempts must be between 1 and 100\");\n  }\n}\n\nfunction validateDeprecatedRetryPolicy(value: unknown): void {\n  if (value === undefined) return;\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    throw new BridgeValidationError(\"retryPolicy must be an object\");\n  }\n  const allowed = new Set([\"maxAttempts\", \"baseDelayMs\", \"maxDelayMs\", \"jitterRatio\"]);\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new BridgeValidationError(`retryPolicy.${key} is not supported`);\n  }\n  const policy = value as Record<string, unknown>;\n  validateDeprecatedMaxAttempts(policy.maxAttempts);\n  for (const [key, maximum] of [[\"baseDelayMs\", 3_600_000], [\"maxDelayMs\", 86_400_000]] as const) {\n    if (policy[key] !== undefined && (!Number.isSafeInteger(policy[key]) || Number(policy[key]) < 1 || Number(policy[key]) > maximum)) {\n      throw new BridgeValidationError(`${key} is invalid`);\n    }\n  }\n  if (policy.jitterRatio !== undefined && (!Number.isFinite(policy.jitterRatio) || Number(policy.jitterRatio) < 0 || Number(policy.jitterRatio) > 1)) {\n    throw new BridgeValidationError(\"jitterRatio must be between 0 and 1\");\n  }\n}\n\nfunction validateLeaseMs(value = 30_000): number {\n  if (!Number.isSafeInteger(value) || value < 1_000 || value > 15 * 60_000) {\n    throw new BridgeValidationError(\"leaseMs must be between 1000 and 900000\");\n  }\n  return value;\n}\n\nexport type PublicMessageQuery = MessageQuery & { unacknowledgedBy?: string };\n\nfunction validateQuery(query: PublicMessageQuery, principal: BridgePrincipal): MessageQuery {\n  const limit = query.limit ?? 50;\n  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) {\n    throw new BridgeValidationError(\"limit must be between 1 and 200\");\n  }\n  if (query.types !== undefined) {\n    if (!Array.isArray(query.types) || query.types.length > 64) {\n      throw new BridgeValidationError(\"types must contain at most 64 entries\");\n    }\n    for (const type of query.types) {\n      if (typeof type !== \"string\" || !type.trim() || type.length > 128) {\n        throw new BridgeValidationError(\"type filter is invalid\");\n      }\n    }\n  }\n  const source = query.source?.trim();\n  if (source !== undefined && (!source || source.length > 128)) {\n    throw new BridgeValidationError(\"source filter is invalid\");\n  }\n  const unacknowledgedBy = query.unacknowledgedBy?.trim();\n  if (\n    unacknowledgedBy !== undefined &&\n    (!unacknowledgedBy || unacknowledgedBy.length > 128)\n  ) {\n    throw new BridgeValidationError(\"unacknowledgedBy filter is invalid\");\n  }\n  if (unacknowledgedBy !== undefined && unacknowledgedBy !== principal.agent) {\n    throw new BridgePrincipalMismatchError(\"unacknowledgedBy must equal the configured principal\");\n  }\n  const mailbox = query.mailbox ?? \"inbox\";\n  if (![\"inbox\", \"sent\", \"all\"].includes(mailbox)) throw new BridgeValidationError(\"mailbox is invalid\");\n  const receiptState = query.receiptState ?? (unacknowledgedBy ? \"unread\" : \"any\");\n  if (![\"any\", \"unread\", \"read\"].includes(receiptState)) throw new BridgeValidationError(\"receiptState is invalid\");\n  if (mailbox !== \"inbox\" && receiptState !== \"any\") {\n    throw new BridgeValidationError(\"receiptState is valid only for inbox\");\n  }\n  let since: string | undefined;\n  if (query.since !== undefined) {\n    const date = new Date(query.since);\n    if (Number.isNaN(date.getTime())) throw new BridgeValidationError(\"since must be an ISO timestamp\");\n    since = date.toISOString();\n  }\n  const threadId = query.threadId?.trim();\n  if (threadId !== undefined && (!threadId || threadId.length > 128)) {\n    throw new BridgeValidationError(\"threadId filter is invalid\");\n  }\n  if (query.latest && query.cursor) {\n    throw new BridgeValidationError(\"latest cannot be combined with cursor\");\n  }\n  const { unacknowledgedBy: _compat, ...storeQuery } = query;\n  return { ...storeQuery, mailbox, receiptState, project: validateProject(query.project), limit, source, since, threadId, latest: query.latest === true };\n}\n\nexport class BridgeService {\n  constructor(private readonly store: BridgeStore) {}\n\n  async publish(\n    principalInput: BridgePrincipal,\n    draftInput: MessageDraft,\n  ): Promise<InsertMessageResult> {\n    const principal = validatePrincipal(principalInput);\n    const draft = validateMessageDraft(draftInput);\n    return this.store.insertMessage({\n      ...draft,\n      workspace: principal.workspace,\n      source: principal.agent,\n    });\n  }\n\n  async history(\n    principalInput: BridgePrincipal,\n    query: PublicMessageQuery = {},\n  ): Promise<MessagePage> {\n    const principal = validatePrincipal(principalInput);\n    return this.store.listMessages(principal, validateQuery(query, principal));\n  }\n\n  async acknowledge(principalInput: BridgePrincipal, messageIds: string[]): Promise<number> {\n    const principal = validatePrincipal(principalInput);\n    if (!Array.isArray(messageIds) || !messageIds.length || messageIds.length > 200) {\n      throw new BridgeValidationError(\"messageIds must contain between 1 and 200 entries\");\n    }\n    const ids = messageIds.map((id) => validateUuid(id, \"messageId\"));\n    return this.store.recordReceipt(principal, ids);\n  }\n\n  async claim(\n    principalInput: BridgePrincipal,\n    options: { leaseMs?: number; maxAttempts?: number } = {},\n  ): Promise<{ delivery: BridgeDelivery; leaseToken: string } | null> {\n    const principal = validatePrincipal(principalInput);\n    validateDeprecatedMaxAttempts(options.maxAttempts);\n    const delivery = await this.store.claimDelivery(principal, {\n      leaseMs: validateLeaseMs(options.leaseMs),\n    });\n    return delivery?.leaseToken ? { delivery, leaseToken: delivery.leaseToken } : null;\n  }\n\n  async extend(\n    principalInput: BridgePrincipal,\n    deliveryId: string,\n    leaseToken: string,\n    leaseMs = 30_000,\n  ): Promise<BridgeDelivery | null> {\n    const principal = validatePrincipal(principalInput);\n    return this.store.renewDelivery(\n      principal,\n      validateUuid(deliveryId, \"deliveryId\"),\n      validateUuid(leaseToken, \"leaseToken\"),\n      validateLeaseMs(leaseMs),\n    );\n  }\n\n  async ack(\n    principalInput: BridgePrincipal,\n    deliveryId: string,\n    leaseToken: string,\n  ): Promise<BridgeDelivery | null> {\n    const principal = validatePrincipal(principalInput);\n    return this.store.settleDelivery(\n      principal,\n      validateUuid(deliveryId, \"deliveryId\"),\n      validateUuid(leaseToken, \"leaseToken\"),\n      \"acked\",\n      undefined,\n    );\n  }\n\n  async nack(\n    principalInput: BridgePrincipal,\n    deliveryId: string,\n    leaseToken: string,\n    error: string,\n    disposition: \"retry\" | \"dead\" | boolean = \"retry\",\n    deprecatedRetryPolicy?: unknown,\n  ): Promise<BridgeDelivery | null> {\n    const principal = validatePrincipal(principalInput);\n    if (![\"retry\", \"dead\", true, false].includes(disposition as never)) {\n      throw new BridgeValidationError(\"disposition must be retry or dead\");\n    }\n    if (typeof error !== \"string\" || !error.trim()) {\n      throw new BridgeValidationError(\"error is required\");\n    }\n    validateDeprecatedRetryPolicy(deprecatedRetryPolicy);\n    return this.store.settleDelivery(\n      principal,\n      validateUuid(deliveryId, \"deliveryId\"),\n      validateUuid(leaseToken, \"leaseToken\"),\n      disposition === \"dead\" || disposition === true ? \"dead\" : \"retrying\",\n      error.slice(0, 1_024),\n    );\n  }\n\n  async deliveries(principalInput: BridgePrincipal, query: DeliveryQuery = {}) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.listDeliveries) throw new BridgeValidationError(\"delivery listing is not supported by this provider\");\n    const limit = query.limit ?? 50;\n    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new BridgeValidationError(\"limit must be between 1 and 200\");\n    const role = query.role ?? \"all\";\n    if (![\"recipient\", \"publisher\", \"all\"].includes(role)) throw new BridgeValidationError(\"role is invalid\");\n    const validStates: DeliveryState[] = [\"pending\", \"claimed\", \"acked\", \"retrying\", \"dead\", \"cancelled\"];\n    if (query.states !== undefined && (!Array.isArray(query.states) || query.states.some((state) => !validStates.includes(state)))) {\n      throw new BridgeValidationError(\"states contains an invalid delivery state\");\n    }\n    const recipient = query.recipient?.trim();\n    if (recipient !== undefined && (!recipient || recipient.length > 128)) throw new BridgeValidationError(\"recipient is invalid\");\n    return this.store.listDeliveries(principal, {\n      ...query,\n      role,\n      limit,\n      messageId: query.messageId ? validateUuid(query.messageId, \"messageId\") : undefined,\n      recipient,\n      states: query.states ? [...new Set(query.states)].sort() : undefined,\n    });\n  }\n\n  async deliveryEvents(principalInput: BridgePrincipal, deliveryId: string, query: { cursor?: string; limit?: number } = {}) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.listDeliveryEvents) throw new BridgeValidationError(\"delivery event listing is not supported by this provider\");\n    const limit = query.limit ?? 50;\n    if (!Number.isSafeInteger(limit) || limit < 1 || limit > 200) throw new BridgeValidationError(\"limit must be between 1 and 200\");\n    return this.store.listDeliveryEvents(principal, validateUuid(deliveryId, \"deliveryId\"), { ...query, limit });\n  }\n\n  async cancel(principalInput: BridgePrincipal, deliveryId: string) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.cancelDelivery) throw new BridgeValidationError(\"delivery cancellation is not supported by this provider\");\n    return this.store.cancelDelivery(principal, validateUuid(deliveryId, \"deliveryId\"));\n  }\n\n  async requeue(principalInput: BridgePrincipal, deliveryId: string) {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.requeueDelivery) throw new BridgeValidationError(\"delivery requeue is not supported by this provider\");\n    return this.store.requeueDelivery(principal, validateUuid(deliveryId, \"deliveryId\"));\n  }\n\n  async heartbeat(\n    principalInput: BridgePrincipal,\n    options: { leaseMs?: number; runtimeType?: string; capabilities?: string[] } = {},\n  ): Promise<AgentPresence> {\n    const principal = validatePrincipal(principalInput);\n    if (!principal.instance) throw new BridgeValidationError(\"instance is required for presence\");\n    if (!this.store.heartbeat) throw new BridgeValidationError(\"presence is not supported by this provider\");\n    if (\n      options.runtimeType !== undefined &&\n      typeof options.runtimeType !== \"string\"\n    ) {\n      throw new BridgeValidationError(\"runtimeType must be a string\");\n    }\n    const runtimeType = options.runtimeType?.trim();\n    if (runtimeType && runtimeType.length > 128) throw new BridgeValidationError(\"runtimeType exceeds 128 characters\");\n    if (options.capabilities !== undefined && !Array.isArray(options.capabilities)) {\n      throw new BridgeValidationError(\"capabilities must be an array\");\n    }\n    const capabilities = [...new Set(options.capabilities ?? [])].map((value) => {\n      if (typeof value !== \"string\" || !value.trim() || value.length > 128) throw new BridgeValidationError(\"capability is invalid\");\n      return value.trim();\n    });\n    if (capabilities.length > 64) throw new BridgeValidationError(\"capabilities exceeds 64 entries\");\n    return this.store.heartbeat(principal, validateLeaseMs(options.leaseMs), runtimeType, capabilities);\n  }\n\n  async presence(principalInput: BridgePrincipal): Promise<AgentPresence[]> {\n    const principal = validatePrincipal(principalInput);\n    if (!this.store.listPresence) throw new BridgeValidationError(\"presence is not supported by this provider\");\n    return this.store.listPresence(principal);\n  }\n}\n\nexport { encodeCursor, type BridgeMessage };\n"],"mappings":";;;;;;;;;;;AAuBA,SAAS,8BAA8B,OAAsB;AAC3D,MAAI,UAAU,OAAW;AACzB,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,KAAK,IAAI,KAAK;AAC5E,UAAM,IAAI,sBAAsB,uCAAuC;AAAA,EACzE;AACF;AAEA,SAAS,8BAA8B,OAAsB;AAC3D,MAAI,UAAU,OAAW;AACzB,MAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,sBAAsB,+BAA+B;AAAA,EACjE;AACA,QAAM,UAAU,oBAAI,IAAI,CAAC,eAAe,eAAe,cAAc,aAAa,CAAC;AACnF,aAAW,OAAO,OAAO,KAAK,KAAK,GAAG;AACpC,QAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,OAAM,IAAI,sBAAsB,eAAe,GAAG,mBAAmB;AAAA,EAC9F;AACA,QAAM,SAAS;AACf,gCAA8B,OAAO,WAAW;AAChD,aAAW,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC,eAAe,IAAS,GAAG,CAAC,cAAc,KAAU,CAAC,GAAY;AAC9F,QAAI,OAAO,GAAG,MAAM,WAAc,CAAC,OAAO,cAAc,OAAO,GAAG,CAAC,KAAK,OAAO,OAAO,GAAG,CAAC,IAAI,KAAK,OAAO,OAAO,GAAG,CAAC,IAAI,UAAU;AACjI,YAAM,IAAI,sBAAsB,GAAG,GAAG,aAAa;AAAA,IACrD;AAAA,EACF;AACA,MAAI,OAAO,gBAAgB,WAAc,CAAC,OAAO,SAAS,OAAO,WAAW,KAAK,OAAO,OAAO,WAAW,IAAI,KAAK,OAAO,OAAO,WAAW,IAAI,IAAI;AAClJ,UAAM,IAAI,sBAAsB,qCAAqC;AAAA,EACvE;AACF;AAEA,SAAS,gBAAgB,QAAQ,KAAgB;AAC/C,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,OAAS,QAAQ,KAAK,KAAQ;AACxE,UAAM,IAAI,sBAAsB,yCAAyC;AAAA,EAC3E;AACA,SAAO;AACT;AAIA,SAAS,cAAc,OAA2B,WAA0C;AAC1F,QAAM,QAAQ,MAAM,SAAS;AAC7B,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK;AAC5D,UAAM,IAAI,sBAAsB,iCAAiC;AAAA,EACnE;AACA,MAAI,MAAM,UAAU,QAAW;AAC7B,QAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,MAAM,MAAM,SAAS,IAAI;AAC1D,YAAM,IAAI,sBAAsB,uCAAuC;AAAA,IACzE;AACA,eAAW,QAAQ,MAAM,OAAO;AAC9B,UAAI,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,KAAK,KAAK,SAAS,KAAK;AACjE,cAAM,IAAI,sBAAsB,wBAAwB;AAAA,MAC1D;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,QAAQ,KAAK;AAClC,MAAI,WAAW,WAAc,CAAC,UAAU,OAAO,SAAS,MAAM;AAC5D,UAAM,IAAI,sBAAsB,0BAA0B;AAAA,EAC5D;AACA,QAAM,mBAAmB,MAAM,kBAAkB,KAAK;AACtD,MACE,qBAAqB,WACpB,CAAC,oBAAoB,iBAAiB,SAAS,MAChD;AACA,UAAM,IAAI,sBAAsB,oCAAoC;AAAA,EACtE;AACA,MAAI,qBAAqB,UAAa,qBAAqB,UAAU,OAAO;AAC1E,UAAM,IAAI,6BAA6B,sDAAsD;AAAA,EAC/F;AACA,QAAM,UAAU,MAAM,WAAW;AACjC,MAAI,CAAC,CAAC,SAAS,QAAQ,KAAK,EAAE,SAAS,OAAO,EAAG,OAAM,IAAI,sBAAsB,oBAAoB;AACrG,QAAM,eAAe,MAAM,iBAAiB,mBAAmB,WAAW;AAC1E,MAAI,CAAC,CAAC,OAAO,UAAU,MAAM,EAAE,SAAS,YAAY,EAAG,OAAM,IAAI,sBAAsB,yBAAyB;AAChH,MAAI,YAAY,WAAW,iBAAiB,OAAO;AACjD,UAAM,IAAI,sBAAsB,sCAAsC;AAAA,EACxE;AACA,MAAI;AACJ,MAAI,MAAM,UAAU,QAAW;AAC7B,UAAM,OAAO,IAAI,KAAK,MAAM,KAAK;AACjC,QAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,EAAG,OAAM,IAAI,sBAAsB,gCAAgC;AAClG,YAAQ,KAAK,YAAY;AAAA,EAC3B;AACA,QAAM,WAAW,MAAM,UAAU,KAAK;AACtC,MAAI,aAAa,WAAc,CAAC,YAAY,SAAS,SAAS,MAAM;AAClE,UAAM,IAAI,sBAAsB,4BAA4B;AAAA,EAC9D;AACA,MAAI,MAAM,UAAU,MAAM,QAAQ;AAChC,UAAM,IAAI,sBAAsB,uCAAuC;AAAA,EACzE;AACA,QAAM,EAAE,kBAAkB,SAAS,GAAG,WAAW,IAAI;AACrD,SAAO,EAAE,GAAG,YAAY,SAAS,cAAc,SAAS,gBAAgB,MAAM,OAAO,GAAG,OAAO,QAAQ,OAAO,UAAU,QAAQ,MAAM,WAAW,KAAK;AACxJ;AAEO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAA6B,OAAoB;AAApB;AAAA,EAAqB;AAAA,EAElD,MAAM,QACJ,gBACA,YAC8B;AAC9B,UAAM,YAAY,kBAAkB,cAAc;AAClD,UAAM,QAAQ,qBAAqB,UAAU;AAC7C,WAAO,KAAK,MAAM,cAAc;AAAA,MAC9B,GAAG;AAAA,MACH,WAAW,UAAU;AAAA,MACrB,QAAQ,UAAU;AAAA,IACpB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QACJ,gBACA,QAA4B,CAAC,GACP;AACtB,UAAM,YAAY,kBAAkB,cAAc;AAClD,WAAO,KAAK,MAAM,aAAa,WAAW,cAAc,OAAO,SAAS,CAAC;AAAA,EAC3E;AAAA,EAEA,MAAM,YAAY,gBAAiC,YAAuC;AACxF,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,CAAC,WAAW,UAAU,WAAW,SAAS,KAAK;AAC/E,YAAM,IAAI,sBAAsB,mDAAmD;AAAA,IACrF;AACA,UAAM,MAAM,WAAW,IAAI,CAAC,OAAO,aAAa,IAAI,WAAW,CAAC;AAChE,WAAO,KAAK,MAAM,cAAc,WAAW,GAAG;AAAA,EAChD;AAAA,EAEA,MAAM,MACJ,gBACA,UAAsD,CAAC,GACW;AAClE,UAAM,YAAY,kBAAkB,cAAc;AAClD,kCAA8B,QAAQ,WAAW;AACjD,UAAM,WAAW,MAAM,KAAK,MAAM,cAAc,WAAW;AAAA,MACzD,SAAS,gBAAgB,QAAQ,OAAO;AAAA,IAC1C,CAAC;AACD,WAAO,UAAU,aAAa,EAAE,UAAU,YAAY,SAAS,WAAW,IAAI;AAAA,EAChF;AAAA,EAEA,MAAM,OACJ,gBACA,YACA,YACA,UAAU,KACsB;AAChC,UAAM,YAAY,kBAAkB,cAAc;AAClD,WAAO,KAAK,MAAM;AAAA,MAChB;AAAA,MACA,aAAa,YAAY,YAAY;AAAA,MACrC,aAAa,YAAY,YAAY;AAAA,MACrC,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,IACJ,gBACA,YACA,YACgC;AAChC,UAAM,YAAY,kBAAkB,cAAc;AAClD,WAAO,KAAK,MAAM;AAAA,MAChB;AAAA,MACA,aAAa,YAAY,YAAY;AAAA,MACrC,aAAa,YAAY,YAAY;AAAA,MACrC;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,KACJ,gBACA,YACA,YACA,OACA,cAA0C,SAC1C,uBACgC;AAChC,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,CAAC,SAAS,QAAQ,MAAM,KAAK,EAAE,SAAS,WAAoB,GAAG;AAClE,YAAM,IAAI,sBAAsB,mCAAmC;AAAA,IACrE;AACA,QAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,GAAG;AAC9C,YAAM,IAAI,sBAAsB,mBAAmB;AAAA,IACrD;AACA,kCAA8B,qBAAqB;AACnD,WAAO,KAAK,MAAM;AAAA,MAChB;AAAA,MACA,aAAa,YAAY,YAAY;AAAA,MACrC,aAAa,YAAY,YAAY;AAAA,MACrC,gBAAgB,UAAU,gBAAgB,OAAO,SAAS;AAAA,MAC1D,MAAM,MAAM,GAAG,IAAK;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,gBAAiC,QAAuB,CAAC,GAAG;AAC3E,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,eAAgB,OAAM,IAAI,sBAAsB,oDAAoD;AACpH,UAAM,QAAQ,MAAM,SAAS;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAK,OAAM,IAAI,sBAAsB,iCAAiC;AAC/H,UAAM,OAAO,MAAM,QAAQ;AAC3B,QAAI,CAAC,CAAC,aAAa,aAAa,KAAK,EAAE,SAAS,IAAI,EAAG,OAAM,IAAI,sBAAsB,iBAAiB;AACxG,UAAM,cAA+B,CAAC,WAAW,WAAW,SAAS,YAAY,QAAQ,WAAW;AACpG,QAAI,MAAM,WAAW,WAAc,CAAC,MAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,OAAO,KAAK,CAAC,UAAU,CAAC,YAAY,SAAS,KAAK,CAAC,IAAI;AAC9H,YAAM,IAAI,sBAAsB,2CAA2C;AAAA,IAC7E;AACA,UAAM,YAAY,MAAM,WAAW,KAAK;AACxC,QAAI,cAAc,WAAc,CAAC,aAAa,UAAU,SAAS,KAAM,OAAM,IAAI,sBAAsB,sBAAsB;AAC7H,WAAO,KAAK,MAAM,eAAe,WAAW;AAAA,MAC1C,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA,WAAW,MAAM,YAAY,aAAa,MAAM,WAAW,WAAW,IAAI;AAAA,MAC1E;AAAA,MACA,QAAQ,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK,IAAI;AAAA,IAC7D,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,eAAe,gBAAiC,YAAoB,QAA6C,CAAC,GAAG;AACzH,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,mBAAoB,OAAM,IAAI,sBAAsB,0DAA0D;AAC9H,UAAM,QAAQ,MAAM,SAAS;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,IAAK,OAAM,IAAI,sBAAsB,iCAAiC;AAC/H,WAAO,KAAK,MAAM,mBAAmB,WAAW,aAAa,YAAY,YAAY,GAAG,EAAE,GAAG,OAAO,MAAM,CAAC;AAAA,EAC7G;AAAA,EAEA,MAAM,OAAO,gBAAiC,YAAoB;AAChE,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,eAAgB,OAAM,IAAI,sBAAsB,yDAAyD;AACzH,WAAO,KAAK,MAAM,eAAe,WAAW,aAAa,YAAY,YAAY,CAAC;AAAA,EACpF;AAAA,EAEA,MAAM,QAAQ,gBAAiC,YAAoB;AACjE,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,gBAAiB,OAAM,IAAI,sBAAsB,oDAAoD;AACrH,WAAO,KAAK,MAAM,gBAAgB,WAAW,aAAa,YAAY,YAAY,CAAC;AAAA,EACrF;AAAA,EAEA,MAAM,UACJ,gBACA,UAA+E,CAAC,GACxD;AACxB,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,UAAU,SAAU,OAAM,IAAI,sBAAsB,mCAAmC;AAC5F,QAAI,CAAC,KAAK,MAAM,UAAW,OAAM,IAAI,sBAAsB,4CAA4C;AACvG,QACE,QAAQ,gBAAgB,UACxB,OAAO,QAAQ,gBAAgB,UAC/B;AACA,YAAM,IAAI,sBAAsB,8BAA8B;AAAA,IAChE;AACA,UAAM,cAAc,QAAQ,aAAa,KAAK;AAC9C,QAAI,eAAe,YAAY,SAAS,IAAK,OAAM,IAAI,sBAAsB,oCAAoC;AACjH,QAAI,QAAQ,iBAAiB,UAAa,CAAC,MAAM,QAAQ,QAAQ,YAAY,GAAG;AAC9E,YAAM,IAAI,sBAAsB,+BAA+B;AAAA,IACjE;AACA,UAAM,eAAe,CAAC,GAAG,IAAI,IAAI,QAAQ,gBAAgB,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU;AAC3E,UAAI,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK,KAAK,MAAM,SAAS,IAAK,OAAM,IAAI,sBAAsB,uBAAuB;AAC7H,aAAO,MAAM,KAAK;AAAA,IACpB,CAAC;AACD,QAAI,aAAa,SAAS,GAAI,OAAM,IAAI,sBAAsB,iCAAiC;AAC/F,WAAO,KAAK,MAAM,UAAU,WAAW,gBAAgB,QAAQ,OAAO,GAAG,aAAa,YAAY;AAAA,EACpG;AAAA,EAEA,MAAM,SAAS,gBAA2D;AACxE,UAAM,YAAY,kBAAkB,cAAc;AAClD,QAAI,CAAC,KAAK,MAAM,aAAc,OAAM,IAAI,sBAAsB,4CAA4C;AAC1G,WAAO,KAAK,MAAM,aAAa,SAAS;AAAA,EAC1C;AACF;","names":[]}

package/dist/chunk-6BTJE6D4.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/migrations.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readdir, readFile } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport type { PgQueryable } from \"./postgres-bridge-store.js\";\n\nconst MIGRATION_NAME = /^(\\d+)_([a-z0-9_]+)\\.sql$/;\n// Native DR holds this database-local key with pg_advisory_lock. Migration and\n// Agent Bridge membership mutations take the shared transaction form.\nexport const NATIVE_DR_ADVISORY_LOCK_KEY = 1646705664;\nconst REQUIRED_COLUMNS = new Map([\n  [\"workspaces.id\", \"text\"],\n  [\"agents.id\", \"uuid\"],\n  [\"agents.workspace_id\", \"text\"],\n  [\"agents.principal\", \"text\"],\n  [\"credentials.id\", \"uuid\"],\n  [\"credentials.workspace_id\", \"text\"],\n  [\"credentials.agent_id\", \"uuid\"],\n  [\"credentials.token_hash\", \"bpchar\"],\n  [\"credentials.scopes\", \"_text\"],\n  [\"credentials.scope_set_name\", \"text\"],\n  [\"credentials.replaces_credential_id\", \"uuid\"],\n  [\"credentials.revoked_by\", \"text\"],\n  [\"credentials.revocation_reason\", \"text\"],\n  [\"credentials.expiry_grace_until\", \"timestamptz\"],\n  [\"credential_scope_sets.name\", \"text\"],\n  [\"credential_scope_sets.scopes\", \"_text\"],\n  [\"credential_scope_sets.created_at\", \"timestamptz\"],\n  [\"security_events.sequence\", \"int8\"],\n  [\"security_events.event_id\", \"uuid\"],\n  [\"security_events.event_type\", \"text\"],\n  [\"security_events.outcome\", \"text\"],\n  [\"security_events.reason_code\", \"text\"],\n  [\"security_events.workspace_id\", \"text\"],\n  [\"security_events.principal\", \"text\"],\n  [\"security_events.actor_principal\", \"text\"],\n  [\"security_events.credential_id\", \"uuid\"],\n  [\"security_events.related_credential_id\", \"uuid\"],\n  [\"security_events.operation_id\", \"text\"],\n  [\"security_events.request_id\", \"uuid\"],\n  [\"security_events.policy_id\", \"text\"],\n  [\"security_events.retry_after_seconds\", \"int4\"],\n  [\"security_events.created_at\", \"timestamptz\"],\n  [\"rate_limit_policies.policy_id\", \"text\"],\n  [\"rate_limit_policies.operation_id\", \"text\"],\n  [\"rate_limit_policies.capacity\", \"int4\"],\n  [\"rate_limit_policies.refill_per_second\", \"numeric\"],\n  [\"rate_limit_policies.enabled\", \"bool\"],\n  [\"rate_limit_buckets.credential_id\", \"uuid\"],\n  [\"rate_limit_buckets.policy_id\", \"text\"],\n  [\"rate_limit_buckets.tokens\", \"numeric\"],\n  [\"rate_limit_buckets.updated_at\", \"timestamptz\"],\n  [\"request_authorities.backend_pid\", \"int4\"],\n  [\"request_authorities.transaction_id\", \"xid8\"],\n  [\"request_authorities.request_id\", \"uuid\"],\n  [\"request_authorities.credential_id\", \"uuid\"],\n  [\"request_authorities.workspace_id\", \"text\"],\n  [\"request_authorities.principal\", \"text\"],\n  [\"request_authorities.scopes\", \"_text\"],\n  [\"request_authorities.opened_session_user\", \"name\"],\n  [\"request_authorities.authorized_endpoint_migration_operation\", \"text\"],\n  [\"gateway_authority.singleton\", \"bool\"],\n  [\"gateway_authority.authority_id\", \"uuid\"],\n  [\"endpoint_migration_challenges.challenge_hash\", \"bpchar\"],\n  [\"endpoint_migration_challenges.authority_id\", \"uuid\"],\n  [\"endpoint_migration_challenges.workspace_id\", \"text\"],\n  [\"endpoint_migration_challenges.principal\", \"text\"],\n  [\"endpoint_migration_challenges.issuer_credential_id\", \"uuid\"],\n  [\"endpoint_migration_challenges.verifier_credential_id\", \"uuid\"],\n  [\"endpoint_migration_challenges.issued_at\", \"timestamptz\"],\n  [\"endpoint_migration_challenges.expires_at\", \"timestamptz\"],\n  [\"endpoint_migration_challenges.consumed_at\", \"timestamptz\"],\n  [\"endpoint_migration_challenge_events.sequence\", \"int8\"],\n  [\"endpoint_migration_challenge_events.event_id\", \"uuid\"],\n  [\"endpoint_migration_challenge_events.request_id\", \"uuid\"],\n  [\"endpoint_migration_challenge_events.event_type\", \"text\"],\n  [\"endpoint_migration_challenge_events.created_at\", \"timestamptz\"],\n  [\"endpoint_migration_challenge_attestations.name\", \"text\"],\n  [\"endpoint_migration_challenge_attestations.catalog_definition\", \"text\"],\n  [\"row_isolation_attestations.name\", \"text\"],\n  [\"row_isolation_attestations.catalog_definition\", \"text\"],\n  [\"row_isolation_attestations.attested_at\", \"timestamptz\"],\n  [\"control_requests.request_id\", \"uuid\"],\n  [\"control_requests.operation\", \"text\"],\n  [\"control_requests.fingerprint\", \"bpchar\"],\n  [\"control_requests.actor\", \"name\"],\n  [\"control_requests.result\", \"jsonb\"],\n  [\"control_requests.created_at\", \"timestamptz\"],\n  [\"control_events.sequence\", \"int8\"],\n  [\"control_events.event_id\", \"uuid\"],\n  [\"control_events.request_id\", \"uuid\"],\n  [\"control_events.operation\", \"text\"],\n  [\"control_events.outcome\", \"text\"],\n  [\"control_events.actor\", \"name\"],\n  [\"control_events.workspace_id\", \"text\"],\n  [\"control_events.principal\", \"text\"],\n  [\"control_events.credential_id\", \"uuid\"],\n  [\"control_events.related_credential_id\", \"uuid\"],\n  [\"control_events.reason_code\", \"text\"],\n  [\"control_events.created_at\", \"timestamptz\"],\n  [\"owner_control_attestations.name\", \"text\"],\n  [\"owner_control_attestations.catalog_definition\", \"text\"],\n  [\"owner_control_attestations.attested_at\", \"timestamptz\"],\n  [\"control_membership_events.sequence\", \"int8\"],\n  [\"control_membership_events.request_id\", \"uuid\"],\n  [\"control_membership_events.action\", \"text\"],\n  [\"control_membership_events.member_role\", \"name\"],\n  [\"control_membership_events.control_role\", \"text\"],\n  [\"control_membership_events.actor\", \"name\"],\n  [\"control_membership_events.created_at\", \"timestamptz\"],\n  [\"archive_membership_events.sequence\", \"int8\"],\n  [\"archive_membership_events.request_id\", \"uuid\"],\n  [\"archive_membership_events.action\", \"text\"],\n  [\"archive_membership_events.member_role\", \"name\"],\n  [\"archive_membership_events.actor\", \"name\"],\n  [\"archive_membership_events.created_at\", \"timestamptz\"],\n  [\"archive_operations.sequence\", \"int8\"],\n  [\"archive_operations.request_id\", \"uuid\"],\n  [\"archive_operations.phase\", \"text\"],\n  [\"archive_operations.operation\", \"text\"],\n  [\"archive_operations.workspace\", \"text\"],\n  [\"archive_operations.client_verified_digest\", \"bpchar\"],\n  [\"archive_operations.message_count\", \"int8\"],\n  [\"archive_operations.receipt_count\", \"int8\"],\n  [\"archive_operations.message_inserted_count\", \"int8\"],\n  [\"archive_operations.receipt_inserted_count\", \"int8\"],\n  [\"archive_operations.server_content_binding\", \"bpchar\"],\n  [\"archive_operations.outcome\", \"text\"],\n  [\"archive_operations.failure_code\", \"text\"],\n  [\"archive_operations.published_at\", \"timestamptz\"],\n  [\"archive_operations.apply\", \"bool\"],\n  [\"archive_operations.actor\", \"name\"],\n  [\"archive_operations.created_at\", \"timestamptz\"],\n  [\"archive_operation_batches.sequence\", \"int8\"],\n  [\"archive_operation_batches.request_id\", \"uuid\"],\n  [\"archive_operation_batches.record_kind\", \"text\"],\n  [\"archive_operation_batches.batch_ordinal\", \"int8\"],\n  [\"archive_operation_batches.record_count\", \"int8\"],\n  [\"archive_operation_batches.batch_fingerprint\", \"bpchar\"],\n  [\"archive_operation_batches.chain_binding\", \"bpchar\"],\n  [\"archive_operation_batches.actor\", \"name\"],\n  [\"archive_operation_batches.created_at\", \"timestamptz\"],\n  [\"archive_import_records.sequence\", \"int8\"],\n  [\"archive_import_records.request_id\", \"uuid\"],\n  [\"archive_import_records.record_kind\", \"text\"],\n  [\"archive_import_records.record_key\", \"text\"],\n  [\"archive_import_records.batch_ordinal\", \"int8\"],\n  [\"archive_import_records.semantic_fingerprint\", \"bpchar\"],\n  [\"archive_import_records.inserted\", \"bool\"],\n  [\"archive_import_records.actor\", \"name\"],\n  [\"archive_import_records.created_at\", \"timestamptz\"],\n  [\"archive_transaction_authorizations.backend_pid\", \"int4\"],\n  [\"archive_transaction_authorizations.transaction_id\", \"text\"],\n  [\"archive_transaction_authorizations.request_id\", \"uuid\"],\n  [\"archive_transaction_authorizations.operation\", \"text\"],\n  [\"archive_transaction_authorizations.workspace\", \"text\"],\n  [\"archive_transaction_authorizations.client_verified_digest\", \"bpchar\"],\n  [\"archive_transaction_authorizations.actor\", \"name\"],\n  [\"archive_transaction_authorizations.messages_consumed\", \"bool\"],\n  [\"archive_transaction_authorizations.receipts_consumed\", \"bool\"],\n  [\"archive_transaction_authorizations.created_at\", \"timestamptz\"],\n  [\"portable_archive_attestations.name\", \"text\"],\n  [\"portable_archive_attestations.catalog_definition\", \"text\"],\n  [\"portable_archive_attestations.attested_at\", \"timestamptz\"],\n  [\"messages.sequence\", \"int8\"],\n  [\"messages.id\", \"uuid\"],\n  [\"messages.workspace\", \"text\"],\n  [\"messages.project\", \"text\"],\n  [\"messages.source\", \"text\"],\n  [\"messages.targets\", \"jsonb\"],\n  [\"messages.delivery_mode\", \"text\"],\n  [\"messages.delivery_max_attempts\", \"int4\"],\n  [\"messages.delivery_retry_base_delay_ms\", \"int4\"],\n  [\"messages.delivery_retry_max_delay_ms\", \"int4\"],\n  [\"messages.delivery_retry_jitter_ratio\", \"float8\"],\n  [\"messages.delivery_not_before\", \"timestamptz\"],\n  [\"receipts.workspace\", \"text\"],\n  [\"receipts.message_id\", \"uuid\"],\n  [\"receipts.principal\", \"text\"],\n  [\"deliveries.id\", \"uuid\"],\n  [\"deliveries.message_id\", \"uuid\"],\n  [\"deliveries.workspace\", \"text\"],\n  [\"deliveries.publisher\", \"text\"],\n  [\"deliveries.recipient\", \"text\"],\n  [\"deliveries.state\", \"text\"],\n  [\"deliveries.lease_token\", \"uuid\"],\n  [\"deliveries.created_at\", \"timestamptz\"],\n  [\"deliveries.priority_rank\", \"int2\"],\n  [\"deliveries.cycle_attempt\", \"int4\"],\n  [\"deliveries.requeue_count\", \"int4\"],\n  [\"deliveries.last_actor\", \"text\"],\n  [\"deliveries.last_action\", \"text\"],\n  [\"delivery_events.delivery_id\", \"uuid\"],\n  [\"delivery_events.publisher\", \"text\"],\n  [\"delivery_events.to_state\", \"text\"],\n  [\"delivery_events.cycle_attempt\", \"int4\"],\n  [\"delivery_events.requeue_count\", \"int4\"],\n  [\"delivery_events.actor\", \"text\"],\n  [\"delivery_events.action\", \"text\"],\n  [\"agent_instances.workspace\", \"text\"],\n  [\"agent_instances.instance\", \"text\"],\n  [\"agent_instances.capabilities\", \"jsonb\"],\n]);\n\nexport interface AppliedMigration {\n  version: number;\n  name: string;\n  checksum: string;\n}\n\nexport interface MigrationPlanEntry extends AppliedMigration {\n  source: string;\n}\n\nexport const REQUIRED_MIGRATIONS = [\n  { version: 1, name: \"schema_state\" },\n  { version: 2, name: \"workspaces_agents_credentials\" },\n  { version: 3, name: \"messages_receipts_deliveries\" },\n  { version: 4, name: \"message_query_indexes\" },\n  { version: 5, name: \"delivery_events_presence\" },\n  { version: 6, name: \"legacy_shared_context_import\" },\n  { version: 7, name: \"runtime_role\" },\n  { version: 8, name: \"message_projects\" },\n  { version: 9, name: \"mailbox_query_indexes\" },\n  { version: 10, name: \"publisher_delivery_policy\" },\n  { version: 11, name: \"credential_security\" },\n  { version: 12, name: \"request_authority\" },\n  { version: 13, name: \"row_isolation\" },\n  { version: 14, name: \"owner_control_plane\" },\n  { version: 15, name: \"portable_archives\" },\n  { version: 16, name: \"native_dr_fence\" },\n  { version: 17, name: \"gateway_authority_binding\" },\n  { version: 18, name: \"endpoint_migration_challenges\" },\n  { version: 19, name: \"endpoint_migration_same_successor\" },\n] as const;\n\nfunction withNativeDrSharedLock(source: string): string {\n  if (!/^begin;\\s/i.test(source)) {\n    throw new Error(\"migration must begin with an explicit transaction\");\n  }\n  return source.replace(\n    /^begin;\\s/i,\n    `begin;\\n\\nselect pg_advisory_xact_lock_shared(${NATIVE_DR_ADVISORY_LOCK_KEY});\\n\\n`,\n  );\n}\n\nfunction checksum(source: string): string {\n  return createHash(\"sha256\").update(source, \"utf8\").digest(\"hex\");\n}\n\nasync function recordedMigrations(db: PgQueryable): Promise<AppliedMigration[]> {\n  const exists = await db.query<{ table_name: string | null }>(\n    \"SELECT to_regclass('agent_bridge.schema_migrations')::text AS table_name\",\n  );\n  if (!exists.rows[0]?.table_name) return [];\n  const result = await db.query<{ version: number; name: string; checksum: string }>(\n    \"SELECT version, name, checksum FROM agent_bridge.schema_migrations ORDER BY version\",\n  );\n  return result.rows.map((row) => ({\n    version: Number(row.version),\n    name: row.name,\n    checksum: row.checksum,\n  }));\n}\n\nexport async function loadMigrationPlan(directory: string): Promise<MigrationPlanEntry[]> {\n  const files = (await readdir(directory))\n    .filter((file) => MIGRATION_NAME.test(file))\n    .sort((left, right) => left.localeCompare(right));\n  const expected = await Promise.all(files.map(async (file) => {\n    const match = file.match(MIGRATION_NAME)!;\n    const source = await readFile(join(directory, file), \"utf8\");\n    return { version: Number(match[1]), name: match[2], source, checksum: checksum(source) };\n  }));\n\n  if (\n    expected.length !== REQUIRED_MIGRATIONS.length ||\n    !expected.every(\n      (migration, index) =>\n        migration.version === REQUIRED_MIGRATIONS[index]?.version &&\n        migration.name === REQUIRED_MIGRATIONS[index]?.name,\n    )\n  ) {\n    throw new Error(\"migration directory does not match the required migration sequence\");\n  }\n  return expected;\n}\n\nexport async function migrationsReady(\n  db: PgQueryable,\n  expected: ReadonlyArray<Pick<MigrationPlanEntry, \"version\" | \"name\" | \"checksum\">>,\n): Promise<boolean> {\n  const applied = await recordedMigrations(db);\n  return expected.every(\n    (required, index) =>\n      applied[index]?.version === required.version &&\n      applied[index]?.name === required.name &&\n      applied[index]?.checksum === required.checksum,\n  ) && applied.length === expected.length;\n}\n\nexport async function rowIsolationReady(db: PgQueryable, allowPrivilegedCaller: boolean): Promise<boolean> {\n  const result = await db.query<{\n    rolesReady: boolean;\n    callerReady: boolean;\n    callerBypasses: boolean;\n    ownershipReady: boolean;\n    policiesReady: boolean;\n    functionsReady: boolean;\n    constraintsReady: boolean;\n    triggersReady: boolean;\n    grantsReady: boolean;\n    catalogReady: boolean;\n  }>(`WITH names AS (\n      SELECT\n        ('agent_bridge_runtime_' || substr(md5(current_database()),1,16))::name AS runtime_role,\n        ('agent_bridge_data_owner_' || substr(md5(current_database()),1,16))::name AS data_owner,\n        ('agent_bridge_context_reader_' || substr(md5(current_database()),1,16))::name AS context_reader,\n        ('agent_bridge_event_writer_' || substr(md5(current_database()),1,16))::name AS event_writer\n    ), required_roles(role_name) AS (\n      SELECT runtime_role FROM names UNION ALL SELECT data_owner FROM names\n      UNION ALL SELECT context_reader FROM names UNION ALL SELECT event_writer FROM names\n    ), domain_tables(table_name) AS (\n      VALUES ('messages'),('receipts'),('deliveries'),('delivery_events'),('agent_instances')\n    ), caller_role AS (\n      SELECT * FROM pg_roles WHERE rolname=current_user\n    ), expected_policies(table_name,policy_name,command_name,role_name,needs_workspace,needs_principal) AS (\n      SELECT 'messages','messages_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'messages','messages_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'messages','messages_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'receipts','receipts_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'receipts','receipts_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'receipts','receipts_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'deliveries','deliveries_runtime_update','w',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_runtime_select','r',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'delivery_events','delivery_events_writer_insert','a',event_writer::text,false,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_owner_all','*',data_owner::text,false,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_select','r',runtime_role::text,true,false FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_insert','a',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_update','w',runtime_role::text,true,true FROM names UNION ALL\n      SELECT 'agent_instances','agent_instances_runtime_delete','d',runtime_role::text,true,true FROM names\n    ), actual_policies AS (\n      SELECT relation.relname AS table_name,policy.polname AS policy_name,\n        policy.polcmd AS command_name,policy.polpermissive,\n        ARRAY(SELECT role.rolname::text FROM unnest(policy.polroles) member(oid)\n          JOIN pg_roles role ON role.oid=member.oid ORDER BY role.rolname) AS role_names,\n        coalesce(pg_get_expr(policy.polqual,policy.polrelid),'') || ' ' ||\n          coalesce(pg_get_expr(policy.polwithcheck,policy.polrelid),'') AS expressions\n      FROM pg_policy policy\n      JOIN pg_class relation ON relation.oid=policy.polrelid\n      JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n      WHERE namespace.nspname='agent_bridge'\n        AND relation.relname IN (SELECT table_name FROM domain_tables)\n    )\n    SELECT\n      (SELECT count(*)=4 AND bool_and(\n          role.rolname=(required.role_name::text)\n          AND NOT role.rolcanlogin AND NOT role.rolsuper AND NOT role.rolcreatedb\n          AND NOT role.rolcreaterole AND NOT role.rolreplication AND NOT role.rolbypassrls\n        )\n       FROM required_roles required JOIN pg_roles role ON role.rolname=required.role_name::text) AS \"rolesReady\",\n      ((SELECT rolsuper OR rolbypassrls FROM caller_role) OR (\n        (SELECT rolcanlogin AND rolinherit AND NOT rolsuper AND NOT rolcreatedb\n           AND NOT rolcreaterole AND NOT rolreplication AND NOT rolbypassrls\n         FROM caller_role)\n        AND pg_has_role(current_user,(SELECT runtime_role FROM names),'MEMBER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_roles unexpected\n          WHERE unexpected.oid<>(SELECT oid FROM caller_role)\n            AND unexpected.rolname<>(SELECT runtime_role::text FROM names)\n            AND pg_has_role(current_user,unexpected.oid,'MEMBER')\n        )\n      )) AS \"callerReady\",\n      EXISTS (\n        SELECT 1 FROM pg_roles elevated\n        WHERE (elevated.rolsuper OR elevated.rolbypassrls)\n          AND pg_has_role(current_user,elevated.oid,'MEMBER')\n      ) AS \"callerBypasses\",\n      (SELECT count(*)=5 AND bool_and(\n          relation.relrowsecurity AND relation.relforcerowsecurity\n          AND owner.rolname=(SELECT data_owner::text FROM names)\n        )\n       FROM domain_tables required\n       JOIN pg_namespace namespace ON namespace.nspname='agent_bridge'\n       JOIN pg_class relation ON relation.relnamespace=namespace.oid AND relation.relname=required.table_name\n       JOIN pg_roles owner ON owner.oid=relation.relowner)\n        AND EXISTS (\n          SELECT 1 FROM pg_class attestation\n          JOIN pg_namespace namespace ON namespace.oid=attestation.relnamespace\n          WHERE namespace.nspname='agent_bridge'\n            AND attestation.relname='row_isolation_attestations'\n            AND attestation.relowner=namespace.nspowner\n        ) AS \"ownershipReady\",\n      ((SELECT count(*) FROM actual_policies)=18 AND NOT EXISTS (\n        SELECT 1 FROM expected_policies expected\n        LEFT JOIN actual_policies actual\n          ON actual.table_name=expected.table_name AND actual.policy_name=expected.policy_name\n        WHERE actual.policy_name IS NULL OR actual.command_name<>expected.command_name\n          OR NOT actual.polpermissive OR actual.role_names<>ARRAY[expected.role_name]\n          OR (expected.needs_workspace AND position('current_request_workspace' in actual.expressions)=0)\n          OR (expected.needs_principal AND position('current_request_principal' in actual.expressions)=0)\n          OR (NOT expected.needs_workspace AND NOT expected.needs_principal\n            AND position('true' in actual.expressions)=0)\n      )) AS \"policiesReady\",\n      (SELECT count(*)=4 AND bool_and(\n          procedure.proconfig @> ARRAY['search_path=\"\"']::text[]\n          AND CASE procedure.proname\n            WHEN 'record_delivery_event' THEN owner.rolname=(SELECT event_writer::text FROM names)\n              AND procedure.prosecdef AND procedure.provolatile='v'\n            WHEN 'row_isolation_catalog_definition' THEN\n              owner.oid=(SELECT relation.relowner FROM pg_class relation\n                JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n                WHERE namespace.nspname='agent_bridge'\n                  AND relation.relname='row_isolation_attestations')\n              AND NOT procedure.prosecdef AND procedure.provolatile='s'\n            ELSE owner.rolname=(SELECT context_reader::text FROM names)\n              AND procedure.prosecdef AND procedure.provolatile='s'\n          END\n        )\n       FROM pg_proc procedure\n       JOIN pg_namespace namespace ON namespace.oid=procedure.pronamespace\n       JOIN pg_roles owner ON owner.oid=procedure.proowner\n       WHERE namespace.nspname='agent_bridge'\n         AND procedure.proname IN (\n           'current_request_workspace','current_request_principal',\n           'record_delivery_event','row_isolation_catalog_definition'\n         ))\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_proc private_function\n          JOIN pg_namespace private_namespace ON private_namespace.oid=private_function.pronamespace\n          WHERE private_namespace.nspname='agent_bridge'\n            AND has_function_privilege('public',private_function.oid,'EXECUTE')\n        )\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.current_request_workspace()','EXECUTE')\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.current_request_principal()','EXECUTE')\n        AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_catalog_definition()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_delivery_event()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.reject_delivery_identity_mutation()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.enforce_delivery_actor_role()','EXECUTE')\n        AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.reject_delivery_event_mutation()','EXECUTE')\n        AS \"functionsReady\",\n      ((SELECT count(*)=5 AND bool_and(constraint_record.convalidated)\n       FROM (VALUES\n          ('agent_bridge.messages'::regclass,'messages_workspace_id_source_unique'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_publisher_message_fk'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_event_identity_unique'),\n          ('agent_bridge.delivery_events'::regclass,'delivery_events_delivery_publisher_fk'),\n          ('agent_bridge.row_isolation_attestations'::regclass,'row_isolation_attestation_name')\n       ) required(relation_id,constraint_name)\n       JOIN pg_constraint constraint_record\n         ON constraint_record.conrelid=required.relation_id\n        AND constraint_record.conname=required.constraint_name)\n        AND (SELECT count(*)=2 AND bool_and(attribute.attnotnull)\n          FROM pg_attribute attribute\n          WHERE (attribute.attrelid,attribute.attname) IN (\n            ('agent_bridge.deliveries'::regclass,'publisher'),\n            ('agent_bridge.delivery_events'::regclass,'publisher')\n          ) AND attribute.attnum>0 AND NOT attribute.attisdropped)\n      ) AS \"constraintsReady\",\n      (SELECT count(*)=4 AND bool_and(trigger.tgenabled='O')\n       FROM (VALUES\n          ('agent_bridge.deliveries'::regclass,'deliveries_record_event'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_identity_immutable'),\n          ('agent_bridge.deliveries'::regclass,'deliveries_actor_role'),\n          ('agent_bridge.delivery_events'::regclass,'delivery_events_append_only')\n       ) required(relation_id,trigger_name)\n       JOIN pg_trigger trigger ON trigger.tgrelid=required.relation_id\n        AND trigger.tgname=required.trigger_name AND NOT trigger.tgisinternal) AS \"triggersReady\",\n      (has_schema_privilege((SELECT runtime_role FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT runtime_role FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT data_owner FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT data_owner FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT context_reader FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT context_reader FROM names),'agent_bridge','CREATE')\n        AND has_schema_privilege((SELECT event_writer FROM names),'agent_bridge','USAGE')\n        AND NOT has_schema_privilege((SELECT event_writer FROM names),'agent_bridge','CREATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','INSERT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.messages','UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','INSERT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.receipts','UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','INSERT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','UPDATE')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.deliveries','DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events','SELECT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','SELECT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','INSERT')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','UPDATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','DELETE')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agent_instances','TRUNCATE,REFERENCES,TRIGGER')\n        AND has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.messages_sequence_seq','USAGE')\n        AND NOT has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.messages_sequence_seq','SELECT,UPDATE')\n        AND NOT has_sequence_privilege((SELECT runtime_role FROM names),'agent_bridge.delivery_events_sequence_seq','USAGE,SELECT,UPDATE')\n        AND has_table_privilege((SELECT context_reader FROM names),'agent_bridge.request_authorities','SELECT')\n        AND NOT has_table_privilege((SELECT context_reader FROM names),'agent_bridge.request_authorities','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND has_table_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events','INSERT')\n        AND NOT has_table_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events','SELECT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_class relation\n          JOIN pg_namespace namespace ON namespace.oid=relation.relnamespace\n          WHERE namespace.nspname='agent_bridge' AND relation.relkind IN ('r','p','v','m','f')\n            AND (\n              (relation.relname<>'request_authorities' AND has_table_privilege(\n                (SELECT context_reader FROM names),relation.oid,\n                'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER'\n              ))\n              OR (relation.relname<>'delivery_events' AND has_table_privilege(\n                (SELECT event_writer FROM names),relation.oid,\n                'SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER'\n              ))\n            )\n        )\n        AND has_sequence_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events_sequence_seq','USAGE')\n        AND NOT has_sequence_privilege((SELECT event_writer FROM names),'agent_bridge.delivery_events_sequence_seq','SELECT,UPDATE')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_class sequence\n          JOIN pg_namespace namespace ON namespace.oid=sequence.relnamespace\n          WHERE namespace.nspname='agent_bridge' AND sequence.relkind='S'\n            AND (\n              has_sequence_privilege((SELECT context_reader FROM names),sequence.oid,'USAGE,SELECT,UPDATE')\n              OR (sequence.relname<>'delivery_events_sequence_seq' AND has_sequence_privilege(\n                (SELECT event_writer FROM names),sequence.oid,'USAGE,SELECT,UPDATE'\n              ))\n            )\n        )\n        AND NOT has_sequence_privilege('public','agent_bridge.messages_sequence_seq','USAGE,SELECT,UPDATE')\n        AND NOT has_sequence_privilege('public','agent_bridge.delivery_events_sequence_seq','USAGE,SELECT,UPDATE')\n        AND has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_attestations','SELECT')\n        AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.row_isolation_attestations','INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT EXISTS (\n          SELECT 1\n          FROM unnest(ARRAY[\n            'agent_bridge.credentials','agent_bridge.agents',\n            'agent_bridge.workspaces','agent_bridge.request_authorities'\n          ]) protected_table(value)\n          CROSS JOIN unnest(ARRAY[\n            'SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER'\n          ]) requested_privilege(value)\n          WHERE has_table_privilege(\n            (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n          )\n        )\n        AND NOT EXISTS (\n          SELECT 1\n          FROM unnest(ARRAY[\n            'agent_bridge.credentials','agent_bridge.agents',\n            'agent_bridge.workspaces','agent_bridge.request_authorities'\n          ]) protected_table(value)\n          CROSS JOIN unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) requested_privilege(value)\n          WHERE has_any_column_privilege(\n            (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n          )\n        )\n        AND NOT has_table_privilege('public','agent_bridge.row_isolation_attestations','SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT data_owner FROM names),'MEMBER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT context_reader FROM names),'MEMBER')\n        AND NOT pg_has_role((SELECT runtime_role FROM names),(SELECT event_writer FROM names),'MEMBER')\n        AND NOT EXISTS (\n          SELECT 1 FROM pg_proc private_function\n          JOIN pg_namespace namespace ON namespace.oid=private_function.pronamespace\n          WHERE namespace.nspname='agent_bridge'\n            AND (\n              (NOT (private_function.proname IN ('current_request_workspace','current_request_principal')\n                    AND private_function.pronargs=0)\n                AND has_function_privilege((SELECT context_reader FROM names),private_function.oid,'EXECUTE'))\n              OR (NOT (private_function.proname='record_delivery_event' AND private_function.pronargs=0)\n                AND has_function_privilege((SELECT event_writer FROM names),private_function.oid,'EXECUTE'))\n            )\n        )\n      ) AS \"grantsReady\",\n      (SELECT count(*)=1 AND bool_and(\n          attestation.catalog_definition=agent_bridge.row_isolation_catalog_definition()\n        )\n       FROM agent_bridge.row_isolation_attestations attestation\n       WHERE attestation.name='domain-v1') AS \"catalogReady\"\n  `);\n  const row = result.rows[0];\n  const callerReady = row?.callerReady && (allowPrivilegedCaller || !row.callerBypasses);\n  return Boolean(\n    row?.rolesReady && callerReady && row.ownershipReady && row.policiesReady &&\n    row.functionsReady && row.constraintsReady && row.triggersReady && row.grantsReady && row.catalogReady\n  );\n}\n\nexport async function runtimeSchemaReady(\n  db: PgQueryable,\n  options: { allowPrivilegedCaller?: boolean } = {},\n): Promise<boolean> {\n  const columns = await db.query<{ table_name: string; column_name: string; udt_name: string }>(\n    `SELECT relation.relname AS table_name, attribute.attname AS column_name,\n       type.typname AS udt_name\n     FROM pg_catalog.pg_attribute attribute\n     JOIN pg_catalog.pg_class relation ON relation.oid=attribute.attrelid\n     JOIN pg_catalog.pg_namespace namespace ON namespace.oid=relation.relnamespace\n     JOIN pg_catalog.pg_type type ON type.oid=attribute.atttypid\n     WHERE namespace.nspname='agent_bridge'\n       AND attribute.attnum>0 AND NOT attribute.attisdropped`,\n  );\n  const actual = new Map(\n    columns.rows.map((row) => [`${row.table_name}.${row.column_name}`, row.udt_name]),\n  );\n  if ([...REQUIRED_COLUMNS].some(([name, type]) => actual.get(name) !== type)) return false;\n\n  const objects = await db.query<{ immutable: boolean; deliveryAudit: boolean; idempotency: boolean; claim: boolean; publisher: boolean; terminal: boolean; source: boolean; thread: boolean; created: boolean; presence: boolean; project: boolean; targets: boolean; scopeSets: boolean; securityEvents: boolean; ratePolicies: boolean; rateBuckets: boolean; replacement: boolean; rateCleanup: boolean; credentialSecurity: boolean; eventAppendOnly: boolean; scopeAudit: boolean; rateConsume: boolean; securityReady: boolean; requestAuthorities: boolean; gatewayAuthority: boolean; gatewayAuthorityShape: boolean; gatewayAuthorityImmutable: boolean; authorityOpen: boolean; authorityBoundOpen: boolean; authorityClose: boolean; authorityReady: boolean; credentialDigestHidden: boolean; authorityRowsHidden: boolean; gatewayAuthorityRowsHidden: boolean; principalTablesHidden: boolean; authorityTablesLocked: boolean; gatewayAuthorityPublicLocked: boolean; authorityCatalog: boolean }>(\n    `WITH names AS (\n       SELECT ('agent_bridge_runtime_' || substr(md5(current_database()),1,16))::name AS runtime_role\n     ) SELECT\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid='agent_bridge.messages'::regclass\n           AND tgname='messages_immutable' AND NOT tgisinternal\n       ) AS immutable,\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid='agent_bridge.deliveries'::regclass\n           AND tgname='deliveries_record_event' AND NOT tgisinternal\n       ) AS \"deliveryAudit\",\n       to_regclass('agent_bridge.messages_idempotency') IS NOT NULL AS idempotency,\n       to_regclass('agent_bridge.deliveries_claim') IS NOT NULL AS claim,\n       to_regclass('agent_bridge.deliveries_publisher_lookup') IS NOT NULL AS publisher,\n       to_regclass('agent_bridge.deliveries_terminal_lookup') IS NOT NULL AS terminal,\n       to_regclass('agent_bridge.messages_source') IS NOT NULL AS source,\n       to_regclass('agent_bridge.messages_thread') IS NOT NULL AS thread,\n       to_regclass('agent_bridge.messages_created') IS NOT NULL AS created,\n       to_regclass('agent_bridge.messages_project') IS NOT NULL AS project,\n       to_regclass('agent_bridge.messages_targets_gin') IS NOT NULL AS targets,\n       to_regclass('agent_bridge.agent_instances_active') IS NOT NULL AS presence,\n       to_regclass('agent_bridge.credential_scope_sets') IS NOT NULL AS \"scopeSets\",\n       to_regclass('agent_bridge.security_events') IS NOT NULL AS \"securityEvents\",\n       to_regclass('agent_bridge.rate_limit_policies') IS NOT NULL AS \"ratePolicies\",\n       to_regclass('agent_bridge.rate_limit_buckets') IS NOT NULL AS \"rateBuckets\",\n       to_regclass('agent_bridge.credentials_replacement_lineage') IS NOT NULL AS replacement,\n       to_regclass('agent_bridge.rate_limit_buckets_cleanup') IS NOT NULL AS \"rateCleanup\",\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid=to_regclass('agent_bridge.credentials')\n           AND tgname='credentials_validate_security' AND NOT tgisinternal\n       ) AS \"credentialSecurity\",\n       EXISTS (\n         SELECT 1 FROM pg_trigger\n         WHERE tgrelid=to_regclass('agent_bridge.security_events')\n           AND tgname='security_events_append_only' AND NOT tgisinternal\n       ) AS \"eventAppendOnly\",\n       to_regprocedure('agent_bridge.record_scope_denial(uuid,text,uuid)') IS NOT NULL AS \"scopeAudit\",\n       to_regprocedure('agent_bridge.consume_rate_limit(uuid,text,uuid)') IS NOT NULL AS \"rateConsume\",\n       to_regprocedure('agent_bridge.security_schema_ready()') IS NOT NULL AS \"securityReady\",\n       to_regclass('agent_bridge.request_authorities') IS NOT NULL AS \"requestAuthorities\",\n       to_regclass('agent_bridge.gateway_authority') IS NOT NULL AS \"gatewayAuthority\",\n       (\n         (SELECT attribute.attnotnull\n          FROM pg_attribute attribute\n          WHERE attribute.attrelid=to_regclass('agent_bridge.gateway_authority')\n            AND attribute.attname='singleton' AND attribute.attnum>0 AND NOT attribute.attisdropped)\n         AND (SELECT attribute.attnotnull\n          FROM pg_attribute attribute\n          WHERE attribute.attrelid=to_regclass('agent_bridge.gateway_authority')\n            AND attribute.attname='authority_id' AND attribute.attnum>0 AND NOT attribute.attisdropped)\n         AND EXISTS (\n           SELECT 1 FROM pg_constraint table_constraint\n           WHERE table_constraint.conrelid=to_regclass('agent_bridge.gateway_authority')\n             AND table_constraint.conname='gateway_authority_singleton'\n             AND table_constraint.contype='p'\n             AND table_constraint.conkey::smallint[]=ARRAY[(SELECT attribute.attnum FROM pg_attribute attribute\n               WHERE attribute.attrelid=to_regclass('agent_bridge.gateway_authority')\n                 AND attribute.attname='singleton' AND attribute.attnum>0 AND NOT attribute.attisdropped)]\n         )\n         AND EXISTS (\n           SELECT 1 FROM pg_constraint table_constraint\n           WHERE table_constraint.conrelid=to_regclass('agent_bridge.gateway_authority')\n             AND table_constraint.conname='gateway_authority_singleton_true'\n             AND table_constraint.contype='c'\n             AND regexp_replace(\n               pg_get_expr(table_constraint.conbin,table_constraint.conrelid),'[[:space:]()]','','g'\n             )='singleton'\n         )\n         AND EXISTS (\n           SELECT 1 FROM pg_constraint table_constraint\n           WHERE table_constraint.conrelid=to_regclass('agent_bridge.gateway_authority')\n             AND table_constraint.conname='gateway_authority_id_unique'\n             AND table_constraint.contype='u'\n             AND table_constraint.conkey::smallint[]=ARRAY[(SELECT attribute.attnum FROM pg_attribute attribute\n               WHERE attribute.attrelid=to_regclass('agent_bridge.gateway_authority')\n                 AND attribute.attname='authority_id' AND attribute.attnum>0 AND NOT attribute.attisdropped)]\n         )\n       ) AS \"gatewayAuthorityShape\",\n       EXISTS (\n         SELECT 1\n         FROM pg_trigger trigger\n         JOIN pg_proc trigger_function ON trigger_function.oid=trigger.tgfoid\n         JOIN pg_namespace trigger_namespace ON trigger_namespace.oid=trigger_function.pronamespace\n         WHERE trigger.tgrelid=to_regclass('agent_bridge.gateway_authority')\n           AND trigger.tgname='gateway_authority_immutable'\n           AND NOT trigger.tgisinternal AND trigger.tgenabled='O'\n           AND (trigger.tgtype::integer & 1)=0\n           AND (trigger.tgtype::integer & 2)=2\n           AND (trigger.tgtype::integer & 56)=56\n           AND trigger_function.proname='reject_gateway_authority_mutation'\n           AND trigger_namespace.nspname='agent_bridge'\n           AND trigger_function.proowner=(SELECT nspowner FROM pg_namespace WHERE nspname='agent_bridge')\n           AND NOT trigger_function.prosecdef\n           AND coalesce(trigger_function.proconfig @> ARRAY['search_path=\"\"'],false)\n       ) AS \"gatewayAuthorityImmutable\",\n       to_regprocedure('agent_bridge.open_request_authority(uuid,text,uuid)') IS NOT NULL\n         AND to_regprocedure('agent_bridge.resolve_credential_hash(text)') IS NOT NULL AS \"authorityOpen\",\n       to_regprocedure('agent_bridge.open_request_authority_bound(uuid,text,uuid)') IS NOT NULL AS \"authorityBoundOpen\",\n       to_regprocedure('agent_bridge.close_request_authority()') IS NOT NULL AS \"authorityClose\",\n       to_regprocedure('agent_bridge.gateway_authority_ready()') IS NOT NULL AS \"authorityReady\",\n       NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.credentials','SELECT') AS \"credentialDigestHidden\",\n       NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.request_authorities','SELECT') AS \"authorityRowsHidden\",\n       (NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.gateway_authority','SELECT')\n         AND NOT has_table_privilege('public','agent_bridge.gateway_authority','SELECT')) AS \"gatewayAuthorityRowsHidden\",\n       (NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.agents','SELECT')\n         AND NOT has_table_privilege((SELECT runtime_role FROM names),'agent_bridge.workspaces','SELECT')) AS \"principalTablesHidden\",\n       (\n         NOT EXISTS (\n           SELECT 1\n           FROM unnest(ARRAY[\n             'agent_bridge.credentials','agent_bridge.agents',\n             'agent_bridge.workspaces','agent_bridge.request_authorities',\n             'agent_bridge.gateway_authority'\n           ]) protected_table(value)\n           CROSS JOIN unnest(ARRAY[\n             'SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER'\n           ]) requested_privilege(value)\n           WHERE has_table_privilege(\n             (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n           )\n         )\n         AND NOT EXISTS (\n           SELECT 1\n           FROM unnest(ARRAY[\n             'agent_bridge.credentials','agent_bridge.agents',\n             'agent_bridge.workspaces','agent_bridge.request_authorities',\n             'agent_bridge.gateway_authority'\n           ]) protected_table(value)\n           CROSS JOIN unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) requested_privilege(value)\n           WHERE has_any_column_privilege(\n             (SELECT runtime_role FROM names),protected_table.value,requested_privilege.value\n           )\n         )\n       ) AS \"authorityTablesLocked\",\n       NOT EXISTS (\n         SELECT 1\n         FROM unnest(ARRAY[\n           'SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER'\n         ]) requested_privilege(value)\n         WHERE has_table_privilege('public','agent_bridge.gateway_authority',requested_privilege.value)\n       )\n       AND NOT EXISTS (\n         SELECT 1\n         FROM unnest(ARRAY['SELECT','INSERT','UPDATE','REFERENCES']) requested_privilege(value)\n         WHERE has_any_column_privilege(\n           'public','agent_bridge.gateway_authority',requested_privilege.value\n         )\n       ) AS \"gatewayAuthorityPublicLocked\",\n       (\n         has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.resolve_credential_hash(text)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.open_request_authority(uuid,text,uuid)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.open_request_authority_bound(uuid,text,uuid)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.close_request_authority()','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.gateway_authority_ready()','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_scope_denial(uuid,text,uuid)','EXECUTE')\n         AND has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.consume_rate_limit(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.active_request_authority()','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.assert_active_request_credential(uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.record_scope_denial_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege((SELECT runtime_role FROM names),'agent_bridge.consume_rate_limit_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.resolve_credential_hash(text)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.open_request_authority(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.open_request_authority_bound(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.close_request_authority()','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.gateway_authority_ready()','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.record_scope_denial(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.consume_rate_limit(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.record_scope_denial_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT has_function_privilege('public','agent_bridge.consume_rate_limit_unbound_011(uuid,text,uuid)','EXECUTE')\n         AND NOT EXISTS (\n           SELECT 1 FROM pg_proc procedure\n           JOIN pg_namespace namespace ON namespace.oid=procedure.pronamespace\n           WHERE namespace.nspname='agent_bridge'\n             AND procedure.proname IN (\n               'resolve_credential_hash','open_request_authority','open_request_authority_bound',\n               'gateway_authority_ready','active_request_authority',\n               'assert_active_request_credential','close_request_authority','record_scope_denial',\n               'consume_rate_limit','record_scope_denial_unbound_011','consume_rate_limit_unbound_011'\n             )\n             AND (\n               NOT procedure.prosecdef\n               OR procedure.proowner <> (SELECT nspowner FROM pg_namespace WHERE nspname='agent_bridge')\n               OR NOT coalesce(procedure.proconfig @> ARRAY['search_path=\"\"'],false)\n             )\n         )\n       ) AS \"authorityCatalog\"`,\n  );\n  const row = objects.rows[0];\n  if (!Boolean(\n    row?.immutable && row.deliveryAudit && row.idempotency && row.claim && row.publisher &&\n    row.terminal && row.source && row.thread && row.created && row.presence && row.project &&\n    row.targets && row.scopeSets && row.securityEvents && row.ratePolicies && row.rateBuckets &&\n    row.replacement && row.rateCleanup && row.credentialSecurity && row.eventAppendOnly &&\n    row.scopeAudit && row.rateConsume && row.securityReady && row.requestAuthorities &&\n    row.gatewayAuthority && row.gatewayAuthorityShape && row.gatewayAuthorityImmutable && row.authorityOpen &&\n    row.authorityBoundOpen && row.authorityClose && row.authorityReady &&\n    row.credentialDigestHidden && row.authorityRowsHidden && row.gatewayAuthorityRowsHidden &&\n    row.principalTablesHidden && row.authorityTablesLocked && row.gatewayAuthorityPublicLocked &&\n    row.authorityCatalog\n  )) return false;\n  const endpointChallenge = await db.query<{\n    tables: boolean;\n    functions: boolean;\n    grants: boolean;\n    marker: boolean;\n  }>(`\n    WITH names AS (\n      SELECT ('agent_bridge_runtime_' || substr(md5(current_database()),1,16))::name AS runtime_role\n    ) SELECT\n      to_regclass('agent_bridge.endpoint_migration_challenges') IS NOT NULL\n        AND to_regclass('agent_bridge.endpoint_migration_challenge_events') IS NOT NULL\n        AND to_regclass('agent_bridge.endpoint_migration_challenge_attestations') IS NOT NULL AS tables,\n      to_regprocedure('agent_bridge.issue_endpoint_migration_challenge(uuid,uuid,text)') IS NOT NULL\n        AND to_regprocedure('agent_bridge.consume_endpoint_migration_challenge(uuid,uuid,text)') IS NOT NULL\n        AND to_regprocedure('agent_bridge.endpoint_migration_challenge_ready()') IS NOT NULL AS functions,\n      NOT EXISTS (\n        SELECT 1\n        FROM unnest(ARRAY[\n          'agent_bridge.endpoint_migration_challenges',\n          'agent_bridge.endpoint_migration_challenge_events',\n          'agent_bridge.endpoint_migration_challenge_attestations'\n        ]) relation_name\n        CROSS JOIN unnest(ARRAY['SELECT','INSERT','UPDATE','DELETE','TRUNCATE','REFERENCES','TRIGGER']) privilege\n        WHERE has_table_privilege((SELECT runtime_role FROM names),relation_name,privilege)\n          OR has_table_privilege('public',relation_name,privilege)\n      )\n        AND has_function_privilege((SELECT runtime_role FROM names),\n          'agent_bridge.issue_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')\n        AND has_function_privilege((SELECT runtime_role FROM names),\n          'agent_bridge.consume_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')\n        AND NOT has_function_privilege('public',\n          'agent_bridge.issue_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')\n        AND NOT has_function_privilege('public',\n          'agent_bridge.consume_endpoint_migration_challenge(uuid,uuid,text)','EXECUTE')\n        AND NOT EXISTS (\n          SELECT 1\n          FROM pg_catalog.pg_proc procedure\n          JOIN pg_catalog.pg_namespace namespace ON namespace.oid=procedure.pronamespace\n          WHERE namespace.nspname='agent_bridge'\n            AND procedure.proname IN (\n              'guard_endpoint_migration_challenge',\n              'reject_endpoint_migration_challenge_truncate',\n              'reject_endpoint_migration_challenge_event_mutation',\n              'reject_endpoint_migration_challenge_attestation_mutation',\n              'cleanup_endpoint_migration_challenges',\n              'endpoint_migration_challenge_active_credential',\n              'endpoint_migration_challenge_direct_lineage',\n              'endpoint_migration_challenge_catalog_definition',\n              'endpoint_migration_challenge_ready'\n            )\n            AND has_function_privilege((SELECT runtime_role FROM names),procedure.oid,'EXECUTE')\n        ) AS grants,\n      EXISTS (\n        SELECT 1 FROM pg_catalog.pg_attribute\n        WHERE attrelid='agent_bridge.request_authorities'::regclass\n          AND attname='authorized_endpoint_migration_operation'\n          AND NOT attnotnull\n      ) AS marker\n  `);\n  const endpoint = endpointChallenge.rows[0];\n  if (!endpoint?.tables || !endpoint.functions || !endpoint.grants || !endpoint.marker) return false;\n  try {\n    const security = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.security_schema_ready() AS ready\",\n    );\n    const ownerControl = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.owner_control_plane_ready() AS ready\",\n    );\n    const portableArchive = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.portable_archive_ready() AS ready\",\n    );\n    const gatewayAuthority = await db.query<{ ready: boolean }>(\n      \"SELECT agent_bridge.gateway_authority_ready() AS ready\",\n    );\n    return security.rows[0]?.ready === true && ownerControl.rows[0]?.ready === true &&\n      portableArchive.rows[0]?.ready === true && gatewayAuthority.rows[0]?.ready === true &&\n      await rowIsolationReady(\n      db,\n      options.allowPrivilegedCaller === true,\n    );\n  } catch {\n    return false;\n  }\n}\n\nexport async function runMigrations(\n  db: PgQueryable,\n  directory: string,\n): Promise<AppliedMigration[]> {\n  const expected = await loadMigrationPlan(directory);\n\n  for (const migration of expected) {\n    const applied = await recordedMigrations(db);\n    const recorded = applied.find((entry) => entry.version === migration.version);\n    if (recorded) {\n      if (recorded.name !== migration.name || recorded.checksum !== migration.checksum) {\n        throw new Error(`migration ${migration.version}_${migration.name} conflicts with schema state`);\n      }\n      continue;\n    }\n    await db.query(withNativeDrSharedLock(\n      migration.source.split(\"__AGENT_BRIDGE_MIGRATION_CHECKSUM__\").join(migration.checksum),\n    ));\n    const verified = (await recordedMigrations(db)).find(\n      (entry) => entry.version === migration.version,\n    );\n    if (verified?.name !== migration.name || verified.checksum !== migration.checksum) {\n      throw new Error(`migration ${migration.version}_${migration.name} was not recorded correctly`);\n    }\n  }\n\n  return recordedMigrations(db);\n}\n"],"mappings":";;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS,gBAAgB;AAClC,SAAS,YAAY;AAGrB,IAAM,iBAAiB;AAGhB,IAAM,8BAA8B;AAC3C,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B,CAAC,iBAAiB,MAAM;AAAA,EACxB,CAAC,aAAa,MAAM;AAAA,EACpB,CAAC,uBAAuB,MAAM;AAAA,EAC9B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,kBAAkB,MAAM;AAAA,EACzB,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,0BAA0B,QAAQ;AAAA,EACnC,CAAC,sBAAsB,OAAO;AAAA,EAC9B,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,kCAAkC,aAAa;AAAA,EAChD,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,gCAAgC,OAAO;AAAA,EACxC,CAAC,oCAAoC,aAAa;AAAA,EAClD,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,uCAAuC,MAAM;AAAA,EAC9C,CAAC,8BAA8B,aAAa;AAAA,EAC5C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,yCAAyC,SAAS;AAAA,EACnD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6BAA6B,SAAS;AAAA,EACvC,CAAC,iCAAiC,aAAa;AAAA,EAC/C,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,kCAAkC,MAAM;AAAA,EACzC,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,8BAA8B,OAAO;AAAA,EACtC,CAAC,2CAA2C,MAAM;AAAA,EAClD,CAAC,+DAA+D,MAAM;AAAA,EACtE,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,kCAAkC,MAAM;AAAA,EACzC,CAAC,gDAAgD,QAAQ;AAAA,EACzD,CAAC,8CAA8C,MAAM;AAAA,EACrD,CAAC,8CAA8C,MAAM;AAAA,EACrD,CAAC,2CAA2C,MAAM;AAAA,EAClD,CAAC,sDAAsD,MAAM;AAAA,EAC7D,CAAC,wDAAwD,MAAM;AAAA,EAC/D,CAAC,2CAA2C,aAAa;AAAA,EACzD,CAAC,4CAA4C,aAAa;AAAA,EAC1D,CAAC,6CAA6C,aAAa;AAAA,EAC3D,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,kDAAkD,MAAM;AAAA,EACzD,CAAC,kDAAkD,MAAM;AAAA,EACzD,CAAC,kDAAkD,aAAa;AAAA,EAChE,CAAC,kDAAkD,MAAM;AAAA,EACzD,CAAC,gEAAgE,MAAM;AAAA,EACvE,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,0CAA0C,aAAa;AAAA,EACxD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,gCAAgC,QAAQ;AAAA,EACzC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,2BAA2B,OAAO;AAAA,EACnC,CAAC,+BAA+B,aAAa;AAAA,EAC7C,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,2BAA2B,MAAM;AAAA,EAClC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,6BAA6B,aAAa;AAAA,EAC3C,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,0CAA0C,aAAa;AAAA,EACxD,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,0CAA0C,MAAM;AAAA,EACjD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,6CAA6C,QAAQ;AAAA,EACtD,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,oCAAoC,MAAM;AAAA,EAC3C,CAAC,6CAA6C,MAAM;AAAA,EACpD,CAAC,6CAA6C,MAAM;AAAA,EACpD,CAAC,6CAA6C,QAAQ;AAAA,EACtD,CAAC,8BAA8B,MAAM;AAAA,EACrC,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,mCAAmC,aAAa;AAAA,EACjD,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,iCAAiC,aAAa;AAAA,EAC/C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,2CAA2C,MAAM;AAAA,EAClD,CAAC,0CAA0C,MAAM;AAAA,EACjD,CAAC,+CAA+C,QAAQ;AAAA,EACxD,CAAC,2CAA2C,QAAQ;AAAA,EACpD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,wCAAwC,aAAa;AAAA,EACtD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,qCAAqC,MAAM;AAAA,EAC5C,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,+CAA+C,QAAQ;AAAA,EACxD,CAAC,mCAAmC,MAAM;AAAA,EAC1C,CAAC,gCAAgC,MAAM;AAAA,EACvC,CAAC,qCAAqC,aAAa;AAAA,EACnD,CAAC,kDAAkD,MAAM;AAAA,EACzD,CAAC,qDAAqD,MAAM;AAAA,EAC5D,CAAC,iDAAiD,MAAM;AAAA,EACxD,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,gDAAgD,MAAM;AAAA,EACvD,CAAC,6DAA6D,QAAQ;AAAA,EACtE,CAAC,4CAA4C,MAAM;AAAA,EACnD,CAAC,wDAAwD,MAAM;AAAA,EAC/D,CAAC,wDAAwD,MAAM;AAAA,EAC/D,CAAC,iDAAiD,aAAa;AAAA,EAC/D,CAAC,sCAAsC,MAAM;AAAA,EAC7C,CAAC,oDAAoD,MAAM;AAAA,EAC3D,CAAC,6CAA6C,aAAa;AAAA,EAC3D,CAAC,qBAAqB,MAAM;AAAA,EAC5B,CAAC,eAAe,MAAM;AAAA,EACtB,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,mBAAmB,MAAM;AAAA,EAC1B,CAAC,oBAAoB,OAAO;AAAA,EAC5B,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,kCAAkC,MAAM;AAAA,EACzC,CAAC,yCAAyC,MAAM;AAAA,EAChD,CAAC,wCAAwC,MAAM;AAAA,EAC/C,CAAC,wCAAwC,QAAQ;AAAA,EACjD,CAAC,gCAAgC,aAAa;AAAA,EAC9C,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,uBAAuB,MAAM;AAAA,EAC9B,CAAC,sBAAsB,MAAM;AAAA,EAC7B,CAAC,iBAAiB,MAAM;AAAA,EACxB,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,wBAAwB,MAAM;AAAA,EAC/B,CAAC,oBAAoB,MAAM;AAAA,EAC3B,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,yBAAyB,aAAa;AAAA,EACvC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,+BAA+B,MAAM;AAAA,EACtC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,iCAAiC,MAAM;AAAA,EACxC,CAAC,yBAAyB,MAAM;AAAA,EAChC,CAAC,0BAA0B,MAAM;AAAA,EACjC,CAAC,6BAA6B,MAAM;AAAA,EACpC,CAAC,4BAA4B,MAAM;AAAA,EACnC,CAAC,gCAAgC,OAAO;AAC1C,CAAC;AAYM,IAAM,sBAAsB;AAAA,EACjC,EAAE,SAAS,GAAG,MAAM,eAAe;AAAA,EACnC,EAAE,SAAS,GAAG,MAAM,gCAAgC;AAAA,EACpD,EAAE,SAAS,GAAG,MAAM,+BAA+B;AAAA,EACnD,EAAE,SAAS,GAAG,MAAM,wBAAwB;AAAA,EAC5C,EAAE,SAAS,GAAG,MAAM,2BAA2B;AAAA,EAC/C,EAAE,SAAS,GAAG,MAAM,+BAA+B;AAAA,EACnD,EAAE,SAAS,GAAG,MAAM,eAAe;AAAA,EACnC,EAAE,SAAS,GAAG,MAAM,mBAAmB;AAAA,EACvC,EAAE,SAAS,GAAG,MAAM,wBAAwB;AAAA,EAC5C,EAAE,SAAS,IAAI,MAAM,4BAA4B;AAAA,EACjD,EAAE,SAAS,IAAI,MAAM,sBAAsB;AAAA,EAC3C,EAAE,SAAS,IAAI,MAAM,oBAAoB;AAAA,EACzC,EAAE,SAAS,IAAI,MAAM,gBAAgB;AAAA,EACrC,EAAE,SAAS,IAAI,MAAM,sBAAsB;AAAA,EAC3C,EAAE,SAAS,IAAI,MAAM,oBAAoB;AAAA,EACzC,EAAE,SAAS,IAAI,MAAM,kBAAkB;AAAA,EACvC,EAAE,SAAS,IAAI,MAAM,4BAA4B;AAAA,EACjD,EAAE,SAAS,IAAI,MAAM,gCAAgC;AAAA,EACrD,EAAE,SAAS,IAAI,MAAM,oCAAoC;AAC3D;AAEA,SAAS,uBAAuB,QAAwB;AACtD,MAAI,CAAC,aAAa,KAAK,MAAM,GAAG;AAC9B,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO,OAAO;AAAA,IACZ;AAAA,IACA;AAAA;AAAA,sCAAiD,2BAA2B;AAAA;AAAA;AAAA,EAC9E;AACF;AAEA,SAAS,SAAS,QAAwB;AACxC,SAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,MAAM,EAAE,OAAO,KAAK;AACjE;AAEA,eAAe,mBAAmB,IAA8C;AAC9E,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,EACF;AACA,MAAI,CAAC,OAAO,KAAK,CAAC,GAAG,WAAY,QAAO,CAAC;AACzC,QAAM,SAAS,MAAM,GAAG;AAAA,IACtB;AAAA,EACF;AACA,SAAO,OAAO,KAAK,IAAI,CAAC,SAAS;AAAA,IAC/B,SAAS,OAAO,IAAI,OAAO;AAAA,IAC3B,MAAM,IAAI;AAAA,IACV,UAAU,IAAI;AAAA,EAChB,EAAE;AACJ;AAEA,eAAsB,kBAAkB,WAAkD;AACxF,QAAM,SAAS,MAAM,QAAQ,SAAS,GACnC,OAAO,CAAC,SAAS,eAAe,KAAK,IAAI,CAAC,EAC1C,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AAClD,QAAM,WAAW,MAAM,QAAQ,IAAI,MAAM,IAAI,OAAO,SAAS;AAC3D,UAAM,QAAQ,KAAK,MAAM,cAAc;AACvC,UAAM,SAAS,MAAM,SAAS,KAAK,WAAW,IAAI,GAAG,MAAM;AAC3D,WAAO,EAAE,SAAS,OAAO,MAAM,CAAC,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,QAAQ,UAAU,SAAS,MAAM,EAAE;AAAA,EACzF,CAAC,CAAC;AAEF,MACE,SAAS,WAAW,oBAAoB,UACxC,CAAC,SAAS;AAAA,IACR,CAAC,WAAW,UACV,UAAU,YAAY,oBAAoB,KAAK,GAAG,WAClD,UAAU,SAAS,oBAAoB,KAAK,GAAG;AAAA,EACnD,GACA;AACA,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,SAAO;AACT;AAEA,eAAsB,gBACpB,IACA,UACkB;AAClB,QAAM,UAAU,MAAM,mBAAmB,EAAE;AAC3C,SAAO,SAAS;AAAA,IACd,CAAC,UAAU,UACT,QAAQ,KAAK,GAAG,YAAY,SAAS,WACrC,QAAQ,KAAK,GAAG,SAAS,SAAS,QAClC,QAAQ,KAAK,GAAG,aAAa,SAAS;AAAA,EAC1C,KAAK,QAAQ,WAAW,SAAS;AACnC;AAEA,eAAsB,kBAAkB,IAAiB,uBAAkD;AACzG,QAAM,SAAS,MAAM,GAAG,MAWrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GA6QF;AACD,QAAM,MAAM,OAAO,KAAK,CAAC;AACzB,QAAM,cAAc,KAAK,gBAAgB,yBAAyB,CAAC,IAAI;AACvE,SAAO;AAAA,IACL,KAAK,cAAc,eAAe,IAAI,kBAAkB,IAAI,iBAC5D,IAAI,kBAAkB,IAAI,oBAAoB,IAAI,iBAAiB,IAAI,eAAe,IAAI;AAAA,EAC5F;AACF;AAEA,eAAsB,mBACpB,IACA,UAA+C,CAAC,GAC9B;AAClB,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQF;AACA,QAAM,SAAS,IAAI;AAAA,IACjB,QAAQ,KAAK,IAAI,CAACA,SAAQ,CAAC,GAAGA,KAAI,UAAU,IAAIA,KAAI,WAAW,IAAIA,KAAI,QAAQ,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,GAAG,gBAAgB,EAAE,KAAK,CAAC,CAAC,MAAM,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,IAAI,EAAG,QAAO;AAEpF,QAAM,UAAU,MAAM,GAAG;AAAA,IACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA6LF;AACA,QAAM,MAAM,QAAQ,KAAK,CAAC;AAC1B,MAAI,CAAC;AAAA,IACH,KAAK,aAAa,IAAI,iBAAiB,IAAI,eAAe,IAAI,SAAS,IAAI,aAC3E,IAAI,YAAY,IAAI,UAAU,IAAI,UAAU,IAAI,WAAW,IAAI,YAAY,IAAI,WAC/E,IAAI,WAAW,IAAI,aAAa,IAAI,kBAAkB,IAAI,gBAAgB,IAAI,eAC9E,IAAI,eAAe,IAAI,eAAe,IAAI,sBAAsB,IAAI,mBACpE,IAAI,cAAc,IAAI,eAAe,IAAI,iBAAiB,IAAI,sBAC9D,IAAI,oBAAoB,IAAI,yBAAyB,IAAI,6BAA6B,IAAI,iBAC1F,IAAI,sBAAsB,IAAI,kBAAkB,IAAI,kBACpD,IAAI,0BAA0B,IAAI,uBAAuB,IAAI,8BAC7D,IAAI,yBAAyB,IAAI,yBAAyB,IAAI,gCAC9D,IAAI;AAAA,EACN,EAAG,QAAO;AACV,QAAM,oBAAoB,MAAM,GAAG,MAKhC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,GAqDF;AACD,QAAM,WAAW,kBAAkB,KAAK,CAAC;AACzC,MAAI,CAAC,UAAU,UAAU,CAAC,SAAS,aAAa,CAAC,SAAS,UAAU,CAAC,SAAS,OAAQ,QAAO;AAC7F,MAAI;AACF,UAAM,WAAW,MAAM,GAAG;AAAA,MACxB;AAAA,IACF;AACA,UAAM,eAAe,MAAM,GAAG;AAAA,MAC5B;AAAA,IACF;AACA,UAAM,kBAAkB,MAAM,GAAG;AAAA,MAC/B;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,GAAG;AAAA,MAChC;AAAA,IACF;AACA,WAAO,SAAS,KAAK,CAAC,GAAG,UAAU,QAAQ,aAAa,KAAK,CAAC,GAAG,UAAU,QACzE,gBAAgB,KAAK,CAAC,GAAG,UAAU,QAAQ,iBAAiB,KAAK,CAAC,GAAG,UAAU,QAC/E,MAAM;AAAA,MACN;AAAA,MACA,QAAQ,0BAA0B;AAAA,IACpC;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,cACpB,IACA,WAC6B;AAC7B,QAAM,WAAW,MAAM,kBAAkB,SAAS;AAElD,aAAW,aAAa,UAAU;AAChC,UAAM,UAAU,MAAM,mBAAmB,EAAE;AAC3C,UAAM,WAAW,QAAQ,KAAK,CAAC,UAAU,MAAM,YAAY,UAAU,OAAO;AAC5E,QAAI,UAAU;AACZ,UAAI,SAAS,SAAS,UAAU,QAAQ,SAAS,aAAa,UAAU,UAAU;AAChF,cAAM,IAAI,MAAM,aAAa,UAAU,OAAO,IAAI,UAAU,IAAI,8BAA8B;AAAA,MAChG;AACA;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,MACb,UAAU,OAAO,MAAM,qCAAqC,EAAE,KAAK,UAAU,QAAQ;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,mBAAmB,EAAE,GAAG;AAAA,MAC9C,CAAC,UAAU,MAAM,YAAY,UAAU;AAAA,IACzC;AACA,QAAI,UAAU,SAAS,UAAU,QAAQ,SAAS,aAAa,UAAU,UAAU;AACjF,YAAM,IAAI,MAAM,aAAa,UAAU,OAAO,IAAI,UAAU,IAAI,6BAA6B;AAAA,IAC/F;AAAA,EACF;AAEA,SAAO,mBAAmB,EAAE;AAC9B;","names":["row"]}

package/dist/chunk-IHZFI7TH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/contracts/registry.ts"],"sourcesContent":["import Type, { type TSchema } from \"@sinclair/typebox\";\nimport { Check, Errors } from \"@sinclair/typebox/value\";\n\nexport const PROTOCOL_VERSION = \"2.1\";\nexport const LEGACY_PROTOCOL_VERSION = \"2.0\";\nexport const SUPPORTED_PROTOCOL_VERSIONS = [LEGACY_PROTOCOL_VERSION, PROTOCOL_VERSION] as const;\nexport const SUPPORTED_PROTOCOL_RANGE = SUPPORTED_PROTOCOL_VERSIONS.join(\",\");\nexport const PROTOCOL_HEADER = \"x-agent-bridge-protocol-version\";\nexport const SUPPORTED_PROTOCOL_HEADER = \"x-agent-bridge-supported-protocol-versions\";\nexport const SCOPE_ENFORCEMENT = true;\n\nconst StringArray = Type.Array(Type.String());\nconst Empty = Type.Object({}, { additionalProperties: false });\nconst OptionalString = () => Type.Optional(Type.String());\nconst OptionalNumber = (options: Record<string, unknown> = {}) => Type.Optional(Type.Number(options));\nconst OptionalBoolean = () => Type.Optional(Type.Boolean());\nconst NullableString = () => Type.Union([Type.String(), Type.Null()]);\nconst NullableNumber = () => Type.Union([Type.Number(), Type.Null()]);\nconst UUID_PATTERN = \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$\";\nconst UUID_V7_PATTERN = \"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-7[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$\";\n\nexport const ErrorIssueSchema = Type.Object({\n  path: Type.String(),\n  message: Type.String(),\n}, { additionalProperties: true });\n\nexport const ErrorEnvelopeSchema = Type.Object({\n  error: Type.Object({\n    code: Type.String(),\n    requestId: Type.String(),\n    message: OptionalString(),\n    operation: OptionalString(),\n    issues: Type.Optional(Type.Array(ErrorIssueSchema)),\n    details: Type.Optional(Type.Any()),\n    supportedProtocolVersions: Type.Optional(StringArray),\n  }, { additionalProperties: true }),\n}, { additionalProperties: true });\n\nconst DeliveryPolicySchema = Type.Union([\n  Type.Object({ mode: Type.Literal(\"mailbox\") }, { additionalProperties: false }),\n  Type.Object({\n    mode: Type.Literal(\"leased\"),\n    maxAttempts: Type.Number(),\n    retryBaseDelayMs: Type.Number(),\n    retryMaxDelayMs: Type.Number(),\n    retryJitterRatio: Type.Number(),\n    notBefore: OptionalString(),\n  }, { additionalProperties: false }),\n]);\n\nconst DeliveryPolicyInputSchema = Type.Object({\n  mode: Type.Optional(Type.Enum([\"mailbox\", \"leased\"])),\n  maxAttempts: OptionalNumber(),\n  retryBaseDelayMs: OptionalNumber(),\n  retryMaxDelayMs: OptionalNumber(),\n  retryJitterRatio: OptionalNumber(),\n  notBefore: OptionalString(),\n}, { additionalProperties: false });\n\nconst MessageDraftSchema = Type.Object({\n  id: Type.Optional(Type.String({ pattern: UUID_V7_PATTERN })),\n  source: OptionalString(),\n  project: OptionalString(),\n  type: Type.String(),\n  content: Type.String(),\n  contentType: OptionalString(),\n  data: Type.Optional(Type.Any()),\n  targets: Type.Optional(StringArray),\n  threadId: OptionalString(),\n  replyToId: OptionalString(),\n  correlationId: OptionalString(),\n  causationId: OptionalString(),\n  priority: Type.Optional(Type.Enum([\"info\", \"high\", \"urgent\"])),\n  expiresAt: OptionalString(),\n  idempotencyKey: OptionalString(),\n  atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray),\n  metadata: Type.Optional(Type.Any()),\n  deliveryPolicy: Type.Optional(DeliveryPolicyInputSchema),\n}, { additionalProperties: false });\n\n// Exact field set released by package 0.2.0 at d8184fe. A headerless\n// gateway response selects this wire contract, not the current one.\nexport const LegacyMessageDraftSchema = Type.Object({\n  id: OptionalString(), source: OptionalString(), type: Type.String(), content: Type.String(),\n  contentType: OptionalString(), data: Type.Optional(Type.Any()), targets: Type.Optional(StringArray),\n  threadId: OptionalString(), replyToId: OptionalString(), correlationId: OptionalString(),\n  causationId: OptionalString(), priority: Type.Optional(Type.Enum([\"info\", \"high\", \"urgent\"])),\n  expiresAt: OptionalString(), idempotencyKey: OptionalString(), atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray), metadata: Type.Optional(Type.Any()),\n}, { additionalProperties: false });\n\nconst MessageSchema = Type.Object({\n  id: Type.String(),\n  workspace: Type.String(),\n  project: OptionalString(),\n  source: Type.String(),\n  type: Type.String(),\n  content: Type.String(),\n  contentType: Type.String(),\n  sequence: Type.String(),\n  createdAt: Type.String(),\n  data: Type.Optional(Type.Any()),\n  targets: StringArray,\n  threadId: OptionalString(),\n  replyToId: OptionalString(),\n  correlationId: OptionalString(),\n  causationId: OptionalString(),\n  priority: Type.Enum([\"info\", \"high\", \"urgent\"]),\n  expiresAt: OptionalString(),\n  idempotencyKey: OptionalString(),\n  atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray),\n  metadata: Type.Optional(Type.Any()),\n  deliveryPolicy: DeliveryPolicySchema,\n}, { additionalProperties: true });\n\nexport const LegacyMessageSchema = Type.Object({\n  id: Type.String(), workspace: Type.String(), source: Type.String(), type: Type.String(),\n  content: Type.String(), contentType: Type.String(), sequence: Type.String(), createdAt: Type.String(),\n  data: Type.Optional(Type.Any()), targets: StringArray, threadId: OptionalString(), replyToId: OptionalString(),\n  correlationId: OptionalString(), causationId: OptionalString(), priority: Type.Enum([\"info\", \"high\", \"urgent\"]),\n  expiresAt: OptionalString(), idempotencyKey: OptionalString(), atribReceiptId: OptionalString(),\n  informedBy: Type.Optional(StringArray), metadata: Type.Optional(Type.Any()),\n}, { additionalProperties: true });\n\nconst DeliveryStateSchema = Type.Enum([\"pending\", \"claimed\", \"acked\", \"retrying\", \"dead\", \"cancelled\"]);\nconst DeliveryActionSchema = Type.Enum([\"created\", \"claim\", \"ack\", \"nack_retry\", \"nack_dead\", \"lease_expired\", \"attempts_exhausted\", \"message_expired\", \"cancel\", \"requeue\"]);\nconst DeliverySchema = Type.Object({\n  id: Type.String(),\n  messageId: Type.String(),\n  workspace: Type.String(),\n  recipient: Type.String(),\n  state: DeliveryStateSchema,\n  attempt: Type.Number(),\n  cycleAttempt: Type.Number(),\n  requeueCount: Type.Number(),\n  createdAt: Type.String(),\n  priorityRank: Type.Number(),\n  availableAt: Type.String(),\n  leaseToken: OptionalString(),\n  leaseOwner: OptionalString(),\n  leaseExpiresAt: OptionalString(),\n  lastError: OptionalString(),\n  lastActor: OptionalString(),\n  lastAction: DeliveryActionSchema,\n}, { additionalProperties: true });\n\nexport const LegacyDeliverySchema = Type.Object({\n  id: Type.String(), messageId: Type.String(), workspace: Type.String(), recipient: Type.String(),\n  state: Type.Enum([\"pending\", \"claimed\", \"acked\", \"retrying\", \"dead\"]), attempt: Type.Number(),\n  availableAt: Type.String(), leaseToken: OptionalString(), leaseOwner: OptionalString(),\n  leaseExpiresAt: OptionalString(), lastError: OptionalString(),\n}, { additionalProperties: true });\n\nconst DeliveryEventSchema = Type.Object({\n  sequence: Type.String(),\n  deliveryId: Type.String(),\n  messageId: Type.String(),\n  workspace: Type.String(),\n  recipient: Type.String(),\n  fromState: Type.Optional(DeliveryStateSchema),\n  toState: DeliveryStateSchema,\n  attempt: Type.Number(),\n  cycleAttempt: Type.Number(),\n  requeueCount: Type.Number(),\n  leaseOwner: OptionalString(),\n  error: OptionalString(),\n  actor: Type.String(),\n  action: DeliveryActionSchema,\n  createdAt: Type.String(),\n}, { additionalProperties: true });\n\nconst PresenceSchema = Type.Object({\n  workspace: Type.String(),\n  agent: Type.String(),\n  instance: Type.String(),\n  runtimeType: OptionalString(),\n  capabilities: StringArray,\n  leaseExpiresAt: Type.String(),\n  lastSeenAt: Type.String(),\n}, { additionalProperties: true });\n\nconst DeliveryDiagnosticsProperties = {\n  schemaVersion: Type.Enum([\"local-v2\", \"postgres-v2\", \"legacy-v1\"]),\n  deliverySupported: Type.Boolean(),\n  pending: NullableNumber(),\n  claimed: NullableNumber(),\n  retrying: NullableNumber(),\n  dead: NullableNumber(),\n  cancelled: Type.Optional(NullableNumber()),\n  oldestAvailableAt: OptionalString(),\n  due: Type.Optional(NullableNumber()),\n  scheduled: Type.Optional(NullableNumber()),\n  expiredLeases: Type.Optional(NullableNumber()),\n  oldestDueAt: OptionalString(),\n  queueLagMs: Type.Optional(NullableNumber()),\n  gatewayAuthorityId: OptionalString(),\n  credentialId: OptionalString(),\n  principal: Type.Optional(Type.Object({ workspace: Type.String(), agent: Type.String() }, { additionalProperties: true })),\n} as const;\n\nconst DiagnosticsSchema = Type.Object(DeliveryDiagnosticsProperties, { additionalProperties: true });\n\nconst ClientDiagnosticsSchema = Type.Object({\n  ...DeliveryDiagnosticsProperties,\n  remoteReachable: Type.Optional(Type.Union([Type.Boolean(), Type.Null()])),\n  outboxPending: OptionalNumber(),\n  outboxBlocked: OptionalNumber(),\n  cachedMessages: OptionalNumber(),\n  lastSyncAt: OptionalString(),\n  lastSyncError: OptionalString(),\n  outboxDue: OptionalNumber(),\n  outboxScheduled: OptionalNumber(),\n  outboxLeased: OptionalNumber(),\n  outboxOldestDueAt: OptionalString(),\n  outboxQueueLagMs: OptionalNumber(),\n  outboxOldestBlockedAt: OptionalString(),\n  outboxBlockedAgeMs: Type.Optional(NullableNumber()),\n  outboxBlockedMaxAttempts: OptionalNumber(),\n  outboxBlockedLastError: OptionalString(),\n  outboxNextRetryAt: OptionalString(),\n  lastOutboundSyncAt: OptionalString(),\n  lastInboundSyncAt: OptionalString(),\n  lastSyncAttemptAt: OptionalString(),\n  syncLoopState: Type.Optional(Type.Enum([\"disabled\", \"idle\", \"running\", \"backoff\", \"paused\", \"stopped\", \"failed\"])),\n  syncLoopError: OptionalString(),\n  remoteError: OptionalString(),\n  migrationState: Type.Optional(Type.Enum([\"active\", \"draining\", \"retired\"])),\n  migrationOperationId: OptionalString(),\n  migrationLeaseExpiresAt: OptionalString(),\n}, { additionalProperties: true });\n\nconst ClientStatusSchema = Type.Object({\n  status: Type.Enum([\"ok\", \"unknown\", \"degraded\", \"failed\"]),\n  localHealthy: Type.Boolean(),\n  connected: Type.Boolean(),\n  remoteReachable: Type.Union([Type.Boolean(), Type.Null()]),\n  provider: Type.Enum([\"local\", \"gateway\", \"legacy-supabase\"]),\n  workspace: Type.String(),\n  agent: Type.String(),\n  instance: Type.Union([Type.String(), Type.Null()]),\n  schemaVersion: Type.Enum([\"local-v2\", \"postgres-v2\", \"legacy-v1\"]),\n  endpoint: Type.Union([Type.String(), Type.Null()]),\n  database: Type.Union([Type.String(), Type.Null()]),\n  cursorPath: Type.String(),\n  lastCursor: Type.Union([Type.String(), Type.Null()]),\n  queue: ClientDiagnosticsSchema,\n  checks: Type.Array(Type.Object({\n    name: Type.String(),\n    status: Type.Enum([\"ok\", \"unknown\", \"degraded\", \"failed\"]),\n    message: Type.String(),\n  }, { additionalProperties: false })),\n}, { additionalProperties: true });\n\nconst HistoryRequestSchema = Type.Object({\n  cursor: OptionalString(),\n  limit: OptionalNumber({ minimum: 1, maximum: 200 }),\n  types: Type.Optional(StringArray),\n  mailbox: Type.Optional(Type.Enum([\"inbox\", \"sent\", \"all\"])),\n  receiptState: Type.Optional(Type.Enum([\"any\", \"unread\", \"read\"])),\n  includeExpired: OptionalBoolean(),\n  source: OptionalString(),\n  project: OptionalString(),\n  since: OptionalString(),\n  unacknowledgedBy: OptionalString(),\n  threadId: OptionalString(),\n  latest: OptionalBoolean(),\n}, { additionalProperties: false });\n\nconst MessagePageSchema = Type.Object({\n  messages: Type.Array(MessageSchema),\n  cursor: OptionalString(),\n  source: Type.Optional(Type.Enum([\"remote\", \"cache\"])),\n  stale: OptionalBoolean(),\n  degraded: OptionalBoolean(),\n  acknowledgements: Type.Optional(Type.Enum([\"authoritative\", \"unknown\"])),\n  lastSyncedAt: OptionalString(),\n}, { additionalProperties: true });\n\nconst DeliveryPageSchema = Type.Object({ deliveries: Type.Array(DeliverySchema), cursor: OptionalString() }, { additionalProperties: true });\nconst DeliveryEventPageSchema = Type.Object({ events: Type.Array(DeliveryEventSchema), cursor: OptionalString() }, { additionalProperties: true });\nconst DeliveryIdSchema = Type.Object({ deliveryId: Type.String() }, { additionalProperties: false });\nconst LeaseSchema = Type.Object({ deliveryId: Type.String(), leaseToken: Type.String() }, { additionalProperties: false });\nconst RetryPolicySchema = Type.Object({\n  maxAttempts: OptionalNumber(),\n  baseDelayMs: OptionalNumber(),\n  maxDelayMs: OptionalNumber(),\n  jitterRatio: OptionalNumber(),\n}, { additionalProperties: false });\n\nconst NegativeAcknowledgeRequestSchema = Type.Object({\n  deliveryId: Type.String(),\n  leaseToken: Type.String(),\n  error: Type.String(),\n  disposition: Type.Optional(Type.Enum([\"retry\", \"dead\"])),\n  dead: OptionalBoolean(),\n  retryPolicy: Type.Optional(RetryPolicySchema),\n}, { additionalProperties: false });\n\nconst LegacyNegativeAcknowledgeRequestSchema = Type.Object({\n  deliveryId: Type.String(),\n  leaseToken: Type.String(),\n  error: OptionalString(),\n  disposition: Type.Optional(Type.Enum([\"retry\", \"dead\"])),\n  dead: OptionalBoolean(),\n  retryPolicy: Type.Optional(RetryPolicySchema),\n}, { additionalProperties: false });\n\nconst SyncResponseSchema = Type.Object({\n  online: Type.Boolean(),\n  pushed: Type.Number(),\n  deduplicated: Type.Number(),\n  pulled: Type.Number(),\n  pending: Type.Number(),\n  blocked: Type.Number(),\n  cached: Type.Number(),\n  cursor: Type.Optional(NullableString()),\n  lastSyncedAt: Type.Optional(NullableString()),\n  lastError: Type.Optional(NullableString()),\n  failureRetryable: OptionalBoolean(),\n}, { additionalProperties: true });\n\nconst ClaimResponseSchema = Type.Object({\n  delivery: Type.Union([DeliverySchema, Type.Null()]),\n  leaseToken: OptionalString(),\n}, {\n  additionalProperties: true,\n  oneOf: [\n    { properties: { delivery: { type: \"null\" }, leaseToken: false }, required: [\"delivery\"] },\n    { properties: { delivery: DeliverySchema, leaseToken: { type: \"string\" } }, required: [\"delivery\", \"leaseToken\"] },\n  ],\n});\n\nexport const AUTHORIZATION_SCOPES = [\n  \"deliveries:claim\",\n  \"deliveries:manage\",\n  \"deliveries:read\",\n  \"deliveries:settle\",\n  \"gateway:metrics\",\n  \"messages:read\",\n  \"messages:write\",\n  \"presence:read\",\n  \"presence:write\",\n  \"receipts:write\",\n  \"status:read\",\n] as const;\n\nexport type AuthorizationScope = typeof AUTHORIZATION_SCOPES[number];\n\nexport type ContractProvider = \"local\" | \"gateway\" | \"legacy-supabase\";\nexport type ContractSurface = \"mcp\" | \"http\" | \"cli\";\nexport type OperationId =\n  | \"capabilities\" | \"status\" | \"client_status\" | \"gateway_metrics\" | \"publish_message\" | \"history\"\n  | \"issue_endpoint_migration_challenge\" | \"consume_endpoint_migration_challenge\"\n  | \"record_receipt\" | \"claim_delivery\" | \"list_deliveries\" | \"list_delivery_events\"\n  | \"cancel_delivery\" | \"requeue_delivery\" | \"extend_delivery\" | \"acknowledge_delivery\"\n  | \"negative_acknowledge_delivery\" | \"heartbeat\" | \"presence\" | \"sync\";\n\nexport interface HttpContract {\n  method: \"GET\" | \"POST\";\n  path: string;\n  successStatus?: 200 | 201;\n  responseContentType?: \"application/json\" | \"text/plain\";\n  queryAliases?: Readonly<Record<string, readonly string[]>>;\n}\n\nexport interface CliContract {\n  command: string;\n  aliases?: readonly string[];\n  options: readonly string[];\n  response?: TSchema;\n  variants?: readonly CliCompatibilityVariant[];\n}\n\nexport interface CliCompatibilityVariant {\n  command: string;\n  condition: { kind: \"always\" } | { kind: \"option-present\"; option: string };\n  routesTo: OperationId;\n  options: readonly string[];\n  response: TSchema;\n}\n\nexport interface OperationContract {\n  id: OperationId;\n  summary: string;\n  request: TSchema;\n  response: TSchema;\n  scopes: readonly AuthorizationScope[];\n  providers: readonly ContractProvider[];\n  mcp?: { name: string };\n  http?: HttpContract;\n  cli?: CliContract;\n}\n\nconst ALL_PROVIDERS = [\"local\", \"gateway\", \"legacy-supabase\"] as const;\nconst DELIVERY_PROVIDERS = [\"local\", \"gateway\"] as const;\nconst GATEWAY_PROVIDER = [\"gateway\"] as const;\nconst operation = (entry: OperationContract): OperationContract => entry;\nconst HistoryCliOptions = [\"cursor\", \"limit\", \"type\", \"category\", \"mailbox\", \"receipt-state\", \"source\", \"project\", \"since\", \"unacked-by\", \"thread-id\", \"latest\"] as const;\nconst LegacyGetRowSchema = Type.Object({\n  id: Type.Union([Type.String(), Type.Number()]),\n  source: Type.String(),\n  category: Type.String(),\n  content: Type.String(),\n  priority: Type.Enum([\"info\", \"high\", \"urgent\"]),\n  project: NullableString(),\n  metadata: Type.Any(),\n  created_at: Type.String(),\n}, { additionalProperties: false });\nconst ReceiptCliResponseSchema = Type.Object({\n  acknowledged: Type.Number(),\n  agent: Type.String(),\n}, { additionalProperties: true });\n\nexport const operations: readonly OperationContract[] = [\n  operation({ id: \"capabilities\", summary: \"Discover operations available on the current surface.\", request: Empty, response: Type.Object({ protocolVersion: Type.String(), currentProtocolVersion: Type.String(), selectedProtocolVersion: Type.String(), supportedProtocolVersions: StringArray, scopeEnforcement: Type.Boolean(), requestAuthority: Type.Boolean(), rowIsolation: Type.Boolean(), authorizationModel: Type.Enum([\"scoped-credential\", \"credential-wide\", \"process-identity\", \"legacy-key\"]), surface: Type.Enum([\"mcp\", \"http\", \"cli\"]), provider: Type.Enum([\"local\", \"gateway\", \"legacy-supabase\"]), grantedScopes: Type.Optional(StringArray), operations: Type.Array(Type.Object({ id: Type.String(), summary: Type.String(), requiredScopes: StringArray, mcp: Type.Optional(Type.Any()), http: Type.Optional(Type.Any()), cli: Type.Optional(Type.Any()) }, { additionalProperties: true })) }, { additionalProperties: true }), scopes: [], providers: ALL_PROVIDERS, mcp: { name: \"capabilities\" }, http: { method: \"GET\", path: \"/v2/capabilities\" }, cli: { command: \"capabilities\", options: [] } }),\n  operation({ id: \"status\", summary: \"Read gateway delivery diagnostics.\", request: Empty, response: DiagnosticsSchema, scopes: [\"status:read\"], providers: ALL_PROVIDERS, http: { method: \"GET\", path: \"/v2/status\" } }),\n  operation({ id: \"issue_endpoint_migration_challenge\", summary: \"Issue a short-lived endpoint migration challenge commitment.\", request: Type.Object({ challenge: Type.String({ pattern: \"^[0-9a-f]{64}$\" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), verifierCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.String() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: \"POST\", path: \"/v2/endpoint-migration-challenges\" } }),\n  operation({ id: \"consume_endpoint_migration_challenge\", summary: \"Consume a short-lived endpoint migration challenge commitment.\", request: Type.Object({ challenge: Type.String({ pattern: \"^[0-9a-f]{64}$\" }), expectedGatewayAuthorityId: Type.String({ pattern: UUID_PATTERN }), issuerCredentialId: Type.String({ pattern: UUID_PATTERN }) }, { additionalProperties: false }), response: Type.Object({ gatewayAuthorityId: Type.String(), issuerCredentialId: Type.String(), verifierCredentialId: Type.String(), expiresAt: Type.Union([Type.String(), Type.Null()]), consumed: Type.Boolean() }, { additionalProperties: false }), scopes: [], providers: GATEWAY_PROVIDER, http: { method: \"POST\", path: \"/v2/endpoint-migration-challenges/consume\" } }),\n  operation({ id: \"client_status\", summary: \"Read client connectivity and provider diagnostics.\", request: Empty, response: ClientStatusSchema, scopes: [\"status:read\"], providers: ALL_PROVIDERS, cli: { command: \"status\", aliases: [\"doctor\"], options: [] } }),\n  operation({ id: \"gateway_metrics\", summary: \"Read Prometheus gateway counters.\", request: Empty, response: Type.String(), scopes: [\"gateway:metrics\"], providers: GATEWAY_PROVIDER, http: { method: \"GET\", path: \"/metrics\", responseContentType: \"text/plain\" } }),\n  operation({ id: \"publish_message\", summary: \"Create an immutable Agent Bridge v2 message.\", request: MessageDraftSchema, response: Type.Object({ created: Type.Boolean(), message: MessageSchema, disposition: Type.Optional(Type.Enum([\"committed\", \"queued\"])), authoritative: OptionalBoolean() }, { additionalProperties: true }), scopes: [\"messages:write\"], providers: ALL_PROVIDERS, mcp: { name: \"send\" }, http: { method: \"POST\", path: \"/v2/messages\", successStatus: 201 }, cli: { command: \"send\", aliases: [\"post\"], options: [\"source\", \"project\", \"type\", \"kind\", \"category\", \"content\", \"content-type\", \"data\", \"payload\", \"payload-mime\", \"payload-ref\", \"payload-ciphertext\", \"target\", \"target-agent\", \"target-agents\", \"thread-id\", \"reply-to-id\", \"correlation-id\", \"causation-id\", \"priority\", \"expires-at\", \"idempotency-key\", \"atrib-receipt-id\", \"informed-by\", \"metadata\", \"delivery-mode\", \"delivery-policy\", \"delivery-max-attempts\", \"retry-base-ms\", \"retry-max-ms\", \"retry-jitter\", \"not-before\", \"message-id\"] } }),\n  operation({ id: \"history\", summary: \"Read visible messages after an opaque cursor.\", request: HistoryRequestSchema, response: MessagePageSchema, scopes: [\"messages:read\"], providers: ALL_PROVIDERS, mcp: { name: \"history\" }, http: { method: \"GET\", path: \"/v2/history\", queryAliases: { unacknowledgedBy: [\"unacked_by\"] } }, cli: { command: \"history\", aliases: [\"inbox\", \"sent\"], options: HistoryCliOptions, variants: [{ command: \"get\", condition: { kind: \"always\" }, routesTo: \"history\", options: HistoryCliOptions, response: Type.Array(LegacyGetRowSchema) }] } }),\n  operation({ id: \"record_receipt\", summary: \"Record caller-bound inbox read receipts.\", request: Type.Object({ messageIds: Type.Array(Type.String(), { minItems: 1, maxItems: 200 }) }, { additionalProperties: false }), response: Type.Object({ recorded: Type.Number() }, { additionalProperties: true }), scopes: [\"receipts:write\"], providers: ALL_PROVIDERS, http: { method: \"POST\", path: \"/v2/receipts\" }, cli: { command: \"acknowledge\", aliases: [\"receipt\"], options: [\"ids\"], response: ReceiptCliResponseSchema, variants: [{ command: \"ack\", condition: { kind: \"option-present\", option: \"ids\" }, routesTo: \"record_receipt\", options: [\"ids\"], response: ReceiptCliResponseSchema }] } }),\n  operation({ id: \"claim_delivery\", summary: \"Atomically claim the next targeted delivery.\", request: Type.Object({ leaseMs: OptionalNumber(), maxAttempts: OptionalNumber() }, { additionalProperties: false }), response: ClaimResponseSchema, scopes: [\"deliveries:claim\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"claim\" }, http: { method: \"POST\", path: \"/v2/deliveries/claim\" }, cli: { command: \"claim\", options: [\"lease-ms\", \"max-attempts\"], response: Type.Union([Type.Object({ delivery: DeliverySchema, leaseToken: Type.String() }, { additionalProperties: true }), Type.Null()]) } }),\n  operation({ id: \"list_deliveries\", summary: \"List caller-visible deliveries.\", request: Type.Object({ cursor: OptionalString(), limit: OptionalNumber(), role: Type.Optional(Type.Enum([\"recipient\", \"publisher\", \"all\"])), messageId: OptionalString(), recipient: OptionalString(), states: Type.Optional(Type.Array(DeliveryStateSchema)) }, { additionalProperties: false }), response: DeliveryPageSchema, scopes: [\"deliveries:read\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"list_deliveries\" }, http: { method: \"GET\", path: \"/v2/deliveries\" }, cli: { command: \"deliveries\", aliases: [\"dead-letters\"], options: [\"cursor\", \"limit\", \"role\", \"message-id\", \"recipient\", \"state\"] } }),\n  operation({ id: \"list_delivery_events\", summary: \"List the append-only event history for a delivery.\", request: Type.Object({ deliveryId: Type.String(), cursor: OptionalString(), limit: OptionalNumber() }, { additionalProperties: false }), response: DeliveryEventPageSchema, scopes: [\"deliveries:read\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"list_delivery_events\" }, http: { method: \"GET\", path: \"/v2/deliveries/{deliveryId}/events\" }, cli: { command: \"delivery-events\", options: [\"delivery-id\", \"cursor\", \"limit\"] } }),\n  operation({ id: \"cancel_delivery\", summary: \"Cancel a delivery as its publisher.\", request: DeliveryIdSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:manage\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"cancel_delivery\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/cancel\" }, cli: { command: \"cancel\", options: [\"delivery-id\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"requeue_delivery\", summary: \"Requeue a delivery as its publisher.\", request: DeliveryIdSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:manage\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"requeue_delivery\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/requeue\" }, cli: { command: \"requeue\", options: [\"delivery-id\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"extend_delivery\", summary: \"Extend a claimed delivery lease.\", request: Type.Object({ deliveryId: Type.String(), leaseToken: Type.String(), leaseMs: Type.Number() }, { additionalProperties: false }), response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:settle\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"extend\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/extend\" }, cli: { command: \"extend\", options: [\"delivery-id\", \"lease-token\", \"lease-ms\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"acknowledge_delivery\", summary: \"Settle a claimed delivery successfully.\", request: LeaseSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:settle\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"acknowledge\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/ack\" }, cli: { command: \"ack\", options: [\"delivery-id\", \"lease-token\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"negative_acknowledge_delivery\", summary: \"Settle a claimed delivery for retry or dead letter.\", request: NegativeAcknowledgeRequestSchema, response: Type.Object({ delivery: Type.Union([DeliverySchema, Type.Null()]) }, { additionalProperties: true }), scopes: [\"deliveries:settle\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"negative_acknowledge\" }, http: { method: \"POST\", path: \"/v2/deliveries/{deliveryId}/nack\" }, cli: { command: \"nack\", options: [\"delivery-id\", \"lease-token\", \"error\", \"disposition\", \"dead\"], response: Type.Union([DeliverySchema, Type.Null()]) } }),\n  operation({ id: \"heartbeat\", summary: \"Publish a leased runtime presence record.\", request: Type.Object({ leaseMs: OptionalNumber({ minimum: 1000, maximum: 900000 }), runtimeType: OptionalString(), capabilities: Type.Optional(StringArray) }, { additionalProperties: false }), response: PresenceSchema, scopes: [\"presence:write\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"heartbeat\" }, http: { method: \"POST\", path: \"/v2/presence/heartbeat\" }, cli: { command: \"join\", options: [\"lease-ms\", \"runtime\", \"capability\"] } }),\n  operation({ id: \"presence\", summary: \"List active agent runtime instances.\", request: Empty, response: Type.Object({ agents: Type.Array(PresenceSchema) }, { additionalProperties: true }), scopes: [\"presence:read\"], providers: DELIVERY_PROVIDERS, mcp: { name: \"presence\" }, http: { method: \"GET\", path: \"/v2/presence\" }, cli: { command: \"presence\", options: [] } }),\n  operation({ id: \"sync\", summary: \"Replay a gateway outbox and refresh its inbox cache.\", request: Type.Object({ maxPush: OptionalNumber(), maxPages: OptionalNumber() }, { additionalProperties: false }), response: SyncResponseSchema, scopes: [\"messages:write\", \"messages:read\"], providers: GATEWAY_PROVIDER, mcp: { name: \"sync\" }, cli: { command: \"sync\", options: [\"max-push\", \"max-pages\", \"limit\"] } }),\n];\n\nconst byId = new Map(operations.map((entry) => [entry.id, entry]));\n\nexport class ContractValidationError extends Error {\n  readonly code = \"invalid_input\";\n  readonly status = 400;\n  constructor(readonly operation: string, readonly issues: readonly { path: string; message: string }[]) {\n    super(`Request does not match the ${operation} schema`);\n  }\n}\n\nexport class ContractResponseError extends Error {\n  readonly code = \"protocol_mismatch\";\n  readonly status = 502;\n  constructor(readonly operation: string, readonly issues: readonly { path: string; message: string }[]) {\n    super(`Response does not match the ${operation} schema`);\n  }\n}\n\nfunction issues(schema: TSchema, value: unknown): readonly { path: string; message: string }[] {\n  return [...Errors(schema, value)].map((entry) => ({ path: entry.instancePath || \"/\", message: entry.message }));\n}\n\nexport function operationContract(operationId: string): OperationContract {\n  const contract = byId.get(operationId as OperationId);\n  if (!contract) throw new Error(`Unknown operation contract: ${operationId}`);\n  return contract;\n}\n\nexport function validateRequest(operationId: string, value: unknown): Record<string, unknown> {\n  const contract = operationContract(operationId);\n  if (!Check(contract.request, value)) throw new ContractValidationError(operationId, issues(contract.request, value));\n  return value as Record<string, unknown>;\n}\n\nexport function validateRequestForProtocol(operationId: string, value: unknown, protocolVersion: string): Record<string, unknown> {\n  if (protocolVersion === LEGACY_PROTOCOL_VERSION) {\n    if (operationId === \"publish_message\") {\n      if (!Check(LegacyMessageDraftSchema, value)) throw new ContractValidationError(operationId, issues(LegacyMessageDraftSchema, value));\n      return value as Record<string, unknown>;\n    }\n    if ([\"list_deliveries\", \"list_delivery_events\", \"cancel_delivery\", \"requeue_delivery\", \"capabilities\"].includes(operationId)) {\n      throw new ContractValidationError(operationId, [{ path: \"/\", message: `Operation is not supported by protocol ${LEGACY_PROTOCOL_VERSION}` }]);\n    }\n    if (operationId === \"history\" && value && typeof value === \"object\") {\n      const unsupported = [\"mailbox\", \"receiptState\", \"project\"].find((field) => (value as Record<string, unknown>)[field] !== undefined);\n      if (unsupported) throw new ContractValidationError(operationId, [{ path: `/${unsupported}`, message: `Field is not supported by protocol ${LEGACY_PROTOCOL_VERSION}` }]);\n    }\n  }\n  if (operationId !== \"negative_acknowledge_delivery\" || protocolVersion !== LEGACY_PROTOCOL_VERSION) {\n    return validateRequest(operationId, value);\n  }\n  if (!Check(LegacyNegativeAcknowledgeRequestSchema, value)) {\n    throw new ContractValidationError(operationId, issues(LegacyNegativeAcknowledgeRequestSchema, value));\n  }\n  return value as Record<string, unknown>;\n}\n\nexport function parseResponse(operationId: string, value: unknown): unknown {\n  const contract = operationContract(operationId);\n  const serialized = JSON.stringify(value);\n  const wireValue = serialized === undefined ? value : JSON.parse(serialized);\n  if (!Check(contract.response, wireValue)) throw new ContractResponseError(operationId, issues(contract.response, wireValue));\n  return wireValue;\n}\n\nexport function parseResponseForProtocol(operationId: string, value: unknown, protocolVersion: string): unknown {\n  if (protocolVersion !== LEGACY_PROTOCOL_VERSION) return parseResponse(operationId, value);\n  let schema: TSchema | undefined;\n  let normalized = value;\n  if (operationId === \"publish_message\") schema = Type.Object({ created: Type.Boolean(), message: LegacyMessageSchema }, { additionalProperties: true });\n  else if (operationId === \"history\") schema = Type.Object({ messages: Type.Array(LegacyMessageSchema), cursor: OptionalString() }, { additionalProperties: true });\n  else if (operationId === \"claim_delivery\") {\n    schema = Type.Union([Type.Object({ delivery: LegacyDeliverySchema, leaseToken: Type.String() }, { additionalProperties: true }), Type.Null()]);\n    normalized = value === null ? { delivery: null } : value;\n  } else if ([\"extend_delivery\", \"acknowledge_delivery\", \"negative_acknowledge_delivery\"].includes(operationId)) {\n    schema = LegacyDeliverySchema;\n    normalized = { delivery: value };\n  }\n  if (!schema) return parseResponse(operationId, value);\n  if (!Check(schema, value)) throw new ContractResponseError(operationId, issues(schema, value));\n  return normalized;\n}\n\nexport function parseCliResponse(\n  operationId: string,\n  value: unknown,\n  invocation?: { command: string; optionNames?: readonly string[] },\n): unknown {\n  const contract = operationContract(operationId);\n  const optionNames = new Set(invocation?.optionNames ?? []);\n  const variant = contract.cli?.variants?.find((entry) =>\n    entry.command === invocation?.command && cliVariantMatches(entry, optionNames));\n  const schema = variant?.response ?? contract.cli?.response ?? contract.response;\n  const serialized = JSON.stringify(value);\n  const wireValue = serialized === undefined ? value : JSON.parse(serialized);\n  if (!Check(schema, wireValue)) throw new ContractResponseError(operationId, issues(schema, wireValue));\n  return wireValue;\n}\n\nexport function availableOperations(context: { surface: ContractSurface; provider: ContractProvider }): readonly OperationContract[] {\n  return operations.filter((entry) => entry.providers.includes(context.provider) && Boolean(entry[context.surface]));\n}\n\nexport function operationForMcp(name: string, provider: ContractProvider): OperationContract | undefined {\n  return availableOperations({ surface: \"mcp\", provider }).find((entry) => entry.mcp?.name === name);\n}\n\nexport function operationForHttp(method: string, path: string): OperationContract | undefined {\n  return availableOperations({ surface: \"http\", provider: \"gateway\" }).find((entry) => entry.http?.method === method && entry.http.path === path);\n}\n\nfunction cliVariantMatches(\n  variant: CliCompatibilityVariant,\n  optionNames: ReadonlySet<string>,\n): boolean {\n  return variant.condition.kind === \"always\" || optionNames.has(variant.condition.option);\n}\n\nexport function operationForCli(\n  command: string,\n  provider: ContractProvider,\n  optionNames: readonly string[] = [],\n): OperationContract | undefined {\n  const selectedOptions = new Set(optionNames);\n  return availableOperations({ surface: \"cli\", provider }).find((entry) =>\n    entry.cli?.command === command ||\n    entry.cli?.aliases?.includes(command) ||\n    entry.cli?.variants?.some((variant) =>\n      variant.command === command && cliVariantMatches(variant, selectedOptions)));\n}\n\nexport function capabilityDocument(context: { surface: ContractSurface; provider: ContractProvider; selectedProtocolVersion?: string; requestAuthority?: boolean; rowIsolation?: boolean } = { surface: \"http\", provider: \"gateway\" }) {\n  const selectedProtocolVersion = context.selectedProtocolVersion ?? PROTOCOL_VERSION;\n  return {\n    protocolVersion: selectedProtocolVersion,\n    currentProtocolVersion: PROTOCOL_VERSION,\n    selectedProtocolVersion,\n    supportedProtocolVersions: [...SUPPORTED_PROTOCOL_VERSIONS],\n    scopeEnforcement: context.provider === \"gateway\" ? SCOPE_ENFORCEMENT : false,\n    requestAuthority: context.provider === \"gateway\" && context.requestAuthority === true,\n    rowIsolation: context.provider === \"gateway\" && context.requestAuthority === true && context.rowIsolation === true,\n    authorizationModel: context.provider === \"gateway\"\n      ? \"scoped-credential\"\n      : context.provider === \"local\"\n        ? \"process-identity\"\n        : \"legacy-key\",\n    surface: context.surface,\n    provider: context.provider,\n    operations: availableOperations(context).map(({ request: _request, response, providers: _providers, scopes, cli, ...entry }) => ({\n      ...entry,\n      ...(cli ? {\n        cli: {\n          command: cli.command,\n          ...(cli.aliases ? { aliases: cli.aliases } : {}),\n          options: cli.options,\n          outputSchema: cli.response ?? response,\n          ...(cli.variants ? {\n            variants: cli.variants.map((variant) => ({\n              command: variant.command,\n              condition: variant.condition,\n              routesTo: variant.routesTo,\n              options: variant.options,\n              outputSchema: variant.response,\n            })),\n          } : {}),\n        },\n      } : {}),\n      requiredScopes: [...scopes],\n    })),\n  };\n}\n\nexport function negotiateProtocolVersion(value: string | string[] | undefined): string {\n  const requested = Array.isArray(value) ? value[0] : value;\n  if (requested === undefined || requested.trim() === \"\") return LEGACY_PROTOCOL_VERSION;\n  if ((SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(requested.trim())) return requested.trim();\n  const error = new Error(\"Unsupported Agent Bridge protocol version\") as Error & { status: number; code: string; supported: string };\n  error.status = 426;\n  error.code = \"unsupported_protocol_version\";\n  error.supported = SUPPORTED_PROTOCOL_RANGE;\n  throw error;\n}\n"],"mappings":";;;AAAA,OAAO,UAA4B;AACnC,SAAS,OAAO,cAAc;AAEvB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,8BAA8B,CAAC,yBAAyB,gBAAgB;AAC9E,IAAM,2BAA2B,4BAA4B,KAAK,GAAG;AACrE,IAAM,kBAAkB;AACxB,IAAM,4BAA4B;AAClC,IAAM,oBAAoB;AAEjC,IAAM,cAAc,KAAK,MAAM,KAAK,OAAO,CAAC;AAC5C,IAAM,QAAQ,KAAK,OAAO,CAAC,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAC7D,IAAM,iBAAiB,MAAM,KAAK,SAAS,KAAK,OAAO,CAAC;AACxD,IAAM,iBAAiB,CAAC,UAAmC,CAAC,MAAM,KAAK,SAAS,KAAK,OAAO,OAAO,CAAC;AACpG,IAAM,kBAAkB,MAAM,KAAK,SAAS,KAAK,QAAQ,CAAC;AAC1D,IAAM,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AACpE,IAAM,iBAAiB,MAAM,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AACpE,IAAM,eAAe;AACrB,IAAM,kBAAkB;AAEjB,IAAM,mBAAmB,KAAK,OAAO;AAAA,EAC1C,MAAM,KAAK,OAAO;AAAA,EAClB,SAAS,KAAK,OAAO;AACvB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,sBAAsB,KAAK,OAAO;AAAA,EAC7C,OAAO,KAAK,OAAO;AAAA,IACjB,MAAM,KAAK,OAAO;AAAA,IAClB,WAAW,KAAK,OAAO;AAAA,IACvB,SAAS,eAAe;AAAA,IACxB,WAAW,eAAe;AAAA,IAC1B,QAAQ,KAAK,SAAS,KAAK,MAAM,gBAAgB,CAAC;AAAA,IAClD,SAAS,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,IACjC,2BAA2B,KAAK,SAAS,WAAW;AAAA,EACtD,GAAG,EAAE,sBAAsB,KAAK,CAAC;AACnC,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,uBAAuB,KAAK,MAAM;AAAA,EACtC,KAAK,OAAO,EAAE,MAAM,KAAK,QAAQ,SAAS,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAAA,EAC9E,KAAK,OAAO;AAAA,IACV,MAAM,KAAK,QAAQ,QAAQ;AAAA,IAC3B,aAAa,KAAK,OAAO;AAAA,IACzB,kBAAkB,KAAK,OAAO;AAAA,IAC9B,iBAAiB,KAAK,OAAO;AAAA,IAC7B,kBAAkB,KAAK,OAAO;AAAA,IAC9B,WAAW,eAAe;AAAA,EAC5B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AACpC,CAAC;AAED,IAAM,4BAA4B,KAAK,OAAO;AAAA,EAC5C,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC,WAAW,QAAQ,CAAC,CAAC;AAAA,EACpD,aAAa,eAAe;AAAA,EAC5B,kBAAkB,eAAe;AAAA,EACjC,iBAAiB,eAAe;AAAA,EAChC,kBAAkB,eAAe;AAAA,EACjC,WAAW,eAAe;AAC5B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,IAAI,KAAK,SAAS,KAAK,OAAO,EAAE,SAAS,gBAAgB,CAAC,CAAC;AAAA,EAC3D,QAAQ,eAAe;AAAA,EACvB,SAAS,eAAe;AAAA,EACxB,MAAM,KAAK,OAAO;AAAA,EAClB,SAAS,KAAK,OAAO;AAAA,EACrB,aAAa,eAAe;AAAA,EAC5B,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAC9B,SAAS,KAAK,SAAS,WAAW;AAAA,EAClC,UAAU,eAAe;AAAA,EACzB,WAAW,eAAe;AAAA,EAC1B,eAAe,eAAe;AAAA,EAC9B,aAAa,eAAe;AAAA,EAC5B,UAAU,KAAK,SAAS,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC7D,WAAW,eAAe;AAAA,EAC1B,gBAAgB,eAAe;AAAA,EAC/B,gBAAgB,eAAe;AAAA,EAC/B,YAAY,KAAK,SAAS,WAAW;AAAA,EACrC,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAClC,gBAAgB,KAAK,SAAS,yBAAyB;AACzD,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAI3B,IAAM,2BAA2B,KAAK,OAAO;AAAA,EAClD,IAAI,eAAe;AAAA,EAAG,QAAQ,eAAe;AAAA,EAAG,MAAM,KAAK,OAAO;AAAA,EAAG,SAAS,KAAK,OAAO;AAAA,EAC1F,aAAa,eAAe;AAAA,EAAG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAAG,SAAS,KAAK,SAAS,WAAW;AAAA,EAClG,UAAU,eAAe;AAAA,EAAG,WAAW,eAAe;AAAA,EAAG,eAAe,eAAe;AAAA,EACvF,aAAa,eAAe;AAAA,EAAG,UAAU,KAAK,SAAS,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC,CAAC;AAAA,EAC5F,WAAW,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAC9F,YAAY,KAAK,SAAS,WAAW;AAAA,EAAG,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAC5E,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,gBAAgB,KAAK,OAAO;AAAA,EAChC,IAAI,KAAK,OAAO;AAAA,EAChB,WAAW,KAAK,OAAO;AAAA,EACvB,SAAS,eAAe;AAAA,EACxB,QAAQ,KAAK,OAAO;AAAA,EACpB,MAAM,KAAK,OAAO;AAAA,EAClB,SAAS,KAAK,OAAO;AAAA,EACrB,aAAa,KAAK,OAAO;AAAA,EACzB,UAAU,KAAK,OAAO;AAAA,EACtB,WAAW,KAAK,OAAO;AAAA,EACvB,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAC9B,SAAS;AAAA,EACT,UAAU,eAAe;AAAA,EACzB,WAAW,eAAe;AAAA,EAC1B,eAAe,eAAe;AAAA,EAC9B,aAAa,eAAe;AAAA,EAC5B,UAAU,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,EAC9C,WAAW,eAAe;AAAA,EAC1B,gBAAgB,eAAe;AAAA,EAC/B,gBAAgB,eAAe;AAAA,EAC/B,YAAY,KAAK,SAAS,WAAW;AAAA,EACrC,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAClC,gBAAgB;AAClB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,sBAAsB,KAAK,OAAO;AAAA,EAC7C,IAAI,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAAG,QAAQ,KAAK,OAAO;AAAA,EAAG,MAAM,KAAK,OAAO;AAAA,EACtF,SAAS,KAAK,OAAO;AAAA,EAAG,aAAa,KAAK,OAAO;AAAA,EAAG,UAAU,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EACpG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;AAAA,EAAG,SAAS;AAAA,EAAa,UAAU,eAAe;AAAA,EAAG,WAAW,eAAe;AAAA,EAC7G,eAAe,eAAe;AAAA,EAAG,aAAa,eAAe;AAAA,EAAG,UAAU,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,EAC9G,WAAW,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAAG,gBAAgB,eAAe;AAAA,EAC9F,YAAY,KAAK,SAAS,WAAW;AAAA,EAAG,UAAU,KAAK,SAAS,KAAK,IAAI,CAAC;AAC5E,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,sBAAsB,KAAK,KAAK,CAAC,WAAW,WAAW,SAAS,YAAY,QAAQ,WAAW,CAAC;AACtG,IAAM,uBAAuB,KAAK,KAAK,CAAC,WAAW,SAAS,OAAO,cAAc,aAAa,iBAAiB,sBAAsB,mBAAmB,UAAU,SAAS,CAAC;AAC5K,IAAM,iBAAiB,KAAK,OAAO;AAAA,EACjC,IAAI,KAAK,OAAO;AAAA,EAChB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,OAAO;AAAA,EACP,SAAS,KAAK,OAAO;AAAA,EACrB,cAAc,KAAK,OAAO;AAAA,EAC1B,cAAc,KAAK,OAAO;AAAA,EAC1B,WAAW,KAAK,OAAO;AAAA,EACvB,cAAc,KAAK,OAAO;AAAA,EAC1B,aAAa,KAAK,OAAO;AAAA,EACzB,YAAY,eAAe;AAAA,EAC3B,YAAY,eAAe;AAAA,EAC3B,gBAAgB,eAAe;AAAA,EAC/B,WAAW,eAAe;AAAA,EAC1B,WAAW,eAAe;AAAA,EAC1B,YAAY;AACd,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,uBAAuB,KAAK,OAAO;AAAA,EAC9C,IAAI,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAAG,WAAW,KAAK,OAAO;AAAA,EAC9F,OAAO,KAAK,KAAK,CAAC,WAAW,WAAW,SAAS,YAAY,MAAM,CAAC;AAAA,EAAG,SAAS,KAAK,OAAO;AAAA,EAC5F,aAAa,KAAK,OAAO;AAAA,EAAG,YAAY,eAAe;AAAA,EAAG,YAAY,eAAe;AAAA,EACrF,gBAAgB,eAAe;AAAA,EAAG,WAAW,eAAe;AAC9D,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,sBAAsB,KAAK,OAAO;AAAA,EACtC,UAAU,KAAK,OAAO;AAAA,EACtB,YAAY,KAAK,OAAO;AAAA,EACxB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,OAAO;AAAA,EACvB,WAAW,KAAK,SAAS,mBAAmB;AAAA,EAC5C,SAAS;AAAA,EACT,SAAS,KAAK,OAAO;AAAA,EACrB,cAAc,KAAK,OAAO;AAAA,EAC1B,cAAc,KAAK,OAAO;AAAA,EAC1B,YAAY,eAAe;AAAA,EAC3B,OAAO,eAAe;AAAA,EACtB,OAAO,KAAK,OAAO;AAAA,EACnB,QAAQ;AAAA,EACR,WAAW,KAAK,OAAO;AACzB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,iBAAiB,KAAK,OAAO;AAAA,EACjC,WAAW,KAAK,OAAO;AAAA,EACvB,OAAO,KAAK,OAAO;AAAA,EACnB,UAAU,KAAK,OAAO;AAAA,EACtB,aAAa,eAAe;AAAA,EAC5B,cAAc;AAAA,EACd,gBAAgB,KAAK,OAAO;AAAA,EAC5B,YAAY,KAAK,OAAO;AAC1B,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,gCAAgC;AAAA,EACpC,eAAe,KAAK,KAAK,CAAC,YAAY,eAAe,WAAW,CAAC;AAAA,EACjE,mBAAmB,KAAK,QAAQ;AAAA,EAChC,SAAS,eAAe;AAAA,EACxB,SAAS,eAAe;AAAA,EACxB,UAAU,eAAe;AAAA,EACzB,MAAM,eAAe;AAAA,EACrB,WAAW,KAAK,SAAS,eAAe,CAAC;AAAA,EACzC,mBAAmB,eAAe;AAAA,EAClC,KAAK,KAAK,SAAS,eAAe,CAAC;AAAA,EACnC,WAAW,KAAK,SAAS,eAAe,CAAC;AAAA,EACzC,eAAe,KAAK,SAAS,eAAe,CAAC;AAAA,EAC7C,aAAa,eAAe;AAAA,EAC5B,YAAY,KAAK,SAAS,eAAe,CAAC;AAAA,EAC1C,oBAAoB,eAAe;AAAA,EACnC,cAAc,eAAe;AAAA,EAC7B,WAAW,KAAK,SAAS,KAAK,OAAO,EAAE,WAAW,KAAK,OAAO,GAAG,OAAO,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,CAAC;AAC1H;AAEA,IAAM,oBAAoB,KAAK,OAAO,+BAA+B,EAAE,sBAAsB,KAAK,CAAC;AAEnG,IAAM,0BAA0B,KAAK,OAAO;AAAA,EAC1C,GAAG;AAAA,EACH,iBAAiB,KAAK,SAAS,KAAK,MAAM,CAAC,KAAK,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC;AAAA,EACxE,eAAe,eAAe;AAAA,EAC9B,eAAe,eAAe;AAAA,EAC9B,gBAAgB,eAAe;AAAA,EAC/B,YAAY,eAAe;AAAA,EAC3B,eAAe,eAAe;AAAA,EAC9B,WAAW,eAAe;AAAA,EAC1B,iBAAiB,eAAe;AAAA,EAChC,cAAc,eAAe;AAAA,EAC7B,mBAAmB,eAAe;AAAA,EAClC,kBAAkB,eAAe;AAAA,EACjC,uBAAuB,eAAe;AAAA,EACtC,oBAAoB,KAAK,SAAS,eAAe,CAAC;AAAA,EAClD,0BAA0B,eAAe;AAAA,EACzC,wBAAwB,eAAe;AAAA,EACvC,mBAAmB,eAAe;AAAA,EAClC,oBAAoB,eAAe;AAAA,EACnC,mBAAmB,eAAe;AAAA,EAClC,mBAAmB,eAAe;AAAA,EAClC,eAAe,KAAK,SAAS,KAAK,KAAK,CAAC,YAAY,QAAQ,WAAW,WAAW,UAAU,WAAW,QAAQ,CAAC,CAAC;AAAA,EACjH,eAAe,eAAe;AAAA,EAC9B,aAAa,eAAe;AAAA,EAC5B,gBAAgB,KAAK,SAAS,KAAK,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC,CAAC;AAAA,EAC1E,sBAAsB,eAAe;AAAA,EACrC,yBAAyB,eAAe;AAC1C,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,QAAQ,KAAK,KAAK,CAAC,MAAM,WAAW,YAAY,QAAQ,CAAC;AAAA,EACzD,cAAc,KAAK,QAAQ;AAAA,EAC3B,WAAW,KAAK,QAAQ;AAAA,EACxB,iBAAiB,KAAK,MAAM,CAAC,KAAK,QAAQ,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACzD,UAAU,KAAK,KAAK,CAAC,SAAS,WAAW,iBAAiB,CAAC;AAAA,EAC3D,WAAW,KAAK,OAAO;AAAA,EACvB,OAAO,KAAK,OAAO;AAAA,EACnB,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACjD,eAAe,KAAK,KAAK,CAAC,YAAY,eAAe,WAAW,CAAC;AAAA,EACjE,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACjD,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACjD,YAAY,KAAK,OAAO;AAAA,EACxB,YAAY,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAAA,EACnD,OAAO;AAAA,EACP,QAAQ,KAAK,MAAM,KAAK,OAAO;AAAA,IAC7B,MAAM,KAAK,OAAO;AAAA,IAClB,QAAQ,KAAK,KAAK,CAAC,MAAM,WAAW,YAAY,QAAQ,CAAC;AAAA,IACzD,SAAS,KAAK,OAAO;AAAA,EACvB,GAAG,EAAE,sBAAsB,MAAM,CAAC,CAAC;AACrC,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,uBAAuB,KAAK,OAAO;AAAA,EACvC,QAAQ,eAAe;AAAA,EACvB,OAAO,eAAe,EAAE,SAAS,GAAG,SAAS,IAAI,CAAC;AAAA,EAClD,OAAO,KAAK,SAAS,WAAW;AAAA,EAChC,SAAS,KAAK,SAAS,KAAK,KAAK,CAAC,SAAS,QAAQ,KAAK,CAAC,CAAC;AAAA,EAC1D,cAAc,KAAK,SAAS,KAAK,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC,CAAC;AAAA,EAChE,gBAAgB,gBAAgB;AAAA,EAChC,QAAQ,eAAe;AAAA,EACvB,SAAS,eAAe;AAAA,EACxB,OAAO,eAAe;AAAA,EACtB,kBAAkB,eAAe;AAAA,EACjC,UAAU,eAAe;AAAA,EACzB,QAAQ,gBAAgB;AAC1B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,oBAAoB,KAAK,OAAO;AAAA,EACpC,UAAU,KAAK,MAAM,aAAa;AAAA,EAClC,QAAQ,eAAe;AAAA,EACvB,QAAQ,KAAK,SAAS,KAAK,KAAK,CAAC,UAAU,OAAO,CAAC,CAAC;AAAA,EACpD,OAAO,gBAAgB;AAAA,EACvB,UAAU,gBAAgB;AAAA,EAC1B,kBAAkB,KAAK,SAAS,KAAK,KAAK,CAAC,iBAAiB,SAAS,CAAC,CAAC;AAAA,EACvE,cAAc,eAAe;AAC/B,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,qBAAqB,KAAK,OAAO,EAAE,YAAY,KAAK,MAAM,cAAc,GAAG,QAAQ,eAAe,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAC3I,IAAM,0BAA0B,KAAK,OAAO,EAAE,QAAQ,KAAK,MAAM,mBAAmB,GAAG,QAAQ,eAAe,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC;AACjJ,IAAM,mBAAmB,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;AACnG,IAAM,cAAc,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,GAAG,YAAY,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC;AACzH,IAAM,oBAAoB,KAAK,OAAO;AAAA,EACpC,aAAa,eAAe;AAAA,EAC5B,aAAa,eAAe;AAAA,EAC5B,YAAY,eAAe;AAAA,EAC3B,aAAa,eAAe;AAC9B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,mCAAmC,KAAK,OAAO;AAAA,EACnD,YAAY,KAAK,OAAO;AAAA,EACxB,YAAY,KAAK,OAAO;AAAA,EACxB,OAAO,KAAK,OAAO;AAAA,EACnB,aAAa,KAAK,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,CAAC,CAAC;AAAA,EACvD,MAAM,gBAAgB;AAAA,EACtB,aAAa,KAAK,SAAS,iBAAiB;AAC9C,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,yCAAyC,KAAK,OAAO;AAAA,EACzD,YAAY,KAAK,OAAO;AAAA,EACxB,YAAY,KAAK,OAAO;AAAA,EACxB,OAAO,eAAe;AAAA,EACtB,aAAa,KAAK,SAAS,KAAK,KAAK,CAAC,SAAS,MAAM,CAAC,CAAC;AAAA,EACvD,MAAM,gBAAgB;AAAA,EACtB,aAAa,KAAK,SAAS,iBAAiB;AAC9C,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAElC,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,QAAQ,KAAK,QAAQ;AAAA,EACrB,QAAQ,KAAK,OAAO;AAAA,EACpB,cAAc,KAAK,OAAO;AAAA,EAC1B,QAAQ,KAAK,OAAO;AAAA,EACpB,SAAS,KAAK,OAAO;AAAA,EACrB,SAAS,KAAK,OAAO;AAAA,EACrB,QAAQ,KAAK,OAAO;AAAA,EACpB,QAAQ,KAAK,SAAS,eAAe,CAAC;AAAA,EACtC,cAAc,KAAK,SAAS,eAAe,CAAC;AAAA,EAC5C,WAAW,KAAK,SAAS,eAAe,CAAC;AAAA,EACzC,kBAAkB,gBAAgB;AACpC,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAEjC,IAAM,sBAAsB,KAAK,OAAO;AAAA,EACtC,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;AAAA,EAClD,YAAY,eAAe;AAC7B,GAAG;AAAA,EACD,sBAAsB;AAAA,EACtB,OAAO;AAAA,IACL,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,OAAO,GAAG,YAAY,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE;AAAA,IACxF,EAAE,YAAY,EAAE,UAAU,gBAAgB,YAAY,EAAE,MAAM,SAAS,EAAE,GAAG,UAAU,CAAC,YAAY,YAAY,EAAE;AAAA,EACnH;AACF,CAAC;AA+DD,IAAM,gBAAgB,CAAC,SAAS,WAAW,iBAAiB;AAC5D,IAAM,qBAAqB,CAAC,SAAS,SAAS;AAC9C,IAAM,mBAAmB,CAAC,SAAS;AACnC,IAAM,YAAY,CAAC,UAAgD;AACnE,IAAM,oBAAoB,CAAC,UAAU,SAAS,QAAQ,YAAY,WAAW,iBAAiB,UAAU,WAAW,SAAS,cAAc,aAAa,QAAQ;AAC/J,IAAM,qBAAqB,KAAK,OAAO;AAAA,EACrC,IAAI,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,OAAO,CAAC,CAAC;AAAA,EAC7C,QAAQ,KAAK,OAAO;AAAA,EACpB,UAAU,KAAK,OAAO;AAAA,EACtB,SAAS,KAAK,OAAO;AAAA,EACrB,UAAU,KAAK,KAAK,CAAC,QAAQ,QAAQ,QAAQ,CAAC;AAAA,EAC9C,SAAS,eAAe;AAAA,EACxB,UAAU,KAAK,IAAI;AAAA,EACnB,YAAY,KAAK,OAAO;AAC1B,GAAG,EAAE,sBAAsB,MAAM,CAAC;AAClC,IAAM,2BAA2B,KAAK,OAAO;AAAA,EAC3C,cAAc,KAAK,OAAO;AAAA,EAC1B,OAAO,KAAK,OAAO;AACrB,GAAG,EAAE,sBAAsB,KAAK,CAAC;AAE1B,IAAM,aAA2C;AAAA,EACtD,UAAU,EAAE,IAAI,gBAAgB,SAAS,yDAAyD,SAAS,OAAO,UAAU,KAAK,OAAO,EAAE,iBAAiB,KAAK,OAAO,GAAG,wBAAwB,KAAK,OAAO,GAAG,yBAAyB,KAAK,OAAO,GAAG,2BAA2B,aAAa,kBAAkB,KAAK,QAAQ,GAAG,kBAAkB,KAAK,QAAQ,GAAG,cAAc,KAAK,QAAQ,GAAG,oBAAoB,KAAK,KAAK,CAAC,qBAAqB,mBAAmB,oBAAoB,YAAY,CAAC,GAAG,SAAS,KAAK,KAAK,CAAC,OAAO,QAAQ,KAAK,CAAC,GAAG,UAAU,KAAK,KAAK,CAAC,SAAS,WAAW,iBAAiB,CAAC,GAAG,eAAe,KAAK,SAAS,WAAW,GAAG,YAAY,KAAK,MAAM,KAAK,OAAO,EAAE,IAAI,KAAK,OAAO,GAAG,SAAS,KAAK,OAAO,GAAG,gBAAgB,aAAa,KAAK,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC,GAAG,KAAK,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,GAAG,WAAW,eAAe,KAAK,EAAE,MAAM,eAAe,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,mBAAmB,GAAG,KAAK,EAAE,SAAS,gBAAgB,SAAS,CAAC,EAAE,EAAE,CAAC;AAAA,EAC/jC,UAAU,EAAE,IAAI,UAAU,SAAS,sCAAsC,SAAS,OAAO,UAAU,mBAAmB,QAAQ,CAAC,aAAa,GAAG,WAAW,eAAe,MAAM,EAAE,QAAQ,OAAO,MAAM,aAAa,EAAE,CAAC;AAAA,EACtN,UAAU,EAAE,IAAI,sCAAsC,SAAS,gEAAgE,SAAS,KAAK,OAAO,EAAE,WAAW,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC,GAAG,4BAA4B,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,GAAG,sBAAsB,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,oBAAoB,KAAK,OAAO,GAAG,oBAAoB,KAAK,OAAO,GAAG,sBAAsB,KAAK,OAAO,GAAG,WAAW,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,WAAW,kBAAkB,MAAM,EAAE,QAAQ,QAAQ,MAAM,oCAAoC,EAAE,CAAC;AAAA,EAClqB,UAAU,EAAE,IAAI,wCAAwC,SAAS,kEAAkE,SAAS,KAAK,OAAO,EAAE,WAAW,KAAK,OAAO,EAAE,SAAS,iBAAiB,CAAC,GAAG,4BAA4B,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,GAAG,oBAAoB,KAAK,OAAO,EAAE,SAAS,aAAa,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,oBAAoB,KAAK,OAAO,GAAG,oBAAoB,KAAK,OAAO,GAAG,sBAAsB,KAAK,OAAO,GAAG,WAAW,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,GAAG,UAAU,KAAK,QAAQ,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,WAAW,kBAAkB,MAAM,EAAE,QAAQ,QAAQ,MAAM,4CAA4C,EAAE,CAAC;AAAA,EACjuB,UAAU,EAAE,IAAI,iBAAiB,SAAS,sDAAsD,SAAS,OAAO,UAAU,oBAAoB,QAAQ,CAAC,aAAa,GAAG,WAAW,eAAe,KAAK,EAAE,SAAS,UAAU,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,EAAE,EAAE,CAAC;AAAA,EAC/P,UAAU,EAAE,IAAI,mBAAmB,SAAS,qCAAqC,SAAS,OAAO,UAAU,KAAK,OAAO,GAAG,QAAQ,CAAC,iBAAiB,GAAG,WAAW,kBAAkB,MAAM,EAAE,QAAQ,OAAO,MAAM,YAAY,qBAAqB,aAAa,EAAE,CAAC;AAAA,EAClQ,UAAU,EAAE,IAAI,mBAAmB,SAAS,gDAAgD,SAAS,oBAAoB,UAAU,KAAK,OAAO,EAAE,SAAS,KAAK,QAAQ,GAAG,SAAS,eAAe,aAAa,KAAK,SAAS,KAAK,KAAK,CAAC,aAAa,QAAQ,CAAC,CAAC,GAAG,eAAe,gBAAgB,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,gBAAgB,GAAG,WAAW,eAAe,KAAK,EAAE,MAAM,OAAO,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,gBAAgB,eAAe,IAAI,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,WAAW,QAAQ,QAAQ,YAAY,WAAW,gBAAgB,QAAQ,WAAW,gBAAgB,eAAe,sBAAsB,UAAU,gBAAgB,iBAAiB,aAAa,eAAe,kBAAkB,gBAAgB,YAAY,cAAc,mBAAmB,oBAAoB,eAAe,YAAY,iBAAiB,mBAAmB,yBAAyB,iBAAiB,gBAAgB,gBAAgB,cAAc,YAAY,EAAE,EAAE,CAAC;AAAA,EACn/B,UAAU,EAAE,IAAI,WAAW,SAAS,iDAAiD,SAAS,sBAAsB,UAAU,mBAAmB,QAAQ,CAAC,eAAe,GAAG,WAAW,eAAe,KAAK,EAAE,MAAM,UAAU,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,eAAe,cAAc,EAAE,kBAAkB,CAAC,YAAY,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,WAAW,SAAS,CAAC,SAAS,MAAM,GAAG,SAAS,mBAAmB,UAAU,CAAC,EAAE,SAAS,OAAO,WAAW,EAAE,MAAM,SAAS,GAAG,UAAU,WAAW,SAAS,mBAAmB,UAAU,KAAK,MAAM,kBAAkB,EAAE,CAAC,EAAE,EAAE,CAAC;AAAA,EACjjB,UAAU,EAAE,IAAI,kBAAkB,SAAS,4CAA4C,SAAS,KAAK,OAAO,EAAE,YAAY,KAAK,MAAM,KAAK,OAAO,GAAG,EAAE,UAAU,GAAG,UAAU,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,gBAAgB,GAAG,WAAW,eAAe,MAAM,EAAE,QAAQ,QAAQ,MAAM,eAAe,GAAG,KAAK,EAAE,SAAS,eAAe,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,KAAK,GAAG,UAAU,0BAA0B,UAAU,CAAC,EAAE,SAAS,OAAO,WAAW,EAAE,MAAM,kBAAkB,QAAQ,MAAM,GAAG,UAAU,kBAAkB,SAAS,CAAC,KAAK,GAAG,UAAU,yBAAyB,CAAC,EAAE,EAAE,CAAC;AAAA,EACxqB,UAAU,EAAE,IAAI,kBAAkB,SAAS,gDAAgD,SAAS,KAAK,OAAO,EAAE,SAAS,eAAe,GAAG,aAAa,eAAe,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,qBAAqB,QAAQ,CAAC,kBAAkB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,uBAAuB,GAAG,KAAK,EAAE,SAAS,SAAS,SAAS,CAAC,YAAY,cAAc,GAAG,UAAU,KAAK,MAAM,CAAC,KAAK,OAAO,EAAE,UAAU,gBAAgB,YAAY,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EACzkB,UAAU,EAAE,IAAI,mBAAmB,SAAS,mCAAmC,SAAS,KAAK,OAAO,EAAE,QAAQ,eAAe,GAAG,OAAO,eAAe,GAAG,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC,aAAa,aAAa,KAAK,CAAC,CAAC,GAAG,WAAW,eAAe,GAAG,WAAW,eAAe,GAAG,QAAQ,KAAK,SAAS,KAAK,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,oBAAoB,QAAQ,CAAC,iBAAiB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,kBAAkB,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,iBAAiB,GAAG,KAAK,EAAE,SAAS,cAAc,SAAS,CAAC,cAAc,GAAG,SAAS,CAAC,UAAU,SAAS,QAAQ,cAAc,aAAa,OAAO,EAAE,EAAE,CAAC;AAAA,EACpqB,UAAU,EAAE,IAAI,wBAAwB,SAAS,sDAAsD,SAAS,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,GAAG,QAAQ,eAAe,GAAG,OAAO,eAAe,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,yBAAyB,QAAQ,CAAC,iBAAiB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,uBAAuB,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,qCAAqC,GAAG,KAAK,EAAE,SAAS,mBAAmB,SAAS,CAAC,eAAe,UAAU,OAAO,EAAE,EAAE,CAAC;AAAA,EAC7gB,UAAU,EAAE,IAAI,mBAAmB,SAAS,uCAAuC,SAAS,kBAAkB,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,kBAAkB,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,qCAAqC,GAAG,KAAK,EAAE,SAAS,UAAU,SAAS,CAAC,aAAa,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EAC/e,UAAU,EAAE,IAAI,oBAAoB,SAAS,wCAAwC,SAAS,kBAAkB,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,mBAAmB,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,sCAAsC,GAAG,KAAK,EAAE,SAAS,WAAW,SAAS,CAAC,aAAa,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EACpf,UAAU,EAAE,IAAI,mBAAmB,SAAS,oCAAoC,SAAS,KAAK,OAAO,EAAE,YAAY,KAAK,OAAO,GAAG,YAAY,KAAK,OAAO,GAAG,SAAS,KAAK,OAAO,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,SAAS,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,qCAAqC,GAAG,KAAK,EAAE,SAAS,UAAU,SAAS,CAAC,eAAe,eAAe,UAAU,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EAC5mB,UAAU,EAAE,IAAI,wBAAwB,SAAS,2CAA2C,SAAS,aAAa,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,cAAc,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,kCAAkC,GAAG,KAAK,EAAE,SAAS,OAAO,SAAS,CAAC,eAAe,aAAa,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EACxf,UAAU,EAAE,IAAI,iCAAiC,SAAS,uDAAuD,SAAS,kCAAkC,UAAU,KAAK,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,mBAAmB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,uBAAuB,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,mCAAmC,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,eAAe,eAAe,SAAS,eAAe,MAAM,GAAG,UAAU,KAAK,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;AAAA,EAC7kB,UAAU,EAAE,IAAI,aAAa,SAAS,6CAA6C,SAAS,KAAK,OAAO,EAAE,SAAS,eAAe,EAAE,SAAS,KAAM,SAAS,IAAO,CAAC,GAAG,aAAa,eAAe,GAAG,cAAc,KAAK,SAAS,WAAW,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,gBAAgB,QAAQ,CAAC,gBAAgB,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,YAAY,GAAG,MAAM,EAAE,QAAQ,QAAQ,MAAM,yBAAyB,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,YAAY,WAAW,YAAY,EAAE,EAAE,CAAC;AAAA,EACzgB,UAAU,EAAE,IAAI,YAAY,SAAS,wCAAwC,SAAS,OAAO,UAAU,KAAK,OAAO,EAAE,QAAQ,KAAK,MAAM,cAAc,EAAE,GAAG,EAAE,sBAAsB,KAAK,CAAC,GAAG,QAAQ,CAAC,eAAe,GAAG,WAAW,oBAAoB,KAAK,EAAE,MAAM,WAAW,GAAG,MAAM,EAAE,QAAQ,OAAO,MAAM,eAAe,GAAG,KAAK,EAAE,SAAS,YAAY,SAAS,CAAC,EAAE,EAAE,CAAC;AAAA,EAC3W,UAAU,EAAE,IAAI,QAAQ,SAAS,wDAAwD,SAAS,KAAK,OAAO,EAAE,SAAS,eAAe,GAAG,UAAU,eAAe,EAAE,GAAG,EAAE,sBAAsB,MAAM,CAAC,GAAG,UAAU,oBAAoB,QAAQ,CAAC,kBAAkB,eAAe,GAAG,WAAW,kBAAkB,KAAK,EAAE,MAAM,OAAO,GAAG,KAAK,EAAE,SAAS,QAAQ,SAAS,CAAC,YAAY,aAAa,OAAO,EAAE,EAAE,CAAC;AACnZ;AAEA,IAAM,OAAO,IAAI,IAAI,WAAW,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;AAE1D,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAGjD,YAAqBA,YAA4BC,SAAsD;AACrG,UAAM,8BAA8BD,UAAS,SAAS;AADnC,qBAAAA;AAA4B,kBAAAC;AAFjD,SAAS,OAAO;AAChB,SAAS,SAAS;AAAA,EAGlB;AACF;AAEO,IAAM,wBAAN,cAAoC,MAAM;AAAA,EAG/C,YAAqBD,YAA4BC,SAAsD;AACrG,UAAM,+BAA+BD,UAAS,SAAS;AADpC,qBAAAA;AAA4B,kBAAAC;AAFjD,SAAS,OAAO;AAChB,SAAS,SAAS;AAAA,EAGlB;AACF;AAEA,SAAS,OAAO,QAAiB,OAA8D;AAC7F,SAAO,CAAC,GAAG,OAAO,QAAQ,KAAK,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,gBAAgB,KAAK,SAAS,MAAM,QAAQ,EAAE;AAChH;AAEO,SAAS,kBAAkB,aAAwC;AACxE,QAAM,WAAW,KAAK,IAAI,WAA0B;AACpD,MAAI,CAAC,SAAU,OAAM,IAAI,MAAM,+BAA+B,WAAW,EAAE;AAC3E,SAAO;AACT;AAEO,SAAS,gBAAgB,aAAqB,OAAyC;AAC5F,QAAM,WAAW,kBAAkB,WAAW;AAC9C,MAAI,CAAC,MAAM,SAAS,SAAS,KAAK,EAAG,OAAM,IAAI,wBAAwB,aAAa,OAAO,SAAS,SAAS,KAAK,CAAC;AACnH,SAAO;AACT;AAEO,SAAS,2BAA2B,aAAqB,OAAgB,iBAAkD;AAChI,MAAI,oBAAoB,yBAAyB;AAC/C,QAAI,gBAAgB,mBAAmB;AACrC,UAAI,CAAC,MAAM,0BAA0B,KAAK,EAAG,OAAM,IAAI,wBAAwB,aAAa,OAAO,0BAA0B,KAAK,CAAC;AACnI,aAAO;AAAA,IACT;AACA,QAAI,CAAC,mBAAmB,wBAAwB,mBAAmB,oBAAoB,cAAc,EAAE,SAAS,WAAW,GAAG;AAC5H,YAAM,IAAI,wBAAwB,aAAa,CAAC,EAAE,MAAM,KAAK,SAAS,0CAA0C,uBAAuB,GAAG,CAAC,CAAC;AAAA,IAC9I;AACA,QAAI,gBAAgB,aAAa,SAAS,OAAO,UAAU,UAAU;AACnE,YAAM,cAAc,CAAC,WAAW,gBAAgB,SAAS,EAAE,KAAK,CAAC,UAAW,MAAkC,KAAK,MAAM,MAAS;AAClI,UAAI,YAAa,OAAM,IAAI,wBAAwB,aAAa,CAAC,EAAE,MAAM,IAAI,WAAW,IAAI,SAAS,sCAAsC,uBAAuB,GAAG,CAAC,CAAC;AAAA,IACzK;AAAA,EACF;AACA,MAAI,gBAAgB,mCAAmC,oBAAoB,yBAAyB;AAClG,WAAO,gBAAgB,aAAa,KAAK;AAAA,EAC3C;AACA,MAAI,CAAC,MAAM,wCAAwC,KAAK,GAAG;AACzD,UAAM,IAAI,wBAAwB,aAAa,OAAO,wCAAwC,KAAK,CAAC;AAAA,EACtG;AACA,SAAO;AACT;AAEO,SAAS,cAAc,aAAqB,OAAyB;AAC1E,QAAM,WAAW,kBAAkB,WAAW;AAC9C,QAAM,aAAa,KAAK,UAAU,KAAK;AACvC,QAAM,YAAY,eAAe,SAAY,QAAQ,KAAK,MAAM,UAAU;AAC1E,MAAI,CAAC,MAAM,SAAS,UAAU,SAAS,EAAG,OAAM,IAAI,sBAAsB,aAAa,OAAO,SAAS,UAAU,SAAS,CAAC;AAC3H,SAAO;AACT;AAoBO,SAAS,iBACd,aACA,OACA,YACS;AACT,QAAM,WAAW,kBAAkB,WAAW;AAC9C,QAAM,cAAc,IAAI,IAAI,YAAY,eAAe,CAAC,CAAC;AACzD,QAAM,UAAU,SAAS,KAAK,UAAU,KAAK,CAAC,UAC5C,MAAM,YAAY,YAAY,WAAW,kBAAkB,OAAO,WAAW,CAAC;AAChF,QAAM,SAAS,SAAS,YAAY,SAAS,KAAK,YAAY,SAAS;AACvE,QAAM,aAAa,KAAK,UAAU,KAAK;AACvC,QAAM,YAAY,eAAe,SAAY,QAAQ,KAAK,MAAM,UAAU;AAC1E,MAAI,CAAC,MAAM,QAAQ,SAAS,EAAG,OAAM,IAAI,sBAAsB,aAAa,OAAO,QAAQ,SAAS,CAAC;AACrG,SAAO;AACT;AAEO,SAAS,oBAAoB,SAAiG;AACnI,SAAO,WAAW,OAAO,CAAC,UAAU,MAAM,UAAU,SAAS,QAAQ,QAAQ,KAAK,QAAQ,MAAM,QAAQ,OAAO,CAAC,CAAC;AACnH;AAUA,SAAS,kBACP,SACA,aACS;AACT,SAAO,QAAQ,UAAU,SAAS,YAAY,YAAY,IAAI,QAAQ,UAAU,MAAM;AACxF;AAEO,SAAS,gBACd,SACA,UACA,cAAiC,CAAC,GACH;AAC/B,QAAM,kBAAkB,IAAI,IAAI,WAAW;AAC3C,SAAO,oBAAoB,EAAE,SAAS,OAAO,SAAS,CAAC,EAAE,KAAK,CAAC,UAC7D,MAAM,KAAK,YAAY,WACvB,MAAM,KAAK,SAAS,SAAS,OAAO,KACpC,MAAM,KAAK,UAAU,KAAK,CAAC,YACzB,QAAQ,YAAY,WAAW,kBAAkB,SAAS,eAAe,CAAC,CAAC;AACjF;AAEO,SAAS,mBAAmB,UAA0J,EAAE,SAAS,QAAQ,UAAU,UAAU,GAAG;AACrO,QAAM,0BAA0B,QAAQ,2BAA2B;AACnE,SAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,wBAAwB;AAAA,IACxB;AAAA,IACA,2BAA2B,CAAC,GAAG,2BAA2B;AAAA,IAC1D,kBAAkB,QAAQ,aAAa,YAAY,oBAAoB;AAAA,IACvE,kBAAkB,QAAQ,aAAa,aAAa,QAAQ,qBAAqB;AAAA,IACjF,cAAc,QAAQ,aAAa,aAAa,QAAQ,qBAAqB,QAAQ,QAAQ,iBAAiB;AAAA,IAC9G,oBAAoB,QAAQ,aAAa,YACrC,sBACA,QAAQ,aAAa,UACnB,qBACA;AAAA,IACN,SAAS,QAAQ;AAAA,IACjB,UAAU,QAAQ;AAAA,IAClB,YAAY,oBAAoB,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,UAAU,UAAU,WAAW,YAAY,QAAQ,KAAK,GAAG,MAAM,OAAO;AAAA,MAC/H,GAAG;AAAA,MACH,GAAI,MAAM;AAAA,QACR,KAAK;AAAA,UACH,SAAS,IAAI;AAAA,UACb,GAAI,IAAI,UAAU,EAAE,SAAS,IAAI,QAAQ,IAAI,CAAC;AAAA,UAC9C,SAAS,IAAI;AAAA,UACb,cAAc,IAAI,YAAY;AAAA,UAC9B,GAAI,IAAI,WAAW;AAAA,YACjB,UAAU,IAAI,SAAS,IAAI,CAAC,aAAa;AAAA,cACvC,SAAS,QAAQ;AAAA,cACjB,WAAW,QAAQ;AAAA,cACnB,UAAU,QAAQ;AAAA,cAClB,SAAS,QAAQ;AAAA,cACjB,cAAc,QAAQ;AAAA,YACxB,EAAE;AAAA,UACJ,IAAI,CAAC;AAAA,QACP;AAAA,MACF,IAAI,CAAC;AAAA,MACL,gBAAgB,CAAC,GAAG,MAAM;AAAA,IAC5B,EAAE;AAAA,EACJ;AACF;AAEO,SAAS,yBAAyB,OAA8C;AACrF,QAAM,YAAY,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AACpD,MAAI,cAAc,UAAa,UAAU,KAAK,MAAM,GAAI,QAAO;AAC/D,MAAK,4BAAkD,SAAS,UAAU,KAAK,CAAC,EAAG,QAAO,UAAU,KAAK;AACzG,QAAM,QAAQ,IAAI,MAAM,2CAA2C;AACnE,QAAM,SAAS;AACf,QAAM,OAAO;AACb,QAAM,YAAY;AAClB,QAAM;AACR;","names":["operation","issues"]}