@jini-ai/http-kit 0.3.2 → 0.3.6

package/dist/adapter.d.ts

@@ -1,4 +1,5 @@
 import type { Express } from 'express';
+import { type ApiError } from '@jini-ai/protocol';
 import { type OriginContext } from './origin.js';
 import type { JsonRouteSpec } from './types.js';
 export interface AdapterInternalErrorContext {
@@ -21,6 +22,31 @@ export interface AdapterContext extends OriginContext {
      */
     readonly onInternalError?: (context: AdapterInternalErrorContext) => void;
 }
+/**
+ * Thrown by a route's `handle` — or by anything it calls, at any depth — to bypass the SEC-005
+ * redaction below with an `ApiError` the throwing code has already decided is safe for the caller
+ * to see. This is the general-purpose version of a carve-out every consuming module of this catch
+ * otherwise hand-rolls for itself: `attachments.ts`'s `AttachmentRejectedError`/
+ * `respondToUploadFailure`, and `delegated-tools.ts`'s `errorKind: 'validation'` split on
+ * `ToolExecutionResult`, both exist because nothing at THIS layer distinguished "the code that threw
+ * already classified this as caller-safe" from "something unanticipated happened" — so a route with
+ * no such local carve-out has no way to disclose even a deliberately-safe failure, and everything it
+ * throws redacts identically to a stray filesystem or driver error.
+ *
+ * Prefer returning `err(apiError)` from `handle` when the failure is anticipated at that point —
+ * that path already reaches the caller with full fidelity and never touches this catch at all. This
+ * class exists for the same kind of failure discovered a level deeper: inside an awaited call
+ * `handle` itself did not (or could not) wrap in its own `try`.
+ *
+ * Not a way to defeat SEC-005: the only way to reach the branch that reads this class is for code to
+ * construct one itself, naming the exact `ApiError` — code and message — it is choosing to disclose.
+ * Any thrown value that is not this class (including a plain `Error` with an actionable-looking
+ * message) still redacts exactly as before; nothing here widens what a route can leak by accident.
+ */
+export declare class ClientFacingError extends Error {
+    readonly apiError: ApiError;
+    constructor(apiError: ApiError);
+}
 /**
  * Identity function that pins a route spec's generic parameters at the definition site so
  * callers do not have to repeat them. The returned spec is consumed by `mountJsonRoute` (live)

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAI1D,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,2BAA2B;IAC1C,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wHAAwH;IACxH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,CAAC;CAC3E;AAOD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EACjD,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GACvC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAEpC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAChD,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EACxC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,cAAc,GACtB,IAAI,CA4DN"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAGlE,OAAO,EAAmB,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,WAAW,2BAA2B;IAC1C,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wHAAwH;IACxH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,oFAAoF;AACpF,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,KAAK,IAAI,CAAC;CAC3E;AAOD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAEhB,QAAQ,EAAE,QAAQ;CAK/B;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EACjD,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GACvC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAEpC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAChD,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EACxC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,cAAc,GACtB,IAAI,CAmEN"}

package/dist/adapter.js

@@ -12,6 +12,35 @@ function defaultInternalErrorSink(context) {
     // eslint-disable-next-line no-console
     console.error(`[@jini-ai/http-kit] internal error (${context.method.toUpperCase()} ${context.path}, correlationId=${context.correlationId})`, context.error);
 }
+/**
+ * Thrown by a route's `handle` — or by anything it calls, at any depth — to bypass the SEC-005
+ * redaction below with an `ApiError` the throwing code has already decided is safe for the caller
+ * to see. This is the general-purpose version of a carve-out every consuming module of this catch
+ * otherwise hand-rolls for itself: `attachments.ts`'s `AttachmentRejectedError`/
+ * `respondToUploadFailure`, and `delegated-tools.ts`'s `errorKind: 'validation'` split on
+ * `ToolExecutionResult`, both exist because nothing at THIS layer distinguished "the code that threw
+ * already classified this as caller-safe" from "something unanticipated happened" — so a route with
+ * no such local carve-out has no way to disclose even a deliberately-safe failure, and everything it
+ * throws redacts identically to a stray filesystem or driver error.
+ *
+ * Prefer returning `err(apiError)` from `handle` when the failure is anticipated at that point —
+ * that path already reaches the caller with full fidelity and never touches this catch at all. This
+ * class exists for the same kind of failure discovered a level deeper: inside an awaited call
+ * `handle` itself did not (or could not) wrap in its own `try`.
+ *
+ * Not a way to defeat SEC-005: the only way to reach the branch that reads this class is for code to
+ * construct one itself, naming the exact `ApiError` — code and message — it is choosing to disclose.
+ * Any thrown value that is not this class (including a plain `Error` with an actionable-looking
+ * message) still redacts exactly as before; nothing here widens what a route can leak by accident.
+ */
+export class ClientFacingError extends Error {
+    apiError;
+    constructor(apiError) {
+        super(apiError.message);
+        this.name = 'ClientFacingError';
+        this.apiError = apiError;
+    }
+}
 /**
  * Identity function that pins a route spec's generic parameters at the definition site so
  * callers do not have to repeat them. The returned spec is consumed by `mountJsonRoute` (live)
@@ -72,6 +101,13 @@ export function mountJsonRoute(app, spec, deps, adapter) {
             sendJson(res, spec.successStatus ?? 200, result.value);
         }
         catch (e) {
+            // A route (or something it called) already classified this failure as safe to disclose —
+            // see `ClientFacingError`'s own doc. Sent verbatim, at its own status; never routed to the
+            // SEC-005 sink below, because nothing unanticipated happened.
+            if (e instanceof ClientFacingError) {
+                sendApiError(res, statusForError(e.apiError), e.apiError);
+                return;
+            }
             // SEC-005. This catch exists for exceptions no route anticipated, which makes it precisely
             // the path most likely to be holding something private: a driver error naming a database
             // file, a connection string, a credential a provider echoed back. Serializing `e.message`

package/dist/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC;AAyBlE,SAAS,wBAAwB,CAAC,OAAoC;IACpE,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,uCAAuC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,aAAa,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/J,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAwC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,IAAwC,EACxC,IAAU,EACV,OAAuB;IAEvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,6FAA6F;QAC7F,0FAA0F;QAC1F,uFAAuF;QACvF,yFAAyF;QACzF,6FAA6F;QAC7F,wFAAwF;QACxF,uFAAuF;QACvF,8FAA8F;QAC9F,2FAA2F;QAC3F,iEAAiE;QACjE,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtD,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,8EAA8E;QAC9E,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;YAC7E,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,yFAAyF;YACzF,mEAAmE;YACnE,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,IAAI,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,2FAA2F;YAC3F,yFAAyF;YACzF,0FAA0F;YAC1F,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,uFAAuF;YACvF,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;YACjE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACxE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QACvH,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAiB,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC;AAyBlE,SAAS,wBAAwB,CAAC,OAAoC;IACpE,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,uCAAuC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,aAAa,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/J,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,QAAQ,CAAW;IAE5B,YAAY,QAAkB;QAC5B,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAwC;IAExC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,IAAwC,EACxC,IAAU,EACV,OAAuB;IAEvB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAChE,6FAA6F;QAC7F,0FAA0F;QAC1F,uFAAuF;QACvF,yFAAyF;QACzF,6FAA6F;QAC7F,wFAAwF;QACxF,uFAAuF;QACvF,8FAA8F;QAC9F,2FAA2F;QAC3F,iEAAiE;QACjE,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;QAC9C,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QACtD,+FAA+F;QAC/F,8FAA8F;QAC9F,6FAA6F;QAC7F,8EAA8E;QAC9E,GAAG,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACnC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;oBACf,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;YAC7E,4FAA4F;YAC5F,6FAA6F;YAC7F,2FAA2F;YAC3F,yFAAyF;YACzF,mEAAmE;YACnE,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO;YAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,IAAI,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,yFAAyF;YACzF,2FAA2F;YAC3F,8DAA8D;YAC9D,IAAI,CAAC,YAAY,iBAAiB,EAAE,CAAC;gBACnC,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,2FAA2F;YAC3F,yFAAyF;YACzF,0FAA0F;YAC1F,4FAA4F;YAC5F,8FAA8F;YAC9F,6FAA6F;YAC7F,uFAAuF;YACvF,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,OAAO,CAAC,eAAe,IAAI,wBAAwB,CAAC;YACjE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;YACxE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,gBAAgB,EAAE,4BAA4B,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QACvH,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/agents.d.ts

@@ -37,7 +37,8 @@ export interface AgentSummary {
     readonly supportsCustomModel?: boolean;
     readonly diagnostic?: string;
     /**
-     * Whether this runtime can receive external MCP servers (Tovu/Jini tools) at all, per
+     * Whether this runtime can receive external MCP servers (the host application's or this engine's
+     * own tools) at all, per
      * `@jini-ai/agent-runtime`'s `runtimeSupportsExternalTools(def)` — the def-level source of
      * truth. `undefined` means the host did not populate this field (pre-existing hosts on an older
      * `@jini-ai/http-kit` continue to omit it); a UI gating on this should treat `undefined` the same

package/dist/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAmC,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAGpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC;IACtF,yFAAyF;IACzF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC;CAC1F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C;AAED,sIAAsI;AACtI,eAAO,MAAM,cAAc,6EAKzB,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,6EAM3B,CAAC;AAEH,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAGrG"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAmC,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAGpF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,GAAG,SAAS,GAAG,SAAS,CAAC;IACnD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACzD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,MAAM,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC;IACtF,yFAAyF;IACzF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,GAAG,SAAS,YAAY,EAAE,CAAC;CAC1F;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C;AAED,sIAAsI;AACtI,eAAO,MAAM,cAAc,6EAKzB,CAAC;AAEH,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,6EAM3B,CAAC;AAEH,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAGrG"}

package/dist/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AA4ChC,sIAAsI;AACtI,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAA0C;IACrF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAA0C;IACvF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,oBAAoB;IAC1B,iBAAiB,EAAE,IAAI;IACvB,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,IAAoB,EAAE,OAAuB;IAC7F,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAuB,MAAM,cAAc,CAAC;AACpF,OAAO,EAAE,EAAE,EAAE,MAAM,YAAY,CAAC;AA6ChC,sIAAsI;AACtI,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAA0C;IACrF,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;CACxE,CAAC,CAAC;AAEH,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAA0C;IACvF,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,oBAAoB;IAC1B,iBAAiB,EAAE,IAAI;IACvB,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC;IAC1B,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;CAC/F,CAAC,CAAC;AAEH,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,IAAoB,EAAE,OAAuB;IAC7F,cAAc,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,cAAc,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC"}

package/dist/attachments.d.ts

@@ -97,9 +97,78 @@ export interface AttachmentStore {
         name: string;
         kind: StoredAttachment['kind'];
         size: number;
+        /** See `AttachmentRecord.ownerId`'s own doc. Omitted by a host with no owner concept. */
+        ownerId?: string;
     }) => Promise<StoredAttachment>;
     /** Exchanges capability ids for real paths, exactly once, binding them to `runId`. */
     claim: (attachments: readonly StoredAttachment[], runId: string) => Promise<AttachmentClaim>;
+    /**
+     * Resolves ONE still-known attachment to its real path for `runId`, without the "exactly once
+     * across the whole batch" shape `claim()` has — the read-side counterpart for a caller that wants
+     * to look up a single attachment it may or may not already own, rather than atomically reserving a
+     * batch at run start.
+     *
+     * `ref` accepts either identifier a caller may actually be holding: the opaque `attachment:<uuid>`
+     * capability id `register()` returned, or the real absolute path this run was already told about.
+     * Both resolve to the same record. This dual form exists because `@jini-ai/daemon`'s
+     * `image-prompt-delivery.ts` narrates the resolved PATH into the run's prompt text for an
+     * already-claimed attachment — never the id — so a caller built from that prompt has the path, not
+     * the id; a caller with the id (from the original upload response) can still use it directly.
+     *
+     * Ownership is enforced here, which is new: an attachment nobody has claimed yet is claimed for
+     * `runId` on this call (identical effect to `claim()`, same integrity re-check); an attachment
+     * already claimed BY `runId` is simply re-verified and returned again (idempotent — a run may look
+     * this up more than once); an attachment claimed by any OTHER run throws the same
+     * `'attachment-unknown-or-claimed'` rejection `claim()` uses for a genuinely unknown id, so a
+     * caller cannot distinguish "no such attachment" from "a different run owns this" — the same
+     * non-disclosure `claim()` already practices for its own rejections. This is the run-ownership
+     * check `claim()`'s own FIRST reservation does not have (see this module's trust-model doc on the
+     * deliberate capability-bearer model for a brand-new claim); `resolveForRun` adds it for every
+     * lookup made through this method, so a second run/session on this same daemon can never read an
+     * attachment already bound to someone else's run by calling this method with a guessed or
+     * overheard `ref`.
+     *
+     * Returns `undefined` only for a `ref` this store has never heard of (never uploaded, or its
+     * record was already deleted by `cleanupRun`/`pruneExpired`/`dispose`).
+     */
+    resolveForRun: (ref: string, runId: string) => Promise<StoredAttachment | undefined>;
+    /**
+     * Lists every still-unclaimed attachment registered with `ownerId` — the discovery counterpart to
+     * `resolveForRun`'s single-lookup: a caller that does not yet hold a specific ref at all (an
+     * attachment uploaded in an earlier turn, never named in this run's prompt) has no id to look up
+     * with `resolveForRun` in the first place. This is what makes that attachment findable.
+     *
+     * **This is the one method in this port that widens the trust model documented at the top of this
+     * file.** `register()`/`claim()`/`resolveForRun` all work from a caller-supplied opaque id or path
+     * — the "you must already hold the unguessable capability" property that makes an unauthenticated
+     * `claim()` first-reservation safe. A listing necessarily hands back ids the caller never held, so
+     * it can only be safe if it is scoped to something the caller is actually entitled to — here, the
+     * same principal id a host recorded via `register()`'s `ownerId` for the ORIGINAL upload request.
+     *
+     * Two things make that scoping real rather than decorative:
+     * - an attachment registered with NO `ownerId` (a host that never wired `resolveOwnerId`, or any
+     *   attachment from before this method existed) is excluded from every caller's results, never
+     *   just "unscoped" — this method is not callable with `ownerId: undefined`, so there is no input
+     *   that could accidentally match an ownerless record;
+     * - a claimed attachment is excluded outright, whether or not this caller's own `runId` claimed
+     *   it, so this method can never be used to re-discover something already handed to a run — the
+     *   same "runs, not listings, are the reach here" boundary `resolveForRun` draws for a single ref.
+     *
+     * What this does NOT scope by: batch, conversation, or run — none of those are recorded on an
+     * `AttachmentRecord` today. Two different conversations run by the SAME `ownerId` will each see
+     * the other's pending attachments through this method. A host for whom that is too wide needs a
+     * finer-grained id than `ownerId` to pass into `register()` — this method does not itself assume
+     * `ownerId` means "one admin account" rather than "one conversation, one composer, one browser
+     * tab"; it only assumes the host's `ownerId` is something the CALLER of this method is authorized
+     * to see everything under.
+     *
+     * Sorted oldest-first (`createdAt` ascending) — arrival order, matching how a person would expect
+     * to review what is waiting.
+     *
+     * @complexity O(n) in the number of tracked records (bounded by `maxStoredAttachments`), matching
+     * every other method on this port.
+     */
+    listPendingForOwner: (ownerId: string) => Promise<PendingAttachmentSummary[]>;
     /** Deletes the named still-unclaimed uploads, then the batch directory if it is now empty. */
     deleteUnclaimed: (batchId: string, paths: readonly string[]) => Promise<void>;
     /** Deletes everything `runId` claimed. Safe to call for a run that claimed nothing. */
@@ -122,7 +191,34 @@ export interface CreateDiskAttachmentStoreOptions {
     readonly maxStoredBytes?: number;
     /** How long an unclaimed upload survives `pruneExpired`. Defaults to one hour. */
     readonly retentionMs?: number;
+    /**
+     * Adopts the uploads a previous process left behind instead of emptying the directory on
+     * construction, so an attachment staged seconds before a restart is still there — and still
+     * listable — afterwards.
+     *
+     * **Defaults to `false`, which is exactly this pack's pre-existing behavior.** Opting in is a
+     * one-word change at the call site and reverting is deleting it; nothing about a store
+     * constructed without this option differs in any way from before the option existed.
+     *
+     * Adoption is authenticated, not blind: see {@link loadPersistedAttachments}.
+     */
+    readonly retainAcrossRestarts?: boolean;
 }
+/**
+ * `true` when `body` opens with an ISO-BMFF `ftyp` box whose major brand or compatible-brand list
+ * names AVIF. This is a line-for-line mirror of `@jini-ai/cms`'s `content-type-sniffer.ts`
+ * `isAvif` (no shared dependency exists between `@jini-ai/http-kit` and `@jini-ai/cms` today — see
+ * this module's handoff notes on whether extracting one is worth it): the major brand alone is not
+ * sufficient, because a great many real AVIF files declare the generic `mif1` (HEIF image) major
+ * brand and name `avif` only in the compatible-brand list, so both are checked. HEIC declares
+ * neither and is therefore never matched here — deliberate; nothing downstream of this attachment
+ * store has confirmed it can render a HEIC as an `<img>`, so labelling one `'image'` would risk the
+ * same "sniffed as a type the surface cannot actually display" failure this whole fix addresses.
+ *
+ * Must run before any generic `ftyp` check: {@link hasIsoBmffFtypTag} alone cannot tell AVIF, HEIC,
+ * and MP4 apart, so a brand-blind caller would misclassify every ISO-BMFF file it sees as one type.
+ */
+export declare function hasAvifSignature(body: Uint8Array): boolean;
 export interface AttachmentRecord {
     id: string;
     filePath: string;
@@ -135,6 +231,26 @@ export interface AttachmentRecord {
     ino: number;
     createdAt: number;
     claimedRunId?: string;
+    /**
+     * The principal a host's `AttachmentsHttpDeps.resolveOwnerId` reported for the request that
+     * registered this attachment. Absent when the host supplies no `resolveOwnerId` (this pack's
+     * behavior before ownership existed), which is why `listPendingForOwner` treats an absent
+     * `ownerId` as "cannot be scoped" rather than as a wildcard match — see that method's own doc.
+     */
+    ownerId?: string;
+}
+/**
+ * What `listPendingForOwner` hands back for one still-unclaimed attachment: enough for a caller to
+ * show a person what is waiting, and to name it again (`ref`) to `claim()`/`resolveForRun`.
+ */
+export interface PendingAttachmentSummary {
+    /** The same opaque `attachment:<uuid>` id `register()` returned over the wire. */
+    ref: string;
+    name: string;
+    kind: StoredAttachment['kind'];
+    size: number;
+    /** `Date.now()` at registration — when the file arrived, not when it was looked up. */
+    createdAt: number;
 }
 /** What registration recorded about a file, as `isUnchangedAttachment` needs it. */
 export interface RecordedAttachmentIdentity {
@@ -219,7 +335,10 @@ export declare function hasGifSignature(body: Uint8Array): boolean;
 export declare function hasWebpSignature(body: Uint8Array): boolean;
 /**
  * Infers `'image'` from the leading bytes rather than from a renderer-controlled MIME type or file
- * extension. PNG, JPEG, GIF87a/89a, and WEBP are recognized; everything else is `'file'`.
+ * extension. PNG, JPEG, GIF87a/89a, WEBP, and AVIF (brand-checked ISO-BMFF, see
+ * {@link hasAvifSignature}) are recognized; everything else is `'file'` — including a plain MP4 or
+ * other non-AVIF ISO-BMFF file, which shares AVIF's `ftyp` tag but is deliberately NOT matched here
+ * (see {@link hasIsoBmffFtypTag}'s doc for why a brand-blind `ftyp` check would be wrong).
  *
  * `kind` decides whether a path is later passed to `AgentExecutor.run()`'s `imagePaths`, so letting
  * a renderer assert it would let a renderer choose how the agent runtime parses the bytes.
@@ -242,6 +361,91 @@ export declare function writeBoundedAttachmentBody({ request, filePath, maxBytes
     size: number;
     signature: Uint8Array;
 }>;
+/**
+ * One attachment as it is written to its sidecar — `AttachmentRecord` minus two fields, both
+ * omitted deliberately:
+ *
+ * - **`batchDirectory`**, because it is re-derived from the upload root on read rather than trusted.
+ *   A sidecar is a file on disk; if it could name the directory a claim later hands to an agent, a
+ *   forged one would turn this store into an arbitrary-file-read primitive. Re-deriving it through
+ *   the same `BATCH_ID_PATTERN` + `resolve` containment argument `resolveBatchDirectory` uses means
+ *   a forged sidecar can only ever point inside the upload root.
+ * - **`claimedRunId`**, because no run survives the process that owned it. Everything adopted comes
+ *   back unclaimed; a file whose run died is re-listable to its own uploader (never to anyone else
+ *   — `claim`/`resolveForRun` still demand the unguessable id or path) and expires on the normal
+ *   TTL. See {@link loadPersistedAttachments} for the retention consequence that carries.
+ */
+export interface PersistedAttachmentRecord {
+    readonly id: string;
+    readonly filePath: string;
+    readonly name: string;
+    readonly kind: StoredAttachment['kind'];
+    readonly size: number;
+    readonly batchId: string;
+    readonly dev: number;
+    readonly ino: number;
+    readonly createdAt: number;
+    readonly ownerId?: string;
+}
+/**
+ * Turns one sidecar's parsed JSON back into an `AttachmentRecord`, or `undefined` for anything that
+ * is not a well-formed record naming a file inside its own batch directory.
+ *
+ * `batchDirectory` is re-derived here and `filePath`'s containment is re-checked against it with
+ * the same parent-equality test `register` uses — the two checks that make an adopted record no
+ * more trusted than one this process registered itself. Pure and exported so both can be exercised
+ * against hostile input directly, without staging files on disk.
+ */
+export declare function parsePersistedAttachment(raw: unknown, canonicalUploadDirectory: string): AttachmentRecord | undefined;
+/**
+ * Sidecar filename for a record id. Reduces the id to the same `[a-zA-Z0-9-]` allowlist
+ * `BATCH_ID_PATTERN` uses before appending the extension, so no id — however this store's own id
+ * format later changes — can put a `/`, a `..`, or a second extension into the path. Ids are
+ * `attachment:<uuid>`, so the reduction stays injective in practice: the UUID is what makes it
+ * unique and the UUID survives unchanged.
+ */
+export declare function attachmentSidecarFileName(id: string): string;
+/**
+ * Rebuilds the record map from the sidecar directory, adopting only records that are (a) well
+ * formed and contained, (b) still within the retention window, and (c) still backed by the exact
+ * file registration accepted. Anything failing any of those is deleted — sidecar first, then the
+ * file it named, and the file ONLY when containment passed, so an unparseable sidecar can never
+ * make this an arbitrary-file-delete primitive for whatever the daemon can unlink.
+ *
+ * **The retention consequence, stated rather than assumed harmless.** Because `claimedRunId` is not
+ * persisted (see {@link PersistedAttachmentRecord}), a file claimed by a run that died with the
+ * process is adopted as unclaimed instead of being wiped, so it now occupies disk and quota for up
+ * to `retentionMs` rather than until the next start. Bounded by the same `maxStoredAttachments` /
+ * `maxStoredBytes` quotas as any live upload, and cleared by the `pruneExpired` every upload
+ * already runs — but it is a real change in when that disk comes back.
+ *
+ * @complexity O(n) in sidecars present, each costing one read and one `lstat`/`realpath` pair.
+ */
+export declare function loadPersistedAttachments({ canonicalUploadDirectory, retentionMs, now, }: {
+    readonly canonicalUploadDirectory: string;
+    readonly retentionMs: number;
+    readonly now?: number;
+}): Promise<Map<string, AttachmentRecord>>;
+/**
+ * Removes every upload the sidecar pass did not adopt. Without this, a file whose sidecar was lost
+ * (or was never written, because it predates this option) would survive forever with nothing
+ * tracking it — trading the wipe's data loss for unbounded disk growth, which is not a trade worth
+ * making. This is what keeps "never wipe on construction" bounded.
+ */
+export declare function removeUnadoptedUploads(canonicalUploadDirectory: string, adopted: ReadonlyMap<string, AttachmentRecord>): Promise<void>;
+/**
+ * Decides what a newly-constructed store starts holding: nothing (the default — empty the directory
+ * outright, this pack's behavior before `retainAcrossRestarts` existed), or the authenticated
+ * survivors of the previous process.
+ *
+ * Exported so the whole restart decision can be exercised without standing a store up around it.
+ */
+export declare function prepareAttachmentStorage({ canonicalUploadDirectory, retainAcrossRestarts, retentionMs, now, }: {
+    readonly canonicalUploadDirectory: string;
+    readonly retainAcrossRestarts: boolean;
+    readonly retentionMs: number;
+    readonly now?: number;
+}): Promise<Map<string, AttachmentRecord>>;
 /**
  * The disk-backed `AttachmentStore` this package ships. Every default matches what a chat composer
  * needs out of the box; a host that wants different quotas passes them rather than reimplementing
@@ -250,7 +454,7 @@ export declare function writeBoundedAttachmentBody({ request, filePath, maxBytes
  * @complexity `register`/`claim` are O(n) in the number of tracked records (a small bounded number
  * — `maxStoredAttachments`), which is what keeps the quota decision synchronous; see `register`.
  */
-export declare function createDiskAttachmentStore({ uploadDirectory, maxAttachments, maxBatchBytes, maxStoredAttachments, maxStoredBytes, retentionMs, }: CreateDiskAttachmentStoreOptions): Promise<AttachmentStore>;
+export declare function createDiskAttachmentStore({ uploadDirectory, maxAttachments, maxBatchBytes, maxStoredAttachments, maxStoredBytes, retentionMs, retainAcrossRestarts, }: CreateDiskAttachmentStoreOptions): Promise<AttachmentStore>;
 /**
  * Diagnostic detail for an internal-error response the public API deliberately does not disclose
  * (SEC-005), matching `MediaInternalErrorContext`'s precedent.
@@ -286,6 +490,19 @@ export interface AttachmentsHttpDeps {
     readonly requireSameOrigin?: boolean;
     /** Host-owned sink for the real exception behind a generic `INTERNAL_ERROR` (SEC-005). Defaults to `console.error`. */
     readonly onInternalError?: (context: AttachmentsInternalErrorContext) => void;
+    /**
+     * Resolves the principal id that owns this upload, if any, passed through to `store.register()`'s
+     * `ownerId` (see that field's own doc, and `AttachmentStore.listPendingForOwner`). Optional: a
+     * host with no owner concept omits it and every attachment registers ownerless, matching this
+     * pack's behavior before ownership existed — `listPendingForOwner` simply never returns those.
+     *
+     * A host is expected to read this from a header/context IT ALREADY TRUSTS (e.g. a reverse proxy's
+     * own session-verified principal header, asserted only downstream of that proxy's auth gate) —
+     * this pack has no session concept of its own and never authenticates `req` itself. Returning a
+     * caller-controlled value here (an inbound header nothing has verified) would let any uploader
+     * assert an arbitrary `ownerId` and make its files discoverable by whoever that id names.
+     */
+    readonly resolveOwnerId?: (req: Request) => string | undefined;
 }
 export declare const ATTACHMENTS_ROUTE_PATH = "/api/attachments";
 export interface AttachmentUploadResponse {

package/dist/attachments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAqFA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,gGAAgG;IAChG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,+FAA+F;AAC/F,MAAM,MAAM,yBAAyB;AACnC,4DAA4D;AAC1D,eAAe;AACjB,qDAAqD;GACnD,sBAAsB;AACxB,sDAAsD;GACpD,sBAAsB;AACxB,2DAA2D;GACzD,iBAAiB;AACnB,4EAA4E;GAC1E,cAAc;AAChB,+CAA+C;GAC7C,kBAAkB;AACpB,2DAA2D;GACzD,6BAA6B;AAC/B,qFAAqF;GACnF,yBAAyB;AAC3B;;;GAGG;GACD,0BAA0B;AAC5B;;;GAGG;GACD,sBAAsB;AACxB,kEAAkE;GAChE,sBAAsB;AACxB,0DAA0D;GACxD,sBAAsB;AACxB,0DAA0D;GACxD,+BAA+B;AACjC,6CAA6C;GAC3C,aAAa,CAAC;AAElB;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;gBAE/B,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM;CAK/D;AA+BD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,oBAAoB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC;KACd,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChC,sFAAsF;IACtF,KAAK,EAAE,CACL,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B,8FAA8F;IAC9F,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,uFAAuF;IACvF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,iEAAiE;IACjE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,uDAAuD;IACvD,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gDAAgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAYD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,oFAAoF;AACpF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAMT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC9C,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,GACrB,gBAAgB,EAAE,CAsBpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAQD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,CAGrE;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAMzD;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAK1D;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAGzD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAI1D;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,IAAY,GACb,EAAE;IACD,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,CAAC,CAmCnD;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,eAAe,EACf,cAAmB,EACnB,aAAgC,EAChC,oBAA0B,EAC1B,cAAkC,EAClC,WAA6B,GAC9B,EAAE,gCAAgC,GAAG,OAAO,CAAC,eAAe,CAAC,CAwM7D;AAED;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,uHAAuH;IACvH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,+BAA+B,KAAK,IAAI,CAAC;CAC/E;AAED,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAkDzD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAsDf;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,cAAc,GACtB,IAAI,CA2BN"}
+{"version":3,"file":"attachments.d.ts","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAsGA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,gGAAgG;IAChG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,+FAA+F;AAC/F,MAAM,MAAM,yBAAyB;AACnC,4DAA4D;AAC1D,eAAe;AACjB,qDAAqD;GACnD,sBAAsB;AACxB,sDAAsD;GACpD,sBAAsB;AACxB,2DAA2D;GACzD,iBAAiB;AACnB,4EAA4E;GAC1E,cAAc;AAChB,+CAA+C;GAC7C,kBAAkB;AACpB,2DAA2D;GACzD,6BAA6B;AAC/B,qFAAqF;GACnF,yBAAyB;AAC3B;;;GAGG;GACD,0BAA0B;AAC5B;;;GAGG;GACD,sBAAsB;AACxB,kEAAkE;GAChE,sBAAsB;AACxB,0DAA0D;GACxD,sBAAsB;AACxB,0DAA0D;GACxD,+BAA+B;AACjC,6CAA6C;GAC3C,aAAa,CAAC;AAElB;;;;GAIG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;gBAE/B,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM;CAK/D;AA+BD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,oBAAoB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,EAAE,MAAM,CAAC;QACb,yFAAyF;QACzF,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAChC,sFAAsF;IACtF,KAAK,EAAE,CACL,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,KAAK,EAAE,MAAM,KACV,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACrF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAmCG;IACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAAC;IAC9E,8FAA8F;IAC9F,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,uFAAuF;IACvF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,iEAAiE;IACjE,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,uDAAuD;IACvD,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,wFAAwF;IACxF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,gDAAgD;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,kFAAkF;IAClF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CACzC;AA6CD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAW1D;AAWD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,kFAAkF;IAClF,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,0BAA0B,EACpC,QAAQ,EAAE,0BAA0B,GACnC,OAAO,CAMT;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,SAAS,gBAAgB,EAAE,EACxC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC9C,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,MAAM,GACrB,gBAAgB,EAAE,CAsBpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAQD;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,OAAO,GAAG,MAAM,CAGrE;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAMzD;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAK1D;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAGzD;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAI1D;AAWD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAE/E;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAAC,EAC/C,OAAO,EACP,QAAQ,EACR,QAAQ,EACR,IAAY,GACb,EAAE;IACD,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,UAAU,CAAA;CAAE,CAAC,CAmCnD;AAwBD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,wBAAwB,EAAE,MAAM,GAC/B,gBAAgB,GAAG,SAAS,CAmB9B;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE5D;AAgCD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,wBAAwB,EACxB,WAAW,EACX,GAAgB,GACjB,EAAE;IACD,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAezC;AAkBD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,wBAAwB,EAAE,MAAM,EAChC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC7C,OAAO,CAAC,IAAI,CAAC,CAMf;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,wBAAwB,EACxB,oBAAoB,EACpB,WAAW,EACX,GAAG,GACJ,EAAE;IACD,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAczC;AAED;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,EAC9C,eAAe,EACf,cAAmB,EACnB,aAAgC,EAChC,oBAA0B,EAC1B,cAAkC,EAClC,WAA6B,EAC7B,oBAA4B,GAC7B,EAAE,gCAAgC,GAAG,OAAO,CAAC,eAAe,CAAC,CAkR7D;AAED;;;GAGG;AACH,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,MAAM,EAAE,mBAAmB,GAAG,oBAAoB,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,4FAA4F;IAC5F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC,uHAAuH;IACvH,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,+BAA+B,KAAK,IAAI,CAAC;IAC9E;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAC;CAChE;AAED,eAAO,MAAM,sBAAsB,qBAAqB,CAAC;AAkDzD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,mBAAmB,EACzB,KAAK,EAAE;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,GAC/B,OAAO,CAAC,IAAI,CAAC,CAwDf;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,cAAc,GACtB,IAAI,CA2BN"}