@krischoichoi/channel-harness 0.6.0

package/README.md

@@ -0,0 +1,110 @@
+# @krischoichoi/channel-harness
+
+Thin Harness-native bridge between channel adapters and DeepSeek Harness
+agents/sessions.
+
+This package is the **only** package allowed to import Harness public APIs. It
+turns `ChannelEvent`s emitted by `@krischoichoi/channel-core` adapters into Harness
+sessions, routes them to the right agent, and streams assistant output back to
+the channel reply pipeline.
+
+## Install
+
+```bash
+pnpm add @krischoichoi/channel-harness
+```
+
+As a Cordis plugin:
+
+```yaml
+- id: channels-harness
+  name: '@krischoichoi/channel-harness'
+  inject:
+    - channels
+    - agents
+    - agentDefaultModel
+    - agentPresets
+    - llm
+    - commands
+```
+
+Channel images follow the official Harness image pipeline: the bridge hands
+raw inbound image bytes to the Harness Attachment Store
+(`attachments.saveImage` -> `ImageAttachmentRef` -> real `ImageBlock`) and
+never rewrites messages for model compatibility. Whether the current model
+can see images (vision variant vs. deterministic text placeholder) is decided
+by Harness request projection, and the append-only session history keeps the
+original attachment reference.
+
+## What it does
+
+| Area | Responsibility |
+| --- | --- |
+| `SessionBinding` / `BindingStore` | Binds platform conversations to Harness session ids (file-backed by default, survives restarts) |
+| `AgentManager` / `AgentRouter` | Resolves/creates the agent for a conversation via `agent.default` plus per-channel/account/conversation overrides |
+| `MessageConverter` | Maps structured `ChannelEvent` messages to Harness message types |
+| `ReplyRouter` / `ReplyContextStore` | Streams `session/event` output back to the adapter (`ReplyHandle`) |
+| `ChannelQuestionPresenter` (interactions/) | Presents `ask_user_question` requests through generic interactive actions. One root-level, **prepended** answerer on the official `user-questions/request` Cordis waterfall serves every profile (the official Remote/Web answerer registers first at boot, and a waterfall is first-claim-wins); a declined presentation delegates to the next answerer (the Web UI) via `next()` |
+| `WorkspaceResolver` | Maps conversations to Harness workspaces (`channel-account` by default) |
+| commands | Registers Agent-scoped slash commands (`/new`, `/stop`, `/help`, `/status`, `/model`, `/version`, `/mirror`, `/bind`) through Harness `CommandRuntime` |
+| outbox | Proactive `send_channel_message` tool support (`OutboxService`) |
+
+Model routing remains Harness-owned. A channel Session uses the model resolved
+at create/resume time from its request header, route options, or the shared
+`agentDefaultModel`. `/model` delegates the current-Session switch to the
+official Host RPC (or the official headless hook) and persists the same choice
+as the default for future Sessions. The bridge does not add a second owner or
+run a first-turn model preparation RPC.
+
+## Configuration
+
+```yaml
+- id: channels-harness
+  name: '@krischoichoi/channel-harness'
+  inject: [channels, agents, agentDefaultModel, agentPresets, llm, commands]
+  config:
+    agent:
+      default:
+        preset: main
+        provider: deepseek
+        model: deepseek-chat
+        maxTokens: 4096
+    routing:
+      mode: global            # global | channel | account | conversation
+    bindingStore:
+      type: file              # memory | file
+    workspace:
+      mode: channel-account   # channel-account | host-cwd | disabled
+      autoCreate: true
+    userQuestions:
+      enabled: true
+      timeoutMs: 300000
+    reply:
+      updateIntervalMs: 200
+      splitParagraphs: true
+      splitCodeBlocks: true
+      finalFlush: true
+    maxConcurrency: 4
+    drainTimeoutMs: 5000
+    includeMetadataPrefix: false
+```
+
+Routing priority when `routing.mode` is not `global`:
+`conversation` > `account` > `channel` > `agent.default`.
+
+## Development
+
+```bash
+pnpm --filter @krischoichoi/channel-harness build
+pnpm --filter @krischoichoi/channel-harness typecheck
+pnpm --filter @krischoichoi/channel-harness test
+```
+
+## Related
+
+- [Repository root](../../README.md)
+- [Architecture design](../../docs/architecture.md)
+
+## License
+
+[MIT](../../LICENSE)

package/lib/access/controller.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Pure Inbound Access Controller.
+ *
+ * NO I/O, NO imports of storage/adapters/model. This is a deterministic pure
+ * function of a resolved policy + inbound identity facts. The bridge resolves
+ * the policy, then feeds both into `authorize` and acts ONLY on the returned
+ * decision (drop when !authorized or !activated).
+ *
+ * Algorithm (§19.1 DM / §19.2 Group):
+ *  - DM: disabled -> DENY; open -> ALLOW; allowlist -> allowFrom includes
+ *    senderId ? ALLOW : DENY (empty allowFrom == DENY ALL, never open).
+ *  - Group: groupPolicy disabled -> DENY; allowlist -> groups[conversationId]
+ *    must exist; open -> defaultGroupRule must exist. The selected rule
+ *    must be enabled; then the
+ *    sender gate (allowlist/open); finally the ACTIVATION gate: requireMention
+ *    without mentionedBot === true is NOT activated (`undefined !== true`, no
+ *    fail-open).
+ *
+ * The plan separates the Security Gate (authorized) from the Activation Gate
+ * (activated). `reason` is always the single most-specific cause.
+ */
+import type { ChannelAccessPolicy } from '@krischoichoi/channel-core';
+import type { InboundAccessDecision } from './decision.js';
+export interface InboundAccessInput {
+    conversationType: 'dm' | 'group';
+    senderId: string;
+    conversationId: string;
+    /** Adapter-supplied activation fact; `undefined`/`false` is never "mentioned". */
+    mentionedBot?: boolean;
+    policy: ChannelAccessPolicy;
+}
+export declare class InboundAccessController {
+    authorize(input: InboundAccessInput): InboundAccessDecision;
+    private authorizeDm;
+    private authorizeGroup;
+}
+//# sourceMappingURL=controller.d.ts.map

package/lib/access/controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.d.ts","sourceRoot":"","sources":["../../src/access/controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,IAAI,GAAG,OAAO,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,qBAAa,uBAAuB;IAClC,SAAS,CAAC,KAAK,EAAE,kBAAkB,GAAG,qBAAqB;IAO3D,OAAO,CAAC,WAAW;IAgBnB,OAAO,CAAC,cAAc;CAiCvB"}

package/lib/access/controller.js

@@ -0,0 +1,51 @@
+export class InboundAccessController {
+    authorize(input) {
+        if (input.conversationType === 'dm') {
+            return this.authorizeDm(input);
+        }
+        return this.authorizeGroup(input);
+    }
+    authorizeDm(input) {
+        const { policy, senderId } = input;
+        if (policy.dmPolicy === 'disabled') {
+            return { authorized: false, activated: false, reason: 'dm_disabled' };
+        }
+        if (policy.dmPolicy === 'open') {
+            return { authorized: true, activated: true, reason: 'allowed' };
+        }
+        // policy.dmPolicy === 'allowlist' (incl. allowFrom = []).
+        if (policy.allowFrom.includes(senderId)) {
+            return { authorized: true, activated: true, reason: 'allowed' };
+        }
+        return { authorized: false, activated: false, reason: 'user_not_allowed' };
+    }
+    authorizeGroup(input) {
+        const { policy, senderId, conversationId, mentionedBot } = input;
+        if (policy.groupPolicy === 'disabled') {
+            return { authorized: false, activated: false, reason: 'group_disabled' };
+        }
+        const rule = policy.groupPolicy === 'open'
+            ? policy.defaultGroupRule
+            : policy.groups[conversationId];
+        if (!rule) {
+            return { authorized: false, activated: false, reason: 'group_not_allowed' };
+        }
+        if (rule.enabled !== true) {
+            return { authorized: false, activated: false, reason: 'group_disabled' };
+        }
+        // Sender gate.
+        if (rule.senderPolicy === 'allowlist') {
+            if (!rule.allowFrom.includes(senderId)) {
+                return { authorized: false, activated: false, reason: 'group_user_not_allowed' };
+            }
+        }
+        // senderPolicy === 'open' -> any sender in this NAMED group is authorized.
+        // Activation gate (§14): requireMention without a reliable mention is NOT
+        // activated (undefined !== true, never fail-open).
+        if (rule.requireMention && mentionedBot !== true) {
+            return { authorized: true, activated: false, reason: 'mention_required' };
+        }
+        return { authorized: true, activated: true, reason: 'allowed' };
+    }
+}
+//# sourceMappingURL=controller.js.map

package/lib/access/controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"controller.js","sourceRoot":"","sources":["../../src/access/controller.ts"],"names":[],"mappings":"AAiCA,MAAM,OAAO,uBAAuB;IAClC,SAAS,CAAC,KAAyB;QACjC,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAEO,WAAW,CAAC,KAAyB;QAC3C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QAEnC,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YACnC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QACD,0DAA0D;QAC1D,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7E,CAAC;IAEO,cAAc,CAAC,KAAyB;QAC9C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;QAEjE,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;YACtC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3E,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,KAAK,MAAM;YACxC,CAAC,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC9E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC1B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QAC3E,CAAC;QAED,eAAe;QACf,IAAI,IAAI,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;YACnF,CAAC;QACH,CAAC;QACD,2EAA2E;QAE3E,0EAA0E;QAC1E,mDAAmD;QACnD,IAAI,IAAI,CAAC,cAAc,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YACjD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC5E,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,CAAC;CACF"}

package/lib/access/decision.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Access decision types.
+ *
+ * `AccessDecisionReason` enumerates every fail-closed outcome the Harness
+ * Access Gate can produce. `InboundAccessDecision` is the pure controller's
+ * output: `authorized` = the security gate passed; `activated` = the activation
+ * gate passed; `reason` is the singular, most specific cause (see §19).
+ *
+ * These types are intentionally free of I/O concerns — the controller that
+ * produces them never touches storage, adapters or the model.
+ */
+export type AccessDecisionReason = 'allowed' | 'missing_policy' | 'invalid_policy' | 'unidentified_sender' | 'invalid_conversation' | 'dm_disabled' | 'user_not_allowed' | 'group_disabled' | 'group_not_allowed' | 'group_user_not_allowed' | 'mention_required';
+export interface InboundAccessDecision {
+    authorized: boolean;
+    activated: boolean;
+    reason: AccessDecisionReason;
+}
+//# sourceMappingURL=decision.d.ts.map

package/lib/access/decision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/access/decision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAC5B,SAAS,GACT,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,sBAAsB,GACtB,aAAa,GACb,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,wBAAwB,GACxB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,oBAAoB,CAAC;CAC9B"}

package/lib/access/decision.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=decision.js.map

package/lib/access/decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../src/access/decision.ts"],"names":[],"mappings":""}

package/lib/access/resolver.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Harness-side Access Policy Resolver.
+ *
+ * Failure-closed resolution over the shared ChannelStorage. The Harness DOES
+ * NOT depend on channel-control: it reads the shared versioned policy KV via
+ * `accessPolicyStorageKey` and validates it with
+ * the shared `channelAccessPolicySchema` (both live in @krischoichoi/channel-core).
+ *
+ * Reading rules (§15):
+ *   - missing JSON     -> `missing`
+ *   - malformed JSON   -> `invalid`
+ *   - unknown version / schema failure -> `invalid`
+ *
+ * There is no policy caching: every inbound reads once, so Web
+ * saves and permission revocations take effect immediately with no invalidation
+ * machinery and no stale-ACL window.
+ */
+import type { ChannelAccessPolicy, ChannelStorage } from '@krischoichoi/channel-core';
+export type ResolvedAccessPolicy = {
+    state: 'present';
+    policy: ChannelAccessPolicy;
+} | {
+    state: 'missing';
+} | {
+    state: 'invalid';
+    error: string;
+};
+export interface ChannelAccessPolicyResolver {
+    resolve(channelId: string, accountId: string): Promise<ResolvedAccessPolicy>;
+}
+/**
+ * Default resolver backed by the shared ChannelStorage (production wiring is
+ * `ctx.channels.resources.storage`). Lazily resolves storage via a getter so it
+ * stays decoupled from the Cordis context / ChannelService lifecycle.
+ */
+export declare class StoredChannelAccessPolicyResolver implements ChannelAccessPolicyResolver {
+    private readonly getStorage;
+    constructor(getStorage: () => ChannelStorage);
+    resolve(channelId: string, accountId: string): Promise<ResolvedAccessPolicy>;
+}
+//# sourceMappingURL=resolver.d.ts.map

package/lib/access/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/access/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAGtF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACjD;IAAE,KAAK,EAAE,SAAS,CAAA;CAAE,GACpB;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,MAAM,WAAW,2BAA2B;IAC1C,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC9E;AAED;;;;GAIG;AACH,qBAAa,iCAAkC,YAAW,2BAA2B;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM,cAAc;IAEvD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAkBnF"}

package/lib/access/resolver.js

@@ -0,0 +1,31 @@
+import { accessPolicyStorageKey, channelAccessPolicySchema } from '@krischoichoi/channel-core';
+/**
+ * Default resolver backed by the shared ChannelStorage (production wiring is
+ * `ctx.channels.resources.storage`). Lazily resolves storage via a getter so it
+ * stays decoupled from the Cordis context / ChannelService lifecycle.
+ */
+export class StoredChannelAccessPolicyResolver {
+    getStorage;
+    constructor(getStorage) {
+        this.getStorage = getStorage;
+    }
+    async resolve(channelId, accountId) {
+        const storage = this.getStorage();
+        const raw = await storage.get(accessPolicyStorageKey(channelId, accountId));
+        if (raw === undefined)
+            return { state: 'missing' };
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return { state: 'invalid', error: 'malformed policy JSON' };
+        }
+        const result = channelAccessPolicySchema.safeParse(parsed);
+        if (!result.success) {
+            return { state: 'invalid', error: `policy schema validation failed: ${result.error.message}` };
+        }
+        return { state: 'present', policy: result.data };
+    }
+}
+//# sourceMappingURL=resolver.js.map

package/lib/access/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../src/access/resolver.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAW/F;;;;GAIG;AACH,MAAM,OAAO,iCAAiC;IACf;IAA7B,YAA6B,UAAgC;QAAhC,eAAU,GAAV,UAAU,CAAsB;IAAG,CAAC;IAEjE,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,SAAiB;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5E,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAEnD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;CACF"}

package/lib/agent-manager.d.ts

@@ -0,0 +1,314 @@
+/**
+ * AgentManager — the single place that touches `ctx.agents`.
+ *
+ * Ownership model (doc H0.4/H0.7):
+ * - `ctx.agents.get()` returns a live agent the bridge does NOT own — it is
+ *   never disposed here.
+ * - `ctx.agents.create()` / `ctx.agents.resume()` return an `AgentHandle`;
+ *   the bridge MUST hold every handle it created/resumed and dispose it on
+ *   plugin unload. Owned handles live in `owned` and are disposed exactly
+ *   once by `disposeAll()`.
+ *
+ * Routing is expressed as an `AgentRouteSpec`, never an `agentId` (the
+ * Harness Agent identity is the `SessionId`). `create` and `resume` receive
+ * the SAME route so provider/model/maxTokens stay identical on both paths
+ * (doc H0.5 route parity).
+ *
+ * Create-vs-resume is decided by the CALLER (the bridge), not by error-regex
+ * fallback. Persistence is an OPTIONAL capability resolved LIVE at the use
+ * site: `canResume()` tells the caller whether a sessionPersistence service
+ * is currently mounted, `exists()` probes membership via the live service,
+ * and `probePersisted()` answers the atomic unavailable/present/missing
+ * question in one resolver call (no canResume/exists TOCTOU across a
+ * persistence HMR) — corruption / unsupported-format / backend failures
+ * propagate loudly rather than being misread as "no persistence".
+ *
+ * Global concurrency gate: at most `maxConcurrency` `create()`/`resume()` calls
+ * are in flight at once across all sessions; `get()` (a live lookup) is never
+ * limited.
+ */
+import { SessionId, type SessionEvent, type SessionHeader } from '@deepseek-ai/dsh-session';
+import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence';
+import type { Context } from '@deepseek-ai/cordis';
+import type { Agent, AgentOptions, AgentSetup, ModelSelection } from '@deepseek-ai/dsh-agent';
+import type { ChannelLogger } from '@krischoichoi/channel-core';
+import type { AgentRouteSpec } from './agent-router.js';
+import type { SessionBinding } from './session-router.js';
+/** A live agent as seen through the gateway (id + raw Agent + drive surface). */
+export interface GatewayAgent {
+    id: string;
+    /** The raw Harness Agent — the dsh-scope key used to install Agent-scoped commands. */
+    agent: Agent;
+    followup(message: unknown): void;
+    whenIdle(): Promise<void>;
+}
+/** A gateway-created/resumed agent that the caller must dispose. */
+export interface GatewayAgentHandle extends GatewayAgent {
+    dispose(): Promise<void>;
+}
+/**
+ * Whether a persisted session exists, probed through the optional persistence
+ * service. Implemented via membership/inspection, NEVER by matching an error
+ * message against a /persistence|persist/i regex.
+ */
+export interface PersistenceProbe {
+    exists(sessionId: string): Promise<boolean>;
+}
+/**
+ * Atomic result of probing ONE session through the LIVE persistence
+ * capability: `unavailable` (no sessionPersistence service mounted right
+ * now), `present`, or `missing`. Resolving the capability once per probe
+ * closes the canResume/exists TOCTOU window (a persistence HMR between the
+ * two lookups would otherwise pair different backends).
+ */
+export type PersistedProbeResult = 'unavailable' | 'present' | 'missing';
+/** Persistence was configured for the binding, but is unavailable right now. */
+export declare class PersistenceUnavailableError extends Error {
+    readonly sessionId: string;
+    readonly bindingKey?: string | undefined;
+    constructor(sessionId: string, bindingKey?: string | undefined);
+}
+/**
+ * A durable binding references a persisted session that no longer exists
+ * (session-not-found, aligned with the official Host's
+ * "persisted identity missing -> session-not-found"). With a
+ * sessionPersistence service mounted, a missing persisted session behind an
+ * existing binding is a binding/session durability inconsistency — NEVER a
+ * first create — so resolution fails loudly instead of silently
+ * blank-recreating the same session id. Deployments WITHOUT persistence
+ * explicitly ephemeral bindings never throw this: they recreate on the recorded id.
+ */
+export declare class SessionNotFoundError extends Error {
+    readonly sessionId: string;
+    readonly bindingKey?: string | undefined;
+    constructor(sessionId: string, bindingKey?: string | undefined);
+}
+/** Caller-supplied metadata for a fresh agent create. */
+export interface AgentCreateMeta {
+    /** Explicit working directory for the new session's header.cwd. */
+    cwd?: string;
+}
+/** Minimal port the bridge needs from the Harness agent runtime. */
+export interface AgentGateway {
+    get(sessionId: string): GatewayAgent | undefined;
+    create(sessionId: string, route: AgentRouteSpec, setup?: AgentSetup, meta?: AgentCreateMeta): Promise<GatewayAgentHandle>;
+    resume(sessionId: string, route: AgentRouteSpec, setup?: AgentSetup): Promise<GatewayAgentHandle>;
+    /** Whether a sessionPersistence service is available (enables resume). */
+    canResume(): boolean;
+    /** Probe whether a persisted session exists. */
+    exists(sessionId: string): Promise<boolean>;
+    /**
+     * Atomic persistence probe (live capability resolved once). Optional on
+     * the interface so minimal test doubles can rely on the AgentManager's
+     * canResume+exists fallback; the real gateway implements it.
+     */
+    probePersisted?(sessionId: string): Promise<PersistedProbeResult>;
+}
+/** A resolved agent reference handed to the caller. */
+export interface AgentRef {
+    sessionId: string;
+    route: AgentRouteSpec;
+    /** The raw Harness Agent — the dsh-scope key used to install Agent-scoped commands. */
+    agent: Agent;
+    followup(message: unknown): void;
+    whenIdle(): Promise<void>;
+    /**
+     * Marks the caller done with the ref. Simple v1 semantics: the ref never
+     * disposes the underlying handle itself — the manager owns lifecycle and
+     * disposes each handle exactly once during `disposeAll()`.
+     */
+    release(): void;
+}
+/** Filter out undefined optional agentOptions fields (route parity helper). */
+export declare function optionsFor(route: AgentRouteSpec): AgentOptions | undefined;
+/**
+ * Resolve a route's provider/model, falling back to Harness's default model
+ * selection when the route leaves the model unset.
+ *
+ * `{{model}}` (the persona variable that fails with "prompt variable has no
+ * value") depends only on `model`, so a route that already pins a model —
+ * with or without a provider — is left untouched. Only a missing model is
+ * filled from the default (and the default's provider rides along when the
+ * route also left provider unset).
+ *
+ * The default model is read live (per agent creation), so new channel sessions
+ * follow the user's Harness-wide default while sessions pinned to an explicit
+ * route keep their own provider/model.
+ */
+export declare function resolveRoute(route: AgentRouteSpec, defaultSelection: ModelSelection | undefined): AgentRouteSpec;
+/**
+ * Probe a persisted session's existence through the persistence service's
+ * `list()` membership. A session that is absent returns `false`; any backend
+ * failure (corruption, unsupported format, connectivity) propagates loudly.
+ *
+ * The persistence service is resolved LIVE on every call (a resolver, not a
+ * startup snapshot): a sessionPersistence mounted/unmounted/replaced after
+ * the bridge started is observed on the next probe — reversible Cordis
+ * lifecycle parity, since `ctx.get` only returns currently active providers.
+ */
+export declare class PersistenceMembershipProbe implements PersistenceProbe {
+    private readonly resolvePersistence;
+    constructor(resolvePersistence: () => SessionPersistence | undefined);
+    exists(sessionId: string): Promise<boolean>;
+    /** Atomic probe: the live capability is resolved exactly once per call. */
+    probe(sessionId: string): Promise<PersistedProbeResult>;
+}
+/**
+ * Read one durable V3 session through the public read handle. A channel bridge
+ * never depends on an implementation-specific persistence reader.
+ */
+export declare function resolvePersistedInspection(persistence: SessionPersistence, sessionId: SessionId): Promise<PersistedInspection | undefined>;
+/** Structural subset of the official `SessionInspection` the bridge consumes. */
+export interface PersistedInspection {
+    readonly meta: SessionHeader;
+    readonly events: readonly SessionEvent[];
+}
+/**
+ * Real gateway over `ctx.agents`. This is the only Harness import surface in
+ * the bridge (besides the `session/event` feed consumed by ReplyRouter).
+ *
+ * Persistence is an OPTIONAL capability resolved LIVE at the use site: the
+ * caller passes a resolver (`() => ctx.get('sessionPersistence')`), so
+ * `canResume()` and the existence probe reflect the service's CURRENT
+ * presence — mounting, unmounting, or replacing the service after the bridge
+ * started is observed on the next probe (never a startup snapshot).
+ */
+export declare class HarnessAgentGateway implements AgentGateway {
+    private readonly ctx;
+    private readonly probe;
+    private readonly resolvePersistence;
+    /**
+     * All persisted session ids (shape-tolerant, issue #8) — the `/bind`
+     * resolution universe. Empty when no persistence is mounted.
+     */
+    listPersistedSessionIds(): Promise<string[]>;
+    /**
+     * The persisted Agent preset of one session (issue #6 route parity): the
+     * official `agentPresetProjectionDefinition` fold over the durable
+     * inspection. Undefined when no persistence / no recorded preset.
+     */
+    persistedPresetOf(sessionId: string): Promise<string | undefined>;
+    constructor(ctx: Context, resolvePersistence?: () => SessionPersistence | undefined);
+    get(sessionId: string): GatewayAgent | undefined;
+    canResume(): boolean;
+    exists(sessionId: string): Promise<boolean>;
+    probePersisted(sessionId: string): Promise<PersistedProbeResult>;
+    /** Read Harness's live default-model selection (undefined when absent). */
+    private defaultSelection;
+    /**
+     * Resolve and mount the official Agent preset before publication, matching
+     * the Harness Host's create/resume composition boundary. Without this join,
+     * preset-scoped tools such as `ask_user_question` are invisible to the Agent.
+     */
+    private composePreset;
+    create(sessionId: string, route: AgentRouteSpec, setup?: AgentSetup, meta?: AgentCreateMeta): Promise<GatewayAgentHandle>;
+    resume(sessionId: string, route: AgentRouteSpec, setup?: AgentSetup): Promise<GatewayAgentHandle>;
+    private wrap;
+}
+export declare class AgentManager {
+    private readonly gateway;
+    private readonly logger;
+    private readonly inFlight;
+    /** Handles this manager created/resumed — the ones it must dispose. */
+    private readonly owned;
+    /** Resolved refs, kept for drain (`whenIdle`) lookups. */
+    private readonly refs;
+    /** Agents that already received the one-time channel-command setup. */
+    private readonly configuredAgents;
+    /** sessionId -> binding, the reverse lookup used by the ReplyRouter. */
+    private readonly bindings;
+    private readonly maxConcurrency;
+    private active;
+    /** Waiters queued for a free concurrency slot. */
+    private readonly waiters;
+    private closed;
+    constructor(gateway: AgentGateway, logger: ChannelLogger, maxConcurrency?: number);
+    /** Whether a sessionPersistence service enables `resume`. */
+    canResume(): boolean;
+    /** Probe whether a persisted session exists. Backend failures propagate. */
+    exists(sessionId: string): Promise<boolean>;
+    /**
+     * Atomic persistence probe: resolves the LIVE capability once and answers
+     * `unavailable` / `present` / `missing` — the bridge's single decision
+     * point for recreate-vs-resume-vs-fail, immune to a persistence HMR between
+     * `canResume()` and `exists()`.
+     */
+    probePersisted(sessionId: string): Promise<PersistedProbeResult>;
+    /**
+     * Create a NEW agent for a session (no prior binding). Calls
+     * `gateway.create` directly (under the concurrency slot), owns the handle,
+     * and returns the ref. Never resumes — the caller already decided this is a
+     * fresh conversation. Single-flight per session id.
+     */
+    create(sessionId: string, route: AgentRouteSpec, setup?: AgentSetup, meta?: AgentCreateMeta): Promise<AgentRef>;
+    /**
+     * Resolve an agent for an EXISTING, persisted session: live `get` first; on
+     * a miss, `gateway.resume(route)`. A resume failure propagates loudly
+     * (throws) — never falls back to create and never sniffs error messages.
+     * Single-flight per session id.
+     */
+    resolve(sessionId: string, route: AgentRouteSpec, setup?: AgentSetup): Promise<AgentRef>;
+    /**
+     * Borrow the LIVE agent for a session, when one is loaded in this process.
+     * Returns `undefined` when there is no live agent — the caller (the Session
+     * factory, for channel-session lifecycle decisions) decides what to do next
+     * (resume, or a cwd/workspace-aware recreate). Never creates or resumes and
+     * never takes ownership (the borrowed agent is never disposed here). Runs
+     * the one-time setup against a borrowed agent, exactly once.
+     */
+    borrowIfLive(sessionId: string, route: AgentRouteSpec, setup?: AgentSetup): Promise<AgentRef | undefined>;
+    /** Register the binding associated with a session (reverse reply routing). */
+    registerBinding(binding: SessionBinding): void;
+    /** Reverse lookup for the ReplyRouter. */
+    bindingFor(sessionId: string): SessionBinding | undefined;
+    /**
+     * Live agent lookup for the /stop fast path (spec §8). Returns the raw
+     * Agent when it is currently live in this process — NEVER creates or
+     * resumes a session just to answer this probe.
+     */
+    getLiveAgent(sessionId: string): Agent | undefined;
+    /** Resolved ref for drain purposes, if any. */
+    refFor(sessionId: string): AgentRef | undefined;
+    /** Session ids that currently have an active turn (for drain). */
+    activeSessions(): string[];
+    /**
+     * Dispose every owned handle exactly once and clear all tracking. Agents
+     * obtained via `gateway.get()` (not owned) are never disposed.
+     */
+    disposeAll(): Promise<void>;
+    /**
+     * Dispose a single owned handle (used to roll back a create whose binding
+     * write failed afterward). No-op for handles the manager does not own.
+     */
+    disposeSession(sessionId: string): Promise<void>;
+    /**
+     * Retire a session's reference and reverse binding and dispose it ONLY if the
+     * manager owns the handle. Borrowed / unknown agents are released
+     * from local tracking but NEVER disposed. Retiring never touches persisted
+     * history — the old session keeps its durable log.
+     */
+    retireSession(sessionId: string): Promise<void>;
+    /**
+     * One-time channel-command setup for a BORROWED live agent. A
+     * borrowed agent never went through create/resume, so its setup could not
+     * have run at publication; run it here exactly once against the agent's
+     * scoped context. Setup failure propagates to the caller. The borrowed
+     * agent is never disposed here.
+     */
+    private ensureBorrowedSetup;
+    private doCreate;
+    private doResolve;
+    private doBorrowIfLive;
+    private withSlot;
+    private acquireSlot;
+    private releaseSlot;
+    private makeRef;
+}
+/** A durable session cannot be silently recomposed under a different preset. */
+export declare class AgentPresetConflictError extends Error {
+    readonly sessionId: string;
+    readonly requested: string;
+    readonly persisted: string;
+    constructor(sessionId: string, requested: string, persisted: string);
+}
+//# sourceMappingURL=agent-manager.d.ts.map

package/lib/agent-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-manager.d.ts","sourceRoot":"","sources":["../src/agent-manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,KAAK,EAAE,KAAK,EAAe,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAO3G,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,uFAAuF;IACvF,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,oEAAoE;AACpE,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAAG,aAAa,GAAG,SAAS,GAAG,SAAS,CAAC;AAEzE,gFAAgF;AAChF,qBAAa,2BAA4B,SAAQ,KAAK;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM;gBAA/C,SAAS,EAAE,MAAM,EAAW,UAAU,CAAC,EAAE,MAAM,YAAA;CAQrE;AAED;;;;;;;;;GASG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM;gBADnB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,YAAA;CAW/B;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oEAAoE;AACpE,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACjD,MAAM,CACJ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,KAAK,CAAC,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/B,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClG,0EAA0E;IAC1E,SAAS,IAAI,OAAO,CAAC;IACrB,gDAAgD;IAChD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C;;;;OAIG;IACH,cAAc,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACnE;AAED,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,CAAC;IACtB,uFAAuF;IACvF,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACjC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;;OAIG;IACH,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,+EAA+E;AAC/E,wBAAgB,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,YAAY,GAAG,SAAS,CAM1E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,cAAc,EACrB,gBAAgB,EAAE,cAAc,GAAG,SAAS,GAC3C,cAAc,CAUhB;AAED;;;;;;;;;GASG;AACH,qBAAa,0BAA2B,YAAW,gBAAgB;IACrD,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBAAlB,kBAAkB,EAAE,MAAM,kBAAkB,GAAG,SAAS;IAE/E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQjD,2EAA2E;IACrE,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAM9D;AAWD;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,kBAAkB,EAC/B,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAU1C;AAED,iFAAiF;AACjF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,CAAC;CAC1C;AAmBD;;;;;;;;;GASG;AACH,qBAAa,mBAAoB,YAAW,YAAY;IA4BpD,OAAO,CAAC,QAAQ,CAAC,GAAG;IA3BtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAuC;IAE1E;;;OAGG;IACG,uBAAuB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAOlD;;;;OAIG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;gBAQpD,GAAG,EAAE,OAAO,EAC7B,kBAAkB,CAAC,EAAE,MAAM,kBAAkB,GAAG,SAAS;IAM3D,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAWhD,SAAS,IAAI,OAAO;IAKd,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI3C,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAItE,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IAKxB;;;;OAIG;YACW,aAAa;IAmBrB,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,KAAK,CAAC,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,kBAAkB,CAAC;IAqBxB,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAyBvG,OAAO,CAAC,IAAI;CASb;AAED,qBAAa,YAAY;IAiBrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAjBzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAwC;IACjE,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyC;IAC/D,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;IACzD,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqC;IAC9D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,MAAM,CAAK;IACnB,kDAAkD;IAClD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,MAAM,CAAS;gBAGJ,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACtC,cAAc,SAAI;IAKpB,6DAA6D;IAC7D,SAAS,IAAI,OAAO;IAIpB,4EAA4E;IAC5E,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI3C;;;;;OAKG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQtE;;;;;OAKG;IACH,MAAM,CACJ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,cAAc,EACrB,KAAK,CAAC,EAAE,UAAU,EAClB,IAAI,CAAC,EAAE,eAAe,GACrB,OAAO,CAAC,QAAQ,CAAC;IAmBpB;;;;;OAKG;IACH,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmBxF;;;;;;;OAOG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC;IAOzG,8EAA8E;IAC9E,eAAe,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAI9C,0CAA0C;IAC1C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIzD;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAIlD,+CAA+C;IAC/C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAI/C,kEAAkE;IAClE,cAAc,IAAI,MAAM,EAAE;IAI1B;;;OAGG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBjC;;;OAGG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAatD;;;;;OAKG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAarD;;;;;;OAMG;YACW,mBAAmB;YAQnB,QAAQ;YAcR,SAAS;YAcT,cAAc;YAWd,QAAQ;YASR,WAAW;IAazB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,OAAO;CAehB;AAED,gFAAgF;AAChF,qBAAa,wBAAyB,SAAQ,KAAK;IAE/C,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM;gBAFjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM;CAK7B"}