@letta-ai/letta-code 0.34.18 → 0.34.20

package/dist/types/agent/approval-execution.d.ts

@@ -2,6 +2,36 @@ import type { ApprovalReturn, ToolReturn } from "@letta-ai/letta-client/resource
 import type { ToolReturnMessage } from "@letta-ai/letta-client/resources/tools";
 import type { ApprovalRequest } from "../cli/helpers/stream";
 import { executeTool, type ToolExecutionResult, type ToolReturnContent } from "../tools/manager";
+/** Grace period an aborted batch waits for signal-honoring tools to unwind
+ * before discarding stragglers (ms). */
+export declare const ABORT_GRACE_MS = 500;
+/** True when an error represents a user-initiated abort of a tool batch. */
+export declare function isUserAbortError(error: unknown): boolean;
+/** Overlay real partial results over queued synthetic interrupted results:
+ * settled tools' actual outputs win; stragglers keep their synthetics.
+ * Partials for tools never present in the queue (denials, precomputed
+ * results) are appended so real work is not silently dropped. */
+export declare function overlayPartialResults(queued: ApprovalResult[] | null, partials: ApprovalResult[] | undefined): ApprovalResult[];
+/** Map auto-denied decisions to their wire form. Denials are decisions, not
+ * tool executions: they must reach the server even when the batch aborts. */
+export declare function buildDeniedResults(autoDenied: Array<{
+    approval: ApprovalRequest;
+    reason: string;
+}>): ApprovalResult[];
+/** Results for decisions that never execute client-side: auto-handled tools
+ * with precomputed results and auto-denied calls. They must ride along on
+ * both the fulfilled path and the grace-expiry overlay, or the server's
+ * approval batch goes out incomplete. */
+export declare function buildCompanionResults(autoHandled: Array<{
+    toolCallId: string;
+    result: ToolExecutionResult;
+}>, autoDenied: Array<{
+    approval: ApprovalRequest;
+    reason: string;
+}>): ApprovalResult[];
+/** Attach extra decisions (e.g. pre-built denials) to an abort error's
+ * partials so the recovery queue carries a complete approval batch. */
+export declare function appendAbortPartials(error: unknown, extras: ApprovalResult[]): void;
 /**
  * Extract displayable text from tool return content (for UI display).
  * Multimodal content returns the text parts concatenated.
@@ -71,7 +101,9 @@ export declare function executeApprovalBatch(decisions: ApprovalDecision[], onCh
     afterToolExecution?: (toolCallId: string, result: ApprovalResult) => void | Promise<void>;
     executeTool?: typeof executeTool;
 }): Promise<ApprovalResult[]>;
-export declare function settleApprovalExecutionTasks(tasks: readonly Promise<void>[], partialResults?: () => ApprovalResult[]): Promise<void>;
+export declare function settleApprovalExecutionTasks(tasks: readonly Promise<void>[], partialResults?: () => ApprovalResult[], options?: {
+    abortSignal?: AbortSignal;
+}): Promise<void>;
 /**
  * Helper to execute auto-allowed tools and map results to the format expected by App.tsx.
  * Consolidates the common pattern of converting approvals to decisions, executing them,

package/dist/types/agent/approval-execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"approval-execution.d.ts","sourceRoot":"","sources":["../../../src/agent/approval-execution.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,cAAc,EAEd,UAAU,EACX,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAO5D,OAAO,EACL,WAAW,EAGX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAS3E;AAgDD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,gBAAgB,GAAE,MAAqC,GACtD,MAAM,CAmBR;AAED,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;CACzC,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAGF,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,cAAc,CAAC;AA+KjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,EAC5C,OAAO,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,OAAO,KACf,IAAI,CAAC;IACV,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,EAAE,CACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;CAClC,GACA,OAAO,CAAC,cAAc,EAAE,CAAC,CAO3B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,EAC/B,cAAc,GAAE,MAAM,cAAc,EAAa,GAChD,OAAO,CAAC,IAAI,CAAC,CAWf;AAmHD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,eAAe,CAAA;CAAE,CAAC,EACjD,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,EAC3C,OAAO,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,OAAO,KACf,IAAI,CAAC;IACV,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3D,GACA,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAmB9B"}
+{"version":3,"file":"approval-execution.d.ts","sourceRoot":"","sources":["../../../src/agent/approval-execution.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,cAAc,EAEd,UAAU,EACX,MAAM,kDAAkD,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAO5D,OAAO,EACL,WAAW,EAGX,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AAEzB;wCACwC;AACxC,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQxD;AAED;;;iEAGiE;AACjE,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAC/B,QAAQ,EAAE,cAAc,EAAE,GAAG,SAAS,GACrC,cAAc,EAAE,CAMlB;AAED;6EAC6E;AAC7E,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC/D,cAAc,EAAE,CAOlB;AAED;;;yCAGyC;AACzC,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,KAAK,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAAC,EACF,UAAU,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAC/D,cAAc,EAAE,CAYlB;AAED;uEACuE;AACvE,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,cAAc,EAAE,GACvB,IAAI,CAIN;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAS3E;AAgDD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,gBAAgB,GAAE,MAAqC,GACtD,MAAM,CAmBR;AAED,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,mBAAmB,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GACxB;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,iBAAiB,CAAC,EAAE,mBAAmB,CAAC;CACzC,GACD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAGF,MAAM,MAAM,cAAc,GAAG,kBAAkB,GAAG,cAAc,CAAC;AA+KjE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CACxC,SAAS,EAAE,gBAAgB,EAAE,EAC7B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,EAC5C,OAAO,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,OAAO,KACf,IAAI,CAAC;IACV,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC1D,mBAAmB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,kBAAkB,CAAC,EAAE,CACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,cAAc,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,CAAC,EAAE,OAAO,WAAW,CAAC;CAClC,GACA,OAAO,CAAC,cAAc,EAAE,CAAC,CAO3B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,SAAS,OAAO,CAAC,IAAI,CAAC,EAAE,EAC/B,cAAc,GAAE,MAAM,cAAc,EAAa,EACjD,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,WAAW,CAAA;CAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CAoFf;AAiKD;;;;;;;;;GASG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,eAAe,CAAA;CAAE,CAAC,EACjD,OAAO,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,EAC3C,OAAO,CAAC,EAAE;IACR,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,iBAAiB,CAAC,EAAE,CAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,OAAO,KACf,IAAI,CAAC;IACV,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3D,GACA,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAmB9B"}

package/dist/types/agent/mcp-originator-authority-file.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Durable-file layer for MCP originator authority records: types, wire
+ * validation, lattice merges, path resolution, and the locked whole-file
+ * read/write primitives. Split out of mcp-originator-authority.ts so both
+ * modules stay under the source-file size limit; all policy (gates,
+ * transactions, pending retirements) lives in the parent module.
+ */
+export type McpOriginatorAuthorityState = "live" | "headerless" | "terminal";
+/** The non-live end states a retirement can target. */
+export type McpOriginatorRetirementState = Exclude<McpOriginatorAuthorityState, "live">;
+export type AuthorityRecord = {
+    /** Highest mint generation observed for this run (any delivery kind). */
+    floor?: number;
+    state: McpOriginatorAuthorityState;
+    /**
+     * Durable retirement intent (evil-shub round-9 P1): set when the actual
+     * headerless/terminal mark could not be persisted. Every gate treats a
+     * record carrying an intent as NOT live, so peers fail closed even though
+     * the final state never landed; cleared when the mark lands.
+     */
+    retiringTo?: McpOriginatorRetirementState;
+    updatedAtMs: number;
+};
+/**
+ * A wire or disk generation is meaningful only as a nonnegative safe
+ * integer (evil-shub round-6 P1): a string, negative, fractional, or NaN
+ * value used to flow straight into Math.max, producing a NaN floor that
+ * silently disabled every later floor comparison (NaN < x is false).
+ */
+export declare function isValidGeneration(generation: unknown): generation is number;
+/**
+ * A record timestamp is meaningful only as a nonnegative safe integer not
+ * impossibly far in the future (evil-shub round-8 P1). A negative or NaN
+ * value flows into pruneExpired as `now - t > TTL` = always true, erasing
+ * live/terminal boundaries on the very next access — a fail-OPEN read of a
+ * corrupt file. A far-future value never prunes, pinning a stale floor.
+ */
+export declare function isValidUpdatedAtMs(updatedAtMs: unknown, nowMs: number): updatedAtMs is number;
+/** Test-only: point persistence at a fixture path (null = in-memory only). */
+export declare function configureAuthorityPersistencePathForTests(path: string | null): void;
+export declare function authorityPersistentPath(): string | null;
+export declare const STATE_RANK: Record<McpOriginatorAuthorityState, number>;
+/**
+ * Merge a durable retirement intent under the same monotonicity as the
+ * state lattice: once expressed, an intent is never silently relaxed, and a
+ * pending terminal subsumes a pending headerless. Intents are meaningless
+ * once the record left `live` (the landed mark is the stronger boundary).
+ */
+export declare function mergeRetirementIntents(a: McpOriginatorRetirementState | undefined, b: McpOriginatorRetirementState | undefined): McpOriginatorRetirementState | undefined;
+/**
+ * Merge two records for the same run under the monotone lattice: max floor,
+ * max state, max timestamp, strongest retirement intent. Never relaxes
+ * either side.
+ */
+export declare function mergeRecords(a: AuthorityRecord, b: AuthorityRecord | undefined): AuthorityRecord;
+/**
+ * Read the durable file. `degraded: true` means the file EXISTS but could
+ * not be read, parsed, or fully validated: the durable floor/retirement
+ * state is unknown, so callers must fail CLOSED (deny admission, deny token
+ * use) and must never overwrite the damaged file — writing a fresh file
+ * over it would erase a persisted headerless/terminal boundary and let a
+ * duplicate re-arm authority the operator already revoked (evil-shub
+ * round-5 P1). A missing file is NOT degraded: nothing was ever persisted.
+ */
+export declare function readAuthorityRecords(path: string): {
+    records: Map<string, AuthorityRecord>;
+    degraded: boolean;
+};
+/**
+ * Write with the same discipline as the disposition ledger: unique tmp file,
+ * fsync before rename, fsync the directory after. Throws on failure — the
+ * caller decides whether the mutation must degrade to in-memory only.
+ */
+export declare function writeAuthorityRecords(path: string, records: Map<string, AuthorityRecord>): void;
+//# sourceMappingURL=mcp-originator-authority-file.d.ts.map

package/dist/types/agent/mcp-originator-authority-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-originator-authority-file.d.ts","sourceRoot":"","sources":["../../../src/agent/mcp-originator-authority-file.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAmBH,MAAM,MAAM,2BAA2B,GAAG,MAAM,GAAG,YAAY,GAAG,UAAU,CAAC;AAE7E,uDAAuD;AACvD,MAAM,MAAM,4BAA4B,GAAG,OAAO,CAChD,2BAA2B,EAC3B,MAAM,CACP,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,2BAA2B,CAAC;IACnC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,4BAA4B,CAAC;IAC1C,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,OAAO,GAAG,UAAU,IAAI,MAAM,CAM3E;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,OAAO,EACpB,KAAK,EAAE,MAAM,GACZ,WAAW,IAAI,MAAM,CAOvB;AASD,8EAA8E;AAC9E,wBAAgB,yCAAyC,CACvD,IAAI,EAAE,MAAM,GAAG,IAAI,GAClB,IAAI,CAEN;AAED,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,IAAI,CAoBvD;AAED,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,2BAA2B,EAAE,MAAM,CAIlE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,CAAC,EAAE,4BAA4B,GAAG,SAAS,EAC3C,CAAC,EAAE,4BAA4B,GAAG,SAAS,GAC1C,4BAA4B,GAAG,SAAS,CAI1C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,CAAC,EAAE,eAAe,EAClB,CAAC,EAAE,eAAe,GAAG,SAAS,GAC7B,eAAe,CAcjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG;IAClD,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;CACnB,CAsEA;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,GACpC,IAAI,CAuBN"}

package/dist/types/agent/mcp-originator-authority.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Durable MCP originator authority records (USER_SCOPED_MCP_CONNECTIONS).
+ *
+ * The in-memory token Map in mcp-originator-tokens.ts forgets everything on
+ * teardown, which leaves three paired holes (evil-shub round-3 review):
+ *
+ * - No generation floor: a zombie delivery from a superseded mint attempt is
+ *   accepted whenever the newer generation is not (or no longer) visible in
+ *   memory — before the newer frame arrives, or after a restart forgot it.
+ * - Liveness is not authority: the durable input ledger can prove a run's
+ *   input is still live, but not that the run still OWNS MCP authority. An
+ *   approval origin swap or a mixed-batch merge deliberately deletes the
+ *   run's token so the continuation stays headerless; a duplicate frame
+ *   would otherwise recreate the key and re-arm the header mid-turn.
+ * - Terminal runs must stay retired: a post-terminal duplicate must never
+ *   re-insert a token.
+ *
+ * This module keeps a small durable record per super run id:
+ *
+ *   { floor?: number; state: "live" | "headerless" | "terminal";
+ *     retiringTo?: "headerless" | "terminal"; updatedAtMs }
+ *
+ * floor is the maximum observed mint generation; state transitions only ever
+ * move live → headerless|terminal (never back), mirroring the fail-closed
+ * intent of the boundaries that set them. retiringTo is a durable retirement
+ * INTENT (evil-shub round-9 P1): when a headerless/terminal mark cannot be
+ * persisted, the intent is written instead so peers treat the record as NOT
+ * live (fail closed for admission and token use) and a restarted process
+ * reloads the pending retirement and resumes the retry. Records survive
+ * process restarts in the same ~/.letta/state/<server-namespace>/ directory
+ * as the accepted input disposition ledger.
+ *
+ * Bounded by design: originator tokens carry a 1-hour absolute TTL ceiling
+ * server-side, so any record older than AUTHORITY_RECORD_TTL_MS (2h, twice
+ * the ceiling) can only describe dead tokens and is pruned on access.
+ *
+ * Persistence is serialized read-modify-write under the shared interprocess
+ * durable-file lock: every transaction re-reads and merges the file, so
+ * concurrent listener processes sharing the server-scoped file cannot erase
+ * each other's records (whole-file last-writer-wins would). Mutations are
+ * durable-first — callers retire volatile token state only after the mark
+ * lands. A failed write still applies the boundary in-memory (fail-closed
+ * for the live process) and logs every failure, never throwing into the
+ * input path.
+ */
+import { type McpOriginatorAuthorityState, type McpOriginatorRetirementState } from "./mcp-originator-authority-file";
+export type { McpOriginatorAuthorityState, McpOriginatorRetirementState, } from "./mcp-originator-authority-file";
+/**
+ * Re-attempt every pending retirement. Exported for the listener's
+ * teardown hook and driven explicitly by tests; the timer path calls it
+ * on an interval until the map drains.
+ */
+export declare function retryPendingMcpOriginatorRetirements(): void;
+/** Test-only: pending retirements, for asserting retry registration. */
+export declare function readPendingMcpOriginatorRetirementsForTests(): ReadonlyMap<string, {
+    state: McpOriginatorRetirementState;
+    generation?: number;
+    createdAtMs: number;
+}>;
+/**
+ * Record an accepted originator delivery (any kind: token, tombstone).
+ * Bumps the generation floor; never relaxes a headerless/terminal state.
+ * Returns false when the floor bump could not be persisted (see
+ * mutateDurableFirst) — callers must not treat the delivery as durably
+ * recorded.
+ */
+export declare function noteMcpOriginatorDelivery(runId: string, generation: number | undefined): boolean;
+/**
+ * Atomic admission: evaluate the gate AND, when it passes, durably bump the
+ * generation floor — both inside ONE locked transaction (evil-shub round-5
+ * P1). The pre-round-6 allows() + note() pair released the lock between the
+ * check and the floor write, so a concurrent process could advance the
+ * floor or mark the run headerless/terminal in the gap and this process
+ * would still install its stale token. Here the check, the floor write, and
+ * the durable persistence are indivisible: if the durable write fails, the
+ * whole transaction throws and admission is DENIED (fail closed — the
+ * caller drops the delivery and does not ACK, so redelivery retries).
+ * A degraded durable file also denies: the persisted boundary is unknown.
+ */
+/**
+ * Admission outcome (evil-shub round-8 P1 verdict split). A PERMANENT
+ * denial means this exact delivery can never be admitted — a stale
+ * generation at-or-below the durable floor, a legacy delivery beneath a
+ * known generation contract, a headerless/terminal run, or a malformed
+ * generation. Redelivering it would loop forever, so the caller must
+ * consume/drop the frame (no work, no redelivery). A RETRYABLE denial
+ * means the durable boundary could not be evaluated at all (degraded
+ * durable file, failed transaction): the caller must not commit work and
+ * must not ACK, so redelivery retries the whole admission once the
+ * infrastructure heals.
+ */
+export type McpOriginatorAdmission = {
+    admitted: true;
+} | {
+    admitted: false;
+    permanent: boolean;
+};
+export declare function admitMcpOriginatorDelivery(runId: string, generation: number | undefined): McpOriginatorAdmission;
+/**
+ * Use-time authority recheck for token handout (evil-shub round-5 P1): the
+ * admission gate only runs at delivery; a revoked or deliberately retired
+ * run must not keep spending its token. Consulted by getMcpOriginatorToken
+ * on every scoped call: a non-live state or a floor ahead of the held
+ * generation withdraws the token (the call proceeds unattributed). Fail
+ * closed on degraded/unreadable durable state.
+ */
+export declare function mcpOriginatorAuthorityPermitsUse(runId: string, generation: number | undefined): boolean;
+/**
+ * Mark a run's authority deliberately retired mid-turn (approval origin
+ * swap, mixed-batch merge): the continuation must stay headerless, so no
+ * later delivery of ANY generation may recreate the entry.
+ */
+export declare function markMcpOriginatorHeaderless(runId: string, deletedGeneration?: number): boolean;
+/** Mark a run terminal: no later delivery may recreate the entry. */
+export declare function markMcpOriginatorTerminal(runId: string, deletedGeneration?: number): boolean;
+/**
+ * Admission gate consulted before every create/refresh/tombstone write.
+ * Rejects zombies below the floor, legacy deliveries beneath a known
+ * generation contract, and ANY delivery for a headerless/terminal run.
+ */
+export declare function mcpOriginatorAuthorityAllows(runId: string, generation: number | undefined): boolean;
+/** Test-only: point persistence at a fixture path (null = in-memory only). */
+export declare function configureMcpOriginatorAuthorityPersistenceForTests(path: string | null): void;
+/** Test-only: shorten the record TTL (null restores the 2h default). */
+export declare function configureMcpOriginatorAuthorityTtlForTests(ttlMs: number | null): void;
+/** Test-only: drop every record and forget any loaded state. */
+export declare function resetMcpOriginatorAuthority(): void;
+/** Test-only diagnostics. */
+export declare function readMcpOriginatorAuthorityForTests(runId: string): {
+    floor?: number;
+    state: McpOriginatorAuthorityState;
+    retiringTo?: McpOriginatorRetirementState;
+} | undefined;
+//# sourceMappingURL=mcp-originator-authority.d.ts.map

package/dist/types/agent/mcp-originator-authority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-originator-authority.d.ts","sourceRoot":"","sources":["../../../src/agent/mcp-originator-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAKH,OAAO,EAKL,KAAK,2BAA2B,EAChC,KAAK,4BAA4B,EAMlC,MAAM,iCAAiC,CAAC;AAEzC,YAAY,EACV,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,iCAAiC,CAAC;AAgMzC;;;;GAIG;AACH,wBAAgB,oCAAoC,IAAI,IAAI,CAgC3D;AAsID,wEAAwE;AACxE,wBAAgB,2CAA2C,IAAI,WAAW,CACxE,MAAM,EACN;IACE,KAAK,EAAE,4BAA4B,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB,CACF,CAEA;AA4DD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAIT;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAClB;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC;AAE5C,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,sBAAsB,CAiExB;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAkCT;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAOT;AAED,qEAAqE;AACrE,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,iBAAiB,CAAC,EAAE,MAAM,GACzB,OAAO,CAMT;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAgCT;AAED,8EAA8E;AAC9E,wBAAgB,kDAAkD,CAChE,IAAI,EAAE,MAAM,GAAG,IAAI,GAClB,IAAI,CAEN;AAED,wEAAwE;AACxE,wBAAgB,0CAA0C,CACxD,KAAK,EAAE,MAAM,GAAG,IAAI,GACnB,IAAI,CAEN;AAED,gEAAgE;AAChE,wBAAgB,2BAA2B,IAAI,IAAI,CAQlD;AAED,6BAA6B;AAC7B,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,MAAM,GAC5D;IACE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,2BAA2B,CAAC;IACnC,UAAU,CAAC,EAAE,4BAA4B,CAAC;CAC3C,GACD,SAAS,CAcZ"}

package/dist/types/agent/mcp-originator-keepalive.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Active-turn renewal for MCP originator tokens (USER_SCOPED_MCP_CONNECTIONS).
+ *
+ * The server slides a pair's TTL back to the full 300s window on every
+ * successful verify — which today means on every MCP tool call carrying the
+ * header. A turn whose tool calls are spaced further apart than that window
+ * (long LLM generations, approval waits, sandbox stalls) would find its
+ * token expired at the next call and silently continue unattributed
+ * (evil-shub round-5 P1 lease/renewal). While this process holds a live
+ * token entry for a run, this module pings
+ * POST /v1/mcp-originator-tokens/verify on an interval comfortably below
+ * the sliding TTL, keeping the pair alive for exactly as long as the token
+ * is held — never longer: tombstones, retirements, withdrawals, and store
+ * clears all stop the keepalive, and the absolute 1h ceiling binds
+ * server-side regardless.
+ *
+ * Renewal is not authority: a token the server has revoked or fenced comes
+ * back { valid: false }, the local entry is withdrawn immediately, and the
+ * turn continues headerless. Network failures tolerate three consecutive
+ * ticks before giving up loudly; the server-side TTL remains the bound.
+ * The token value is never logged.
+ */
+type VerifyResult = {
+    valid: boolean;
+};
+type VerifyFn = (token: string, signal: AbortSignal) => Promise<VerifyResult>;
+/**
+ * Store access is injected by the caller (the token store) so this module
+ * never imports the store: the dependency points one way
+ * (store → keepalive), which keeps the import graph acyclic.
+ */
+export type KeepaliveHooks = {
+    /** Current raw token for the run, or undefined once the entry is gone. */
+    getToken: () => string | undefined;
+    /** Withdraw the entry after a server denial (turn continues headerless). */
+    withdraw: () => void;
+};
+/**
+ * Ensure a keepalive is running for a run holding a live token entry.
+ * Idempotent per run; called by the token store on every entry install.
+ * A RE-install (a fresh delivery replacing the held token) refreshes the
+ * hooks and resets the failure counter (evil-shub round-6 P1): strikes
+ * against the old token must not bleed into the new one's renewal budget.
+ */
+export declare function startMcpOriginatorKeepalive(superRunId: string, hooks: KeepaliveHooks): void;
+/** Stop renewing a run's token (entry removal, tombstone, store clear). */
+export declare function stopMcpOriginatorKeepalive(superRunId: string): void;
+/** Stop every keepalive (listener session teardown, tests). */
+export declare function stopAllMcpOriginatorKeepalives(): void;
+/** Test-only: install a verify stub and/or a shorter interval; pass null to restore. */
+export declare function configureMcpOriginatorKeepaliveForTests(config: {
+    verify?: VerifyFn;
+    intervalMs?: number;
+    verifyTimeoutMs?: number;
+} | null): void;
+/** Test-only: synchronously drive one tick for a run. */
+export declare function runMcpOriginatorKeepaliveTickForTests(superRunId: string): Promise<void>;
+/** Test-only: is a keepalive interval registered for this run? */
+export declare function hasMcpOriginatorKeepaliveForTests(superRunId: string): boolean;
+export {};
+//# sourceMappingURL=mcp-originator-keepalive.d.ts.map

package/dist/types/agent/mcp-originator-keepalive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-originator-keepalive.d.ts","sourceRoot":"","sources":["../../../src/agent/mcp-originator-keepalive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAqBH,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AACvC,KAAK,QAAQ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAkC9E;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,IAAI,CAAC;CACtB,CAAC;AAwJF;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,cAAc,GACpB,IAAI,CAyCN;AAED,2EAA2E;AAC3E,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAKnE;AAED,+DAA+D;AAC/D,wBAAgB,8BAA8B,IAAI,IAAI,CAIrD;AAED,wFAAwF;AACxF,wBAAgB,uCAAuC,CACrD,MAAM,EAAE;IACN,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,GAAG,IAAI,GACP,IAAI,CAQN;AAED,yDAAyD;AACzD,wBAAsB,qCAAqC,CACzD,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,kEAAkE;AAClE,wBAAgB,iCAAiC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAE7E"}

package/dist/types/agent/mcp-originator-tokens.d.ts

@@ -0,0 +1,207 @@
+/**
+ * In-memory store for MCP originator tokens (USER_SCOPED_MCP_CONNECTIONS).
+ *
+ * The cloud relay delivers a short-lived originator token on the top-level
+ * run-input frame (`mcp_originator_token`, alongside `super_run_id` — never
+ * inside the user-message payload) when the super run is attributed to a
+ * principal. The listener forwards that token as the
+ * `x-letta-mcp-originator-token` header on MCP tool-run calls so cloud-api can
+ * authorize user-scoped MCP connections on behalf of the originating
+ * principal.
+ *
+ * Hygiene contract (pinned in the design doc):
+ * - Tokens live ONLY in this process-local Map, keyed by super run id.
+ * - The token value is never logged (boolean-presence diagnostics only),
+ *   never persisted to disk, and never copied into tool args, transcripts,
+ *   or durable listener records. Only the super run id may travel on turn
+ *   plumbing (IncomingMessage, runtime context); lookups happen here.
+ * - Entries are deleted when the owning run reaches a terminal state and the
+ *   whole store is cleared on listener session teardown (and process exit).
+ *
+ * Ordering contract (mint generations):
+ * - The producer re-mints per delivery attempt inside one atomic Lua script
+ *   that INCRs a per-run generation counter, so every delivery carries a
+ *   strictly newer generation than any earlier attempt. A delivery whose
+ *   generation is OLDER than the stored entry is a zombie from a superseded
+ *   attempt and is dropped; an equal generation is an idempotent re-delivery
+ *   and last-write-wins within it.
+ * - Mixed-version rule: an entry WITHOUT a generation was written by a
+ *   legacy producer and accepts any delivery; an entry WITH a generation
+ *   rejects legacy (generation-less) deliveries, including tokenless clears
+ *   — a stale legacy frame must never erase known-newer authority.
+ * - Tokenless deliveries record a tombstone (null token) rather than
+ *   deleting, so a later stale create cannot resurrect the key below the
+ *   tombstone's generation. Finalizers still hard-delete at terminal.
+ *
+ * Consumer side only: this module does not verify tokens, enforce ACLs, or
+ * decide attribution. When no token is held for a run, callers simply omit
+ * the header and the call proceeds unattributed.
+ *
+ * Authority floor (durable, mcp-originator-authority.ts): generation
+ * comparison alone only protects against generations this volatile Map still
+ * remembers. A durable per-run record carries the max observed generation
+ * (the floor) plus a monotone live → headerless|terminal state across
+ * restarts, so a zombie from a superseded mint is rejected even on an empty
+ * Map, and a run whose authority was deliberately retired (origin swap,
+ * mixed-batch merge, terminal) can never be re-armed by a duplicate frame.
+ */
+/**
+ * Resolve the held token for a super run, or undefined when the run is
+ * unattributed (no token delivered), the entry is a tombstone, or the token
+ * was already dropped.
+ */
+export declare function getMcpOriginatorToken(superRunId: string | null | undefined): string | undefined;
+/**
+ * Seed a token directly (tests and local fixtures). Production entries only
+ * ever arrive through recordMcpOriginatorDelivery; a seeded entry is legacy
+ * (no generation) so any real delivery can supersede it.
+ */
+export declare function setMcpOriginatorToken(superRunId: string, token: string): void;
+/** Drop the token for a super run that reached a terminal state. */
+export declare function deleteMcpOriginatorToken(superRunId: string): void;
+/** Drop every held token (listener session teardown, tests). */
+export declare function clearMcpOriginatorTokens(): void;
+/** Presence-only diagnostic: how many runs currently hold a token. */
+export declare function mcpOriginatorTokenCount(): number;
+/**
+ * The parsed originator delivery from an inbound frame — the single shape
+ * the pre-commit gate hands to the ack path so the ack installs EXACTLY
+ * what was admitted (evil-shub round-9 P1).
+ */
+export type McpOriginatorParsedDelivery = {
+    superRunId?: string;
+    token?: string;
+    generation?: number;
+    /**
+     * True when the frame CARRIED a generation that failed shape validation —
+     * distinguishable from a legacy frame carrying no generation at all.
+     */
+    malformedGeneration?: boolean;
+};
+/**
+ * Extract the originator delivery from an inbound top-level run-input frame.
+ *
+ * This is the single parse site for the relay contract fields. Wire data is
+ * untrusted: present-but-malformed tokens/ids are treated as absent (the
+ * turn then runs unattributed) rather than rejecting the whole input. A
+ * present-but-malformed GENERATION is different (evil-shub round-6 P1 #1):
+ * degrading it to "legacy" would let a first malformed delivery install a
+ * token beneath the generation contract entirely (no floor exists yet to
+ * reject it), so the parse surfaces `malformedGeneration` and admission
+ * denies the delivery fail-closed.
+ */
+export declare function readMcpOriginatorDelivery(payload: unknown): McpOriginatorParsedDelivery;
+/**
+ * Apply an accepted input's originator delivery to the store.
+ *
+ * Used only by ack paths that did NOT pass through the router's pre-commit
+ * gate (duplicate re-acks and accepted approval payloads): it evaluates
+ * admission itself. Gated frames use installPreGatedMcpOriginatorDelivery
+ * instead — the gate's verdict is their single admission decision.
+ *
+ * Call only once the input has been ACCEPTED (queued or started); tokens
+ * belonging to rejected or dropped inputs must never reach the store.
+ *
+ * `allowCreate: false` (duplicate re-acks and accepted approval/teleport
+ * payloads — accepts that create no new owning turn) restricts the delivery
+ * to refreshing an entry that already exists. Two escape hatches keep live
+ * work from running headerless without reopening the orphaned-token hole:
+ *
+ * - `mayRecreateOwner`: when the entry is missing, the delivery may
+ *   (re)create it if this predicate proves the DURABLE input ledger still
+ *   shows a live accepted started/queued owner for this input — i.e. the
+ *   work survived a process crash or an ACK loss and a finalizer still
+ *   exists for it. Terminal disposition tombstones do not qualify, so a
+ *   post-terminal duplicate can never re-insert an orphaned token.
+ * - Tombstones count as existing entries for ordering purposes: a stale
+ *   create below the tombstone generation is dropped even when recreation
+ *   would otherwise be allowed.
+ */
+/**
+ * Outcome of recording a delivery (evil-shub round-6 P1, split in round 8).
+ *
+ * - "denied_retryable": the durable admission gate could not be evaluated
+ *   (degraded authority file, failed transaction). The caller MUST NOT ack
+ *   the frame and MUST NOT commit work for it: Cloud's delivery gate
+ *   treats an unacked frame as undeliverable and redelivers, retrying the
+ *   whole admission once the infrastructure heals.
+ * - "denied_permanent": this exact delivery can never be admitted — a
+ *   stale generation at-or-below the durable floor, a legacy delivery
+ *   beneath a known generation contract, a headerless/terminal run, or a
+ *   malformed generation. Redelivering it would loop forever with zero
+ *   chance of success, so the caller CONSUMES the frame (acks or rejects
+ *   it, per path) without installing a token and without running work
+ *   under it.
+ * - "admitted" covers every post-admission outcome (stored, refreshed,
+ *   create-deferred, tombstoned) — those are idempotent and ack normally.
+ * - "none" means the frame carried no originator stamp at all.
+ */
+export type McpOriginatorDeliveryVerdict = "admitted" | "denied_retryable" | "denied_permanent" | "none";
+/**
+ * Volatile install half for a delivery the pre-commit gate ALREADY admitted
+ * (evil-shub round-9 P1). Runs NO durable transaction and makes NO admission
+ * decision: the gate's atomic admit (floor bump included) is the single
+ * admission verdict for this frame, so the ack path can never flip committed
+ * work to denied after the fact. A retirement racing the gap between gate
+ * and install is fenced at use time by mcpOriginatorAuthorityPermitsUse,
+ * which re-consults the durable authority on every token use.
+ *
+ * `allowCreate: false` restricts the delivery to refreshing an entry that
+ * already exists; `mayRecreateOwner` is the narrow escape hatch (see
+ * recordMcpOriginatorDelivery).
+ */
+export declare function installPreGatedMcpOriginatorDelivery(delivery: McpOriginatorParsedDelivery, options?: {
+    allowCreate?: boolean;
+    mayRecreateOwner?: () => boolean;
+}): void;
+export declare function recordMcpOriginatorDelivery(frame: unknown, options?: {
+    allowCreate?: boolean;
+    mayRecreateOwner?: () => boolean;
+}): McpOriginatorDeliveryVerdict;
+/**
+ * Pre-commit admission gate (evil-shub round-8 P1; sole admission decision
+ * as of round-9 P1): evaluates ONLY the durable admission half of the
+ * delivery path — parse, malformed check, and the atomic durable admit
+ * (which bumps the generation floor) — without touching the volatile token
+ * store. The input router runs this BEFORE the durable input
+ * commit/enqueue/start so a denied frame never commits work it cannot be
+ * authorized for, and hands the returned `delivery` to the ack path, which
+ * installs it via installPreGatedMcpOriginatorDelivery with NO second
+ * admission transaction — a re-admission at ack time could flip committed
+ * work to denied when a retirement lands in the gate→ack gap (TOCTOU).
+ * Retirement in that gap is instead fenced at use time by
+ * mcpOriginatorAuthorityPermitsUse.
+ */
+export declare function gateMcpOriginatorDeliveryAdmission(frame: unknown): {
+    verdict: McpOriginatorDeliveryVerdict;
+    /**
+     * The parsed delivery, present when (and only when) the verdict is
+     * "admitted": exactly what the ack path must install.
+     */
+    delivery?: McpOriginatorParsedDelivery;
+};
+/**
+ * Fail closed when a turn's originator authority changes mid-run.
+ *
+ * An approval continuation that consumes a queued input from a DIFFERENT
+ * super run must not keep running under the original run's token, and the
+ * queued run's own token is consumed by this very merge. Retire both runs'
+ * held tokens so subsequent MCP calls omit the header (unattributed) instead
+ * of borrowing either run's authority. Same-run follow-ups are a no-op and
+ * keep their token (their run is still the one executing).
+ */
+export declare function retireMcpOriginatorTokensOnOriginSwap(turnSuperRunId: string | null | undefined, queuedSuperRunId: string | null | undefined): void;
+/**
+ * Terminal retirement for the finalizer: drop the held token and mark the
+ * run terminal durably, so a post-terminal duplicate can never re-insert an
+ * orphaned token even after a restart forgot the deletion.
+ */
+export declare function retireMcpOriginatorTokenOnTerminal(superRunId: string | null | undefined): void;
+/**
+ * Mixed-batch merge retirement: constituents' tokens can never be
+ * legitimately used by the unattributed merged turn, so they are retired and
+ * durably marked headerless — the merged finalizer cannot delete them later,
+ * and constituent duplicates must never recreate them.
+ */
+export declare function retireMcpOriginatorTokenOnMixedMerge(superRunId: string | null | undefined): void;
+//# sourceMappingURL=mcp-originator-tokens.d.ts.map

package/dist/types/agent/mcp-originator-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-originator-tokens.d.ts","sourceRoot":"","sources":["../../../src/agent/mcp-originator-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAuBH;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,MAAM,GAAG,SAAS,CAepB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG7E;AAED,oEAAoE;AACpE,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAGjE;AAiBD,gEAAgE;AAChE,wBAAgB,wBAAwB,IAAI,IAAI,CAG/C;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,IAAI,MAAM,CAMhD;AAED;;;;GAIG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,OAAO,GACf,2BAA2B,CAiC7B;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,4BAA4B,GACpC,UAAU,GACV,kBAAkB,GAClB,kBAAkB,GAClB,MAAM,CAAC;AA2BX;;;;;;;;;;;;GAYG;AACH,wBAAgB,oCAAoC,CAClD,QAAQ,EAAE,2BAA2B,EACrC,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAA;CAAE,GACpE,IAAI,CA+CN;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAA;CAAE,GACpE,4BAA4B,CA4B9B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG;IAClE,OAAO,EAAE,4BAA4B,CAAC;IACtC;;;OAGG;IACH,QAAQ,CAAC,EAAE,2BAA2B,CAAC;CACxC,CAkBA;AAED;;;;;;;;;GASG;AACH,wBAAgB,qCAAqC,CACnD,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACzC,gBAAgB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC1C,IAAI,CA2BN;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,IAAI,CAcN;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,IAAI,CAWN"}

package/dist/types/agent/modify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modify.d.ts","sourceRoot":"","sources":["../../../src/agent/modify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,OAAO,EAAgB,KAAK,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAErE,KAAK,aAAa,GACd,mBAAmB,GACnB,sBAAsB,GACtB,qBAAqB,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAY5B;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,iBAAiB,UAAQ,GACxB,aAAa,CA0Qf;AAED,eAAO,MAAM,iBAAiB;;;CAG7B,CAAC;AAEF,iBAAS,0BAA0B,CACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC/C,OAAO,EAAE;IAAE,sBAAsB,EAAE,OAAO,CAAA;CAAE,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AAaD;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC,CAsCrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC/C,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,YAAY,CAAC,CAoDvB;AAED,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AA+C/E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CA2Df;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE;IACf,aAAa,EAAE;QACb,SAAS,EAAE,CACT,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE;YACN,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,KACE,OAAO,CAAC,MAAM,CAAC,CAAC;KACtB,CAAC;CACH,GACA,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAgBnC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAwEnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC,CA2GnC"}
+{"version":3,"file":"modify.d.ts","sourceRoot":"","sources":["../../../src/agent/modify.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,UAAU,EACV,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAC;AACjG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,OAAO,EAAgB,KAAK,uBAAuB,EAAE,MAAM,SAAS,CAAC;AAErE,KAAK,aAAa,GACd,mBAAmB,GACnB,sBAAsB,GACtB,qBAAqB,GACrB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAY5B;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,iBAAiB,UAAQ,GACxB,aAAa,CAmRf;AAED,eAAO,MAAM,iBAAiB;;;CAG7B,CAAC;AAEF,iBAAS,0BAA0B,CACjC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC/C,OAAO,EAAE;IAAE,sBAAsB,EAAE,OAAO,CAAA;CAAE,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AAaD;;;;;;;;;GASG;AACH,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAmED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,UAAU,CAAC,CAsCrB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC/C,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACpC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,YAAY,CAAC,CAoDvB;AAED,MAAM,WAAW,iBAAiB;IAChC,sFAAsF;IACtF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,KAAK,EAAE,cAAc,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AA+C/E;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CA2Df;AAED;;;;;;;;;GASG;AACH,wBAAsB,0BAA0B,CAC9C,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE;IACf,aAAa,EAAE;QACb,SAAS,EAAE,CACT,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE;YACN,OAAO,CAAC,EAAE,OAAO,CAAC;YAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;SACnB,KACE,OAAO,CAAC,MAAM,CAAC,CAAC;KACtB,CAAC;CACH,GACA,OAAO,CAAC,MAAM,CAAC,CAsBjB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,MAAM,GAAG,IAAI,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAgBnC;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAwEnC;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC,CA2GnC"}

package/dist/types/agent/parent-memory-note.d.ts

@@ -0,0 +1,3 @@
+/** Only advertise memory that is available on this machine. */
+export declare function buildParentMemoryNote(parentAgentId: string): string | undefined;
+//# sourceMappingURL=parent-memory-note.d.ts.map

package/dist/types/agent/parent-memory-note.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parent-memory-note.d.ts","sourceRoot":"","sources":["../../../src/agent/parent-memory-note.ts"],"names":[],"mappings":"AAGA,+DAA+D;AAC/D,wBAAgB,qBAAqB,CACnC,aAAa,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAQpB"}

package/dist/types/agent/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../../src/agent/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAoBtE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wDAAwD;IACxD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,mBAAmB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,GAAG,MAAM,CAMxD;AAaD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC9C,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC9C,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,GAAG,SAAS,CAYtB;AAED,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC9C,GAAG,EAAE,MAAM,GACV,OAAO,GAAG,SAAS,CAKrB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE3D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE1D;AAYD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAUT;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,QAA4B,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,QAG7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;GAEG;AACH;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAIzD;AAkCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,iBAAiB,GAAE,MAAwC,EAC3D,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAsD/B;AAiKD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAepE"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../../src/agent/skills.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAoBtE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,wDAAwD;IACxD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,mBAAmB,EAAE,CAAC;CAC/B;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,GAAG,MAAM,CAMxD;AAaD,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC9C,GAAG,EAAE,MAAM,GACV,MAAM,GAAG,SAAS,CAGpB;AAED,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC9C,GAAG,EAAE,MAAM,GACV,MAAM,EAAE,GAAG,SAAS,CAYtB;AAED,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,EAC9C,GAAG,EAAE,MAAM,GACV,OAAO,GAAG,SAAS,CAKrB;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE3D;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAE1D;AAWD,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAUT;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,QAA4B,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,UAAU,YAAY,CAAC;AAEpC;;GAEG;AACH,eAAO,MAAM,iBAAiB,QAG7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAOzD;AAED;;GAEG;AACH;;GAEG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAIzD;AAkCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,cAAc,CAClC,iBAAiB,GAAE,MAAwC,EAC3D,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAsD/B;AAiKD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAepE"}