@oh-hai/cli 0.1.0-beta.0 → 0.2.1

package/dist/commands/inbox.js

@@ -12,20 +12,27 @@
 // loop's. The signed delivery `{ directive, signature }` is forwarded VERBATIM so a runtime that
 // wants defense-in-depth can verify it against the Hub key. In-session `id` dedup (§13.4) IS handled
 // here (see the loop). Sibling subcommands (`inbox list` / `inbox ack`) and long-poll are out of scope.
-import { buildOk, serializeEnvelope } from "../envelope.js";
+import { originOf } from "../auth/resolve-token.js";
+import { CliError, buildOk, serializeEnvelope } from "../envelope.js";
+import { acquireWatchLock } from "../watch-lock.js";
 import { parseSubcommandArgs } from "./flags.js";
 import { ackInbox, drainInbox, redactToken } from "./messaging/http.js";
-import { requireToken } from "./messaging/identity.js";
+import { requireWatchIdentity } from "./messaging/identity.js";
 import { positiveInt, sanitizeForTerminal, strictBoolFlag, stringFlag } from "./messaging/shared.js";
 const SUBCOMMANDS = ["watch"];
 const INBOX_WATCH_OPTIONS = {
     interval: { type: "string" },
     max: { type: "string" },
     once: { type: "boolean" },
+    force: { type: "boolean" },
 };
 /** Default poll cadence (ms). Well under the Hub's 90s presence-freshness window so the agent stays
  *  `online` between polls, and responsive to arriving directives without hammering the Hub. */
 const DEFAULT_INTERVAL_MS = 5000;
+/** Consecutive failed heartbeats before the guard warns (#323). Past a few misses the lock's heartbeat
+ *  is frozen and a peer may reclaim it while this watcher keeps draining — a silent double-drain we
+ *  surface once. Above 1 so a single transient write blip doesn't cry wolf. */
+const HEARTBEAT_FAILURE_WARN_THRESHOLD = 3;
 /** A sane upper bound for `--max` (a drain batch size, not a timer): generous enough to never reject a
  *  realistic mailbox drain, small enough to reject an absurd `?max=` — the Hub clamps to its own cap
  *  regardless. Distinct from the timer ceiling `--interval` uses. */
@@ -42,9 +49,17 @@ async function inboxWatch(ctx, flags) {
     // Strict boolean: a mistyped `--once=treu` is a usage error, not a silent fall-through to the
     // infinite watch loop (it would keep draining + acking every interval instead of a one-shot).
     const once = strictBoolFlag(flags.once, "--once");
-    // The mailbox is selected by the bearer alone (the Hub derives the agent from the token), so this
-    // needs only a token — like `await`, and unlike a submit, it does not require a resolvable account.
-    const token = await requireToken(ctx);
+    // `--force` takes over a lock held by another watcher for this identity (see the guard below).
+    const force = strictBoolFlag(flags.force, "--force");
+    // The mailbox is selected by the bearer (the Hub derives the agent from the token), so the drain
+    // needs only a token — like `await`. But the concurrent-drain guard keys on the AGENT ID (the mailbox
+    // is per-agent, not per-token: one agent can hold several bearers), so resolve both here.
+    const { token, agentId } = await requireWatchIdentity(ctx);
+    // Concurrent-drain guard (#323): `inbox watch` is a DESTRUCTIVE drain+ack, so two watchers sharing
+    // one identity race to consume the same directive. Acquire an agent-scoped lock before the loop,
+    // refuse a live second watcher (unless --force), and release on exit. Skipped when no lock seam is
+    // wired (hermetic callers) — production always wires one, so the guard is active in the shipped CLI.
+    const lock = acquireWatchGuard(ctx, agentId, intervalMs, force);
     // Cross-poll dedup (§13.4): once a directive id has been emitted AND its batch acked, a later
     // redelivery of that same id (fresh t/jti, after a crash or the server's visibility timeout) is
     // suppressed from re-emission — but still acked so the Hub consumes it. `seen` commits only AFTER a
@@ -54,36 +69,117 @@ async function inboxWatch(ctx, flags) {
     // set (dp-007), the runtime's concern, not this loop's. A long-lived watch grows `seen` with
     // directive volume; acceptable for v1.
     const seen = new Set();
-    for (;;) {
-        const { directives } = await drainInbox(ctx, token, max);
-        // The unique ids in THIS drain — both the ack list and the within-batch emit guard (a Hub could
-        // repeat an id inside one batch; emit it once and ack it once, not twice).
-        const batchIds = new Set();
-        for (const delivery of directives) {
-            const id = delivery.directive.id;
-            if (!seen.has(id) && !batchIds.has(id))
-                emitDirective(ctx, delivery, token);
-            batchIds.add(id);
+    // Track sustained heartbeat failure so a frozen-heartbeat watcher warns instead of silently letting a
+    // peer reclaim its identity mid-drain (#323). Reset on any successful heartbeat.
+    let heartbeatFailures = 0;
+    let heartbeatWarned = false;
+    try {
+        for (;;) {
+            // Refresh the heartbeat each poll so a live watcher isn't seen as stale, while a crashed one
+            // ages out and becomes reclaimable. Best-effort (a failed write never crashes the loop) — but a
+            // SUSTAINED failure means our heartbeat is frozen; warn once so the operator knows the guard may
+            // have silently degraded and a second watcher could now be draining too.
+            if (lock !== undefined && !lock.heartbeat()) {
+                heartbeatFailures += 1;
+                if (!heartbeatWarned && heartbeatFailures >= HEARTBEAT_FAILURE_WARN_THRESHOLD) {
+                    heartbeatWarned = true;
+                    ctx.io.err(`⚠️  oh-hai: the watch-lock heartbeat has failed ${heartbeatFailures}× in a row (state dir ` +
+                        `unwritable?) — another watcher may reclaim this identity while this one keeps draining.`);
+                }
+            }
+            else {
+                heartbeatFailures = 0;
+                heartbeatWarned = false;
+            }
+            const { directives } = await drainInbox(ctx, token, max);
+            // The unique ids in THIS drain — both the ack list and the within-batch emit guard (a Hub could
+            // repeat an id inside one batch; emit it once and ack it once, not twice).
+            const batchIds = new Set();
+            for (const delivery of directives) {
+                const id = delivery.directive.id;
+                if (!seen.has(id) && !batchIds.has(id))
+                    emitDirective(ctx, delivery, token);
+                batchIds.add(id);
+            }
+            if (batchIds.size > 0) {
+                // Flush stdout BEFORE acking so the emit-then-ack handoff is genuinely at-least-once: `io.log`
+                // only queues to stdout, so when `watch` is piped to a runtime under backpressure the bytes may
+                // still be buffered in this process. Acking first would let the Hub consume a directive that a
+                // crash/EPIPE could still lose before it reaches the consumer. `flushOutput` waits for the
+                // queued writes to complete (a write-callback barrier, not just the drain flag); THEN ack.
+                await ctx.runtime.flushOutput?.();
+                // The single batched consume-ack (§14) — one call per drained batch, deduped ids.
+                await ackInbox(ctx, token, [...batchIds]);
+                // Commit to the cross-poll dedup set only now that the batch is durably consumed.
+                for (const id of batchIds)
+                    seen.add(id);
+            }
+            // --once: a single drain→emit→ack pass (cron / scripting / deterministic tests). Otherwise loop;
+            // the poll itself IS the presence heartbeat, so keep polling on the interval even on an empty drain.
+            if (once)
+                return;
+            await ctx.runtime.sleep(intervalMs);
         }
-        if (batchIds.size > 0) {
-            // Flush stdout BEFORE acking so the emit-then-ack handoff is genuinely at-least-once: `io.log`
-            // only queues to stdout, so when `watch` is piped to a runtime under backpressure the bytes may
-            // still be buffered in this process. Acking first would let the Hub consume a directive that a
-            // crash/EPIPE could still lose before it reaches the consumer. `flushOutput` waits for the
-            // queued writes to complete (a write-callback barrier, not just the drain flag); THEN ack.
-            await ctx.runtime.flushOutput?.();
-            // The single batched consume-ack (§14) — one call per drained batch, deduped ids.
-            await ackInbox(ctx, token, [...batchIds]);
-            // Commit to the cross-poll dedup set only now that the batch is durably consumed.
-            for (const id of batchIds)
-                seen.add(id);
-        }
-        // --once: a single drain→emit→ack pass (cron / scripting / deterministic tests). Otherwise loop;
-        // the poll itself IS the presence heartbeat, so keep polling on the interval even on an empty drain.
-        if (once)
-            return;
-        await ctx.runtime.sleep(intervalMs);
     }
+    finally {
+        // Release on every exit path (--once return, a thrown drain/ack error, the loop's stop). Deletes
+        // the lockfile only if it is still ours, so a reclaimer's lock is never removed. An abrupt SIGKILL
+        // skips this, but the dead pid then makes the lock reclaimable — the stale mechanism is the net.
+        lock?.release();
+    }
+}
+/**
+ * Acquire the per-agent watch lock (#323) and translate the outcome into user-facing behavior:
+ * refuse a live second watcher (`already_running`, exit 10), a `--force` steal warning, a
+ * stale-reclaim note, or an "unavailable" warning when no lock dir resolves — or when the agent id
+ * can't be resolved (the guard keys on the agent id, never the bearer). Returns the live handle to
+ * heartbeat/release, or undefined when there is no handle to manage (guard unavailable, or no lock
+ * seam wired — the hermetic-test path). All human notes go to stderr so the `--json` NDJSON stdout
+ * stream stays clean.
+ */
+function acquireWatchGuard(ctx, agentId, intervalMs, force) {
+    const io = ctx.runtime.watchLockIo;
+    if (io === undefined)
+        return undefined; // no seam wired → guard skipped (existing behavior)
+    if (agentId === undefined) {
+        // The mailbox is per-agent, so without a resolved agent id there's no correct key (the bearer is
+        // wrong — one agent can hold several). Degrade honestly rather than key on the token.
+        ctx.io.err("⚠️  oh-hai: concurrent-watch protection is unavailable (no resolvable agent id — set --account / " +
+            "MA2H_AGENT_ID, or log in). Proceeding without a lock — do not start a second watcher for this identity.");
+        return undefined;
+    }
+    const origin = originOf(ctx.config.baseUrl);
+    const outcome = acquireWatchLock(io, { origin, agentId, intervalMs, force });
+    if (outcome.kind === "held") {
+        const h = outcome.holder;
+        // `already_running` (exit 10), NOT `conflict`/exit 8: this is a LOCAL precondition conflict with no
+        // Hub call, distinct from a Hub 409, so a caller branching on the exit code never treats "stop the
+        // other watcher" (non-retryable) as a retryable idempotency conflict. See docs/specs/cli.md §7/§8.
+        // `holder` is undefined when a peer just won the create race and its record isn't readable yet.
+        const who = h !== undefined ? `(pid ${h.pid} on ${h.hostname}, watching ${h.origin} since ${new Date(h.startedAt).toISOString()})` : "(it just started; its lock is being written)";
+        throw new CliError("already_running", `another 'oh-hai inbox watch' is already draining this identity ${who}. Two watchers on one ` +
+            `identity race to drain the same mailbox — a directive delivered once is consumed by whichever ` +
+            `drains first, so the other agent can silently lose it. Stop the other watcher, or re-run with ` +
+            `--force to take over.`);
+    }
+    if (outcome.kind === "unavailable") {
+        ctx.io.err(`⚠️  oh-hai: concurrent-watch protection is unavailable (${outcome.reason}). Proceeding without a ` +
+            `lock — do not start a second 'oh-hai inbox watch' for this identity.`);
+        return undefined;
+    }
+    if (outcome.reclaimed?.wasLive) {
+        // Only reachable under --force: we stole a lock that still looked live.
+        const h = outcome.reclaimed.holder;
+        ctx.io.err(`⚠️  oh-hai: --force took over the watch lock held by pid ${h.pid} on ${h.hostname} (held since ` +
+            `${new Date(h.startedAt).toISOString()}). If that watcher is still running you now BOTH drain ` +
+            `this mailbox and will race for directives.`);
+    }
+    else if (outcome.reclaimed) {
+        const h = outcome.reclaimed.holder;
+        ctx.io.err(`oh-hai: reclaimed a stale watch lock from pid ${h.pid} on ${h.hostname} (last active ` +
+            `${new Date(h.heartbeatAt).toISOString()}).`);
+    }
+    return outcome.lock;
 }
 /** Hand one directive to the agent runtime. stdout is the directive STREAM.
  *

package/dist/commands/inbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbox.js","sourceRoot":"","sources":["../../src/commands/inbox.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,+FAA+F;AAC/F,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,8GAA8G;AAC9G,EAAE;AACF,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,mGAAmG;AACnG,iGAAiG;AACjG,qGAAqG;AACrG,wGAAwG;AAExG,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGrG,MAAM,WAAW,GAAG,CAAC,OAAO,CAAU,CAAC;AAEvC,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CACjB,CAAC;AAEX;+FAC+F;AAC/F,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC;;qEAEqE;AACrE,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,+FAA+F;IAC/F,8EAA8E;IAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnF,MAAM,UAAU,CAAC,GAAG,EAAE,MAAiC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,KAA8B;IAC3E,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC9H,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrI,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAElD,kGAAkG;IAClG,oGAAoG;IACpG,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IAEtC,8FAA8F;IAC9F,gGAAgG;IAChG,oGAAoG;IACpG,kGAAkG;IAClG,qGAAqG;IACrG,kGAAkG;IAClG,6FAA6F;IAC7F,uCAAuC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,SAAS,CAAC;QACR,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACzD,gGAAgG;QAChG,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACtB,+FAA+F;YAC/F,gGAAgG;YAChG,+FAA+F;YAC/F,2FAA2F;YAC3F,2FAA2F;YAC3F,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;YAClC,kFAAkF;YAClF,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;YAC1C,kFAAkF;YAClF,KAAK,MAAM,EAAE,IAAI,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,iGAAiG;QACjG,qGAAqG;QACrG,IAAI,IAAI;YAAE,OAAO;QACjB,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;wDAYwD;AACxD,SAAS,aAAa,CAAC,GAAmB,EAAE,QAAyB,EAAE,KAAa;IAClF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACxH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,QAAQ,EAAE,CAAC;IAChI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"inbox.js","sourceRoot":"","sources":["../../src/commands/inbox.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,+FAA+F;AAC/F,qGAAqG;AACrG,qGAAqG;AACrG,qGAAqG;AACrG,8GAA8G;AAC9G,EAAE;AACF,kGAAkG;AAClG,qGAAqG;AACrG,oGAAoG;AACpG,mGAAmG;AACnG,iGAAiG;AACjG,qGAAqG;AACrG,wGAAwG;AAExG,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAkB,MAAM,kBAAkB,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGrG,MAAM,WAAW,GAAG,CAAC,OAAO,CAAU,CAAC;AAEvC,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC5B,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;IACvB,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;IACzB,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;CAClB,CAAC;AAEX;+FAC+F;AAC/F,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC;;+EAE+E;AAC/E,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAC3C;;qEAEqE;AACrE,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,+FAA+F;IAC/F,8EAA8E;IAC9E,MAAM,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACnF,MAAM,UAAU,CAAC,GAAG,EAAE,MAAiC,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAE,KAA8B;IAC3E,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAC9H,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrI,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,+FAA+F;IAC/F,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAErD,iGAAiG;IACjG,sGAAsG;IACtG,0FAA0F;IAC1F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE3D,mGAAmG;IACnG,iGAAiG;IACjG,mGAAmG;IACnG,qGAAqG;IACrG,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAEhE,8FAA8F;IAC9F,gGAAgG;IAChG,oGAAoG;IACpG,kGAAkG;IAClG,qGAAqG;IACrG,kGAAkG;IAClG,6FAA6F;IAC7F,uCAAuC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,sGAAsG;IACtG,iFAAiF;IACjF,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,SAAS,CAAC;YACR,6FAA6F;YAC7F,gGAAgG;YAChG,iGAAiG;YACjG,yEAAyE;YACzE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBAC5C,iBAAiB,IAAI,CAAC,CAAC;gBACvB,IAAI,CAAC,eAAe,IAAI,iBAAiB,IAAI,gCAAgC,EAAE,CAAC;oBAC9E,eAAe,GAAG,IAAI,CAAC;oBACvB,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,mDAAmD,iBAAiB,wBAAwB;wBAC1F,yFAAyF,CAC5F,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,iBAAiB,GAAG,CAAC,CAAC;gBACtB,eAAe,GAAG,KAAK,CAAC;YAC1B,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACzD,gGAAgG;YAChG,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;gBAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC5E,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;gBACtB,+FAA+F;gBAC/F,gGAAgG;gBAChG,+FAA+F;gBAC/F,2FAA2F;gBAC3F,2FAA2F;gBAC3F,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;gBAClC,kFAAkF;gBAClF,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC;gBAC1C,kFAAkF;gBAClF,KAAK,MAAM,EAAE,IAAI,QAAQ;oBAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,iGAAiG;YACjG,qGAAqG;YACrG,IAAI,IAAI;gBAAE,OAAO;YACjB,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,iGAAiG;QACjG,mGAAmG;QACnG,iGAAiG;QACjG,IAAI,EAAE,OAAO,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CACxB,GAAmB,EACnB,OAA2B,EAC3B,UAAkB,EAClB,KAAc;IAEd,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC;IACnC,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;IAE5F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,iGAAiG;QACjG,sFAAsF;QACtF,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,mGAAmG;YACjG,yGAAyG,CAC5G,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7E,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QACzB,oGAAoG;QACpG,mGAAmG;QACnG,mGAAmG;QACnG,gGAAgG;QAChG,MAAM,GAAG,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,cAAc,CAAC,CAAC,MAAM,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,8CAA8C,CAAC;QACpL,MAAM,IAAI,QAAQ,CAChB,iBAAiB,EACjB,kEAAkE,GAAG,wBAAwB;YAC3F,gGAAgG;YAChG,gGAAgG;YAChG,uBAAuB,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,2DAA2D,OAAO,CAAC,MAAM,0BAA0B;YACjG,sEAAsE,CACzE,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QAC/B,wEAAwE;QACxE,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,4DAA4D,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,eAAe;YAC/F,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,yDAAyD;YAC/F,4CAA4C,CAC/C,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,iDAAiD,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,QAAQ,gBAAgB;YACrF,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,IAAI,CAC/C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;wDAYwD;AACxD,SAAS,aAAa,CAAC,GAAmB,EAAE,QAAyB,EAAE,KAAa;IAClF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACxH,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC7B,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,QAAQ,EAAE,CAAC;IAChI,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC;AACrD,CAAC"}

package/dist/commands/login.d.ts

@@ -1,2 +1,15 @@
 import type { CommandContext } from "./context.js";
 export declare function loginCommand(ctx: CommandContext): Promise<void>;
+/**
+ * The device-code acquisition (§4.3/§1, RFC 8628), shared by `oh-hai login`, `oh-hai setup`, and the
+ * bare-`oh-hai` first-run onboarding (#271). Requests a device code, opens the human's browser to the
+ * approval URL (falling back to PRINTING it), prompts on STDERR (stdout stays reserved for the single
+ * `--json` envelope, §8), then polls until the human approves — storing the returned bearer under
+ * `<origin>|<agent id>`. The agent id comes FROM the token response (the human chose which agent to
+ * bind at approval time, in the browser), so this path needs no `--account`, unlike `--token-stdin`.
+ * `command` is the §8 envelope label the success reports under — "login" for `oh-hai login`, "setup"
+ * for the onboarding entrypoints — so `--json` automation dispatching on `command` stays consistent.
+ * Returns the AGENT ID the approved bearer was stored under (the one the human bound in the browser),
+ * so the onboarding caller can reconcile it against the resolver's precedence and give honest next steps.
+ */
+export declare function runDeviceCodeFlow(ctx: CommandContext, command?: string): Promise<string>;

package/dist/commands/login.js

@@ -9,6 +9,7 @@
 import { CliError, buildOk, serializeEnvelope } from "../envelope.js";
 import { originOf } from "../auth/resolve-token.js";
 import { sanitizeForTerminal } from "../terminal.js";
+import { isHttpUrl } from "../url.js";
 import { flagOn, parseCommandArgs } from "./flags.js";
 import { throwTransportError } from "./http.js";
 /** Per-request bound for each device-grant POST when no `--timeout`/`MA2H_TIMEOUT_MS` is set. It
@@ -36,7 +37,7 @@ export async function loginCommand(ctx) {
         await tokenStdinLogin(ctx);
     }
     else {
-        await deviceCodeLogin(ctx);
+        await runDeviceCodeFlow(ctx);
     }
 }
 /** `--token-stdin` (§4.3): read a bearer from stdin (local bootstrap / paste) and store it the same
@@ -54,19 +55,35 @@ async function tokenStdinLogin(ctx) {
     await storeAndReport(ctx, account, token);
 }
 /**
- * The bare `oh-hai login` device-code acquisition (§4.3/§1, RFC 8628). Requests a device code,
- * prompts on STDERR (stdout stays reserved for the single `--json` envelope, §8), then polls until
- * the human approves — storing the returned bearer under `<origin>|<agent id>`. The agent id comes
- * FROM the token response (the human chose which agent to bind at approval time), so this path
- * needs no `--account`, unlike `--token-stdin`.
+ * The device-code acquisition (§4.3/§1, RFC 8628), shared by `oh-hai login`, `oh-hai setup`, and the
+ * bare-`oh-hai` first-run onboarding (#271). Requests a device code, opens the human's browser to the
+ * approval URL (falling back to PRINTING it), prompts on STDERR (stdout stays reserved for the single
+ * `--json` envelope, §8), then polls until the human approves — storing the returned bearer under
+ * `<origin>|<agent id>`. The agent id comes FROM the token response (the human chose which agent to
+ * bind at approval time, in the browser), so this path needs no `--account`, unlike `--token-stdin`.
+ * `command` is the §8 envelope label the success reports under — "login" for `oh-hai login`, "setup"
+ * for the onboarding entrypoints — so `--json` automation dispatching on `command` stays consistent.
+ * Returns the AGENT ID the approved bearer was stored under (the one the human bound in the browser),
+ * so the onboarding caller can reconcile it against the resolver's precedence and give honest next steps.
  */
-async function deviceCodeLogin(ctx) {
+export async function runDeviceCodeFlow(ctx, command = "login") {
     const code = await requestDeviceCode(ctx);
-    // Prompt on stderr. `openUrl` prefers the one-click `verification_uri_complete` (embeds the code);
-    // the code is shown separately so a human copying the plain URL still knows what to enter. Both are
-    // sanitized of control characters first — they're server-supplied and echoed straight to the terminal.
-    ctx.io.err(`oh-hai: to authorize this device, open ${sanitizeForTerminal(code.openUrl)}`);
-    ctx.io.err(`oh-hai: and enter the code: ${sanitizeForTerminal(code.userCode)}`);
+    // Try to open the browser for the human first (#271 "platinum" onboarding — no copy-paste). The
+    // capability is optional and best-effort: `openBrowser` resolves false when it can't launch one
+    // (headless box, no opener), and every hermetic test omits it → the printed fallback below. `openUrl`
+    // prefers the one-click `verification_uri_complete` (embeds the code). All server-supplied strings are
+    // sanitized of control characters first — they're echoed straight to the terminal.
+    const opened = ctx.runtime.openBrowser !== undefined ? await ctx.runtime.openBrowser(code.openUrl) : false;
+    if (opened) {
+        ctx.io.err(`oh-hai: opened your browser to ${sanitizeForTerminal(code.openUrl)} — approve there.`);
+        // Still show the short code so the human can approve from ANOTHER device if the opened tab isn't
+        // where they're signed in.
+        ctx.io.err(`oh-hai: if it didn't open, enter this code there: ${sanitizeForTerminal(code.userCode)}`);
+    }
+    else {
+        ctx.io.err(`oh-hai: to authorize this device, open ${sanitizeForTerminal(code.openUrl)}`);
+        ctx.io.err(`oh-hai: and enter the code: ${sanitizeForTerminal(code.userCode)}`);
+    }
     ctx.io.err("oh-hai: waiting for approval…");
     // Poll budget: the server expires the code and returns `expired_token` at the real deadline; this
     // cap is a pure anti-infinite-loop guard against a server that never returns a terminal state.
@@ -83,8 +100,8 @@ async function deviceCodeLogin(ctx) {
         const res = await hubPost(ctx, "/auth/device/token", { device_code: code.deviceCode });
         if (res.status === 200) {
             const token = await readAccessToken(res);
-            await storeAndReport(ctx, token.agentId, token.accessToken);
-            return;
+            await storeAndReport(ctx, token.agentId, token.accessToken, command);
+            return token.agentId;
         }
         // The Hub's per-IP limiter throttles the shared device surface with HTTP 429 `rate_limited`
         // (+ Retry-After); a legit poller (e.g. behind a corporate NAT) can trip it mid-approval, so
@@ -122,14 +139,15 @@ async function deviceCodeLogin(ctx) {
     throw new CliError("timeout", "device authorization did not complete before the code expired; run `oh-hai login` again.");
 }
 /** Store the bearer Hub-scoped (§5.1) and report success. The token is NEVER in the output (§5.4);
- *  an existing token for this identity is overwritten silently (§4.3). Shared by both login paths. */
-async function storeAndReport(ctx, agentId, token) {
+ *  an existing token for this identity is overwritten silently (§4.3). Shared by both login paths and
+ *  the onboarding entrypoints — `command` labels the §8 success envelope ("login" / "setup"). */
+async function storeAndReport(ctx, agentId, token, command = "login") {
     const store = await ctx.runtime.openStore();
     await store.set(originOf(ctx.config.baseUrl), agentId, token);
     if (ctx.json) {
         // No token field, ever (§5.4). `storage` reports which backend actually holds it. The agent id
         // is emitted raw — JSON.stringify escapes any control character, so it can't reach the terminal.
-        ctx.io.log(serializeEnvelope(buildOk("login", { agent_id: agentId, base_url: ctx.config.baseUrl, storage: store.backendName })));
+        ctx.io.log(serializeEnvelope(buildOk(command, { agent_id: agentId, base_url: ctx.config.baseUrl, storage: store.backendName })));
     }
     else {
         // Sanitize the DISPLAYED agent id — on the device-code path it's server-supplied, so a hostile
@@ -251,16 +269,6 @@ function str(value) {
     const trimmed = value.trim();
     return trimmed === "" ? undefined : trimmed;
 }
-/** True when `value` parses as an http(s) URL — the only schemes we invite the user to open (§4.3). */
-function isHttpUrl(value) {
-    try {
-        const { protocol } = new URL(value);
-        return protocol === "http:" || protocol === "https:";
-    }
-    catch {
-        return false;
-    }
-}
 /** An integer from an unknown response field, clamped to `[min, max]`; `fallback` (already in range)
  *  is used when the value is missing or non-finite. Clamping means a missing, zero, fractional
  *  (floors to 0), negative, or absurdly large server-supplied `interval` / `expires_in` can never

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,4FAA4F;AAC5F,4FAA4F;AAC5F,0FAA0F;AAC1F,8FAA8F;AAC9F,gGAAgG;AAChG,kGAAkG;AAClG,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;qGAEqG;AACrG,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,mGAAmG;AACnG,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,oGAAoG;AACpG,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;+FAC+F;AAC/F,KAAK,UAAU,eAAe,CAAC,GAAmB;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,GAAmB;IAChD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE1C,mGAAmG;IACnG,oGAAoG;IACpG,uGAAuG;IACvG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0CAA0C,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChF,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAE5C,kGAAkG;IAClG,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7E,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,2BAA2B;IAC3B,IAAI,UAAU,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC7C,IAAI,WAAW,GAAG,UAAU,CAAC;IAE7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,WAAW,GAAG,UAAU,CAAC,CAAC,sEAAsE;QAChG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEvF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QAED,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACvE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,YAAY,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,uBAAuB;gBAC1B,SAAS,CAAC,mEAAmE;YAC/E,KAAK,WAAW;gBACd,UAAU,IAAI,sBAAsB,CAAC,CAAC,8CAA8C;gBACpF,WAAW,GAAG,UAAU,CAAC;gBACzB,SAAS;YACX,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;YACjE,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,2EAA2E,CAC5E,CAAC;YACJ;gBACE,+EAA+E;gBAC/E,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED;sGACsG;AACtG,KAAK,UAAU,cAAc,CAAC,GAAmB,EAAE,OAAe,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,+FAA+F;QAC/F,iGAAiG;QACjG,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,iBAAiB,CACf,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAClG,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,+FAA+F;QAC/F,6FAA6F;QAC7F,yDAAyD;QACzD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,mBAAmB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAWD;gDACgD;AAChD,KAAK,UAAU,iBAAiB,CAAC,GAAmB;IAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,4FAA4F;IAC5F,yGAAyG;IACzG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACrD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;QACnF,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;QAChH,gBAAgB,EAAE,UAAU,CAC1B,IAAI,CAAC,UAAU,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,CACvB;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAAC,GAAiB;IAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;2FAC2F;AAC3F,KAAK,UAAU,OAAO,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;IACrE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,0BAA0B,CAAC;KAChF,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;sCAEsC;AACtC,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACvC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,iBAAiB,CAC9B,GAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;oGAEoG;AACpG,SAAS,WAAW,CAAC,MAAc,EAAE,OAA2B;IAC9D,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC;IAChG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;2FAC2F;AAC3F,SAAS,gBAAgB,CAAC,WAAsC;IAC9D,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,GAAG,IAAI,CAAC;AAC3D,CAAC;AAED,oGAAoG;AACpG,SAAS,GAAG,CAAC,KAAc;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,uGAAuG;AACvG,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;sGAGsG;AACtG,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAC5E,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,4FAA4F;AAC5F,4FAA4F;AAC5F,0FAA0F;AAC1F,8FAA8F;AAC9F,gGAAgG;AAChG,kGAAkG;AAClG,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEhD;;qGAEqG;AACrG,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,mGAAmG;AACnG,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAErC,oGAAoG;AACpG,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,qGAAqG;AACrG,sGAAsG;AACtG,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AACvC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;+FAC+F;AAC/F,KAAK,UAAU,eAAe,CAAC,GAAmB;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;IACnC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,+FAA+F,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAmB,EAAE,OAAO,GAAG,OAAO;IAC5E,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE1C,gGAAgG;IAChG,gGAAgG;IAChG,sGAAsG;IACtG,uGAAuG;IACvG,mFAAmF;IACnF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3G,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kCAAkC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACnG,iGAAiG;QACjG,2BAA2B;QAC3B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qDAAqD,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0CAA0C,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAE5C,kGAAkG;IAClG,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7E,iGAAiG;IACjG,iGAAiG;IACjG,+FAA+F;IAC/F,2BAA2B;IAC3B,IAAI,UAAU,GAAG,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC7C,IAAI,WAAW,GAAG,UAAU,CAAC;IAE7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,WAAW,GAAG,UAAU,CAAC,CAAC,sEAAsE;QAChG,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEvF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,4FAA4F;QAC5F,6FAA6F;QAC7F,gGAAgG;QAChG,4FAA4F;QAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;YACvE,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,YAAY,CAAC,CAAC;YAC1E,SAAS;QACX,CAAC;QAED,+FAA+F;QAC/F,gGAAgG;QAChG,8FAA8F;QAC9F,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QACD,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,uBAAuB;gBAC1B,SAAS,CAAC,mEAAmE;YAC/E,KAAK,WAAW;gBACd,UAAU,IAAI,sBAAsB,CAAC,CAAC,8CAA8C;gBACpF,WAAW,GAAG,UAAU,CAAC;gBACzB,SAAS;YACX,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;YACjE,KAAK,eAAe;gBAClB,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,2EAA2E,CAC5E,CAAC;YACJ;gBACE,+EAA+E;gBAC/E,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,uFAAuF;IACvF,MAAM,IAAI,QAAQ,CAChB,SAAS,EACT,0FAA0F,CAC3F,CAAC;AACJ,CAAC;AAED;;iGAEiG;AACjG,KAAK,UAAU,cAAc,CAAC,GAAmB,EAAE,OAAe,EAAE,KAAa,EAAE,OAAO,GAAG,OAAO;IAClG,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5C,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,+FAA+F;QAC/F,iGAAiG;QACjG,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,iBAAiB,CACf,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAClG,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,+FAA+F;QAC/F,6FAA6F;QAC7F,yDAAyD;QACzD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,mBAAmB,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAWD;gDACgD;AAChD,KAAK,UAAU,iBAAiB,CAAC,GAAmB;IAClD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,UAAU,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,4FAA4F;IAC5F,yGAAyG;IACzG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACrD,OAAO;QACL,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe;QACnF,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,oBAAoB,CAAC;QAChH,gBAAgB,EAAE,UAAU,CAC1B,IAAI,CAAC,UAAU,EACf,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,CACvB;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,eAAe,CAAC,GAAiB;IAC9C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;2FAC2F;AAC3F,KAAK,UAAU,OAAO,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;IACrE,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC1B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,0BAA0B,CAAC;KAChF,CAAC;IACF,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;sCAEsC;AACtC,KAAK,UAAU,QAAQ,CAAC,GAAiB;IACvC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAChC,OAAO,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAC5E,CAAC,CAAE,MAAkC;YACrC,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,KAAK,UAAU,iBAAiB,CAC9B,GAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;oGAEoG;AACpG,SAAS,WAAW,CAAC,MAAc,EAAE,OAA2B;IAC9D,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,MAAM,GAAG,CAAC;IAChG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;2FAC2F;AAC3F,SAAS,gBAAgB,CAAC,WAAsC;IAC9D,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,GAAG,IAAI,CAAC;AAC3D,CAAC;AAED,oGAAoG;AACpG,SAAS,GAAG,CAAC,KAAc;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED;;;sGAGsG;AACtG,SAAS,UAAU,CAAC,KAAc,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAC5E,MAAM,CAAC,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7F,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC"}

package/dist/commands/messaging/identity.d.ts

@@ -22,6 +22,15 @@ export declare function resolveSubmitIdentity(ctx: CommandContext): Promise<{
  *  + the submitter-bound bearer). Uses `resolveIdentity` so a zero-config single stored identity is
  *  discovered for the token lookup. A missing token is an auth error (exit 3). */
 export declare function requireToken(ctx: CommandContext): Promise<string>;
+/** The bearer PLUS the resolved agent id, for `inbox watch`: the token drains the mailbox, while the
+ *  agent id keys the concurrent-drain lock (the mailbox is scoped to the AGENT, not the bearer — one
+ *  agent can hold several tokens, #323). `account` may be undefined (an env token with no
+ *  `MA2H_AGENT_ID`, or an ambiguous store) — the caller degrades the guard to "unavailable" then,
+ *  never keying on the token. A missing token is still an auth error (exit 3). */
+export declare function requireWatchIdentity(ctx: CommandContext): Promise<{
+    token: string;
+    agentId: string | undefined;
+}>;
 /** The bearer for an `--envelope` replay. The captured envelope already carries the submitting
  *  `agent.id`, so fall back to it for the store lookup when no explicit `--account` was given —
  *  otherwise a user with a stored login but no `default_account` following the replay example

package/dist/commands/messaging/identity.js

@@ -49,6 +49,27 @@ export async function requireToken(ctx) {
     }
     return token;
 }
+/** The bearer PLUS the resolved agent id, for `inbox watch`: the token drains the mailbox, while the
+ *  agent id keys the concurrent-drain lock (the mailbox is scoped to the AGENT, not the bearer — one
+ *  agent can hold several tokens, #323). `account` may be undefined (an env token with no
+ *  `MA2H_AGENT_ID`, or an ambiguous store) — the caller degrades the guard to "unavailable" then,
+ *  never keying on the token. A missing token is still an auth error (exit 3). */
+export async function requireWatchIdentity(ctx) {
+    const store = ctx.config.tokenSource === "env" ? undefined : await ctx.runtime.openStore();
+    const { token, account } = await resolveIdentity(ctx.config, store);
+    if (token === undefined) {
+        throw new CliError("auth", NOT_AUTHENTICATED);
+    }
+    // The lock key must be the agent that OWNS this bearer. In the store-backed path the token was looked
+    // up BY the agent id (or discovered as the sole stored identity), so the two are bound. But an ENV
+    // token is not bound to config: an account from a machine default (`default_account` or a directory
+    // binding) may name a DIFFERENT agent than the env bearer — locking on it would guard the wrong agent
+    // while draining another's mailbox. So alongside an env token, only trust an EXPLICITLY-supplied agent
+    // id (`--account` / `MA2H_AGENT_ID`); otherwise leave it undefined so the guard degrades to a warning.
+    const explicit = ctx.config.accountSource === "flag" || ctx.config.accountSource === "env";
+    const agentId = ctx.config.tokenSource === "env" && !explicit ? undefined : account;
+    return { token, agentId };
+}
 /** The bearer for an `--envelope` replay. The captured envelope already carries the submitting
  *  `agent.id`, so fall back to it for the store lookup when no explicit `--account` was given —
  *  otherwise a user with a stored login but no `default_account` following the replay example

package/dist/commands/messaging/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/commands/messaging/identity.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,+FAA+F;AAC/F,2FAA2F;AAC3F,gGAAgG;AAChG,iGAAiG;AAEjG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,2FAA2F;AAC3F,MAAM,iBAAiB,GAAG,oFAAoF,CAAC;AAE/G;;;;;;4BAM4B;AAC5B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,eAAwB;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACxG,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;sGAMsG;AACtG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAmB;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;kFAEkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;kFAGkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAmB,EAAE,eAAuB;IACnF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/commands/messaging/identity.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,+FAA+F;AAC/F,2FAA2F;AAC3F,gGAAgG;AAChG,iGAAiG;AAEjG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,2FAA2F;AAC3F,MAAM,iBAAiB,GAAG,oFAAoF,CAAC;AAE/G;;;;;;4BAM4B;AAC5B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAmB,EAAE,eAAwB;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,MAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;IACxG,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;sGAMsG;AACtG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAmB;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;kFAEkF;AAClF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;kFAIkF;AAClF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAmB;IAC5D,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,sGAAsG;IACtG,mGAAmG;IACnG,oGAAoG;IACpG,sGAAsG;IACtG,uGAAuG;IACvG,uGAAuG;IACvG,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC;IAC3F,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACpF,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED;;;kFAGkF;AAClF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAmB,EAAE,eAAuB;IACnF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/commands/messaging/validate.d.ts

@@ -16,14 +16,15 @@ export declare function isActor(value: string): value is Actor;
 export declare function normalizePushUrl(raw: string): string;
 /** Parse `value:label` (label may itself contain ':'). Throws a usage CliError on a bad shape. */
 export declare function parseOption(raw: string): ResponseOption;
-/** A task/ask is resolvable only when allowed_resolvers names ≥1 concrete `human:<id>` — the
- *  resolve route is human-only and fail-closed (spec §5.4), so a message with none (or only
- *  agent:/system: resolvers) can never be marked done and sits open until expiry. */
+/** True when allowed_resolvers names ≥1 `human:<id>`. The Hub always lets the account OWNER resolve
+ *  (issue #366) — an omitted/empty list is owner-only, and a non-owner human may resolve only if
+ *  explicitly listed (fail-closed, spec §5.4). Callers use this to nudge when the ONLY resolvers
+ *  given are non-human: the resolve route is human-only, so such a list narrows to the owner alone. */
 export declare function hasHumanResolver(resolvers: readonly unknown[] | undefined): boolean;
 /** Stricter than `hasHumanResolver`: requires ≥1 `human:<id>` with a CONCRETE (non-wildcard,
  *  non-empty) id. The Hub matches allowed_resolvers literally (`allowed.includes(actor)`), so a
- *  captured `human:*` can never match any real actor — the replay guard must reject it exactly as
- *  the compose path does, or the replayed ask/task is submitted unresolvable. */
+ *  captured `human:*` can never match any real actor — the replay callers use this to note (and
+ *  proceed) that only the account owner will be able to resolve the replayed ask/task. */
 export declare function hasConcreteHumanResolver(resolvers: readonly unknown[] | undefined): boolean;
 /** Read the `--envelope` source: inline JSON, `@<path>` (local file), or `@-` (stdin, via the
  *  injected reader so tests never touch fd 0). */

package/dist/commands/messaging/validate.js

@@ -6,6 +6,7 @@
 // so tests stay hermetic.
 import { readFileSync } from "node:fs";
 import { CliError } from "../../envelope.js";
+import { isHttpUrl } from "../../url.js";
 export const PRIORITIES = ["low", "normal", "high", "urgent"];
 export const REQUEST_MODES = ["select", "input", "confirm"];
 export const CALLBACK_MODES = ["pull", "push"];
@@ -23,17 +24,6 @@ export function isCallbackMode(value) {
 export function isActor(value) {
     return /^(human|agent|system):[^\s]+$/.test(value);
 }
-/** True when `raw` parses as an http(s) URL — the only schemes the Hub's SSRF delivery guard
- *  accepts for a push callback, so a mailto:/file: url would silently lose the push. */
-function isHttpUrl(raw) {
-    try {
-        const u = new URL(raw);
-        return u.protocol === "http:" || u.protocol === "https:";
-    }
-    catch {
-        return false;
-    }
-}
 /** Normalize a push `--callback-url` to the canonical WHATWG href the Hub signs and `fetch` POSTs
  *  to (so the signed callback_url can't desync from the delivery URL), and enforce http(s) — the
  *  Hub's SSRF delivery guard rejects every other scheme, so a mailto:/file: url would pass
@@ -63,16 +53,17 @@ export function parseOption(raw) {
     }
     return { value, label };
 }
-/** A task/ask is resolvable only when allowed_resolvers names ≥1 concrete `human:<id>` — the
- *  resolve route is human-only and fail-closed (spec §5.4), so a message with none (or only
- *  agent:/system: resolvers) can never be marked done and sits open until expiry. */
+/** True when allowed_resolvers names ≥1 `human:<id>`. The Hub always lets the account OWNER resolve
+ *  (issue #366) — an omitted/empty list is owner-only, and a non-owner human may resolve only if
+ *  explicitly listed (fail-closed, spec §5.4). Callers use this to nudge when the ONLY resolvers
+ *  given are non-human: the resolve route is human-only, so such a list narrows to the owner alone. */
 export function hasHumanResolver(resolvers) {
     return (resolvers ?? []).some((r) => typeof r === "string" && r.startsWith("human:"));
 }
 /** Stricter than `hasHumanResolver`: requires ≥1 `human:<id>` with a CONCRETE (non-wildcard,
  *  non-empty) id. The Hub matches allowed_resolvers literally (`allowed.includes(actor)`), so a
- *  captured `human:*` can never match any real actor — the replay guard must reject it exactly as
- *  the compose path does, or the replayed ask/task is submitted unresolvable. */
+ *  captured `human:*` can never match any real actor — the replay callers use this to note (and
+ *  proceed) that only the account owner will be able to resolve the replayed ask/task. */
 export function hasConcreteHumanResolver(resolvers) {
     return (resolvers ?? []).some((r) => {
         if (typeof r !== "string" || !r.startsWith("human:"))

package/dist/commands/messaging/validate.js.map

@@ -1 +1 @@
-{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/commands/messaging/validate.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,wFAAwF;AACxF,4FAA4F;AAC5F,yFAAyF;AACzF,gGAAgG;AAChG,0BAA0B;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAG7C,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAGxD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAQ,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;kGACkG;AAClG,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;wFACwF;AACxF,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,sCAAsC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,uEAAuE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,wCAAwC,GAAG,GAAG,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,6DAA6D,GAAG,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;qFAEqF;AACrF,MAAM,UAAU,gBAAgB,CAAC,SAAyC;IACxE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;iFAGiF;AACjF,MAAM,UAAU,wBAAwB,CAAC,SAAyC;IAChF,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;kDACkD;AAClD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,SAAgC;IACjF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,EAAE,CAAC;IACrC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6FAA6F;YAC7F,qFAAqF;YACrF,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,mFAAmF,CAAC,CAAC;IACjH,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,6DAA6D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC/G,IAAI,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACtE,CAAC;IACD,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,QAAQ,GAAI,OAAmC,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAI,QAAoC,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,GAAG,GAAI,QAAoC,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,uDAAuD,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,kEAAkE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED;wFACwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,oFAAoF,CAAC,CAAC;IAClH,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,8DAA8D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC/G,IAAI,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oGAAoG,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAI,MAAkC,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAI,QAAoC,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,GAAG,GAAI,QAAoC,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,uDAAuD,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,iEAAiE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IACD,OAAO,KAAoB,CAAC;AAC9B,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,eAAe,CAAC,QAAkC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC5E,MAAM,SAAS,GAAI,MAA0C,CAAC,iBAAiB,CAAC;IAChF,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,OAAe;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../../src/commands/messaging/validate.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,wFAAwF;AACxF,4FAA4F;AAC5F,yFAAyF;AACzF,gGAAgG;AAChG,0BAA0B;AAE1B,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnF,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,MAAM,CAAU,CAAC;AAGxD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAQ,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC;AACD,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAQ,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;kGACkG;AAClG,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,OAAO,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;;4FAG4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,sCAAsC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAChE,MAAM,IAAI,QAAQ,CAChB,OAAO,EACP,uEAAuE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,wCAAwC,GAAG,GAAG,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,6DAA6D,GAAG,GAAG,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;uGAGuG;AACvG,MAAM,UAAU,gBAAgB,CAAC,SAAyC;IACxE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;0FAG0F;AAC1F,MAAM,UAAU,wBAAwB,CAAC,SAAyC;IAChF,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;kDACkD;AAClD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,SAAgC;IACjF,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,EAAE,CAAC;IACrC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6FAA6F;YAC7F,qFAAqF;YACrF,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,8BAA8B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;8DAE8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,mFAAmF,CAAC,CAAC;IACjH,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,6DAA6D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC/G,IAAI,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC;IACtE,CAAC;IACD,8FAA8F;IAC9F,wFAAwF;IACxF,MAAM,QAAQ,GAAI,OAAmC,CAAC,UAAU,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,IAAI,GAAI,QAAoC,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,GAAG,GAAI,QAAoC,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,uDAAuD,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,kEAAkE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED;wFACwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,oFAAoF,CAAC,CAAC;IAClH,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,8DAA8D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IAC/G,IAAI,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oGAAoG,CAAC,CAAC;IACpI,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,oCAAoC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,qCAAqC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAI,MAAkC,CAAC,UAAU,CAAC,CAAC;IACjE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,8CAA8C,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,IAAI,GAAI,QAAoC,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,GAAG,GAAI,QAAoC,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,uDAAuD,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,iEAAiE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IACD,OAAO,KAAoB,CAAC;AAC9B,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,eAAe,CAAC,QAAkC;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC5E,MAAM,SAAS,GAAI,MAA0C,CAAC,iBAAiB,CAAC;IAChF,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc,EAAE,OAAe;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC"}